Archive for November, 2007

Identities of a Dual-Mode Phone

This post is not meant to be comprehensive but I shall attempt to cover the most important identities used to identify the UE/MS. It has been a difficult task the reason being that information is spread across many specifications. If there are errors, do let me know. I also appreciate assistance on making this list complete.

Identities are summarized in Table 1. Shaded cells refer to group identities. Many of these identities can exist at the same time. Some identities are mutually exclusive. For example, TLLI cannot exist at the same time as C-RNTI. The former’s context is with the GPRS CN and the latter’s is within UTRAN.

An RNTI (Radio Network Temporary Identifier) exists only when the UE has an RRC connection. Depending upon the context and allocator, different RNTIs exist as listed in Table 1. RNTIs are deallocated when RRC connection is released.

Table 1: UE/MS Identities








Cell Radio Network Temporary Identifier

  • Allocated by the CRNC.
  • Unique within the cell controlled by the CRNC.
  • Can be reallocated when UE changes cell with a Cell Update procedure.
  • Deallocated when RRC connection is released
  • Used by MAC to address a UE-UTRAN connection when DCCH/DTCH are mapped to common transport channels.
  • Can be used by MAC on UL and DL transport channels.




Downlink Shared Channel Radio Network Temporary Identifier

  • Used only for TDD.
  • Used on the SHCCH.




E-DCH Radio Network Temporary Identifier

  • For E-DCH (HSUPA) only.
  • Two variants are possible: primary and secondary: both can be active at the same time.
  • RRC signalling configures the UE to use either primary or secondary.
  • Identity is used by PHY to address the UE on E-AGCH. Identity is used as a mask on the 16-bit CRC.




GERAN Radio Network Temporary Identifier

  • Applicable from Release 5 onwards for GERAN Iu Mode.
  • Allocated by RRC in the Serving BSC and unique within the BSC.
  • Reallocated when the SBSC changes
  • Used at RLC/MAC during contention resolution. If there is no allocation, a random G-RNTI is used; otherwise the allocated identity is used.
  • Deallocated when RRC connection is released.
  • Derived from TLLI codespace. Used on Iu interface and quite similar in purpose to TLLI used on A/Gb.



HS-DSCH Ratio Network Temporary Identifier

  • For HSDPA only.
  • Identity is used by PHY to address the UE on HS-SCCH. Identity is used as a mask on the 16-bit CRC.




International Mobile Station Equipment Identity

  • Unique number allocated to each Mobile Equipment (ME) in the PLMN.
  • Unconditionally implemented by the MS manufacturer.
  • Generally used to block stolen mobiles. IMEI can be changed but it is illegal in some countries (UK for example).
  • Composed of Type Allocation Code (TAC) + Serial Number (SNR) + spare digit = 8 + 6 + 1= 15 digits.
  • IMEI will be used for emergency call establishment and re-establishment only when SIM/USIM and IMSI are not available.




International Mobile Station Equipment Identity with Software Version Number

  • Similar to IMEI; composed of Type Allocation Code (TAC) + Serial Number (SNR) + Software Version Number (SVN) = 8 + 6 + 2= 16 digits.
  • Optionally included by the mobile in Authentication and Ciphering Response.




International mobile group identity





IP Multimedia Private Identity

  • Used in IMS.
  • Could be based on IMSI if not allocated explicitly.
  • Of the form “user@domain”.




IP Multimedia Public identity

  • Used in IMS.
  • Of the form “sip:user@domain”.




International Mobile Subscriber Identity

  • Variants exist based on the type of CN: IMSI-DS-41, IMSI-GSM-MAP, IMSI-and-ESN-DS-41. Here we are refer to IMSI-GSM-MAP when we say IMSI.
  • Allocated to each mobile subscriber in the GSM/UMTS system.
  • ITU-T refers to this as International Mobile Station Identity.
  • This is the common identity across both CN domains.
  • RAN uses it for coordination with UE. CN transfers identity to RAN using RANAP. RAN deletes it when RRC connection is released.
  • Consists of MCC (3 digits) + MNC (2 or 3 digits) + MSIN.
  • Used by RRC for CN originated paging.
  • Generally avoided on the air interface in lieu of TMSI or P-TMSI unless the latter is not recognized by the CN or not available at the mobile.
<= 15



International Mobile User Number

  • A diallable number allocated to a 3GPP System user.
  • Not sure how this is used.




International USIM Identifier





Local Mobile Station Identity

  • Allocated by the VLR and mapped to IMSI.
  • Used for communication with HLR although HLR makes no use of it. HLR merely sends it back in its responses.
  • Facilitates easy search of database at the VLR.
  • Advantage is that TMSI could be reallocated while LMSI is persistent.




Mobile Station Identifier





Mobile Station Identification Number

  • Part of IMSI.
  • Identifies the mobile within the PLMN.
  • The leading digits may in some cases used by the PLMN to identify quickly the HLR.
  • If MNC has just 2 digits, this identity has a leading zero.

<= 10



Mobile Station/Subscriber ISDN Number

  • Number by which the mobile can be called.
  • Composed of Country Code (CC) + National Destination Code (NDC) + Subscriber Number (SN).
  • An NDC is required for each PLMN. Some PLMNs may require more than one NDC.
  • Parts of the identity are used by SCCP for routing messages to the HLR.




Mobile Station Roaming Number

  • Allocated by the VLR.
  • Used to route calls to the mobile.
  • Passed by the HLR to GMSC for routing purpose.
  • Identity addresses the MSC/VLR where the mobile currently has a context.
  • Has a structure similar to MSISDN.
  • A mobile may have more than one MSRN.




Mobile User Identifier





National Mobile Station Identifier

  • Part of IMSI.
  • Composed of MNC + MSIN.
  • Managed within relevant national bodies.

<= 12



National User / USIM Identifier

Network User Identification





Packet Temporary Mobile Subscriber Identity

  • Variants exist based on the type of CN: P-TMSI-GSM-MAP, P-TMSI-and-RAI-GSM-MAP. Here we refer to P-TMSI-GSM-MAP when we say P-TMSI.
  • Used instead of IMSI to implement subscriber confidentiality in the PS domain.
  • Allocated by SGSN which maps it to the IMSI.
  • Extensively used by GMM.
  • Generally reallocated when Routing Area changes. Has local context within a RA, outside which it has to be combined with RAI.
  • Used by RRC for CN originated paging. If it exists, preferred over IMSI for packet paging.
  • A P-TMSI signature exists to enable GMM establish the context of a mobile.




SRNC Radio Network Temporary Identifier

  • Allocated by the SRNC and unique within the SRNC.
  • Reallocated during SRNC Relocation.
  • Deallocated when RRC connection is released.
  • A shorted version (10 bits) exists for signalling purpose only during a handover to UTRAN.




Temporary Logical Link Identity

  • Used on the GPRS air interface (RLC/MAC) to address the mobile.
  • Allocated by the MS based on P-TMSI (local or foreign TLLI) or directly (random TLLI).
  • Auxiliary TLLI is allocated by the SGSN but this is no longer required from R99 onwards.
  • Part of the TLLI codespace is reserved for G-RNTI.
  • Used by LLC in SGSN to uniquely identify the MS.
  • TLLI along with NSAPI is used by SGSN to identify the PDP context to which a packet belongs.




Temporary Mobile Group Identity

  • Used to identify an MBMS Bearer Service.
  • Allocated by BM-SC.
  • Used for either broadcast or multicast service.
  • This is the radio resource equivalent of MBMS Bearer Service Identification consisting of IP multicast address and APN.
  • Contains 24 bits of MBMS Service Id and optionally MCC (12 bits) MNC (12 bits) if the session is from a non-local PLMN.
  • Identity is used by RR/GRR for packet paging procedures for MBMS (pre-)notification. An optional MBMS Session Identity is used along with TMGI if notification is done on A/Gb mode.
  • Identity used by Layer 3.

24, 48



Temporary Mobile Subscriber Identity

  • Variants exist based on the type of CN: TMSI-DS-41, TMSI-GSM-MAP, TMSI-and-LAI-GSM-MAP. Here we are refer to TMSI-GSM-MAP when we say TMSI.
  • Used instead of IMSI to implement subscriber confidentiality in the CS domain.
  • Allocated by VLR which maps it to the IMSI.
  • Extensively used by MM.
  • Generally reallocated when Location Area changes. Has local context within an LA, outside which it has to be combined with LAI.
  • Used by RRC for CN originated paging.
  • Format of TMSI is not standardized.




UTRAN Radio Network Temporary Identifier

  • Identifies the UE uniquely within UTRAN.
  • Made of two parts: SRNC identifier (12 bits) + S-RNTI (20 bits).
  • Used to identify UE in many RRC procedures in CELL_FACH (Cell Update, URA Update, UTRAN Originated Paging).
  • Used by MAC to address a UE-UTRAN connection when DCCH/DTCH are mapped to common transport channels.
  • Not used by MAC in the UL but can be used by RRC. Used by MAC only in the DL when DCCH is mapped to FACH for SRB1 (alternative is the C-RNTI).
  • During a handover to UTRAN, RRC signalling uses U-RNTI-Short in which the S-RNTI component has only 10 bits. The shortened S-RNTI is expanded to 20 bits to (MSBs set to zeros) and the final U-RNTI is generated.
  • Rel5 RRC signalling uses this in a modified form to address a group of UEs for RRC connection release.



Some identities need explanation. Since C-RNTI and U-RNTI are usually meant for use in CELL_FACH states, it may be puzzling to note that these can be reallocated in CELL_DCH state. Such a reallocation will generally happen in the case of handovers when the CRNC or SRNC change. The UE will merely store the identities until a later time when they may be required. For example, after the handover the channel conditions may worsen triggering a Cell Update procedure on CCCH. This procedure will then make use of the U-RNTI within RRC Cell Update message. The Cell Update Confirm may be on CCCH or on DCCH. In the former case, the U-RNTI will be returned within the message. In the latter case, U-RNTI is used at MAC. Either way, Cell Update Confirm may in its turn allocate new identities.

Specifications [TS 24.008] define the conditions under which the mobile shall use IMEI, IMSI, TMSI or P-TMSI. Some of these have been mentioned in Table 1. Specification titled “Numbering, addressing and identification” [TS 23.003] is a good source of information. The use of some of these identities by RR/GRR/RRC can be found in relevant specifications [TS 44.018, TS 44.060, TS 44.160, TS 25.331]. The use of E-RNTI and H-RNTI is mentioned in a PHY layer specification [TS 25.212]. Some details on TMGI is in an MBMS specification [TS 23.246].

Other important identities for the mobile are DLCI, XID, NSAPI and TI. Because these pertain more to connections at a specific layer rather than the MS/UE as a whole, they have been left out of this discussion.



Read Full Post »

Those of us initiated into the design and workings of cellular systems will know the truth of the matter. Those of us who have tried browsing on a GPRS mobile will know that we rarely get the promised maximum data rate of 171 kbps. Engineers are not to be blamed for this. They know for sure what’s possible and under what conditions. Misrepresentation, as we may call it, comes from the marketing guys.

These days, with the growing affluence of the Indian middle class and their spending power, I find more and more TV adverts for cars – sleek, stylish and spacious. These cars are fitted with ultra-modern features and latest gadgets. In these adverts, the cars zip across a lush countryside. The ride is smooth and noiseless. The roads are wide, free of traffic and spotlessly clean. Overall, the cars promise a great driving experience. Exactly the same cars on Bangalore’s congested, pot-holed, water-logged and narrow roads struggle to live up to expectations.

Just as these adverts have failed to point out that enjoyment of cars is only as good as the roads, phones are only as good as the network and its capacity. Operators have failed to inform subscribers that there is a great deal of difference between average data rates and peak data rates. Most of the time users will not get the data rates that they have come to expect, be it for GPRS or for HSDPA. Let’s take the example of GPRS.

Cellular systems were first designed for GSM. GSM networks were deployed such that there is enough C/N (Channel to Noise ratio) for the required BER at the cell edge. This meant that users closer to the BTS often had better quality. However, GSM did not utilize this to provide higher capacity, higher data rates and better QoS for subscribers. This didn’t matter much because GSM offered CS voice calls and CS data at only 9.6 kbps. Then GSM 14.4 kbps data service was introduced. The difference with the 9.6 kbps was that this had less error protection by puncturing more bits [TS 45.003]. The end result was that GSM 14.4 kbps did not offer the same cell coverage as 9.6 kbps although it did deliver the promised bit rate because of the circuit switched nature of the connection.

Enter GPRS. Four coding schemes were introduced, the difference being the level of error protection: CS-1, CS-2, CS-3 and CS-4. Cell coverage decreases as we move from CS-1 to CS-4 and the coverage is worse without frequency hopping. So only users close to the base station will be able to use CS-4 at bit rates as high as 171 kbps. Even this is an ideal situation which can happen only if neighbouring cells are lightly loaded (lower interference), current cell has sufficient spare capacity so that all the slots in a frame can be allocated to the user requesting the high data rate.

The situation is similar with HSDPA. When there are multiple users in the same cell, it is unlikely that a single user will be allocated all the 15 codes. Even when there is only one user, he has to be close to the Node-B for ideal channel conditions. At the cell edge, it is has been shown that HSDPA can offer only 250 kbps with 15 codes and HSDPA using 80% power [1, Chapter 11]. In fact, at cell edge DCH/DSCH can achieve 384 kbps mainly because of soft handover gain. Soft handover is not possible with HSDPA.

It is certain that GPRS, E-GPRS, HSDPA and HSUPA all increase network capacity. This improvement is advertised to the user as higher data rates. This is true in terms of average bit rates which are significantly lower than peak rates. Peak data rates are possible only under good channel conditions that enable higher modulation and lower FEC coding. So although spectral efficiency has improved with newer access technologies, the difference between average and peak efficiency has also increased. The exceptions are AMPS and GSM for which cells were planned for what they were meant to deliver. Figure 1 summarizes the efficiency gap [2].

Figure 1: Average vs Peak Spectral Efficiency over Time

Average vs Peak Spectral Efficiency

This may be one way seeing why the cost of mobile/wireless data has always been not as competitive as fixed data. If it were cheap, lots of subscribers would try it for a start. This would increase the load, which would reduce the effective data rate per user. Reduction in data rate per user occurs because available capacity has to be shared and more users means more interference. The user would be disillusioned with the service when he had been promised a much higher rate. Thus, it is only natural that data is for premium users and not for the mass market. If all mobile users were to start using data at the moment and expect speeds possible with their ADSL modems, today’s cellular networks are not ready to deliver. We have the technology but not the delivery mechanism. Operators have to perform cell splitting and provide HSDPA at the level of microcells rather than at the macrocell level. This would result in more handovers. They would have to upgrade their backhauls (Iub, Iur and Iu). Naturally, link budgeting has to be revised along with other factors associated with cell planning.

Will it make business sense to make these upgrades? To answer this we need to look at the predicted growth of data when compared to voice so that a proper cost-benefit analysis can be made. Hopefully, this will be another post. But then, there are also competing technologies such as WiMAX/WiFi (microcell) and femtocells (picocell).


  1. Harri Holma and Antti Toskala, WCDMA for UMTS, Second Edition, John Wiley & Sons, 2002.
  2. “What Next for Mobile Telephony?”, Agilent Measurement Journal, Issue 3, 2007.

Read Full Post »

Following the article on GPRS cell reselection and NACC, I thought it was appropriate to mention neighbouring cells that the MS monitors. The list of neighbour cells is formed by a complex process in which information is gathered from different sources. As an easy reference, this post attempts to summarize this process. This post will look at:

  • GSM Neighbour Cell List for GSM
  • GSM Neighbour Cell List for GPRS

The term “GSM Neighbour Cell List” is so named to distinguish it from 3G Neighbour Cell List. It is applicable to GPRS as well. It is simply a list of neighbours that the MS maintains. It makes measurements on these cells and reports them to the network if configured to do so. Cell reselection depends on these measurements.

The final list that the MS maintains is the Neighbour Cell List which is a concatenation of GSM Neighbour Cell List and 3G Neighbour Cell List. For the purpose of reporting measurements, the lists are treated separately.

Every cell maintains a BCCH Allocation List or BA List which is a list of frequencies of neighbouring cells. This information is useful for the MS for performing and reporting measurements, and eventually in cell reselection and handover. The BA List is formed from information in the SI. For GPRS, BA(GPRS) exists which is formed from information in PSI. If the cell does not have a PBCCH, BA(GPRS) equates to BA(list) obtained from SI. The key difference between BA(list) and BA(GPRS) is that the former is only a frequency list and the latter is a list of frequencies paired with Base Station Identification Code (BSIC). BSIC allows for cell changes across cells that are not necessarily neighbours in a geographic sense. So an MS could do a cell reselection across cells with the same frequency but different BSIC. Such a possibility arises if the immediate neighbours are hidden (no line of sight) whereas a far away cell can provide better service due to clear LOS radio path.

Figure 1: GSM NC List (GSM)

Now let us look at the formation of GSM Neighbour Cell List for GSM (Figure 1). In idle mode, BA(list) is formed from SI2/2bis/2ter while in dedicated mode SI5/5bis/5ter are used. If the latter set is missing completely in dedicated mode, the former will be used. SI2quater enhances the BA(list) by providing BSICs. The combination of the two makes the GSM NC List. SI2quater was introduced for enhanced measurements, a feature I will describe in a separate post. In dedicated mode, Measurement Information (MI) is used instead of SI2quater but the end result is the same as in idle mode. If SI5 and MI are both not sent to the MS in dedicated mode, the GSM NC List in dedicated mode is same as in idle mode.

Figure 2: GSM NC List (GPRS)

Figure 2 illustrates the formation of GSM NC List for GPRS. In packet idle mode without PBCCH on the cell, the BA(GPRS) is only a frequency list. Combined with BSIC information in SI2quater this becomes the GSM NC List. If PBCCH is present, PSI3/3bis is used to make the BA(GPRS) which contains pairs of frequency and BSIC. This is also the GSM NC List. In packet transfer mode, the GSM NC List formed in packet idle mode is reused. Elements of this list can be deleted or new elements can be added using Packet Measurement Order (PMO) or Packet Cell Change Order (PCCO). Addition happens on the GSM NC List and is based on pairing of frequency and BSIC. Deletion happens on the BA(GPRS) and is based on frequency which implies that all cells with that frequency are removed from the GSM NC List regardless of the BSIC. Such a definition is useful if the BA(GPRS) is only a frequency list as in a cell without PBCCH.

Among the cells in the GSM NC List for GPRS, some may be cells with both Iu and A/Gb modes. There may be cells with only Iu mode. In the final count, the list can have a maximum of 96 cells and 32 unique frequencies.

Read Full Post »

In a cellular system, it is common for mobiles to move from cell to cell while an active data connection is in progress. In GPRS, this happens with a cell reselection during which there is a short break in communication. This is called service outage and is defined as [TR 44.901],

the time between the last received uplink RLC block from the mobile station in the old cell and the mobile station’s first uplink RLC block received in the new cell.

Service outage dampens user experience. It can be of the order of a few seconds, certainly a bad thing for real-time or streaming services. GPRS has been designed in such a way that many parameters that control communication with a particular mobile are optional. If these optional parameters are absent during the setup phase of a TBF (Temporary Block Flow), equivalent parameters from SI/PSI are used. This means that an MS that does cell reselection must first acquire a defined minimum set of SI/PSI in the target cell before resuming the TBF in the new cell. This contributes to the long service outage.

An equivalent problem in UMTS does not exist or has been mitigated by sensible design. In UMTS, the UE does handover (hard or soft) when RRC is in CELL_DCH. This is the common case. Occasionally, when RRC is in CELL_FACH with an active connection on PS domain, the UE does cell reselection. However, CELL_FACH allows the mobile to acquire SIBs of neighbour cells before cell reselection is triggered. The problem in UTRAN occurs only if the chosen cell for reselection is of a different frequency. Service outage within UTRAN is less but is still a problem when UTRAN-GERAN cell reselection is triggered.

Network Assisted Cell Change (NACC) was introduced in Release 4 to mitigate this problem. Network assists the MS so that it has necessary SI/PSI of the target cell in advance of the cell reselection. Service outage is reduced from the order of a few seconds to 300 – 700 ms [TR 44.901] . NACC has two main procedures:

  • One part that can assist an MS in packet transfer mode with neighbour cell system information required for initial packet access after a cell change.
  • One part in which the mobile station notifies the network when the cell change criteria is fulfilled and delays the cell re-selection a short time to let the network respond with neighbour cell system information (CCN mode procedures).

The need for two variants can be understood by the NC modes which controls GPRS cell reselection. There are three NC modes: NC0, NC1 and NC2. In the case of NC0 and NC1 MS does reselection autonomously. In these two modes, the MS enters the CCN (Cell Change Notification) mode which is new for NACC. The MS indicates to the network that it has chosen a cell for reselection but delays the procedure by entering CCN mode. This gives the network time to send SI/PSI of the selected neighbour cell. In NC1 and NC2 MS sends measurement reports to the network, which can then initiate a cell reselection process. Before such an initiation, the network sends SI/PSI to the MS.

NACC adds the possibility to let the MS operate in NC0 and reduces the loading on the signalling in terms of measurement reporting. Even in NC0, the use of NACC enables the network to direct the MS to select a cell that could be different from the one chosen by the MS.

Another important detail is that the MS delays the cell reselection until complete RLC SDU has been transferred. This is only best-effort. If the connection to the current cell is really bad to make further transfer impossible, the MS has to quickly move to the target cell.

The following RLC/MAC messages have been added to enable NACC:

  • Packet Cell Change Notification (PCCN): MS indicates to network that it wants to move to another cell and enters CCN mode
  • Packet Cell Change Continue (PCCC): network asks MS to continue with cell reselection after sending necessary SI/PSI of neighbour cell
  • Packet Neighbour Cell Data (PNCD): contains SI/PSI or neighbour cell
  • Packet Serving Cell Data (PSCD): contains SI/PSI of current/serving cell: this is useful if only a minimum set has been sent before cell reselection and the rest is sent in this message after cell reselection
  • Packet SI Status: contains SI of current cell: purpose is similar to PSCD
  • Packet PSI Status: contains PSI of current cell: purpose is similar to PSCD

A typical scenario is described in Figure 1. The MS in packet transfer mode determines that a new cell (N1) is to be selected. It delays the reselection and sends PCCN to the serving cell indicating its selection. The serving cell contains the system information of the selected cell N1. Therefore it sends PNCD messages to the MS. Once the required PNCD messages have been sent and once complete RLC SDUs have been transferred, the BSC sends PCCC message. MS switches to the new cell and immediately performs uplink access to restart the TBF. Subsequently, the MS requests the new cell to send the missing system information messages on the PACCH. These are sent to the MS. Some messages may be encapsulated into PSCD messages.

Figure 1: Typical Message Sequence for NACC
NACC Typical Sequence

Figure 1 points to a key fact: “BSC Serving Cell” need not be the same as “BSC Cell N1”. However, in Release 4 the source and target cells must be part of the same BSC. The reason is simple. Unlike UTRAN, in which Iur interfaces one RNC to another, BSCs in BSS are not connected to each other. Thus, SI/PSI of one cell cannot be sent on another cell that’s under a different BSC. Future releases of the specifications extends NACC in many ways:

  • NACC for Geran Iu mode
  • NACC across different BSC

These enhancements are not really mature in the specifications at this point. In other words, it is not clear if CN should be involved in transferring SI/PSI or would it be sufficient to use the Iur-g interface. Should SI/PSI be stored in the SRNC or in the DRNC? Should O&M be involved in storing SI/PSI statically in each CRNC? However, UTRAN RRC [TS 25.331, Rel5] already has updates for NACC for Cell Change Order From UTRAN procedure. Once these are in place and the parameters tuned by study, we can expect smoother data transfer when cell change occurs between UTRAN and GERAN.

Read Full Post »

« Newer Posts - Older Posts »