Air Interface PDF

Air Interface Siemens
Air Interface
Contents
1 Channel Structure and Layer Model 3
1.1 Air Interface Channels 4
1.2 Signaling Architecture 8
1.3 Framing of Messages 10
1.4 Layer 2 Connections 16
2 Call Sequences 19
2.1 Radio Resource Management 20
2.2 Mobility Management 30
2.3 Connection Management 38
2.4 RR-, MM- and CM-Connection(s) 46
2.5 Complete Sequences 48
3 Formatting Rules 67
4 Exercises 83
5 Solutions 89
TM3101EU02TM_0001
1
2003 Siemens AG
Siemens Air Interface
2 TM3101EU02TM_0001
2003 Siemens AG
1 Channel Structure and Layer Model
Air Interface
Fig. 1
TM3101EU02TM_0001
3
2003 Siemens AG
1.1 Air Interface Channels

SSS specialists require supplementary knowledge of the air interface for 2 reasons:
1. Procedures in the air interface (e.g. incoming and outgoing calls, Handover) have
far-reaching consequences for events in the SSS.
2. With the DTAP (Direct Transfer Application Part) at the A-interface, messages
are transmitted from the air interface directly to the MSC, and from the MSC
directly to the air interface.
Nevertheless, this document will limit its description of channel structure and layer
model to the features essential to an understanding of the air interface procedures.
The specialized literature (in particular GSM Guidelines 05.01 to 05.08) should be
consulted for details.
As is generally known, time division multiplexing and frequency division multiplexing
techniques are employed in the air interface, whereby the uplink (MS BTS) and
downlink (BTS MS) frequencies differ by a fixed amount. Furthermore, it must be
noted that, to avoid mutual interference, two adjacent cells are not permitted to
employ the same frequencies. Accordingly the number of channels available in the
air interface depends on the number of adjacent cells.
The channels are subdivided according to channel types. Channels of the same
type have the same attributes. The channel types are described in GSM Guideline
04.03.
A distinction is made between Traffic Channel (TCH) and Control Channel (CCH).
Control channels carry the signaling. There are various types of such signaling
channels. Some like the traffic channel are available in full-duplex operation; others
are operated only uplink or only downlink.
The control channels are divided into the following categories: Broadcast Control
Channel (BCCH), Common Control Channel (CCCH) and Dedicated Control
Channel (DCCH). The BCCH and CCCH are used jointly by all Mobile Stations in the
relevant cell, whilst the DCCH like the TCH are allocated individually to the single
Mobile Stations. This allocation takes place for the handling of a specific call
processing procedure (e.g. call set up or location update); once the DCCH has
fulfilled its purpose, it is released once again.
4 TM3101EU02TM_0001
2003 Siemens AG
Channel
Traffic Channel (TCH) TD/FD multiplexing
User information Control Channel (CCH)
(speech, data) Signaling
Broadcast Control Common Control Dedicated Control

Channel (BCCH) Channel (CCCH) Channel (DCCH)
Information for all MS Special applications Assigned to a specific MS
Slow Associated Dedicated

Paging Channel (PCH)
Control Channel (SACCH)
Subscriber Paging
Assigned to each TCH or SDCCH
Access Grant Channel Fast Associated Dedicated

(AGCH) Control Channel (FACCH)
Initial Assignment of a DCCH Assigned to each TCH
Random Access Channel Stand-Alone Dedicated

(RACH) Control Channel (SDCCH)
Request for of a DCCH As long as no TCH is assigned
Fig. 2 Air Interface Channels (GSM 04.03)
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
5
2003 Siemens AG
The BSS conveys in the broadcast control channel information, which is important for
all stations in the cell. Such information includes:
z the valid location area identity (LAI)
z the network to which the Base Station belongs
z specification of all channels available in this cell and in the adjacent cells etc..
Accordingly, the BCCH is operated only downlink.

The common control channels are used to handle special tasks. The following
applications exist:
z Random Access Channel (RACH), in which a Mobile Station so far not allocated
a DCCH can request the allocation of the latter. The RACH operates uplink only.
z Access Grant Channel (AGCH), in which the Base Station allocates an initial
DCCH to a Mobile Station on request (in the RACH). The AGCH operates
downlink only.
z Paging Channel (PCH), in which the Base Station performs the paging
(searching) of subscribers. The PCH operates downlink only.
The dedicated control channels are always operated uplink and downlink (duplex
mode). Here there are Stand-Alone Dedicated Control Channels (SDCCH), as well
as other dedicated control channels with fixed assignment to other channels, namely
the Associated Control Channels (ACCH). Depending on the ACCH bit rate, a
distinction is made between Fast Associated Control Channels (FACCH) and Slow
Associated Control Channels (SACCH). One slow associated control channel
(SACCH) is assigned to each traffic channel (TCH) and each Stand-Alone dedicated
control channel (SDCCH) respectively. Each traffic channel (TCH) is additionally
allocated one fast associated control channel (FACCH).
As long as no traffic channel (TCH) is assigned to the Mobile Station, the signaling
procedures described in the sections below take place in the Stand-Alone Dedicated
Control Channel (SDCCH). When a TCH is allocated, signaling switches to the Fast
Associated Control Channel (FACCH). The Slow Associated Control Channels
(SACCH) assigned to the SDCCH and TCH are used in the uplink direction mainly for
the ongoing transmission of the results obtained in measurements by which the MS
determines the reception power and quality of the surrounding Base Stations. During
a call, these measurement results supply the network with a criterion for deciding
when to initiate a Handover. In the downlink direction, the SACCH extend the
function of the broadcast channels (BCCH) by transporting from the Base Station
additional system information which is relevant for all Mobile Stations in the
associated cell.
6 TM3101EU02TM_0001
2003 Siemens AG
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
7
2003 Siemens AG
1.2 Signaling Architecture

The 7-layered OSI model (in conformity with ITU-CCITT recommendations X.200 and
X.210) will be used to describe procedures on the air interface. Layers 1, 2 and 3 are
especially relevant for signaling.
Layer 1 (Physical Layer) defines the manner in which information is conveyed in the
available channels. Furthermore, the layer 1 protocols define the Mobile Station's
search for a suitable BCCH and the seizure of a DCCH through the MS (after
allocation by the Base Station). GSM Guideline 04.04 should be referred to for
details; here it is sufficient to state that in all control channels (CCH) except for the
random access channel (RACH) the information is transmitted in 23-byte blocks. In
order to minimize interference caused by the overlay of simultaneous requests, the
RACH conveys blocks merely 1 byte in length.
Layer 2 (Data Link Layer) defines the structure of the 23-byte blocks in the CCH, and
in particular the numbering and acknowledgment of the blocks. As this has some
consequences for layer 3, this will be dealt with briefly in the following pages.
Layer 3 (Network Layer) is concerned with the actual contents of the signaling
messages. The special attributes of the air interface require the subdivision of the
layer into three sub-layers, whereby each signaling message belongs to one, and
only one, of these sub-layers.
Radio Resource Management (RR), the lowest of these sub-layers, is concerned
with the set up, operation and cleardown of a logical connection on a DCCH (in
particular SDCCH and FACCH).
Mobility Management (MM), the middle sub-layer, handles those procedures which,
although necessary for operating the Mobile Station, are only indirectly connected
with the actual call set up and cleardown. Location update and authentication must
be especially mentioned in this context.
Connection Management (CM), the highest sub-layer, is in turn divided into three
parts. However, this division is not hierarchic; the sub-layer is divided into three
equivalent MM users. These three parts are Call Control (CC), Supplementary
Service Support (SSS) and Short Message Service (SMS).
8 TM3101EU02TM_0001
2003 Siemens AG
CM CM
BSSMAP
MM MM
MAP
BSSMAP
ISUP
DTAP DTAP
RR
RR
BSSAP BSSAP TCAP
RR BTSM BTSM SCCP SCCP SCCP
LAPDm LAPDm LAPD LAPD

MTP MTP MTP
TDMA TDMA
G.703,... G.703,...
FDMA FDMA
MS BTS BSC MSC

Um Abis A B,C,E
Fig. 3 Air Interface Signaling Architecture
Supplementary
Short Message
Services
Call Control (CC) Service
Support
(SMS)
(SSS)
Connection Management (CM)
Network Layer
Mobility Management (MM)
Radio Resource Management (RR)
Data Link Layer LAPDm
Physical Layer TDMA / FDMA
Fig. 4 Network Layer of the Air Interface
TM3101EU02TM_0001
9
2003 Siemens AG
1.3 Framing of Messages

The structure of a 23-byte transmission block in the SDCCH, FACCH, PCH, AGCH or
BCCH is shown in the adjacent figure. (The block structure in SACCH deviates
slightly from the illustration, whilst a block in the RACH consists of only one byte).
A block of this type (known also as layer 2 frame) begins with an address field (1
byte), a control field (1 byte) and a length indicator (1 byte). The subsequent
information field contains the layer 3 data. If the 20 bytes available for this data are
not completely used, the residual bytes are filled with the fill bit pattern "00101011"
("11111111" also permissible in uplink direction) in order to attain a total length of 23
bytes.
Address field contents:
z Link Protocol Discriminator (LPD) for discriminating between the GSM protocol
and other protocols (national or manufacturer-specific)
z Service Access Point Identifier (SAPI) for discriminating between short message
service (SMS) and other layer 3 parts (RR, MM, CC or SSS) in the information
field. (A special layer 3 format is used for SMS, and the SMS messages are
numbered independently of the other messages in the control field).
z Command/Response Field bit (C/R) for discriminating between commands
(messages transmitted on own initiative) and responses (reactions to received
commands).
The control field is used to number and acknowledge the frames. Its structure is
shown in the next figure.
The length indicator specifies the length in bytes of the information field. The indicator
additionally contains the More Data bit (M) specifying whether the layer 3 message
extends to the follow-on layer 2 frame. It may be the case that a layer 3 message is
longer than 20 bytes and must therefore be distributed over several layer 2 frames. In
this case, the last frame is transmitted with M = 0 and all preceding frames with M = 1
("Continuation in the next issue"). If the layer 3 messages fits into one layer 2 frame,
the More-Data bit of the latter is set to 0 ("End").
10 TM3101EU02TM_0001
2003 Siemens AG
1 Address Field
LPD SAPI C/R
2 Control Field
LAPDm frame type
3 Length M Length Indicator
Layer 3 Information
(if SAPI = 0)
Information Field
n
Fill bits
23
Fig. 5 Structure of a Layer 2 frame (acc. to GSM 04.06)
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
11
2003 Siemens AG
1.3.1 LAPDm Frame Types

The control field differentiates the following three frame types:
z Information Frames (I-frames)
z Supervisory Frames (S-frames)
z Unnumbered Frames (U-frames)
Information frames. are used for error-protected message transmission. "Error

protection" means in this context that the messages are individually numbered and
acknowledged, thus allowing the receiver the opportunity to request a repeat
transmission in the event of a transmission error or reception fault. Accordingly, the
control field in the I-frame contains one send number N(S) and one reception number
N(R), each 3 bits in length. The send number numbers consecutively all I-frames
running in the same direction on one CCH, whereby short message service (SMS)
messages and other layer 3 part messages are counted separately. The reception
number specifies which I-frame is next expected in the counter direction; thus, the
number is that of the last correctly-received I-frame + 1. I-frames are always
commands and always include an information field.
Supervisory frames are identified by the bit combination "01" in the two least
significant bits in the control field. These frames are used for acknowledgment of
received information frames without simultaneously supplying new information.
Therefore, the S-frame control fields have only a reception number N(R) indicating
the next anticipated I-frame in the counter direction. Three types of S-frame are
distinguished:
z Receive Ready (RR): positive acknowledgment in normal operation
z Receive Not Ready (RNR): positive acknowledgment simultaneously declaring
that due to overload no further I-frames can currently be accepted.
z Reject (REJ): negative acknowledgment (i.e. repeat request)
Supervisory frames can occur as commands or responses; they never include an
information field.
12 TM3101EU02TM_0001
2003 Siemens AG
Information Frame (I-frame)

Reliable message transmission with acknowledgment
mechanism
Supervisory Frame (S-frame)

Acknowledgment of I-frames without further information
Unnumbered Frame (U-frame)

Setup and cleardown of layer-2 connections
Fig. 6 LAPDm Frame types
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
13
2003 Siemens AG
Unnumbered frames. These frames contain like their name suggests neither a send
number nor reception number. The frames are not acknowledged, therefore, and the
receiver cannot request a retransmission. A distinction is made between the following
types of unnumbered frames:
z Set Asynchronous Balanced Mode (SABM): layer 2 connection set up

z Disconnect (DISC): layer 2 connection cleardown
z Unnumbered acknowledge (UA): positive acknowledgment for SABM and DISC
z Disconnect Mode (DM): negative acknowledgment for SABM; is also used in
cases where an I-frame or S-frame arrives without a layer 2 connection having
been established
z Unnumbered Information (UI): transmission of an information field without layer 2
connection.
SABM, DISC and UI are commands; UA and DM are responses. An information field
is always included in the UI, but never in the DISC or DM. SABM and UA may
optionally contain an information field.
As layer 2 connections exist only in the SDCCH and FACCH, UI-frames are used
exclusively in the BCCH, AGCH, PCH and SACCH.
TIP
The P, F or P/F bits 3 are known as poll bits in commands and final bits in responses.
Their standard value is 0. By transmitting a command with P = 1, one side (MS or
BSS) can specially request the opposite side to send a response labeled with F = 1.
This polling method is used for set up and cleardown of the layer 2 connection
(SABM or DISC with P = 1, UA with F = 1). The BSS likewise polls the MS to
ascertain whether the latter is still accessible. Polling is additionally used when one
side reports overload with RNR: the opposite side regularly queries (command RR
with P = 1) whether the overload still exists (response RNR with F = 1) or not
(response RR with F = 1).
14 TM3101EU02TM_0001
2003 Siemens AG
Frame Format bit pattern Command Inform.

Response Field
I N(R) P N(S) 0 Command yes
RR N(R) P/F 0 0 0 1 both no
S RNR N(R) P/F 0 1 0 1 both no
REJ N(R) P/F 1 0 0 1 both no
SABM 0 01 P 1 1 1 1 Command possible
DM 0 00 F 1 1 1 1 Response no
U UI 0 00 P 0 0 1 1 Command yes
DISC 0 10 P 0 0 1 1 Command no
UA 0 11 F 0 0 1 1 Response possible
Fig. 7 LAPDm Frame types and formats (GSM 04.06)
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
15
2003 Siemens AG
1.4 Layer 2 Connections

If information frames and supervisory frames are exchanged between MS and BSS in
a CCH, a layer 2 connection is said to exist in this CCH (FACCH or SDCCH). The set
up of such a layer 2 connection means that both sides allocate storage space for the
valid send and reception numbers as well as for the buffering of as yet unacknow-
ledged I-frames, which must possibly be retransmitted. This storage space is releas-
ed when the layer 2 connection is cleared down.
Layer 2 connection set up and cleardown

A layer 2 connection is always set up by the transmission of a SABM command in
which a poll bit is set to 1 (P = 1), whereupon the opposite side answers with a UA
response in which a final bit is set to 1 (F = 1). If this SABM command contains an
information field, the term contention resolution procedure is used; otherwise the set
up is referred to as a normal set up procedure. Contention resolution can only be
used by the Mobile Station, whereas both sides (MS or BSS) can initiate the normal
set up procedure.
The normal cleardown procedure for layer 2 connections consists of one of the two
sides (MS or BSS) sending a DISC command in which a poll bit is set to 1 (P = 1)
and the opposite side answers with a UA response in which a final bit is set to 1 (F =
1). Apart from the normal procedure, there is the local cleardown of a layer 2
connection; here, both sides view the connection as ended without explicit message
exchange and release the resources. The local cleardown is applied if it is obvious,
due to the procedures in layer 3, that the layer 2 connection is no longer required.
One example is Handover: after Handover completion, it is clear to both mobile and
Base Station that the layer 2 connection on the FACCH of the previous TCH is no
longer required. Thus, both sides can release the resources for this connection
without conversing per message exchange.
TIP
SMS messages utilize a different layer 2 connection than signaling, therefore two in-
dependent layer 2 connections can exist in the same CCH. One layer 2 connection
for SMS and another one for all other layer 3 signaling messages.
TIP
For all further details of the layer 2 protocol, please refer to GSM Guideline 04.06.
16 TM3101EU02TM_0001
2003 Siemens AG
Layer 2 connections are the basis for the exchange of

signaling messages in the SDCCH/FACCH
Normal setup (SABM and UA commands)

Contention resolution (SABM with information field and UA)
Normal cleardown (DISC and UA commands)

Local cleardown (Determined by layer 3 messages, no further
commands)
RR MM CM
Layer 2 connection
Fig. 8 Layer 2 connections
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
17
2003 Siemens AG
18 TM3101EU02TM_0001
2003 Siemens AG
2 Call Sequences
TM3101EU02TM_0001
19
2003 Siemens AG
2.1 Radio Resource Management

Radio resource management (RR), the lowest sub-layer of layer 3, is responsible for
the selection, seizure and release of the signaling channels (CCH) of the air
interface. An RR connection is said to exist between a Mobile Station and Base
Station if the following conditions are met:
z The Mobile Station is allocated
a) either a Stand-Alone dedicated control channel (SDCCH) with slow
associated control channel (SACCH),
b) or a traffic channel (TCH Bm or Lm, or two Lm) with one fast and one slow
associated channel (FACCH and SACCH).
z A layer 2 connection for messages (i.e. not for the short message service but for
RR, MM, CC and SSS messages) exists in the SDCCH or FACCH.
The channel in which the layer 2 connection exists is termed the main dedicated
control channel (main DCCH).
An RR connection is a prerequisite for the work of all higher sub-layers of layer 3.
Even a layer 2 connection for SMS can only be established if an RR connection has
been set up previously.
More than one RR connection cannot exist simultaneously for one Mobile Station. It
is possible, however, to change from one RR connection to another without affecting
the higher sub-layers of layer 3. One example of this is the allocation of a traffic
channel (TCH) during a call set up: the previous RR connection in the SDCCH is
replaced by an RR connection in the FACCH but the MM and CC procedures are not
affected.
Both the Mobile Station and the Base Station are able to set up an RR connection in
a stand alone dedicated control channel (SDCCH).
If the Mobile Station initiates the set up (e.g. mobile originating call [MOC] or location
update), it first requests a SDCCH in the RACH. The "Channel Request" message
used by the MS is 1 byte in length and includes the reason for the setup (e.g. loc.
update, normal MOC, emergency call) and a random reference. The message is
repeated at random intervals (each time with a new random reference) since the
possibility cannot be ruled out that a different Mobile Station has simultaneously
requested a control channel and one request has overlaid the other.
20 TM3101EU02TM_0001
2003 Siemens AG
RR procedures (GSM04.08)
RR connection setup by the Mobile Station
RACH Channel Request

(Reason, Random Reference)
UI (Immediate Assignment) AGCH

(Request Reference, SDCCH-No.)
SDCCH SABM ( ... )
UA SDCCH
Fig. 9 RR connection setup by the Mobile Station
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
21
2003 Siemens AG
On reception of "Channel Request" in the RACH, the Base Station selects an idle
SDCCH and allocates it to the Mobile Station with the message "Immediate
Assignment". The message is sent in the AGCH and is located in the information field
of a UI. The received random reference of the Mobile Station as well as the channel
number of the selected SDCCH are included as parameters.
When the Mobile Station receives the "Immediate Assignment" and recognizes its
random reference (from one of the last three "Channel Request" messages), it seizes
the SDCCH and associated SACCH, then immediately sets up with SABM a layer 2
connection in the SDCCH. In doing so, the MS uses the contention resolution
procedure, i.e. the SABM contains an information field with a layer 3 message
indicating the reason for the RR connection set up (e.g. "Location Update Request"
or "MOC Request"). Once the Base Station has responded with "UA", the RR
connection set up is complete.
The set up of the RR connection for a mobile terminating call (MTC), or for a mobile
terminated short message service, is initiated by the Base Station. The BS pages, i.e.
it transmits in the PCH a UI with the layer 3 message "Paging Request" in its
information field. The message includes the identity of the called subscriber (normally
the TMSI).
When the Mobile Station recognizes the identity (TMSI), it requests a channel by
means of a "Channel Request" with random reference in the RACH; the reason is
"Answer to paging". The Base Station responds with "Immediate Assignment", which
includes the received random reference as well as the channel number of the
selected SDCCH. The Mobile Station then sets up a layer 2 connection with the
contention resolution procedure, whereby the message "Paging Response", along
with the TMSI as parameter, is placed in the information field of the SABM. As soon
as the Base Station has responded with "UA", the RR connection set up is complete.
22 TM3101EU02TM_0001
2003 Siemens AG
RR Procedures (GSM 04.08)
RR connection setup by the Base Station
UI (Paging Request) PCH

(Mobile Identity)

(Reason = Answer to Paging, Random Reference)

SDCCH SABM ( Paging Response )

(Mobile Identity)
UA SDCCH
Fig. 10 RR-connection setup by the Base Station
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
23
2003 Siemens AG
For obvious reasons, the messages discussed so far are transmitted in non-coded
form. On activation of ciphering, the entire bit stream of the channel configuration for
the relevant MS is enciphered, and this coding is retained even if the channel
configuration changes. As enciphering has direct consequences for channel
operation, it is assigned to Radio Resource Management.
Ciphering is always activated by the Base Station; to do so, the latter sends the (non-
enciphered) message "Ciphering Mode Command" in the information field of an I-
frame. To counteract deciphering by unauthorized listeners, the message is not
permitted to contain the cipher key as a parameter. Instead, the key must already be
known to both partners (generally from the last authentication).
Once the Base Station has sent the "Ciphering Mode Command", it immediately
switches the receive direction of the relevant channel configuration to deciphering.
On receiving the "Cipher Mode Command", the Mobile Station for its part switches
the transmit direction of its channel configuration to ciphering mode, and the receive
direction to deciphering mode. The MS responds with an I-frame that is already
enciphered and contains in its information field the message "Ciphering Mode
Complete".
On receiving the enciphered "Ciphering Mode Complete" (or some other correctly
enciphered message), the Base Station switches the transmit direction of this
channel configuration likewise to enciphering. With this, transmission is encrypted in
both directions and cipher mode activation is thus complete.
There are two cases in which the RR connection must be changed: firstly, when a
speech channel is seized during call set up (involving a changeover from the SDCCH
to the FACCH), and, secondly, Handover. In the case of speech channel seizure, the
Base Station sends an I-frame with "Assignment Command"; the latter contains the
number of the assigned TCH. The Mobile Station acknowledges this I-frame with a
"Receive Ready" (RR). With this, it is clear to both sides that the previously used
SDCCH is no longer valid. Therefore, the layer 2 connection in the SDCCH can be
cleared down locally. The MS subsequently sets up with SABM a new layer 2
connection in the FACCH assigned to the TCH, and, after receiving the UA, sends to
the Base Station the message "Assignment Complete" in the first I-frame. With this,
the speech channel assignment is complete. The SDCCH and its SACCH are idle;
the FACCH is the new main DCCH.
24 TM3101EU02TM_0001
2003 Siemens AG
RR procedures (GSM 04.08)
Activation of Ciphering
I (Ciphering Mode Command)

MS starts SDCCH
ciphering
I (Ciphering Mode Complete)

SDCCH
.
.
.
ciphering Channel deciphering
deciphering Channel ciphering
Fig. 11 Ciphering
Allocation of a Traffic Channel
I (Assignment Command)
SDCCH
Receive Ready
SDCCH
SABM
FACCH
UA
FACCH
I (Assignment Complete)
FACCH
Fig. 12 Allocation of a Traffic Channel
TM3101EU02TM_0001
25
2003 Siemens AG
It is necessary to distinguish different cases for Handover. For the sake of simplicity,
this document confines itself to one case of synchronized Handover. GSM Guideline
05.10 and GSM Guideline 04.08 provides more detailed information on Handover.
From the view of the Mobile Station, Handover begins when the Base Station
transmits in the present FACCH (or SDCCH) an I-frame with the message "Handover
Command". This command contains specifications about the new cell (e.g. color
code, channel structure, timing advance) and the new traffic channel (TCH), as well
as a Handover reference number. The Mobile Station acknowledges the I-frame with
Receive Ready, whereupon the layer 2 connection in the former FACCH is cleared
down locally. The old traffic channel (TCH), along with the associated signaling
channels (FACCH and SACCH), is now idle once more.
The Mobile Station now logs-on in the new cell by transmitting four separate
"Handover Access" messages in the FACCH of the new TCH. This message does
not conform to the standard format; it is one byte long and comprises only the
Handover reference number. The Mobile Station subsequently sets up with SABM
the layer 2 connection in the new FACCH and, after receiving the UA, transmits the
message "Handover Complete" in the first I-frame to the new Base Station. From the
viewpoint of the Mobile Station, this completes the Handover.
26 TM3101EU02TM_0001
2003 Siemens AG
Handover in syncronized cells
I (Handover Command)
FACCH old
(data abaout new cell, new
TCH-No., handover reference)
Receive Ready
FACCH old
Handover Access
FACCH new
(Handover Reference)
Handover Access
FACCH new (Handover Reference)
Handover Access
FACCH new (Handover Reference)
Handover Access
FACCH new
SABM
FACCH new
UA
FACCH new
FACCH new I (Handover Complete)
Fig. 13 Handover
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
27
2003 Siemens AG
The channel configuration for every RR connection includes one slow associated
control channel (SACCH). During the RR connection the Mobile Station constantly
transmits in this SACCH UI-frames whose information fields contain the message
"Measurement Report". With this, the Mobile Station communicates to the Base
Station the results of the power and quality measurement of the own cell, and the
power measurement of the surrounding cells, and so supplies a criterion for the
Handover. The Base Station, for its part, constantly sends in the SACCH UI-frames
with the following messages: "System Information 5", "System Information 5 bis" and
"System Information 6"; these contain information about the Base Stations own cell
(e.g. cell global identity [CGI]) and adjacent cells.
Note: the "System Information" messages nos. 1 to 4 are transmitted in the
Broadcast Control Channel (BCCH).
So far, we have viewed cases where RR connections are cleared down locally (traffic
channel assignment and Handover). It is also possible to explicitly clear down an RR
connection (e.g. at the end of a call, or on completion of a Location Update). This
cleardown is always initiated by the Base Station; for this, it transmits an I-frame with
the message "Channel Release" in the valid main DCCH (either an SDCCH or an
FACCH, depending on the situation). The Mobile Station must respond by releasing
the layer 2 connection with DISC. The layer 2 connection and RR connection are
considered to be cleared down on reception of the UA.
The GSM Guideline 04.08 provides a comprehensive treatment of further Radio
Resource Management details; no further explanations will be given here.
28 TM3101EU02TM_0001
2003 Siemens AG
Measurement Reports and System Information
UI (Measurement Report)
SACCH
(Power and quality measurement)
UI (System Information 5 / 5 bis / 6)

SACCH
(data about own cell and
adjacent cells)
Fig. 14 Measurement Reports and System Information
Cleardown of RR connections
I (Channel Release)
DCCH
DISC
DCCH
UA
DCCH
DCCH = SDCCH or FACCH
Fig. 15 Cleardown of RR connections
TM3101EU02TM_0001
29
2003 Siemens AG
2.2 Mobility Management

The main tasks of Mobility Management (MM), the middle sub-layer of layer 3, are
the execution of authentication and location update; the explicit allocation of a new
TMSI (TMSI Reallocation) and the identification by the network of the mobile
subscriber and/or terminal unit must be mentioned in the same context. The stated
operations are termed MM-specific procedures. The existence of an RR connection
is necessary for all these procedures.
MM is additionally used to make the RR connections applicable for Connection
Management (CM), the highest sub-layer of layer 3. Here the term MM connection is
employed. The MM connection is an application of an RR connection. In accordance
with the 3 parts of CM, MM connections exist for Call Control (CC), for
Supplementary Services Support (SSS) and for Short Message Service (SMS);
additionally, there is an MM connection for emergency calls. While only one RR
connection is permissible per Mobile Station, up to four MM connections may exist (in
theory): one for CC, one for SSS, one for SMS and one for emergency calls.
MM connections and MM-specific procedures are independent from each other. Not
every MM connection requires the execution of MM-specific procedures, and not
every MM-specific procedure needs an MM connection. This is a sharp contrast to
Radio Resource Management, where everything begins with the RR connection
setup and ends with the RR connection cleardown.
2.2.1 Mobility Management Procedures

Our description of MM-specific procedures begins with the TMSI Reallocation. Here,
the Base Station sends the message "TMSI Reallocation Command" in an I-frame in
the main DCCH (SDCCH or FACCH). The message includes the new TMSI and the
current location area identity (LAI). The Mobile Station responds with "TMSI
Reallocation Complete" in another I-frame.
For Authentication, the Base Station sends an I-frame with the message
"Authentication Request" containing the random number (RAND; part of
authentication triple) and the ciphering key sequence number (CKSN; the index of
the authentication triple in the mobile subscriber data in the VLR). The Mobile Station
calculates from the RAND the Signed Response (SRES; a further part of the triple)
and returns the SRES with the message "Authentication Response". Furthermore,
the Mobile Station computes from the RAND the ciphering key (Kc, the last part of
the triple) and memorizes it together with the CKSN).
30 TM3101EU02TM_0001
2003 Siemens AG
MM-specific procedures (GSM 04.08)
TMSI Reallocation
I (TMSI Reallocation Command)

(new TMSI) DCCH
I (TMSI Reallocation Complete)

DCCH
Fig. 16 TMSI Reallocation
Authentication
I (Authentication Request)
SDCCH
(RAND, CKSN)
I (Authentication Response)
SDCCH (SRES)
Fig. 17 Authentication
TM3101EU02TM_0001
31
2003 Siemens AG
The network uses the Identification to request the identity of the Mobile Station or
equipment. The following two applications are the most important:
z IMSI interrogation (if TMSI supplied by Mobile Station is insufficient or the LAI is
unknown)
z IMEI interrogation (to check the authorization of the mobile equipment).
In all cases, the Base Station sends with an I-frame the message "Identity Request",
in which the requested identity type (IMSI, TMSI or IMEI) is specified. The Mobile
Station answers with an "Identity Response" which communicates the requested
identity.
The idea of the IMSI Detach procedure is that the Mobile Station signs off with
message "IMSI Detach Indication" when deactivated, and reports back with "IMSI
Attach" (a special Location Update variant, see "Location Update") if reactivated in
the same location area. If reactivated in a different location area, the Mobile Station
must carry out the normal Location Update procedure.
The Mobile Station sends the "IMSI Detach Indication" in an I-frame (if an RR
connection already exists), or in a SABM (if an RR connection is set up especially for
the Detach procedure). The temporary mobile subscriber identity (TMSI) is included
as a parameter. As this message is the last sign of life from the deactivated Mobile
Station, the Base Station does not respond but clears down the RR connection and
layer 2 connection locally. With this, all resources are again released.
32 TM3101EU02TM_0001
2003 Siemens AG
Identification
I (Identity Request)
SDCCH
(requested identity type)
I (Identity Response)
SDCCH
(IMSI / TMSI / IMEI)
Fig. 18 Identification
IMSI Detach
I / SABM (IMSI Detach Indication)

DCCH
(Mobile Identity)
Local cleardown of RR connection
Fig. 19 IMSI Detach
TM3101EU02TM_0001
33
2003 Siemens AG
The following cases must be distinguished for Location Update:

z Normal location update: the Mobile Station detects a change of the location area
(cell change; new LAI in BCCH)
z Periodic location update: the time monitor in the Mobile Station expires.
z IMSI attach: a previously deactivated Mobile Station signed off with "IMSI Detach"
and is now reactivated in the same location area.
The Mobile Station sets up an RR connection in all cases, and sends the message
"Location Update Request" in the SABM. The SABM contains the IMSI (for initial
activation) or, as applicable, last valid TMSI and last valid local area identity (LAI).
Another message parameter is the ciphering key sequence number (CKSN) from the
last authentication which enables an enciphering without a new authentication. The
Mobile Station further specifies in this SABM the type of location update requested
(normal/periodic/IMSI attach) and the "follow-on request", i.e. whether an MM
connection set up is requested to directly follow the location update (because a call is
planned). The Base Station acknowledges the SABM with UA.
The VLR now attempts to determine the IMSI on the basis of the LAI and TMSI. If this
proves impossible (the LAI is unknown, or the previous VLR does not support TMSI,
or the previous VLR has suffered a recovery with data loss), the Base Station
performs the identification procedure in order to ascertain the IMSI of the Mobile
Station.
Once the IMSI is established, the VLR can notify the HLR and allocate a new TMSI.
The new TMSI is mostly communicated to the Mobile Station in enciphered form. For
this, either a renewed authentication takes place, or the VLR uses the same
ciphering key as with the last call (identified by the CKSN) when the cipher mode is
activated.
The Base Station now sends to the Mobile Station an I-frame with the message
"Location Update Accept"; it contains the new TMSI, the new LAI and - possibly - an
indication "follow-on proceed" as to whether the immediate setup of an MM
connection (i.e. in the same RR connection) is allowed or not. The Mobile Station
responds, like for a TMSI reallocation, with "TMSI Allocation Complete". With this, the
location update is completed. Now either the RR connection is cleared down, or else
the Mobile Station immediately sets up a MM connection.
34 TM3101EU02TM_0001
2003 Siemens AG
Location update
SABM (Location Update Request)

SDCCH (IMSI / TMSI + old LAI, CKSN,
type of location update,
follow-on request?)
UA
SDCCH
[ - identification - ]
[ - Authentication - ]
[ - Ciphering activation - ]
I (Location Update Accept)

SDCCH
(new TMSI, new LAI,
follow-on proceed?)
I (TMSI Reallocation Complete)

SDCCH
Fig. 20 Location Update
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
35
2003 Siemens AG
2.2.2 Mobility Management Connections

MM-connections can be set up by the mobile station or base station. The following
are prerequisites in either case:
z The Mobile Station must have previously signed on in the location area (i.e.
location update was successfully completed). Exception: MM connections for
emergency calls are always permissible.
z Existence of an RR connection.
z No MM-specific procedure is currently running.
If the Mobile Station sets up the MM connection, it transmits the message "CM
Service Request" either in a SABM (if the RR connection was set up specifically for
the MM connection) or in an I-frame (if an RR connection already exists, e.g. directly
following a location update). The type of required MM connection (Call Control [CC],
Supplementary Services Support [SSS], Short Message Service [SMS] or emergency
service) is transferred as message parameter, along with the CKSN from the last
authentication. If the network side proceeds to activate the ciphering mode (see
appendix), this is considered to be confirmation of the MM connection set up. The
MM connection set up must only be explicitly confirmed with message "CM Service
Accept" (in an I-frame, without additional parameters) if ciphering mode is not
activated.
If the Base Station sets up the MM connection, it does so implicitly; therefore, no

messages relating solely to the MM connection set up are transmitted. Instead, the
Base Station sends an arbitrary CM message that is not yet associated with an
existing MM connection. This is viewed as the MM connection set up.
MM connections are always cleared down locally (i.e. without message exchange for
this specific purpose).
Section 4 of GSM Guideline 04.08 provides further details of Mobility Management

(with special cases and faults being discussed in particular).
36 TM3101EU02TM_0001
2003 Siemens AG
MM connections (GSM 04.08)
Mobility Management Connection setup by the MS
SABM (CM Service Request)

DCCH
(CKSN, type of MM connection requested)
OR
I (CM Service Request)

DCCH
(CKSN, type of MM connection requested)
I (Ciphering Mode Command) DCCH
OR
I (CM Service Accept) DCCH
MM Connections are cleared down locally
Fig. 21 Set up of MM connections by the MS
Mobility Management Connection setup by the BSS
I (arbitrary CM message not yet DCCH

associated with a MM connection)
(DCCH = SDCCH or FACCH)
MM Connections are cleared down locally
Fig. 22 Set up of MM connections by the BSS
TM3101EU02TM_0001
37
2003 Siemens AG
2.3 Connection Management

Connection Management (CM) is the highest of the three sub-layers of layer 3. The
actual call processing sequences, such as call set up and cleardown, are executed in
this sub-layer. Connection Management is sub-divided into the following three parts:
Call Control (CC), Supplementary Services Support (SSS) and Short Message
Service (SMS).
Signaling connections exist in Connection Management, too. CM connections (known
also as transactions) are set up between a Mobile Station and the network side in
order to handle call processing procedures (e.g. useful connections). Similar to the
way one RR connection can bear up to 4 MM connections, one MM connection can
carry up to 14 CM connections (of these, max. 7 set up by the Mobile Station and
max. 7 by the network side). For example, if a multifunctional mobile terminal unit is
able to handle several useful connections simultaneously, the signaling for these
useful connections is routed via the MM connection for Call Control, but each useful
connection has its own CM connection.
A CM connection (transaction) is characterized by:
z its association with a MM connection (CC, SSS, SMS or emergency call)
z a 4-bit transaction identifier (TI).
The transaction identifier comprises a TI flag indicating whether the transaction was
set up by the Mobile Station or the network side and a TI value between 0 and 6. The
value 7 is reserved for expansion of the TI to more than 4 bits; GSM has not yet
specified the details of the expansion.
A CM connection is set up by an arbitrary message with a new TI (i.e. a message
whose TI is not in use for the relevant MM connection). If the Mobile Station sets up
the CM connection, the associated MM connection must already exist. If the network
side sets up the CM connection, however, and the associated MM connection is not
yet established, a corresponding MM connection set up is incorporated in the CM
connection set up.
A CM connection is cleared down with the message "Release" from the Base Station
to the Mobile Station, which the Mobile Station acknowledges with "Release
Complete".
38 TM3101EU02TM_0001
2003 Siemens AG
CM connections (GSM 04.08)
CM Connection setup by MS
- MM connection setup -
I (CC or SSS or SMS or Emergency / new TI)

DCCH
CM Connection setup by BSS
I (CC or SSS or SMS / new TI)

DCCH
Fig. 23 CM connection set up
Cleardown of CM Connections
I (Release)
DCCH
I (Release Complete)
DCCH
Fig. 24 CM connection clear down
TM3101EU02TM_0001
39
2003 Siemens AG
In the case of a mobile originating call (MOC), the Mobile Station sets up the
transaction with the message "Setup" (following the MM connection set up). This
message has various optional parameters; the following are some examples:
z bearer capability: the transmission capacity which the network must provide
z parameters for securing the compatibility between A-side and B-side terminal
equipment
z called party number
"Setup" can also be used to request various features (supplementary services; e.g.
Advice of Charges).
The network side acknowledges the "Setup" with "Call Proceeding". Once suitable
terminal equipment is located on the called side, the network sends "Alerting" (i.e.
'called subscriber is being rung'). As soon as the called party answers, the Base
Station sends the message "Connect" to the Mobile Station; the latter responds with
"Connect Acknowledge".
The option OACSU (Off-Air Call Set up) signifies that the air interface speech
channel will be allocated at the latest possible moment. If OACSU is active, the
speech channel is only allocated directly before the "Connect" (i.e. when it is assured
that the called party has answered). If a connection is set up without OACSU, the
speech channel is already allocated directly after "Call Proceeding".
The difference between a call set up with and without OACSU becomes evident in
the "Alerting" message: in a MOC without OACSU, "Alerting" is transmitted in the
FACCH (because a TCH is already allocated), whereas in a MOC with OACSU,
"Alerting" remains in the SDCCH. In either case, "Setup" and "Call Proceeding" are
transmitted in the SDCCH, but "Connect" and "Connect Acknowledge" in the FACCH.
40 TM3101EU02TM_0001
2003 Siemens AG
CM sequences (GSM 04.08)
Mobile originating call (MOC)
- MM connection setup -
I (Setup)
SDCCH
(bearer capability, compatibility,
called party number, features)
I (Call Proceeding)
SDCCH
I (Alerting)
FACCH *)
I (Connect)
FACCH
I (Connect Acknowledge)
FACCH
*) SDCCH with OACSU
Fig. 25 Mobile Originating Call (MOC)
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
41
2003 Siemens AG
In the case of a mobile terminating call (MTC), the network side sets up the
transaction with the message "Setup". Again, several optional parameters are
possible in this message, e.g. the calling party number, or parameters for securing
end equipment compatibility. The Mobile Station immediately acknowledges the
"Setup" with "Call Confirmed".
Once a suitable terminal equipment is located, the Mobile Station sends "Alerting"
(i.e. 'subscriber is being rung'). The Mobile Station signals that the called party has
answered by sending "Connect" to the network side, which responds with "Connect
Acknowledge".
If OACSU is active, the network side allocates the speech channel only after
receiving "Connect" (because until then it is not clear whether the subscriber is
accessible). If OACSU is inactive, the speech channel is assigned immediately after
the "Call Confirmed". Thus: "Set up" and "Call Confirmed" are always sent via the
SDCCH, and "Connect Acknowledge" always via the FACCH. "Alerting" and
"Connect" are transmitted in the SDCCH if OACSU is active, and otherwise in the
FACCH.
42 TM3101EU02TM_0001
2003 Siemens AG
Mobile terminating call (MTC)
I (Setup)
SDCCH
I (Call Confirmed)
SDCCH
I (Alerting)
FACCH *)
I (Connect)
FACCH *)
FACCH
*) SDCCH with OACSU
Fig. 26 Mobile Terminating Call (MTC)
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
43
2003 Siemens AG
In-call modification is understood to mean a change of service in the course of a

connection (e.g. from speech to data transmission). A change of this type can be
initiated by the Mobile Station or by the remote party. In both cases, the initiating side
sends the message "Modify", in which the new bearer capability and new terminal
compatibility information are specified. In a positive case, the opposite side answers
with "Modify Complete", repeating in the message the capacity and compatibility
data.
The call cleardown likewise can be initiated by the Mobile Station or by the remote
party. If the Mobile Station initiates the cleardown, it sends the message
"Disconnect"; the Base Station responds by clearing down the CM connection (using
"Release" and "Release Complete"). If, however, the remote party initiates the
cleardown, then the Base Station clears down the CM connection immediately.
Note: the layer 3 message "Disconnect" is transferred in an I-frame and must not be
mixed up with the UI-frame DISC of layer 2.
Further CM call control sequences are discussed in Section 6 of GSM Guideline
04.08. Please refer to GSM 04.10 for Supplementary Services Support, and to GSM
04.11 and 04.12 for Short Message Service.
44 TM3101EU02TM_0001
2003 Siemens AG
In-call Modifications
I (Modify)
FACCH
(bearer capability, compatibility)
I (Modify Complete)
FACCH
In-call modification, initiated by MS
I (Modify)
FACCH
I (Modify Complete)
FACCH
In-call modification, initiated by the remote party
Fig. 27 In-call modification
Call cleardown
Initiated by the MS
I (Disconnect)
FACCH
- BS clears down the CM connection -
OR
Initiated by the remote party
- BS clears down the CM connection -
Fig. 28 Call Cleardown
TM3101EU02TM_0001
45
2003 Siemens AG
2.4 RR-, MM- and CM-Connection(s)

A RR-connection is a layer 2 connection with SAPI=0 between MS and BSS. Only
one RR-connection can exist simultaneously for one mobile station.
Up to four MM-connections can be established by one mobile station at the same
time. A MM connection is set up between MS and MSC. There could be one for CC
(call control), one for SSS (supplementary services support), one for SMS (short
message service) and one for the call control of emergency calls.
It is (theoretically) possible, to set up 14 CM-connections to each MM-connection
between MS and MSC. One CM-connection to the MM-connection CC (call control) is
established for every call of that MS, e. g. one call active, one call on hold and one
call is waiting. The same principle holds for simultaneous subscriber controlled inputs
(MM-connection SSS), for short messages at the same time (MM-connection SMS)
and for more than one emergency call at one time (MM-connection emergency calls).
46 TM3101EU02TM_0001
2003 Siemens AG
Connection Management
RR-connection
MM-connection MM-connection MM-connection

(SSS) (SMS) (emergency calls)
MM-connection
(CC) max. 14 CM-conn. max. 14 CM-conn. max. 14 CM-conn.
CM- CM- CM- CM- CM- CM- CM- CM- CM- CM- CM- CM- CM- CM-
conn. conn. conn. conn. conn. conn. conn. conn. conn. conn. conn. conn. conn. conn.
no.1 no.2 no.3 no.4 no.5 no.6 no.7 no.8 no.9 no.10 no.11 no.12 no.13 no.14
Fig. 29 RR-, MM-, CM-connections
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
47
2003 Siemens AG
2.5 Complete Sequences

Our consideration of a location update will be confined to the following case: a
Mobile Station, which is in service but without an existing user connection, changes
its location area. As soon as the Mobile Station has tuned itself to the new Base
Station and recognizes the new LAI in the BCCH, it requests (via the RACH) a
signaling channel (SDCCH). After being assigned a signaling channel (in the AGCH),
the Mobile Station sets up a layer 2 connection with the "Contention Resolution"
procedure, including in the SABM the layer 3 message "Location Update Request"
along with the old CKSN, the prior TMSI and previous LAI. The Mobile Station
additionally indicates that the requested location update is a normal one (and not a
periodic one or an IMSI Attach). The Base Station acknowledges the SABM with UA.
The VLR determines the IMSI on the basis of the TMSI and LAI (and possibly by
querying the previous VLR), and notifies (if necessary) the HLR. Before confirming
the location update and assigning a new TMSI to the Mobile Station, the VLR
performs the authentication (I-frames "Authentication Request" and "Authentication
Response") and the ciphering activation (I-frames "Ciphering Mode Command" and
"Ciphering Mode Complete").
After this, a new TMSI can be allocated with the enciphered message "Location
Update Accept"; the Mobile Station responds with "TMSI Reallocation Complete".
The Base Station then clears down the RR connection.
48 TM3101EU02TM_0001
2003 Siemens AG
Location update

(Reason = Loc. Upd., Random Reference)
SDCCH SABM (Location Update Request)
(TMSI + old LAI, CKSN, loc upd. type)
UA SDCCH
SDCCH
(RAND, CKSN)
SDCCH I (Authentication Response)
(SRES)
I (Ciphering Mode Command) SDCCH
SDCCH I (Ciphering Mode Complete)
I (Location Update Accept) SDCCH

(new TMSI, new LAI)
SDCCH I (TMSI Reallocation Complete)
I (Channel Release)
SDCCH
SDCCH DISC
UA SDCCH
Fig. 30 Location Update
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
49
2003 Siemens AG
For a mobile originating call (MOC) we will consider the case that a Mobile Station,
whose current location is already updated, sets up an outgoing call. Therefore, a
location update with directly following MM connection set up is not required first of all;
instead, a RR connection must be set up specifically for the MOC. For this, the
Mobile Station requests a SDCCH (in the RACH; reason for request = MOC set up).
After allocation of the SDCCH (via the AGCH), the Mobile Station sets up the layer 2
connection and conveys in the SABM the message "CM Service Request", which
includes the CKSN of the last authentication and the information that a MM
connection for call control (CC) is to be set up. The Base Station acknowledges the
SABM with UA.
The Base Station now performs the authentication (I-frames "Authentication Request"
and "Authentication Response") and ciphering activation (I-frames "Ciphering Mode
Command" and "Ciphering Mode Complete"). With this, the MM connection is set up
and the Mobile Station for its part can establish a CC connection with the message
"Setup". This message contains a new transaction identifier (TI; selected by the
Mobile Station) as well as all information required for a network call set up (in
particular the bearer capability and the called party number).
The Base Station answers with the I-frame "Call Proceeding", to which the Mobile
Station responds with "Receive Ready".
50 TM3101EU02TM_0001
2003 Siemens AG
Mobile originating call (MOC), beginning
Mobile Originating Call - MOC (Part 1)

(Reason = MOC, Random Reference)
SDCCH SABM (CM Service Request)
(Call Control, CKSN)
UA SDCCH
SDCCH
(RAND, CKSN)
(SRES)
I (Ciphering Mode Command)
SDCCH
Receive Ready
SDCCH
SDCCH I (Setup)
I (Call Proceeding)
SDCCH
SDCCH Receive Ready
Fig. 31 Mobile originating call, part 1
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
51
2003 Siemens AG
At this stage, if Off-Air Call Set up (OACSU) is not active, the network side assigns a
speech channel by sending an "Assignment Command" I-frame with the TCH
number. The Mobile Station responds with "Receive Ready", whereupon the layer 2
connection in the SDCCH can be cleared down locally, and a new layer 2 connection
is set up in the FACCH. The Mobile Station uses this new FACCH to acknowledge
the received "Assignment Command" with "Assignment Complete".
As soon as ringing begins for the called party, the network side sends to the Mobile
Station the I-frame "Alerting", to which the Mobile Station responds with "Receive
Ready".
Once the called party answers, the network side sends the I-frame "Connect" to the
Mobile Station; the latter responds with I-frame "Connect Acknowledge". Finally, the
Base Station acknowledges the MS response with "Receive Ready", thus completing
the connection set up.
52 TM3101EU02TM_0001
2003 Siemens AG
Mobile originating call (MOC),
continuation without OACSU
Mobile Originating Call MOC (Part 2 without OACSU)
SDCCH
(TCH-No.)
SDCCH Receive Ready
FACCH SABM
UA
FACCH
FACCH I (Assignment Complete)
Receive Ready FACCH
I (Alerting)
FACCH
FACCH Receive Ready
I (Connect)
FACCH
FACCH I (Connect Acknowledge)
Receive Ready FACCH
Fig. 32 Mobile originating call, part 2a
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
53
2003 Siemens AG
If Off-Air Call Set up (OACSU) is active, the speech channel is first assigned when
the called party answers (i.e. directly before the "Connect"). The transmission of
"Alerting" and the associated "Receive Ready" continues in the SDCCH
54 TM3101EU02TM_0001
2003 Siemens AG
Mobile originating call (MOC),
continuation with OACSU
Mobile Originating Call MOC (Part 2 with OACSU)
I (Alerting) SDCCH
SDCCH Receive Ready
SDCCH
(TCH-No.)
SDCCH Receive Ready
FACCH SABM
UA FACCH
I (Assignment Complete)
FACCH
I (Connect) FACCH
FACCH
Receive Ready
FACCH
Fig. 33 Mobile originating call, part 2b
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
55
2003 Siemens AG
The Base Station initiates a mobile terminating call (MTC) by paging. For this, it
sends in the PCH a UI-frame "Paging Request" including the TMSI. The called
Mobile Station requests ("Channel Request" in RACH, Reason = Answer to paging)
and obtains ("Immediate Assignment" in AGCH) a channel, in which it sets up a layer
2 connection. The SABM for this set up includes the message "Paging Response"
along with the last CKSN and the TMSI. The network recognizes the positive paging
result and answers the SABM with UA.
The Base Station now performs the authentication (I-frames "Authentication Request"
and "Authentication Response") and ciphering activation (I-frames "Ciphering Mode
Command" and "Ciphering Mode Complete"). With this, the MM connection is set up
and the Base Station can establish a CC connection with the message "Setup". This
message contains a new transaction identifier (TI; selected by Base Station) as well
as all information required for a call set up (in particular the bearer capability).
The Mobile Station answers with the I-frame "Call Confirmed", to which the Base
Station responds with "Receive Ready".
56 TM3101EU02TM_0001
2003 Siemens AG
Mobile terminating call (MTC), beginning
Mobile Terminating Call MTC (Part 1)
UI (Paging Request)
PCH
(Mobile Identity)

(Reason = Answer to Paging, Random Reference)
UI (Immediate Assignment)
AGCH
SDCCH SABM ( Paging Response )

(TMSI, CKSN)
UA SDCCH
I (Authentication Request) SDCCH

(RAND, CKSN)

(SRES)
I (Ciphering Mode Command) SDCCH
I (Setup) SDCCH
calling party number, features)
SDCCH I (Call Confirmed)
Receive Ready SDCCH
Fig. 34 Mobile terminating call, part 1
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
57
2003 Siemens AG
If Off-Air Call Set up (OACSU) is not active, the Base Station assigns the speech
channel at this point. The procedure is identical with that for a mobile originating call
(see above). Most importantly, the remaining RR connection in the SDCCH is
replaced by a new one in the FACCH.
As soon as ringing begins for the called party, the Mobile Station sends the I-frame
"Alerting", to which the Base Station responds with "Receive Ready".
If the called party answers, the Mobile Station notifies the Base Station with the I-
frame "Connect". The Base Station responds with "Connect Acknowledge". Finally,
the Mobile Station acknowledges the Base Station response with "Receive Ready",
thus completing the connection set up for a mobile terminating call.
58 TM3101EU02TM_0001
2003 Siemens AG
Mobile terminating call (MTC),
continuation without OACSU
Mobile Terminating Call MTC (Part 2 without OACSU)
I (Assignment Command) SDCCH

(TCH-No.)
SDCCH Receive Ready
FACCH SABM
UA FACCH
Receive Ready FACCH
FACCH I (Alerting)
Receive Ready FACCH
FACCH I (Connect)
I (Connect Acknowledge) FACCH
FACCH Receive Ready
Fig. 35 Mobile terminating call, part 2 without OACSU
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
59
2003 Siemens AG
If Off-Air Call Set up (OACSU) is active, the speech channel is first assigned when
the called party answers (i.e. after the "Connect"). The transmission of "Alerting", the
associated "Receive Ready", and "Connect" continue in the SDCCH.
60 TM3101EU02TM_0001
2003 Siemens AG
Mobile terminating call (MTC),
continuation with OACSU
Mobile Terminating Call MOC (Part 2 with OACSU)
SDCCH I (Alerting)
Receive Ready SDCCH
SDCCH I (Connect)
I (Assignment Command) SDCCH

(TCH-No.)
SDCCH Receive Ready
FACCH SABM
UA FACCH
I (Connect Acknowledge) FACCH
FACCH Receive Ready
Fig. 36 Mobile terminating call, part 2 with OACSU
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
61
2003 Siemens AG
From the view of the Mobile Station, the Handover procedure begins when the Base
Station sends an I-frame with a "Handover Command" message in the FACCH valid
up to that point. The message contains specifications of the new cell (e.g. color code,
channel structure, timing advance), of the new speech channel (TCH) and a new
Handover reference number. The Mobile Station acknowledges this I-frame with
"Receive Ready". With this, the layer 2 connection in the remaining FACCH is
cleared down locally. The old speech channel (TCH), together with its associated
signaling channels (FACCH and SACCH), is now idle once more.
The Mobile Station now logs-on in the new cell by transmitting four separate
"Handover Access" messages in the FACCH of the new TCH. This message does
not conform to the standard format of 23 Byte length; it is one byte long and
comprises only the Handover reference number. The Mobile Station subsequently
sets up with SABM the layer 2 connection in the new FACCH and, after receiving the
UA, transmits the message "Handover Complete" in the first I-frame to the new Base
Station. This Base Station responds with "Receive Ready". From the viewpoint of the
Mobile Station, the handover is now completed.
62 TM3101EU02TM_0001
2003 Siemens AG
Handover
Handover
I (Handover Command) FACCH old
(data abaout new cell, new
TCH-No., handover reference)
FACCH old Receive Ready
FACCH new Handover Access




FACCH new SABM
UA FACCH new
FACCH new I (Handover Complete)
Receive Ready FACCH new
Fig. 37 Handover
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
63
2003 Siemens AG
The call cleardown can be initiated by either the Mobile Station or network side (i.e.
the partner side). Here, only the cleardown of an established useful connection will
be considered.
If the Mobile Station initiates the cleardown, it sends the I-frame "Disconnect". The
Base Station responds by clearing down the CM connection with the I-frame
"Release", which is answered by "Release Complete".
If the partner side initiates the cleardown, the Base Station transmits "Release"
immediately. Again, the Mobile Station answers with "Release Complete".
The MM connection is cleared down only locally. The RR connection however must
be cleared down explicitly. The Base Station must initiate the RR cleardown
(irrespective of the initiating side for the user connection cleardown) by sending the I-
frame "Channel Release".
Finally, the Mobile Station clears down the layer 2 connection with DISC, which the
Base Station acknowledges with UA. With this, all seized resources are released,
and the connection cleardown is completed.
64 TM3101EU02TM_0001
2003 Siemens AG
Call cleardown
Call Cleardown
FACCH I (Disconnect)
I (Release) FACCH
FACCH I (Release Complete)
I (Channel Release) FACCH
FACCH DISC
UA FACCH
Initiated by mobile station
Fig. 38 Call clear down
Call Cleardown
I (Release) FACCH
FACCH I (Release Complete)
I (Channel Release) FACCH
FACCH DISC
UA FACCH
Initiated by partner side
Fig. 39 Call Cleardown
TM3101EU02TM_0001
65
2003 Siemens AG
66 TM3101EU02TM_0001
2003 Siemens AG
3 Formatting Rules
TM3101EU02TM_0001
67
2003 Siemens AG
Each message begins with the same three parameters:

The protocol discriminator specifies the layer 3 part to which the message belongs.
It is a parameter of 1/2 byte length. Its possible values are given in the next figure.
The transaction identifier (TI) characterizes the transaction (= CM connection, cf.
2.3). It is a V-parameter of 1/2 byte, too; in conformity with the rules, the protocol
discriminator and the TI together fill 1 byte. For RR and MM messages (protocol
discriminator = 0110 or 0101), no CM connection is established; for this reason, the
TI is replaced by the skip indicator whose value is 0.
With a proper TI, the most significant bit serves as TI flag in messages for other TI
parts; it is 0 in messages from the side, which set up the transaction, and 1 in
messages to the side, which set up the transaction. The three remaining bits form the
TI value are freely selected by the initiating side in a transaction set up; the value 111
is not permissible.
The message type identifies the nature of the message (e.g. "Handover Command",
"Location Update Request", "Setup" and many other examples from section 2). It is a
V-parameter with a length of 1 byte. The second bit is the send sequence number
N(SD). In all messages from the Base Station, as well as in RR messages from the
Mobile Station, this bit is 0. In MM and CM messages from the Mobile Station the bit
alternately has the values 0 and 1.
For the remaining parameters, the protocol may define three different presence
requirements: M (mandatory), C (conditional) or O (optional). An M-parameter must
always be included in a message of a given type; its absence is reason enough for
the receiver to reject the whole message. A C-parameter must be present under
certain conditions, but can be absent under other conditions. An O-parameter, finally,
is never bound to be present; its absence is never sufficient reason for the receiver to
reject the message.
68 TM3101EU02TM_0001
2003 Siemens AG
Air interface message structure
Parameter containing
information Type of message,...
RR, MM, CM, TI, ...
Message Message Type

Layer 2 Parameter(s) Type Identifier Layer 2
(GSM 04.07) (1 Byte) (1 Byte)
Fig. 40 Air interface message structure (GSM 04.07)
Value Layer 3 part
0110 Radio Resource Management (RR)
0101 Mobility Management (MM)
0011 Call Control (CC)
1011 Supplementary Services Support (SSS)
1001 Short Message Service (SMS)
1111 reserved for tests
Fig. 41 Protocol discriminator
TM3101EU02TM_0001
69
2003 Siemens AG
Every layer 3 message is comprised of several parameters, also known as

information elements. Section 9 of GSM Guideline 04.08 defines the mandatory and
optional parameters for every message. The same parameter may be mandatory for
one message and optional for another. Optional parameters bear an identifier
(Information Element Identifier, IEI) to designate their presence. The identifier is
always located at the beginning of the parameter. Mandatory parameters, by
contrast, include sometimes - dependent on the position - an identifier.
The parameters are sub-divided into 5 parameter formats (described in GSM 04.07):
V (value only) parameters have neither an identifier (IEI) nor a length indicator;
they are mandatory parameters of fixed length. The length is either an integer
amount of bytes or 1/2 byte. In the last case, V-parameters of 1/2 byte length
are combined to form pairs whenever possible. The first parameter in the
combination encompasses the 4 least significant bits, the second parameter
the 4 most significant bits. If the total number of V-parameters of 1/2 byte is
odd, the 4 most significant bits of the last byte are filled with 0000.
TV (type and value) parameters have an identifier (IEI) but no length indicator. If
the length of the contents is an integer amount of bytes, then the IEI is 1 byte
in length, and the most significant IEI bit is 0. If the length of the contents is 1/2
byte, then the IEI is likewise 1/2 byte in length. The most significant bit is 1,
and the succeeding bits must not be 010 (to distinguish them from T-
parameters, see below).
T (type only) parameters have 0 byte content. The communicated information
consists solely in the presence or absence of the parameter. Obviously, such
parameters can only be considered as optional. The identifier (IEI) is 1 byte in
length and begins with 1010 (so that no confusion with TV-parameters is
possible). One example of a type-2 parameter is the authorization given in
"Location Update Accept" for the Mobile Station to set up a MM connection
directly after the location update (i.e. in the same RR connection). This
authorization may, or may not, be present.
LV (length and value) parameters have a length indicator but no identifier (IEI);
they are mandatory parameters of variable length. The length indicator is the
first byte and indicates how many bytes of contents follow.
TLV (type, length and value) parameters have an identifier (IEI) and a length
indicator. The IEI is the first byte of the parameter; its most significant bit is 0.
The length indicator is the second byte of the parameter and indicates how
many bytes of contents follow.
70 TM3101EU02TM_0001
2003 Siemens AG
Layer 3 parameters (GSM 04.07)
Parameter Format Length integer amount of Bytes Length of 1/2 Byte
Example: 5 parameters
V alue content 2 content 1

content content 4 content 3
0 0 0 0 content 5
0 IEI
T ype,
V alue content
1 IEI content
#0 1 0
T ype 1 0 1 0 IEI
Length indicator
L ength,
V alue
content
T ype, 0 IEI
L ength, Length indicator
V alue
content
Fig. 42 Parameter formats
TM3101EU02TM_0001
71
2003 Siemens AG
Some examples of layer 3 messages will now be examined. First we shall consider a
Radio Resource Management message the "Handover Command" from Base Station
to Mobile Station. Apart from the parameters in the message header (see fig. 21), the
mandatory parameters are the description of the new cell (Cell Description), the
specification of the new speech channel (Description of the First Channel) and the
required power of the Mobile Station in the new cell (Power Command). Several
conditional and optional parameters exist which depend on the cell synchronization
or on whether frequency hopping is employed in the new cell.
The length specifications in fig. 23, 24, 25 indicate the total parameter lengths, i.e.
inclusive of identifier and length indicator, where applicable. Thus, V-parameters
have the length 1/2 or an integer value. With TV-parameters, the length is 1 if they
have 1/2 byte contents and 1/2 byte identifier; otherwise, the length of the contents is
1 byte less than the indicated length (because the first byte is the IEI). T-parameters
always have a length of 1 byte. LV-parameters have a length of the contents which is
1 byte less than the indicated length (here, the first byte is the length indicator).
Finally, with TLV-parameters, the length of the contents is 2 bytes less than the
indicated length, since the first byte is the IEI and the second byte is the length
indicator.
For example, the parameter "Real Time Difference" (TLV) has a total length of 3
bytes. When 1 byte is subtracted for identifier and length indicator respectively, 1
byte remains for the content.
72 TM3101EU02TM_0001
2003 Siemens AG
Parameter Presence Format Length

Protocol Discriminator M V 1/
2
Skip Indicator M V 1/
2
Message Type M V 1
Cell Description M V 2
Description of the First Channel, after time M V 3
Handover Reference M V 1
Power Command M V 1
Synchronization Indication O TV 1
Frequency Short List, after time C TV 10
Frequency List, after time C TLV 4-131
Cell Channel Description C TV 17
Mode of the First Channel O TV 2
Description of the Second Channel, after time O TV 4
Mode of the Second Channel O TV 2
Frequency Channel Sequence, after time C TV 10
Mobile Allocation, after time C TLV 3-10
Starting Time O TV 3
Real Time Difference C TLV 3
Timing Advance C TV 2
Frequency Short List, before time C TV 10
Frequency List, before time C TLV 4-131
Description of the First Channel, before time O TV 4
Description of the Second Channel, before O TV 4
time
Frequency Channel Sequence, before time C TV 10
Mobile Allocation, before time C TLV 3-10
Cipher Mode Setting O TV 1
Fig. 43 Handover Command BS --> MS
TM3101EU02TM_0001
73
2003 Siemens AG
The table shows an example of a Mobility Management message: the Location

Update Request. This message includes only mandatory parameters, of which the
following deserve particular mention: "Location Updating Type" (normal
update/periodic update/IMSI attach; this parameter additionally indicates whether a
MM connection set up shall follow on immediately), the "Location Area Identification"
(the previous LAI stored on the SIM card) and the "Mobile Identity" (normally the last
valid TMSI; for initial activation, IMSI also). "Mobile Identity" is the only variable
length parameter (LV).
Parameter "Ciphering Key Sequence Number" specifies which of the (max. 7) triples
stored in the VLR was used for the last authentication. This allows the ciphering
mode to be activated without a renewed authentication. Finally, parameter "Mobile
Station Classmark" supplies the network with data about the terminal unit in use (e.g.
its power).
The next one shows an example of a Connection Management message: the
"Setup". Apart from the message header, this message contains only parameters
with type indication (TLV, TV and T). It is obvious that the Bearer Capability
(indication of the basic service of the call) and the Called Party Number must be
included for direction MS --> BS.
The recurring "Repeat Indicator" precedes elements that may appear several times in
succession. These elements are the parameters "Bearer Capability", "Low Layer
Compatibility" and "High Layer Compatibility". They make multiple appearances in
the following cases:
z several connection options are offered, one of which can be selected in
accordance with the capabilities of the network and partner side (e.g. in the case
of multifunctional terminal equipment)
z In-Call Modification is to be performed later.
74 TM3101EU02TM_0001
2003 Siemens AG

2
Skip Indicator M V 1/
2
Message Type M V 1
Location Updating Type M V 1/

2
Ciphering Key Sequence Number M V 1/

2
Location Area Identification M V 5
Mobile Station Classmark M V 1
Mobile Identity M LV 2-9
Fig. 44 Location Update Request MS --> BS

2
Transaction Identifier M V 1/
2
Message Type M V 1
BC Repeat Indicator C TV 1
Bearer Capability 1 M TLV 3-10
Bearer Capability 2 O TLV 3-10
Facility O TLV 2-?
Calling Party Subaddress O TLV 2-23
Called Party BCD Number M TLV 3-13
Called Party Subaddress O TLV 2-23
LLC Repeat Indicator O TV 1
Low Layer Compatibility I O TLV 2-15
Low Layer Compatibility II O TLV 2-15
HLC Repeat Indicator O TV 1
High Layer Compatibility I O TLV 2-5
High Layer Compatibility II O TLV 2-5
User-user O TLV 3-35
SS version O TLV 2-3
CLIR suppression C T 1
CLIR invocation O T 1
Fig. 45 Setup MS --> BS
TM3101EU02TM_0001
75
2003 Siemens AG
The adjacent example shows a "Handover Command". The protocol discriminator

specifies "Radio Resource Management" (cf. fig. 22); accordingly, there is no
transaction identifier but a skip indicator. The subsequent message type 00101011
identifies the message as a "Handover Command".
The mandatory parameters follow. The parameter "Cell Description" contains the
color codes (Network Color Code NCC and Base Station Color Code BCC) for the
new cell, and the absolute channel number of the broadcast channel (BCCH).
"Description of the First Channel" describes the new channel configuration, in this
case shown by the bit combination 00001 to be a Bm with SACCH and FACCH. The
time slot number, training sequence and absolute channel number of the traffic
channel (TCH) ensue. These are followed by the Handover Reference (repeated by
the Mobile Station in the "Handover Access" bursts) and the Power Command.
Of the optional and conditional parameters, "Synchronization Indication" and
"Channel Mode" are present. The former is recognizable by identifier 1101; the value
1001 indicates that the cells are synchronized. The "Channel Mode" has the identifier
01100011; its value 00000001 indicates that speech can be transmitted at full rate in
the traffic channel.
All the considered parameters are of fixed length; therefore, no length indicators are
present.
76 TM3101EU02TM_0001
2003 Siemens AG
0 0 0 0 0 1 1 0 Protocol Discriminator RR: Skip Indicator
0 0 1 0 1 0 1 1 Message Type "Handover Command"

NCC BCC
Cell Description
Abs. RF Channel Number BCCH
0 0 0 0 1 Timeslot
Desciption of First Channel:
Training Seq. 0 0 0 Bm + SACCH + FACCH,
single Radio Freq. Channel
Abs. RF Channel Number TCH
Handover Reference
0 0 0 Power Level Power Command

1 1 0 1 1 0 0 1 Synchronization Indic.: synchronized
0 1 1 0 0 0 1 1 Mode of First Channel:
0 0 0 0 0 0 1 1 Speech full rate
Fig. 46 Example of a Handover Command
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
77
2003 Siemens AG
An example of a "Location Update Request" will now be considered. The protocol

discriminator is "Mobility Management"; accordingly, the Transaction Identifier is
replaced by the Skip Indicator. The bit combination 0X001000 identifies the message
as a "Location Update Request", whereby X stands for the send sequence number
N(SD).
The V-parameters begin with the location update type; the bit combination 0000
indicates that a normal location update without a "Follow-on Request" is desired (i.e.
no MM connection is to be set up directly after the update). The Ciphering Key
Sequence Number follows (in the same byte). The subsequent Location Area
Identification comprises the Mobile Country Code (MCC; 3 digits, each 1/2 byte; last
half-byte filled with 1111), the Mobile Network Code (MNC; 2 digits, each 1/2 byte)
and the LACOD (2 bytes, unstructured). Finally, the Mobile Station Classmark 1
follows with the power level.
The only LV-parameter is the Mobile Identity. The length indicator shows that 5
further bytes will follow (total length: 6 bytes). The follow-on bit combination 0100
indicates that the TMSI will be transmitted (and not, for example, the IMSI); the 4-
byte TMSI value follows.
No T-, TV- and TLV-parameters are included this time; for this reason, no identifiers
appear.
78 TM3101EU02TM_0001
2003 Siemens AG
0 0 0 0 0 1 0 1 Protocol Discriminator MM: Skip Indicator
0 N(SD) 0 0 1 0 0 0 Message Type "Location Update Request"

CKSN 0 0 0 0 Normal Loc. Upd.; no follow-on
MCC
1 1 1 1
MNC Location Area Identification
LACOD
0 0 0 0 0 RF power Mobile Station Classmark

0 0 0 0 0 1 0 1
1 1 1 1 0 1 0 0
Mobile Identity:
Length 5; TMSI
TMSI
Fig. 47 Example of "Location Update Request"
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
79
2003 Siemens AG
Finally, we will consider an example of a "Setup" initiated by the Mobile Station. The
protocol discriminator indicates "Call Control". The TI-flag is 0 (as the transaction will
be established with this set up), while the TI value of the Mobile Station is freely
selectable. The subsequent bit combination 0X000101 identifies the message as
"Setup", whereby X stands for the send sequence number N(SD).
Parameters with IEI follow. The first is recognizable as "Bearer Capability" through its
IEI 00000100. The length indicator imparts that one further byte will follow (resulting
in 3 bytes total length), and the content 10100000 indicates should be circuit-
switched at full rate.
The next parameter bears the IEI 01011110, i.e. "Called Party BCD Number". The
length indicator shows 7. The succeeding byte contains the type of number
(international/national/subscriber number etc.) and the numbering plan. Both the
number type and numbering plan are often unknown (bit combination 10000000) in
the case of messages from the Mobile Station. The dialed digits now follow, on a half-
byte basis and adjusted to the right. The digit sequence 08972241497 is identifiable.
As the number of digits is odd, the final half-byte is filled with 1111.
The next (and final) parameter has the IEI 01111100, showing it to be "Low Layer
Compatibility". The length indicator signifies that one byte will follow. This byte has
the value 00000000, communicating the compatibility information "Speech".
80 TM3101EU02TM_0001
2003 Siemens AG
0 TI value 0 0 1 1 Protocol Discriminator CC (TI-flag = 0)
0 N(SD) 0 0 0 1 0 1 Message Type "Setup"

0 0 0 0 0 1 0 0
Bearer Capability:
0 0 0 0 0 0 0 1 Length 1,
Speech full rate, Circuit Mode
1 0 1 0 0 0 0 0
0 1 0 1 1 1 1 0
0 0 0 0 0 1 1 1
1 0 0 0 0 0 0 0
1 0 0 0 0 0 0 0 Called Party BCD Number:
Length 7,
0 1 1 1 1 0 0 1 Type of Number unknown,
Numbering Plan unknown,
0 0 1 0 0 0 1 0 Directory number 08972241497
0 0 0 1 0 1 0 0
1 0 0 1 0 1 0 0
1 1 1 1 0 1 1 1
0 1 1 1 1 1 0 0
Low Layer Compatibility:
0 0 0 0 0 0 0 1 Length 1,
0 0 0 0 0 0 0 0 Speech
Fig. 48 Example of a Set up
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
TM3101EU02TM_0001
81
2003 Siemens AG
82 TM3101EU02TM_0001
2003 Siemens AG
4 Exercises
TM3101EU02TM_0001
83
2003 Siemens AG
84 TM3101EU02TM_0001
2003 Siemens AG
Exercise
1. Which kind of common control channels (CCCH) exist Which of them are
operated uplink, and which downlink?
2. To which channels is a SACCH assigned? To which channels a FACCH?
3. Which layer 2 frames always contain an information field? Which ones

sometimes do? Which ones never do?
4. In which air interface channels is it possible to set up layer 2 connections?
5. a) How many RR connections can exist per Mobile Station?
b) How many MM connections can exist per RR connection?
c) How many CM connections can exist per MM connection?
6. Which messages have no layer 2 frame but consist of a single byte?
7. What is understood by local connection cleardown?
TM3101EU02TM_0001
85
2003 Siemens AG
8. Evaluate the layer 3 of the following MTC example by using the GSM 04.08.
K1103 --- CCS No. 7 - Monitor , Date: 21.01.97 , Time:
15:20:52"5 bss sccp 83 3050 408 5 DT1

ITU-T WHITE BOOK SCCP (sccp) Data Form 1 (DT1)
----0011 Service Indicator SCCP
--00---- Sub-Service: Priority Spare/priority 0 (U.S.A. only)
10------ Sub-Service: Network Ind National message
******** Destination Point Code 3050
******** Originating Point Code 408
******** Signalling Link Selection 5
00000110 SCCP Message Type 0x6
******** Destination Local Ref. 0x402021
-------0 Segment/reass M indicator No more data
0000000- Spare
00000001 Ptr to Data parameter 1
Data parameter
00010001 Parameter length 17
******** Data 01 00 0E 93 57 07 A3 B8
81 20 15 63 80 7D 02 91
84
dtap 3
E-GSM 04.08 (DTAP) Version 4.8.0 (dtap) ..............

-------1 Discrimination bit D DTAP
0000000- Filler
-----000 SAPI Signalling
--000--- Spare
00------ Radio channel id fACCH or sDCCH
00001110 Message Length 14
93
57
07
86 TM3101EU02TM_0001
2003 Siemens AG
A3
B8
81
20
15
63
80
7D
02
91
84
TM3101EU02TM_0001
87
2003 Siemens AG
88 TM3101EU02TM_0001
2003 Siemens AG
5 Solutions
TM3101EU02TM_0001
89
2003 Siemens AG
90 TM3101EU02TM_0001
2003 Siemens AG
Solution
1. Which kind of common control channels (CCCH) exist? Which of them are
operated uplink, and which downlink?
Random Access Channel (RACH): uplink
Access Grant Channel (AGCH): downlink
Paging Channel (PCH): downlink
2. To which channels is a SACCH assigned? To which channels a FACCH?
SACCH: to Traffic Channel (TCH) and Stand-Alone Dedicated Control

Channel (SDCCH)
FACCH: to Traffic Channel (TCH) only
3. Which layer 2 frames always contain an information field? Which ones sometimes
do? Which ones never do?
always: I and UI
sometimes: SABM and UA
never: DISC, DM and all S-frames (RR, RNR and REJ)
4. In which air interface channels is it possible to set up layer 2 connections?

SDCCH and FACCH
5. a) How many RR connections can exist per Mobile Station?

Only one
b) How many MM connections can exist per RR connection?

Four (CC, SSS, SMS and emergency call)
c) How many CM connections can exist per MM connection?

Fourteen (BS and MS can select transaction identifiers from 0 to 6)
TM3101EU02TM_0001
91
2003 Siemens AG
6. Which messages have no layer 2 frame but consist of a single byte?

Channel Request and Handover Access
7. What is understood by a local connection cleardown?

There is no message exchange relating to the connection cleardown, since
on account of the situation both partners agree that the connection is
ended and release the resources
92 TM3101EU02TM_0001
2003 Siemens AG

Air Interface PDF

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Air Interface PDF

Hochgeladen von

Copyright:

Verfügbare Formate

Air Interface Siemens

1 Channel Structure and Layer Model

1.1 Air Interface Channels

Broadcast Control Common Control Dedicated Control

Slow Associated Dedicated

Access Grant Channel Fast Associated Dedicated

Random Access Channel Stand-Alone Dedicated

Fig. 2 Air Interface Channels (GSM 04.03)

Accordingly, the BCCH is operated only downlink.

1.2 Signaling Architecture

RR BTSM BTSM SCCP SCCP SCCP

LAPDm LAPDm LAPD LAPD

MS BTS BSC MSC

Fig. 3 Air Interface Signaling Architecture

Connection Management (CM)

Mobility Management (MM)

Radio Resource Management (RR)

Data Link Layer LAPDm

Physical Layer TDMA / FDMA

Fig. 4 Network Layer of the Air Interface

1.3 Framing of Messages

3 Length M Length Indicator

Fig. 5 Structure of a Layer 2 frame (acc. to GSM 04.06)

1.3.1 LAPDm Frame Types

Information frames. are used for error-protected message transmission. "Error

Information Frame (I-frame)

Supervisory Frame (S-frame)

Unnumbered Frame (U-frame)

Fig. 6 LAPDm Frame types

z Set Asynchronous Balanced Mode (SABM): layer 2 connection set up

Frame Format bit pattern Command Inform.

I N(R) P N(S) 0 Command yes

RR N(R) P/F 0 0 0 1 both no

S RNR N(R) P/F 0 1 0 1 both no

REJ N(R) P/F 1 0 0 1 both no

SABM 0 01 P 1 1 1 1 Command possible

Fig. 7 LAPDm Frame types and formats (GSM 04.06)

1.4 Layer 2 Connections

Layer 2 connection set up and cleardown

Layer 2 connections are the basis for the exchange of

Normal setup (SABM and UA commands)

Normal cleardown (DISC and UA commands)

Fig. 8 Layer 2 connections

2.1 Radio Resource Management

RR connection setup by the Mobile Station

RACH Channel Request

UI (Immediate Assignment) AGCH

SDCCH SABM ( ... )

Fig. 9 RR connection setup by the Mobile Station

RR Procedures (GSM 04.08)

RR connection setup by the Base Station

UI (Paging Request) PCH

RACH Channel Request

UI (Immediate Assignment) AGCH

SDCCH SABM ( Paging Response )

Fig. 10 RR-connection setup by the Base Station

RR procedures (GSM 04.08)

I (Ciphering Mode Command)

I (Ciphering Mode Complete)

deciphering Channel ciphering

Allocation of a Traffic Channel

Fig. 12 Allocation of a Traffic Channel

RR procedures (GSM 04.08)