1.

Introduction to Signaling
The term signaling is used in many contexts. In technical systems, it very often
refers to the control of different procedures. With reference to telephony, signaling means
the transfer of information and the instructions relevant to control and monitor telephony
connections.
Todays global telecom networks are included in very complex technical systems.
Naturally, a system of this type requires extensive signaling, both internally in different
nodes (for example, exchanges) and externally between different types of network nodes.
In this document we will focus on external signaling. Thus, the term signaling in the
following chapters always refers to external signaling traffic.
The main purpose of using signaling in modern telecom networks where different
network nodes must cooperate and communicate with each other is to enable transfer of
control information between nodes in connection with:
- Traffic control procedures as set-up, supervision, and release of telecommunication
connections and services.
- Database communication, for example, database queries concerning specific
services, roaming in cellular networks, dialog.
- Network management procedures, for example, blocking or deblocking trunks.
Traditionally, external signaling has been divided into two basic types:
- Access signaling (for example, Subscriber Loop Signaling). This means signaling
between a subscriber terminal (telephone) and the local exchange.
- Trunk signaling (that is, Inter-Exchange Signaling)
This is used for signaling between exchanges.

Figure 1. Signaling in Telecommunication Networks.

1.1. Access signaling

There are many types of access signaling, for example, PSTN analog subscriber line
signaling, ISDN Digital Subscriber Signaling System (DSS1), and signaling between the
MS and the network in the GSM system.
Signaling on the analog subscriber line between a telephony subscriber and the Local
Exchange (LE) is performed by means of on/off hook signals, dialed digits, information
tones (dial tone, busy tone, etc.), recorded announcements, and ringing signals.
The dialed digits can be sent in two different ways: as decadic pulses (used for old-type
rotary-dial telephones), or as a combination of two tones (used for modern pushbutton
telephones). The latter system is known as the Dual Tone Multi Frequency (DTMF).
The information tones (dial tone, ringing tone, busy tone, etc.) are audio signals used to
keep the calling party (the A-subscriber) informed about what is going on in the network
during the set-up of a call.
Digital Subscriber Signaling System No. 1 (DSS1) is the standard access signaling system
used in ISDN. It is also called a D-channel signaling system.
D-channel signaling is defined for digital access lines only. The signaling protocols are
based on the OSI (Open System Interconnection) reference model, layers 1 to 3.
Consequently, the signaling messages are transferred as data packets between the user
terminal and the local exchange.
Due to the much more complex service environment at the ISDN users site, the amount of
signaling information and the number of variations differ greatly from the arrangement
used for the ordinary telephone subscriber signaling, described above. This fact is reflected
in the number of parameters included in D-channel messages.

1.2. Trunk Signaling

The Inter-exchange Signaling information is usually transported on one of the time slots in
a PCM link, either in association with the speech channel or independently. There are two
commonly used methods for Inter Exchange Signaling:
- Channel Associated Signaling (CAS) In CAS, the speech channel (in-band), or a
channel closely associated with a speech channel (out-band), is used for signaling.
- Common Channel Signaling (CCS) In this case a dedicated channel, completely
separate from the speech channel, is used for signaling. Due to the high capacity, one
signaling channel in CCS can serve a large number of speech channels. CCITT Signaling
System No. 7 (SS7) is used in the Mobile Core Network. SS7 is a Common Channel
Signaling system. The general concepts of both CAS and CCS are briefly described in the
following sections.

1.2.1. Channel Associated Signaling (CAS)

Channel Associated Signaling (CAS) means that the signaling is always sent on the same
connection (PCM link) as the traffic. The signaling is associated with the traffic channel. In
a 2 Mbps PCM link, 30 time slots are used for speech, whereas TS 0 is used for
synchronization and TS 16 is used for the line signaling. All 30 traffic connections share
TS 16 in a multiframe consisting of 16 consecutive frames. On TS 16, each traffic channel
has a permanently allocated recurring location for line signaling, where two traffic
channels share TS 16 in one frame. However, register signaling is carried over the traffic
channel.
- Line Signals Line Signals are used during the whole duration of a call to monitor
the status of the connection and traffic circuit. Example: Seizure, Answer signals.
- Register Signals The Register Signals are used during the set-up phase of a call to
transfer address and category information. Example: dialed B-number.
As previously mentioned, the register signals are only used during call set-up, hence the
information B-number, charging, dialog. CAS uses code sender and code receiver for
Register Signals. These devices are released after the call set-up.
The line signals are used for seizing the trunk during the call set-up as well as releasing the
trunk at the termination of the call, which can be initiated either by the A subscriber (Clear
Forward) or the B subscriber (Clear Back).

1.2.2. Common Channel Signaling (CCS)

In CCS, signaling messages (or data packets) are transmitted over time slots in a PCM link
reserved for the purpose of signaling, instead of Line Signals and Register Signals (which
do not exist in CCS). The system is designed to use a common data channel (or signaling
link) as the carrier of all signals, required by a large number of traffic channels.

2. Signaling System 7 (SS7)

2.1. Introduction
Comit Consultatif International Tlgraphique et Tlphonique (CCITT, now ITU-T,
International Telecommunication Union, Telecommunications sector) has defined
interfaces and methods for digital communication, used world wide. The Signaling System
No. 7 (SS7) is an elaborate set of recommendations defining protocols for the internal
management of digital networks. These recommendations were introduced in 1980 and
revised in 1984 and 1988 in different-colored books (yellow, red, and blue).
CCITT SS No. 7 is intended primarily for digital networks, both national and international,
where the high transmission rates (64 kbps) can be exploited. It may also be used on analog
lines especially on international trunks (CCITT SS No 6).

CCS was initially meant for telephony only, but has now evolved into non-telephony and
non-connection related applications (for example, location updating of a mobile
subscriber). A dialog with a database or between two databases is a typical application for
CCS in the Mobile Core Network.
Thus, there is a need for a generic system that is able to support a wide variety of
applications in telecommunication. The variety of applications is increasing as new types
of telephony systems and a wider use of databases in the network become necessary
(mobile telephony networks, ISDN, IN, etc.).
Even though the standardization of SS7 is now the responsibility of ITU-T, for traditional
and historical reasons, the system is often called CCITT No. 7 signaling system.
The signaling system used in GSM and WCDMA systems follows the CCITT
recommendations: the modular layer structure allows flexible usage of the specifications.
The interfaces between different levels and the protocols of the functions in each layer are
defined in CCITT SS No.7.
Protocol is a set of definitions and agreements on how to communicate.
The communication between functions always takes place on the same level according to
the protocol for that level. Only functions on the same level can understand each other.
In CCITT Signaling System (SS) No. 7 the control messages are exchanged between
different nodes. These control messages are used by the relevant nodes for call
management purposes, for example, set-up, maintenance, termination, etc. In reality the
signals are data packets, hence, SS7 is a type of packet switching system. SS No.7 only
defines the functions of various levels, but does not dictate the details of implementation.
Other standards than those specified by ITU-T are in use today. The SS7 network in the
USA, for instance, is based on the ANSI (American National Standards Institute) standard.
In some situations, the differences between these standards may cause interfacing problems
in the SS7 network.

2.2. SS7 Network Architecture

Figure 2. General SS7 architecture.

SS7 can employ different types of signaling network structures. The choice between these
different structures can be influenced by factors such as administrative aspects and the
structure of the telecommunication network to be served by the signaling system.
The worldwide signaling network has two functionally independent levels:
- International
- National
This structure makes possible a clear division of responsibility for signaling network
management. It also lets numbering plans of SS7 nodes belonging to the international
network and the different national networks be independent of one another.
SS7 network nodes are called signaling points (SPs). Each SP is addressed by an integer
called a point code (PC). The international network uses a 14-bit PC. The national
networks also use a 14-bit PCexcept North America and China, which use an incompatible
24-bit PC, and Japan, which uses a 16-bit PC. The national PC is unique only within a
particular operator's national network. International PCs are unique only within the
international network. Other operator networks (if they exist) within a country also could
have the same PC and also might share the same PC as that used on the international
network. Therefore, additional routing information is provided so that the PC can be
interpreted correctly that is, as an international network, as its own national network, or as
another operator's national network.

2.2.1. Signaling Links and Linksets

SPs are connected to each other by signaling links over which signaling takes place. The
bandwidth of a signaling link is normally 64 kilobits per second (kbps). Because of legacy
reasons, however, some links in North America might have an effective rate of 56 kbps. In
recent years, high-speed links have been introduced that use an entire 1.544 Mbps T1
carrier for signaling. Links are typically engineered to carry only 25 to 40 percent of their
capacity so that in case of a failure, one link can carry the load of two.

To provide more bandwidth and/or for redundancy, up to 16 links between two SPs can be
used. Links between two SPs are logically grouped for administrative and load-sharing
reasons. A logical group of links between two SP is called a linkset.

Figure 3. Signaling link and Signaling linkset

A number of linksets that may be used to reach a particular destination can be grouped
logically to form a combined linkset. For each combined linkset that an individual linkset is
a member of, it may be assigned different priority levels relative to other linksets in each
combined linkset.
A group of links within a linkset that have the same characteristics (data rate,
terrestrial/satellite, and so on) are called a link group. Normally the links in a linkset have
the same characteristics, so the term link group can be synonymous with linkset.

2.2.2. Routes and Routesets

SS7 routes are statically provisioned at each SP. There are no mechanisms for route
discovery. A route is defined as a pre-provisioned path between source and destination for a
particular relation.
All the pre-provisioned routes to a particular SP destination are called the routeset.

2.2.3. Node Types

There are three different types of SP (that is, SS7 node):
- Signal Transfer Point
- Service Switching Point
- Service Control Point
Signal Transfer Point
A Signal Transfer Point (STP) is responsible for the transfer of SS7 messages between
other SS7 nodes, acting somewhat like a router in an IP network.
An STP is neither the ultimate source nor the destination for most signaling messages.
Generally, messages are received on one signaling link and are transferred out another. The
only messages that are not simply transferred are related to network management and
global title translation.STPs route each incoming message to an outgoing signaling link
based on routing information contained in the SS7 message. Additionally, standalone STPs
often can screen SS7 messages, acting as a firewall.
An STP can exist in one of two forms:
- Standalone STP
- Integrated STP (SP with STP)
Standalone STPs are normally deployed in "mated" pairs for the purposes of redundancy.
Under normal operation, the mated pair shares the load. If one of the STPs fails or isolation
occurs because of signaling link failure, the other STP takes the full load until the problem
with its mate has been rectified.
Integrated STPs combine the functionality of an SSP and an STP. They are both the source
and destination for MTP user traffic. They also can transfer incoming messages to other
nodes.
Service Switching Point
A Service Switching Point (SSP) is a voice switch that incorporates SS7 functionality. It
processes voice-band traffic (voice, fax, modem, and so forth) and performs SS7 signaling.
All switches with SS7 functionality are considered SSPs regardless of whether they are
local switches (known in North America as an end office) or tandem switches.
An SSP can originate and terminate messages, but it cannot transfer them. If a message is
received with a point code that does not match the point code of the receiving SSP, the
message is discarded.

Service Control Point

A Service Control Point (SCP) acts as an interface between telecommunications databases
and the SS7 network. Telephone companies and other telecommunication service providers
employ a number of databases that can be queried for service data for the provision of
services.
SCPs form the means to provide the core functionality of cellular networks, which is
subscriber mobility. Certain cellular databases (called registers) are used to keep track of
the subscriber's location so that incoming calls may be delivered. Other telecommunication
databases include those used for calling card validation (access card, credit card), calling
name display (CNAM), and LNP.
SCPs used for large revenue-generating services are usually deployed in pairs and are
geographically separated for redundancy. Unless there is a failure, the load is typically
shared between two mated SCPs. If failure occurs in one of the SCPs, the other one should
be able to take the load of both until normal operation resumes.
Queries/responses are normally routed through the mated pair of STPs that services that
particular SCP, particularly in North America.

2.2.4. Link types

Signaling links can be referenced differently depending on where they are in the network.
Although different references can be used, you should understand that the link's physical
characteristics remain the same. The references to link types A through E are applicable
only where standalone STPs are present, so the references are more applicable to the North
American market.
Six different link references exist:
- Access links (A links): They connect "outer" SPs (SSPs or SCPs) to the STP
backbone
- Crossover links (C links): are used to connect two STPs to form a mated pair that
is, a pair linked such that if one fails, the other takes the load of both.
- Bridge links (B links): are used to connect mated pairs of STPs to each other
across different regions within a network at the same hierarchical level. These links help
form the backbone of the SS7 network. B links are normally deployed in link quad
configuration between mated pairs for redundancy.
- Diagonal links (D links): are the same as B links in that they connect mated STP
pairs.The difference is that they connect mated STP pairs that belong to different
hierarchical levels or to different networks altogether. For example, they may connect an
interexchange carrier (IXC) STP pair to a local exchange carrier (LEC) STP pair or a
cellular regional STP pair to a cellular metro STP pair.

- Extended links (E links): connect SSPs and SCPs to an STP pair, as with A links,
except that the pair they connect to is not the normal home pair. Instead, E links connect to
a nonhome STP pair
- Fully associated links (F links): are used to connect network SSPs and/or SCPs
directly to each other without using STPs. The most common application of this type of
link is in metropolitan areas. F links can establish direct connectivity between all switches
in the area for trunk signaling and Custom Local Area Signaling Service (CLASS), or to
their corresponding SCPs.

2.3. SS7 Protocol Overview

Figure 4. General protocol stack of SS7

2.3.1. Message Transfer Part (MTP)

The Message Transfer Part (MTP) consists of three levels (levels 1 to 3 of SS7). Its purpose
is to reliably transfer messages on behalf of the User Parts across the SS7 network. The
MTP maintains this service despite failures in the network.

2.3.1.1. MTP1
Layer 1 defines the physical interface. In Europe, SS7 is generally carried on a timeslot in a
2.048Mbps E1 trunk, generally timeslot 16 (but not necessarily). In North America, SS7
may be carried on either a V.35 synchronous serial interface running at 56 or 64kbps, or
multiplexed on to a 1.544Mbps T1 timeslot The SS7 messages are constructed similar to
HDLC frames (each message being delimited by flag bytes or octets, and containing a
Cyclic Redundancy Check, CRC).

2.3.1.2. MTP2
The layer 2 part of the protocol provides reliable transfer of messages between two
adjacent nodes, ensuring that messages are delivered in sequence and error free. The SS7
protocol specifies that empty frames known as Fill in Signal Units (FISU) should be sent
when no signaling information from the upper layers is waiting for transmission, hence the
SS7 receiver always expects to receive frames (information or empty) continuously,
enabling rapid detection of any failure or break in communication.

Layer 2 provides a method of message acknowledgement using sequence numbers and

indicator bits in both the forwards and backward direction. Each information message
carries a Forward Sequence Number (FSN) uniquely identifying that message. The
message also carries a Backwards Sequence Number (BSN) acknowledging the FSN of the
last message successfully received. Forward and Backward Indicator bits are toggled to
indicate positive or negative acknowledgement.
The two common methods for handling errors on SS7 links are either the basic method,
whereby a message is only retransmitted on receipt of a negative acknowledgement, and
Preventative Cyclic Retransmission (PCR), whereby a frame is repeatedly sent when the
upper layers have no information to be sent to the network. PCR is generally only used
over transmission paths where the transmission delay is large, such as satellite links.
Before an SS7 link is able to convey information from the higher layers, the layer 2 entities
at each end of the link follow a handshaking procedure known as the proving period,
lasting for 0.5 to 8.2 seconds (depending on the availability of routes served by the link in
question). During this time, Link Status Signal Units (LSSU) are exchanged between the
layer 2 parts of the protocol, enabling both ends to monitor the number of received errors
during this time. If less than a pre-set threshold, the link enters the IN SERVICE state, and
may now carry Message Signal Units (MSU) containing information from the upper layers.
The layer 2 entities also monitor the state of the link and communicate link state
information to their peers in layer 2 messages or Link Status Signal Units (LSSU). These
are transmitted, for example, when links become congested or are taken out of service.

Figure 5. Basic SS7 message types

2.3.1.3. MTP3
Layer 3 provides the message routing and failure handling capabilities for the message
transport. Each SS7 node (this could be a classic switch or a node containing 800 number
translation records) is uniquely identified within a network using an SS7 address called a
Point Code. European networks use 14 bit point codes, North American 24 bit point codes.
A single SS7 link is able to carry traffic for thousands of circuits (depending on traffic a
single SS7 link is normally engineered to control 1000 to 2000 circuits), however, failure
of this single link would disable all of the circuits that are controlled, hence for resilience
and also to increase traffic capacity, more than one signaling channel is normally
provisioned between any two nodes communicating using SS7. The collection of signaling
links between two adjacent nodes is known as a link set, each link set can contain up to 16
signaling links. Figure 3 shows a simple SS7 network containing 3 nodes.

Figure 6 A simple SS7 network

MTP3 adds information into the Signalling Information Field (SIF) of the MSU. This
includes a Destination Point Code (DPC) identifying the destination for a message, an
Originating Point Code (OPC) identifying the originator of a message and a Signalling
Link Selection (SLS) value used by MTP3 to load share messages between links in a link
set.

Figure 7. MTP Header

The MTP automatically load shares between the links within a link set, and re-routes
traffic from failed links to a working link within the same link set on detection of failure.
MTP layer 3 also attempts to automatically restore failed links and returns traffic to a
recovered link, these two procedures being termed Changeover and Changeback. MTP3 is
also able to load share between two link sets that serve the same destination (through the
use of intermediate nodes), the link sets here being contained within a route set.

MTP3 provides a reliable message transport service to the higher layer protocols, which
use MTP as a message transport service, hence their generic name, User Parts. In order to
deliver a received message to the correct user part, MTP3 examines the Service Indicator
(SI) which forms part of the Service Information Octet (SIO) in the received message.
The SIO also contains the Network Indicator (enabling identification of a message
travelling on a national or international network).

Figure 8. MTP3 Message Distribution

Routing of messages to a destination by MTP3 can either be Quasi Associated, where a
message passes through an intermediate node before reaching its final destination or Fully
Associated, in which case there is a direct signalling connection between the sender and
recipient of a message. The intermediate nodes are known as Signalling Transfer Points
(STP) which act as SS7 routers to provide multiple paths to a destination in order to handle
failures within the network. The Classic SS7 architecture also defines two other types of
nodes, a Service Switching Point (SSP) which is the point where the service user access the
network (using an access protocol), and a Service Control Point (SCP) that contains
network and data control functions (such as billing or free-phone number translation).