The document provides an agenda on GSM and GPRS theory that includes: - An overview of GSM definition, history, services, system architecture, functional model, and interfaces - Descriptions of the radio interface, A-bis, A-interface, signaling protocols, and inter-MSC signaling - A brief history of GPRS and definitions of its new network elements and air and A-bis interfaces

2. G lobal S ystem for M obile Communication ( G roupe S péciale M obile)‏ GSM

3. Definition and History BTS

5. Local Exchange Mobile Switching Centre fixed medium Mobile Station fixed location Variable Location Diffuse Medium Telephone Basic concept - 1 GSM vs. fixed network Telephony SONOFON M N

6. Analog Mobile Systems RC 2000 Italy France TACS / ETACS NMT 450/900 C-Netz RTMS AMPS Nordic Countries, France, Belgium, Netherland, Switzerland, Austria, Turkey, Yugoslavia, Thailand, Malaysia, North Africa West Germany, Portugal UK, Ireland, Italy, Spain, Austria, Greece, Hong Kong, China, Malaysia, Thailand, Sri Lanka USA, Canada, Australia, New Zealand, Malaysia, Pakistan Singapore, Hong Kong

7. C-NET Analog 450 MHz UMTS / IMT-2000 (FPLMTS)‏ Cordless Satellite (IRIDIUM)‏ Mobile Other systems DECT NMT Analog 450/900 MHz TACS/ETACS Analog 900 MHz AMPS Analog 800 MHz The evolution PCS 1900 GSM at 1900 MHz CT2 DCS 1800 GSM at 1800 MHz Trunked mobile radio (TETRA)‏ GSM Digital 900 MHz CT0,CT1 GSM Digital 900 MHz GSM Digital 900 MHz DAMPS (TDMA)‏ GSM Digital 900 MHz CDMA

12. GSM Services BTS

16. System architecture . BTS

17. Base Station Controller BSC Public Switched Telephone Network Base Mobile Station (MS)‏ Mobile Switching Centre MSC (PSTN)‏ Station Subsystem (BSS)‏ A-Inter A-bis Um 2 Mbit/s PCM Air Interface Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Equip. Id Register EIR Authen. Centre AUC Visitor Location Register VLR Home Location Register HLR Mobile Switching Centre MSC MAP ISUP / TUP MAP MAP MAP ISUP / TUP ISUP / TUP MAP System Overview BTS

18. System Building Blocks Home Location Register Visitor Location Register Mobile Switching Centre Base Station Controller Base Transceiver Station MSC BTS BSC VLR HLR SONOFON M N

29. Functional model. BTS

30. Base Station Controller BSC Public Switched Telephone Network Base Mobile Station (MS)‏ Mobile Switching Centre MSC (PSTN)‏ Station Subsystem (BSS)‏ A-Inter A-bis Um 2 Mbit/s PCM Air Interface Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Equip. Id Register EIR Authen. Centre AUC Visitor Location Register VLR Home Location Register HLR Mobile Switching Centre MSC MAP ISUP / TUP MAP MAP MAP ISUP / TUP ISUP / TUP MAP The overview of the System. BTS

39. Um Radio (Um) Interface BTS

40. The System Base Station Controller BSC Public Switched Telephone Network Base Mobile Station (MS)‏ Mobile Switching Centre MSC (PSTN)‏ Station Subsystem (BSS)‏ A-Inter A-bis Um 2 Mbit/s PCM Air Interface Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Equip. Id Register EIR Authen. Centre AUC Visitor Location Register VLR Home Location Register HLR Mobile Switching Centre MSC MAP ISUP / TUP MAP MAP MAP ISUP / TUP ISUP / TUP MAP BTS

46. Physical Channels Control Channels Control Channels Traffic Channels Traffic channels showing three timeslot delays between the down and up links. Eight TS, or eight physical channels compromise a FRAME BTS TS 5 TS 4 TS 3 TS2 TS1 TS0 TS 4 TS 3 TS2 TS0 TS7 TS6 TS 5 TS7 TS6 SONOFON M N TS 2 TS1 TS 0 TS7 TS6 TS5 TS 0 TS 7 TS6 TS5 TS4 TS3 TS 1 TS3 TS2 Downlink Uplink

52. Mobile Station Timing advance Measurement Report Message Type : 3Fh = Immediate assignment --- Channel description --- Time slot number : .....001 Channel type and TDMA offset : 01011... = SDCCH/8 + SACCH/C8 or CBCH (SACCH/8)‏ Training Sequence Code : 011..... Hopping channel : ...0.... = Single RF channel spare : ....00.. Absolute RF Channel Number : 720 --- Request reference --- Random access information : 4 T1 : 7 T3 : 19 T2 : 7 --- Timing advance --- Timing advance value : ..000010 Spare : 00...... Timing advance = 2 The mobile station is 1km from the BTS.

58. 1 hyperframe = 2048 superframes (3h 28min 53s 760ms)‏ 0 1 2 3 4 5 6 2042 2043 2044 2045 2046 2047 0 1 2 3 4 5 6 7 18 19 20 21 22 23 24 25 1 superframe = 26 (51-frames) or 51 (26-frames) multiframes (6.12s)‏ 0 1 2 3 4 5 45 46 47 48 49 50 6 1 (26-frame) multiframe = 26 TDMA frames (120ms)‏ Hyper-, Super- and Multiframes 0 1 2 3 4 5 6 7 1 TDMA frame = 8 timeslots (4.615 ms)‏ 0 1 2 3 4 5 6 7 18 19 20 21 22 23 24 25 1 (51-frame) multiframe = 51 TDMA frames (235.38 ms)‏ 0 1 2 3 4 5 45 46 47 48 49 50 6 0 1 2 3 4 5 6 7 1 TDMA frame = 8 timeslots (4.615 ms)‏

59. Downlink and Uplink Bm Bm Bm Bm Bm Bm Bm Bm Bm Bm Bm Bm SA Bm Bm Bm Bm Bm Bm Bm Bm Bm Bm Bm Bm - 0 1 2 3 4 5 6 7 TDMA Frame (8 timeslots)‏ F S BCCH PCH/AGCH F S F S SDCCH/1 SDCCH/2 F S SDCCH/3 SDCCH/4 F S SACCH/1 SACCH/2 - PCH/AGCH PCH/AGCH F S BCCH PCH/AGCH F S F S SDCCH/1 SDCCH/2 F S SDCCH/3 SDCCH/4 F S SACCH/3 SACCH/4 - PCH/AGCH PCH/AGCH R R SACCH/1 SACCH/2 R R R R R R SDCCH/1 SDCCH/2 R R SDCCH/3 SDCCH/4 R R SACCH/3 SACCH/4 R R R R R R SDCCH/1 SDCCH/2 R R SDCCH/3 SDCCH/4 R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R R Cyklus: 1 TCH multiframe = 26 TDMA frames = 120 ms 4.615 ms Downlink: Cyklus: 1 CCH multiframe = 51 TDMA frames = 235.38 ms F = Frequency correction burst S = Synchronisation burst R = RACH R R Uplink: TDMA Frame with 1 combined CCH and 7 TCH

62. Mobile Station Neighbour Cells Measurement Report --- MEAS REP --- --- MEAS RES --- NO NCELL M : 100b = 4 neighbour cell measurement result RXL NCEL 1 : 36 = minimum received signal level = -75 dBm to -74 dBm BCCH NCEL1 : 1 BSIC NCEL1 : 57 RXL NCEL 2 : 24 = minimum received signal level = -87 dBm to -86 dBm BCCH NCEL2 : 12 BSIC NCEL2 : 63 RXL NCEL 3 : 23 = minimum received signal level = -88 dBm to -87 dBm BCCH NCEL3 : 7 BSIC NCEL3 : 59 RXL NCEL 4 : 16 = minimum received signal level = -95 dBm to -94 dBm BCCH NCEL4 : 2 BSIC NCEL4 : 56 RXL NCEL 5 : 0 = minimum received signal level less than -110 dBm BCCH NCEL5 : 0 BSIC NCEL5 : 0 RXL NCEL 6 : 0 = minimum received signal level less than -110 dBm BCCH NCEL6 : 0 BSIC NCEL6 : 0

64. A-bis BTS

65. The System. Base Station Controller BSC Public Switched Telephone Network Base Mobile Station (MS)‏ Mobile Switching Centre MSC (PSTN)‏ Station Subsystem (BSS)‏ A-Inter A-bis Um 2 Mbit/s PCM Air Interface Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Equip. Id Register EIR Authen. Centre AUC Visitor Location Register VLR Home Location Register HLR Mobile Switching Centre MSC MAP ISUP / TUP MAP MAP MAP ISUP / TUP ISUP / TUP MAP BTS

70. Flag 01111110 Flag 01111110 16 Bits CRC Information N - Bits Control Address 16 Bits 8 or 16 Bits Message Discriminator 1 2 3 4 5 6 7 8 Octet 1 Octet 2 Octet n EM Message Type Information Elements 8 7 6 5 4 3 1 2 Fixed Length Info. Element Format Information Element Identifier Length of Information Elements Content of Information Elements Variable Length Info. Element Format T Information Element Identifier Content of Information Elements T: EM = = 0: Non-transparent message Extension bit (future use)‏ Message Discriminator 0 1 4 6 8 Other Reserved Radio Link Management Dedicated Channel Management Common Channel Management Transceiver Management Reserved for Future Use A-bis Layer 3 Structure I

71. Message type Code A-bis Messages, MD=1 Radio Link Layer Management messages DATA REQuest (Transfer of transparent messages in layer 2 DATA INDication I-frames on radio interface)‏ ERROR INDication (Indicates protocol error on radio link layer )‏ ESTablish REQuest (Establishment of layer 2 link on radio interface)‏ ESTablish CONFirm ESTablish INDication RELease REQuest (Release of layer 2 link on radio interface)‏ RELease CONFirm RELease INDication UNIT DATA REQuest (Transfer of transparent messages in layer 2 UI- UNIT DATA INDication frames on radio interface)‏ 0000- - - - 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011

72. A-bis Messages, MD=4, part 1 Message type Code 001- - - - - 00001 00010 00011 00100 00101 00110 00111 01000 01001 01010 01011 Dedicated Channel Management messages: CHANnel ACTIVation (Activation of a radio channel)‏ CHANnel ACTIVation ACKnowledge CHANnel ACTIVation Negative ACKnowledge CONNection FAILure INDication (Failure on radio connection)‏ DEACTIVATE SACCH ENCRyption CoMmanD (Start of ciphering on radio interface)‏ HANDOver DETection (MS handover to new BTS detected)‏ MEASurement RESult (Radio signal measurement data from BTS/MS)‏ MODE MODIFY REQuest (Change of channel mode, e.g. speech to data)‏ MODE MODIFY ACKnowledge MODE MODIFY Negative ACKnowledge

73. A-bis Messages, MD=4, part 2 Message type Code Dedicated Channel Management messages: PHYsical CONTEXT REQuest (Physical context is not specified by ETSI)‏ PHYsical CONTEXT CONFirm RF CHANnel RELease (Release of radio channel)‏ MS POWER CONTROL (Change of MS power level or control limits)‏ BS POWER CONTROL (Change of TRX power level or control limits)‏ PREPROCess CONFIGure (Conveys pre-processing parameters to BTS)‏ PREPROCessed MEASurement RESult (From BTS)‏ RF CHANnel RELease ACKnowledge 001- - - - - 01100 01101 01110 01111 10000 10001 10010 10011

74. A-bis Messages, MD = 6 Message type Code 00010 - - - 001 010 011 100 101 110 111 Common Channel Management messages: BCCH INFOrmation (Indicates new information to be sent on BCCH)‏ CCCH LOAD INDication (Indicates load on RACH and PCH)‏ CHANnel REQuired (Reception of RR Channel Request message)‏ DELETE INDication (Deletion of RR Immediate Assign message due to overload on AGCH)‏ PAGING CoMmanD (Requests paging of MS)‏ IMMediate ASSign CoMmanD (Setup of DCCH, answer to CHAN REQ)‏ SMS BroadCast REQuest (Broadcast of SMS-message in cell)‏

75. A-bis Messages, MD=8 Message type Code TRX Management messages: RF RESource INDication (Interference level on idle radio channels)‏ SACCH FILLing (New filling information to be used on SACCH)‏ OVERLOAD (Control channel or TRX processor overload)‏ ERROR REPORT (Detection of errored message)‏ 00011 - - - 001 010 011 100

76. - Channel number (Indicates channel on radio interface)‏ - Link identifier (Signalling link and SAPI used on radio interface)‏ - Activation type (Intra-cell, inter-cell or additional assignment CHAN ACTIV)‏ - BS power (BTS/TRX power level)‏ - Channel identification (Description of channels allocated to MS)‏ - Channel mode (Indicates discontinuous transmission and channel type, e.g. speech)‏ - Encryption information (Encryption algorithm and key)‏ - Frame number (On radio interface, modulo 42432)‏ - Handover reference (Identical to handover reference in RR information elements)‏ - L1 information (MS power level and timing advance)‏ - L3 information (Contains transparent RR, MM or CM message)‏ - MS identity (IMSI or TMSI)‏ - MS power (MS power level)‏ - Paging group (Identifies MS paging group)‏ - Paging load (Load on paging channel, PCH)‏ - Physical context (Not specified)‏ - Access delay (Delay of MS access burst at random access or handover)‏ - RACH load (Load of random access channel, RACH)‏ - Request reference (Random ref. in RR Channel Request message)‏ A-bis Information Elements, part 1

77. - Release mode (Normal release or local end release)‏ - Resource information (Interference level for idle TRX channels)‏ - RLM cause (Indicates protocol error on radio link layer)‏ - Starting time (Expressed as Frame Number modulo 42432)‏ - Timing advance (To be used by MS in subsequent communications)‏ - Uplink measurements (Radio signal measurement results from TRX)‏ - Cause (Reason for event/failure)‏ - Measurement result num (For a radio channel; set to 0 at activation)‏ - Message identifier (In ERROR REPORT message: Message type of errored message)‏ - Message indicator (In ERROR REPORT message: Copy of errored message follows)‏ - System info type (Type of RR System Information message)‏ - MS power parameters (Limits set by BSC for BTS control of MS power)‏ - BS power parameters (Limits set by BSC for BTS control of TRX power)‏ - Preprocessing param. (For preproc. of radio measurement data in BTS)‏ - Preprocessed measurements (Preprocessed radio measurement data)‏ - Immediate assign info (Conveys complete RR Immediate Assign msg.)‏ - SMSCB information (SMS-message to be broadcasted in a radio cell)‏ A-bis Information Elements, part 2

80. BSC BTS A-bis signalling example BTS ENCRyption CoMmanD (Ciphering Mode Command [RR])‏ ESTablish INDication {MS establishes layer 2 on TCH} DEACTIVATE SACCH {on BTS} RF CHANnnel RELease {release of TCH} DATA REQuest (Release [CM])‏ DATA INDication (Release Complete [CM]) RF CHANnel RELease {release of SDCCH} DATA INDication (Assign Complete [RR]) {MS now ready on TCH} DATA REQuest (Assign Command [RR]) {assigns TCH to MS} CHANnel ACTIVation ACKnowledge {TCH activ} DATA INDication (Ciphering Mode Complete [RR])‏ CHANnel ACTIVation {activation of TCH} CHANnel REQuired {MS requests DCCH} CHANnel ACTIVation {activation of SDCCH} CHANnel ACTIVation ACKnowledge {SDCCH activ} IMMediate ASSign CoMmanD {assigns SDCCH to MS} ESTablish INDication (CM Service Request [MM]) {L2 up on SDCCH} DATA INDication (Setup [CM])‏ DATA REQuest (Call Proceeding [CM])‏ DATA REQuest (Alerting [CM]) {call setup continues on TCH} RELease INDication {MS releases layer 2 on SDCCH} RF CHANnel RELease ACKnowledge {SDCCH released} . RELease INDicaton {MS releases layer 2 on TCH} DATA INDication (Disconnect [CM]) {MS disconnects call} DATA REQuest ( Channel Release [RR]) {to MS, deactivation of TCH} RF CHANnel RELease ACKnowledge {TCH released} Active Call DATA REQuest (Connect [CM])‏ DATA INDication (Connect Acknowledge [CM])‏ DATA REQuest (Authentication Request (RAND) [MM])‏ DATA INDication (Authentication Response (SRES) [MM])‏

81. A-Interface. BTS

82. The System. Base Station Controller BSC Public Switched Telephone Network Base Mobile Station (MS)‏ Mobile Switching Centre MSC (PSTN)‏ Station Subsystem (BSS)‏ A-Inter A-bis Um 2 Mbit/s PCM Air Interface Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Equip. Id Register EIR Authen. Centre AUC Visitor Location Register VLR Home Location Register HLR Mobile Switching Centre MSC MAP ISUP / TUP MAP MAP MAP ISUP / TUP ISUP / TUP MAP BTS

86. Basic format of MSU - SCCP message === MTP === BSN : 66 BIB : 0....... FSN : 4 FIB : 1....... LI : 28 = MSU SPARE : 00...... SIO : 03h = SCCP Label SIF F CK F I B FSN F B I B BSN LI > 2 SIO User Data MTC SLS Originating Point Code Destination Point Code N x 8 bits 8 bits 14 bits 14 bits 4 bits Mandatory fixed part Mandatory variable part Optional part Service Indicator 0 0 1 1 Sub-service Field

90. Connection-oriented Data Transfer Data Transfer Data Transfer = Release Resource = Reserved Resource CR CC CC CR RLC RLSD RLSD RLC STP SCP SCP

91. Connectionless Data Transfer UDT UDT UDT UDT STP SCP SCP

100. A-Interface BSSAP BTS

102. SCCP Information elements SCCP Header SSN FEh: BSSAP Discriminator 0 0 0 0 0 0 0 0 1 1 DLCI Data Link Connection Identifier Discriminator 0 0 0 0 0 0 0 1 OCTET DLCI 2 3 2 Length Indicator 1 n n Layer 3 Messages Octet Length Indicator 1 Layer 3 Um Interface Octet Bit no.: 8 7 6 5 4 3 2 1 C2 C1 0 0 0 S3 S2 S1 C2 C1 identifies signaling-radio channel (00: SDCCH/FACCH, 01: SACCH)‏ S3-S1 is the SAPI on the radio interface BSSMAP DTAP Label SIF F CK F I B FSN F B I B BSN LI > 2 SIO x3h

103. A-Interface BSSMAP BTS

104. BSSMAP Format BTS Disc. 0 = BSSMAP Length indicator BSSMAP message type BSSMAP message Information Element Identifier Length of Information Elements Content of Information Elements Information Element Identifier Content of Information Elements Fixed Length Info. Element Format Variable Length Info. Element Format OCTET 1 OCTET 2 OCTET n

105. BSSMAP Messages, part 1 Assignment messages: (Setup of traffic channels)‏ - Assignment request - Assignment complete - Assignment failure Release messages: - Clear command (Release of traffic channels)‏ - Clear complete - Clear request - SAPI "n" clear command (Control of layer 2 links with SAPI not equal - SAPI "n" clear complete to 0 on the radio interface)‏ - SAPI "n" reject 0000- - - - 0001 0010 0011 0010- - - - 0000 0001 0010 0011 0100 0101 Message type Code

106. BSSMAP Messages, part 2 Message type Code Handover messages: - Handover request (To BSC: Request for handover to that BSC)‏ - Handover required (To MSC: Inter-BSC/MSC handover required)‏ - Handover request ack (To MSC: Acknowledge of Handover request)‏ - Handover command (To BSC: Contains the new radio channel/BTS to which the MS should switch)‏ - Handover complete (To MSC: Commanded handover complete)‏ - Handover failure (To MSC: Commanded handover unsuccessful)‏ - Handover performed (To MSC: BSC has performed intern. handover)‏ - Handover candidate (To BSC: MSC requests list of MS that could enquire be handed over to another cell)‏ - Handover candidate (To MSC: Answer to Handover candidate response enquire)‏ - Handover required reject (To BSC: Required handover unsuccessful)‏ - Handover detect (To MSC: Commanded handover successful)‏ 0001- - - - 0000 0001 0010 0011 0100 0110 0111 1000 1001 1010 1011

107. BSSMAP Messages, part 3 Message type Code General messages: - Reset (Initialisation of BSS or MSC due to failure)‏ - Reset Acknowledge - Overload (Processor or CCCH overload)‏ - Trace invocation (Start production of trace record)‏ - Reset Circuit (Initialisation of single circuit due to failure)‏ - Reset Circuit acknowledge Terrestrial resource messages: - Block (Management of circuits/time slots - Blocking acknowledge between MSC and BTS) - Unblock - Unblocking acknowledge 0011- - - - 0000 0001 0010 0011 0100 0101 0100- - - - 0000 0001 0010 0011

108. BSSMAP Messages, part 4 Message type Code Radio resource messages: - Resource request (Available radio channels in the BSS cells)‏ - Resource indication - Paging (Paging of MS)‏ - Cipher mode command (Commands start of cyphering)‏ - Classmark update (Change of MS power class)‏ - Cipher mode complete (Ciphering is successfully initiated)‏ - Queuing indication (Indicates delay in assignment of traffic channel)‏ - Complete layer 3 (Contains first message received from MS; information sets up SCCP-connection at A-interface)‏ 0101- - - - 0000 0001 0010 0011 0100 0101 0110 0111

111. A-Interface DTAP BTS

113. Information Element Identifier Length of Information Elements Content of Information Elements Information Element Identifier Content of Information Elements Fixed Length Info. Element Format Variable Length Info. Element Format OCTET 1 OCTET 2 OCTET n DTAP Format BTS Disc. 1 = DTAP Length indicator BSSMAP message type BSSMAP message

115. A-Interface signalling example [MM]))‏ BTS MSC BSC SCCP CR (BSSMAP Comp layer 3 info (CM Service Request SCCP CC (BSSMAP Cipher mode command)‏ SCCP DT1 (BSSMAP Cipher mode complete)‏ SCCP DT1 (DTAP (Setup [CM]))‏ SCCP DT1 (DTAP (Call Proceeding [CM]))‏ SCCP DT1 (BSSMAP Assignment request)‏ SCCP DT1 (BSSMAP Assignment complete)‏ SCCP DT1 (DTAP (Alerting [CM]))‏ SCCP DT1 (DTAP (Connect [CM]))‏ SCCP RLC SCCP DT1 (DTAP (Disconnect [CM]))‏ SCCP DT1 (DTAP (Release [CM]))‏ SCCP DT1 (DTAP (Release Complete [CM]))‏ SCCP DT1 (BSSMAP Clear command)‏ SCCP DT1 (BSSMAP Clear complete)‏ SCCP RLSD . . . . . . . . . Active call

116. Inter-MSC Signalling MAP BTS

117. Base Station Controller BSC Public Switched Telephone Network Base Mobile Station (MS)‏ Mobile Switching Centre MSC (PSTN)‏ Station Subsystem (BSS)‏ A-Inter A-bis Um 2 Mbit/s PCM Air Interface Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Base Transceiver Station BTS Equip. Id Register EIR Authen. Centre AUC Visitor Location Register VLR Home Location Register HLR Mobile Switching Centre MSC MAP ISUP / TUP MAP MAP MAP ISUP / TUP ISUP / TUP MAP The System. BTS

127. Connectionless Data Transfer UDT UDT UDT UDT STP SCP SCP

128. Signalling System Number 7 Level 4/User Parts TCAP MTP Level 3 Physical Data Link Network Transport Session Presentation Application OSI Layer SS7 Levels 7 6 5 4 3 2 1 MTP Level 1 MTP Level 2 I S U P SCCP TCAP T U P INAP, MAP SCCP TCAP Physical MTP Level 1 Data Link 2 MTP Level 2 MTP Level 3 Network 3 I S U P Transport Session Presentation Application

136. TCAP Structure Message type tag Total message length Transaction portion information element Component portion tag Component type tag Component length Component portion information element Component Abort Cause Dialogue Portion Component Portion Destination Transaction Identifier Originating Transaction Identifier Tag Length Contents Tag Length Contents Invoke ID Linked ID Operation Code Sequence Error Code Problem Code - Unidirectional - Begin - End - Continue - Abort - Invoke - Return Result (Last)‏ - Return Result (Not Last)‏ - Return Error - Reject

139. TCAP Signaling Example. SCP SSP BEGIN ORIG TID: 75 INVOKE INVOKE ID: 0 CONTINUE ORIG TID: 18 DEST TID: 75 INVOKE INVOKE ID: 0 CONTINUE ORIG TID: 75 DEST TID: 18 RET RES L INVOKE ID: 0 CONTINUE ORIG TID: 18 DEST TID: 75 INVOKE INVOKE ID: 1 CONTINUE ORIG TID: 18 DEST TID: 75 INVOKE INVOKE ID: 2 CONTINUE ORIG TID: 75 DEST TID: 18 RET RES L INVOKE ID: 2 CONTINUE ORIG TID: 75 DEST TID: 18 RET RES L INVOKE ID: 1 END DEST TID: 75 INVOKE INVOKE ID: 0 Application Begin Data send Data received Data send Data send Data received Data received Application End

140. Signalling System Number 7 Level 4/User Parts MAP MTP Level 3 Physical Data Link Network Transport Session Presentation Application OSI Layer SS7 Levels 7 6 5 4 3 2 1 MTP Level 1 MTP Level 2 I S U P SCCP TCAP T U P INAP, MAP SCCP TCAP MAP BTS Physical MTP Level 1 Data Link 2 MTP Level 2 MTP Level 3 Network 3 I S U P Transport Session Presentation Application

142. Called party address Message type Calling party address Protocol class 0, 1 Pointers MAP Info. TCAP part Sub-system Number (part of the address field)‏ SCCP User Data Format of SCCP message for MAP information Label SIF F CK F I B FSN F B I B BSN LI > 2 SIO x3h

143. MAP information in TCAP Message type tag Total message length Transaction portion information element Component portion tag Component type tag Component length Component portion information element Component Tag Length Contents Tag Length Code Parameter

145. 1 Update location area 2 Update location 3 Cancel location 4 Provide roaming number 5 Detach IMSI 6 Attach IMSI 7 Insert subscriber data 8 Delete subscriber data 9 Send parameters 10 Register SS 11 Erase SS 12 Activate SS 13 Deactivate SS 14 Interrogate SS 15 Invoke SS 16 Forward SS notification 17 Register password 18 Get password 19 Process unstructured data MAP Operations Part 1 BTS Operation Value

146. 20 Send info for incoming call 21 Send info for outgoing call 22 Send routing information 23 Complete call 24 Connect to following address 25 Process call waiting 26 Page 27 Search for mobile subscriber 28 Perform handover 29 Send end signal 30 Perform subsequent handover 31 Allocate handover number 32 Send handover report 33 Process access signalling 34 Forward access signalling 35 Note internal handover 36 Register charging information 37 Reset 38 Forward check SS indication MAP Operations Part 2 BTS Operation Value

147. 39 Authenticate 40 Provide IMSI 41 Forward new TMSI 42 Set ciphering mode 43 Check IMEI 45 Send routing info for SM 46 Forward short message 47 Set message-waiting data 48 Note MS present 49 Alert service centre 50 Activate trace mode 51 Deactivate trace mode 52 Trace subscriber activity 53 Process access request 54 Begin subscriber activity MAP Operations Part 3 BTS Operation Value

148. Home side Visited side INVOKE (Update Location)‏ BEGIN INVOKE (Insert Subscriber Data)‏ CONTINUE RETURN RESULT CONTINUE (Update Location)‏ END (Insert Subscriber Data)‏ RETURN RESULT MAP - signalling Location Updating example BTS

149. GSM Signalling procedures BTS

152. MS BTS BSC MSC VLR 1 VLR 2 HLR Location Update Request (old LAI, TMSI) [MM] Update Location Area (old LAI, new LAI, TMSI)‏ Send Parameters (old LAI, TMSI)‏ Send Parameters Result (IMSI)‏ Update Location (IMSI, MSRN, VLR no)‏ Cancel Loc (IMSI, VLR' no)‏ Cancel Location Ack Update Location Ack Insert Subscriber Data (IMSI, service inf)‏ Subscriber Data Acknowledge Update Location Area Ack Forward New TMSI (TMSI)‏ Location Update Accept (new LAI, TMSI) [MM] TMSI Reallocation Complete [MM] TMSI Ack Channel Release [RR] Clear Command [RR] Um/A-bis/A signalling MAP signalling Location Updating (Roaming)‏

155. Send handover report Um/A-bis/A signalling MAP signalling ISUP/TUP signalling MS BTS BSC-A MSC-A BSC-B MSC-B VLR-B Handover Required (new BTS) [RR] Perform handover (new BTS, Ch type)‏ Handover Request (new BTS)‏ Handover Req Ack (Radio Ch)‏ Allocate handover number (MSRN)‏ (MSRN)‏ Radio Ch Ack (Radio Ch, MSRN)‏ IAM (MSRN)‏ ACM Handover Command (Radio CH) [RR] Handover Complete [RR] Clear Command[RR] Clear Complete[RR] Send End Signal Answer Measurement Result [RR] Handover, example

158. IAM (MSISDN, service)‏ BTS BSC MSC VLR HLR GMSC ISDN Send Routing Info (MSISDN)‏ Roaming Number (MSRN)‏ Routing Info (MSRN)‏ Provide Roaming Number (IMSI)‏ IAM (MSRN, service)‏ Send Info Incoming Call (MSRN, service)‏ Page (IMSI, TMSI, LAI)‏ Paging Request (TMSI) [RR] Paging Response (TMSI) [RR] Page Result Complete Call (service)‏ Channel Request [RR] Immediate Assign [RR] SETUP (service) [CM] Call Confirm [CM] Assign Command [RR] Assign Req [RR] Assign Complete [RR] Alerting [CM] ACM Connect [CM] ANM Connect Ack [CM] Complete Call Result MS Um/A-bis/A signalling MAP signalling ISUP/TUP signalling Incoming Call

160. Um/A-bis/A signalling MAP signalling ISUP/TUP signalling Outgoing Call from MS BTS BSC MSC VLR ISDN Immediate Assign [RR] CM Service Req (IMSI, transact) [MM] Process Access Request Authenticate (RAND)‏ Authentication Request (RAND) [MM] Authentication Response (SRES) [MM] Authentication Response (SRES)‏ Set ciphering mode (key)‏ Ciphering Mode Command (key) [RR] Ciphering Mode Complete [RR] Access Request Ack SETUP (service, called number) [CM] Send info for o/g (service, called number)‏ Complete call Call Proceeding [CM] Assign Request [RR] Assign Command [RR] Assign Complete [RR] IAM ACM ANM Alerting [CM] Connect [CM] Connect Ack [CM] CM copy [MM] MS Channel Request/Required [RR]

161. Signalling System Number 7 Level 4/User Parts INAP MTP Level 3 Physical Data Link Network Transport Session Presentation Application OSI Layer SS7 Levels 7 6 5 4 3 2 1 MTP Level 1 MTP Level 2 I S U P SCCP TCAP T U P INAP, MAP SCCP TCAP INAP Physical MTP Level 1 Data Link 2 MTP Level 2 MTP Level 3 Network 3 I S U P Transport Session Presentation Application

172. Intelligent Network Signalling Procedures IN