SHORT MESSAGE SERVICE TRAFFIC CASES

The Short Message Service (SMS) provides a means of sending text messages containing up to 160 alpha numerical characters to and from MS’s. SMS makes use of a SMS Center (SMS-C), which acts as a store and forward center for short messages. SMS consists of two basic services:

• Mobile terminated SMS: from an SMS–C to an MS

• Mobile originated SMS: from an MS to an SMS–C In the two cases described below, the MS is in idle mode. If the MS is in active mode, short message is transmitted on the SACCH. No paging, call set-up, authentication, etc. needs to be performed in that case.

MOBILE ORIGINATED SMS

Mobile originated SMS transfers a short message submitted by the MS to an SMS-C. It also provides information about the delivery of the short message, either by a delivery report or failure report.

Mobile originating short message

1. An MS establishes a connection to the network, as in the case of a normal call set-up. This step is not performed if the MS is in active mode, since the connection already exists.

2. If authentication is successful, the MS sends the short message using SDCCH to the SMS–C via the MSC/VLR. The SMS–C in turn forwards the short message to its destination. This could be an MS or a terminal in the fixed network, such as a PC.

MOBILE TERMINATED SMS

Mobile terminated SMS has the capability to transfer a short message from the SMS–C to an MS.

Mobile terminating short message

1. A user sends a message to a SMS–C.

2. The SMS–C sends the message to the SMS–GMSC.

3. The SMS–GMSC queries the HLR for routing information.

4. The HLR returns routing information to the SMS-GMSC.

5. The SMS-GMSC re-routes the message to the MSC/VLR.

6. The MS is paged and a connection is set up between the MS and the network, as in the normal call set-up case.

7. If authentication is successful, the MSC/VLR delivers the message to the MS. Short messages are transmitted on the allocated signaling channel, SDCCH.

8. If the delivery was successful, a report is sent from the MSC/VLR to the SMS–C, if not, the HLR is informed by the MSC/VLR, and a failure report is sent to SMS–C.

In the case of an unsuccessful delivery, the SMS-C informs the HLR and VLR that there is a message waiting to be delivered to the MS. The HLR then informs the SMS–C when the MS becomes available. Mobile terminated SMS can be input to the SMS–C via a variety of sources, e.g. speech, telex, facsimile or internet.

INTERNATIONAL TRAFFIC CASES

One of the primary features of GSM is the ability to perform international roaming and to handle international call cases. In order for a mobile subscriber to be able to make calls while roaming in a different GSM network, there must be an agreement between the subscriber’s home network operator and the visited network operator. This also applies to international roaming. Although there are less significant affects on other traffic cases, the two traffic cases that are affected most are outlined here.

IMSI ATTACH

When an MS is roaming internationally, the following occurs:

1. The MS is switched on and scans all GSM frequencies within one frequency band (e.g. GSM 900). It is searching for a BCCH carrier. The MS tunes to the BCCH carrier that has the strongest signal strength and reads its system information. This includes the identity of the network operator.

2. The MS compares this network identity with the list of forbidden PLMN’s in the SIM memory. This list contains all network identities, which the subscriber’s home operator does not have an international roaming agreement with. If the network, which the MS has tuned to, is a forbidden network, the MS continues to scan for a permitted network.

3. If the MS does not find a permitted network, but has identified a forbidden network, it displays the message “Emergency Calls Only”. If the MS finds a permitted network, it tunes to it and sends an IMSI attach message.

4. The remainder of this traffic case is identical to that of the normal IMSI attach case, with the only difference being that the subscriber’s HLR is located in another country.

CALL TO AN MS

When an MS is roaming internationally and a call is made to it, the procedure used is identical to when the MS is in their home network. The only major difference is that the GMSC and HLR used are in the home network, while the MSC/VLR is in a network in another country.

DROPBACK FUNCTIONALITY

The following traffic case demonstrates the advantages of using dropback functionality. It involves two subscribers:

• Subscriber A is from France and is located in France under the control of the MSC/VLR-A.

• Subscriber B is from Sweden but is currently roaming internationally in France under the control of the same MSC/VLR-A.

1. Subscriber A calls subscriber B. The call is routed internationally from France to Sweden.

2. The Swedish network then identifies that B is in under the control of MSC/VLR-A in France and routes the call back to France. The subscribers are connected to each other and continue their call.

• Without dropback: the speech on the call goes through the GMSC in Sweden.

• With dropback: the speech on the call is switched within MSC/VLR-A, thus saving on processing and transmission costs.

Traffic case showing the advantage of using dropback

Handover

The process of changing cells during a call is called handover in GSM terminology. To choose the best target cell, the MS and the RBS perform measurements. Because the MS contributes to the handover decision, this type of handover is often called Mobile Assisted HandOver (MAHO).

Locating

An MS continuously measures signal strength and quality on it’s own cell and signal strength on the BCCH carriers of the neighboring cells. The measurements are carried out on the downlink while MS is in active mode. The measurement results are sent to the RBS on SACCH at regular intervals. The serving RBS measures signal strength and quality on the uplink.

Measurements sent to BSC

The measurements from the RBS and MS are sent to the BSC in the form of measurement reports. Based on these reports, the BSC decides if a handover is necessary and to which cell. This is called locating. As soon as a neighboring cell is considered to be better than the serving cell, a handover is attempted. Another reason for attempting a handover, apart from signal strength and quality, is when the Timing Advance (TA) used by MS exceeds a threshold value set by the operator. This usually happens when the MS is moving over the cell border to another cell. When the MS has changed cells, the new RBS informs the MS about the new neighboring BCCH carriers so measurements can be taken again. If the MS has also switched to a new LA, a location updating type normal takes place after the call has finished. Handover can be used for load balancing between cells. During a call setup in a congested cell, the MS can be transferred to a cell with less traffic if an acceptable connection quality is likely to be obtained. Another area where forced handover is a useful tool is maintenance. Channels can be released from traffic if necessary, e.g. for RBS maintenance reasons. There are several types of handover, including:

• Intra-cell handover

• Handover between cells controlled by the same BSC

• Handover between cells controlled by different BSC’s, but the same MSC/VLR

• Handover between cells controlled by different MSC/VLRs

Each of these traffic cases is described in greater detail below. In each case, the decision to perform a handover has already been made and a target cell has been identified.

Intra-Cell Handover

A special type of handover is the intra-cell handover. It is performed when the BSC considers the quality of the connection too low, but receives no indication from the measurements that another cell would be better. In that case the BSC identifies another channel1 in the same cell which may offer a better quality, and the MS is ordered to retune to it.

Handover between Cells Controlled by the Same BSC

When performing a handover between two cells controlled by the same BSC, the MSC/VLR is not involved. However, the MSC/VLR will be informed when a handover has taken place. If the handover involves different LA’s, location updating is performed once the call is finished.

Handover: cells controlled by the same BSC

1. The BSC orders the new RBS to activate a TCH.

2. The BSC sends a message to the MS, via the old RBS, containing information about the frequency and time slot to change to and also the output power to use. This information is sent to the MS using FACCH.

3. The MS tunes to the new frequency, and transmits handover access bursts in the correct time slot. Since the MS has no information yet on TA, the handover bursts are very short (only 8 bits of information).

4. When the new RBS detects the handover bursts, it sends information about TA. This is also sent via FACCH.

5. The MS sends a Handover Complete message to the BSC via the new RBS.

6. The BSC tells the old RBS to release the old TCH.

Handover between Cells Controlled by Different BSC’s but the Same MSC/VLR

When another BSC is involved in a handover, the MSC/VLR must also be involved to establish the connection between the two BSC’s.

Handover: different BSC’s but the same MSC/VLR

1. The serving (old) BSC sends a Handover Required message to the MSC containing the identity of the target cell.

2. The MSC knows which BSC controls this cell and sends a Handover Request to this BSC.

3. The new BSC orders the target RBS to activate a TCH.

4. The new BSC sends a message to the MS via the MSC and the old RBS.

5. MS tunes to the new frequency and transmits handover access bursts in the correct time slot.

6. When the new RBS sends information about TA.

7. MS sends a Handover Complete message to MSC via the new BSC.

8. MSC sends the old BSC an order to release the old TCH.

9. The old BSC tells the old RBS to release the TCH.

Handover between Cells Controlled by Different MSC/VLRs

Handover between cells controlled by different MSC/VLRs can only be performed within one PLMN and not between two PLMN’s. Cells controlled by different MSC/VLRs also means that they are controlled by different BSC’s.

Handover: cells controlled by different MSC’s

1. The serving (old) BSC sends a Handover Required message to the serving MSC (MSC–A), with the identity of the target cell.

2. MSC–A identifies that this cell belongs to another MSC, (MSC–B), and requests help.

3. MSC–B allocates a handover number to reroute the call. A Handover Request is then sent to the new BSC.

4. The new BSC orders the target RBS to activate a TCH.

5. MSC–B receives the information, and passes it on to MSC– A together with the handover number.

6. A link is set up to MSC–B, possibly via PSTN.

7. MSC–A sends a handover command to the MS, via the old BSC.

8. The MS tunes to the new frequency and transmits handover access bursts in the correct time slot.

9. When the new RBS detects the handover bursts it sends information about TA.

10. The MS sends Handover Complete message to the old MSC via the new BSC and the new MSC/VLR.

11. A new path in the group switch in MSC–A is established, and the call is switched through.

12. The old TCH is deactivated by the old BSC (not shown in the picture).

The old MSC, MSC–A, retains main control of the call until the call is cleared. This is because it contains the information about the subscriber and call details such as charging. After call release, the MS must perform location updating because a LA never belongs to more than one MSC/VLR service area. The HLR is updated by the VLR–B, and will in turn tell VLR–A to delete all information about the mobile subscriber.

TRAFFIC CASES: MS IN ACTIVE MODE

An MS is in active mode when there is a call (speech, fax or data), or a call set up procedure taking place.

Cases which activate an MS and cases when MS is in active mode

CALL FROM AN MS

This section describes what happens when a mobile subscriber wants to set up a voice call to a subscriber in the PSTN. Data and text message calls are described separately.

Call set-up MS to PSTN

1. The MS uses RACH to ask for a signaling channel.

2. The BSC/TRC allocates a signaling channel, using AGCH.

3. The MS sends a call set-up request via SDCCH to the MSC/VLR. Over SDCCH all signaling preceding a call takes place. This includes:

• Marking the MS as “active” in the VLR

• The authentication procedure

• Start ciphering

• Equipment identification

• Sending the B-subscriber’s number to the network

• Checking if the subscriber has the service “Barring of outgoing calls” activated

4. The MSC/VLR instructs the BSC/TRC to allocate an idle TCH. The RBS and MS are told to tune to the TCH.

5. The MSC/VLR forwards the B–number to an exchange in the PSTN, which establishes a connection to the subscriber.

6. If the B-subscriber answers, the connection is established.

CALL TO AN MS

The major difference between a call to an MS and a call from an MS is that in a call to an MS the exact location of the mobile subscriber is unknown. Therefore, the MS must be located using paging before a connection can be established. Below is the description of the call set-up procedure for a call from a PSTN subscriber to a mobile subscriber. A call from an MS to a mobile subscriber operates according to the same process, the only difference being that the GMSC is contacted by another MSC/VLR instead of by a PSTN node.

Call to MS from PSTN

1. The PSTN subscriber keys in the MS’s telephone number (MSISDN). The MSISDN is analyzed in the PSTN, which identifies that this is a call to a mobile network subscriber. Aconnection is established to the MS’s home GMSC.

2. The GMSC analyzes the MSISDN to find out which HLR the MS is registered in, and queries the HLR for information about how to route the call to the serving MSC/VLR.

3. The HLR translates MSISDN into IMSI, and determines which MSC/VLR is currently serving the MS. The HLR also checks if the service, “Call forwarding to C–number” is activated, if so, the call is rerouted by the GMSC to that number.

4. The HLR requests an MSRN from the serving MSC/VLR.

5. The MSC/VLR returns an MSRN via HLR to the GMSC.

6. The GMSC analyses the MSRN and routes the call to the MSC/VLR.

7. The MSC/VLR knows which LA the MS is located in. A paging message is sent to the BSC’s controlling the LA.

8. The BSC’s distribute the paging message to the RBS's in the desired LA. The RBS’s transmit the message over the air interface using PCH. To page the MS, the network uses an IMSI or TMSI valid only in the current MSC/VLR service area.

9. When the MS detects the paging message, it sends a request on RACH for a SDCCH.

10. The BSC provides a SDCCH, using AGCH.

11. SDCCH is used for the call set-up procedures. Over SDCCH all signaling preceding a call takes place. This includes:

• Marking the MS as “active” in the VLR

• The authentication procedure

• Start ciphering

• Equipment identification

12. The MSC/VLR instructs the BSC/TRC to allocate an idle TCH. The RBS and MS are told to tune to the TCH. The mobile phone rings. If the subscriber answers, the connection is established.

TRAFFIC CASES: MS IN IDLE MODE

Traffic cases when MS is in idle mode

ATTACHING TO THE NETWORK

IMSI attach

When an MS is switched on, the IMSI attach procedure is executed. This involves the following steps:

1. The MS sends an IMSI attach message to the network indicating that it has changed state to idle.

2. The VLR determines whether there is a record for the subscriber already present. If not, the VLR contacts the subscriber’s HLR for a copy of the subscription information.

3. The VLR updates the MS status to idle.

4. Acknowledgement is sent to the MS.

IMSI attach

Location Updating, type IMSI Attach

If the MS has changed LA while powered off, the IMSI attach procedure may lead to an update to the location of the MS. During IMSI attach, the VLR may determine that the current LAI of the MS is different from the LAI stored in the MS’s subscription information. If so, the VLR updates the LAI of the MS.

ROAMING IN THE NETWORK

Changing Cells within an LA

MS’s are constantly moving around in the cellular network. The MS location information stored in the VLR is the LA. If an MS changes cells within a LA, the network is not updated. The MS knows that the new cell belongs to the same LA by listening to the BCCH in the new cell. The BCCH broadcasts the cell’s LAI. The MS compares the last LAI received with the new LAI. If they are the same, it means that the MS has not changed LA's and does not need to inform the network.

Location Updating, Same MSC/VLR

If an MS detects a change in LAI on the BCCH, it informs the network. When the MS sends the Location Updating message, the MSC/VLR determines whether it is an MS, which is already registered, or if it is an MS visiting from another MSC/VLR.

Location updating, same MSC/VLR

1. The MS listens to BCCH in the new cell to determine the LAI. The received LAI information is compared to the old one. If they differ, a location update is necessary.

2. The MS establishes a connection with the network via SDCCH. Authentication is performed.

3. If authentication is successful, the MS sends a Location Updating Request to the system.

4. The system acknowledges Location Updating and requests RBS and MS to release the signaling channel.

Location Updating, New MSC/VLR

When an MS roams into a new LA, location updating is performed. However, unknown to the MS, the LA may belong to a new MSC/VLR. When the Location Update Request is received by the new VLR, it executes the procedure below.

Location updating, new MSC/VLR

1. Authentication is performed. If authentication is successful, the VLR checks its database to determine whether or not it has a record for this MS-subscription.

2. When the VLR finds no record for the MS, it sends a request to the subscriber’s HLR for a copy of the MS-subscription.

3. The HLR passes the information to the VLR and updates its location information for the subscriber. The HLR instructs the old VLR to delete the information it has about the MSsubscription.

4. The VLR stores its subscription information for the MS including the latest location and status (idle). The VLR sends acknowledgement to the MS.

Location Updating, type Periodic Registration

Periodic registration is a feature which forces MS’s to send a registration message to the network at predefined intervals. If an MS should miss such a registration, the network will mark the MS as detached. This may occur if an MS is out of the area of coverage and ensures that needless paging is not performed. If the network uses periodic registration, the MS will be informed, on the BCCH of how often periodic registration must be performed. Periodic registration has an acknowledgment message. The MS tries to register until it receives this message.

DETACHING FROM THE NETWORK

IMSI Detach

IMSI detach enables the MS to indicate to the network that it is switched off. At power off, the MS sends an IMSI detach message to the network. On reception, the VLR marks the corresponding IMSI as detached. The HLR is not informed. No acknowledgement is sent to the MS.

Implicit Detach

If the MS sends an IMSI detach message to the system and the radio link quality is poor, the system might not be able to decode the information. Because no acknowledgment is sent to the MS, no further attempt is made. In this case, the system still regards the MS as attached. If periodic registration is in use, the system will soon determine that the MS is detached. The VLR then performs an implicit detach, marking the MS as detached.

MS Purging

MS purging is used to inform the HLR that the VLR is about to remove a subscriber record from the VLR. The HLR then sets the MS purged flag and treats the subscriber as unreachable. This saves unnecessary network signaling and database lookup. For example, an UK MS travels to Australia and performs a location update in an MSC/VLR in Australia. Later, the subscriber travels back to the UK, which takes some time. During this period, the subscriber is not active. If MS purging is not used, when a caller makes a call to the MS, the HLR identifies the MS as registered in the Australian MSC/VLR and routes the call to it. The MSC/VLR then informs the HLR that the subscriber is unreachable. If MS purging is used; the UK subscriber’s record will have been purged from the Australian MSC/VLR. When a call is made to the subscriber, the HLR identifies the MS as unreachable and does not contact the Australian MSC/VLR.

GSM NETWORK IDENTITIES

Network identities are numbers that a GSM network uses to locate a mobile subscriber when it is establishing a call to that subscriber. As the network relies on these identities to route calls to subscribers, it is important that each identity is unique and correct. Numbering plans are used to identify different networks as specified by the International Telecommunications Union - Telecommunications (ITU-T). For a telephone number in the PSTN/ISDN network, ITU-T's numbering plan E.164 is used.

SUBSCRIBER-RELATED IDENTITIES

Mobile Station ISDN number (MSISDN)

The Mobile Station ISDN number (MSISDN) uniquely identifies a mobile telephone subscription in the PSTN numbering plan. This is the number dialed when calling a mobile subscriber. As the MSISDN is the actual telephone number of the mobile subscriber, it is the only network identity that subscribers are aware of. All other network identities discussed in this chapter are for internal network use and subscribers do not need to be aware of them.

CME 20 MSISDN

In CME 20, the MSISDN consists of the following:

CME 20 MSISDN

CC Country Code

NDC National Destination Code

SN Subscriber Number

An NDC is allocated to each PLMN. For example, in Ireland the NDC's 086 and 087 indicate the PLMN's of two different network operators. In some countries, more than one NDC may be required for each PLMN. The international MSISDN number may be of variable length. The maximum length is 15 digits, prefixes not included. A German subscriber calling an Irish GSM subscriber would dial the following number:

CME 20 MSISDN

CMS 40 MSISDN

In CMS 40, the MSISDN consists of the following:

CMS 40 MSISDN

CC Country Code

NPA Number Planning Area

SN Subscriber Number

The NPA is allocated to each GSM 1900 PLMN. The length of MSISDN is determined by the structure and operating plan for each operator. The maximum length is 15 digits, prefixes notincluded. A Swedish subscriber calling a Canadian GSM 1900 subscriber would dial the following number:

CMS 40 MSISDN

International Mobile Subscriber Identity (IMSI)

The International Mobile Subscriber Identity (IMSI) is a unique identity allocated to each subscriber that facilitates correct subscriber identification over the radio path and through the network. It is used for all signaling in the PLMN. All network related subscriber information is connected to an IMSI. TheIMSI is stored in the SIM, the HLR and in the serving VLR. The IMSI consists of three different parts:

IMSI

MCC Mobile Country Code

MNC Mobile Network Code

MSIN Mobile Station Identification Number

According to the GSM specifications, the IMSI has a maximum length of 15 digits.

Temporary Mobile Subscriber Identity (TMSI)

The Temporary Mobile Subscriber Identity (TMSI) is a temporary IMSI number made known to an MS at registration. It is used to protect the subscriber's identity on the air interface. The TMSI has local significance only (that is, within the MSC/VLR area) and is changed at time intervals or when certain events occur such as location updating. Every operator can chose TMSI structure, but should not consist of more than 8 digits.

EQUIPMENT-RELATED IDENTITIES

International Mobile Equipment Identity (IMEI)

The International Mobile Equipment Identity (IMEI) is used to uniquely identify MS equipment to the network. The IMEI is used for security procedures such as identifying stolen equipment and preventing unauthorized access to the network. According to the GSM specifications, IMEI has a total length of 15 digits, and consists of the following:

IMEI

TAC Type Approval Code, determined by a central GSM body FAC Final Assembly Code, identifies the manufacturer SNR Serial Number, an individual serial number of six digits uniquely identifies all equipment within each TAC and FAC spare A spare digit for future use. When transmitted by the MS this digit should always be zero

International Mobile Equipment Identity and Software Version number

(IMEISV)

The International Mobile Equipment Identity and Software Version number (IMEISV) provides a unique identity for every MS and also refers to the version of software which is installed in the MS. The version of software is important as it may affect the services offered by the MS or its speech coding capabilities. For example, mobile networks need to know the MS speech coding capabilities when a call is being made (i.e. half rate/full rate, etc). This will be indicated by the IMEISV. The IMEISV consists of the following:

IMEISV

SVN Software Version Number allows the mobile equipment manufacturer to identify different software versions of a given type approved mobile. SVN value 99 is reserved for future use – 182 – EN/LZT 123 3321 R3B

International Mobile Equipment Identity and Software Version number

(IMEISV)

The International Mobile Equipment Identity and Software Version number (IMEISV) provides a unique identity for every MS and also refers to the version of software which is installed in the MS. The version of software is important as it may affect the services offered by the MS or its speech coding capabilities. For example, mobile networks need to know the MS speech coding capabilities when a call is being made (i.e. half rate/full rate, etc). This will be indicated by the IMEISV. The IMEISV consists of the following:

IMEISV

SVN Software Version Number allows the mobile equipment manufacturer to identify different software versions of a given type approved mobile. SVN value 99 is reserved for future use

LOCATION-RELATED IDENTITIES

Mobile Station Roaming Number (MSRN)

The Mobile Station Roaming Number (MSRN) is a temporary network identity which is assigned during the establishment of a call to a roaming subscriber. More information about the use of MSRN can be found in the "Traffic Cases" section later in the book. The MSRN consists of three parts:

MSRN

Note: In this case, SN is the address to servicing MSC/VLR.

SN= Servicing Node

Location Area Identity (LAI)

The Location Area Identity (LAI) is a temporary network identity, which is also required for routing. The two main purposes of the LAI are:

1. Paging, which is used to inform the MSC of the LA in which the MS is currently situated

2. Location updating of mobile subscribers The LAI contains the following:

LAI

LAC Location Area Code, the maximum length of LAC is 16 bits, enabling 65,536 different location areas to be defined in one PLMN

Cell Global Identity (CGI)

The Cell Global Identity (CGI) is used for identifying individual cells within a LA. Cell identification is achieved by adding a Cell Identity (CI) to the LAI components. The CI has a maximum length of 16 bits. The CGI consists of:

CGI

Base Station Identity Code (BSIC)

The Base Station Identity Code (BSIC) enables MS's to distinguish between different base stations sending on the same frequency. The BSIC consists of:

BSIC

NCC Network Color Code (3 bits) identifies the PLMN. Note that it does not uniquely identify the operator. NCC is primarily used to distinguish between operators on each side of a border BCC Base Station Color Code (3 bits) identifies the Base Station to help distinguish between RBS using the same control frequencies

Location Number (LN)

The Location Number (LN) is a number related to a certain geographical area, which the network operator specifies by “tying” the location numbers to cells, location areas, or MSC/VLR service areas. The LN is used to implement features like regional/local subscription and geographical differentiated charging. The LN consists of the following:

LN

LSP Locally Significant Part

Regional Subscription Zone Identity (RSZI)

For each regional subscription, zones/regions need to be defined. This is achieved by using the Regional Subscription Zone Identity (RSZI). The RSZI consist of the following:

RSZI

ZC The length of the Zone Code, is two octets

SUBSCRIBER IDENTITY CONFIDENTIALITY

Subscriber identity confidentiality means that the IMSI is not disclosed to unauthorized individuals, entities or processes. This function protects a subscriber’s identity when the subscriber is using PLMN resources. It also prevents tracing the mobile subscriber’s location by listening to the signaling exchanges on the radio path.

Subscriber Identity Confidentiality Procedure

Each time a mobile station requests a system procedure (e.g. location updating, call attempt or service activation), the MSC/VLR can allocate a new TMSI to an IMSI. The MSC/VLR transmits the TMSI to MS that stores it on the SIM card. Signaling between MSC/VLR and MS utilizes only the TMSI from this point on. Thus, the real subscriber identity, IMSI, is not transmitted over the radio path again. TMSI is half the length of IMSI; thus allowing twice as many MS's to be paged in the same paging message.IMSI is only used in cases when location updating fails or when the MS has no allocated TMSI.