Call Flow

ZTE ZXC10-MSS After-sales
Competency Certification Secondary

Training Manual
Volume I Total II
ZTE CORPORATION
COPYRIGHT
Copyright © ZTE Corporation
All rights reserved.
All information contained herein are confidential information of ZTE and must be
handled with highest care. Nobody can, for any purpose, copy, save, link to searching
tools, or distribute by any means (including but not limited to electronic, mechanical,
photocopying, recording means) of the above mentioned information without prior
written consent of ZTE.
Author: Pan Xiangqin , Xu Zhongquan , Wu Zhicheng
Editor: Wei Hongwei
* * * *
ZTE UNIVERSITY
ZTE University, Dameisha, Yantian District, Shenzhen, P.R.China
Postcode: 518083
Tel: (+86755) 26778800

Fax: (+86755) 26778999
ZTE CORPORATION
ZTE Plaza, Keji Road South, Hi-Tech Industrial Park, Nanshan District, Shenzhen, P.R.China
Postcode: 518057
Technical Support Website：http://support.zte.com.cn
Client Support Hot line：（+86755）26770800 800-830-1118
Fax: (+86755) 26770801
* * * *
Version: July,2006,first edition
S.N.: PXJCCM200607061
Preface
Thanks for using Manual for ZTE ZXC10-MSS After-sales Competency Certification Secondary
Training Manual Volume I Total II. In order to use the Manual properly, please read the Preface
first.
1. Application
This Manual should not be used for the purpose of on-site installation or trouble shooting.
2. About This Manual
This manual is composed of two volumes，and the table of contents of each volume is shown
below:
Volume Course Code Course Name
ACM-201-E1 No.7 Signaling System (SS7)
ACM-202-E1 MSC/VLR Data Configuration

I
ACM-203-E1 HLR/AUC Data Configuration
ACM-204-E1 Troubleshooting
ACM-205-E1 Billing System
ACM-206-E1 MP and Alarm Box Installation and Configuration
ACM-207-E1 Tone Management

II
ACM-208-E1 Clock Extraction Specification
ACM-209-E1 Database Backup
ACM-210-E1 Course Module Code DBIO and Accounting System
This manual is based on CDMA-MSS. We will update this manual while the product is upgraded.
We apologize if there is any discrepancy between the manual and the products used in your
company.
3. Conventions
Key points
Indicates the key points in one section.
O Note
A Note statement is used to alert the reader of installation, operation, or

maintenance information that is important.
5 Caution
Indicates a potentially hazardous situation which, if not avoided, could result

in damages to the equipment or personal injury. It may also be used to alert
against unsafe practices.
& Tips
Indicates a suggestion or hint to make things easier or more productive for the
reader.
4. Manual Update history
Version Date Comments

First edition July,2006 New
5. From the Author
Thank you for using this manual and your continuous support. We would appreciate your
comments and suggestions on this Manual.
We can be reached at
Telephone：
（+86755）26778072
Fax：（+86755）26778999
ZTE UNIVERSITY
Introduction to ZTE Customer
Documentation
In order to provide more professional and useful documentation and offer better services to
you, ZTE founded its Documentation R&D Department in 2005.
The Documentation R&D Department is responsible for writing, publishing and issuing
various kinds of customer documentation for ZTE Corporation, including product manuals,
Maintenance Experience and training materials. The Documentation R&D Department is
committed to continually improve the quality of customer documentation, so as to help you
operate and maintain ZTE equipment more efficiently.
A suite of ZTE product documentation consists of the following manuals (will vary with
products):
No. Manual name Description

Guide to Introduces the structure of the whole set of manuals, the purpose and contents of
01
documentation each manual, and how to use each manual.
Introduces the principle, specifications, networking scenario and configuration of
the product, including:
1. Related fundamental knowledge
2. Principle of hardware and software
02 Technical Manual 3. Structure of hardware and software
4. Specifications of the overall system and each part/module
5. Internal and external interfaces provided and signaling protocols used
6. Service functions available
7. Connection and networking scenarios and specific configurations
Introduces the hardware system of the product from the viewpoint of cabinet,
shelf and circuit board, including:
1. The composition, assembly diagram and wiring diagram of each cabinet as
well as the functions of the configured shelves, communication relationship
between shelves and the technical specifications of the cabinet.
2. The structure, configuration, function, principle, backplane and interfaces of
03 Hardware manual
each shelf as well as the DIP switches and jumpers on the backplane
3. The function, principle, panel description, PCB layout, DIP switches,
jumpers and specifications of each board as well as whether the board is hot
swappable.
4. Structures of other hardware, such as outsourced parts, alarm box and
network management console.
Introduces the hardware installation method and points for attention, including:
Installation 1. Preparation for installation project
04
manual--Hardware 2. Hardware installation flow
3. Installation of cabinets and shelves
4. Connection of cables, including power cables, grounding wires, internal
cables and external cables
5. Installation of alarm system and background system
6. Installation of antenna and feeder system for radio equipment
7. Check list and standards for judging whether the hardware installation is up
to standard.
8. How to insert and extract circuit boards, pre-power-on check, and
power-on/off procedures
Introduces how to install the software of the equipment and the points for
attention, including:
1. Connection mode between the foreground and background, the software to
be installed, installation flow and the environment requirements for software
Installation
05 installation
manual—software
2. Installation of the operating system
3. Installation of software for various servers
4. Installation of client software
5. Installation of remote maintenance system
Introduces in detail all the man-machine interfaces of the operation and

maintenance system and the parameters on these interfaces. If no man-machine
interface manual is available, please refer to the on-line help or the operation
Man-machine manual for this information. A typical man-machine interface manual includes the
06
interface manual following contents:
1. Structure and networking mode of the operation and maintenance system
2. Startup, shutdown and man-machine interfaces of each server
3. Startup, shutdown and man-machine interfaces of clients
This task-oriented manual describes in detail the purpose, pre-operation setup

(including hardware and software environment, e.g., cabling, equipment room and
grounding), operation steps and result verification for the following tasks:
1. How to commission an office/site
07 Operation manual 2. Configuration of background operation and maintenance system
3. Network (topology) configuration
4. Hardware configuration (rack, shelf, board)
5. Alarm system configuration
6. Service interface configuration, user interface configuration
Introduces in detail all the man-machine commands of the operation and

08 Command manual maintenance system, including the name, function, format, parameter description
and examples for each command.
Serves as a reference manual for guiding equipment maintenance and

Maintenance troubleshooting, including:
09
manual 1. Routine maintenance, including daily, weekly, monthly and quarterly
maintenance items
2. Notification messages and their handling
3. Alarm messages and their handling
4. Common problem handling
5. Flow for handling serious accidents
The contents vary with the specific products. A typical comprehensive user
manual includes:
1. Structure and principle of the product
10 User manual 2. Installation and debugging of hardware and software
3. Power-on and power-off procedures, and how to operate and use the
equipment
4. How to maintain the equipment and handle common problems
The Documentation R&D Department offers you all-round services for accessing our
documentation:
◆ Our product manuals and maintenance experience monthly are available in hard copy,
CD and email.
◆ You can contact us at any time through doc@zte.com.cn.
◆ You can query and download the latest product manuals and Maintenance Experience
from http://ensupport.zte.com.cn.
How to register to this website: Enter the website, click “Register”, select “ZTE system
customer”, and enter your personal information. You will receive your username and
password in your registered mailbox within two days after your registration. Starting
from 2006, all trainees of ZTE university will be registered automatically, with your
username being your phone number and your password being the last 6 digits of your
phone number.
◆ You can contribute to Maintenance Experience through weihujingyan@zte.com.cn
The Documentation R&D Department has launched an action to “hunt bugs in product
documentation”. We welcome you to participate in this action, and there will be rewards for any
good suggestions.
Contents
1 No.7 Signaling System................................................................................................................................ 1
1.1 Signaling-Related Concepts ..............................................................................................................1
1.1.1 Definition of Signaling ...........................................................................................................1
1.1.2 Signaling Types ......................................................................................................................2
1.2 SS7 Overview....................................................................................................................................3
1.2.1 Features of the SS7.................................................................................................................3
1.2.2 SS7 Hierarchy.........................................................................................................................4
1.2.3 Message Structure of the SS7.................................................................................................5
1.3 Message Transfer Part (MTP) ...........................................................................................................8
1.3.1 Signaling Data Link Level (MTP1)........................................................................................8
1.3.2 Signaling Link Function Level (MTP2) .................................................................................8
1.3.3 Signaling Link Function Level (MTP3) ...............................................................................12
1.4 Signaling Connection Control Part (SCCP) ....................................................................................16
1.4.1 SCCP Overview....................................................................................................................16
1.4.2 Structure and Principles of SCCP Messages ........................................................................19
1.4.3 Basic Functions of the SCCP................................................................................................24
1.5 Transaction Capability Application Part (TCAP)............................................................................26
1.5.1 TCAP Hierarchy ...................................................................................................................27
1.6 Mobile Application Part (MAP) ......................................................................................................29
1.6.1 Basic Functions of the MAP.................................................................................................29
1.6.2 Mobility Management ..........................................................................................................30
1.6.3 Security Management...........................................................................................................38
i
1.6.4 Basic Call Services ...............................................................................................................54
1.6.5 Handoff Function..................................................................................................................65
1.7 Supplementary Services ..................................................................................................................67
1.7.1 Overview ..............................................................................................................................67
1.7.2 Supplementary Service Request Procedure ..........................................................................68
1.8 Telephone User Part (TUP) .............................................................................................................70
1.8.1 Basic Functions of the TUP..................................................................................................70
1.8.2 TUP Message Format ...........................................................................................................70
1.8.3 TUP Messages ......................................................................................................................72
1.9 ISDN User Part (ISUP) ...................................................................................................................76
1.9.1 Basic Functions of the ISUP.................................................................................................76
1.9.2 ISUP Message Format ..........................................................................................................77
1.9.3 ISUP Messages .....................................................................................................................81
1.10 BSSAP...........................................................................................................................................87
1.10.1 Basic Functions of the BSSAP ...........................................................................................87
1.11 INAP............................................................................................................................................105
1.11.1 Overview ..........................................................................................................................105
1.11.2 Pre-Paid Charging (PPC) Service .....................................................................................106
1.11.3 Wireless Virtual Private Network (WVPN) Service ......................................................... 113
1.11.4 Free Phone (FPH) Service ................................................................................................ 116
2 SS7 Network............................................................................................................................................ 121
2.1 Basic Concepts of the Signaling Network.....................................................................................121
2.1.1 Signaling Network Components.........................................................................................121
2.1.2 Signaling Point Code (SPC) ...............................................................................................122
2.1.3 Working Mode of the Signaling Network...........................................................................122
2.1.4 Signaling Route ..................................................................................................................123
ii
2.2 Typical Signaling Network Structure ............................................................................................125
3 Basic Service Procedures ....................................................................................................................... 127
3.1 MAP Service Procedures...............................................................................................................127
3.1.1 Security Management.........................................................................................................128
3.1.2 Mobility Management ........................................................................................................134
3.1.3 Basic Call Services .............................................................................................................138
3.1.4 SMS ....................................................................................................................................144
3.1.5 Supplementary Services .....................................................................................................153
3.2 A Interface Service Procedures......................................................................................................161
3.2.1 Overview ............................................................................................................................161
3.2.2 Call Processing ...................................................................................................................162
3.3 IUP/ISUP Service Procedures .......................................................................................................174
3.3.1 TUP Signaling Procedures..................................................................................................174
3.3.2 ISUP Signaling Procedures.................................................................................................178
3.4 Intelligent Network Service Procedures ........................................................................................181
3.4.1 PPC Subscriber-Originated Call.........................................................................................181
3.4.2 PPC Subscriber-Terminated Call........................................................................................183
iii
1 MSC/VLR Data Configuration Principles ........................................................................................... 191
1.1 Overview of Configuration Management System .........................................................................191
1.2 Basic Configuration Sequence ......................................................................................................191
1.3 Adjacent Office Connection Principle ...........................................................................................194
1.3.1 Connection Principle of the Signaling Office ID................................................................194
1.3.2 Connection Principle of Trunk Circuits..............................................................................194
1.3.3 Load Balance of Trunk Circuit and Signaling Link............................................................194
1.4 Precautions for Configuration .......................................................................................................195
2 MSC/VLR Data Configuration Specifications..................................................................................... 197
2.1 Specifications for Naming Module Number..................................................................................197
2.1.1 Module Number Naming Principles...................................................................................197
2.1.2 Suggestions on Module Name............................................................................................197
2.2 Physical Unit Configuration Specifications...................................................................................197
2.2.1 Configuration Principles.....................................................................................................197
2.2.2 Recommended Configuration.............................................................................................198
2.3 Trunk Board Configuration Specifications....................................................................................202
2.3.3 Example..............................................................................................................................204
2.4 Analog Signaling (ASIG) Board Configuration Specifications.....................................................206
2.4.3 Examples ............................................................................................................................208
2.5 Specifications for Defining Adjacent Office Direction .................................................................210
iv
2.5.3 Example.............................................................................................................................. 211
2.6 MTP Management Configuration Specifications ..........................................................................212
2.6.3 Example..............................................................................................................................212
2.7 Trunk Management Configuration Specifications.........................................................................214
2.7.2 Recommendations on Trunk Group Management Data Configuration ..............................215
2.7.3 Example..............................................................................................................................215
2.8 Default Capacity Planning.............................................................................................................216
3 Number Analysis Configuration Specifications ................................................................................... 217
3.1 Function of Number Analysis........................................................................................................217
3.2 Sequence of Number Analysis.......................................................................................................217
3.3 Number Analysis Selector Type ....................................................................................................218
3.4 Definition of Number Analysis Selector .......................................................................................219
3.5 Use Principle of Number Analyzer................................................................................................219
3.6 Meanings of Parameters in Number Analysis Result ....................................................................220
3.6.1 Call service category ..........................................................................................................220
3.6.2 Destination Network Type..................................................................................................220
3.6.3 Number Conversion at Calling Side...................................................................................221
3.6.4 Number Conversion at Called Side ....................................................................................221
3.6.5 Whether or not to End Analysis..........................................................................................221
3.6.6 Various Flag Bits ................................................................................................................221
3.6.7 Minimum and Maximum Number Length .........................................................................221
3.6.8 Length of Toll Prefix plus Area Code.................................................................................221
v
3.6.9 Number Attribute................................................................................................................222
3.6.10 Voice Channel Recovery Mode ........................................................................................222
3.7 Call Origination Selector Configuration........................................................................................222
3.7.1 Special Service Number Analyzer ......................................................................................222
3.7.2 Local Network Number Analyzer.......................................................................................223
3.7.3 National Toll Number Analyzer..........................................................................................224
3.7.4 National Toll Number Analyzer..........................................................................................225
3.8 Roaming Analysis Selector............................................................................................................225
3.9 Incoming Number Analysis Selector.............................................................................................226
3.9.1 Local Network Analyzer.....................................................................................................227
3.9.2 National Toll Analyzer........................................................................................................227
3.9.3 Other Numbers ...................................................................................................................227
3.10 Precautions for Number Analysis ................................................................................................227
3.11 Number Transform ......................................................................................................................228
3.11.1 Outgoing Number Transform ...........................................................................................228
3.11.2 Incoming Number Conversion..........................................................................................228
3.11.3 Application Cases of Number Transform .........................................................................229
4 Specifications for Analyzing and Making GT Number....................................................................... 231
4.1 Function of GT ..............................................................................................................................231
4.2 GT Number Category ....................................................................................................................232
4.3 GT Number Analysis Selector.......................................................................................................232
4.3.1 GT Translation Selector......................................................................................................232
4.3.2 GT Translation Selector Configuration ..............................................................................233
4.4 GT Number Analysis Data ............................................................................................................235
4.4.1 Addressing Mode................................................................................................................235
4.4.2 Number Analysis Digit Length...........................................................................................235
vi
4.4.3 GT Translation Data ...........................................................................................................236
4.4.4 STP Data Configuration: ....................................................................................................238
4.4.5 SP Office Data Configuration.............................................................................................240
vii
1 HLR/AUC Data Configuration Principles ........................................................................................... 243
1.1 Overview of Configuration Management System .........................................................................243
1.2 Basic Configuration Sequence ......................................................................................................243
1.3 Principles of Adjacent Office ID Connection................................................................................245
1.3.1 Principles of Signaling Office ID Connection....................................................................245
1.3.2 Principles of Adjacent Office ID MTP Routing .................................................................245
2 Data Configuration Principles of HLR/AUC....................................................................................... 247
2.1 Physical Configuration ..................................................................................................................247
2.2 Office Capacity Configuration ......................................................................................................247
2.3 Service Data Configuration ...........................................................................................................247
2.4 Configuration of Security Variable Control...................................................................................248
2.5 Principles of Subscriber Database Configuration..........................................................................248
2.6 Subscriber Database Security Management ..................................................................................248
3 Number Conversion Configuration ...................................................................................................... 249
3.1 Number Conversion Modes...........................................................................................................249
3.2 Field Descriptions..........................................................................................................................250
3.2.1 Number Type ......................................................................................................................250
3.2.2 Conversion Methods...........................................................................................................250
3.2.3 Properties............................................................................................................................251
3.3 Configuration Instances.................................................................................................................251
4 GT Number Configuration Specifications ........................................................................................... 255
4.1 Overview of GT.............................................................................................................................255
4.1.1 GT Functions ......................................................................................................................255
4.1.2 GT Number Categories.......................................................................................................256
viii
4.2 GT Number Analysis Selector.......................................................................................................256
4.2.1 GT Translation Selector......................................................................................................256
4.2.2 GT Translation Selector Configuration ..............................................................................257
4.3 GT Number Analysis Data ............................................................................................................259
4.3.1 Addressing Mode................................................................................................................259
4.3.2 Number Analysis Digit Length...........................................................................................259
4.3.3 GT Translation Data ...........................................................................................................259
4.3.4 Data Configuration Descriptions ........................................................................................261
ix
ACM-204-C1 Troubleshooting
1 Fault Classification................................................................................................................................. 263
1.1 Fault Classification........................................................................................................................263
1.2 Key Fault (Level 1 Fault) ..............................................................................................................264
1.3 Major Fault (Level 2 Fault) ...........................................................................................................265
1.4 Ordinary Fault (Level 3, Level 4 Faults).......................................................................................265
2 Troubleshooting Principles and Method .............................................................................................. 267
2.1 Troubleshooting principles ............................................................................................................267
2.1.1 View....................................................................................................................................267
2.1.2 Inquiring .............................................................................................................................267
2.1.3 Think...................................................................................................................................267
2.1.4 Taking Action .....................................................................................................................267
2.2 Common troubleshooting tools .....................................................................................................268
2.2.1 Fault Management ..............................................................................................................268
2.2.2 Configuration management ................................................................................................268
2.2.3 Signaling trace ....................................................................................................................268
2.2.4 Service observation ............................................................................................................268
2.2.5 Performance Statistics ........................................................................................................269
2.2.6 Diagnosis test......................................................................................................................269
2.3 Common troubleshooting methods................................................................................................269
2.3.1 Voice call test......................................................................................................................269
2.3.2 Alarm test judgment ...........................................................................................................270
2.3.3 Performance statistic database observation ........................................................................271
2.3.4 Date area observation .........................................................................................................272
2.3.5 Failure observation statistics ..............................................................................................274
2.3.6 Signaling trace ....................................................................................................................275

x
2.3.7 Supplementary test .............................................................................................................275
2.4 Common fault message collection.................................................................................................275
2.4.1 Signaling trace result ..........................................................................................................275
2.4.2 Failure observation results..................................................................................................276
2.4.3 Collection of performance measurement data ....................................................................276
2.4.4 Acquisition of log files .......................................................................................................277
3 Common Methods for Analyzing and Locating Fault......................................................................... 281
3.1 Hardware problem.........................................................................................................................281
3.1.1 DT Control Unit Failure .....................................................................................................281
3.1.2 Environment monitoring board fault ..................................................................................282
3.1.3 Monitoring board fault .......................................................................................................282
3.1.4 Single Fault with the Switching Network...........................................................................282
3.1.5 SMEM Board Failure .........................................................................................................282
3.1.6 Net drive board alarm.........................................................................................................283
3.1.7 The standby MP faulty........................................................................................................283
3.1.8 Bill data writing disk failure in the charging server ...........................................................284
3.2 Trunk signaling..............................................................................................................................284
3.2.1 DT PCM Alarm ..................................................................................................................284
3.2.2 SCCP Alarm .......................................................................................................................285
3.2.3 No. 7 Circuit Out-of-service Alarm ....................................................................................285
3.2.4 Alarm on Unreachable Signaling Point ..............................................................................285
3.3 System Running Problem ..............................................................................................................286
3.3.1 Optical line board active/standby alarm .............................................................................286
3.3.2 No.7 COMM board failure .................................................................................................286
3.3.3 MPPP COMM board failure...............................................................................................286
3.3.4 MPMP COMM board failure..............................................................................................287
xi
3.3.5 Inter-module Communication Breakdown .........................................................................287
3.3.6 OIB Alarm ..........................................................................................................................287
3.3.7 Fault of the communication link with JFServer .................................................................287
3.3.8 Interruption of communication between the alarm server and MP.....................................288
3.4 Clock problem ...............................................................................................................................288
3.4.1 Some CKI References Failed .............................................................................................288
3.4.2 Loss of Reference for Over 10 Minutes .............................................................................289
3.4.3 All CKI References Failed .................................................................................................289
3.4.4 All SYCK References Failed..............................................................................................289
3.5 Company service problems ...........................................................................................................289
3.5.1 Vacant Number Problem.....................................................................................................289
3.5.2 The called number cannot be connected temporarily. ........................................................290
3.5.3 Subscriber not active ..........................................................................................................291
3.5.4 Number displaying problem ...............................................................................................292
3.5.5 Mute Problem .....................................................................................................................292
3.5.6 Echo Problem .....................................................................................................................293
3.5.7 Monolog .............................................................................................................................294
xii
Objectives:
z To learn the related concepts, structure and functions of the SS7
z To master the structure of the SS7 network
z To master the construction of China Unicom’s SS7 network
z To master the common MAP signaling flows and the analysis
z To learn the TUP/ISUP signaling flows
z To learn the A interface signaling flows
z To learn the IN signaling flows
i
1 No.7 Signaling System
Key points:
z Hierarchy of the SS7; functional features of each layer; structure of various

messages and meanings of the message components
1.1 Signaling-Related Concepts
1.1.1 Definition of Signaling
The purpose of establishing a communication network is to transmit all kinds of

information including speech and non-speech information for users; therefore, various
devices in the communication network will exchange a variety of information so as to
well cooperate with one another. We call the information transmitted between the
devices "signaling". In simple words, signaling is the "language" between devices to
exchange their states and purposes.
As every language has its own conventional rules and stipulations, signaling must
comply with the rules made by the related organizations. We call such rules "signaling
protocols" or "signaling modes". We will describe the signaling mode from three
aspects: structure, transfer mode and control mode.
1. Structure
1) Uncoded signaling such as China No.1 signaling, which takes the method of
selecting two out of six or four to form different signals that are not coded.
2) Coded signaling such as No.7 signaling.
2. Transfer mode
1) End to end transfer mode: The SCCP layer of the SS7 adopts this mode.
2) Link by link transfer mode: The MTP layer of the SS7 adopts this mode.
3) Hybrid mode: The both modes are adopted.
The link-by-link mode is used when the SS7 only has the MTP and the TUP,
1
ACM-201-E1 Signaling System No.7 (SS7)
while the end-to-end mode is used when the SS7 has the SCCP layer. For China
No.1 signaling, the end-to-end mode is commonly used, and the link-by-link
mode is used only in circuits of poor quality.
3. Control mode
1) Non-mutual-control: Similar to the concept of full duplex, that is, Party A is not
controlled by Party B when transmitting signaling to Party B and vice versa. The
two parties can take the next action before receiving a response from the peer.
The SS7 uses the non-mutual-control mode.
2) Semi-mutual-control: Similar to the half-duplex mode in dispatching

automobiles. One party can decide the next action only after receiving the
information from the peer, while the other party is not controlled.
3) Full-mutual-control: The two parties are controlled by each other and coordinate
with each other to complete the specified task. China No.1 signaling adopts this
mode.
1.1.2 Signaling Types
There are lots of methods to classify signaling, including the following common ones:
1. Signaling is divided by different transfer areas into subscriber line signaling and
inter-office signaling.
1) Subscriber line signaling: The signaling transmitted between a subscriber’s

phone and the switch, such as off-hook/on-hook signaling, dialing tone signaling
and busy tone signaling. The most distinctive feature of the signaling is that
there is a little such signaling and the signaling is simple.
2) Inter-office signaling: The signaling transmitted between switches, or between

the switch and the NM (Network Management) center or database. This kind of
signaling is more than and more complex than subscriber line signaling.
2. Signaling is divided by the relationship between the signaling transfer channel

and the speech channel into CAS (Channel Associated Signaling) and CCS
(Common Channel Signaling).
1) CAS: The channel for speech information transmission is used to transmit

signaling related to the speech channel, or one signaling channel uniquely
corresponds to one speech channel. A typical example is China No.1 signaling.
2
Chapter 1 No.7 Signaling System
2) CCS: The channel for signaling transmission and the channel for speech
information transmission are separated. Signaling is transmitted on a
bidirectional signaling link. The SS7 is a kind of CCS.
1.2 SS7 Overview
1.2.1 Features of the SS7
1. High utilization ratio of channels
In theory, a single SS7 link can provide services for tens of thousands of speech
channels, and 2000 to 3000 speech channels even if a certain redundancy is
considered. In contrast, 15 TS16s (TS16 of the first frame is used for multiframe
synchronization) of a multiframe (including 16-frame multiframes) in CAS can
only transmit the information of 480 (16*30) speech channels.
2. Fast transmission
The SS7 transmits information in the digital form and four bits represents one
digit, so the SS7 is much better than CAS.
3. Large signaling capacity
The SS7 transmits signaling in the form of messages with flexible coding. The
maximum length of a message is 272 bytes and the message contents are
abundant. All these are incomparable features CAS does not have.
4. Wide application
The SS7 can transmit not only traditional circuit connection signaling but also
circuit-independent information such as management, maintenance and query
information. Therefore, it is the basis of the ISDN, mobile communication and
intelligent network services.
5. Since the signaling network is separated from the communication network, the
SS7 is easy to operate, maintain and manage.
6. The technical specifications of the SS7 can be easily expanded to satisfy the
development requirements of future information technologies and unknown
services.
One link in the SS7 can provide services for thousands of speech channels, so its
3
reliability must be higher than that in CAS, because the corresponding speech
channels will be influenced once a certain signaling link fails.
1.2.2 SS7 Hierarchy
Modern communications are actually based on computer control. The universality of

the No.7 Signaling System (SS7) determines the necessity of the whole system to
provide many different application functions and have a flexibly expandable
architecture. Therefore, a significant feature of the SS7 is that it adopts modular
architecture to realize the coexistence of multiple applications in the same framework.
In other words, the SS7 is designed and applied based on the Open Systems
Interconnection (OSI), and the basic concepts are as follows:
1. The communication functions are divided into several layers. Each layer just
implements some functions and may be developed and tested alone.
2. Each layer just communicates with its two adjacent layers. It utilizes the services
provided by the next lower layer via the inter-layer interface (without needing to
know how that the next lower layer implements these services) and provides the
specific functions it can implement to the next higher layer.
Each layer is independent and can employ the most appropriate technology for
technical implementation. Changes to a layer due to technical development will not
affect the other layers as long as the interface relations keep the same.
According to this concept, the SS7 can be divided into four functional levels: Message
Transfer Part (MTP) levels 1, 2 & 3 and User Parts (UPs). The MTP levels in the
ascending order of functions are the signaling data link level (MTP1), the signaling
link level (MTP2) and the signaling network level (MTP3). The function of the MTP is
to correctly transfer signaling messages between signaling points.
The UPs process signaling information. There are different Ups according to different
applications. The Telephone User Part (TUP) processes call control signaling messages
in the telephony network; the ISDN User Part (ISUP) processes call control signaling
messages in the ISDN; the Mobile Application Part (MAP) processes call control
signaling messages and call-independent signaling messages (such as roaming and
location update) in the mobile communication network. The detailed protocol hierarchy
is shown in Figure 1.2-1.
4
OSI ITU-T SS7 signaling user
OMAP
(MRVT SRVT)
INAP MAP B
S
Layer 7 S
A I M
TCAP P T
S T
U
U U
P
Layer 6 P P
Layer 5
Layer 4
Layer 3 SCCP
Layer 2
Layer 1
MTP
Figure 1.2-1 Protocol Hierarchy
MTP: Message Transfer Part
SCCP: Signaling Connection Control Part
TUP: Telephone User Part
ISUP: ISDN User Part
TCAP: Transaction Capability Application Part
OMAP: Operation and Maintenance Application Part
MAP: Mobile Application Part
INAP: Intelligent Network Application Protocol
1.2.3 Message Structure of the SS7
In the SS7, all the messages are transmitted in the form of signaling units. A signaling
unit is a data block, similar to a packet in packet switching. The message signal units
5
for transmitting user information can be transmitted in the form of variable-length. The
SS7 signaling units fall into three types by different functions:
1. Fill-In Signal Unit (FISU)
2. Link State Signal Unit (LSSU)
3. Message Signal Unit (MSU)
The FISU is a blank signal unit without any information. It can keep the signaling link
in the communication status and acknowledge the messages from the peer when the
network node has no information to transmit. The LSSU is a signal unit transmitting
the link status. The link status is indicated by the SF (State Field). The MSU is the
signal unit actually carrying the message and places the message in the SIF and SIO
fields. Figure 1.2-2 shows the formats of these three signal units.
F CK SIF SIO LI FIB FSN BIB BSN F
8 16 n× 8 2 6 1 7 1 7 8
(a) MSU format
F CK SF LI FIB FSN BIB BSN
F
8 16 16 2 6 1 7 1 7 8
(b) LSSU format
8 16 2 6 1 7 1 7 8
(c) FISU format
Figure 1.2-2 Signaling Unit Formats of the SS7
With different uses, the three signal units are transmitted in the signaling network and
can be easily differentiated by the LI (Length Indicator): When LI equals 0, this unit is
the FISU; when LI equals 1 or 2, this unit is the LSSU; and when LI is greater than 2,
this unit is the MSU. Both the FISU and the LSSU are sent and received in MTP2. The
MSU delivers the actual user information and is sent/received in MTP3.
The fields in the signal units are defined as follows:
F: Signal unit delimiter. It is an octet with the code pattern of 01111110 and represents
the end of the previous unit and the beginning of the next unit.
6
CK: The error check code. Composed of one or two octets, it is used to detect the
errors possibly occurring during the transmission of the signal unit.
LI: Length Indicator. It is 6 bits long and used to indicate the number of octets between
LI and CK (excluding themselves). It is greater than 2 for the MSU, equal to 1 or 2 for
the LSSU and equal to 0 for the FISU. When the message length is greater than 63
octets, the LI equals 63.
FSN/FIB and BSN/BIB: Forward Sequence Number/Forward Indicator Bit and

Backward Sequence Number/Backward Indicator Bit. They compose two octets for
error correction.
FSN: 7-bit Forward Sequence Number, which is the sequence number of this message.
It adopts modulo-128 coding.
FIB: Forward Indicator Bit. It may be inversed to instruct the local end to start
resending the message.
BSN: 7-bit Backward Sequence Number, used to tell the peer that all the messages
whose sequence number is within the BSN have been correctly received.
BIB: Backward Indicator Bit. It may be inversed to instruct the peer to start resending
the message from BSN+1.
SIO: Service Indicator Octet, which only occurs in the MSU and is used to indicate the
type of the message and the network.
The SIO consists of two subfields: The SI (Service Indicator indicating the type of the
message) that occupies the four least significant bits and the SSF (Sub Service Filed
indicating the type of the network) that occupies the four most significant bits.
SIF: Signaling Information Field, including the information actually sent by the user. It
consists of two parts: Label and signal information. The signal information is
determined by the specific User Part and the label includes DPC (Destination Point
Code), OPC (Originating Point Code) and CIC (Circuit Selection Code) or SLS
(Signaling Link Selection).
SF: Status Field, which is only used in the LSSU to indicate the link status and is
generated by MTP2.
7
1.3 Message Transfer Part (MTP)
1.3.1 Signaling Data Link Level (MTP1)
The signaling data link level (MTP1) is the first level of functions in the SS7. It defines
the physical, electrical and functional features of the signaling data, determines the
method of connecting the data link and provides a full duplex bidirectional
transmission channel. The signaling data link consists of a pair of data channels with
opposite transmission directions and the same dada rate and completes the transparent
transmission of binary bit streams. The SS7 is most suitable for digital communication
networks. The signaling data link usually is a 64 kbit/s digital channel and corresponds
to a timeslot in the PCM transmission system. For example, in the PCM30/32 system,
TS16 is often selected to transmit signaling or other TSs except TS0 are used to transmit
signaling.
The signaling data link of MTP1 can be connected with the second function level of the
digital SPC switch through the digital switching network or interface equipment. The
signaling data link connected via the switching network of the digital SPC can only be
a digital signaling data link. Semi-permanent channels can be established in the digital
switching network to automatically allocate signaling data links or signaling terminals
(MTP2).
In the ZXC10-MSS system, MTP1 is implemented by the Digital Trunk Interface (DTI)
in the switch.
1.3.2 Signaling Link Function Level (MTP2)
The signal link functions serve as the second level of signaling link control and work
together with the signaling data links of MTP1 to ensure that reliable signaling links
are provided to transmit signal messages between two associated signaling points, that
is, they ensure that the transmission quality of the signaling messages meets the
specific indexes.
MTP2 completes the following functions:
z Signaling unit delimitation
z Signaling unit alignment
z Error detection
8
z Error correction
z Initial alignment
z Signaling link error ratio monitoring
z Traffic control
z Processor fault control
The above functions are specifically described as follows:
1.3.2.1 Delimitation and Alignment of Signal Units
To identify the signal units from the bit streams of the signaling data link, a flag should
be set to identify the start and end of every signal unit. The SS7 stipulates that the flag
should take the fixed code 01111110 as the start and end of the signal unit. The system
will check if the flag exists when receiving a signal unit and generate a flag when
sending a signal unit.
In order to delimit the signal unit correctly, this code pattern should not appear in the
other parts of the signal unit. The method to insert the "0" bit is used: 1) The signal unit
without the flag is checked at the sending end. When six continuous "1"s appear in the
message information, the operation to insert a "0" is performed, that is, insert a "0"
after five continuous "1"s; 2) the signal unit containing the flag is checked at the
receiving end. When five continuous "1"s appear, the operation to delete "0" is
performed, that is, delete "0" after the five continuous "1"s.
Normally, the signal unit length is restricted and shall be an integer multiple of 8 bits
and six continuous "1"s should not exist before "0" is deleted. If the above conditions
are not satisfied, the signal unit would be regarded as misaligned, in which case all the
received signal units should be discarded and the signal unit error monitoring process
should be statistically counted.
1.3.2.2 Error Detection
The purpose of error detection is to judge if any error occurs in the bit streams of the
signal units being transmitted.
The interference, such as noise and transient interruption of the transmission channel,
will lead to errors in the signaling information. Therefore, measures for error control
must be taken to guarantee the QoS. Error control includes error detection and error
correction.
9
In order to correct the burst errors caused by pulse interference or transient interruption,
the CRC (Cyclic Redundancy Check) method may be used. We may add redundancy
codes to make the sequence of transmitted information observe a certain rule while
detecting at the receiving end if this rule exists.
1.3.2.3 Error Correction
The purpose of error correction is to re-obtain the correct signal unit after an error
occurs. The SS7 uses the resend method, that is, it requires the sending end to resend
the signal unit when the receiving end detects an error.
There are two error correction methods: Basic method and Preventive Cyclic
Retransmission (PCR) method. When the transmission delay is less than or equal to 15
ms, the basic error correction method is recommended and usually used for terminated
transmission. When the transmission delay is greater than 15 ms, the PCR method is
recommended and used for satellite communications.
1. Basic error correction
The basic error correction method is a non-compelled mode with

affirmative/negative acknowledgement and retransmission.
The non-compelled mode means that the sender can send message signal units
continuously and does not need to wait for the acknowledgement of the previous
signal unit. Obviously, it can enhance the speed of signal transmission.
The affirmative acknowledgement indicates the signaling unit is received

correctly and the negative acknowledgement indicates the signaling unit is
received with errors and needs to be resent. The acknowledgement is
implemented by the sequence numbers of every signal unit: Forward Sequence
Number (FSN), Backward Sequence Number (BSN), Backward Indicator Bit
(BIB) and Forward Indicator Bit (FIB). The FSN implements sequential control
of the signal unit and the BSN implements the function of affirmative
acknowledgement. The peer puts the FSN of the last correctly received message
signal unit into the BSN of the next signal unit it will send to the local end, that
is, the BSN from the peer indicates the FSN of the message signal unit the peer
has correctly received from the local end. Negative acknowledgement is
implemented by the inversion of the BIB.
2. Preventive Cyclic Retransmission (PCR)
10
Preventive cyclic retransmission is a non-compelled method with affirmative

acknowledgement and cyclic retransmission. A Retransmission Buffer (RTB) is
equipped at every signaling terminal and temporarily stores the sent signal unit
whose affirmative acknowledgement is not yet received. When there is no new
message signal unit to be sent, the message signal units that are unacknowledged
and stored in the RTB will be automatically re-sent cyclically. If there are new
signal units, cyclic retransmission will pause and the new signal units will be
transmitted with first priority. Since it uses active cyclic retransmission, the PCR
method does not employ negative acknowledgement.
O Note:
During the configuration of a signaling link, the system requires that you specify the
error correction method. Due to high realtimeness and little delay of message transfer
in our system, the basic error correction method should be selected.
1.3.2.4 Alignment
Alignment is the control procedure used to recover a signaling link upon initial
activation of this link or after a failure occurs to it. The whole process includes four
states: IDLE, NOT ALIGNED, ALIGNED and PROVING. According to the different
proving periods, alignment falls into normal alignment and emergency alignment.
Which mode to use depends on MTP3.
1.3.2.5 Signaling Link Error Rate Monitoring
Signaling link error rate monitoring is used to monitor the error ratio of signaling links
so as to ensure a good QoS. When the error ratio of a signaling link reaches a certain
threshold value, the signaling link should be regarded as having failed.
There are two error monitoring processes for different signal environments. One is for
monitoring the signal unit error ratio when the signaling link is in service and the other
is for monitoring the alignment error ratio when the signaling link is in the proving
status of the alignment phase.
1.3.2.6 Level 2 Flow Control
It is used to handle the congestion status detected in MTP2 so as to prevent the

congestion of signaling links from spreading and ultimately restore the links to the
normal working status.
11
When the signaling link receiving end detects a congestion, it will stop the affirmative
or negative acknowledgement of the message signal unit and send the link status signal
unit with SIB (busy indication), so that the peer can tell whether it is a congestion or
failure. When the congestion is removed at the signaling link receiving end, the
receiving end will stop sending the SIB and the signaling link will be restored.
1.3.2.7 Processor Fault
When a signaling link is not available due to the problem of MTP2 or above function
levels, the processor will be regarded as malfunctioning. A processor fault means that
signal messages cannot be transmitted to the third or fourth function level. It may be
caused by the CPU or by manual blocking of a signaling link.
When MTP2 receives a failure indication from MTP3 or identifies a fault of MTP3, it
will determine that the local processor fails and then send an SIPO to the peer and
discard the message signal units received thereafter. When the processor fault is
recovered, MTP2 will stop sending the SIPO and will start sending the signaling units
again. The signaling link enters the normal status.
In the ZXC10-MSS system, MTP2 is implemented by the Signaling Terminal Board

(STB) in the switch.
1.3.3 Signaling Link Function Level (MTP3)
MTP3 is the third level of functions in the SS7. In principle, it defines the functions
and procedures for transmitting information in the signaling network and is common
for all signaling links.
The functions of the signaling network fall into signaling message handling and
signaling network management. The function of signaling message handling is to direct
messages to the appropriate signaling links or user parts, whereas the function of
signaling network management can control message routing or the structure of the
signaling network based on the preset data and information of the signaling network, so
that the network structure can be reorganized and the normal message transfer
capability can be maintained or restored when any fault occurs to the signaling
network.
1.3.3.1 Signaling Message Handling
The Signaling Message Handling (SMH) function ensures that the signaling message
12
from the user part of a signaling point is correctly transferred to the same type of user
part at the specified destination. It is composed of three functional parts: Message
routing, discrimination and distribution. The structural relationship among them is
shown in Figure 1.3-1.
Signaling link functions (Level 2)

Message From Level 2
Messag
distribution e discri-
mination
User
Parts
Messag
e
routing To Level 2
From Level 4
Figure 1.3-1 Structure of Signaling Message Handling
1. Message discrimination
The Message Discrimination (MDC) function can receive messages from MTP2
and determine if the destination of the messages is the local signaling point
according to the DPC in the messages. If the destination is the local signaling
point, the message discrimination function will transmit the message to the
message distribution function. Otherwise, it would transmit the message to the
message routing function so as to forward the message. The latter case indicates
that the local signaling point has the transfer function, that is, the Signaling
Transfer Point (STP) function.
2. Message distribution
The Message Distribution (MDT) function can distribute messages from the
message discrimination function to the corresponding user parts and the
signaling network management and testing & maintenance part according to the
SIO (Service Indicator Octet) in the service information field of the signaling
units. A message arriving at the message distribution part must be received by
the local signaling point.
3. Message routing
13
The Message Routing (MRT) function selects the message route, that is, it
selects a signaling link for the signaling message according to the information
(DPC and SLS) in the routing label so as to transmit the signaling message to
the destination signaling point.
1) Message source
The messages sent to the message routing part fall into the following types:
z User signaling message from Level 4
z Messages to be forwarded from the message discrimination function in MTP3

SMH (when the local signaling point is a signaling transfer point)
z Messages generated by MTP3. They come from the signaling network

management and testing & maintenance function, including signaling route
management messages, signaling link management messages, signaling service
management messages and signaling link test control messages.
2) Routing
For a message to be sent, the system will first check if a route to the destination
(DPC) exists. If the route does not exist, it shall tell the signaling route
management function in signaling network management that it has received a
message destined to an unreachable signaling point. If a route to the DPC exists,
the system will select a signaling link according to the load-sharing principle
and send the message to MTP2.
& Note:
Load sharing of signaling links:
Since there arises a high reliability requirement for transmitting signal messages and
there are often multiple routes to the destination, the system will select a link according
to the load-sharing principle based on the SLS during message routing. Usually, there
are two methods: 1) Load sharing of different signaling links in the same link set; 2)
Load sharing of signaling links in different link sets.
We have simply introduced three different functions in signaling message handling of

MTP3. It is very easy to see that MTP3 is implemented on the basis of some
identifications such as DPC and SLS in the signaling message. These identifications
are the routing label in the signaling message and the routing label that must be carried
14
in every signaling message. The routing label is discussed in the section below.
1.3.3.2 Routing Label
The routing label is located at the beginning of the Signaling Information Field (SIF) in
a Message Signal Unit (MSU), as shown in Figure 1.3-2.
S IF
S ig n a lin g H e a d in g c o d e
in fo rm a tio n L abel
H 1H 0
SLS O PC DPC
4 14 14
R o u tin g la b e l
(a )
SLS O PC DPC
4 4 24 24
R o u tin g la b e l
(b )
Figure 1.3-2 Routing Label
The routing label consists of the following information:
z DPC: Destination Point Code
z OPC: Originating Point Code
z SLS: Signaling Link Selection
The DPC (Destination Point Code) is the signaling point code of the message
destination, the OPC (Originating Point Code) is the originating signaling point code of
the message, and the SLS (Signaling Link Selection) is the code to select the signaling
link in the load sharing mode. The routing label shown in (a) of the above figure is 32
bits long: 14 bits for the DPC, 14 bits for the OPC and 4 bits for SLS. The routing label
used by China is shown in (b) of the above figure: DPC and OPC are both 24 bits long,
15
SLS is 4 bits long and the other four bits are reserved.
For the circuit-dependent signaling message of the Telephone User Part (TUP), the
SLS is practically the four least significant bits of the CIC (Circuit Identification Code).
The CIC indicates to which circuit this signaling message belongs.
O Note:
The 14-bit signaling point code is used internationally whereas the 24-bit code is used
by most of the signaling points in China. The 14-bit signaling point code is also used in
China but seldom. Please refer to the section about the signaling network for details.
A description of the CIC will be given in the related chapter.
If you are still not clear about the above description, let’s have a look at a simple
example in real life and begin with the mailing of a letter.
We may regard a letter as a message to be transmitted. The address of the addressee

equals the Destination Point Code (DPC), the name of the addressee is the specific user
of the message, and the address of the sender is just like the Originating Point Code
(OPC) and is used as the return label in the case of delivery failure. When the letter is
sent to the post box, local and non-local mails are sorted by the sorter. Local mails are
sent by the local postman to the appropriate users. The non-local mails can have
different routes (e.g. by land, sea or air) according to different destinations and can be
sent by the postman to a railway station, dock or airport.
In this example, the functions of MTP3 are what the post office completes. The
message discrimination function is the mail sorter, the message distribution function is
the local postman and the message routing function is the postman.
1.3.3.3 Signaling Network Management
Signaling network management means to control the message routing and signaling
network structure based on the known signaling network status data and information,
so that the signaling network can be reorganized in the case of a fault so as to recover
the normal transfer capability of the signaling service. It is composed of three function
procedures: Signaling service management, signaling link management and signaling
route management.
In the ZXC10-MSS system, MTP3 is implemented by the Mobile Processor (MP)

board in the switch.
16
1.4 Signaling Connection Control Part (SCCP)
1.4.1 SCCP Overview
Through studying the MTP layer, we learn that addressing is to send a message to the
specified destination based on the Destination Point Code (DPC) and then allocate the
message to the specified user part according to the Service Indicator (SI). However,
with the development of telecom networks, more and more network services need to
transmit end-to-end control information between remote nodes. This information is
irrelevant to the call connection circuit and is even call-independent. It includes the
information related to roaming and authentication services sent between the Mobile
Switching Center (MSC), the Visitor Location Register (VLR) and the Home Location
Register (HLR) in the digital mobile communication network, and the information sent
between the Service Switching Point (SSP) and the Service Control Point (SCP) in the
intelligent network. The addressing function of the MTP can no longer satisfy these
requirements.
In the SS7 hierarchy, the signaling connection control part belongs to the user part of
the MTP and provides the MTP with the GT-based routes and routing functions. This
makes it possible to transmit different types of circuit-dependent or circuit-independent
information and other types of information between the switching offices and dedicated
centers in the telecom network through the SS7 network, and set up connectionless or
connection-oriented services. If the data that the user wants to transmit exceeds the
limited capability of the MTP, the SCCP will provide the necessary segmentation and
reassembly functions. The SCCP is the third layer in the SS7. After implementing the
supplementary addressing function of MTP3, the SCCP will combine with MTP3 to
provide the network layer functions equal to the OSI reference model. The SCCP
functions must be added to the signaling points in the SS7 network to provision
services such as end-to-end supplementary services of ISDN, IN services, roaming and
channel switching of mobile calls and SMS.
& Note:
The term "User" is often mentioned here. What is the user and who is whose user? We
have emphasized that the SS7 network is a hierarchical structure. In this structure, the
N+1st layer is the user of the Nth layer and the N-1 layer is the service provider of the
Nth layer. The SCCP is above the MTP, so the SCCP is the user of the MTP and also the
service provider of the TCAP.
17
1.4.1.1 Limitations of the MTP
The source of the SCCP is mentioned above. Which aspects of the MTP cannot satisfy
the needs of modern communications? To answer this question, we have to mention the
limitation of the MTP in the following four aspects:
1. The signaling point code is not the international unified code and not globally
insignificant
The code of every number is related to the specified national network. It will not
be identified when connecting with the signaling points of other national
networks. In some cases, for example, when a mobile subscriber roaming abroad
needs a location update and searches for the home location register, the signaling
point may possibly be unable to be addressed correctly.
2. Unable to satisfy the addressing requirements of more users
For a signaling point, the Service Indicator (SI) has a 4-bit code and is permitted
to allocate 16 users of the MTP at most. However, there are actually far more
than 16 users and the MTP is unable to satisfy the addressing requirements of
more users, as shown in Figure 1.4-1.
SSF SI
4bit 4bit
SIF SIO
Figure 1.4-1 SIO Message Bit
3. Unable to suit the development of diversified services in the telecom network.
The MTP is only connectionless and provides the datagram service. The telecom
network tends to send abundant non-realtime messages (like billing files)
between network nodes. Due to the large volume of data and high reliability for
these messages, it is required to establish virtual circuits between network nodes
and implement connection-oriented data transmission.
4. The MTP only supports the link-by-link mode but not the end-to-end
transmission mode.
18
1.4.1.2 Application Features of the SCCP
1. Transmits circuit-independent signaling messages.
2. Provides the routing function based on the GT to implement direct transfer of

signaling between the different SS7 networks globally interconnected.
3. Provides both connection-oriented and connectionless services.
According to the SS7 hierarchy, the users of the SCCP are the ISUP and the TCAP. The
ISUP implements end-to-end transfer of messages through the SCCP and supports the
related ISDN supplementary services. With the perfect network layer functions of the
SCCP and MTP3, the TCAP implements the existing and future remote transmission of
circuit-independent messages and supports new services and functions such as mobile
communication and IN services.
1.4.2 Structure and Principles of SCCP Messages
After receiving a primitive from a user, the SCCP will encapsulate the user data and the
necessary control & routing information into an SCCP message according to the
primitive parameters and send it to the peer SCCP entity of the remote node.
ITU-T defines 23 types of messages for the SCCP, of which 4 types are used for
connectionless services, 14 for connection-oriented services and the rest five for SCCP
management. The MAP only uses the four kinds of connectionless messages.
z UDT (Unit Data)
Used to transfer user data.
z UDTS (Unit Data Service)
When the UDT message cannot be correctly transmitted to the user and should
be returned, the DUTS is used to specify the reason of transmission errors.
z XUDT (Extended Unit Data)
When the data volume to be transmitted is greater than what an MSU can carry,
the SCC will divide the user data into segments and transmit them in multiple
XUDT messages. The SCCP at the receiving end will send them to the SCCP
user after reassembly.
z XUDTS (Extended Unit Data Service)
When XUDT message transmission errors occur and the message should be sent
19
back, XUDTS is used to indicate the cause of transmission error.
SCCP message format:
SCCP messages are encapsulated in the SIF field and transmitted in the signaling
network through the MSU, as shown in Figure 1.4-2.
F B
F CK SI SIO FS
F LI I N I BSN F
B B
Transmit direction
Level 3 Signaling network H H SL

management info OPC DPC
1 0 S
TUP H H CIC
TUP info OPC DPC
1 0 SL
S
ISUP ISUP info Message type CIC SL OPC DPC

S
SCCP Message
SCCP EO SL
User data message type S OPC DPC
P header
Component portion Transactio

TCAP Component Component Component n portion
3 2 1
Figure 1.4-2 Encapsulation Structure of Messages in the MSU
1. Message type
The message type is the message type as described previously and it consists of
an octet. It uniformly defines the functions and format of every SCCP message
and is mandatory for all the messages. The MAP only uses four kinds of
connectionless services at present.
The Unit Data (UDT) is used to transmit unit data and the Unit Data Service
(UDTS) is used to notify the reason why the unit data do not arrive. The
Extended Unit Data (XUDT) is used to transmit the extended unit data and the
Extended Unit Data Service (XUDTS) is used to notify the reason why the
extended unit data do not arrive.
2. Address code format
20
We have been emphasizing the SCCP function, which is used for addressing in
the network. To perform addressing correctly, the SCCP layer must have the
corresponding address information, which is encapsulated in the SCCP message
structure and has the specified format.
The calling party address and the called party address in the SCCP message
consist of the address type indicator and the address information, which are a
combination of several octets. The format of address information depends on the
code of the address indicator. The format of the SCCP calling party and called
party addresses is shown in Figure 1.4-3. The address type indicator is an octet,
whose format is shown in Figure 1.4-4.
Octet 1 Address type indicator
Octet 2
...
Address
Octet N
Figure 1.4-3 Format of the Calling and Called Addresses of the SCCP
8 7 6 2 1
Reserve Routing Global title
d indicator indicator SSN indicatorPoint code indicator
Figure 1.4-4 Format of the Address Indicator
Bit 1 (point code indicator): 0 --- Exclude the signaling point code; 1 --- Include the
signaling point code
Bit 2 (SSN indicator): 0 --- Exclude the subsystem; 1 --- Include the subsystem
Bits 3 through 6 (global title indicator):
0000: The address field does not include GT
0001: The GT includes the address nature indicator only
0010: The GT includes the translation type only
0011: The GT includes the translation type, numbering plan and coding scheme
21
0100: The GT includes the translation type, numbering plan, coding scheme
and address nature indicator
Others: Reserved
Bit 7 (Routing indicator): 0 --- Routing by GT; 1 --- Routing by DPC+SSN
Bit 8: Reserved for national use
Figure 1.4-5 below is an interface for us to configure GT data. From this interface, we
can see that it must be specified whether this address includes the above information
when we configure the GT data for GT addressing. This information involves whether
to include the signaling point code and the subsystem number, what mode of
addressing and what information the global title in the address information includes.
Figure 1.4-5 GT Data Configuration
& Note:
The global title indicator should be 4 if GT addressing is chosen. The global title
includes the address information code, that is, the SCCP address information includes
the translation type, numbering plan, encoding scheme and address nature indicator. If
DPC+SSN addressing is chosen, we must select 0 for the global title indicator. The
address field does not include the global title, that is, GT routing is not needed when
22
the destination signaling point is known.
Let’s take GT=0100(GT=4) for example to see what a format is taken for the calling
and called addresses of the SCCP. When the global title indicator is 0100, it means the
GT includes the translation type, numbering plan and address nature indicator. The
detailed address information is shown in Figure 1.4-6.
GT = 0100
Translation
type
Numbering plan Encoding scheme
Odd/
Odd/even Address nature indicator
Address information
Figure 1.4-6 Global Title Format (GT=4)
z Translation type (8 bits): It specifies the translation function of the global title
and translates the message address into a new combination of DPC, SSN and GT.
For the same GT number, it stands for different destination addresses due to the
different translation types.
z Numbering plan (4 bits): Used to specify which numbering plan the address
information uses. There are several numbering plans at present.
0000 Undefined
0001 ISDN/telephone numbering plan (E.164)
0010 Reserved
0011 Data numbering plan (X.121)
0100 User telegraph numbering plan (F.69)
0101 Marine mobile numbering plan (E.210)
0110 Land mobile numbering plan (E.212)
0111 ISDN/Mobile numbering plan (E.214)
23
Others: Reserved
z Address nature indicator (7 bits): Used to specify what nature the address has.
The detailed coding is as follows:
0000000 Idle
0000001 Subscriber number
0000010 Reserved for national use
0000011 National valid number
0000100 International number
Others Idle
& Note:
There are two translation types In the CDMA system: 0 used for HLR addressing and
128 for MC addressing. There are two numbering plans: ISDN/telephone numbering
plan (E.164) and land mobile numbering plan (E.212). The address nature indicator
adopts the international number.
1.4.3 Basic Functions of the SCCP
The SCCP has the following basic functions:
1. Supplementary addressing function
As is known, the MTP can only indicate 16 users at most through the SI (Service
Information) field in the message format. For the SCCP, the MTP can only
indicate the user is the SCCP user but cannot indicate which user of the SCCP.
The Subsystem Number (SSN) is used to identify more SCCP users in a
signaling point. It uses the 8-bit binary code and can define 256 different
subsystems at most.
24
Value Meaning
0 Without SSN
SCCP
1 management
2 Reserved
3 ISDN user part
4 OAMP
5 MUP
6 HLR
7 VLR
8 MSC
9 EIR
10 AUC
Reserve
11
d
12 INAP
13 - 252 Reserved
253 BSSOMAP
254 BSSAP
2. Address translation function
The SCCP performs addressing based on two types of addresses:
z DPC+SSN
z GT
The DPC is the destination signaling code used by the MTP. The SSN is the subsystem
number used to identify different SCCP users in the same node.
The major differences between MTP3 addressing and SCCP addressing are given as
follows:
Only the DPC can be used as the address message in MTP3 addressing and the SI is
25
used to identify the upper-layer users. The DPC is significant only in the defined
signaling network and is not globally significant. During DPC addressing, we must
know the DPC of the peer office so as to implement the communication. This means
that the DCP addresses of all offices that may participate in the communication with an
office must be configured for this office during data configuration if we use MTP3
addressing, but this is impracticable for the time being. The SI may be used to identify
users but it can only indicate few subscribers (16 only) since it is only 4 bits long.
In contrast, the GT or DPC+SSN can be used as the address information in SCCP

addressing and the SSN can be used to identify upper-layer users. The GT (Global Title)
can adopt different numbering plans (like telephone/ISDN numbering plan) to express
the SCCP address. Flexible routing by GT is an important feature of the SCCP and the
addressing range is far wider than that of DPC addressing. Therefore,
circuit-independent information can be transmitted directly between any two signaling
points in the global range. Generally, GT is adopted when the destination signaling
point code is unknown to the originating node. However, the SCCP must translate GT
into DPC+SSN to combine with the new GT before the message is delivered to the
MTP and sent to the destination address. In other words, SCCP addressing does not
mean that it has nothing to do with MTP3 addressing but works with MTP3 addressing
to complete the addressing function together.
1.5 Transaction Capability Application Part (TCAP)

The Transaction Capability Application Part (TCAP) belongs to the SCCP user part in
the SSN7 hierarchy. Its purpose is to provide unified support for various application
services to exchange information in the network environment and to transmit
circuit-independent information such as address translation information, subscriber
data information and billing or management information between switching nodes and
control nodes. The TCAP signaling procedures are the procedures to handle and control
operations and dialogs.
TC users are applications such as the mobile service applications including the
registration, activation and invocation of dedicated function unit supplementary
services (such as free-of-charge telephone service) and the exchange of signaling
information irrelevant to circuit control (such as closed user groups). The general goal
of TC is to provide the dialog capability of information requests and responses between
26
TC users.
The core of TC adopts the concept of remote operation. To provide the agreed support
to all the application services, TC abstracts the interaction process of the information
between different nodes as a process related to “operation”, that is, the user of the start
node invokes a remote operation and the remote node executes this operation and
returns the operation result to the start node. In order to complete a service process,
many operations are possibly involved between the peer entities of two nodes. The
combination of these operations comprises a dialog (transaction). The TC protocol is
the protocol to manage such operations and dialogs (transactions).
In the ZXC10-MSC/VLR (V3.0) system, the TCAP supports two TC users: INAP and
MAP.
1.5.1 TCAP Hierarchy
TC consists of the component sub-layer (CSL) and the transaction sub-layer (TSL), as
TC-user
TC-primitive
CSL
TR-primitive TC
TSL
N-primitive
SCCP
MTP
Figure 1.5-1 TCAP Hierarchy
27
In the figure:
CSL completes operation and management;
TSL completes dialog management;
CSL and TC-users communicate through TC-primitives;
CSL and TSL communicate through TR-primitives;
In order to control operations and dialogs, the TCAP is subdivided into the
following two types:
1.5.1.1 TCAP Transaction Sub-Layer (TCAPTSL)
The TCAPTSL serves to manage the transactions, i.e., the signaling communication
process between users of the local transaction sublayer and users of the remote
transaction sublayer. Users of the transaction sublayer are TR-users. The only TR-user
known at present is the component sublayer (CSL). The communication between peer
TCAPCSLs is performed between peer TC-users and is called a "dialog". Therefore, in
the currently defined TCAP protocol, transactions are completely equivalent to dialogs
one to one.
To complete the signaling process of one application service, two TC-users should
make a two-way exchange of a series of TCAP messages. The start, end and sequence
of message exchange as well as the message content are all controlled and interpreted
by the TC-user. The TCAPTSL manages the start, hold and termination of the dialog,
including detection and handling of abnormalities. The protocol process is applicable to
the dialogs of any application service.
1.5.1.2 TCAP Component Sub-Layer (TCAPCSL)
The major functions of the TCAPCSL include operation management, component error
detection and dialog component distribution.
Normally, the invocation request of one operation is initiated by a TC user and the
TCAPCSL establishes a status diagram for each operation so as to implement operation
management.
Component errors include protocol errors and response timeout. Protocol errors refer to
the inconsistency between the component type received by the component sublayer and
the expected input of the operation status diagram, or syntax errors or unrecognizable
component formats. Response timeout refers to the expiry of operation timers.
28
The TCAPCSL allocates dialog components through its management over dialog IDs.
Here is a simple introduction of the TCAP layer. For more information, please refer to
the related books.
1.6 Mobile Application Part (MAP)
1.6.1 Basic Functions of the MAP
The MAP is located in the seventh layer in the SS7 hierarchy. MAP signaling is
transferred between functional entities of the PLMN network and the MAP protocol
has already become the standard communication protocol between the MSC, HLR and
VLR. The MAP protocol may be used to transfer the information related to mobile call
control.
The ZXC10-MSC/VLR/SSP (V3.0) system features very powerful functions and

provides diversified service functions for subscribers so as to satisfy the service needs
of subscribers. These services are the services that can be implemented in the process
to transfer signaling between entities (such as MSC, HLR, VLR, GMSC or MC) of the
PLMN network (see Figure 1.6-1).
MSC EIR
E F
A Ai
MS BSS MSC PSTN
Di
C B
H D
Q AC HLR VLR ISDN
N G
SME SME MC MC VLR

M M M
Figure 1.6-1 Network Reference Model
The specific services can be summarized as follows:
z Basic service function
29
The basic service functions satisfy the most basic needs of subscribers. They
include the security function (system authentication, unique challenge, SSD
updating and subscriber information encryption), the basic call function
(intra-office calls, outgoing calls, incoming calls and enhanced functions) and
the mobility management function (registration/de-registration, MS deactivation
and MS handoff).
z Supplementary services
The ZXC10-MSC/VLR/SSP (V3.0) system provides more convenient and

personalized communication services such as call forwarding services and call
restriction services to subscribers.
1.6.2 Mobility Management
Due to the mobility of mobile subscribers, their locations often change. In order to
obtain easily the mobile subscribers’ location information during processing of call
services, short message services and supplementary services and to enhance the
effective utilization of radio resources, it is required that the mobile subscribers’
locations be registered in the network and the mobile subscribers’ activation status be
reported, that is, location registration is required.
The CDMA system supports the following nine registration types:
1. Switch-on registration: When an MS is switched on or switches from an analog

system to the CDMA system, it shall initiate a registration procedure.
2. Switch-off registration: If an MS has already been registered in the current

service system, it shall initiate a registration procedure when it is switched off.
3. Periodical registration: When the timer expires, the MS shall initiate a

registration procedure.
4. Distance-based registration: When the distance between the current BTS and the
BTS last time registered by an MS exceeds the threshold, the MS shall initiate a
5. Area-based registration: When an MS enters a new registration area, it shall

initiate a registration procedure.
6. Parameter change-based registration: when an MS enters a new system or when

the parameters stored in the MS change, the MS shall initiate a registration
30
procedure.
7. Commanded registration: An MS initiates a registration procedure as requested

by the BTS.
8. Implicit registration: When an MS sends an Origination message or a Page

Response message successfully, the network can determine the location of the
MS. This can be regarded as implicit registration.
9. Traffic channel registration: When the network obtains the registered

information of an MS that has been assigned a traffic channel, the network can
inform the MS that it has been registered.
1.6.2.1 Registration Notification
The typical registration procedure is shown in Figure 1.6-2.
MS MSC/VLR2 HLR MSC/VLR1
Location
Update Request a
REGNOT
b
REGCANC
c
regcanc
d
regnot
e
Location Update Accept
f
Figure 1.6-2 Registration Procedure
a When the BTS receives a registration request from an MS, it sends a Location
Update Request message to the current service system (MSC/VLR2) to start the
31
b The current service system sends a registration notification message (REGNOT)

to the HLR of the MS, so as to report the MS location (MSCID, VLRID, VLRIN)
and MS status (activated or deactivated) and get the MS approval information
(approval period) and the subscriber’s service list (Profile).
c If the MS has been previously registered elsewhere, the HLR will send a
registration cancellation message (REGCANC) to the old MSC/VLR1 so that
MSC/VLR1 will delete all the records of this MS from its database.
d MSC/VLR1 returns the registration cancellation result to the HLR.
e The HLR returns the registration notification result to MSC/VLR2.
f If the registration is successful, MSC/VLR2 will send a Location Update Accept

message to the BTS to indicate the successful registration of the MS.
Involved MAP signaling:
1. Registration notification (REGNOT)
The REGNOT message is initiated by the VLR to the HLR during the
mobile-originated location update procedure. It is used to report the new
location registered by the MS, approve the MS and obtain the profile of the MS.
1) The parameters of the REGNOT request message are explained in Table 1.6-1.
Table 1.6-1 Parameters of the REGNOT Request Message
Parameter Type Description Note

ESN M A unique 32-bit electronic serial number of the MS.
MIN M Mobile Identification Number of the MS; 10 digits long; BCD
coded.
MSCID (Serving MSC) M The identifier used to determine the specific system.
Qualification information code M Indicates the type of information needed.
System type code M Indicates the vendor of the system.
Available type O Indicates the reason why the MS cannot be called. At this time, a
the MS may be working in an inaccessible mode (such as the
sleep mode).
Extended MSCID O Indicates the identifier and system type of the specific system. b
Location area ID O The Serving MSC uses this parameter to determine the location c
of the MS. This parameter is 16 bits long and determines a
special area in a group of cells.
32

PC-SSN (Serving MSC or VLR) O Indicates the PC and SSN of the specific cellular network d
function entity and points out the type of the function entity
(MSC, HLR or VLR).
Report type O The service system uses this parameter to report the cause of e
authentication failure to the AC.
Origination indicators O Identify the node that sends the message. f, k
SMS - address O Address of the MS. g
SMS - message waiting flag O It is used to tell the MSC or HLR to send the SMS when the h
MS is available. The length of this message is zero bytes.
System access type O Access type used by the MS. i
System capabilities O Defines the capabilities of the service system, for example, the j
AC may send an SSD parameter to the VLR that has the CAVE
capability so as to reduce the load of the AC.
Terminal type O Specifies the air interface standard supported by the MS. i
Processing capabilities O Indicates whether the system supports the profile parameters. i
Note:
a. This parameter is added when the MS cannot accept a call.
b. This parameter is added when the MSC and the VLR are separated.
c. This parameter can be added in the REGNOT request message sent from the
MSC to the VLR.
d. This parameter is added to replace the lower-layer address.
e. This parameter is added if the Serving MSC requests for authentication

parameters but does not receive them from the MS.
f. This parameter is added to identify the sender of the message.
g. This parameter indicates if the Serving MSC supports the SMS.
h. If the MS was once registered in this VLR and the MSC in which the MS is
currently registered does not support the SMS, this parameter may be added to
indicate that one short message is waiting to be sent.
i. This parameter is added in this Specification and later versions.
j. This parameter is added if the MSC supports authentication.
k. This parameter must be added in China and set to the GT of the corresponding
network node.
33
2) The parameters of the REGNOT response message are explained in Table 1.6-2.
Table 1.6-2 Parameters of the REGNOT Response Message

Approval deny O Indicates that the MS is unavailable or the MS is available but a
multiple accesses occur.
Approval period O Used to confirm the approval and specify the approval period. b
Before the approval period ends, the VLR should be re-approved
by the HLR so as to provide services.
Re-approval period O The time interval to confirm the re-approval. After the approval c
period ends, the VLR should be approved by the HLR.
Number (operator) O Used to transmit different numbers. d
Number (destination) O Used to transmit different numbers. e
MSCID (HLR) O The identifier (SID and SWNO) used to determine the specific f
system.
Profile O Profile information of the subscriber. g
Origination indicators O Identify the node that sends the message. h, j
SMS - message waiting O It is used to tell the MSC or HLR to send the SMS when the MS is i
flag available. The length of this message is zero bytes.
Note:
a. There should not be any other parameter if this parameter is included in the
message.
b. This parameter is added if the request message requests for acknowledgement

information.
c. This parameter is added to indicate the time interval of approval request if the
"Approval deny” parameter is contained in the message.
d. This parameter is added if the Profile is required and the operator is selected.
e. This parameter is added if the Profile is required and call origination is limited
to the specific toll area.
f. This parameter is added in this Specification and later versions.
g. The related parameters are added.
h. This parameter is added to identify the sender of the message.
34
i. This parameter is added to indicate that a short message is waiting to be sent.
j. This parameter must be added in China and set to the GT of the corresponding
network node.
2. Registration cancellation (REGCAN)
The HLR initiates this message to the VLR in which the subscriber was
previously registered when the MS needs a location update.
3. Cancellation deny (CANDEN)
The VLR initiates this message to the HLR so as to refuse to delete this
subscriber from its database.
1) The parameters of the REGCAN request message are explained in Table 1.6-3.
Table 1.6-3 Parameters of the REGCAN Request Message

MIN M Mobile Identification Number of the MS; 10 digits long; BCD coded.
Cancellation type O This parameter describes two scenarios: 1) multiple accesses occur and the a
VLR thinks that it is the best service system; 2) The MS is in a conversation
or is performing a service operation.
Origination indicators O Identify the node that sends the message. b
Note:
a. This parameter is added when it is available.
b. This parameter is added to identify the sender of the message. This parameter
must be added in China and set to the GT of the corresponding network node.
2) The parameters of the REGCAN response message are explained in Table 1.6-4.
Table 1.6-4 Parameters of the REGCAN Response Message

Call history counter O A call history counter managed by the MS, AC or VLR. The AC or a
VLR management procedure determines when to increment the
value of this counter. This parameter may be added at the initial
registration of the MS in a new service system, at call origination or
at call termination.
35
Cancellation deny O This parameter describes two scenarios: 1) multiple accesses occur b
and the VLR thinks that it is the best service system; 2) The MS is
in a conversation or is performing a service operation.
SMS - message waiting flag O It is used to tell the MSC or HLR to send the SMS when the MS is c
available. The length of this message is zero bytes.
Note:
a. This parameter is added when SSD sharing applies.
b. This parameter is added if the registration cancellation is rejected.
c. This parameter is added to indicate that a short message is waiting to be sent.
4. MS deactivation (MSINACT): It is initiated by the VLR to the HLR, telling the

HLR that the MS is no longer active.
(1) The parameters of the MSINACT request message are explained in Table 1.6-5.
Table 1.6-5 Parameters of the MSINACT Request Message

VLR management procedure determines when to increment the value
of this counter. This parameter may be added at the initial registration
of the MS in a new service system, at call origination or at call
termination.
Registration cancellation type O This parameter is used to request for registration cancellation when b
the MS reports that itself is inactive. It is used to transmit registration
cancellation and deactivation information.
Location area ID O The Serving MSC uses this parameter to determine the location of c
the MS. This parameter is 16 bits long and determines a special area
in a group of cells.
Origination indicators O Identify the node that sends the message. d, f
SMS - message waiting flag O It is used to tell the MSC or HLR to send the SMS when the MS is e
available. The length of this message is zero bytes.
Note:
a. This parameter is added when the MS cancels the registration and SSD sharing
applies.
36
b. This parameter is added when the message is sent from the VLR to the HLR or
from the HLR to the AC.
c. This parameter is added when the message is sent from the MSC-V to the MSC.
d. This parameter is added to identify the sender of the message.
e. This parameter is added to indicate that a short message is waiting to be sent.
f. This parameter must be added in China and set to the GT of the corresponding
network node.
2) Parameters of the MSINACT response message
Null.
& Note:
Periodical location update: When an MS is powered off, the system may fail to know
this event but still regard the MS as being in the active status due to poor radio
transmission quality or some other reasons. When the MS is powered on but has
roamed beyond the service coverage, that is, the MS is in a blind spot, the system will
not be able to know its location. In both cases, the system will keep sending paging
messages if others call this subscriber. As a result, radio resources would be wasted.
To solve the above problem, forced registration applies in the system: The MS must
register itself at a certain interval. This process is called "periodical location update".
This concept is the same for the CDMA system and the GSM system. The flowchart of
periodical location update is just the same as that of generic location update.
1.6.2.2 Deregistration
The typical registration cancellation procedure is illustrated in Figure 1.6-3.
37
MSC/VLR HRL/AU
MSINACT(DEREG)
a
msinact
b
Figure 1.6-3 Deregistration Procedure
a. The Serving MSC/VLR deletes all the records of this MS and sends an
MSINACT message containing the registration cancellation type parameter to
the HLR.
b. The HLR deletes the pointer that points to the MSC/VLR from the MS data and
sends a null msinact message to the MSC/VLR.
1.6.2.3 MS Deactivation
After confirming that a registered roaming MS is inactive for a long time (for example,
the MS does not perform periodical location update within the specified time), the
MSC/VLR will initiate the MS deactivation operation to release the resources occupied
by this subscriber.
& Note:
The signaling form of registration cancellation is the same as that of MS deactivation

but the results are different in the CDMA system. In the deactivation procedure during
registration cancellation, the VLR database deletes the information of the subscriber. In
contrast, the subscriber is only marked with the inactive flag but its data are not deleted
from the database in the system-initiated MS deactivation procedure.
1.6.3 Security Management
Authentication is purposed to protect legal subscribers against the "intrusion" of fake or

illegal users. Since the CDMA technology was initially applied in the military field, it
must provide very high confidentiality and so two levels of confidentiality mechanisms
38
were applied for security management.
The authentication parameters used in the CDMA system include the A-KEY, MIN,
ESN, SSD and some authentication algorithms.
Every registered subscriber has been allocated a subscriber number (MDN), a mobile
identification number (MIN) and an authentication key (A-KEY). The MIN and
A-KEY are written by the air activation service or special equipment into the
subscriber’s MS. By means of SSD updating, a Shared Secret Data (SSD) parameter is
generated in both the AUC and the subscriber’s MS and used for future calculation of
authentication and encryption algorithms. If the VLR supports SSD sharing, this SSD
is also stored in the VLR. The 128-bit SSD is divided into two parts, one of which is
the 64-bit SSD_A used for authentication calculation and the other is the 64-bit SSD_B
for encryption calculation. The SSD generation algorithm and authentication algorithm
are illustrated in Figure 1.6-4 and Figure 1.6-5.
RANDSSD ESN A-Key

56 32 64
SSD_Generation
Procedure
SSD_A_NEW SSD_B_NEW
64 64
Figure 1.6-4 SSD Generation Algorithm
39
RAND_CALLENGE ESN AUTH_DATA SSD_AUTH

RAND ESN MIN1 SSD_A_NEW
32 32 24 64
Auth_Signature
Procedure
AUTHR
18
Figure 1.6-5 Authentication Algorithm
Generally, the system authenticates users in the following modes:
1) Authentication request (AUTHREQ)
2) Unique challenge
3) SSD update
The details are given in the sections below.
1.6.3.1 System Authentication
Let’s take registration as an example. The typical system authentication procedure is

40
MS MSC/VLR HLR/AUC
OMT(AUTH=1,RAND)
a
Location Updata Request
(RANDC,AUTHR,COUNT)
b
AUTHREQ(RAND,AUTHR,COUNT)
c
authreq
d
REGNOT
e
regnot
f
Figure 1.6-6 System Authentication During Registration
a. If the AUTH parameter in the air interface OMT message equals 1, it indicates
that authentication is necessary at system access. The RAND for authentication
is also provided by the BS. The MS uses RAND and the SSD-A and MIN/ESN
data that it has stored to execute the CAVE algorithm and obtain an
authentication result AUTHR.
b. The MS registers itself in the new Serving MSC/VLR and provides

authentication parameters such as MIN/ESN, AUTHR, RANDC and COUNT in
the Location Update Request message.
c. The MSC/VLR sends the authentication request message AUTHREQ to the

HLR/AUC. The HLR/AUC executes the CAVE algorithm using the MIN/ESN,
RAND and the currently stored SSD-A to calculate an authentication result
AUTHR, and compares the result with the AUTHR sent from the MS.
d. The HLR/AUC returns the authentication result "authreq" to the MSC/VLR.

Access denial should be possible in one of the following conditions:
1) Parameter error (ParameterError);
2) Message parameter error (UnrecognizedParameterValue);
41
3) MIN/HLR mismatch;
4) TSB51 is not supported;
5) MIN/ESN mismatch
6) The subscriber is unallocated or illegal, etc.;
7) Terminal type mismatch.
e. If the authentication is successful, the MSC/VLR will initiate the registration

procedure.
f. The HLR returns the registration result.
1.6.3.2 Unique Challenge
When an MS is idle or on a traffic channel, the AUC may initiate unique challenge. If
the SSD is shared, the unique challenge may also be initiated by the VLR. Figure 1.6-7
shows the typical procedure of unique challenge.
MS MSC/VLR HLR/AUC
AUTHDIR(RANDU,AUTHU)
a
b
Unique Challenge Response
c
ASREPORT(UCHALRPT)
d
asreport
e
Figure 1.6-7 Unique Challenge Procedure
a. The primitive is triggered by the agent and initiated by the AUC so as to

implement the following functions:
1. SSD update: Generate a new SSD so as to keep the SSD synchronization among
the AC, the VLR and the MS.
2. Unique challenge: Initiate the authentication of the MS and check if the SSD of
42
the AUD is synchronous with the SSD of the MS.
This procedure is initiated by the AUC after the unique challenge function is
completed and the subscriber should be authenticated.
b. The Serving MSC/VLR sends the random number for authentication purpose to
the MS, requesting the MS to provide the authentication result.
c. The MS sends the calculated authentication result to the MSC/VLR.
d. The MSC/VLR compares the result sent from the MS with the authentication
result sent from the AUC, so as to determine if the authentication is passed.
e. The MSC/VLR tells the comparison result of the authentication results to the
AUC. The access of the MIN should be able to be denied in one of the following
conditions:
1) Message parameter error (ParameterError);
3) The subscriber is unallocated or illegal, etc.
f. The HLR/AUC returns a response message.
1.6.3.3 SSD Update
SSD update should be performed for the MS when the SSD value in the MS does not
match the SSD value in the AUC or if such update is required in view of security.
The typical SSD update procedure is shown in Figure 1.6-8.
43
MS MSC/VLR HLR/AUC
AUTHDIR(RANDSSD,RAN
DU,AUTHU)
a
SSD Update authdir
b
Request(RANDSSD)
c
BS Challenge
(RANDBS)
d
BS Challenge
Response(AUTHBS)
e
SSD Update Response
f
Figure 1.6-8 SSD Update Procedure
a. This statement is the same as in the first step of the unique challenge procedure,
except that the cause of initiation is SSD update.
b. Upon receipt of the information, the MSC/VLR returns a response to the

HLR/AUC.
c. The MSC/VLR sends a random number RANDSSD used for SSD update to the
MS, requesting the MS to provide the result.
d. The MS calculates out an SSD based on RANDSSD, A-KEY and other

information. In order to ensure that the SSD does not appear at the air interface,
the MS sends the RANDBS generated by the BS to the network through BS
challenge.
e. The MSC/VLR calculates out the BS challenge result (AUTHBS) based on

RANDSSD, MIN and other information and sends the result to the MS.
f. The MS compares this result with the result the MS itself calculates based on the
same parameters. If the results are the same, the SSD update succeeded.
Otherwise, the SSD update failed.
1.6.3.4 Involved Signaling
1. Authentication request (AUTHREQ)
44
The VLR initiates this message to the AUC when it decides that authentication
is needed during MS access.
1) The parameters of the AUTHREQ message are explained in Table 1.6-6 below:
Table 1.6-6 Parameters of the AUTHREQ Request Message

MIN M Mobile Identification Number of the MS; 10 digits long; BCD
coded.
System access type M Access type used by the MS.
System capabilities (service M Defines the capabilities of the service system, for example, the AC
system) may send an SSD parameter to the VLR that has the CAVE
Authentication data O 24-bit authentication data used as the input of the CAVE algorithm a
during call origination. See the related air interface standard for its
detailed definition.
Authentication response O 18-bit authentication response generated when the MS accesses the b
system. It is generated when the MS executes the CAVE procedure
with SSD and RAND parameters.
Call history counter O A call history counter managed by the MS, AC or VLR. The AC or b
VLR management procedure determines when to increment the
registration of the MS in a new service system, at call origination or
at call termination.
Confidentiality mode (currently O Specifies the SME and VP states preferred by the subscriber. c
in use)
Number (dialing) O Used to transmit different numbers. d
PC_SSN O Indicates the PC and SSN of the specific cellular network function e
entity and points out the type of the function entity (MSC, HLR or
VLR).
Random number O A 32-bit parameter used as the input of the CAVE procedure for MS b
authentication, SME and VP.
Origination indicators O Identify the node that sends the message. f, h
Terminal type O Specifies the air interface standard supported by the MS. See the g
related air interface standard for its detailed definition.
Note:
a. This parameter is added if the system access type is call origination and the digit
45
type (dialing) of the air interface is not TBCD.
b. This parameter is added when the system access type is call origination, paging
response or registration and when authentication is required during the access to
the system.
c. This parameter is added when the system access type is Flash Request and the
SMEKey is provided to the Serving MSC.
d. This parameter is added when the system access type is Flash Request or
Origination.
e. This parameter is added to replace the lower-layer parameter.
f. This parameter is added to identify the sender of the message.
g. This parameter is added in this Specification and later versions.
h. This parameter must be added in China and set to the GT of the corresponding
network node.
2) The parameters of the AUTHREQ response message are explained in Table

1.6-7.
Table 1.6-7 Parameters of the AUTHREQ Response Message

Authentication algorithm O The AC can send this parameter in a message that contains the SSD a
version parameter to the VLR. If this parameter is not sent, then the default
value 199 applies.
Unique challenge response O A response to the 18-bit unique challenge command of the MS. It is b
generated when the MS executes the CAVE query with the SSD and
RANDU parameters.
Call history counter O A call history counter managed by the MS, AC or VLR. The AC or VLR c
management procedure determines when to increment the value of this
counter. This parameter may be added at the initial registration of the
MS in a new service system, at call origination or at call termination.
CDMA personal long code O A 42-bit personal long code flag. d
flag
Access deny O Indicates that the visiting MS is invalid. e
SSD random number O A 56-bit random number used as the input of the CAVE to generate a f
new SSD. This parameter is selected by the AC.
46
Unique challenge random O A 24-bit random number used as the input of the CAVE algorithm for b
number MA authentication. It is selected by the AC or VLR when the AC or
VLR executes the unique challenge procedure.
Shared secret data (SSD) O Consists of the SSD-A used for MS authentication and the SSD-B used c
for the VP and SME. The SSD is only calculated in the AC and the MS,
because the A-key only exists in the AC and the MS.
Signaling message O A 64-bit encryption key used to encrypt the data field in the signaling g
encryption key message transmitted on the speech/traffic channel. It is generated by the
CAVE procedure during the call setup process and remains unchanged
during the call proceeding.
SSD WS (without sharing) O The HLR uses this parameter to indicate that the SSD previously h
provided is invalid.
Counter update O Indicates that the call history counter update should be started. i
Note:
a. This parameter is added when the SSD parameter is included in the message.
b. This parameter is added when the MSC-V should execute the unique challenge
procedure.
c. This parameter is added if the system capabilities parameter includes the

capability to execute the CAVE procedure and the AC management process
permits SSD sharing.
d. This parameter is added when the system access type is paging response or call
origination.
e. This parameter is added when the MSC should release the resources assigned to
this call. However, this will interrupt the ongoing call.
f. This parameter is added when the VLR should execute the SSD update and the
unique challenge procedure.
g. This parameter is added when the system access type is call origination or
paging response.
h. This parameter is added when the VLR should delete the SSD.
i. This parameter is added when the MSC should execute the call history counter
update procedure.
2. Authentication directive (AUTHDIR)
The AUC may use this directive to initiate the unique challenge procedure or
47
SSD update, or the VLR may use it to initiate the unique challenge procedure.
The authentication directive message is used to modify the authentication

parameters of the MS.
1) The parameters of the AUTHDIR request message are explained in Table 1.6-8.
Table 1.6-8 Parameters of the AUTHDIR Request Message

MIN M Mobile Identification Number of the MS; 10 digits long;
BCD coded.
Authentication algorithm O The AC can send this parameter in a message that contains a
version the SSD parameter to the VLR. If this parameter is not sent,
then the default value 199 applies.
Unique challenge response O A response to the 18-bit unique challenge command of the b
MS. It is generated when the MS executes the CAVE query
with the SSD and RANDU parameters.
Call history counter O A call history counter managed by the MS, AC or VLR. The c
AC or VLR management procedure determines when to
increment the value of this counter. This parameter may be
added at the initial registration of the MS in a new service
system, at call origination or at call termination.
Access deny O Indicates that the visiting MS is invalid. d
Location area ID O The Serving MSC uses this parameter to determine the e
location of the MS. This parameter is 16 bits long and
determines a special area in a group of cells.
SSD random number O A 56-bit random number used as the input of the CAVE to f
generate a new SSD. This parameter is selected by the AC.
Unique challenge random O A 24-bit random number used as the input of the CAVE b
number algorithm for MA authentication. It is selected by the AC or
VLR when the AC or VLR executes the unique challenge
procedure.
Origination indicators O Identify the node that sends the message. g, j
Shared secret data (SSD) O Consists of the SSD-A used for MS authentication and the c
SSD-B used for the VP and SME. The SSD is only calculated
in the AC and the MS, because the A-key only exists in the
AC and the MS.
SSD WS (without sharing) O The HLR uses this parameter to indicate that the SSD h
previously provided is invalid.
48

Counter update O Indicates that the call history counter update should be i
started.
Note:
a. This parameter may be added when the SSD is included in the message.
b. This parameter is added when the MSC should execute the unique challenge
procedure.

d. This parameter is added when the MSC should release the system resources
related to this access. However, this will interrupt the ongoing call.
e. This parameter may be added when the VLR sends the message to the MSC-V.
f. This parameter is added when the MSC should update the SSD.
g. This parameter is added to identify the sender of the message.
h. This parameter is added when the SSD in the VLR should be deleted.
i. This parameter is added when the MSC should update the COUNT.
j. This parameter must be added in China and set to the GT of the corresponding
network node.
2) The parameters of the AUTHDIR response message are explained in Table

1.6-9.
Table 1.6-9 Parameters of the AUTHDIR Response Message

Call history counter O A call history counter managed by the MS, AC or VLR. a
The AC or VLR management procedure determines when
to increment the value of this counter. This parameter may
be added at the initial registration of the MS in a new
service system, at call origination or at call termination.
Note:
a. This parameter is added when it exists in the VLR.
49
3. BS challenge (BSCHALL)
The MS initiates this message to the MSC after the network sends an SSD update
command to the MS.
1) The parameters of the BSCHALL request message are explained in Table

1.6-11.
Table 1.6-11 Parameters of the BSCHALL Request Message

BCD coded.
BS random number M A 32-bit random number used as the input of the CAVE
procedure for BS authentication. This parameter is
selected by the MS.
Origination indicators O Identify the node that sends the message. a, b
Note:
a. This parameter is added to identify the sender of the message.
b. This parameter must be added in China and set to the GT of the corresponding
network node.
2) The parameters of the BSCHALL response message are explained in Table

1.6-12.
Table 1.6-12 Parameters of the BSCHALL Response Message

BS authentication response M A response to the 18-bit BS challenge command. It is
generated when the MS executes the CAVE procedure
with the SSD and RAND parameters.
4. Authentication status report (ASSREPORT)
This directive is initiated when the AC fails to initiate the unique challenge
procedure. It is used to report the result of an authentication operation.
1) The parameters of the ASSREPORT request message are explained in Table

1.6-13.
50
Table 1.6-13 Parameters of the ASSREPORT Request Message

System capabilities (service M Defines the capabilities of the service system, for example, the AC may
system) send an SSD parameter to the VLR that has the CAVE capability so as
to reduce the load of the AC.
Counter update report O Indicates the result of the call history counter update initiated by the AC a
or VLR.
Origination indicators O Identify the node that sends the message. b, e
SSD update report O Indicates the result of the AC-initiated SSD update. c
Unique challenge report O Indicates the result of the AC-initiated or VLR-initiated unique d
challenge.
Note:
a. This parameter is added when the report involves counter update.
b. This parameter is used to identify the sender of the message.
c. This parameter is added when the report involves SSD update.
d. This parameter is added when the report involves unique challenge.
e. This parameter must be added in China and set to the GT of the corresponding
network node.
2) The parameters of the ASSREPORT response message are explained in Table

1.6-14.
Table 1.6-14 Parameters of the ASSREPORT Response Message

Authentication algorithm version O The AC can send this parameter in a message that contains the a
SSD parameter to the VLR. If this parameter is not sent, then the
default value 199 applies.
Unique challenge response O A response to the 18-bit unique challenge command of the MS. It b
is generated when the MS executes the CAVE query with the SSD
and RANDU parameters.
51
Call history counter O A call history counter managed by the MS, AC or VLR. The AC c
or VLR management procedure determines when to increment the
registration of the MS in a new service system, at call origination
or at call termination.
SSD random number O A 56-bit random number used as the input of the CAVE to e
Unique challenge random number O A 24-bit random number used as the input of the CAVE algorithm b
for MA authentication. It is selected by the AC or VLR when the
AC or VLR executes the unique challenge procedure.
Shared secret data (SSD) O Consists of the SSD-A used for MS authentication and the SSD-B c
used for the VP and SME. The SSD is only calculated in the AC
and the MS, because the A-key only exists in the AC and the MS.
SSD WS (without sharing) O The HLR uses this parameter to indicate that the SSD previously f
provided is invalid.
Counter update O Indicates that the call history counter update should be started. g
Note:
a. This parameter may be added when the SSD parameter is included in the
message.
procedure.

d. This parameter is added when the MSC should release the resources assigned to
this access. However, this will interrupt the ongoing call.
e. This parameter is added when the MSC should execute the SSD update
procedure.
f. This parameter is added when the MSC should delete the SSD.
g. This parameter is added when the MSC should execute the call history counter
update procedure.
5. Authentication failure report (AFREPORT)
This directive is initiated when SSD sharing applies and the VLR fails to initiate
52
the unique challenge procedure. It is used to report the failure of MS

authentication.
1) The parameters of the AFREPORT request message are explained in Table

1.6-15.
Table 1.6-15 Parameters of the AFREPORT Request Message

Report type M The service system uses this parameter to report the cause of
authentication failure to the AC.
System access type M Access type used by the MS.
System capabilities (service M Defines the capabilities of the service system, for example, the AC
system) may send an SSD parameter to the VLR that has the CAVE
VLR management procedure determines when to increment the value
of this counter. This parameter may be added at the initial registration
of the MS in a new service system, at call origination or at call
termination.
Expected call history O The call history counter value expected to be received from the MS. a
counter In fact, the value received from the MS is included in the call history
counter parameter.
MSCID O The identifier used to determine the specific system. b
Origination indicators O Identify the node that sends the message. c, d
Note:
a. This parameter is added when the report type parameter is set to counter
mismatch.
b. This parameter is added in this Specification and later versions.
c. This parameter is added to identify the sender of the message.
d. This parameter must be added in China and set to the GT of the corresponding
network node.
2) The parameters of the AFREPORT response message are explained in Table

1.6-16.
53
Table 1.6-16 Parameters of the AFREPORT Response Message

Authentication algorithm version O The AC can send this parameter in a message that contains the a
SSD parameter to the VLR. If this parameter is not sent, then
the default value 199 applies.
Unique challenge response O A response to the 18-bit unique challenge command of the MS. b
It is generated when the MS executes the CAVE query with the
SSD and RANDU parameters.
Call history counter O A call history counter managed by the MS, AC or VLR. The c
AC or VLR management procedure determines when to
increment the value of this counter. This parameter may be
added at the initial registration of the MS in a new service
system, at call origination or at call termination.
SSD random number O A 56-bit random number used as the input of the CAVE to e
Unique challenge random number O A 24-bit random number used as the input of the CAVE b
algorithm for MA authentication. It is selected by the AC or
VLR when the AC or VLR executes the unique challenge
procedure.
Shared secret data (SSD) O Consists of the SSD-A used for MS authentication and the c
SSD-B used for the VP and SME. The SSD is only calculated
in the AC and the MS, because the A-key only exists in the AC
and the MS.
SSD WS (without sharing) O The HLR uses this parameter to indicate that the SSD f
previously provided is invalid.
Terminal type O Specifies the air interface standard supported by the MS. g
Counter update O Indicates that the call history counter update should be started. h
Note:
a. This parameter may be added when the SSD parameter is included in the
message.
procedure.

d. This parameter is added when the MSC should release the system resources
54
assigned to this access. However, this will interrupt the ongoing call.
e. This parameter is added when the MSC should start the SSD update procedure.
f. This parameter is added when the VLR should delete the SSD.
g. This parameter is added in this Specification and later versions.
h. This parameter is added when the MSC should start the call history counter
update procedure.
1.6.4 Basic Call Services
1.6.4.1 Concepts
The basic call service functions include local calls, outgoing calls, incoming calls and
transit calls. The latter three are supported by inter-office signaling, which can be
divided by different working modes into Channel Associated Signaling (CAS) and
Common Channel Signaling (CCS). CCS is applicable to signaling transfer between
SPC switch offices while CAS is applicable to communications between trunks (such
as DT, ABT and SFT) and other offices.
1.6.4.2 Mobile-Originated Call (MOC)
Figure 1.6-9 illustrates the procedure of an MS-originated call.
55
BS MSC/A VLR MSC/CC

CR (CompleteLayer3Info:
CM_Service_Request)
a
Acess_Req
b
Auth_Req
c
CC
(AuthenticationRequest)
d
AuthenticationResponse e
Auth_Rsp
f
Acess_Rsp
g
Setup
h
Assign_Req
i
AssignmentRequest
CC j
(AssignmentRequest)
AssignmentComplete
k
Assign_Cmpl
l
Figure 1.6-9 Mobile-Originated Call Procedure
a. The BS constructs a CM_Service_Request message and places it in the

Complete Layer3 Info message after receiving the access probe from an MS. It
sends the Complete Layer3 Info message as the subscriber data of the SCCR
Connection Request (CR) to the MSC.
b. Upon receipt of the CM_Service_Request message, the MSC/A interface

module constructs an Access_Req message and sends it to the VLR, so as to
check if the MS is allowed to access the system.
c-f: After receiving the Access_Req message, the VLR may start the unique
challenge procedure. If the SCCP connection is not yet established when the
MSC sends the Authentication Request message to the BS, the Authentication
Request message may be sent as the subscriber data of the SCCP Connection
Confirmation (CC).
g. The VLR returns an Access_Rsp message to the A interface module, indicating

that the access succeeded.
h. If the access succeeded, the A interface module sends a Setup message to the CC
56
module, instructing the CC to establish the call. In the Setup message, the
parameters such as the called number are carried.
i. The CC module sends an Assign_Request message to the A interface module.

This message carries terrestrial circuit information and air chaIf the SCCP
connection is not yet established (without the authentication procedure), the
Assignment Request message may be sent as the subscriber data of the SCCP
Connection Confirmation (CC). nnel information.
j. The A interface module sends an Assignment Request message to the BS.
k. After completing the assignment, the BS sends an Assignment Complete

message to the MSC.
l. The A interface module receives the Assignment Complete message from the BS
and then sends an Assign_Cmpl message to the CC module. Till now, the call
establishment procedure ends for the A interface module.
1.6.4.3 Mobile-Terminated Call (MTC)
Figure 1.6-10 illustrates the procedure of an MS-terminated call.
BS MSC/A CC VLR
Page_R eq
a
P a g in g R e q u e s t
b
C R ( C o m p le te L a y e r3 In fo
P a g in g R e s p o n s e )
c
A c c e s s _ R e q (P a g e _ R s p )
d
A u th _ R e q
CC
(A u th e n tic a tio n R e q u e s t)
A u th e n tic a tio n R e s p o n s e e
A u th _ R s p
A ccess_ R sp
f
A s s ig n _ R e q
g
C C (A s s ig n m e n tR e q u e s t)
h
A s s ig n m e n tC o m p le te
i
A s s ig n _ C m p l
j
C onn ect
k
Connect
l
Figure 1.6-10 Mobile-Terminated Call Procedure

57
a. The VLR finds an incoming call request in its service area, so it sends a
Page_Req message to the corresponding A interface module.
b. The A interface module sends a connectionless PagingRequest message to the

BS.
c. The BS sends a PagingResponse message to the MSC. This message is included

in the CompleteLayer3Info of the BSMAP message and the
CompleteLayer3Info message is sent as the data item of the SCCP Connection
Request (CR).
d. Upon receipt of the Page Response message from the BS, the A interface module
sends an Access_Req to the VLR, so as to determine if the subscriber is allowed
to access the system.
e. The VLR may selectively initiate the unique challenge operation as necessary.
f. The VLR returns the access result (Access_Rsp) to the A interface module.
g. The VLR then starts the MSC/CC module with TpBegin. Upon receipt of the
Setup message from the calling side, the CC module sends an Assign_Req
message to the A interface module.
h. The A interface module sends an AssignmentRequest message to the BS.
i. After completing the assignment of circuits and radio resources, the BS sends an
AssignmentComplete message to the MSC.
j. The A interface module notifies the CC module with the Assign_Cmpl message
that the assignment is complete.
k. The BS sends a Connect message to the MSC if the called party hooks off.
l. The A interface module notifies the CC module with the Connect Message that
the called subscriber has hooked off. At this time, the subscribers enter the
conversation status.
1.6.4.4 Obtaining the Routing information
When a mobile subscriber is called, the system needs to determine the location
information of the called subscriber. In this process, the transfer of MAP signaling
58
among the MSC, the VLR and the HLR is involved. The involved signaling messages
are listed as follows:
1. Location request (LOCREQ): It is initiated by the MSC to the HLR of the called
MS when the MSC finds that the caller dials a mobile subscriber number.
2. Route request (ROUTREQ): It is initiated to request for a TLDN when the caller
and the called are not in the same MSC.
Figure 1.6-11 shows the procedure to obtain the routing information.
MSC HLR VLR
L O C R E Q [B IL L ID , O rig ID ,
D G T S D IA L , T R A N S C A P , T A T ]
a
R O U T R E Q [R o u tR e q ID , T E R M T R M T ,
T E R M T R IG , A L R T C O D E , L E G IN F O ,
O T F I, C N Iin fo A S C II, D M H D a ta ,
V M S P IN , V M B O X ]
b
RR
LR ro u tre q [M S C ID , B IL L ID ,
T
T
PC _SSN , TLD N ]
c
lo c req [M IN , E S N , M S C ID , P C _ S S N ,
A N N L IS T ,In te rsy ste m R o u tin g In fo ,

D M H D a ta] d
Figure 1.6-11 Location Request Procedure
a. The originating MSC sends a location request message (LOCREQ) to the HLR
related to the MS. The related HLR is determined by the MDN of the MS. The
location request message is used to locate the HLR of the called subscriber. The
HLR will return the processing information of this call after analyzing this
message.
b. If the MDN is assigned to a legal subscriber, the HLR sends a route request
message (ROUTREQ) to the VLR in which the MS has been registered, so as to
request for a roaming number (TLDN) from the serving VLR of the called
subscriber. The HLR returns the TLDN in the locreq message to the originating
MSC to set up the call.
c. The serving VLR allocates a Temporary Local Directory Number (TLDN) and
places it in the routreq message (return result of the route request message) to
send to the HLR.
59
d. Upon receipt of the routreq message, the HLR returns a location request
message (locreq) to the originating MSC. The routing information is carried in
the terminal list parameter.
When receiving a location request message (LOCREQ) from the MSC, the HLR may
take one of the following actions as needed:
1) Directly return the call connection information if the caller and the called are in
the same MSC.
2) Initiate a ROUTREQ message to the called VLR so as to obtain the TLDN and
return it to the CC if the called is located in an MSC different from the MSC
where the caller is located.
3) Perform the supplementary service operation if a supplementary service is

activated. For example, the HLR should get the forwarded-to number if the CFU
service is activated and should deny the access if the DND is activated.
4) Deny the access if the called subscriber is roaming (outside the HLR) and does
not have the roaming right.
Parameter description:
1) Parameters of the LOCREQ request
Table 1.6-17 Parameters of the LOCREQ Request Message

Billing ID (originating M This parameter is initially assigned by the controlling MSC for a
system) mobile-originated or mobile-terminated call. When necessary, it may be
sent to every system related to this call. It is used for the billing record
but may also be used for other purposes (e.g. to identify the controlling
MSC).
The originating MSC may also assign the billing ID for an incoming
call.
MSCID (originating M The identifier used to determine the specific system. It consists of the
system) SID and the SwitchNo..
Calling number 1 O Transmits the calling number information provided by the network in the a
BCD format.
Calling number 2 O Transmits the calling number information provided by the subscriber in a
the BCD format.
60

Calling sub-address O Specifies the sub-address of the caller. a
MSC ID O Identifies the MSC that sends the message. b, e
PC-SSN (originating) O Indicates the PC and SSN of the specific cellular network function entity c
and points out the type of the function entity (MSC, HLR or VLR).
Redirection number O Identifies the redirection address. a
Redirection O Identifies the redirection sub-address. a
sub-address
Terminal access type O Specifies the access state. d
Processing capabilities O Specifies the processing capabilities of the current system.
Note:
a. This parameter is added if available.
b. This parameter is added to identify the MSC that sends the message.
c. This parameter is added.
d. This parameter is added if the call involves a special access type.
e. This parameter must be added in China and set to the corresponding MSC ID.
2) Parameters of the LOCREQ response message
Table 1.6-18 Parameters of the LOCREQ Response Message

ESN M A unique 32-bit electronic serial number of the MS. a
MIN M Mobile Identification Number of the MS; 10 digits long; BCD a
coded.
MSCID (Serving MSC) M The identifier used to determine the specific system. b
Access deny reason O Specifies the reason why the MS cannot access the system. c
Announcement list O Specifies the announcements to be provided to the subscriber. d
Calling number 1 O Transmits the calling number information provided by the e
network in the BCD format.
Calling number 2 O Transmits the calling number information provided by the e
subscriber in the BCD format.
Number (operator) O f
Number (destination) O g, h
DMH – Account ID O Account provided by the subscriber. i
DMH – Prepared Billing ID O Provides the accounts of such cards as the credit card. i
61

DMH – Billing ID O Related to billing and used to provide such information as third i
party payment.
DMH – Redirection ID O Provides the reason of redirection; used for billing. j
Group information O Transfers the information related to the pilot number in the FA k
(Flexible Alerting) service.
MDN O Mobile directory number of the MS. i, p
No reply time O Ringing time before no-reply processing in the unit of seconds. l
Single-service identifier O Modifies the normal service procedure of this call. m
PC-SSN (Serving MSC or O Indicates the PC and SSN of the specific cellular network function n
VLR) entity and points out the type of the function entity (MSC, HLR or
VLR).
Redirection number O Identifies the redirection address. j
Redirection number string O f
Redirection sub-address O Identifies the redirection sub-address. e, j
Route number O Identifies the routing information of the MS. f
Terminal list O Provides the routing information of one or more terminals to the o
MSC.
Terminal trigger O Defines the method to process the ongoing incoming call. f
Note:
a. Just set it to zero if it is unknown.
b. If the access is denied or a route to the MDN is provided, the value of this
parameter should be the originating MSC ID.
c. This parameter is added when the access is denied.
d. This parameter is added when announcements should be provided to the MS.
e. This parameter is added if some functions are activated and the terminal list
contains the local terminal.
f. These parameters are added if available.
g. This parameter is added if the call can be connected.
h. This parameter is used only when the system is unable to receive the terminal
list parameter.
i. If available, this parameter is added for billing purpose.
j. This parameter is added if it is available and redirection is required.
62
k. This parameter is added for multi-leg calls.
l. This parameter is added to replace the default setting of the originating MSC.
m. This parameter is added if a call requires the modification of the normal service
processing.
n. The purpose of this parameter is yet to be determined.
o. This parameter is added if call routing is required.
p. This parameter must be added in China.
3) Parameters of the ROUTREQ request message
Table 1.6-19 Parameters of the ROUTREQ Request Message

Billing ID (originating) M This parameter is initially assigned by the controlling a
MSC for a mobile-originated or mobile-terminated call.
When necessary, it may be sent to every system related to
this call. It is used for the billing record but may also be
used for other purposes (e.g. to identify the controlling
MSC).
The originating MSC may also assign the Billing ID for
an incoming call.
BCD coded.
MSCID (originating MSC) M The identifier used to determine the specific system.
System type code (originating M Indicates the vendor of the system.
MSC)
Alert code O Specifies the volume and rhythm of the ringing tone b
provided to the MS.
Calling number string 1 O Transmits the calling number information provided by the c
network in the IA5 format.
Calling number string 2 O Transmits the calling number information provided by the c
subscriber in the BCD format.
Calling sub-address O Specifies the sub-address of the caller. c
Destination number O Specifies the called address. d, e
DMH – Account ID O Account provided by the subscriber. f
DMH – Prepared Billing ID O Provides the accounts of such cards as the credit card. f
63

DMH – Billing ID O Related to billing and used to provide such information as f
third party payment.
Leg message O Specifies a leg related to a multi-terminal call (e.g. FA) g
Location area ID O The Serving MSC uses this parameter to determine the f, h
location of the MS. This parameter is 16 bits long and
determines a special area in a group of cells.
MDN O Mobile directory number of the MS. f, p
MSC ID O Identifies the MSC that sends the message. i, q
Single-service identifier O Modifies the normal service procedure of this call. j
No reply time O Ringing time before no-reply processing in the unit of k
seconds.
PC-SSN O Indicates the PC and SSN of the specific cellular network l
function entity and points out the type of the function
entity (MSC, HLR or VLR).
Pilot billing ID O This parameter is allocated by the first originating MSC. It m
may be transmitted to every system as necessary in a
multi-subscriber call. It is used to collect billing
information and may also be used to identify a
mobile-originated call.
Pilot number O Pilot number of the multi-subscriber call. m
Redirection number string O c
Redirection sub-address O Identifies the redirection sub-address. c
Origination indicators O Identify the node that sends the message. n, r
Terminal processing O Specifies the nature of termination processing. o
Terminal trigger O Defines the method to process the ongoing incoming call. f
Note:
a. It is used to identify a mobile-originated call.
b. This parameter is added to specify a special ringing tone.
c. This parameter is added if the related function is activated.
d. This parameter may be added when the "Terminal processing" parameter is set
to "Dialog".
e. This parameter may be added when the "Terminal processing" parameter is set
to "Store speech information" or "Extract speech information".
f. This parameter is added when the "Terminal processing" parameter is set to

"MS-terminated".
64
g. This parameter is added when the "Terminal processing" parameter is set to

"MS-terminated" and the call has multiple legs.
h. This parameter is added when the VLR sends the message to the MSC-V.
i. This parameter is added to identify the originating MSC.
j. This parameter is added if an in-service call requires the modification of the

normal service processing.
k. This parameter is added to replace the default no-reply time of the service
system.
l. This parameter is added for later call forwarding.
m. This parameter is added if the call has multiple legs.
n. This parameter is added to identify the sender of the message.
o. This parameter is added to indicate the specific termination type. By default, the
value is "MS-terminated".
p. This parameter must be added in China.
q. This parameter must be added in China and set to the corresponding MSC ID.
r. This parameter must be added in China and set to the GT of the corresponding
network node.
2) Parameters of the ROUTREQ response message
Table 1.6-20 Parameters of the ROUTREQ Response Message

Access deny reason O Specifies the reason why the MS cannot access the system. a
Billing ID (controlling) O This parameter is initially assigned by the controlling MSC b
for a mobile-originated or mobile-terminated call. When
necessary, it may be sent to every system related to this
call. It is used for the billing record but may also be used
for other purposes (e.g. to identify the controlling MSC).
The originating MSC may also assign the billing ID for an
incoming call.
Cause of conditional denial O Specifies the reason why the called MS cannot access the c
system.
65
Number (destination) O Destination address of the network (e.g. TLDN) d

MSC ID O Identifies the MSC that sends the message. e, g
PC-SSN (Serving MSC) O Indicates the PC and SSN of the specific cellular network f
function entity and points out the type of the function entity
(MSC, HLR or VLR).
Note:
a. This parameter is added when the access is denied.
b. It is used for billing purpose.
c. This parameter is added for call waiting.
d. This parameter is added to transfer the TLDN.
e. This parameter is added to identify the serving MSC.
f. The purpose of this parameter is for further study.
g. This parameter must be added in China and set to the corresponding MSC ID.
1.6.5 Handoff Function
A handoff will take place during a call if the MS needs to change its traffic channel for
a certain reason. Handoff falls into soft handoff and hard handoff in the CDMA system.
It is required for soft handoff that the channel frequency and Selection Distribution
Unit (SDU) not be changed during the handoff, lest the call be interrupted during the
handoff. By the entities involved, handoff can be divided into intra-BS handoff,
inter-BS handoff and inter-MSC handoff. The following sections introduce some
typical handoff procedures.
1.6.5.1 Soft Handoff
A soft handoff is usually implemented within the BS and it will be notified to the MSC
in a Handoff Performed message, as shown in Figure 1.6-12.
BS MSC/VLR
Handoff Performed
Figure 1.6-12 Soft Handoff
66
1.6.5.2 Hard Handoff
Let’s take an inter-MSC forward handoff as an example. The typical hard handoff
procedure is shown in Figure 1.6-13.
Source BS Serving MSC Target MSC Target BS
Handoff Required
a
FACDIR2
b
Handoff Request
c
Handoff Request Ack
d
facdir2
e
Handoff Command
f
Handoff Commenced
g
Handoff Completed
h
MSONCH
i
Figure 1.6-13 Hard Handoff
a. The source BS sends a Handoff Required message to the serving MSC to initiate
a handoff procedure.
b. The serving MSC sends an FACDIR2 message to the target MSC, instructing the
target MSC to start the forward handoff procedure.
c. The target MSC sends a Handoff Request message to the target BS, requesting
the target BS to assign the corresponding resources to the MS.
d. The target BS acknowledges the handoff request with a Handoff Request Ack
message.
e. The target MSC acknowledges the forward handoff command with a facdir2
message.
f. The serving MSC sends a Handoff Command message to the source BS,
instructing the MS to start the handoff.
g. The MS starts the handoff.
67
h. The MS reports handoff completion to the target MSC.
i. The target BSC notifies the old serving MSC of the handoff completion with an
MSONCH message.
1.7 Supplementary Services
1.7.1 Overview
1.7.1.1 Types of Supplementary Services
The CDMA IS41-3 defines altogether 22 kinds of supplementary services. The CDMA
CC can support the service procedures of these supplementary services.
• Call Forwarding Busy (CFB)
• Call Forwarding Default (CFD)
• Call Forwarding No Answer (CFNA)
• Call Forwarding Unconditional (CFU)
• Call Transfer (CT)
• Call Waiting (CW)
• Calling Number Identification Presentation (CNIP)
• Calling Number Identification Restriction (CNIR)
• Conference Call (CC)
• Do Not Disturb (DND)
• Flexible Alerting (FA)
• Message Waiting Notification (MWN)
• Mobile Access Hunting (MAH)
• Password Call Acceptance (PCA)
• Preferred Language (PL)
• Remote Feature Control (RFC)
• Selective Call Acceptance (SCA)
• Subscriber PIN Access (SPINA)

68
• Subscriber PIN Intercept (SPINI)
• Three-Way Calling (TWC)
• Voice Message Retrieval (VMR)
• Voice Encryption (VP)
1.7.1.2 Supplementary Service Operations
Supplementary service processing falls into two types of operations: Registration,

activation, deregistration and deactivation of supplementary services, which are
completed in the service request (FEATREQ); processing of supplementary services in
the call procedure.
For the supplementary services, seven operations are defined in the CDMA system:
1) Provisioning: An operation implemented by the service provider to make the

service available to the subscriber.
2) Withdrawal: An operation implemented by the service provider to make the

service unavailable to the subscriber.
3) Registration: An operation implemented by the service provider or subscriber to

make the service executable. It includes inputting necessary information.
4) Erasure: An operation implemented by the service provider or subscriber to

delete the information inputted at the time of registration.
5) Activation: It is used to make the service enter the "Ready" status.
6) Deactivation: Reverse operation of activation.
1.7.2 Supplementary Service Request Procedure
Figure 1.7-1 shows the specific supplementary service request procedure.
The system needs to process the service request twice when a subscriber initiates a
supplementary service request: The MSC-initiated request procedure is shown in Steps
a - d in the following figure. After the request succeeded, the HLR initiates a
qualification directive shown in Steps e - f in the following figure to the VLR so as to
synchronize the database information.
69
MS MSC VLR HLR
Service code string

a
FEATREQ
b
featreq
c
Service operation Ack
d
QUALDIR
e
qualdir
f
Figure 1.7-1 Signaling Procedure of a Supplementary Service Request
a. The serving MSC receives the dialed digits. During dialed digit analysis, the
serving MSC finds the service code string.
b. The serving MSC sends a service request message (FEATREQ) including the
dialed digits to the MS-related HLR.
c. The HLR returns a service request response message (featreq), including the
service request acknowledgement indication or the parameters regarding the
measures to be taken by the MSC, to the serving MSC. If the call route is
provided after service operation acknowledgment, routing information must be
provided in the terminal list parameter.
d. Upon receipt of the featreq message from the HLR, the serving MSC processes
the served MS according to the information in the featreq message. In this case,
the service acknowledgement information shall be provided.
e. If the service request leads to the change of MS’s profile, the HLR should report
this change to the VLR in the qualification directive message (QUALDIR) so
that the VLR can modify the related supplementary service information in its
database.
f. The VLR sends a qualdir message (return result of the qualification directive
message) to the HLR.
70
Summary:
In this chapter, we have learned the service functions that the CDMA system can
provide, including the basic service functions (e.g. mobility management, security
management and call services) and supplementary services. We have discussed in
detail all the MAP signaling procedures and service procedures that may be involved
among the MSC, the VLR and the HLR so as to complete these functions. Because
signaling procedure analysis is needed to locate the specific cause of a fault in most
cases during maintenance, the MAP signaling analysis process presented in this chapter
is of great significance.
1.8 Telephone User Part (TUP)
1.8.1 Basic Functions of the TUP
The TUP belongs to the application layer of the SS7 and defines inter-office signaling
required for call connection. For the TUP, the message signal unit transmits telephone
signal messages.
1.8.2 TUP Message Format
As mentioned in the above description of SCCP messages, an SCCP message is

encapsulated in the MSU for transmission. TUP messages are transmitted in the same
way as SCCP messages but the message structure differs, as shown in Figure 1.8-1.
F CK SIF SIO LI FIB FSN BIB BSN F
Heading code
Signaling
information H 1 H0 Label
Figure 1.8-1 Format of the Telephone Message Signaling Unit
The content of the TUP message is transmitted in the Signaling Information Field (SIF)
of the Message Signal Unit (MSU). The SIF consists of three parts: Routing label,
heading code and signaling information.
1. Routing label
71
The routing label is similar to that in the SCCP message, as shown in Figure
1.8-2.
The first transmitted

CIC OPC DPC bit
4 12 24 24
Figure 1.8-2 Routing Label of the TUP
The difference between TUP messages and SCCP messages lies in the CIC. The
CIC is a 4-bit signaling link selection code in SCCP messages. What is the CIC
in TUP messages?
The CIC (Circuit Identification Code) is allocated to a specific telephone speech

channel to specify the circuit occupied by the two parties in conversation. It is a
12-bit code. For the digital channel at 2048 kbit/s, the five least significant bits
of the CIC are the speech channel timeslot code and the seven most significant
bits indicate the PCM system code between the originating signaling point and
the destination signaling point. For the digital channel at 8448 kbit/s, the seven
least significant bits are the speech channel timeslot code and the five most
significant bits indicate the PCM system code between the originating signaling
point and the destination signaling point. Therefore, theoretically a signaling
link can indicate 4096 speech channels.
O Note:
When configuring the trunk circuit to an adjacent office, please make sure that the CIC
is consistent with the CIC of the adjacent office, lest that the speech channel
connection fail.
2. Heading code
All the telephone signaling messages have a heading code to specify the
message type. As shown in the above figure, the heading code consists of two
parts: H0 indicates the message group code and H1 indicates the specific message
code. Please refer to the related manuals of the SS7 for the specific message
groups and messages.
72
1.8.3 TUP Messages
In the No.7 telephone network, all telephone connection and control signals are
transmitted in telephone message signal units in the signal network. For the TUP, the
telephone message signal unit is called the "TUP message signal unit" or "MSU-TUP",
which is a message packet form specially defined for telephone signal transmission. Its
basic format meets the Message Signal Unit (MSU) format transmitted by the SS7
MTP.
The SIF of the TUP MSU consists of the routing label, the heading code and one or
more signals or indicators. Telephone signal messages may fall into these types:
Forward/backward messages used for call setup, messages used for call supervision,
messages used for circuit supervision and circuit group supervision, and dedicated
signal messages used for the national network. Table 1.8-1 lists various TUP signaling
messages.
Table 1.8-1 List of TUP Signaling Messages
Abbre
Message Type Message Name Function
viation
Transmits the information needed for call
Initial address message IAM
setup and routing
Initial address message with Extended address message with routing and
IAI
Forward Address Message additional information billing information added
(FAM) Transmits the remaining subsequent
Subsequent address message SAM
addresses after the IAM/IAI
Subsequent address message Transmits an address signal after the above
SAO
with one signal address information
General forward setup Transmits some information related to the
GSM
information message calling subscriber during call setup
Forward Setup Message Indicates that the speech channel passes the
Continuity signal COT
(FSM) continuity check
Indicates that the speech channel fails the
Continuity failure signal CCF
continuity check
Backward Setup Message
General request message GRQ The message needed for call setup request
(BSM)
Successful Backward Setup Indicates that the call has been set up
Address complete message ACM
Message (SBM) successfully
73
Abbre
viation
Indicates that the switching equipment is
Switching equipment
SEC congested or faulty and cannot implement
congestion signal
calls
Circuit group congestion Indicates that the outgoing circuit group of
CGC
signal the switching office is congested
Indicates that the received address signal is
Address incomplete signal ADI
incomplete to set up a call
Indicates the call failure that cannot be
Call failure signal CFL
represented by the other backward signals
Unsuccessful Backward Setup
Indicates that the called number is
Message (UBM) Unallocated number signal UUN
unallocated
Indicates that the called subscriber line is
Line out-of-service signal LOS
broken or out-of-service
Send special information Indicates that a special information tone
SST
tone signal should be sent back to the calling subscriber
Indicates that the compatibility check fails
Access barred signal ACB
and the call is barred
Digital path not provided Indicates that there is no route with complete
DPN
signal digital channels
Clear forward signal CLF Indicates call end or call abort
Clear back signal CBK Indicates that the called should hook on
Indicate that the called should hook off and
Answer signal, charge ANC
answer (charge)
Call Supervision Message Indicates that the called should hook off and
Answer signal, no charge ANN
(CSM) answer (no charge)
Reanswer Signal RAN Indicates that the called should answer again
Used for the operator function in the
Forward transfer signal FOT
international semi-auto case
Calling party clear signal CCL Indicates that the calling party has hooked on
Circuit Supervision Message Release guard signal RLG Response signal of the CLF signal
(CCM) The signal that causes the peer not to receive
Blocking signal BLO
services
Blocking acknowledgement The signal used by the peer to acknowledge
BLA
signal that it will not receive services
The signal that enables the unblocked circuit
Unblocking signal UBL
to restore its services
Unblocking The signal used to acknowledge that the
UBA
acknowledgment signal circuit has restored its services
74
Abbre
viation
The signal that enables the failed circuit to
Reset circuit signal RSC
restore its original status
Continuity check request The signal used to check the conversation
CCR
signal quality of a circuit
Maintenance-oriented group Maintenance oriented group blocking
MGB
blocking message message
Hardware-failure-oriented Hardware failure oriented group blocking
HGB
group blocking message message
Maintenance-oriented group Maintenance oriented group unblocking
MGU
unblocking message message
Hardware-failure-oriented Hardware failure oriented group unblocking
HGU
group unblocking message message
Maintenance-oriented group
Maintenance oriented group blocking
blocking acknowledgment MBA
acknowledgement message
message
Circuit Group Supervision Hardware-failure-oriented
Hardware failure oriented group blocking
Message (GRM) group blocking HBA
acknowledgment message
Maintenance-oriented group
Maintenance oriented group unblocking
unblocking acknowledgment MUA
message
Hardware-failure-oriented
Hardware failure oriented group unblocking
group unblocking HUA
acknowledgment message
The signal that enables the circuit group to
Circuit group reset message GRS
restore its original status
Circuit group reset The signal used to acknowledge that the
GRA
acknowledgment message circuit group has restored its original status
National Successful
Time metering pulse message after the called
Backward Setup Message Metering pulse message MPM
subscriber answers
(NSB)
National Call Supervision
Operator message OPR The message for the operator’s use
Message (NCB)
Indicates that the dialed local subscriber is
National Unsuccessful Subscriber local busy signal SLB
busy
Backward Setup Message
Indicates that the dialed non-local subscriber
(NUB) Subscriber toll busy signal STB
is busy
Let’s take the call from a mobile subscriber to a fixed subscriber where the MSC is
75
located as an example to describe the TUP telephone call signaling procedures so as to

list the messages involved in the call procedure. Such signaling procedures are
applicable to the scenario where a mobile subscriber calls a local fixed subscriber or a
roaming mobile subscriber calls a fixed subscriber in the visited place.
1. When the called subscriber is idle
Figure 1.8-3 shows the call connection procedure when the called subscriber is
idle.
Gatewa TM/LS
MSC
y
IAI
IAI
ACM
ACM
Ringback
tone
ANC
ANC
Conversation
CBK The called

CBK hooks on
first
CLF
CLF
RLG
RLG
The caller
hooks on CLF
first CLF
RLG
RLG
Figure 1.8-3 Call Connection Procedure when the Called Is Idle
76
2. When the called subscriber is busy
busy or when the line is out of service.
MSC Gateway TM/LS
IAI
IAI
SLB STB LOS SST

SLB STB LOS SST
CLF
CLF
RLG
RLG
Figure 1.8-4 Call Connection Procedure when the Called Is Busy
The MSC receives a signal such as SLB or STB that indicates the call cannot be
connected, so it sends the CLF and delivers a command via the air interface to request
the Mobile Station (MS) to generate the busy tone. After receiving the LOS and SST,
the MSC sends the CLF and sets up a radio speech channel on which to send the
specific announcement to the MS.
1.9 ISDN User Part (ISUP)
1.9.1 Basic Functions of the ISUP
In the early times the TUP was used for inter-office No.7 signaling of the telephone
networks in China. However, the TUP is oriented to telephone services. In order to
satisfy the ever-increasing service requirements of the ISDN, the ISDN User Part
(ISUP) is introduced. As one of the parallel user parts in the SS7 system, the ISUP adds
the control protocols of non-voice bearer services and the other protocols (for call
modification, communication suspension/resumption, etc.) that the telephone network
77
does not have based on the TUP. It provides the signal functions needed for the
provisioning of voice-oriented and non-voice-oriented basic bearer services and
supplementary services in the ISDN.
The ISUP is applicable to hybrid digital/analog networks, telephone networks and

circuit-switched data networks.
It supports the following types of services:
1. Bearer services
Unrestricted 64 kbps circuit switched service
Voice services
3.1 kHz audio service
Unrestricted 64 kbps voice alternate service
Unrestricted 2 × 64 kbps service
2. User terminal services
Telephone service
Intelligent user telegram
G2/G3 facsimile
G4 facsimile
Hybrid mode
Videotext
Videophone, etc.
3. Supplementary services
Calling Line Identification Presentation (CLIP)/Calling Line Identification

Restriction (CLIR)
Connected Line Identification Presentation (COIP)/Connected Line

Identification Restriction (COIR)
Direct Dialing In (DDI)
CUG (Closed User Group)
78
User-User Signaling (UUS)
Call Forwarding (CF)
Multiple Subscriber Number (MSN), etc.
1.9.2 ISUP Message Format
ISUP messages are transmitted in signal units on signaling links. Just like TUP
messages, ISUP messages are also transmitted in the SIF. Figure 1.9-1 shows the
format of an ISUP message.
Figure 1.9-1 Format of the ISUP Message Transmitted in the SIF
The SIF of every MSU consists of an integer multiple of octets and includes the
following parts (see Table 1.9-1):
1. Routing label
2. Circuit Identification Code (CIC)
3. Message type code
4. Mandatory fixed part
5. Mandatory variable part
6. Optional part, which may include the fixed length parameter field and the
variable length parameter field.
Table 1.9-1 ISUP Message
Routing label
CIC
Message type code
Mandatory fixed part
Mandatory variable part
Optional part
79
1.9.2.1 Routing Label
The routing label in an ISUP message in China takes the format shown in Figure 1.9-2:
Figure 1.9-2 Format of the Routing Label in the ISUP Message
the message, and the SLS (Signaling Link Selection) is the code to select the signaling
link in the load sharing mode and only occupies the four least significant bits for the
time being.
1.9.2.2 CIC
The CIC in an ISUP message in China takes the format shown in Figure 1.9-3:
Figure 1.9-3 Format of the CIC in the ISUP Message
the message, and the CIC (Circuit Identification Code) is the code of the speech
channel between the OPC and the DPC and only occupies the twelve least significant
bits for the time being (five bits are used as the timeslot number assigned to the
communication channel and seven bits indicate the number of the PCM system
between the source and the destination).
1.9.2.3 Message Type Code
The message type code is composed of an octet and is mandatory for all messages. It
uniformly defines the functions and format of every type of ISUP message (see Table
1.9-2).
80
Table 1.9-2 Message Type Code
Message Type Code

Address complete 0000 0110
Answer 0000 1001
Blocking 0001 0011
Blocking acknowledgement 0001 0101
Call progress 0010 1100
Circuit group blocking 0001 1000
Circuit group blocking 0001 1010
acknowledgement
Circuit group query 0010 1010
Circuit group query response 0010 1011
Circuit group reset 0001 0111
Circuit group reset 0010 1001
acknowledgement
Circuit group unblocking 0010 1001
Circuit group unblocking 0001 1011
acknowledgement
Confusion 0010 1111
Connect 0000 0111
Continuity 0000 0101
Continuity check request 0001 0001
Facility rejected 0010 0001
Facility request 0001 1111
Information 0000 0100
Information request 0000 0011
Initial address 0000 0001
Network resource 0011 0010
management
Release 0000 1100
Release complete 0001 0000
Reset circuit 0001 0010
Resume 0000 1110
Subsequent address 0000 0010
Suspend 0000 1101
Unblocking 0001 0100
Unblocking 0001 0110

acknowledgement
User part available 0011 0101
User part test 0011 0100
81
Message Type Code

Metering pulse message 1111 1101
1.9.2.4 Mandatory Fixed Part
For a specific message type, the parameters that are mandatory and have a fixed length
are included in the mandatory fixed part. The location, length and sequence of these
parameters are uniformly determined by the message type; therefore, the message does
not include the name and length indicator of these parameters.
1.9.2.5 Mandatory Variable Part
The mandatory parameters with a variable length are included in the mandatory
variable part. A pointer is used for every parameter to indicate the start of this
parameter and every pointer is represented by an octet. The name of every parameter
and the sending sequence of the pointers are contained in the message type, whereas
the number of parameters and the number of pointers are determined by the message
type.
A pointer is also used to indicate the start of the optional part. If the message type
indicates that the optional part should not exist, then this pointer will not exist. If the
message type indicates that there may be an optional part but this specific message
does not include any optional part, then the pointer field will assume the value of 0.
All pointers are continuously sent at the beginning of the mandatory parameters with a
variable length. Every parameter includes a parameter length indicator and the
parameter content.
1.9.2.6 Optional Part
The optional part is also composed of several parameters, each of which may have a
fixed length or a variable length. Every optional parameter should contain the
parameter name (an octet), the length indicator (an octet) and the parameter content.
The "end of optional parameters" octet (all-0s) will be sent after all the optional
parameters, if any, are sent.
1.9.3 ISUP Messages
According to the functions of the ISUP, some messages related to non-voice services
and supplementary services are added as the signaling messages of the ISUP, in
addition to the TUP messages in the SS7. ISUP messages are transmitted on signaling
82
links in the form of MSUs, in which the Signaling Information Field (SIF) has a
structure similar to that in an SCCP message. There are seven types of ISUP messages
as listed in Table 1.9-3.
Table 1.9-3 ISUP Messages
Message Type Message Name Abbreviation Function

Address complete message ACM A message sent in the backward direction to
indicate that all the required address signals
have been received.
Charging message CRG A message used to transfer charging
parameters
Backward call setup Call progress message CPG A message sent in the backward direction to
message indicate that an event has occurred during the
call setup
Connect message CON A message sent in the backward direction to
indicate that the required address signals
have been received and the call has been
answered.
Answer message ANM A message sent to indicate that the call has
been answered
Call supervision Release message REL A message sent to indicate that the speech
message channel is being released
Forward transfer message FOT A message sent to implement the operator
function
Circuit supervision Release complete message RLC Indicates that the speech channel has been
message released
Delayed release message DRS Indicates either the calling or called party has
been disconnected while the network keeps
the connection
Suspend message SUS Indicates either the calling or called party has
been disconnected temporarily
Resume message RES Indicates either the calling or called party,
having been suspended, is reconnected
(Protocol) Confusion CFN Indicates there is an unidentifiable part in the
message received signaling
Continuity check request CCR A message used to request for connecting the
message continuity check equipment
83

Loopback acknowledgement LPA A message used to respond to the continuity
message check request, indicating a loop has been
connected
(Circuit) Blocking message BLO A message used to tell the backward office
that the circuit is seized
Blocking acknowledgment BLA A message used by the backward office to
message indicate that the circuit has been blocked
Unblocking message UBL Indicates that the circuit unblocking status is
to be released and recovered to the initial
status
Unblocking acknowledgment UBA A message used to acknowledge that the
message circuit has been unblocked
Reset circuit message RSC A message used to reset the circuit status due
to a certain reason
Unequipped CIC message UCIC A message sent when an unequipped circuit
identification code is received
Overload message OLM An overload control message used in load
control
Circuit group blocking CGB A signaling message used to block multiple
message circuits
Circuit group blocking CGBA A message used to acknowledge that the
acknowledgement message multiple circuits have been blocked
Circuit group unlocking CGU A message used to unblock multiple circuits
message
Circuit group unblocking CGUA A message used to acknowledge that the
acknowledgement message multiple blocked circuits have been
Circuit group
unblocked
supervision message
Circuit group reset message GRS A message sent to reset multiple circuits
identified
Circuit group reset GRA Indicates the requested circuit group has been
acknowledgement message reset or in maintenance-oriented blocking
status
Circuit group query message CQM A message sent to query multiple specified
circuits
Circuit group query response CQR A message to return the states of all the
message circuits in the specified range
Information request message INR A message used to request the peer to
Information query provide the call-related information
message Information message INF A message sent to convey the information in
association with the call
84

Call modification request CMR Indicates that either the calling or called
message party requests for call parameter
modification
Call modification CMC A message used to confirm that the call
confirmation message feature has been modified
Call modification Call modification reject CMRJ Indicates that the call modification request is
message message rejected
Facility request message FAR A message sent to request activation of a
facility
Facility accepted message FAA Indicates that the request to activate a facility
is accepted
Facility rejected message FRJ Indicates that the request to activate a facility
has been rejected
Pass along message PAM Indicates that any party may set up the
channel so that the same physical channel
may be used between signaling points to
End-to-end message
transfer information
User-to-user information USR A message used to transfer user-to-user
signaling unrelated to call control
located as an example to describe the ISUP telephone call signaling procedures such
signaling procedures are applicable to the scenario where a mobile subscriber calls a
local fixed subscriber or a roaming mobile subscriber calls a fixed subscriber in the
visited place.
The called subscriber number in the IAI is PQR (S) ABCD and the calling subscriber
number is a national valid number 133H0H1H2H3ABCD.
1. When the called subscriber is idle
idle.
85
MSC Gateway TM/LS
IAM
IAM
ACM
ACM
Ringback
tone
ANM
ANM
Conversation
The called
RE hooks on first
RE L
L
RLC
RLC
The caller RE
hooks on first L
RE
L
RLC
RLC
2. When the local call fails
unallocated or busy or when the line is out of service.
MSC Gateway TM/LS
IAM
IAM
REL
REL
RLC
RLC
Figure 1.9-5 Call Connection Procedure when the Call Fails

86
When the MSC receives the REL signal indicating that the call cannot be
connected (this can be determined by analyzing the error code carried in the
REL), it sets up a radio speech channel to send the specific announcement to
the MS.
3. When the call is destined to a local special service console
Figure 1.9-6 shows the call connection procedure when the call is destined to a
special service console.
MSC Gateway TM/LS
IAM
IAM
ACM
ACM
Ringback tone
ANM
ANM
Conversation
RE
L
RE
L
RLC
RLC
Figure 1.9-6 Connection Procedure of the Call Destined to a Special Service Console
4. Announcement sending
Figure 1.9-7 shows the call connection procedure during the sending of an
announcement.
87
MSC Gateway TM/LS
IAM
IAM
ACM
ACM
Announcement
RE
L
RE
L
RLC
RLC
Figure 1.9-7 Call Connection Procedure During Announcement Sending (from the Terminating
Office)
1.10 BSSAP
1.10.1 Basic Functions of the BSSAP
The Base Station Subsystem Application Part (BSSAP) belongs to the application layer
and is independent of lower-layer transmission in terms of the protocol stack.
Lower-layer transmission is solved by equipment manufacturers and operators. The
BSSAP is used to transmit Layer 3 signaling messages between the MSC (call control
and mobility management) and the BS (BSC call control). In the CDMA network
architecture, the BSSAP is also known as the "A interface".
Figure 1.10-1 shows the position of the BSSAP in the protocol stack.
88
BS MSC
BSSAP BSSAP
DTAP BSMAP DTAP BSMAP
Transport layer protocols Transport layer protocols
SCCP SCCP
MTP3 MTP3
MTP2 MTP2
MTP1 MTP1
Physical layer
Figure 1.10-1 Position of the BSSAP in the Protocol Stack
As shown in the above figure, BSSAP signaling messages between the MSC and the
BS are supported by the MTP and the SCCP. Every active MS has one or more
activation processing. The BSSAP uses signaling connections to transmit Layer 3
messages related to these processing and is subdivided into two parts:
z DTAP (Direct Transfer Application Part): Transports call control and mobility
management messages coming from or sent to the MS. Different from the
GSM system, Layer 3 information of these messages is translated by the BS into
the format compliant with the A interface specifications.
z BSMAP (Base Station Mobile Application Part): Supports other procedures

(such as resource management and handoff control) related to the MS between
the MSC and the BS (probably one cell of the BS or the entire BS). The BSMAP
uses connectionless and connection-oriented procedures.
It provides the following service functions:
z Call handling and supplementary services
Including call control, speech call establishment and clearance, supplementary

services, SMS, Over The Air Service Provisioning (OTASP), PACA service,
89
location service, circuit-switched data service calls, packet-switched data service

calls and concurrent service support.
z Radio resources management
Including radio channel management and MSC handoff.
z Mobility management, authentication and encryption
Including registration and deregistration, SSD update, terminal authentication,

parameter update and voice encryption.
z Terrestrial circuit management
Including terrestrial circuit assignment, blocking/unblocking, circuit reset,

global reset, and Tandem Free Operation (TFO).
1.10.1.1 BSSAP Signaling Messages
Layer 3 DTAP and BSSMAP messages between the MSC and the BS are included in
the subscriber data field of the SCCP frames that are exchanged. Table 1.10-1
summarizes the application of the subscriber data field in the SCCP frame.
Table 1.10-1 Application of the Subscriber Data Field in the SCCP Frame
SCCP Message Name Function

Connection-Oriented (CO) Protocol Class 2
SCCP Connection Request (CR) Used to request for setting up an SCCP connection between
the MSC and the BSC
SCCP Connection Confirm (CC) Used to confirm that an SCCP connection has been
established between the MSC and the BSC
SCCP Connection Refused (CREF) Used to refuse to establish an SCCP connection between
the MSC and the BSC
SCCP Released (RLSD) Used to release the SCCP connection between the MSC and
the BSC
SCCP Release Complete (RLC) Used to ensure that the SCCP connection between the MSC
and the BS is released successfully
SCCP data form 1 (DT1) Once the signaling connection between the MSC and the
BS is confirmed, all the A1 interface messages will be
transmitted through DT1 till the connection is disconnected
Connectionless (CL) Protocol Class 0
SCCP Unit Data (UDT) When there does not exist any SCCP connection, the A1
interface message is transmitted in the UDT message
90
Table 1.10-2 lists the correspondence between SCCP message and BSSAP message.
Table 1.10-2 List of BSSAP Messages
Application Message SCCP

Description
Message Type Message
Call handling messages
This message contains the CM Service Request,
Complete L3 Info BSMAP CRa Page Response or Location Updating Request
message
After the initial access probe of the MS is
CM Service
DTAP CRa,g received by the BS, the BS constructs this
Request
message
The MSC sends this message to the BS to
Paging Request BSMAP UDTa
initialize the MS-terminated call setup procedure
The Page Response and follow-up MSC
Page Response DTAP CRa,g
response are used to set up a connection
This message is used to tell the MSC that the
Connect DTAP DT1
called MS has answered the call (hooked off)
The MSC sends this message in any call control
Progress DTAP DT1 process to generate/remove the specified local
tone
The BS sends this message to the MS to release
Service Release DTAP DT1
one of the multiple service connections
Service Release The MSC sends this message to the BS as a
DTAP DT1
Complete response to the Service Release message
Assignment The MSC sends this message to the BS to
BSMAP CCb, DT1
Request request for radio resource assignment
Assignment This message indicates the requested assignment
BSMAP DT1
Complete has been completed correctly
Assignment This message indicates the requested assignment
BSMAP DT1
Failure cannot be completed correctly
The BS sends this message when the radio
channel fails or the MS has sent a release signal
Clear Request BSMAP DT1
to the BS
The MSC sends this message to the BS to

Clear Command BSMAP DT1
release relevant specialized resources
The BS sends this message to the MSC to
Clear Complete BSMAP DT1 indicate that the clearance operation is
completed
91

Description
This message is sent to the BS so as to send an
Alert with Info DTAP DT1 alert message with information via the air
interface
BS Service The BS sends this message to the MSC so as to
BSMAP UDT
Request start the BS-initiated call setup procedure
BS Service The MSC sends this message to the BS so as to
BSMAP UDT
Response respond to the BS Service Request message
If the MS has activated a service, the BS sends
Additional
DTAP DT1 this message to request for setting up a
Service Request
connection for an additional service
Additional If the MS has activated a service, the MSC sends
Service BSMAP DT1 this message to initiate an additional service
Notification connection
Supplementary service messages
This message is used to transmit supplementary
Message with
DTAP DT1 service information between the MS and the
Info Prompt
MSC
Message with This message is used to confirm that a message
DTAP DT1
Info Prompt Ack with information prompt has been received
The MSC sends this message to the BS, so as to
Service
BSMAP UDTa transmit service notification information
Notification
destined to the MS
The BS sends this message to the MSC, so as to
Service
BSMAP UDTa confirm that a service notification message has
Notification Ack
been received
The MSC sends this message to the BS so as to
PACA Command BSMAP CCb, DT1 tell the BS that the PACA service will be used
for the current call
The BS sends this message to the MSC so as to
PACA Command
BSMAP DT1 tell the MSC that the PACA request has been
Ack
queued successfully
The BS sends this message to the MSC so as to
PACA Update BSMAP UDT tell the MSC that the BSC or MSC should adjust
the queued call
This message is used to confirm that the
PACA Update BS/MSC has executed the corresponding
BSMAP UDT
Ack operation and the PACA information has been
updated
Location Radio BSMAP DT1 This message is sent to the BS to request for the
92

Description
Parameter radio measurement value, so as to calculate the
Request location of the MS
Location Radio This message includes the radio interface
Parameter BSMAP DT1 measurement value or geographical location of
Response the MS
Mobility management messages
Authentication The MSC sends this message to the BS, so as to
BOTH DT1/UDTc
Request initiate authentication of the specific MS
Authentication The BS sends this message to the MSC to
BOTH DT1/UDTc
Response respond to the authentication request
SSD Update This message is sent to the BS to instruct the MS
BOTH DT1/UDTh
Request to update the SSD
Base Station This message is sent to the MSC to confirm the
BOTH DT1/UDTh
Challenge new SSD calculated by the MS
Base Station
This message is sent to the BS/MS to respond to
Challenge BOTH DT1/UDTh
the Base Station Challenge message
Response
SSD Update This message is sent to the MSC to indicate
BOTH DT1/UDTh
Response whether the SSD update succeeds
Location The BS constructs this message and sends it to
DTAP CRa,g
Updating Request the MSC after receiving the registration message
This message is sent to the BS to indicate that
Location
DTAP CREF the Location Updating Request message has
Updating Accept
been processed successfully
This message is sent to the BS to indicate the
Location
DTAP CREF Location Updating Request message cannot be
Updating Reject
processed successfully
This message is sent by the MSC to the BS to
Parameter Update
DTAP DT1 increment the value of the call history counter in
Request
the MS
Parameter Update This message is sent by the BS to the MSC to
DTAP DT1
Ack respond to the parameter update request
This message designates the signaling
Encryption Mode
BSMAP DT1 encryption/voice encryption parameters used for
Command
the call
The BS actively sends this message to the MSC
Encryption Mode
BSMAP DT1 or it serves as a response to the Encryption
Complete
Mode Command
Handoff messages
93

Description
This message provides the MSC with the
candidate target cell list or the available
Handoff Required BSMAP DT1
measurement information, so as to determine the
target cell with the available radio channel
The MSC uses this message to make a specific
request for a candidate to provide radio
Handoff Request BSMAP CRd
resources for handoff of the current mobile
connection
Handoff Request The target BS uses this message to respond to
BSMAP CCd
Ack the Handoff Request message sent by the MSC
Indicates that resource allocation failed or the
DT1f,
Handoff Failure BSMAP execution of the handoff between BSs failed and
CREFe
the handoff has been terminated
The MSC uses this message to tell the source BS
Handoff
BSMAP DT1 that a target channel has been allocated to the
Command
handoff
This message is sent by the MSC to the source
Handoff Request
BSMAP DT1 BS, so as to reject the request in the Handoff
Reject
Required message
This message is sent by the source BS to the
Handoff
BSMAP DT1 MSC, so as to indicate the handoff command has
Commenced
been sent to the MS
The target BS uses this message to tell the MSC
Handoff
BSMAP DT1 that the MS has successfully accessed the target
Complete
cell
After a handoff is over, the BS will notify the
Handoff
BSMAP DT1 MSC of the completion by using this Handoff
Performed
Performed message
Equipment management messages
This message indicates one or more terrestrial
Block BSMAP UDT
circuits must be blocked at the MSC
Block
BSMAP UDT blocking message has been received and the
Acknowledge
corresponding action has been taken
This message is used to tell the MSC that one
Unblock BSMAP UDT
blocked circuit is unblocked
The MSC marks this circuit as available before
Unblock
BSMAP UDT sending the unblocking acknowledgement
Acknowledge
message to the BS
94

Description
When one end has a fault or loses processing
Reset BSMAP UDT reference information due to initialization, it will
send a Reset message to the peer end
Reset This message is used to respond to the Reset
BSMAP UDT
Acknowledge message
When one end detects the circuit is set to the idle
state due to abnormal release of the SCCP
connection or OAM&P intervention, it will send
Reset Circuit BSMAP UDT
this message to tell the peer to set the circuit to
the idle state and notifies the peer of the circuit
reset reason
Reset Circuit
BSMAP UDT Sent to respond to the Reset Circuit message
Acknowledge
This message is sent to the BS, so as to request
Transcoder
BSMAP DT1 for changing the state of the current in-band
Control Request
signaling mechanism
Transcoder Transcoder Control Request has been received
BSMAP DT1
Control Ack and to indicate the success or failure of the MSC
request
Application Data Delivery Service (ADDS) messages
This message is sent by the MSC to the BS to
ADDS Paging BSMAP UDT
transmit an SM
The BS sends this message via the control

ADDS Transfer BSMAP UDT channel to the MSC so as to transmit the SMS
origination message
The BS sends this message via the traffic

ADDS Delivery DTAP DT1 channel to the MSC so as to transmit the SMS
origination message
ADDS Paging This message is used to acknowledge the

BSMAP UDT
Ack ADDS Paging message
ADDS Delivery This message is used to acknowledge the

DTAP DT1
Ack ADDS Delivery message
ADDS Transfer This message is used to acknowledge the

BSMAP UDT
Ack ADDS Transfer message
95

Description
Error handling message
This message is used to tell the MSC that the
Reject BOTH DT1/UDTc MS has indicated the refusal of a
command/message
Note:
a. It is the first message for the BS to request for an SCCP connection.
b. It is used to respond to the CM Service Request message or Paging Request

message.
c. It is used only when the processing is made on the paging channel.
d. It is required only in hard handoff.
e. For the SCCP connection request/handoff request, the response message can be the
SCCP CREF.
f. It can be used after the SCCP connection is set up.
g. It is transmitted in the Complete L3 Info message.
h. It is used when the SSD update is executed on the control channel.
1.10.1.2 BSSAP Signaling Procedures
1. Call setup
1) MS-originated call setup
Figure 1.10-2 illustrates the setup procedure of an MS-originated call.
96
MS BS MSC
Origination
a
Base Station Ack Order Complete L3 Info:
b
CM Service Request
c
Assignment Request
Channel Assignment Message
d
e
Tch Preamble
f
BS Ack Order
g
MS Ack Order
h
Service Connect Message CM Service Request i
Continuation
j
Assignment Complete
k
Ringback Tone
l
Figure 1.10-2 MS-Originated Call Setup Procedure
a. The MS sends an Origination message with an L2 Ack request to the BS via the
access channel of the air interface, so as to request for services.
b. The BS sends the Base Station Ack Order to the MS after receiving the
Origination message.
c. The BS constructs the CM Service Request message to send to the MSC.
d. The MSC sends an Assignment Request message to the BS, requesting the BS to
assign radio resources.
e. The BS sends the Channel Assignment Message via the paging channel of the
air interface to start the setup of a radio traffic channel.
f. The MS sends the Tch Preamble via the assigned reverse traffic channel.
g. After getting the reverse traffic channel, the BS sends the BS Ack Order to the
MS via the forward traffic channel.
h. After getting the BS Ack Order, the MS sends an MS Ack Order to the BS.
i. The BS sends the Service Connect Message/service selection response message

to the MS to specify the service configuration for the call. The MS begins to
process services according to specified service configuration.
j. After receiving the Service Connect Message, the MS sends a Service Connect
97
Completion message.
k. After the radio traffic channel and terrestrial circuit are established and fully
interconnected, the BS sends an Assignment Complete message to the MSC.
The call is regarded as entering the conversation status.
l. The Ringback Tone is sent to the MS in the speech circuit.
2) MS-terminated call setup
Figure 1.10-3 illustrates the setup procedure of an MS-terminated call.
MS BS MSC
Paging Request
Page Message a
b
Page Response Message Complete L3 Info: c
Paging Response
d
Base Station Ack Order
Assignment Request e
Channel Assignment Message f
g
Tch Preamble
h
BS Ack Order
i
MS Ack Order j
Service Connect Message
k
Service Connect Completion
Assignment Complete l
Alert with Info m
n
MS Ack Order
o
Connect Order
p
BS Ack Order
q
Connect
r
Figure 1.10-3 MS-Terminated Call Setup Procedure
a. The MSC sends a Paging Request message to the BS to start the MS-terminated
call setup procedure.
b. The BS sends the Page Message via the paging channel.
c. The MS returns a Page Response Message.
d. The BS uses the information received from the MS to construct a Page Response
message and places it in the Complete L3 Info to send to the MSC.
98
e. After receiving the Page Response Message sent by the MS, the BS sends the
Base Station Ack Order via the air interface.
f. The MSC sends an Assignment Request message to the BS to request for radio
resource assignment.
g. The BS sends the Channel Assignment Message to start the setup of a radio
traffic channel.
h. The MS starts to send the Tch Preamble via the reverse traffic channel.
i. The BS sends the BS Ack Order via the forward traffic channel.
j. The MS sends an MS Ack Order to respond to the BS Ack Order.
k. The BS sends the Service Connect Message/service selection response message

to the MS to specify the service configuration for the call.
j. After receiving the Service Connect Message, the MS sends the Service
Connect Completion message.
m. After the radio traffic channel and terrestrial circuit have been established, the
BS sends an Assignment Complete message to the MSC.
n. The BS sends an Alert with Info message to alert the MS.
o. After receiving the Alert with Info message, the MS sends an MS Ack Order to
the BS.
p. When answering this call (hooking off), the MS sends the Connect Order to the
BS.
q. After receiving the Connect Order, the BS sends the BS Ack Order to the MS
via the forward traffic channel.
r. The BS sends the Connect message to the MSC, telling the MSC that the MS
has answered this call. At this time, this call is regarded as having entered the
2. Call clearance
Figure 1.10-4 illustrates the call clearance procedure.
99
MS BS MSC
Release Order
a
Clear Request
b
Clear Command
c
Release Order
d
Clear Complete
e
Figure 1.10-4 MS-Initiated Call Clearance
a. The MS sends the Release Order via the reverse traffic channel to initiate call
clearance.
b. The BS sends the Clear Request message to the MSC to start timer T300.
c. The MSC starts timer T315 and sends the Clear Command message to instruct
the BS to release the relevant specialized resources (such as the terrestrial
circuit). The BS stops timer T300.
d. After receiving the Clear Command message, the BS sends the Clear Complete
message and releases the assigned terrestrial circuit. The BS sends the Release
Order to the MS and then the assigned radio resources are released.
e. The BS sends the Clear Complete message to the MSC. The MSC stops timer
T315 and releases the lower-layer transmission connection (SCCP connection).
3. Authentication
1) Basic authentication procedure
Figure 1.10-5 illustrates the basic authentication procedure.
MS BS MSC
Authentication Request
a
Authentication Challenge
b
Authentication Challenge Response
Authentication Response c
d
Figure 1.10-5 Authentication Procedure
a. The MSC sends an Authentication Request message to the BS.
100
b. The BS forwards the RANDU to the MS via the Authentication Challenge

message.
c. The MS calculates the AUTHU according to the designated RANDU and SSD
and sends the AUTHU to the BS via the Authentication Challenge Response
message.
d. The BS sends an Authentication Response message to the MSC to transmit the

AUTHU.
2) SSD update
Figure 1.10-6 illustrates the SSD update procedure.
MS BS MSC
SSD Update Request

SSD Update Message a
b
Base Station Challenge Order c
Base Station Challenge
d
Base Station Challenge Response
e
f
SSD Update Confirmation Order g
SSD Update Response
h
a. The MSC sends the SSD Update Request message to the BS, indicating it is
necessary to update the SSD in the MS.
b. Based on the SSD Update Request message sent from the MSC, the BS sends an
SSD Update Message to the MS.
c. After receiving the SSD Update Message, the MS uses the RANDSSD as the
input parameter to calculate the new SSD according to a specific algorithm.
Then the MS selects the 32-bit random number (RANDBS) and sends it to the
BS via the Base Station Challenge Order.
d. The BS sends the Base Station Challenge message to the MSC to confirm
whether the SSD update value calculated by the MS is the same as that stored in
the network.
e. After receiving the Base Station Challenge message, the MSC uses the new SSD
101
update value to calculate the authentication response parameter and sends the
AUTHBS to the BS via the Base Station Challenge Response message.
f. After receiving the Base Station Challenge Response message, the BS sends the
Base Station Challenge Ack message that carries the authentication response
value to the MS.
g. If the AUTHBS from the MSC is legal, the MS sends an SSD Update
Confirmation Order to the BS. If the AUTHBS is illegal, the BS returns an
SSD Update Refuse Order.
h. The BS sends an SSD Update Response message to the MSC.
4. Registration
Figure 1.10-7 illustrates the successful MS-initiated location registration

procedure.
MS BS MSC
Registration Message
a
Location Updating Request
b
Location Updating Accept
c
Registration Accepted Order
d
Figure 1.10-7 MS-Initiated Location Registration Procedure
a. The MS sends the Registration Message to the BS to initiate the registration

operation.
b. After receiving the Registration Message, the BS constructs the Location

Updating Request message and sends it to the MSC.
c. The MSC sends the Location Updating Accept message to the BS, indicating the
Location Updating Request message has been processed.
d. The BS may transmit the Registration Accepted Order to the MS, indicating the
location registration succeeds.
5. Hard handoff
Figure 1.10-8 illustrates the successful hard handoff between BSs. Suppose this
102
call is not in soft handoff status prior to the hard handoff. Therefore, there is no
A3 connection to be removed.
MS Source BS MSC Target BS
Handoff Required
a
Handoff Request
Null forward traffic channel frames b
c
Handoff Request Ack
d
Handoff Command
e
Handoff Direction Message
f
MS Ack Order g
Handoff Commenced
h
Reverse Traffic Channel Frames or Traffic Channel Preamble
i
Handoff Completion Message
j
BS Ack Order
k
Handoff Complete
l
Clear Command
m
Clear Complete n
Figure 1.10-8 Inter-BS Hard Handoff
a. Based on the report from the MS that the signal strength has already exceeded
the threshold designated by the network or due to other reasons, the source BS
suggests hard handoff between TIA/EIA-95 and the target cell. The source BS
sends the Handoff required message that carries the cell list to the MSC.
b. Because the Handoff required message has indicated the handoff is a hard
handoff, the MSC sends the Handoff Request message with the TIA/EIA-95
channel identification unit to the target BS. In the case of hard handoff with
asynchronous data or fax, the CIC extension unit in the Handoff Request
message indicates the CIC of the circuit connecting the SDU of the BS so as to
support A5 connection to the IWF.
c. After receiving the Handoff Request message of the MSC, the target BS assigns
the corresponding radio resources and connects the call according to the
directive in the message. The target BS sends the Null forward traffic channel
frames to the MS.
103
103
d. The target BS sends the Handoff Request Ack message to the MSC.
e. The MSC prepares for the handoff from the source BS to the target BS, and
sends the Handoff Command to the source BS.
f. The source BS sends the Handoff Direction Message to the MS via the air
interface.
g. The MS sends an MS Ack Order to the source BS as the response to the Handoff
Direction Message.
h. The source BS sends the Handoff Commenced message to the MSC, notifying
the MSC that the MS has been handed off to the target BS channel.
i. The MS sends the Reverse Traffic Channel Frames or Traffic Channel Preamble
to the target BS.
j. The MS sends the Handoff Completion Message to the target BS.
k. The target BS sends the BS Ack Order.
l. The target BS sends the Handoff Completion Message to notify the MSC that
the MS has successfully completed the hard handoff.
m. The MSC sends the Clear Command message to the source BS.
n. The source BS sends the Clear Complete message to the MSC.
6. Terrestrial circuit management
1) Blocking
The Block message is sent by the BS to the MSC to indicate that one or more
terrestrial circuits must be blocked at the MSC.
Figure 1.10-9 illustrates the blocking procedure.
BS MSC
Block
a
Block Acknowledge
b
Figure 1.10-9 Blocking Procedure
a. The BS sends the Block message to the MSC, indicating the circuit to be
104
blocked. The BS starts timer T1.
b. The MSC sends the Block Acknowledge to indicate the corresponding circuit
has been blocked. The BS stops timer T1.
2) Unblocking
The BS notifies the MSC through the BSSAP message that a certain blocked
circuit can be used.
Figure 1.10-10 illustrates the unblocking procedure.
BS MSC
Unblock
a
Unblock Acknowledge
b
Figure 1.10-10 Unblocking Procedure
a. The BS sends an Unblock message to the MSC, requesting the MSC to unblock
the indicated circuit. The BS starts timer T1.
b. The MSC marks the indicated circuit as available and replies with an Unblock
Acknowledge message to the BS. The BS stops timer T1.
3) Circuit reset procedure (BS-initiated)
If a fault only influences a small part of the equipment and the SCCP connection
has been released when the fault occurs, it is necessary to use the Reset Circuit
message to initialize the information in the MSC/BS. If the MSC/BS detects
that the circuit is forced to be idle due to abnormal release of the SCCP
connection, the MS/BS should send the Reset Circuit message. After receiving
the Reset Circuit message, the receiver sets the indicated circuit to the idle status
and replies with the Reset Circuit Acknowledge message.
Figure 1.10-11 illustrates the circuit reset procedure.
105
BS MSC
Reset Circuit
a
Reset Circuit Acknowledge
b
Figure 1.10-11 A1 Circuit Reset Procedure (BS-Initiated)
a. When detecting that one or more circuits are forced to be idle, the BS sends the
Reset Circuit message (including the circuit ID to be reset and the reset reason)
to the MSC. The BS starts timer T12 while sending the Reset Circuit message.
b. After receiving the Reset Circuit message, the MSC sends the Reset Circuit
Acknowledge message to the BS, indicating the circuit has been reset. The BS
stops timer T12.
4) Circuit reset procedure (MSC-initiated)
Figure 1.10-12 illustrates the simple MSC-initiated circuit reset procedure.
BS MSC
Reset Circuit
a
Reset Circuit Acknowledge
b
Figure 1.10-12 A1 Circuit Reset Procedure (MSC-Initiated)
a. When detecting that one or more circuits are forced to be idle, the MSC sends
the Reset Circuit message (including the circuit ID to be reset and the reset
reason) to the BS. The MSC starts timer T12 while sending the Reset Circuit
message.
b. After receiving the Reset Circuit message, the BS sends the Reset Circuit
Acknowledge message to the MSC, indicating the circuit has been reset. The
MSC stops timer T12.
106
1.11 INAP
1.11.1 Overview
ZTE embeds the WIN SSP in the ZXC10-MSC/VLR using the mature CDMA mobile
communication system software/hardware platform to facilitate operators’ networking
and provide perfect WIN services to users. The WIN services currently implemented
include:
1. Pre-Paid Charging (PPC) service
2. Wireless Virtual Private Network (WVPN) service
3. Free-PHone (FPH) service
1.11.2 Pre-Paid Charging (PPC) Service
PPC is an IS826-based IN service on the 800 MHz CDMA digital cellular mobile
communication network. A subscriber can have an account in the system by paying a
certain amount of money beforehand or buying a card (e.g. a scratch card) with a fixed
face value, and can then deposit certain money in the account as his/her conversation
expenses. During the establishment of a call, the system decides to receive or reject the
call based on the balance in the subscriber account. In the process of the call, the
system charges the subscriber and deducts the fee from the account in real time. In this
way, pre-payment is implemented for calls and other services of the subscriber. When
the balance of the subscriber is insufficient, the system will disconnect the call and play
the corresponding announcement.
Below are some signaling procedures:
107
1.11.2.1 PPC Subscriber-Originated Call Procedure
SSP HLR SCP
ORREQ[MSCID, MSID, MDN, BILLID, DGTSDIAL, TRIGTYPE(36)

a
orreq [DMH_SVCID]
b
ANLYZD[MSCID, TRANSCAP, WINCAP, MSID,
MDN, BILLID,TOD,TDO,TRIGTYPE(37) ]
c
anlyzd[]
d
LOCREQ(MSCID,BILLID,DGTSDIAL,SystemTypeCode)
e
locreq(MSCID,MIN,ESN,TERMLIST,REDIND)
f
OANSWER[TDO,TOD, TRIGTYPE(40)
g
End of conversation
ODISCONNECT[TDO,TOD, TRIGTYPE(41) ]
h
odisconnect[]
i
Figure 1.11-1 Signaling Procedure of a PPC Subscriber-Originated Call
a. The SSP sends the origination message (ORREQ) to the SCP and sets the
parameter TRIGTYPE to Origination_Attempt_Authorized, indicating the
trigger type currently used. The other important parameters include the MSCID
(to identify the switch), MSID (to identify the MS), MDN and BILLID (used for
unique identification of a call among different dialogs between the SSP and the
SCP).
b. The SCP indicates through the DMH_ServID (128) in the response message
orreq that the PPC service is activated.
c. The SSP sends the information analysis request message (ANLYZDREQ) to the
SCP and sets the TRIGTYPE to Calling_Routing_Address_Available, indicating
the trigger type currently used. The other important parameters include the
108
MSCID, TRANSCAP (indicating the current processing capability of the

switch), WINCAP (indicating the capability of the switch to support WIN
operation and trigger assembly), MSID, MDN, BILLID, and RoutingInfo
(including the called address).
d. The SCP returns a null anlyzd response message.
e. The SSP sends a location request message to the called HLR, requesting the
HLR to provide the called subscriber’s location information.
f. The HLR returns the called subscriber’s location information.
g. The SSP connects the call to the called and then sends the O-ANSWER message
including the call answer time (TimeOfDy, TimeDateOffset) to the SCP after the
called subscriber answers.
h. Upon completion of the call, the SSP sends the O_DISCONNECTREQ message
to the SCP, which includes the call end time (TimeOfDy, TimeDateOffset).
i. The SCP returns the o_disconnect response message.
109
1.11.2.2 PPC Subscriber-Terminated Call Procedure
SSP HLR SCP SSP

LOCREQ(MSCID,BILLID,,DGTSDIAL,TRIGTYPE(32),
TRANSCAP,WINCAP)
a
locreq [MSCID, MIN, Profile{TRIGADDRLIST}] b
ANLYZD [MSCID, BILLID, DGTSDIAL, MSID, TRIGTYPE(38)]

c
anlyzd [DMH_SVCID]
d
LOCREQ(MSCID,BILLID,,DGTSDIAL,TRIGTYPE(34)
TRANSCAP,WINCAP)
e
ROUTREQ [MSCID,BILLID,MIN,TRIGADDRLIST(69,70)]
f
Routreq[TLDN]
g
h
ANLYZD[MSCID, MSID,MDN,BILLID,RoutingInfo,REDIND, TRIGTYPE(39), TOD,TDO]

i
anlyzd []
j
TANSWER[MSCID,MSID, BILLID,TRIGTYPE(69),TOD,TDO]
k
End of conversation
TDISCONNECT[TDO,TOD, TRIGTYPE(70) ]
l
tdisconnect[]
m
Figure 1.11-2 Signaling Procedure of a PPC Subscriber-Terminated Call
a. The originating MSC/SSP triggers the Mobile_Termination trigger and sends

LOCREQ to the HLR. In this message, the TRANSCAP parameter indicates that
the MSC/SSP is able to process the TRIGADDRLIST parameter while the
TRIGTYPE parameter indicates that the Mobile_Termination trigger has been
triggered.
b. The HLR sends the locreq message to the originating MSC/SSP. In addition to
the other mandatory parameters, the locreq message contains TRIGADDRLIST
in the profile information as well as triggers Initial_Termination, Location and
Called_Routing_Address_Available.
c. The originating MSC/SSP triggers the Initial_Termination trigger and sends the
110
ANLYZD message to the SCP specified in the TRIGADDRLIST parameter. In

this message, the TRIGTYPE parameter indicates that the Initial_Termination
trigger is triggered.
d. The SCP determines that the subscriber has activated the PPC service and the
subscriber’s balance is sufficient, and then sends the anlyzd message to the
originating MSC/SSP. In this message, the DMH_SVCID parameter indicates to
execute the PPC service with DMH_SVCID=128.
e. The originating MSC/SSP triggers the Location trigger and sends the LOCREQ
message to the HLR. In this message, the TRIGTYPE parameter indicates the
Location trigger is triggered.
f. The HLR determines to continue with call processing and sends the ROUTREQ
message to the VLR. The VLR forwards the ROUTREQ message to the serving
MSC/SSP.
g. The serving MSC/SSP assigns a TLDN number and returns the result to the
HLR.
h. The HLR sends the locreq message that carries the location information of the
called subscriber to the originating MSC/SSP, instructing the MSC/SSP to
connect the subscriber.
i. The originating MSC/SSP prepares to terminate the call, triggers the

Called_Routing_Address_Available trigger and sends the ANLYZD message to
the related SCP.
j. The SCP sends the anlyzd message to the MSC/SSP.
k. The originating MSC/SSP establishes a call connection to the MS. After the MS
answers the call, the MSC triggers the T_Answer trigger and sends the
TANSWER message to the related SCP. The SCP starts billing and the two
parties talk.
l. When the caller hooks on, the serving MSC/SSP triggers the T_Disconnect
trigger and sends the TDISCONNECT message to the related SCP. This message
should include the caller onhook information in addition to the mandatory
parameters. The SCP then stops billing.
m. The SCP sends the tdisconnect message to the serving MSC/SSP. In this
111
message, the DMH_SVCID parameter indicates that the PPC service is executed.
The MSC/SSP releases the call.
1.11.2.3 Playing Balance Notification/Available Conversation Duration
112
Figure 1.11-3 Signaling Procedure of Playing Balance Notification/Available Conversation
Duration
a. The SSP is able to send the ORREQ to the SCP. In addition to the other
mandatory parameters, the ORREQ message includes TRANSCAP, WINCAP,
TRIGTYPE and PLIND (TRIGTYPE = 36 indicates
Origination_Attempt_Authorized).
b. In the orreq message returned by the SCP, the value of DMH_SVCID is 128.
c. In the ANLYZD message, TRIGTYPE = 37 indicates

Calling_Routing_Address_Available.
d. The SCP sends the SearchReq message to the HLR to query the location of the
called subscriber through the MIN/MDN of the called number so as to determine
the tariff at the calling side.
e. The HLR returns the search(SDAEL), ServiceDataAccessElementList to the

SCP. In this message, the MSCID of the called subscriber is contained.
f. The SCP sends the resource request message SEIZERES to the IP. Suppose the
PLIND is in Chinese.
g. The IP returns the seizeres response message, which carries the resource address
parameter (TLDN).
h. The SCP sends the ConnectResReq message to the SSP so as to send the
resource address (TLDN) to the SSP.
i. The SSP sends the IAI message to the IP. The INSTRREQ (indication request)
indicates that everything is ready and the IP is waiting for a further instruction
from the SCP.
j. The SCP sends the SRFDIR message to the IP, requesting the IP to play the
announcement to the subscriber. In this message, the executable script of
announcement play is included.
k. The IP sends the ACM message to the SSP.
l. The IP sends the ANC message to the SSP. The calling subscriber hears the
balance announcement.
m. After playing the balance announcement to the calling subscriber, the IP sends
113
the srfdir message to the SCP, indicating that the announcement has been
successfully played.
n. The SCP finds that it is still necessary to play an announcement to the subscriber,
so it sends the SRFDIR message again to the IP, requesting the IP to play the
announcement to the subscriber. In this message, the executable script of
announcement play is included.
o. The IP plays the announcement to the subscriber and the calling subscriber hears
the announcement notifying the available duration.
p. The IP sends the srfdir message to the SCP, indicating that the announcement
has been successfully played.
q. The SCP checks and finds that it is no longer necessary to play an

announcement to the subscriber, so it sends the anlyzd message to the SSP.
r. The SSP sends the instrreq message to the IP.
s. The SSP connects the called subscriber. The called subscriber answers and the
conversation begins. The SSP sends the O_ANSWER message to the SCP. In
this message, the answer time is included.
t. The conversation keeps for a long time. The SCP sends the CCDIR (Call
Control Directive Request) message to the SSP so as to check the validity of the
call.
u. The SSP sends a null srfdir message to indicate that the call is normal.
v. The called subscriber hooks on. The SSP sends the O_DISCONNECT message
to the SCP. In this message, the release cause is that the called subscriber hooks
on first.
w. The SCP checks that the calling subscriber has subscribed to the service of
balance notification following a conversation, so it sends the SEIZERES
message to the IP.
x. The IP returns the seizeres message.
y. The SCP sends the CONNECTRESREQ message to the SSP.
z. The SSP sends the IAI message to the IP.
aa. The IP sends the INSTRREQ message to the SCP.
114
bb. The SCP sends the SRFDIR message to the IP.
cc. The IP sends the ACM message to the SSP.
dd. The IP sends the ANC message to the SSP. The calling subscriber hears the
balance announcement.
ee. After playing the balance announcement, the IP sends the srfdir message to the
SCP.
ff. The SCP sends the o_disconnect message to the SSP. The call is released.
gg. The SCP sends the instrreq message to the IP.
1.11.3 Wireless Virtual Private Network (WVPN) Service
The WVPN service provides a logical private network for some enterprises and groups
through the resources of the CDMA network, so as to help them open services to
CDMA subscribers in this private network. Such a service can offer some tariff
discounts to the subscribers within the groups while facilitating the management of
conversation expenses of the groups and subscribers. It has two meanings:
1. It is a virtual network without fixed physical connections and the network is

established only when required by subscribers.
2. It is a private network constructed with public network facilities. Such a network

has numerous merits of both public networks and private networks, integrating
the performance reliability and abundant functions of public networks with the
flexibility and high efficiency of private networks.
The VPN service employs the same signaling procedure as the PPC service does.
Below is an example of an in-net call by dialing the short number.
115
SSP HLR SCP
ORREQ[MSCID, MSID, MDN, BILLID, DGTSDIAL (short number),

SSP HLR
TRIGTYPE（36）]
a
orreq [DMH_SVCID,TERMLIST (real number)]
b
ANLYZD[MSCID, DIALDIGITS (short number)，DESTDIGITS (real number)
BILLID,TOD,TDO,TRIGTYPE(37) ]
c
anlyzd[SMH_SECID]
d
LOCREQ[MSCID, DIALDIGITS (real number) BILLID,TRIGTYPE ]

e
locreq[TRIGADDRLIST]
f

BILLID,TOD,TDO,TRIGTYPE]
g
anlyzd[SMH_SECID]
h
LOCREQ[MSCID, DIALDIGITS (real number) BILLID,TRIGTYPE ]

i
locreq[TERMLIST]
j
BILLID,TOD,TDO,TRIGTYPE]
k
anlyzd[SMH_SECID]
l
TANSWER[TDO,TOD, TRIGTYPE]
m
OANSWER[TDO,TOD, TRIGTYPE]
n
End of conversation
TDISCONNECT[TDO,TOD, TRIGTYPE ]
o
tdisconnect[]
p
ODISCONNECT[TDO,TOD, TRIGTYPE ]
q
odisconnect[]
r
Figure 1.11-4 Signaling Procedure of a VPN In-Net Call by Dialing the Short Number
116
a. Subscriber 1 dials the VPN short number of Subscriber 2. The SSP sends the
ANLYZD message to the SCP. In this message, TrigTYPE is set to
Origination_Attempt_Authorized (36).
b. The SCP sends the real number of Subscriber 2 in the TERMLIST to the SSP.
c. The SSP sends the ANLYZD message to the subscriber. In this message,
TrigTYPE is Calling_Routing_Addess_Available (37).
d. The SCP returns the anlyzd response message to the SSP.
e. The SSP sends the LOCREQ message to the HLR of Subscriber 2. In this
message, TrigTYPE is Mobile_Termination (32).
f. Because the serving MSC and the originating MSC are the same MSC, the
TriggerAddressList in the Locreq message should also include T-answer and
T-disconnect, in addition to Initial_Termination, Location and
Called_Routing_Address_ Available.
g. The SSP sends the ANLYZD message to the subscriber. In this message,
TrigTYPE is Initial_Termination (38).
h. The SCP returns the anlyzd response message.
i. The SSP sends the LOCREQ message to the HLR. In this message, TrigTYPE is
Location (34).
j. The HLR returns the location information TERMLIST of the called subscriber.
k. The SSP sends the ANLYZD message to the subscriber. In this message,
TrigTYPE is Called_Routing_Addess_Available (39).
l. The SCP returns the anlyzd response message.
m. The SSP connects the call and the called answers. The SSP sends the
T_ANSWER message to the SCP.
n. The SSP sends the O_ANSWER message to the SCP.
o. The SSP sends the T_DISCONNECT message to the SCP.
p. The SCP returns the t_disconnect message.
q. The SSP sends the O_DISCONNECT message to the SCP.
r. The SCP returns the t_disconnect message.
117
1.11.4 Free Phone (FPH) Service
The FPH service is a kind of charging service. It applies to voice services. It allows the
called to pay the caller’s fee incurred during a call so that the caller does not need to
pay for any fee of the call. This service is applicable to service and publicity behaviors
of some businesses and enterprises. After they register the service as a service
subscriber, the caller’s fee incurred during a call to the subscriber will be paid by the
subscriber. This is purposed to reflect the good image of the company and facilitate
users. The service is also applicable to individual subscribers. For example, some
people whose children go to school in another place can apply for this service, so that
they can pay the fees incurred when their children call them.
Below are some signaling procedures:
1.11.4.1 Call from a Common Subscriber to a Common CDMA Subscriber
GMSC/SSP HLR SCP Serving MSC
ANLYZD[BILLID,MSCID,DIGITS,TRANCAPA,TRIGTYPE,WINCAPA]
SEARCH[DATAKEY,SrvDataAcceElementList]
search[SrvDataAcceElementList]
anlyzd[DMH_SRVID,TERMLIST,TRIGADDRLIST]
LOCREQ[BILLID,MSCID,MSCIN,DIGITS,TRANCAPA,TRIGTYPE,WINCAPA]
ROUTREQ[BILLID,MSCID,ESN,MIN]
routreq[MSCID,DIGITS(DEST)]
locreq[MSCID,ESN,MIN,TERMLIST]
Call setup
The called answers

OANSWER[BILLID,TOD,TDO]
Call release
ODISCONNECT[BILLID,TOD,TDO]
odisconnect
Figure 1.11-5 Signaling Procedure of the Call from a Common Subscriber to a Common CDMA Subscriber
118
a. The subscriber dials the FPH service number 800KN1N2ABCD. The SSP sends
the ANLYZD message to the SCP. In this message, TrigTYP is set to "31
Specific_called_party_digit_string".
b. The SCP determines a called number MDN and sends the SEARCHREQ
message to the HLR of the called subscriber, so as to check the location
information of the called subscriber.
c. The HLR sends the searchreq message, in which the location information of the
called subscriber is carried.
d. The anlyzd message sent by the SCP as a response carries the parameter
TriggerAddressList that includes triggers O_Answer and O_Disconnect and the
parameter TerminationList that indicates the destination phone number to be
connected.
e. The SSP sends the LOCREQ message to the HLR of the called subscriber. In
this message, the parameter Digits(dialed) is a parameter value in the
terminationList of the analzd message.
f. The HLR finds that the serving MSC of the called subscriber is different from
the originating MSC, so it sends the ROUTREQ message to the serving MSC. In
this message, the parameter Digits(dialed) is a parameter value in the
terminationList of the analzd message.
g. The serving MSC returns the routreq message, which carries the TLDN.
h. The HLR returns the Locreq message, which carries the TLDN.
i. The originating MSC sets up a connection to the called subscriber and the called
subscriber answers. The originating MSC then sends the O_ANSWER message
to the SCP. In this message, the answer time is included. The SCP starts billing.
j. The subscriber hooks on. The originating MSC sends the O_DISCONNET
message to the SCP so that the SCP stops billing.
k. The SCP returns the o_disconnect message to the SSP and the call is released.
119
1.11.4.2 Call from a Common Subscriber to a PSTN Subscriber
GMSC/SSP SCP Serving MSC
ANLYZD[BILLID,MSCID,DIGITS,TRANCAPA,TRIGTYPE,WINCAPA]
a
anlyzd[DMH_SRVID,TERMLIST,TRIGADDRLIST]
b
Call setup
The called answers
OANSWER[BILLID,TOD,TDO]
c
Call release
ODISCONNECT[BILLID,TOD,TDO]
d
odisconnect
e
Figure 1.11-6 Signaling Procedure of the Call from a Common Subscriber to a PSTN Subscriber
a. The subscriber dials the FPH service number 800KN1N2ABCD. The SSP sends
the ANLYZD message to the SCP. In this message, TrigTYP is set to "31
Specific_called_party_digit_string".
b. The SCP determines a called number (PSTN number). The anlyzd message sent
by the SCP as a response carries the parameter TriggerAddressList that includes
triggers O_Answer and O_Disconnect and the parameter TerminationList that
indicates the destination phone number to be connected.
c. The originating MSC sets up a connection to the called subscriber and the called
subscriber answers. The originating MSC then sends the O_ANSWER message
to the SCP. In this message, the answer time is included. The SCP starts billing.
d. The subscriber hooks on. The originating MSC sends the O_DISCONNET
message to the SCP so that the SCP stops billing.
e. The SCP returns the o_disconnect message to the SSP and the call is released.
120
1.11.4.3 Announcement Play
Figure 1.11-7 Signaling Procedure of Announcement Play
a. The subscriber is a common CDMA subscriber. The preferred language is

Chinese. The subscriber dials the FPH service number 800KN1N2ABCD. If this
FPH service number is associated with any limits such as regional limit
(according to the ServingCellid of the caller), password authentication or call
number limit, a voice announcement should be notified to the subscriber.
b. The SCP sends the SEIZERES message to the IP.
c. The IP returns the seizeres message, which carries the resource address TLDN.
d. The SCP sends the CONNECTRES message that carries the resource address
TLDN to the SSP.
e. The SSP sets up a connection to the IP. The IP sends the INSTREQ message to
the SCP.
f. The SCP sends the SRFDIR message, requesting the IP to play the
announcement to the subscriber.
121
g. The IP plays the voice announcement to the subscriber and then sends the srfdir
message to the SCP.
h. The SCP sends the anlyzd message to the SSP.
i. The connection is released and the SCP sends the instreq message to the IP.
122
2 SS7 Network
Key points:
z The knowledge points covered in this section
2.1 Basic Concepts of the Signaling Network

The basic feature of common channel signaling (CCS) is that speech channels are
separated from signaling channels. The separate signaling channels may be combined
to form a signaling network.
The SS7 controls a circuit-switched information transmission network. The

transmission and switching devices of the SS7 itself compose an impendent signaling
network that is a private computer communication network overlapped on the circuit
switched network.
2.1.1 Signaling Network Components
A signaling network is generally composed of three elements: SP (Signaling Point),

STP (Signaling Transfer Point) and SL (Signaling Link).
2.1.1.1 Signaling Point (SP)
An SP is a node to process control messages. The SP generating a message is the

source SP of this message whereas the node receiving the message is the destination
SP.
2.1.1.2 Signaling Transfer Point (STP)
An STP can transfer a signaling message from one signaling link to the signaling node
of another signaling link.
STPs fall into two types: Integrated STP and standalone STP. A standalone STP can
only transfer signaling while an integrated STP provides the user part functions in
addition to the signaling transfer function.
123
2.1.1.3 Signaling Link (SL)
An SL refers to a link for transmitting signaling messages between two SPs. A group
of links directly connecting two SPs form a signaling link set.
2.1.2 Signaling Point Code (SPC)
In order to make it easy to manage signaling networks, the international signaling

network and the signaling networks in various countries are independent of one another.
Every signaling network has its own signaling coding rules. 14-bit signaling point
codes are employed internationally while China uses 24-bit signaling point codes.
Therefore, the signaling points are not internationally unified.
A signaling point code is a flag to uniquely determine a signaling point. The 24-bit
signaling point code format used in China is shown in Figure 2.1-1.
Main signaling Signaling sub- Signaling

area area point
8 bit 8 bit 8 bit
Figure 2.1-1 SPC Format Used in China
The main signaling areas are uniformly numbered by provinces, autonomous regions
and municipalities directly under the control of the central government.
Signaling Point Code (SPC), Originating Point Code (OPC) and Destination Point
Code (DPC) are the common concepts that we may encounter as to the network. OPC
and DPC are relative concepts. A signaling point may be an OPC or DPC depending on
the direction of the signaling message but SPC is an absolute concept and will not
change once it is determined.
2.1.3 Working Mode of the Signaling Network
The working mode means the correspondence between the channels from which
signaling messages are obtained and the signaling relations to which the messages
belong. It may be the associated mode, non-associated mode or quasi-associated
mode.
2.1.3.1 Associated Mode
In this mode, the information between two signaling points is transferred by the
124
Chapter 2 SS7 Network
signaling link directly connecting the two signaling points, as shown in Figure 2.1-2.
Speech
channel
A B
Signaling link
Figure 2.1-2 Associated Mode
2.1.3.2 Non-Associated Mode
In this mode, signaling messages are transferred by several signaling links depending
on the current status of the network. At different moments, the paths that the signaling
message route takes are indefinite. This mode is currently not used because too much
data need to be configured for the signaling points.
2.1.3.3 Quasi-Associated Mode
In this mode, the message of a certain signaling relation should be transferred by one or
more signaling points during the transfer process but the paths that the message takes
to pass through the signaling network within a certain period of time are predefined
and fixed. The quasi-associated mode is a special case of the non-associated mode.
As shown in Figure 2.1-3, the signaling messages from A to B are all transferred by C
and the signaling paths are definite.
Speech channel
A B
Signaling link
Figure 2.1-3 Quasi-Associated Mode
2.1.4 Signaling Route
A signaling route is a predefined transfer path of signaling messages from the

originating signaling point to the destination signaling point. By the specific route
features and use method, signaling routes can be classified into normal routes and
125
alternative routes.
2.1.4.1 Normal Route
A normal route is a route that the signaling traffic takes when no fault occurs.
2.1.4.2 Alternate Route
An alternative route is a route that will be selected to transmit signaling traffic only
when the normal route is unable to transfer signaling traffic due to a signaling link or
route failure. Alternative routes are all quasi-associated routes that are transferred by
one or more STPs. There may be one alternative route or many alternative routes.
According to the number of STPs passed, alternative routes fall into the first alternative
route, the second alternative route and so on.
Normally, the route with a direct signaling link is the normal route when there are
multiple routes to the same signaling point. If there is no direct signaling link, the
normal route shall be the shortest route amongst the available signaling routes. When
the load sharing mode applies, the two signaling routes sharing the load of each other
are both normal routes. If the normal route fails, the first alternative route should be
selected with first priority to bear the signaling traffic and then the second alternative
route if the first alternative route also fails.
Let’s have a look at the example shown in Figure 2.1-4.
STP STP
The first alternative route
STP
SP Normal route
SP
STP
The first alternative route
STP STP
The second
alternative route
Figure 2.1-4 Setting of the Normal Signaling Route

126
Chapter 2 SS7 Network
2.2 Typical Signaling Network Structure

Signaling networks can be divided to non-hierarchical signaling networks and
hierarchical signaling networks. They differ in that a non-hierarchical signaling
network has no signaling transfer point because all signaling points are in the
associated mode. When there are many signaling points, the non-hierarchical signaling
network will become very complex and thus will not suite the practical use. The
hierarchical signaling network is employed at present because it caters to the
development needs of modern communication networks with a large network capacity,
simple design and expansion convenience.
The signaling network in China is divided into three levels: High-level Signaling
Transfer Point (HSTP), Low-level Signaling Transfer Point (LSTP) and Signaling
Point (SP). Figure 2.2-1 shows the specific structure.
A B
HSTP
D
D D D D
C
A
2
1
B C LSTP
A B
2 1
C
2 1
A A
A A Area
SP C
Area A
Area B
SP layer
Figure 2.2-1 Three-Level Signaling Network Structure Used in China
HSTPs often come in pairs: One located on Plane A to connect the other located in
127
Plane B. The HSTPs on the same plane are meshed while the HSTPs that are not on the
same plane and not in pairs are not connected to one another, as shown in Figure
2.2-2.
LSTPs also come in pairs and each LSTP is at least connected to a pair of HSTPs on
Planes A and B. Each SP is at least connected to two STPs (HSTPs or LSTPs).
H H
H H
H H
A B
Figure 2.2-2 Connection of HSTPs on Planes A and B
128
3 Basic Service Procedures
Key points:
z The knowledge points covered in this section
This chapter only describes the specific message procedures instead of the detailed
message parameters.
3.1 MAP Service Procedures

The ZXC10-MSC/VLR/SSP (V3.0) system features very powerful functions and
provides diversified service functions for subscribers so as to satisfy the service needs
of subscribers. These services are the services that can be implemented in the process
to transfer signaling between entities (such as MSC, HLR, VLR, GMSC or MC) of the
PLMN network (see Figure 3.1-1).
MSC EIR
E F
A Ai
MS BSS MSC PSTN
Di
C B
H D
Q AC HLR VLR ISDN
N G
SME SME MC MC VLR

M M M
Figure 3.1-1 Network Reference Model
The specific services can be summarized as follows:
First, the ZXC10-MSC/VLR/SSP (V3.0) system provides basic service functions to

satisfy the most basic needs of subscribers. They include the security function (system
authentication, unique challenge, SSD updating and subscriber information encryption),
129
the basic call function (intra-office calls, outgoing calls, incoming calls and enhanced
functions) and the mobility management function (registration/de-registration, MS
deactivation and MS handoff).
Second, the ZXC10-MSC/VLR/SSP (V3.0) system provides more convenient and

personalized communication services such as call forwarding services and call
restriction services to subscribers.
Third, the system can provide intelligent network service functions to both satisfy the
IN service requirements of subscribers and offer an efficient method to quickly add
new service functions for subscribers. At present, the available IN services fall into
three types to satisfy customers’ requirements: Prepaid services, WVPN (Wireless
Virtual Private Network) services and FPH (FreePhone) services.
Last, the system is able to provide SMS to satisfy the ever-increasing short message
requirements. It can satisfy the diversified requirements of subscribers without
increasing the cost.
3.1.1 Security Management
3.1.1.1 Overview
Authentication is purposed to protect legal subscribers against the “intrusion” of fake

or illegal users. Since the CDMA technology was initially applied in the military field,
it must provide very high confidentiality and so two levels of confidentiality
mechanisms were applied for security management.
The authentication parameters used in the CDMA system include the A-KEY, MIN,
ESN, SSD and some authentication algorithms.
Every registered subscriber has been allocated a subscriber number (MDN), a mobile
identification number (MIN) and an authentication key (A-KEY). The MIN and
A-KEY are written by the air activation service or special equipment into the
subscriber’s mobile station. By means of SSD updating, a Shared Secret Data (SSD)
parameter is generated in both the AUC and the subscriber’s mobile station and used
for future calculation of authentication and encryption algorithms. If the VLR supports
SSD sharing, this SSD is also stored in the VLR. The 128-bit SSD is divided into two
parts, one of which is the 64-bit SSD_A used for authentication calculation and the
other is the 64-bit SSD_B for encryption calculation. The SSD generation algorithm
and authentication algorithm are illustrated in Figure 3.1-2 and Figure 3.1-3.
130
Chapter 3 Basic Service Procedures
RANDSSD ESN A-Key

56 32 64
SSD_Generation
Procedure
SSD_A_NEW SSD_B_NEW
64 64
Figure 3.1-2 SSD Generation Algorithm
RAND_CALLENGE ESN AUTH_DATA SSD_AUTH

RAND ESN MIN1 SSD_A_NEW
32 32 24 64
Auth_Signature
Procedure
AUTHR
18
Figure 3.1-3 Authentication Algorithm
3.1.1.2 Authentication Procedure
Generally, the system authenticates users in the following modes:
2) Unique challenge
3) SSD update
The details are given in the sections below.
1. System authentication
Let’s take registration as an example. The typical system authentication
131
procedure is shown in Figure 3.1-4.
MS MSC/VLR HLR/AUC
OMT(AUTH=1,RAND)
a
Location Updata Request
(RANDC,AUTHR,COUNT)
b
AUTHREQ(RAND,AUTHR,COUNT)
c
authreq
d
REGNOT
e
regnot
f
Figure 3.1-4 System Authentication During Registration
a. If the AUTH parameter in the air interface OMT message equals 1, it indicates
that authentication is necessary at system access. The RAND for authentication
is also provided by the BS. The MS uses RAND and the SSD-A and MIN/ESN
data that it has stored to execute the CAVE algorithm and obtain an
authentication result AUTHR.
b. The MS registers itself in the new Serving MSC/VLR and provides

authentication parameters such as MIN/ESN, AUTHR, RANDC and COUNT in
the Location Update Request message.
c. The MSC/VLR sends the authentication request message AUTHREQ to the

HLR/AUC. The HLR/AUC executes the CAVE algorithm using the MIN/ESN,
RAND and the currently stored SSD-A to calculate an authentication result
AUTHR, and compares the result with the AUTHR sent from the MS.
d. The HLR/AUC returns the authentication result "authreq" to the MSC/VLR.

Access denial should be possible in one of the following conditions:
1) Parameter error (ParameterError);

132
3) MIN/HLR mismatch;
4) TSB51 is not supported;
5) MIN/ESN mismatch;
7) Terminal type mismatch.
e. If the authentication is successful, the MSC/VLR will initiate the registration

procedure.
f. The HLR returns the registration result.
2. Unique challenge
When an MS is idle or on a traffic channel, the AUC may initiate unique

challenge. If the SSD is shared, the unique challenge may also be initiated by the
VLR. Figure 3.1-5 shows the typical procedure of unique challenge.
MS MSC/VLR HLR/AUC
AUTHDIR(RANDU,AUTHU)
a
b
Unique Challenge Response
c
ASREPORT(UCHALRPT)
d
asreport
e
Figure 3.1-5 Unique Challenge Procedure
a. The primitive is triggered by the agent and initiated by the AUC so as to

implement the following functions:
1. SSD update: Generate a new SSD so as to keep the SSD synchronization among
the AC, the VLR and the MS.
133
2. Unique challenge: Initiate the authentication of the MS and check if the SSD of
the AUD is synchronous with the SSD of the MS.
This procedure is initiated by the AUC after the unique challenge function is completed
and the subscriber should be authenticated.
b. The Serving MSC/VLR sends the random number for authentication purpose to
the MS, requesting the MS to provide the authentication result.
c. The MS sends the calculated authentication result to the MSC/VLR.
d. The MSC/VLR compares the result sent from the MS with the authentication
result sent from the AUC, so as to determine if the authentication is passed.
e. The MSC/VLR tells the comparison result of the authentication results to the
AUC. The access of the MIN should be able to be denied in one of the following
conditions:
1) Message parameter error (ParameterError);
f. The HLR/AUC returns a response message.
3. SSD updating
SSD update should be performed for the MS when the SSD value in the MS
does not match the SSD value in the AUC or if such update is required in view
of security.
The typical SSD update procedure is shown in Figure 3.1-6.
134
MS MSC/VLR HLR/AUC
AUTHDIR(RANDSSD,RAN
DU,AUTHU)
a
SSD Update authdir
b
Request(RANDSSD)
c
BS Challenge
(RANDBS)
d
BS Challenge
Response(AUTHBS)
e
SSD Update Response
f
a. This statement is the same as in the first step of the unique challenge procedure,
except that the cause of initiation is SSD update.
b. Upon receipt of the information, the MSC/VLR returns a response to the

HLR/AUC.
c. The MSC/VLR sends a random number RANDSSD used for SSD update to the
MS, requesting the MS to provide the result.
d. The MS calculates out an SSD based on RANDSSD, A-KEY and other

information. In order to ensure that the SSD does not appear at the air interface,
the MS sends the RANDBS generated by the BS to the network through BS
challenge.
e. The MSC/VLR calculates out the BS challenge result (AUTHBS) based on

RANDSSD, MIN and other information and sends the result to the MS.
f. The MS compares this result with the result the MS itself calculates based on the
same parameters. If the results are the same, the SSD update succeeded.
Otherwise, the SSD update failed.
4. Involved Signaling
135
The VLR initiates this message to the AUC when it decides that authentication
is needed during MS access.
2) Authentication directive (AUTHDIR)
The AUC may use this directive to initiate the unique challenge procedure or
SSD update, or the VLR may use it to initiate the unique challenge procedure.
The authentication directive message is used to modify the authentication

parameters of the MS.
3) BS challenge (BSCHALL)
The MS initiates this message to the MSC after the network sends an SSD
update command to the MS.
4) Authentication status report (ASSREPORT)
This directive is initiated when the AC fails to initiate the unique challenge
procedure. It is used to report the result of an authentication operation.
5) Authentication failure report (AFREPORT)
This directive is initiated when SSD sharing applies and the VLR fails to initiate
the unique challenge procedure. It is used to report the failure of MS
authentication.
3.1.2 Mobility Management
3.1.2.1 Overview
Due to the mobility of mobile subscribers, their locations often change. In order to
obtain easily the mobile subscribers’ location information during processing of call
services, short message services and supplementary services and to enhance the
effective utilization of radio resources, it is required that the mobile subscribers’
locations be registered in the network and the mobile subscribers’ activation status be
reported, that is, location registration is required.
The CDMA system supports the following nine registration types:
1. Switch-on registration: When an MS is switched on or switches from an analog

system to the CDMA system, it shall initiate a registration procedure.
2. Switch-off registration: If an MS has already been registered in the current
136
service system, it shall initiate a registration procedure when it is switched off.
3. Periodical registration: When the timer expires, the MS shall initiate a

4. Distance-based registration: When the distance between the current BTS and the
BTS last time registered by an MS exceeds the threshold, the MS shall initiate a
5. Area-based registration: When an MS enters a new registration area, it shall

initiate a registration procedure.
6. Parameter change-based registration: When an MS enters a new system or when

the parameters stored in the MS change, the MS shall initiate a registration
procedure.
7. Commanded registration: An MS initiates a registration procedure as requested

by the BTS.
8. Implicit registration: When an MS sends an Origination message or a Page

Response message successfully, the network can determine the location of the
MS. This can be regarded as implicit registration.
9. Traffic channel registration: When the network obtains the registered

information of an MS that has been assigned a traffic channel, the network can
inform the MS that it has been registered.
3.1.2.2 Location Registration
The typical registration procedure is shown in Figure 3.1-7.
137
MS MSC/VLR2 HLR MSC/VLR1
Location
Update Request a
REGNOT
b
REGCANC
c
regcanc
d
regnot
e
Location Update Accept
f
Figure 3.1-7 Registration Procedure
a. When the BTS receives a registration request from an MS, it sends a Location
Update Request message to the current service system (MSC/VLR2) to start the
b. The current service system sends a registration notification message (REGNOT)

to the HLR of the MS, so as to report the MS location (MSCID, VLRID,
VLRIN) and MS status (activated or deactivated) and get the MS approval
information (approval period) and the subscriber’s service list (Profile).
C. If the MS has been previously registered elsewhere, the HLR will send a
registration cancellation message (REGCANC) to the old MSC/VLR1 so that
MSC/VLR1 will delete all the records of this MS from its database.
d. MSC/VLR1 returns the registration cancellation result to the HLR.
e. The HLR returns the registration notification result to MSC/VLR2.
f. If the registration is successful, MSC/VLR2 will send a Location Update Accept

message to the BTS to indicate the successful registration of the MS.
1. Involved MAP signaling
138
1) Registration notification (REGNOT)
The REGNOT message is initiated by the VLR to the HLR during the
mobile-originated location update procedure. It is used to report the new
location registered by the MS, approve the MS and obtain the profile of the MS.
2) Registration cancellation (REGCAN)
The HLR initiates this message to the VLR in which the subscriber was
previously registered when the MS needs a location update.
3) Cancellation deny (CANDEN)
The VLR initiates this message to the HLR so as to refuse to delete this
subscriber from its database.
4) MS deactivation (MSINACT): It is initiated by the VLR to the HLR, telling the

HLR that the MS is no longer active.
& Note:
Periodical location update: When an MS is powered off, the system may fail to know
this event but still regard the MS as being in the active status due to poor radio
transmission quality or some other reasons. When the MS is powered on but has
roamed beyond the service coverage, that is, the MS is in a blind spot, the system will
not be able to know its location. In both cases, the system will keep sending paging
messages if others call this subscriber. As a result, radio resources would be wasted.
To solve the above problem, forced registration applies in the system: The MS must
register itself at a certain interval. This process is called "periodical location update".
This concept is the same for the CDMA system and the GSM system. The flowchart of
periodical location update is just the same as that of generic location update.
3.1.2.3 Deregistration
The typical registration cancellation procedure is illustrated in Figure 3.1-8.
139
MSC/VLR HRL/AU
MSINACT(DEREG)
a
msinact
b
Figure 3.1-8 Registration Cancellation Procedure
a. The Serving MSC/VLR deletes all the records of this MS and sends an
MSINACT message containing the registration cancellation type parameter to
the HLR.
b. The HLR deletes the pointer that points to the MSC/VLR from the MS data and
sends a null msinact acknowledgement operation to the MSC/VLR.
3.1.2.4 MS Deactivation
After confirming that a registered roaming MS is inactive for a long time (for example,
the MS does not perform periodical location update within the specified time), the
MSC/VLR will initiate the MS deactivation operation to release the resources occupied
by this subscriber.
& Note:
The signaling form of registration cancellation is the same as that of MS deactivation

but the results are different in the CDMA system. In the deactivation procedure during
registration cancellation, the VLR database deletes the information of the subscriber. In
contrast, the subscriber is only marked with the inactive flag but its data are not deleted
from the database in the system-initiated MS deactivation procedure.
3.1.3 Basic Call Services
3.1.3.1 Concepts
The basic call service functions include local calls, outgoing calls, incoming calls and
transit calls. The latter three are supported by inter-office signaling, which can be
140
divided by different working modes into Channel Associated Signaling (CAS) and
Common Channel Signaling (CCS). CCS is applicable to signaling transfer between
SPC switch offices while CAS is applicable to communications between trunks (such
as DT, ABT and SFT) and other offices.
3.1.3.2 Mobile-Originated Call (MOC)
Figure 3.1-9 illustrates the procedure of an MS-originated call.
BS MSC/A VLR MSC/CC

CR (CompleteLayer3Info:
CM_Service_Request)
a
Acess_Req
b
Auth_Req
c
CC
(AuthenticationRequest)
d
AuthenticationResponse e
Auth_Rsp
f
Acess_Rsp
g
Setup
h
Assign_Req
i
AssignmentRequest
CC j
(AssignmentRequest)
AssignmentComplete
k
Assign_Cmpl
l
Figure 3.1-9 Mobile-Originated Call Procedure
a. The BS constructs a CM_Service_Request message and places it in the

Complete Layer3 Info message after receiving the access probe from an MS. It
sends the Complete Layer3 Info message as the subscriber data of the SCCR
Connection Request (CR) to the MSC.
b. Upon receipt of the CM_Service_Request message, the MSC/A interface

module constructs an Access_Req message and sends it to the VLR, so as to
check if the MS is allowed to access the system.
c-f: After receiving the Access_Req message, the VLR may start the unique
challenge procedure. If the SCCP connection is not yet established when the
141
MSC sends the Authentication Request message to the BS, the Authentication
Request message may be sent as the subscriber data of the SCCP Connection
Confirm (CC).
g. The VLR returns an Access_Rsp message to the A interface module, indicating

that the access succeeded.
h. If the access succeeded, the A interface module sends a Setup message to the CC
module, instructing the CC to establish the call. In the Setup message, the
parameters such as the called number are carried.
I. The CC module sends an Assign_Request message to the A interface module.

This message carries terrestrial circuit information and air channel information.
J. The A interface module sends an Assignment Request message to the BS. If the
SCCP connection is not yet established (without the authentication procedure),
the Assignment Request message may be sent as the subscriber data of the SCCP
Connection Confirm (CC).
K. After completing the assignment, the BS sends an Assignment Complete

message to the MSC.
L. The A interface module receives the Assignment Complete message from the BS
and then sends an Assign_Cmpl message to the CC module. Till now, the call
establishment procedure ends for the A interface module.
3.1.3.3 Mobile-Terminated Call (MTC)
Figure 3.1-10 illustrates the procedure of an MS-terminated call.
142
BS MSC/A CC VLR
Page_R eq
a
P a g in g R e q u e s t
b
C R ( C o m p le te L a y e r3 In fo
P a g in g R e s p o n s e )
c
A cc ess_R e q(P ag e_ R sp)
d
A u th _ R e q
CC
(A u th e n tic a tio n R e q u e s t)
A u th e n tic a tio n R e s p o n s e e
A u th _ R s p
A c c e s s _ R sp
f
A s s ig n _ R e q
g
C C (A ss ig n m e n tR e q u e st)
h
A s s ig n m e n tC o m p le te
i
A s s ig n _ C m p l
j
C onnect
k
C onnect
l
Figure 3.1-10 Mobile-Terminated Call Procedure
a. The VLR finds an incoming call request in its service area, so it sends a
Page_Req message to the corresponding A interface module.
b. The A interface module sends a connectionless PagingRequest message to the

BS.
c. The BS sends a PagingResponse message to the MSC. This message is included

in the CompleteLayer3Info of the BSMAP message and the
CompleteLayer3Info message is sent as the data item of the SCCP Connection
Request (CR).
d. Upon receipt of the Page Response message from the BS, the A interface module
sends an Access_Req to the VLR, so as to determine if the subscriber is allowed
to access the system.
e. The VLR may selectively initiate the unique challenge operation as necessary.
f. The VLR returns the access result (Access_Rsp) to the A interface module.
143
g. The VLR then starts the MSC/CC module with TpBegin. Upon receipt of the
Setup message from the calling side, the CC module sends an Assign_Req
message to the A interface module.
h. The A interface module sends an AssignmentRequest message to the BS.
I. After completing the assignment of circuits and radio resources, the BS sends an
AssignmentComplete message to the MSC.
J. The A interface module notifies the CC module with the Assign_Cmpl message
that the assignment is complete.
K. The BS sends a Connect message to the MSC if the called party hooks off.
L. The A interface module notifies the CC module with the Connect Message that
the called subscriber has hooked off. At this time, the subscribers enter the
1. Acquisition of routing information
When a mobile subscriber is called, the system needs to determine the location
information of the called subscriber. In this process, the transfer of MAP
signaling among the MSC, the VLR and the HLR is involved. The involved
signaling messages are listed as follows:
1) Location request (LOCREQ): It is initiated by the MSC to the HLR of the called
MS when the MSC finds that the caller dials a mobile subscriber number.
2) Route request (ROUTREQ): It is initiated to request for a TLDN when the caller
and the called are not in the same MSC.
Figure 3.1-11 shows the procedure to obtain the routing information.
144
MSC HLR VLR
LO C R EQ [B ILLID , O rigID ,
D G TSD IA L, TR A N SC A P, TAT]
a
R O U TR EQ [R outR eqID , TER M TR M T,
TER M TR IG , A LR TC O D E, LEGIN FO,
O TFI, C N IinfoA SC II, D M H D ata,
V M SPIN, V M B OX ]
b
RR
LR routreq [M SC ID , B ILLID ,
T
T
PC _SSN , TLD N ]
c
locreq [M IN , ESN , M SC ID , PC _SSN ,
A N N LIST,Intersystem R outingInfo,
D M H D ata] d
Figure 3.1-11 Location Request Procedure
a. The originating MSC sends a location request message (LOCREQ) to the HLR
related to the MS. The related HLR is determined by the MDN of the MS. The
location request message is used to locate the HLR of the called subscriber. The
HLR will return the processing information of this call after analyzing this
message.
b. If the MDN is assigned to a legal subscriber, the HLR sends a route request
message (ROUTREQ) to the VLR in which the MS has been registered, so as to
request for a roaming number (TLDN) from the serving VLR of the called
subscriber. The HLR returns the TLDN in the locreq message to the originating
MSC to set up the call.
c. The serving VLR allocates a Temporary Local Directory Number (TLDN) and
places it in the routreq message (return result of the route request message) to
send to the HLR.
d. Upon receipt of the routreq message, the HLR returns a location request
message (locreq) to the originating MSC. The routing information is carried in
When receiving a location request message (LOCREQ) from the MSC, the HLR may
take one of the following actions as needed:
1) Directly return the call connection information if the caller and the called are in
145
the same MSC.
2) Initiate a ROUTREQ message to the called VLR so as to obtain the TLDN and
return it to the CC if the called is located in an MSC different from the MSC
where the caller is located.
3) Perform the supplementary service operation if a supplementary service is

activated. For example, the HLR should get the forwarded-to number if the CFU
service is activated and should deny the access if the DND is activated.
4) Deny the access if the called subscriber is roaming (outside the HLR) and does
not have the roaming right.
3.1.4 SMS
3.1.4.1 Overview
Short messages are a means to implement simple personal data communication by

using the SS7 of the mobile network to bear short data packets. The short message
center (SC) allows such short messages to be transmitted between mobile subscribers
or between mobile subscribers and various extended short message entities (ESMEs)
such as the voice mailbox, integrated information station or manual agent. It can derive
a series of value-added services on this basis.
This chapter introduces the SMS service implementation procedures through the No.7
signaling of the connection between the SC and the PLMN.
3.1.4.2 Basic SM Procedures
1. Mobile-originated short message procedure
The SMSC (Short Message Service Center) can receive the SMs from a CDMA
mobile station and forward them to the destination SME. The destination SME
can be either the visited MSC or the home SMSC of the MS that receives the
SM.
The signaling procedure of a mobile station sending short messages to the SC is

146
BSS A? VLR MAP MSC MAP MC MAP SC SMPP GW ESME

ADDSTransfer Auth for the
Orig Call Orig User(Orig
through Control
ADDSPage Req Call ability)
Channel
ADDSPage Ack
AccessReq
accessrsp
Ansi41D Protocol Transfer

camSmsMoReq
Ansi41D to Internal
cmSMSDPPReq Protocol Transfer

Interanal to SMPP
cmsMoReq
Protocol Transfer
Internal to Ansi41D
csgDlvReq
Delivery
DeliverAck
Save Short Msg and cgsDlvAck
modify subscrible's
information
csmMoAck
Protocol Transfer
Ansi41D to Internal
cmsMoReq Protocol Transfer

SMPP to Internal
csmMoAck
cmSMSDPPRsp
Protocol Transfer
Internal to Ansi41D
Figure 3.1-12 Signaling Procedure of a Mobile-Originated SM
In this flowchart, the signaling procedures among the terminal, BSS, MSC/VLR
and SC are involved. In the above figure, every part is noted. The A interface,
VLR MAP and MSC MAP belong to the internal functional modules of the
MSC/VLR system; the MC MAP, SC and SMPP gateway represent the signaling
gateway, service processing module and SMPP gateway of the SC in turn. The
specific procedures are described as follows:
Signaling exchange between the BSS and the A interface (MSC): It is the
process of submitting an SM via the control channel. Here, the control channel
may be used instead for transmitting the short message (as shown in the first
circle)
Signaling exchange between the A interface and the VLR MAP: It is the
147
interaction process inside the MSC/VLR for authenticating the call origination
capability of the calling subscriber (as shown in the second circle)
Signaling exchange between the A interface and the MSC MAP: It is the
interaction process inside the MSC/VLR for submitting an SM to the MSC
MAP.
Signaling exchange between the MSC MAP and the MC MAP: The MSC
submits an SM to the SC and the SC returns the response indicating that it can
normally receive the message to the MSC. MSC MAP signaling and MC MAP
signaling are a pair of standard MAP signaling in conformance with the
ANSI-41D protocol.
There are two dotted line boxes in the above figure. One indicates that the called
party is an ESME and the signaling gateway submits the received message to the
service server, which will deliver the message to the corresponding ESME via
the SMPP gateway.
The second dotted line box indicates that the called party is a mobile subscriber
of the local network and the service server receives and stores the message for
delivery.
The signaling exchange among the MC MAP, SC and SMPP gateway belongs to
internal information exchange but the signaling from the SMPP gateway to the
ESME conforms to the SMPP standard protocol.
2. Mobile-terminated short message procedure
The SC can forward the SM submitted by the calling terminal to the CDMA MS.
The originating SME can be either the visited MSC or the home SC of the MS
that originates the short message.
The mobile-terminated short message signaling procedure is shown in Figure

3.1-13.
148
BSS A? VLR MAP MSC MAP HLR MAP MC MAP SC SMPP GW ESME
SubmitReq
cagsSubmitReq
csagSubmitAck
SubmitAck
csmMtReq
cmSMSReq
cmSMSReq
if has no SMSAddr ,
send this Msg
cmSMSRsp
cmSMSRsp
cmSMSDPPReq
Term Call
through Control SMS_Incoming Call
Channel
SMS_Incoming Call Ack

Auth the Dest user
cmaSmsMtReq
ADDSPage Req
ADDSPage Ack
Select Retry mode
camSmsMtAck according MtAck and
cmSMSDPPRsp subscribe's Serv
info
csmMtAck
Figure 3.1-13 Mobile-Terminated SM Procedure
Compared with the mobile-originated SM procedure, this procedure needs the

participation of the HLR. A detailed explanation of the procedure is given as
follows:
The dotted line box at the beginning of the procedure indicates the message is
submitted by the ESME. The signaling from the ESME to the SMPP gateway
conforms to the standard SMPP signaling protocol.
SC-MC MAP signaling: The service processing module delivers an SM to the
149
signaling gateway. This message may either come from the ESME in the dotted
line box or may be submitted by an MS and is in the waiting queue.
MC MAP-HLR MAP signaling exchange: The signaling gateway queries the

location of the called subscriber from the HLR and the HLR returns the query
result. Here, the returned information may be the MSC/VLR address
information of the called subscriber or some failure causes such as illegal
subscriber and subscriber power-off. If the MSC/VLR address information of
the called subscriber is returned, the next step follows. The MC MAP signaling
and the HLR MAP signaling are a pair of standard MAP signaling in
conformance with the ANSI-41D protocol.
MC MAP-MSC MAP signaling exchange: The SC delivers the SM to the MSC

where the called party resides and the MSC returns a response. The other
procedures involved are given as follows:
1) Internal interaction between the MSC MAP and the VLR MAP. The purpose is
to authenticate whether the called subscriber has the SM capability.
2) If the subscriber is capable of receiving SMs, the MSC MAP sends a request to
the A interface for delivering the SM to the called subscriber.
3) The A interface pages the subscriber and delivers the SM. The delivery result is
returned to the MSC MAP via the A interface.
When the MSC MAP receives the final delivery result, it returns the delivery
result to the MC MAP. The delivery may be either successful or unsuccessful.
If it is unsuccessful, the returned result contains the specific failure cause (e.g.
the subscriber does not have the right or the subscriber does not respond to the
paging). The SC may start the corresponding resending mechanism according
to the specific cause.
4. MAP signaling description
● SMSDPPREQ (ACK): This message is used to deliver an SM.
● SMS request: When the SC delivers an SM, this message is used to request for
routing information.
3.1.4.3 SM Notification Procedure
The above-mentioned mobile-terminated SM signaling procedure is based on the
150
assumption that the MS can normally receive short messages.
However, in practice the MS may be unreachable and thus not be able to receive the
SM for the time being. If the SC fails to send a short message to the MS, the SC may
use different re-sending mechanisms depending on the settings of the SC.
1. Forced retransmission
If the current MS is unreachable, the SC will attempt to resend the SM of a high

priority.
2. Timed retransmission
The SC will place the failed short message in the scheduled sending queue and
re-send the message when the scheduled resend time is up.
3. Alert retransmission
When the SC receives a prompt message indicating that the MS is reachable, it

will attempt to resend the SM to that MS.
Here, we will describe the alert retransmission mechanism further. The alert
retransmission procedures are different depending on different failure causes
(e.g. the MS is powered off or the MS is unreachable).
1) SMS Delivery Pending Flag (SMSDPF)
Before introducing the alert retransmission procedure, we must introduce the

SMSDPF. Its change is the key to deciding whether to generate a notification
message.
The SMSDPF (SMS Delivery Pending Flag) is used to record the status of the
current SM sent to the destination subscriber at the network side. If the SC fails
to send an SM to the network side, it sets this flag as valid in the database.
When the MS or the network can receive the SM again, the SC will be notified
of such according to this flag, so as to resend the SM. After successful sending,
this flag is cleared.
2) Power-on notification procedure
When the MS is powered on and sends a registration message to the HLR, the
HLR finds that the SMSDPF of this MS is set, indicating that the SM to this
MS is not received normally because the MS is switched off. The HLR then
151
sends a notification message to the SC, telling the SC to resend the SM to that
MS. Figure 3.1-14 shows the procedure.
B SS A口 VLR MAP MSC MAP H LR M AP MC M AP SC

c s m Mt R eq
The de st h as powe r of f c m SM S R eq
Set SM SDPP Flg = 1
c mS M SR s p
c sm M t Ac k
Po w er O n
Ins ert in Ret ry Q ueue
c av L oc U p da t e Re q
cm R eg N o tR e q
cm R eg N o tR s p
c m SM S No t R eq
cv a Lo c U pd a te R s p
cs m S MS N o tR e q
S uc c
Cle ar the SMS DPPF lag
cs m SM S N ot R sp
c m SM S N ot R s p
SMS Te rmin ati on C all
Figure 3.1-14 HLR Notification Procedure
Descriptions:
Signaling exchange between the SC and the MC MAP: It is the process in

which the service server delivers the SM to the SC signaling gateway.
Signaling exchange between the MC MAP and the HLR MAP: The HLR finds
that the MS is not activated (powered off), so it sets the SMSDPF and returns
the route query result to the HLR. The SC stops delivering the SM.
Signaling exchange between the BSS, the A interface, the VLR MAP and the
HLR MAP: After the MS is powered on, the A interface notifies the VLR of the
power-on. The VLR finds that the database does not contain the information of
this subscriber and then initiates a location registration request to the HLR. The
HLR returns a location registration response and at the same time finds that the
152
SMSDPF is set.
Signaling exchange between the HLR MAP, the MC MAP and the SC: The
HLR sends a notification request to the SC, telling the SC that the subscriber is
able to receive the SM for the time being. After the HLR receives a response, it
will clear the SMSDPF.
The SC redelivers the SM again in the same procedure as the

mobile-terminated SM procedure, except that the SC does not need to request
for routing information from the HLR because the notification message will
inform the SC of the MSC where the called party resides.
3) Reachable notification procedure
When a subscriber is not in the service area, the SM sent to this subscriber from
the network will fail and the VLR will set the SMSDPF of this subscriber in its
database. When the subscriber returns to the service area and sends a location
update or a message to the network, the VLR will find that the SMSDPF of this
subscriber is 1 and then it will send an SM notification request to the SC.
Figure 3.1-15 shows the procedure.
153
BSS A口 VLR MAP MSC MAP HLR MAP MC MAP SC
csmMtReq
cmSMSReq
cmSMSReq
cmSMSRsp
cmSMSRsp
cmSMSDPPReq
SMS_Incoming Call
SMS_Incoming Call Ack
cmaSmsMtReq
ADDSPage Req Page No Response,
SMS Deliver Failure
Set SMSDPPFlag
ADDSPage Ack
camSmsMtAck
csvSetDPPFlgReq
Insert into Retry

csvSetDPPFlgAck Queue
cmSMSDPPRsp
User Active csmMtAck
cavLocUpdateReq
cavLocUpdateRsp
Succ cmSMSNotReq
cmsSMSNotReq
Clear SMSDPPFalg
cmsSMSNotRsp
cmSMSNotRsp
SMS Termination Call
Figure 3.1-15 VLR Notification Procedure
Descriptions:
The process from the SC to the MSC and then to the BSC is a standard
mobile-terminated SM procedure, as introduced previously. Below are the
differences only.
BSS-A interface-MSC MAP: When the A interfaces sends a paging request and
gets no response from the subscriber, it will feed back this information to the
MSC.
MSC MAP-VLR MAP: When the MSC receives the information from the A
154
interface, it will send a request to the VLR, asking the VLR to set the SMSDPF
of this subscriber to 1. After receiving this message, the VLR sets the SMSDPF
of this subscriber and returns a response.
MSC MAP-MC MAP–SC: The MSC returns the delivery failure result to the
signaling gateway with the specific failure cause. The signaling gateway notifies
the SC of this message and the SC starts the specific retransmission mechanism
according to the failure cause. Normally, we set this kind of failure as "stop
sending and wait for notification".
BSS-A interface-VLR MAP signaling: When the subscriber returns to the

service area and registers its location in the VLR via the A interface, the VLR
finds that the SMSDPF of this subscriber is set to 1.
VLR MAP-MC MAP-SC signaling: The VLR sends an SM notification request

to the SC signaling gateway with the specific failure cause. The signaling
gateway forwards this notification request to the service server, which will
return the response message to the VLR via the signaling gateway. The VLR
clears the SMSDPF of this subscriber.
After that, the SC delivers the short message to the subscriber. Please note that
the VLR will notify the MSC/VLR address of the subscriber to the HLR while
telling the HLR to resend the SM, so the VLR does not need to query the HLR
again during the retransmission process but the SM can be directly delivered to
the MSC/VLR where the called subscriber resides.
4) MAP signaling description
SMSNOT: This message is used to report the change of the SM receiving

capability of an MS.
3.1.5 Supplementary Services
3.1.5.1 Types of Supplementary Services
The CDMA IS41-3 defines altogether 22 kinds of supplementary services. The CDMA
CC can support the service procedures of these supplementary services.
● Call Forwarding Busy (CFB)
● Call Forwarding Default (CFD)
155
● Call Forwarding No Answer (CFNA)
● Call Forwarding Unconditional (CFU)
● Call Transfer (CT)
● Call Waiting (CW)
● Calling Number Identification Presentation (CNIP)
● Calling Number Identification Restriction (CNIR)
● Conference Call (CC)
● Do Not Disturb (DND)
● Flexible Alerting (FA)
● Message Waiting Notification (MWN)
● Mobile Access Hunting (MAH)
● Password Call Acceptance (PCA)
● Preferred Language (PL)
● Remote Feature Control (RFC)
● Selective Call Acceptance (SCA)
● Subscriber PIN Access (SPINA)
● Subscriber PIN Intercept (SPINI)
● Three-Way Calling (TWC)
● Voice Message Retrieval (VMR)
● Voice Encryption (VP)
3.1.5.2 Supplementary Service Operations
Supplementary service processing falls into two types of operations: Registration,

activation, deregistration and deactivation of supplementary services, which are
completed in the service request (FEATREQ); processing of supplementary services in
the call procedure.
For the supplementary services, seven operations are defined in the CDMA system:
1. Provisioning: An operation implemented by the service provider to make the
156
service available to the subscriber.
2. Withdrawal: An operation implemented by the service provider to make the

service unavailable to the subscriber.
3. Registration: An operation implemented by the service provider or subscriber to

make the service executable. It includes inputting necessary information.
4. Erasure: An operation implemented by the service provider or subscriber to

delete the information inputted at the time of registration.
5. Activation: It is used to make the service enter the "Ready" status.
6. Deactivation: Reverse operation of activation.
3.1.5.3 Involved Signaling
1. Qualification request (QUALREQ): Sent by the VLR to the HLR when the VLR
processes the registration or call signaling.
2. Feature service request (FEATREQ): Sent by the MSC to the HLR when a
subscribers requests for a supplementary service.
3. Qualification directive (QUALDIR): Sent by the HLR to the VLR of the MS

when the HLR finds that the profile or approval information of an MS changes.
3.1.5.4 Supplementary Service Request Procedure
Figure 3.1-16 shows the specific supplementary service request procedure.
The system needs to process the service request twice when a subscriber initiates a
supplementary service request: The MSC-initiated request procedure is shown in Steps
a - d in the following figure. After the request succeeded, the HLR initiates a
qualification directive shown in Steps e - f in the following figure to the VLR so as to
synchronize the database information.
157
MS MSC VLR HLR
Service code string

a
FEATREQ
b
featreq
c
Service operation Ack
d
QUALDIR
e
qualdir
f
Figure 3.1-16 Signaling Procedure of a Supplementary Service Request
a. The serving MSC receives the dialed digits. During dialed digit analysis, the
serving MSC finds the service code string.
b. The serving MSC sends a service request message (FEATREQ) including the
dialed digits to the MS-related HLR.
c. The HLR returns a service request response message (featreq), including the
service request acknowledgement indication or the parameters regarding the
measures to be taken by the MSC, to the serving MSC. If the call route is
provided after service operation acknowledgment, routing information must be
provided in the terminal list parameter.
d. Upon receipt of the featreq message from the HLR, the serving MSC processes
the served MS according to the information in the featreq message. In this case,
the service acknowledgement information shall be provided.
e. If the service request leads to the change of MS’s profile, the HLR should report
this change to the VLR in the qualification directive message (QUALDIR) so
that the VLR can modify the related supplementary service information in its
database.
f. The VLR sends a qualdir message (return result of the qualification directive
message) to the HLR.
158
3.1.5.5 Supplementary Service Description
1. Call Forwarding Unconditional (CFU)
When this supplementary service is activated for a subscriber, all the incoming
calls to this subscriber will be unconditionally forwarded to a third-party
subscriber registered by this subscriber. The third party here may be a
subscriber of a mobile network, public network or private network, or it may be
an entity such as the voice mailbox. The signaling procedure is shown in Figure
3.1-17:
Originating system
Origination
Call forwarding
CFU notification
Figure 3.1-17 Call Forwarding Unconditional (CFU)
a. The originating MSC receives an Origination message and the mobile directory
number (MDN) of the MS.
b. The originating MSC sends the LOCREQ message to the MS-related HLR,
which is determined by the MDN of the MS.
c. The HLR determines if the CFU service is activated or not according to the
Profile of the MS. It sends the locreq message to the originating MSC. In this
message, the terminal list parameter provides the forwarded-to number and other
159
routing information.
d. The originating MSC sets up a call connection according to the specified

forwarded-to number.
e. The HLR sends an information directive message (INFODIR) to the VLR in

which the MS is registered if it determines the necessity to tell the MS that the
call is forwarded.
f. The VLR sends an INFODIR message to the serving MSC, instructing the
serving MSC to send an Alert message to the MS.
g. The serving MSC sends the Alert message to the MS according to the alert mode
specified by the alert code parameter in the INFODIR message if the MS is idle.
h. The serving MSC sends an information directive message response (infodir)

including the alert result to the VLR.
i. The VLR sends the infodir message to the HLR.
& Note:
When the MSC/VLR/SSP queries the location of the called from the HLR, the HLR
will determine if the CFU service preset by the subscriber is available. If it is available,
the HLR will notify the forwarded-to number in the return message to the MSC and the
MSC will connect the call to the forwarded-to number.
2. Call Forwarding Busy (CFB)
When this supplementary service is activated for a subscriber, all the incoming
calls to this subscriber will be forwarded to a third-party subscriber registered by
this subscriber if this subscriber is busy. Figure 3.1-18 shows the signaling
procedure.
160
Originating system
Origination
Forward the call
Figure 3.1-18 Call Forwarding Busy (CFB)
a. The originating MSC receives an Origination message and the mobile directory
number (MDN) of the MS.
b. The originating MSC sends the LOCREQ message to the MS-related HLR,
which is determined by the MDN of the MS.
c. If the MDN of the MS is assigned to a legal subscriber, the HLR sends the
ROUTREQ message to the VLR in which the MS is registered.
d. The VLR sends the ROUTREQ message to the current serving MSC.
e. The serving MSC checks the internal data structure of the ROUTREQ message
and finds that the MS is being engaged in another call. It returns the status of the
MS in the routreq message to the VLR.
f. The VLR sends the routreq message to the HLR.
g. The HLR determines if the CFB service is activated or not according to the
Profile of the MS. It sends the locreq message to the originating MSC. This
message carries the forwarded-to number and the other routing information in
h. The originating MSC sets up a call connection to the forwarded-to number.
161
3. Call Forwarding No Answer (CFNA)
No answer means that the called mobile subscriber does not hook off after the
called MS rings for a long time. When the CFNA service is activated for a
subscriber, all incoming calls of this subscriber will be forwarded to a third party
if this subscriber does not answer. Figure 3.1-19 shows the signaling procedure.
MSC/VLR/SSP(1) HLR MSC/VLR/SSP(2)
Origination Call
LocationReq(Called number)
RouteReq(Called number)
RouteResult(TLDN)
LocationResult(TLDN)
Connect to called number but Timeout for called no answer
TransToNumReq(Forwardreason,MIN)
TransToNumRsp(forward number)
Connect to the forward number
Figure 3.1-19 Implementation of CFNA
The HLR queries the serving MSC/VLR/SSP(2) and gets the routing
information (TLDN) of the called subscriber. It carries the TLDN in the
response message sent to MSC/VLR/SSP(1), so that MSC/VLR/SSP(1) directs
the call to the terminal according to this TLDN. The called MS rings but does
not answer. The no answer signal is sent back to MSC/VLR/SSP(1).
MSC/VLR/SSP(1) checks the CFNA flag in the subscriber’s profile information
and finds that the subscriber has registered the CFNA service, so it queries the
CFNA number of the subscriber from the HLR (via the TransToNumReq
message). The HLR sends the CFNA number to MSC/VLR/SSP(1) via the
acknowledgement message and then MSC/VLR/SSP(1) directs the call to the
forwarded-to number.
4. Call Forwarding Default (CFD)
162
CFD means forwarding all incoming calls of a mobile subscriber to a third party
when this subscriber does not respond to paging, does not answer the call or is
unavailable (in a blind spot). It is equivalent to a combination of CFB and
CFNA. For the implementation of CFD, please refer to the implementation of
CFB and CFNA discussed just ahead.
3.2 A Interface Service Procedures
3.2.1 Overview
The logical structure of the access network interface is shown in Figure 3.2-1.
MSC
Call control
IWF MM Switching
...
A1 A2 A5
Reference point A
Target BS Source BS
A3 (traffic)
BSC A8 (traffic) A10 (traffic)
BSC
A3 (signaling) PDSN
SDU A9 (signaling) PCF A11 (signaling)
A7 (signaling)
Reference point Aquater

BTS BTS Reference point Aquinter
Reference
point Ater
Figure 3.2-1 Reference Model of the Access Network Interface
The reference model comprises reference points A, Ater, Aquinter and Aquater.
However, only reference point A is related to the switch and includes the following
interfaces:
A1, A2 and A5.
A1 Transmits signaling messages between the MSC (call control and mobility
163
management) and the BS (BSC call control).
A2 Transmits 64 kbps /56 kbps PCM information (voice/data) or 64 kbps unrestricted

digital information (UDI, used for ISDN) between the switching part of the MSC and
the following units.
-- BS channel unit in the case of the analog air interface -- Selection/Distribution Unit
(SDU) in the case of voice calls via the digital air interface
A5 Transmits the full duplex data flow between the IWF and the SDU.
3.2.2 Call Processing
In the following call processing functions, inter-BS hard handoff may take place. In
such a hard handoff procedure, it should be supposed that the target BS exercises the
functions that a BS in the normal case (i.e. no handoff occurs) should exercise. For
example, the new serving BS (target BS) should send the Connect message to the MSC
after receiving the Connect Command message from the air interface if inter-BS hard
handoff occurs when the MS is called and is waiting for answer, even if the BS does
not participate in the previous part of the call setup procedure.
3.2.2.1 Call Control
Call control is implemented by the MSC. The BS provides message transfer and
interoperation between the air interface and the MSC.
● Terrestrial circuit assignment
Terrestrial circuit assignment will be managed in the following mode:
The MSC thinks that the interface to the BS is a route composed of n circuits. It
should ensure that the selected terrestrial circuits support this type of call.
The BS may suggest an available terrestrial circuit to the MSC and the MSC
should select the suggested terrestrial circuit if the circuit is available.
● Radio channel assignment
When the BS has multiple cells, it may select a radio channel from the
corresponding cell. The selection may be based on the information it receives
from the MSC.
● Traffic channel release
The release of resources is controlled by the MSC. However, the BS may also
164
request the MSC to release a call due to radio propagation or other reasons.
3.2.2.2 Setup of a Voice or Circuit Data Call on the A1 Interface
This section describes the mobile-originated call setup procedure and the
mobile-terminated call setup procedure.
● Mobile-originated (MO) call
The following MSC-BS messages will be involved in the MOC setup procedure:
1. Complete L3 Info with CM Service Request
2. Assignment Request
3. Assignment Failure
4. Assignment Complete
5. Progress
6. PACA Command
7. PACA Command Ack
8. PACA Update
9. PACA Update Ack
These messages are described in detail below:
1. CN Service Request
Upon receipt of the initial access probe from the MS, the BS constructs a CM
Service Request message, places it in the Complete L3 Info message and sends
the message to the MSC.
Since the CDMA air interface supports sending the failure processing message
(for example, the Recommand message) via the traffic channel to the MS, the
BS may select an effective channel based on the capabilities of the MS and
assign this channel to the MS at any time after receiving the initial access
message from the MS.
Successful operation:
In the MO call case, the BS starts timers T303 and T3230 and sends a CM
Service Request message to the MSC. The Complete L3 Info message and the
165
MSC’s response will also be used for connection setup.
In the access probe handoff case, the source BS (the BS receiving the initial
access probe) may select to send the second CM Service Request message to the
MSC when it receives the initial request message from the same MS and the
same call forwarded by other BSs via the A7 connection. In the other cases (e.g.
Silent Reorigination), the BS may receive multiple origination messages from
the same MS and may select to send the CM Service Request message for the
second time to the MSC. For the MS that has completed the initial probe
procedure, the MSC should send a Clear Command message with the cause
value being "Not notify the MS" to the source BS as the response to the multiple
CM Service Request messages. In addition, the BS should be able to process the
Clear Command message from the MSC.
The BS may select an effective channel based on the capabilities of the MS and
assign this channel to the MS at any time after receiving the initial access
Failure handling:
If the BS does not receive the Assignment Request message, PACA Command
message (if the call satisfies the PACA service condition) or Clear Command
message till timer T3230 expires, it will send a Recommand or Release message
to the MS. If the lower-layer transmission connection (SCCP connection) exists,
the BS will send a Clear Request message with the cause value being "Timer
expired" to the MSC so as to start call clearance processing.
Abnormality handling:
To clear the call as a response to the CM Service Request, the MSC will send
the SCC CREF primitive to reject the connection request.
2. Complete L3 Info
The BSMAP Complete L3 Info message contains the CM Service Request

message, Page Response message or Location Updating Request message. For
the operation results, please refer to the descriptions of the specific messages.
The MSC sends this BSMAP message to the BS to request for radio resource
166
assignment. If the SCCP Connection Confirm message is not sent yet, the
Assignment Request message will be used as the SCCP Connection Confirm
message.
After sending this message to the BS, the MSC starts timer T10 and waits for an
Assignment Complete message from the BS.
Upon receipt of the Assignment Request message, the BS stops timer T303,
selects a traffic channel of the appropriate type, sends an assignment command
to the MS, and then waits for the MS to return an acknowledgement message.
Failure handling:
If the MSC does not receive the Assignment Complete message or the
Assignment Failure message before timer T10 expires, it will initiate the call
clearance procedure.
This BSMAP message indicates the requested assignment has been completed
correctly. The Assignment Complete Message may also be sent to tell the MSC
that, if necessary, the BS will provide inband processing of the call.
When the MS successfully arrives at the assigned traffic channel, the BS will
send this message to the MSC. At this time, the BS will regard the call as
having entered the conversation status.
Upon receipt of this message, the MSC stops timer T10. At this time, the MS
will regard the call as having entered the conversation status.
Failure handling:
None.
This BSMAP message is sent from the BS to the MSC to indicate that the
requested assignment cannot be correctly completed.
167
When finding that the assignment cannot be completed, the BS sends the
Assignment Failure message, starts timer T20 and waits for the MSC to return
an Assignment Request, Service Release or Clear Command message.
Failure handling:
If the BS does not receive any response before timer T20 expires, it will send a
Clear Request message to the MSC.
6. Progress
The MSC sends this DTAP message in any call control process to
generate/remove the specified local tone.
When receiving the Progress message from the MSC, the BS will take the
corresponding action to request the MS to generate the indicated local tone.
After the Progress message is sent to instruct the MS to generate the specified
local tone, the MSC should delay the sending of any call clearing message and
the BS should know the time needed for the MS to generate the local tone.
Failure handling:
None.
● Mobile-originated call procedure
Below is the typical signaling procedure of a mobile-originated call.
168
Time Note
MS BS MSC
Origination Message
a
Base Station Ack Order
b
Complete L3 Info: CM Service Request
c
T303 Assignment Request
d
Channel Assignment
Message
e
Tch Preamble
f
BS Ack Order
g
MS Ack Order
h
Service Connect
Message i
Service Connect T10
Completion j
Assignment Complete
k
Ringback tone
l Transparent
transmission
signaling
Figure 3.2-2 Mobile-Originated Call (MOC)
a. The MS sends an Origination message with an L2 Ack request to the BS via the
access channel of the air interface, so as to request for services.
b. The BS sends the Base Station Ack Order to the MS after receiving the
Origination message.
If the BS decides that the resources (e.g. traffic channels) are unavailable, it may
execute the processing procedure as described in Section 5.2.2.3.1. Otherwise,
the call would continue.
c. The BS constructs a CM Service Request message, places it in the Complete L3

Info message and sends the message to the MSC. At the same time, it starts
timer T303. For a circuit call, the BS may request the MSC to assign the
preferred terrestrial circuit.
If using the unique challenge procedure, the MSC will wait for the
authentication acknowledgement message during the call setup. When receiving
an authentication failure indication, the MSC may clear this call. In addition, the
MSC may provide certain inband processing such as voice or notification,
169
depending on the MSC manufacturer’s choice.
d. The MSC sends an Assignment Request message to the BS, requesting the BS to
assign radio resources. If a terrestrial circuit is used between the MS and the BS,
the message will include the information of this terrestrial circuit.
If the CM Service Request indicates that the BS requested for the preferred
terrestrial circuit and the MSC supports this terrestrial circuit, the MSC will use
this terrestrial circuit in the Assignment Request message. Otherwise, the MSC
will assign another different terrestrial circuit.
e. If the "Include priority” bit in the Radio Environment and Resources

information element of the CM Service Request message is set to 1, indicating
that there is no available channel with a lower priority (e.g. when the PACA
channel reservation scheme is used), the MSC will include the current priority.
Upon receipt of the Channel Request message, the BS stops timer T303.
If an idle traffic channel is available for this call and currently the MS is not on
this traffic channel, the BS will send a Channel Assignment message (that
carries the address of the MS) on the paging channel of the air interface to the
MS, so as to initiate the setup of the radio traffic channel.
If the BS cannot assign resources (e.g. traffic channel) to this call due to any
reason and the call is assigned the PACA service, the BS will queue the call
request and notify the reason and the queuing position to the MS (see Section
5.2.2.3.1). The BS sends the Assignment Failure message to the MSC. In this
message, the cause value is "PACA call queuing”. The MSC starts the normal
call clearance procedure as described in Section 5.3, so as to release the
lower-layer transmission connection.
When a traffic channel is available, the BS will send a PACA message to instruct
the MS to re-initiate the call.
f. The MS sends the Tch Preamble via the assigned reverse traffic channel.
g. After getting the reverse traffic channel, the BS sends the BS Ack Order with the
L2 Ack request to the MS via the forward traffic channel.
h. After getting the BS Ack Order, the MS sends an MS Ack Order to the BS and
sends the null traffic channel data (null TCH data) via the assigned reverse
traffic channel.
170
i. The BS sends the Service Connect Message/service selection response message

j. After receiving the Service Connect Message, the MS sends a Service Connect
Completion message.
k. After the radio traffic channel and terrestrial circuit are established and fully
interconnected, the BS sends an Assignment Complete message to the MSC.
The call is regarded as entering the conversation status.
The MSC stops timer T10.
l. When the call progress tone is provided via the inband channel, the ringback
tone will be sent via the speech circuit to the MS.
● Mobile-Terminated Call (MTC)
The following MSC-BS messages will be exchanged in the MTC setup

procedure:
1. Paging Request
2. Complete L3 Info with Page Response
6. Alert with Info
7. Connect
These messages are described in detail below:
1. Paging Request
The MSC sends this BSMAP message to the BS to initialize the MS-terminated
call setup procedure. This message may also be sent in the other cases such as
location changes.
If the MSC confirms that the called MS is in its service area, it will start the
paging procedure. It triggers timer T3113, sends a Paging Request message to
171
the BS and waits for the Complete L3 Info message with the Page Response.
Upon receipt of the Paging Request message, the BS first determines to which
groups of cells it should broadcast the paging request and then distributes the
paging message to these cells via the paging channel. The paging message may
be inserted into the computed timeslot.
Failure handling:
If the MSC does not receive the Page Response message before timer T3113
expires, it will resend the Paging Request message and reset timer T3113.
2. Page Response
This DTAP message is sent from the BS to the MSC as the response to the
Paging Request message after a Page Response is received from the MS. The
Page Response and the follow-up MSC response are used to set up a connection.
When the MS identifies a Paging Request message that carries its identification
code, it will send a response message to the BS. The BS uses the information
received from the MS to reconstruct a Page Response message and places it in
the Complete L3 Info to send to the MSC. The BS starts timers T303 and T3230.
The MSC stops timer T3113.
In the access probe handoff case, the source BS (the BS receiving the initial
access probe) may select to send the second CM Service Request message to the
MSC when it receives the Page Response message from the same MS and the
same call forwarded by other BSs via the A7 connection. For the MS that has
completed the MT call probe procedure, the MSC should send a Clear
Command message with the cause value being "Not notify the MS" to the
source BS as the response to the Page Response message. In addition, the BS
should be able to process the Clear Command message from the MSC.
The BS may select an effective channel based on the capabilities of the MS and
assign this channel to the MS at any time after receiving the paging
acknowledgement message from the MS.
Failure handling:
The BS will not take any action if it does not receive the Page Response
172
If the BS does not receive the Assignment Request message or the Clear
Command message before timer T303 expires, it will send a Release message to
the MS and clear all the relevant resources.
Abnormality handling:
If the call is inactive when the MSC receives the Page Response message, the
MSC will clear this call.
See Section 3.3.2.1.
Note that the BS will regard the call as having entered the conversation status
after the BS/MSC sends/receives the Connect message in the MOC case.
6. Connect
This DTAP message is used to tell the MSC that the called MS has answered the
call (hooked off)
When the BS receives the notification that the called MS has answered the call,
it triggers timer T313 and sends the Connect message to the MSC.
Upon receipt of the Connect message, the MSC connects the two parities of the
conversation and stops timer T301.
Failure handling:
If the MSC does not receive the Connect message before timer T301 expires, it
will take other actions (e.g. provide a notification message or forward the call).
The specific action is determined by the operator.
7. Alert with Info
173
This DTAP message is sent from the MSC to the BS. Upon this message, the
BS sends an Alert with Info message via the air interface.
The MSC sends this message to the BS, so as to request the BS to send the Alert
with Info message via the air interface. For example, the MSC may send this
message when the MS has made a soundless prompt during the MTC
establishment procedure, so that the MS generates a sound prompt. This
message may be used for other mobile control.
Failure handling:
None
● Mobile-terminated call procedure
Typical mobile-terminated call setup procedure:
174
Time
MS BS MSC
Paging Request
a
Page Message
b
T3113
Page Response Message
c
Paging Response
d
Base Station Ack Order T303
e
Assignment Request
f
Channel Assignment Message
g
Tch Preamble
T10
h
BS Ack Order
i
MS Ack Order
j
Service Connect Message
k
Service Connect Completion
l
Assignment Complete
m
Alert with Info
n
MS Ack Order
o
Connect Order
p
T301
BS Ack Order
q
Connect
r
Figure 3.2-3 Mobile-Terminated Call (MTC)
a. When finding that the called MS is in its service area, the MSC sends a Paging
Request message to the BS to initiate the MTC setup procedure. The MSC
175
starts timer T3113.
b. The BS sends the Page Message with the MS identification code via the paging
channel.
c. The MS identifies a Paging Request message that carries its identification code
and then sends a Page Response message via the access channel to the BS.
d. The BS uses the information received from the MS to construct a Page Response
message and places it in the Complete L3 Info to send to the MSC. At the same
time, the BS starts timer T303. The BS may request the MSC to assign a
preferred terrestrial circuit.
Upon receipt of the Page Response message, the MSC stops timer T3113.
e. After receiving the Page Response Message sent by the MS, the BS sends the
Base Station Ack Order via the air interface.
f. The MSC sends an Assignment Request message to the BS to request for radio
resource assignment. If the SCCP Connection Confirm message is not sent yet,
the Assignment Request message will be used as the SCCP Connection Confirm
message. If a terrestrial circuit is used between the MSC and the BS, this
message will also contain the information of this terrestrial circuit. The MSC
starts timer T10 after sending the message.
If the MSC supports the preferred terrestrial circuit as requested by the BS, it
will use this terrestrial circuit in the Assignment Request message. Otherwise,
the MSC will assign another different terrestrial circuit.
Upon receipt of the Channel Request message, the BS stops timer T303.
g. If the MS is not on a traffic channel, the BS will send a Channel Assignment

message via the control channel of the air interface so as to initiate the setup of a
radio traffic channel.
h. The MS starts to send the Tch Preamble via the reverse traffic channel.
i. After getting the reverse traffic channel, the BS sends the BS Ack Order with the
L2 Ack request of the MS to the MS via the forward traffic channel.
j. The MS sends an MS Ack Order to respond to the BS Ack Order.
k. The BS sends the Service Connect Message/service selection response message

176
l. After receiving the Service Connect Message, the MS sends a Service Connect
Completion message.
After the radio traffic channel and terrestrial circuit have been established, the
BS sends an Assignment Complete message to the MSC.
m. Upon receipt of the message, the MSC stops timer T10 and starts timer T301.
n. The BS sends an Alert with Info message to alert the MS.
o. After receiving the Alert with Info message, the MS sends an MS Ack Order to
the BS.
p. When answering this call (hooking off), the MS sends the Connect Order with
the L2 Ack request to the BS.
q. After receiving the Connect Order, the BS sends the BS Ack Order to the MS
via the forward traffic channel.
r. The BS sends the Connect message to the MSC, telling the MSC that the MS
has answered this call. At this time, this call is regarded as having entered the
Upon receipt of the Connect message, the MSC stops timer T301.
3.3 IUP/ISUP Service Procedures
3.3.1 TUP Signaling Procedures
located as an example to describe the TUP telephone call signaling procedures. Such
signaling procedures are applicable to the scenario where a mobile subscriber calls a
local fixed subscriber or a roaming mobile subscriber calls a fixed subscriber in the
visited place.
3.3.1.1 When the Called Subscriber Is Idle
Figure 3.3-1 shows the call connection procedure when the called subscriber is idle.
177
Gatewa TM/LS
MSC
y
IAI
IAI
ACM
ACM
Ringback tone
ANC
ANC
Conversation
CBK The called

CBK hooks on
first
CLF
CLF
RLG
RLG
The caller
hooks on CLF
first CLF
RLG
RLG
3.3.1.2 When the Called Subscriber Is Busy
Figure 3.3-2 shows the call connection procedure when the called subscriber is busy or
when the line is out of service.
178
MSC Gateway TM/LS
IAI
IAI
SLB STB LOS SST

SLB STB LOS SST
CLF
CLF
RLG
RLG
Figure 3.3-2 Call Connection Procedure when the Called Is Busy
The MSC receives a signal such as SLB or STB that indicates the call cannot be
connected, so it sends the CLF and delivers a command via the air interface to request
the Mobile Station (MS) to generate the busy tone. After receiving the LOS and SST,
the MSC sends the CLF and sets up a radio voice channel on which to send the specific
announcement to the MS.
3.3.1.3 When the Called Subscriber Is Unallocated
unallocated.
179
MSC Gateway TM/LS
IAI
IAI
UNN
UNN
CLF
CLF
RLG
RLG
Figure 3.3-3 Call Connection Procedure when the Called Is Unallocated
After receiving the UNN signal, the MSC shall send the CLF, release the connection
and send a command via the air interface to ask the MS to generate the unallocated
number tone or set up a radio voice channel on which to send an announcement.
3.3.1.4 Congestion Occurs when the Call Reaches the Tandem Exchange
Figure 3.3-4 shows the call connection procedure when the call reaches the tandem
office and congestion occurs.
MSC Gateway TM/LS
IAI
Congestion occurs when the

call reaches the tandem
exchange
CGC
SEC
CLF
RLG
Figure 3.3-4 Call Connection Procedure when the Call Reaches The Tandem Office and Congestion
180
Occurs
3.3.2 ISUP Signaling Procedures
3.3.2.1 ISUP Call Setup Procedures
The call control protocol of the ISUP is designed on the consumption that telephone
voice services and non-voice services employ the uniform protocol. It cooperates with
the third layer of the user/network D channel protocol to implement call control of
multiple circuit switched services and control of supplementary services.
Below we take the CFB as an instance to describe the supplementary service setup
procedure.
The CFB service allows the served subscriber to forward all incoming calls destined to
the served subscriber’s ISDN number (or only related to a specific basic service) to
another ISDN number without affecting the origination service of the served subscriber
when the served subscriber’s ISDN number is busy.
● Successful supplementary service setup procedure
Figure 3.3-5 shows the signaling procedure of CFB success.
MSC/TSMC GMSC/MSC M-ISUP MSC MSc

MSa M-ISUP
MSb is busy
IAM
IAM
ACM
ACM
ANM
ANM
Conversation
REL REL
RLC
RLC
Figure 3.3-5 CFB -- Success Case (Taking Place at the Originating MSC)
● Unsuccessful supplementary service setup procedure
Figure 3.3-6 shows the signaling procedure of CFB failure.
181
MSC/TSMC GMSC/MSC M-ISUP MSC

MSa M-ISUP MSc
MSb is busy
IAM
IAM
REL REL
RLC
RLC
Figure 3.3-6 CFB -- Failure Case (Taking Place at the Originating MSC)
3.3.2.2 Signaling Cooperation
● ISUP-ISUP cooperation
Below is an example of the cooperation between the mobile ISUP and the PSTN
ISUP.
MSC/TSMC GMSC/MSC TM/LS

M-ISUP ISUP
IAM
IAM
ACM
ACM
ANM
ANM
Conversation
REL
REL
RLC The caller hooks on first
RLC
REL REL
The called hooks on first
RLC
RLC
Figure 3.3-7 Normal Location Connection from Mobile ISUP to PSTN ISUP
● ISUP-TUP cooperation
Below is an example of the cooperation between the mobile ISUP and the PSTN
TUP.
182
MSC/TSMC GMSC/MSC TM/LS

M-ISUP TUP
IAM
IAI
ACM ACM
ANC/ANN
ANM
Conversation
CLF
The caller hooks on first
REL RLG
RLC
CBK
REL The called hooks on first
CLF
RLC
RLG
Figure 3.3-8 Normal Location Connection from Mobile ISUP to PSTN TUP
183
3.4 Intelligent Network Service Procedures
3.4.1 PPC Subscriber-Originated Call
SSP HLR SCP
ORREQ[MSCID, MSID, MDN, BILLID, DGTSDIAL, TRIGTYPE(36)

a
orreq [DMH_SVCID]
b
ANLYZD[MSCID, TRANSCAP, WINCAP, MSID,
MDN, BILLID,TOD,TDO,TRIGTYPE(37) ]
c
anlyzd[]
d
LOCREQ(MSCID,BILLID,DGTSDIAL,SystemTypeCode)
e
f
OANSWER[TDO,TOD, TRIGTYPE(40)
g
End of conversation
ODISCONNECT[TDO,TOD, TRIGTYPE(41) ]
h
odisconnect[]
i
Figure 3.4-1 Signaling Procedure of a PPC Subscriber-Originated Call
a. The SSP sends the origination request message (ORREQ) to the SCP and sets
the TRIGTYPE to Origination_Attempt_Authorized, indicating the trigger type
currently used. The other important parameters include MSCID (to identify the
switch), MSID (to identify the subscriber), MDN and BILLID (billing ID, used
for unique identification of a call among different dialogs between the SSP and
the SCP).
b. The SCP indicates through the DMH_ServID (128) in the response message
orreq that the PPC service is activated.
c. The SSP sends the information analysis request message (ANLYZDREQ) to the
184
SCP and sets the TRIGTYPE to Calling_Routing_Address_Available, indicating

the trigger type currently used. The other important parameters include the
MSCID, TRANSCAP (indicating the current processing capability of the
switch), WINCAP (indicating the capability of the switch to support WIN
operation and trigger assembly), MSID, MDN, BILLID, and RoutingInfo
(including the called address).
d. . The SCP returns a null anlyzd response message.
e. The SSP sends a location request message to the called HLR, requesting the
HLR to provide the called subscriber’s location information.
f. The HLR returns the called subscriber’s location information.
g. The SSP connects the call to the called and then sends the O-ANSWER message
including the call answer time (TimeOfDy, TimeDateOffset) to the SCP after the
called subscriber answers.
h. Upon completion of the call, the SSP sends the O_DISCONNECTREQ message
that includes the call end time (TimeOfDy, TimeDateOffset) to the SCP.
I. The SCP returns the o_disconnect response message.
185
3.4.2 PPC Subscriber-Terminated Call
SSP HLR SCP SSP
LOCREQ(MSCID,BILLID,,DGTSDIAL,TRIGTYPE(32),
TRANSCAP,WINCAP)
a
locreq [MSCID, MIN, Profile{TRIGADDRLIST}] b
ANLYZD [MSCID, BILLID, DGTSDIAL, MSID, TRIGTYPE(38)]

c
anlyzd [DMH_SVCID]
d
LOCREQ(MSCID,BILLID,,DGTSDIAL,TRIGTYPE(34)
TRANSCAP,WINCAP)
e
ROUTREQ [MSCID,BILLID,MIN,TRIGADDRLIST(69,70)]
f
Routreq[TLDN]
g
h
ANLYZD[MSCID, MSID,MDN,BILLID,RoutingInfo,REDIND, TRIGTYPE(39), TOD,TDO]

i
anlyzd []
j
TANSWER[MSCID,MSID, BILLID,TRIGTYPE(69),TOD,TDO]
k
End of conversation
TDISCONNECT[TDO,TOD, TRIGTYPE(70) ]
l
tdisconnect[]
m
Figure 3.4-2 Signaling Procedure of a PPC Subscriber-Terminated Call
a. The originating MSC/SSP triggers the Mobile_Termination trigger and sends

LOCREQ to the HLR. In this message, the TRANSCAP parameter indicates that
the MSC/SSP is able to process the TRIGADDRLIST parameter while the
TRIGTYPE parameter indicates that the Mobile_Termination trigger has been
triggered.
b. The HLR sends the locreq message to the originating MSC/SSP. In addition to
the other mandatory parameters, the locreq message contains TRIGADDRLIST
in the profile information as well as triggers Initial_Termination, Location and
Called_Routing_Address_Available.
186
c. The originating MSC/SSP triggers the Initial_Termination trigger and sends the
ANLYZD message to the SCP specified in the TRIGADDRLIST parameter. In
this message, the TRIGTYPE parameter indicates that the Initial_Termination
trigger is triggered.
d. The SCP determines that the subscriber has activated the PPC service and the
subscriber’s balance is sufficient, so it sends the anlyzd message to the
originating MSC/SSP. In this message, the DMH_SVCID parameter indicates to
execute the PPC service with DMH_SVCID=128.
e. The originating MSC/SSP triggers the Location trigger and sends the LOCREQ
message to the HLR. In this message, the TRIGTYPE parameter indicates the
Location trigger is triggered.
f. The HLR determines to continue with call processing and sends the ROUTREQ
message to the VLR. The VLR forwards the ROUTREQ message to the serving
MSC/SSP.
g. The serving MSC/SSP assigns a TLDN number and returns the result to the
HLR.
h. The HLR sends the locreq message that carries the location information of the
called subscriber to the originating MSC/SSP, instructing the MSC/SSP to
connect the subscriber.
i. The originating MSC/SSP prepares to terminate the call, triggers the

Called_Routing_Address_Available trigger and sends the ANLYZD message to
the related SCP.
j. The SCP sends the anlyzd message to the MSC/SSP.
k. The originating MSC/SSP establishes a call connection to the MS. After the MS
answers the call, the MSC triggers the T_Answer trigger and sends the
TANSWER message to the related SCP. The SCP starts billing and the two
parties talk.
l. When the caller hooks on, the serving MSC/SSP triggers the T_Disconnect
trigger and sends the TDISCONNECT message to the related SCP. This message
should include the caller onhook information in addition to the mandatory
parameters. The SCP then stops billing.
187
m. The SCP sends the tdisconnect message to the serving MSC/SSP. In this
message, the DMH_SVCID parameter indicates that the PPC service is executed.
The MSC/SSP releases the call.
Questions:
1. Briefly state the functions of the Message Transfer Part (MTP).
2. What types of signaling units are there? What are their purposes? And their
formats?
3. Which two parts does the signaling network function level involve? What
functions do they have?
4. Please state the basis of the message discrimination function and the message
distribution function.
5. How does the SCCP enhance the addressing functions of the MTP?
6. What is GT? What are its functions? What kinds of GTs are used in CDMA?
7. What kinds of services can the SCCP provide? What features do they have?
8. What kinds of SCCP messages are used by the MTP in the CDMA system? In
what scenarios are they used?
9. What are the principles of GT routing?
10. How about the three-level signaling network architecture in China?
11. What working modes are available for the signaling network? What are the
features of these modes?
12. What parameters are needed for CDMA system authentication? What modes are
generally available for the system to authenticate users?
13. When is location update needed in the CDMA system?
14. Please simply state the inter-office signaling procedure of a mobile-to-mobile

call.
15. In what devices may the SMSDPF flag be set during the short message
notification procedure? In what cases is it set by these devices?
16. Which operations are defined in the CDMA system for the supplementary
188
services?
17. What role does the MSC play during the A interface call procedure?
189
Course Objectives:
z Familiar with MSC/VLR data configuration principles
z Familiar with MSC/VLR data configuration specifications
z Master the specifications for digit analysis and configuration
z Master the specifications for GT digit analysis and making
References:
z Related specifications of Customer Service Department of CDMA
Division
1 MSC/VLR Data Configuration Principles
Key points：
：
Basic configuration sequence
Adjacent office connection principle
Precautions for configuration
1.1 Overview of Configuration Management System

The configuration management system of the ZXC10-MSC/VLR is a database
management system with complete functions. It manages all the data resources of the
switching system.
The various configuration data that is required for running the ZXC10-MSC/VLR
normally can be set through the configuration management system, which determines
the operation mode and status of the switch.
The course describes the basic sequence and main contents of the data configuration.
Please refer to ZXC10-MSC/VLR (V3.0.15) CDMA Mobile Switching Center/Visitor
Location Register Configuration Manual for details.
1.2 Basic Configuration Sequence

The configuration database of the ZXC10-MSC/VLR is very huge with complicated
and interrelated data, so data configuration must abide by a certain sequence.
Figure1.2-1 shows the basic configuration sequence of the ZXC10-MSC/VLR.
191
Configuration of MP
Basic Data
Physical
Configuration
Office Capacity
Configuration
Exchange
Configuration
VLR
Configuration
Signaling Link
Configuration
Trunk Circuit
Configuration
Switchover Office
Configuration
Tone Table
Configuration
GT Configuration
BSC
Configuration
Number Analysis
Data Synchronization
Figure1.2-1 Basic Sequence of MSC Data Configuration
O Caution:
Some configurations may not be completed at one time. For example, during the local
office data configuration, it is required to select several digit analysis selectors (DASs),
but these selectors must be configured after the completion of “digit analysis”. In this
case, during the configuration of local office data, the selection of DASs may be
192
Chapter 1 MSC/VLR Data Configuration Principles
delayed until the “digit analysis” is configured. Data can be synchronized only after
you make sure they are correct.
Detailed procedures:
1. MP basic data are generally configured after the installation and debugging are
completed. If file copying is required, the MP networking data should be
configured.
2. Configure a module in the sequence of Module → Rack → Shelf → Unit →

Subunit, configure other modules in this order, and set the networking
relationship among modules. Thus, the physical configuration is completed.
3. Perform capacity configuration for these modules respectively.
4. Perform office configuration without digit analysis selectors (DAS) selected.
5. Configure VLR system capacity, system parameters and multi-module load

distribution.
6. Configure the signaling links among offices.
7. Configure MSC and BSC trunk circuits; configure trunk route chains for MSC
to other offices, without DASs selected
8. Establish the trunk group relationship between the adjacent office and the local
office, and configure the handoff office.
9. Configure the tone table.
10. Configure the GT-related data, including numbering plan, mobile data, GT
translator, GT translation data, mobile number digit analysis and SSN data.
11. Configure the BSC-related data, including designating the trunk link to the BSC,
all location areas of the local MSC and the adjacent MSC, and the data of all
global cells in the local MSC.
12. Configure digit analysis data; set the DAS when configuring the virtual MSC in
the office configuration; configure the DAS on the inter-office trunk; no DAS is
selected for the trunk to the BSC.
Steps 1 to 12 are the basic configuration sequence of the ZXC10-MSC/VLR. After the
basic configuration, the following steps should be followed:
13. Check the running status of the office to ensure that the data is correct.
193
14. Perform the data synchronization in the “Send all” mode.
15. Reset MPs (including the active MP and standby MP) of each module.
16. Synchronize the data to the foreground in the “Send all” mode once more.
17. Back up data and prepare reports.
For the O&M system of the ZXC10-MSC/VLR, the basic configuration is the
foundation of O&M and thus must be mastered by the related personnel.
Configure the security variables and timers according to office situation and function
requirements after completing the data configuration.
1.3 Adjacent Office Connection Principle

The MSC’s peripheral modules increase with the expansion of the subscriber capacity.
To optimize the networking of the MSC switching network to reasonably share the load
of office IDs, as well as simplify the module networking, the following networking
principles are proposed to conduct the onsite expansion in a unified manner, which are
shown as follows.
1.3.1 Connection Principle of the Signaling Office ID
Signaling links in a signaling office ID must be distributed to two modules to

maximum extent, which implements signaling load share to ensure the other module is
running normally when one module is faulty on the one hand; and simplifies the
inter-module communications on the other hand.
1.3.2 Connection Principle of Trunk Circuits
Trunk circuits in one office ID must be evenly connected to two modules (the same as
the signaling link connection modules) to maximum extent.
1.3.3 Load Balance of Trunk Circuit and Signaling Link
When other connection principles are satisfied, a comprehensive consideration on the

even distribution of the load by all trunk circuits and signaling links of the MSC should
be taken, in order that the overall loads of modules are relatively even under the normal
traffic.
In the case of two peripheral modules, try to make the number of trunk circuits to the
194
Chapter 1 MSC/VLR Data Configuration Principles
adjacent office as the same as that of the signaling links.
In the case of three peripheral modules, try to make the trunk circuits and the signaling
links to the different adjacent offices evenly distributed to the different modules.
For example, if an MSC has three peripheral modules with three BSCs to be connected,
the recommended distribution is as follows:
1. The trunk circuits and signaling links of BSC1 are distributed to Module 3 and
Module 4.
Module 5.
Module 5.
When adding a adjacent office ID or creating a new MSC and expanding the capacity
of the peripheral module, please follow the principles above.
1.4 Precautions for Configuration

The configuration database is the core database of the system, and the integrity and
reliability of the data should be ensured. To keep maloperation from affecting the
system, the operation and maintenance personnel should note the following points
when configuring data:
1. Before data configuration, prepare the relevant office data that should be
accurate and reliable, and work out a complete data configuration scheme. A
good scheme can not only make data more clear and systematic, but also
enhance system reliability. For example, in the scheme, the active/standby
signaling link and trunk in the same office ID should be assigned to different DT
and STB boards to ensure normal operation of the system in case of damage and
replacement of boards, thus enhancing system reliability.
2. Before any data modification, existing data should be backed up. After the
modification, synchronize the data to the foreground, and immediately make two
copies of the data at the hard disk of local terminals and floppy disks
respectively, after making sure the data are correct. Moreover, the “Report" tool
must be used to periodically print the configuration data, and make hard copies.
195
That is, form the habits of Backup > Modify > Backup so as to avoid the loss
of data.
3. The data configured and modified in the maintenance terminal are effective only
after being transmitted to the foreground via synchronization. To modify
exchange data that are already plunged into service, careful checking shall be
made, and only after confirmation is made that no error exists, can the data be
sent to the foreground, so as to prevent any erroneous data from interfering with
the normal operation of the switching system.
4. The configuration data take effect immediately after being sent to the foreground
MP. However, to make the basic data (e.g., office capacity and table capacity)
take effect, first send them to MP, next reset MP, and then send the data to MP
again.
196
2 MSC/VLR Data Configuration
Specifications
Key points
MSC/VLR data configuration principles and specifications
Suggestions on the MSC/VLR Data Configuration
2.1 Specifications for Naming Module Number
2.1.1 Module Number Naming Principles
For easy to maintain, the commissioning personnel are required to properly name
modules according to their properties.
2.1.2 Suggestions on Module Name
For the single module MPM exchange: No.2 module is named as MPM2#.
For the dual-module MPM exchange (including those with HCOMM board for
networking): No.2 module is named as MPM2#, No.3 module as MPM3#.
For the central shelf multi-module exchange with MPMP board for networking:
No.1 module is named as MSM1#, No.2 module as SNM2#, No.3 module as
MPM3#, No.4 module as MPM4#, and so on.
For the central shelf multi-module exchange with HCOMM board for
networking: No.2 module is named as SNM2#, No.3 module as MPM3#, No.4
module as MPM4#, and so on.
2.2 Physical Unit Configuration Specifications
2.2.1 Configuration Principles
The commissioning personnel must take the HW line by default for physical
connection and data configuration.
197
The commissioning personnel must configure the board unit data according to
the configuration unit number specified here.
2.2.2 Recommended Configuration
The figure below shows the recommended system in full configuration. However, the
configuration may be carried out according to the actual conditions. The board
arrangement in the MPM module is shown below:
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2
S 1 2 3 4 5 6 7 8 9
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7
h
P D D D D D D A A A A P
el D D D D D D
O T T T T T T S S S S O
f T T T T T T
W E E E E E E I I I I W
6 I I I I I I
B C C C C C C G G G G B
S
P D D D D D D A A A A P
h D D D D D D
O T T T T T T S S S S O
el T T T T T T
W E E E E E E I I I I W
f I I I I I I
B C C C C C C G G G G B
5
S S S S S
P S M M M M M M M M P P
h T T T T M
O M M M P P P P P P P P E O
el B B B B O
W E P P M M P P P P P P P W
f 1 1 1 1 N
B M P P P P P P P P D B
4 6 6 6 6
D D D D D D D D D D
S
P S S D D S S S S S S S S S S P
h F F F F F F F F C
O Y Y D D N N N N N N N N N N O
el B B B B B B B B K
W C C S S I I I I I I I I I I W
f I I I I I I I I I
C K K N N - - - - - - - - - - C
3
C C S S S S S S S S
S
P D D D D D D D D P
h D D D D D D D D
O T T T T T T T T O
el T T T T T T T T
W E E E E E E E E W
f I I I I I I I I
B C C C C C C C C B
2
198
Chapter 2 MSC/VLR Data Configuration Specifications
S
P D D D D D D D D P
h D D D D D D D D
O T T T T T T T T O
el T T T T T T T T
W E E E E E E E E W
f I I I I I I I I
B C C C C C C C C B
1
The figure below shows the HW configuration by default, and the onsite connection
and configuration which should be conducted according to the HW connection as
below: HW line list in the MPM.
S 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2
1 2 3 4 5 6 7 8 9
h 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7
e P H H H H H H H H H H H H H H H H P
l O W W W W W W W W W W W W W W W W O
f W 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 W
6 B 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 B
S
H H H H
h P H H H H H H P
H H H H H H W W W W
e O W W W W W W O
W W W W W W 1 1 1 1
l W 1 1 1 1 3 3 W
4 5 6 7 8 9 2 2 2 2
f B 0 1 2 3 0 1 B
5 6 3 4
5
S
S S S S
h P S M M M M M M M M P P
T T T T M
e O M M M P P P P P P P P E O
B B B B O
l W E P P M M P P P P P P P W
1 1 1 1 N
f B M P P P P P P P P D B
6 6 6 6
4
H H H H
H H H H W W W W
S D D D D D D D D D D
W W W W 1 1 1 1
h P S S D D S S S S S S S S S S P
6 6 8 8 0 0 1 1 C
e O Y Y D D N N N N N N N N N N O
8 8 4 4 0 0 6 6 K
l W C C S S I I I I I I I I I I W
- - - - - - - - I
f C K K N N - - - - - - - - - - C
8 8 9 9 1 1 1 1
3 C C S S S S S S S S
3 3 9 9 1 1 2 2
5 5 1 1
199
S
h P H H H H H H H H H H H H H H H H P
e O W W W W W W W W W W W W W W W W O
l W 3 3 3 3 3 3 3 3 4 4 4 4 4 4 4 4 W
f B 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 B
2
S
h P H H H H H H H H H H H H H H H H P
e O W W W W W W W W W W W W W W W W O
l W 4 4 5 5 5 5 5 5 5 5 5 5 6 6 6 6 W
f B 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 B
1
On behave of the maintenance of the physical configuration unit, please perform the
configuration according to the principles below:
Configure the unit with HW board missing, add the unit number of it, and then
conduct the onsite configuration by default.
Set the unit number of the 16K DDSN and define the unit number as 1.
Set the unit numbers of the DTI, DTEC and ASIG of shelves 5, 6, 2 and 1 in
turn with a unit number range from 2 to 65.
After that, configure the unit number of the FBI with a unit number range from
66 to 69.
O Caution:
For convenience of future maintenance, during the commissioning and maintenance,

please strictly follow the unit numbers shown in the figure below to configure the unit
numbers of such boards as DTI, DTEC, ASIG and FBI. Skip the unit if there is no
board in the slot and continue to configure the boards left according to the specified
unit numbers.
1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2
1 2 3 4 5 6 7 8 9
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7
S
h P P
e O 1 1 2 2 2 2 2 2 2 2 2 2 3 3 3 3 O
l W 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 W
f B B
6
200
S
h P P
e O 1 1 1 1 1 1 1 1 O
2 3 4 5 6 7 8 9
l W 0 1 2 3 4 5 6 7 W
f B B
5
S
S S S S
h P S M M M M M M M M P P
T T T T M
e O M M M P P P P P P P P E O
B B B B O
l W E P P M M P P P P P P P W
1 1 1 1 N
f B M P P P P P P P P D B
6 6 6 6
4
U U U U U U U U U U U U
n n n n n n n n n n n n
i i i i i i i i i i i i
t t t t t t t t t t t t
S
w w w w w w w w w w w w
h P P
i i C i i i i i i i i i i
e O 6 6 6 6 6 6 6 6 O
t t K 1 1 t t t t t t t t t t
l W 6 6 7 7 8 8 9 9 W
h h I h h h h h h h h h h
f C C
o o o o o o o o o o o o
3
u u u u u u u u u u u u
t t t t t t t t t t t t
H H H H H H H H H H H H
W W W W W W W W W W W W
S
h P P
e O 3 3 3 3 3 3 4 4 4 4 4 4 4 4 4 4 O
l W 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 W
f B B
2
S
h P P
e O 5 5 5 5 5 5 5 5 5 5 6 6 6 6 6 6 O
l W 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 W
f B B
1
201
2.3 Trunk Board Configuration Specifications
1. Quantity of the DTECs in trunk shelf of each layer should be not more than 8.
2. The trunk boards are configured with the sequence of Shelf 5 > Shelf 6 > Shelf 2
> Shelf 1.
3. In the same trunk shelf, try to ensure an even distribution to the DTI and DTEC;
viewing from the front of the rack, configure DTIs and then DTECs rightwards.
4. Signaling links in the same office direction must not be configured on the same
trunk board.
5. Voice channels of the same trunk group must not be configured on the same
trunk board, and are not allowed to be configured on the trunk boards in a untidy
manner.
1. Quantity of the DTECs in trunk shelf of each layer should be not more than 8.
2. The sequence to configure the trunk shelves is shown as follows:
Set slots 3 ~ 16 of shelf 5
3. In the same trunk shelf, try to ensure an even distribution to the DTI and DTEC;
viewing from the front of the rack, configure DTIs and then DTECs rightwards.
The four figures below are recommended full configurations of DTI, DTEC and
ASIG, which are for your reference only.
202
Power B Power B Power B

Power B
Analog Signaling Analog Signaling Echo Suppression Echo Suppression
Echo Suppression Echo Suppression Echo Suppression Echo Suppression
Shelf Type:
Shelf Type:
Shelf Type:
203
Echo Suppression Echo Suppression Digital Trunk Digital Trunk
Echo Suppression Echo Suppression Digital Trunk Digital Trunk
Digital Trunk Digital Trunk Digital Trunk Digital Trunk
Digital Trunk Digital Trunk
Shelf No.
Digital Trunk
Shelf No.
Shelf No.
Digital Trunk
Power B Power B
Power B Power B
4. Signaling links in the same office direction must not be configured on the same
trunk board.
5. Trunk voice channels in the same trunk group direction must not be configured
on the same trunk board.
6. If there are 8 trunk voice channels in non-BSC direction trunk group, it is

recommended that the channels be shared by two or three, but not more than 4
trunk boards; if the trunk voice channels are more than 8, it is recommended that
those in the same shelf be shared by the sequential trunk boards.
7. It is recommended that the A interface voice channels in the BSC direction in the
same shelf be configured on the sequential DTIs and an MSC DTI correspond 4
E1 circuits of the same BSC SVICM; if the E1 circuits are not sufficient on the
SVICM, the corresponding E1 slot should be idled.
8. For the trunk group in the PSTN direction, the “Contain Echo Suppressor”
property must be selected on the trunk indicator.
2.3.3 Example
Example 1:
According to the full configuration, the BSC SVICM should configured with 4 E1s of
PCM system codes 12 ~ 15, which correspond to PCM1 ~ PCM4 on slot 3 of shelf 5 at
MSC; however, the actual case is that the SVICM is configured with three E1s, PCM12
~ PCM14, that is, PCM1 ~ PCM3 on slot 3 of shelf 5 E1s 12 ~ 14 correspond to ~ 1
should be configured with PCM12 ~ PCM14 of BSC, and the PCM4 are idle.
Example 2:
There is one trunk group GW at the gateway of the exchange with 7 E1s.
Seven circuits are configured in the onsite trunk group direction, which are less than 8,
the critical standard. Distribute the trunk circuits in the GW direction to two or three
trunk boards; the signaling links are open on the different trunk boards and are not
allowed untidily open on more than four trunk boards. For example: The onsite seven
trunks are open respectively on seven trunk board, which is forbidden.
Example 3:
There are 44 E1s are configured in the exchange BSC direction and trunk shelves of
204
layers 5 and 6 are available onsite.
According to A interface circuit configuration principles, evenly distribute the A

interface circuits in BSC direction to shelves 5 and 6 by the SVICM, where, shelf 5
takes total 24 A interfaces, PCM0 ~ PCM23 while shelf 6 takes 20 A interfaces,
PCM24 ~ PCM43. A interface circuits within the shelf are distributed on sequential
DTIs and BSC signaling links are open on different DTIs, but not untidily and
disorderly open on inconsecutive trunk boards. Following is the recommended
configuration mode for your reference.
SVICM No. PCM System No. MSC Physical Position (Module-Shelf-Slot-PCM Unit)
0 2#-5-3-1
1 2#-5-3-2
3
2 2#-5-3-3
3 2#-5-3-4
4 2#-5-4-1
5 2#-5-4-2
4
6 2#-5-4-3
7 2#-5-4-4
8 2#-5-6-1
9 2#-5-6-2
5
10 2#-5-6-3
11 2#-5-6-4
12 2#-5-7-1
13 2#-5-7-2
6
14 2#-5-7-3
15 2#-5-7-4
16 2#-5-9-1
17 2#-5-9-2
7
18 2#-5-9-3
19 2#-5-9-4
20 2#-5-10-1
21 2#-5-10-2
8
22 2#-5-10-3
23 2#-5-10-4
24 2#-6-3-1
25 2#-6-3-2
9
26 2#-6-3-3
27 2#-6-3-4
10 28 2#-6-4-1
205
SVICM No. PCM System No. MSC Physical Position (Module-Shelf-Slot-PCM Unit)
29 2#-6-4-2
30 2#-6-4-3
31 2#-6-4-4
32 2#-6-6-1
33 2#-6-6-2
11
34 2#-6-6-3
35 2#-6-6-4
36 2#-6-7-1
37 2#-6-7-2
12
38 2#-6-7-3
39 2#-6-7-4
40 2#-6-9-1
41 2#-6-9-2
13
42 2#-6-9-3
43 2#-6-9-4
2.4 Analog Signaling (ASIG) Board Configuration Specifications
1. Total eight slots, slots 21, 22, 24 and 25 in both layer 5 and layer 6 of each
MPM, are used for inserting ASIG boards.
2. In ASIG board of each peripheral MPM, at least one DSP unit should be
configured as conference circuit, and the number of 32M voice DSP units and
the number of DTMF DSP units should be configured in a rough proportion as
1:1.
3. Try to ensure that shelves of layers 5 and 6 are respectively configured with both
32M voice DSP unit and DTMF DSP unit.
1. Total eight slots, slots 21, 22, 24 and 25 in both layer 5 and layer 6 of each
peripheral MPM, are used for inserting ASIG boards (note: No such requirement
for the corresponding slots of shelf 1 and shelf 2). The slots for the 8 ASIGs are
not allowed to configure DTIs and DTECs; if the onsite ASIG boards are less
than 8, the empty slots should be idle.
206
2. If the peripheral MPM, with more than 4 ASIGs, is only configured with the
layer-5 shelf, shelf 5 should be configured with 4 ASIGs only, and the
advantages serve as spare for future use. If the MPM is configured with two or
more trunk shelves, try to make the ASIGs of the module evenly distributed to
the specific ASIG configuration slots of shelf 5 and shelf 6.
3. At present, there are three types of ASIG boards: ASIG-1, ASIG-2 and ASIG-3.
The corresponding requirements for configuring ASIG boards and DSP units are
as follows:
DSP Unit
DSP1 DSP2
ASIG
Conference circuit or 32M
ASIG-1 32M voice
voice
ASIG-2 DTMF DTMF
ASIG-3 32M voice DTMF
4. The ASIGs for slots 21, 22, 24 and 25 of shelves 5 and 6 should be inserted to
the corresponding boards ASIG-1, ASIG-2 and ASIG-3 strictly according to the
corresponding relations listed as the following table: slot 25 in shelf 5 and 6 are
configured with ASIG-1; slot 24 with ASIG-2, slot 22 with ASIG-3, and slot 21
can be configured with one of the three according to actual condition.
Shelf
5 6
Slot No.
21 Any ASIG is ok Any ASIG is ok
22 ASIG-3 ASIG-3
24 ASIG-2 ASIG-2
25 ASIG-1 ASIG-1
5. In the ASIGs of each peripheral MPM, generally, only one conference circuit
DSP should be configured and the DSP unit is required to be configured at slot
25 of the layer-5 shelf (note: If two or more conference circuit DSPs are
required, please contact our technical experts).
6. Properly adjust the ASIG DSP configuration of each peripheral MPM to make
the number of 32M voice DSPs and the number of DTMF DSPs configured in a
rough proportion as 1:1.
7. Properly adjust the ASIG DSP configuration of shelves of layers 5 and 6 of each
peripheral MPM to try to ensure at least one 32M voice DSP and one DTMF in
207
the shelf of each layer.
2.4.3 Examples
Example 1:
A exchange is configured with only one trunk shelf, shelf 5, and 5 ASIGs. Only 4
ASIGs are selected to be inserted into slots 21, 22, 24 and 25 and another one is for
spare or future expansion use (note: Which hardly occurs onsite).
Example 2:
A exchange is configured with only one trunk shelf, shelf 5, and 3 ASIGs, one ASIG-1,
one ASIG-2 and one ASIG-3.
According to the previous recommended principles, slot 25 is configured with ASIG-1,

where the DSP1 is configured with conference circuit and DSP2 with 32M voice; slot
24 is configured with ASIG-2, where DSP and DSP2 are configured with DTMFs; slot
22 is configured with ASIG-2, where DSP1 is configured with 32M voice and DSP2
with DTMF.
Example 3:
An exchange is configured with 4 trunk shelves, that is, shelves 5, 6, 1 and 2, and with
7 ASIGs, that is, 2 ASIG-1s, 3 ASIG-2s and 2 ASIG-3. According to the previous
recommended principles, slot 25 is configured with ASIG-1, where the DSP1 is
configured with conference circuit and DSP2 with 32M voice; slot 24 is configured
with ASIG-2, where DSP and DSP2 are configured with DTMFs; slot 22 is configured
with ASIG-2, where DSP1 is configured with 32M voice and DSP2 with DTMF.
Viewing from the information above, 4 trunk shelves are configured onsite. According
to the principles, configure the ASIGs on shelves 5 and 6, but not on shelves 1 and 2.
7 ASIGs are configured; according to the principle of ASIG distributed half in half and
shelf 5 in priority, configure the 4 ASIGs on the layer-5 shelf and the 3 ASIGs on the
layer-6 shelf;
Based on the principle of SLOT-ASIG correspondence, configure slot 25 of shelves 5

and 6 with ASIG-1, slot 24 with ASIG-2, slot 22 with ASIG-3, and slot 21 of shelf 5
with the last, ASIG-2.
According to the ASIG-DSP correspondence principle and the conference circuit
208
configuration requirements, determine, for the ASIG-1 of slot 25, the DSP1 is
configured with conference circuit and DSP2 with voice circuit; for other ASIG-1s,
DSP1s and DSP2s are configured with 32M voice; DSP1 and DSP2 of ASIG-2 are
configured with DTMFs; for ASIG-3, the DSP1 is configured with 32M voice and
DSP2 with DTMF.
And a final configuration state is shown as follows. In this case, the conference circuit :
32M voice : DTMF = 1 : 5 : 8. As a result, though it does not fully coincide with the
principle of 32M voice : DTMF = 1 : 1, in the terms of onsite board delivery limit, it is
the best result.
DSP Unit
DSP1 DSP2
Shelf-Slot
Shelf 5-slot 21 (ASIG-2) DTMF DTMF
Shelf 5-slot 24 (ASIG-2) 32M voice DTMF
Shelf 5-slot 25 (ASIG-1) Conference circuit 32M voice
Shelf 6-slot 21 (idle) Null Null
Shelf 6-slot 25 (ASIG-1) 32M voice 32M voice
Example 4:
An exchange is configured with only two trunk shelves: shelves 5 and 6, and 4 ASIGs:
two ASIG-1s, one ASIG-2 and one ASIG-3.
According to the previously recommended principle, the ASIG-1 configured in slot 25

of shelf 5 contains conference circuit and two ASIGs are configured on both shelf 5
and shelf 6.
According to the principle that there is at least one 32M voice and one DTMF DSP in
the shelf of each layer, the ASIG-1 configured in slot 25 of shelf 5 is for conference
circuit plus 32M voice, and the boards ASIG-1, ASIG-2 and ASIG-3 can be reasonably
regulated: slot 22 of shelf 5 for ASIG-3 (32M voice + DTMF), which ensures there are
two 32M voice, one conference circuit and one DTMF; slot 25 of shelf 6 for ASIG-1
(32M voice+32M voice) and slot 24 of shelf 6 for ASIG-2 (DTMF + DTMF), which
ensure there are two 32M voices and two DTMFs.
Based on the ASIG-Slot corresponding relations, a final configuration state is shown as

follows. In this case, the conference circuit : 32M voice : DTMF = 1 : 4 : 3, which is
209
close to 1 : 1 principle.
DSP Unit
DSP1 DSP2
Shelf-Slot
Shelf 5-slot 25 (ASIG-1) Conference circuit 32M voice
Shelf 6-slot 25 (ASIG-1) 32M voice 32M voice
2.5 Specifications for Defining Adjacent Office Direction
1. Adjacent office directions numbered as 1 ~ 10 are provided special for BSC.
2. If the onsite exchange is LSTP/TMSC, the adjacent office direction numbers

100 ~ 199 are the global quasi-associated office direction numbers.
1. Adjacent office direction numbers 1 ~ 10 should be provided special for BSC.
2. If the onsite exchange is LSTP/TMSC and the operators require the global
quasi-associated office direction (such as LSTP and HSTP), the adjacent office
direction numbers 100 ~ 199 are reserved for the global quasi-associated office
direction numbers and not allowed for other direct office direction use. The
LSTP and HSTP should be configured in pair, for example: Beijing
quasi-associated office direction has HSTP-A and HSTP-B, and the office
number 100 is for Beijing HSTP-A, number 101 for Beijing HSTP-B. If there is
only single LSTP in an individual region, another LSTP office number should be
configured and reserved for future expansion use. There is only LSTP1 in the
quasi-associated office direction of some office and the LSTP2 is not build
temporarily. Reserve the LSTP2 office direction number and define the number
100 as the LSTP1 of the office, and the number 101 is not configured and
reserved for future LSTP2. the next office direction number starts from 102.
210
3. The adjacent office direction numbers 11 ~ 99 is the associated office direction

numbers except the BSC. It is expected to assign the office direction numbers
reasonably upon commissioning and it is recommended the numbers from 11 to
30 be assigned to the CDMA interior equipment office direction, such as SCP,
SC, associated MSC and HLR. it is recommended the numbers from 99 to 31 are
set for other PSTN and mobile office direction numbers. If there are multiple
virtual MSCs, it is recommended to define the numbers in categories by the
MSC, for example, 31 ~ 40 are assigned specially for the PSTN and the mobile
office direction of the virtual MSC-A, and 41 ~ 50 for that of the virtual MSC-B.
2.5.3 Example
Some office is a LSTP/TMSC/MSC exchange controlling four virtual MSCs: A, B, C

and D, which are connected to 8 BSCs, 9 terminal exchange of the whole province,
HLR, SC, SCP, upper level TMSC1, TMSC2, HSTPA, and HSTPB. It is required to
configure the national quasi-associated LSTP and HSTP. According to the principle
above, the configuration is recommended as follows:
Office Direction No. Name (Note: The name is defined according to the actual conditions)
1-8 BSC1——BSC8
11 HLR
12 SC
13 SCP
14 TMSC1
15 TMSC2
16 HSTP-A
17 HSTP-B
18-26 Associated MSC---1-associated MSC 9
31 GW of office A
32 193 of office A
33 GSM of office A
41 GW of office B
42 193 of office B
43 GSM of office B
51 GW of office C
52 193 of office C
53 GSM of office C
61 GW of office D
62 193 of office D
211
Office Direction No. Name (Note: The name is defined according to the actual conditions)
63 GSM of office D
100 Quasi-associated LSTP1
101 No configuration is made.
102 Beijing HSTP-A
103 Beijing HSTP-B
2.6 MTP Management Configuration Specifications
1. Principle for setting signaling link group number : The signaling link group
number corresponds to the associated signaling office direction number. Only
one signaling link group is allowed to be configured in the same associated
office direction.
2. Principle for setting signaling route number: The signaling route number in the
associated signaling office direction corresponds to the real office direction
number. The signaling route number with load share to two associated office
directions are not allowed using quasi-associated signaling office direction
number.
The signaling links in the same signaling link group should be numbered as sequential
as possible and at least an expansion space of 4 signaling link serial numbers should be
reserved in every signaling link group.
2.6.3 Example
Some exchange has 4 associated office directions and 3 quasi-associated office

directions. The MTP management configuration is as follows according to the
principles and recommendations above.
1. Signaling link group configuration
Signaling Link Group Associated Office Direction

1 1
2 2
3 3
212
4 4
& Note:
Here are 4 associated office directions and the signaling link group serial number of
each is the same as the office direction number.
2. Configuration of the signaling route number and the signaling office direction
number
The Second
Signaling Office Connection Normal Signaling The First
Alternative
Direction ID Mode Route Alternative Route
Route
1 Associated 1
2 Associated 2
3 Associated 3
4 Associated 4
Quasi-associ
5 1
ated
Quasi-associ
6 2
ated
Quasi-associ
7 12
ated
& Note:
As shown in the above table, there are 7 office directions: 4 associated directions and 3
quasi-associated directions. The numbers of the signaling route and signaling office
direction of each associated office direction are the same. The route of the associated
direction is used for the signaling route of each quasi-associated office direction. For
the signaling route in the same load share to two associated directions, it is easy to
differentiate because it uses different number from the existing signaling office
direction.
Signaling Route Signaling Link Group1 Signaling Link Group 2

1 1
2 2
3 3
4 4
12 1 2
& Note:
213
Since the signaling route number of the associated signaling office direction
corresponds to the real office direction number, the signaling route number and the
signaling link group number of the associated office direction are identical. For the
signaling route in the same load share to two associated signaling office directions, it
had better to use two overlapped signaling link groups, which helps quickly find the
relevant data during the routine maintenance and saves time for troubleshooting
problems.
3. Signaling Link Configuration
Signaling Link Group Signaling Link No.

1 1
1 2
1 3
1 4
2 9
2 10
3 15
3 16
4 21
4 22
4 23
4 24
& Note：
：
The signaling link numbers in the same signaling link group are in sequence, which is
good for the dynamic management and alarm analysis. The reserved signaling link
numbers can be flexibly configured for expansion numbers according to the actual
conditions.
2.7 Trunk Management Configuration Specifications
General principle: “route link number = office direction number”, and attach the
descriptions when adding a trunk group/route number/route group/route link.
214
2.7.2 Recommendations on Trunk Group Management Data Configuration
1. For an analyzed number prefix, such as 130, the procedure to find its trunk voice
channel is as follows:
Route link No > Route group No. > Route No. > Trunk group No.
2. To reasonably, effectively and quickly manage the date configuration, we put

forward that the route link number, route group number, route number and the
trunk group number which in “Trunk group management”, are frequently used
in the MSC data configuration should be consistent with the office direction
number.
3. No specific requirements for the trunk with groups.
4. The outgoing route link with alternative route group is set as actually required;
the route group number with other parallel route is set as actually required. Note
that the multi-module route is set according to the proportion of the trunk circuit.
For example, if the trunk circuit to some 16 office direction is with 2 PCMs for
No.3 module and 3 PCMs for No.4 module, and the trunks are 2 : 3 in
proportion, the routes of the outgoing route group should be set to 2 No.3
module routes and 3 No.4 module routes.
2.7.3 Example
1. The office direction number from MSC to YGSM is 6.
2. If the trunk of the office is assigned to No.3 module or No.4 module, the trunk
circuit group is defined as 6. For example, the 3# -6 and 4# -6 are the trunks to
this office direction.
3. For the outgoing route:
The route number 36 corresponds to 3#-6 and number 46 to 4#-6. Since the
trunk circuit is configured with two modules, one route number is not enough,
so it is recommended to use two digits for the multiple modules. That is, use the
principle of “Route number = module number + office number”.
For example: route number 36 corresponding to 3#-6
route number 46 corresponding to 4#-6
route number 56 corresponding to 5#-6
215
For the trunks in group, it can be defined according to the actual conditions.
4. For the outgoing route group: The route number 6 consists of route 36 and route
46.
5. For the outgoing route link: The route link number 6 corresponds to the direct
route group 6.
6. It is defined as 6 during the number analysis when it is planned to dialing the

outgoing route link number with 130 prefix, which corresponds to the office
direction number. This helps quickly find the relevant data during the routine
maintenance and saves time for troubleshooting problems.
2.8 Default Capacity Planning

During the office capacity configuration, the route link number (1 ~ 256), route group
number (1 ~ 512), route number (1 ~ 1024) and the trunk group number (1 ~ 250) are
set with default limitations, which should not be exceeded upon data configuration.
216
216
3 Number Analysis Configuration
Specifications
3.1 Function of Number Analysis

The route addressing is required during the call connection of the switch. The basis for
the network addressing is the number. The function of the ZXC-MSC/VLR number
analysis is to determine the network addressing and service processing mode of various
numbers to ensure the signaling interaction and call connection of the switch.
Number analysis consists of three layers, which downwards are: selector, analyzer and
analyzed number.
The number analysis starts from the number analysis selector. Each number analysis
selector includes a number of number analyzer entries. Each number analysis entry
includes a number of analyzed numbers. The system provides seven digit analyzers:
new service analyzer, CENTREX analyzer, private network analyzer, special service
analyzer, local network analyzer, national toll analyzer, and international toll analyzer.
Numbers required to be analyzed in the digit analyzer are: fixed subscriber number,
mobile subscriber number (MDN), and temporary local subscriber number TLDN.
3.2 Sequence of Number Analysis

In the number analysis, select a number analysis selector and then use the number
analyzer for analysis sequentially. For a specific DAS, the numbers will orderly pass
through all the analyzers specified by the selector, which in turn are: new service
analyzer, CENTREX analyzer, private network analyzer, special service analyzer, local
network analyzer, national toll analyzer, and international toll analyzer. It will exit
when the analysis is complete. Where, the new service analyzer, private network
analyzer and special service analyzer are different from the other 4 analyzers: For the
three analyzers, when the number analysis result is null, the process continues moving
to next analyzer; and for the other four analyzers, it exits the analysis and returns the
null result.
The analyzed numbers are series of specific number flow. In general, the system selects
217
same digits from a group of numbers for the analysis object according to the stream
rule. For example, there is a group of numbers: 13305160000 ~ 13305169999, we can
take 1330516 as the analysis object.
Analyzers are categorized into seven types and the numbers in same type can be added
into same analyzer. Multiple analyzers of same type can be created, identified by the
analyzer entry numbers.
The selector is in the top level, is a sequential queue composed of different types of
effective analyzers (an analyzer is ineffective if its entry is set as 0).This sequence is
the execution sequence of number analysis. In other words, the number will pass
through every effective analyzer set by the DAS in turn, till there is an analysis end
indicator. If there is no definite analysis result in an effective analyzer or sequential
analysis indicator, the number is regarded as null. The effective analyzer that is at a
lower position in the queue is called the sequential analyzer of its upper neighbor
effective analyzer.
3.3 Number Analysis Selector Type

In the ZXC10-MSC/VLR, there are two places to be configured with number analysis
selectors; one is during the office configuration and the other is in the trunk property.
Five number analysis selectors are used in the office configuration, which are: call
origination, roaming, special subscriber, IP service and interception service analysis
selector. Three number analysis selectors are used in the trunk property, which are:
incoming, data service and caller number analysis selector. Functions of the number
analysis selectors include:
call origination number analysis selector: Analyze the called numbers and the
forwarding numbers by the local ordinary subscriber; after the selector configuration is
complete, specify in Mobile Data Configuration the MS call origination selectors:
one VMSC is configured with one call origination selector only.
Roaming number analysis selector: Analyze the TLDN carried in the position response
message returned from HLR; if the called is currently in the LOCREQ initiating
exchange, the HLR does not carry TLDN in the locreq response. After the selector
configuration is complete, specify in Mobile Data Configuration the roaming number
selector. One VMSC is configured with one roaming selector only.
Special subscriber number analysis selector: Analyze the called numbers and the
218
Chapter 3 Number Analysis Configuration Specifications
forwarding numbers by the special subscriber, which is not used usually.
IP service number analysis selector: For IP service: used only when the number
analysis result is mobile IP service.
Interception number analysis selector: For interception service, not in use temporarily.
Incoming number analysis selector: It is applicable to the analysis of called numbers of

ordinary incoming voice calls. It is used to analyze called numbers contained in the
incoming IAM/IAI messages. After the selector configuration is complete, specify the
incoming number analysis selector in the corresponding incoming trunk group basic
attributes.
Data service number analysis selector: Analyze the called number of data service upon
incoming.
Caller number analysis selector: not in use temporarily.
3.4 Definition of Number Analysis Selector

The 3-digit length selector is defined. The first digit of the selector (from left to right)
indicates VMSCID. 1 indicates VMSCID1 and 2 indicates VMSCID2, and so on.
The second and the third digits indicate type and No, in particular, 01 indicates the call
origination selector; 02 indicates the roaming selector; 03 indicates the special
subscriber, …, 07 indicates mobile public phone. Numbers from 08 to 19 are reserved
for future expansion use. Numbers from 20 indicate the trunk incoming number
analysis selectors; numbers from 40 indicate the trunk caller number analysis selectors
(configured where the caller analysis if required).
For example: When the VMSCID is 1, the MS call origination selector is 101 and the
roaming is 102. Selectors starting from 120 indicate the trunk incoming number
analysis selectors; those starting from 140 indicate the trunk caller number analysis
selectors. The selector numbers of multiple trunk groups are arranged in a descending
order.
3.5 Use Principle of Number Analyzer

The selection of the number analyzer should comply with the following principles:
1. In general, analyzers of various VMSCID numbers cannot be shared.
219
2. Call origination selector: Special service analyzer, and local, national and
international number analyzer should be set up. New service analyzer should
be used under strict control, which is used when it is specially required by
special exchange.
3. Roaming number selector: Selector should be set up separately for each

VMSCID. At present stage, roaming selectors can share the same roaming
number analyzer. Only local network analyzer should be set up for roaming
selectors, which include all the TLDN numbers in the C network and the
international roaming TLDN numbers.
4. Incoming selector: The incoming selector specifications of different office

directions should not be the same. The number analyzer can be shared.
5. Prevent the route loop when using the “Multiple Result” number analysis.
6. Correctly use number transform. Caller transform is represented in the CDR

while the called transform has no effect on CDR but with effect on the called
number format. The number attributes affect CDR: when the local call attribute
is set, the local area code will be added to the CDR.
3.6 Meanings of Parameters in Number Analysis Result
3.6.1 Call service category
It directly determines the call processing by the switch. Different analysis results will
cause the program to enter different flows. Call service types of the MSC include local
network outgoing/local call service, national toll outgoing (intra large area) automatic
service, national toll outgoing (inter large area) automatic service, international toll
outgoing automatic service, local office free special service, local paid special service,
outgoing free special service, outgoing paid special service, MSC ordinary service,
MSC local office service, MSC local outgoing service, additional service, and mobile
IP service.
3.6.2 Destination Network Type
The homing network type of the called subscriber
220
3.6.3 Number Conversion at Calling Side
It is used for the conversion of the called number at the calling side to meet the
requirement.
3.6.4 Number Conversion at Called Side
It is used for the called number at the called side, applicable to TUP and ISUP. It is
used to convert the called number to the needed format of the subsequent office.
3.6.5 Whether or not to End Analysis
Analysis not ending, analysis ending, no more analysis
Analysis ending, all digits will be analyzed in the subsequent analyzer
Analysis ending, the rest digits will be analyzed in the subsequent analyzer.
3.6.6 Various Flag Bits
Those in use currently mainly include: The caller number is initiatively sent out when
SS7 outgoing is used (indicating when TUP outgoing or ISUP outgoing is used, the
caller number is initiatively sent out); the caller number is requested at the ? digit of the
incoming number flow or the A6 (for CAS, it requests the upper level exchange for the
caller number upon incoming call) is sent after the ? digit of the incoming number
flow.
3.6.7 Minimum and Maximum Number Length
It is used to make a judgment on the called number by the user and the non-standard
calling numbers will be intercepted. The minimum and maximum number lengths
should be strictly set upon number analysis. The range should not be set too large.
3.6.8 Length of Toll Prefix plus Area Code
It is used to judge whether the incoming called number is standardized. It is configured

according to the actual length. For example, 0254636016, the toll prefix is 0 and area
code is 25, so, the length of the prefix plus the area code is 3. For the number in the
format of 13X, the length of toll prefix plus area code is 0. For the number in the
format of 013X, the length of toll prefix plus area code is 1.
221
3.6.9 Number Attribute
The attribute of the analyzed number should be set according to the actual attribute of
the number; the attribute of a local number should be set to the local attribute, such as
114 and 4636016; the attribute of national number should be set to the national
attribute, such as 0086133 and 0085254636016; for IP call, you can select national
number attribute and the default attribute is not allowed. You can specify the number
attribute after the number conversion according to the above principles.
3.6.10 Voice Channel Recovery Mode
There are three modes: Calling control release, called control release, and mutual not
controlled release. The channel release mode should be in the mutually not controlled
release for the mobile office.
3.7 Call Origination Selector Configuration

All the reasonable dialing numbers originated from the local mobile subscribers are
required to be sent to their corresponding number analyzers. The call origination
selectors include the special service analyzer, local network analyzer, national toll
analyzer and international toll analyzer. In special cases, the new service analyzer may
be used.
Here we take the cases in China as an example to detail the mail data required to be
configured in the originated number analysis selector.
3.7.1 Special Service Number Analyzer
It is used for analyzing special service number. In China, it aims at the short numbers
with prefix like 1 and 9, which are analyzed in the special service analyzer.
There are three types of short numbers: Type 1: Common short number; Type 2: Local
office free special service number; Type 3: IP phones and 193 access number in China.
1. Type 1: Common short number:
It is analyzed according to common subscriber number for the outgoing. The

analysis type is “Outgoing charge special service” The digit length of the
number is set according to the actual requirement of the short number. For
example, 114 is three digits (maximum and minimum). The number of the
paging station should feature the same length of the shortest and longest digits.
222
It is not allowed to set to variable length, except the special case.
2. Type 2: Local office free special service number
Nearest access to special service. The numbers are required to be analyzed as

“local office free special service number” and go out of the office through the
relevant outgoing route link.
3. Type 3: IP phones and 193 access number
When the IP access numbers of China Unicom are put into the special service analyzer,
they should be subdivided to 1791100, 1791101, 1791102, and so on, where, the
1791100 indicates international toll and others are national toll (between regions).
Number length should be limited according to the digit length of toll analyzer plus the
access number. The wrong dialing modes of calling the local phone through the IP
phone should be intercepted according to the actual requirements. The analysis of the
193 is similar to that of the 17911. The telecom number 17909 analysis should be
handled according to the actual requirements. Basically, there is no process for
interception. The service type is local network outgoing/local call service, and the
length is set with limitation. Number may be changed according to regional actual
conditions (changes are made in the called side).
3.7.2 Local Network Number Analyzer
The Local Network Number Analyzer is used to analyze the local network number,
local mobile number, local fixed phone, and the national toll prefix 0.
1. 133 number segment: It is analyzed in the Local Network Number Analyzer.

The number analysis result is: MSC ordinary service, mobile network, stop to
continue the analysis after the ending of the number analysis, sending calling
number in the outgoing through SS7, the shortest and longest digit length (both
are 11), the length is 0 when toll prefix added with area code, national number,
and mutually not controlled release mode. The called number can be sub-divided
as specific as 133H1H2H3.
2. For mobile number segment (non-133): It is analyzed in the Local Network

Number Analyzer. (MSN where the segment differentiating is a must) Local
number segment analysis result: local outgoing/local call service, mobile
network, stop to continue to the analysis after the ending of the number analysis,
initiatively sending the calling number in the case of the outgoing call with
223
using SS7, the shortest and longest digit length (both are 11), the length is 0
when toll prefix added with area code, national number (it is a must; otherwise,
the CDR will show the local area code), and mutually not controlled recovery
release mode. Analysis of non-local number segment analysis result: National
toll outgoing (inter large area) automatic service, mobile network, stop to
continue to the analysis after the ending of the number analysis, initiatively
sending the calling number in the case of the outgoing call with using SS7, the
shortest and longest digit length (both are 11), the length is 0 when toll prefix
added with area code, national number, and mutually not controlled recovery
release mode.
3. Local fixed telephone: It is analyzed in the Local Network Number Analyzer.

The number analysis result is the local networking outgoing/local call service.
Where those with the prefix of 2 ~ 8 is required to analyze 1 digit. The public
network, stop to continue to the analysis after the ending of the number analysis,
initiatively sending the calling number in the case of the outgoing call with
using SS7, the shortest and longest digit length are limited according to the local
telecom actual length, the length is 0 when toll prefix added with area code,
number default attributes (according to the actual requirements of the CDR), and
mutually not controlled recovery release mode. The short number starting with
the digit 1 is analyzed in the Special Service Analyzer. The short number starting
with the digit 9 is analyzed in the Special Service Analyzer.
4. National tool prefix 0: The number analysis result is a null number. The analysis
result shows “the analysis ends and the left digits will be analyzed in the next
analyzer”.
3.7.3 National Toll Number Analyzer
The national toll number analyzer is used to analyze the national toll area code and
international prefix 0. Since the national toll prefix 0 has been analyzed in the Local
Network Number Analyzer, the left digits continue to be analyzed in the National Toll
Number Analyzer, that is, only the left part is analyzed in the National Toll Number
Analyzer.
1. International tool prefix 0: The number analysis result is a null number. The
analysis result shows “the analysis ends and the left digits will be analyzed in
the next analyzer”.
224
2. Local toll area code: The analysis result shows the local network outgoing/local
call service.
3. Other national toll area codes: the number analysis results are national toll
(between large areas) outgoing automatic service in unified manner.
The minimum digit length should include the prefix 0, area code, and actual
shortest number (like 114 in China for querying telephone number). Set it to 7
digits in the area with three-digit area code. Set it to 7 in the area with the
two-digit area code.
The maximum digit length should include the prefix 0, area code, and actual
longest number and exclude the ultra-long special service number. Generally, it
is set to 11 digits or 12 digits; however, it can be set according to the actual
conditions onsite. For example, we can increase the longest digit length if it is
required to support ultra-long calling number.
4. In the national toll, analyze 13xxxxxxxxx number with intercepting the voice
prompt. The service type is the additional service. The voice selection is
Tone_UC_11 “Please do not add 0 before the number you are dialing”
3.7.4 National Toll Number Analyzer
Since the international toll prefix 00 has been analyzed respectively in the Local
Network Analyzer and the National Toll Number Analyzer, here in the National Toll
Number Analyzer, only the left part, country code, is to be analyzed. The number
analysis result shows the international toll outgoing automatic service. The shortest and
longest digit lengths should include the prefix 00, and the calculating method is the
same as that within the country. The requirements can be properly loosened. It ranges
from digit 6 to digit 19 temporarily.
3.8 Roaming Analysis Selector

Independent local network analyzer should be set up for the roaming analysis selector
and it does not share other analyzers. All the VMSCIDs can share the local network
analyzer.
It is used to analyze the TLDN carried back with the MAP. The format is 8613344 and
the number is in international format. According to the specifications, the number
225
should be analyzed to 8613344XX, and the length is limited to 13 digits. 86 will be

deleted by the MSC after the analysis ends. 0086 will be added through the “(outgoing)
use international format called number mode” trunk group attribute upon outgoing and
the number goes out as 008613344XX.
If there are two MSCs in local area, the analysis result of the TLDN number segment
belonging to another MSC is the MSC local outgoing service.
For other TLDN number segment, it is analyzed as the MSC toll call service. If there is
only one MSC in local area, it is analyzed as the MSC toll call service.
& Note:
The TLDN number segment in other formats is processed in the same way.
International roaming number is analyzed according to the specifications set by China

Unicom headquarters. If the number length is not determined, it can be set to 6 ~ 19
digits. Whether the international TLDN is analyzed with 00, it should be determined by
the fact that whether the TLDN in the actual MSC LocationRsp carries the prefix 00 or
not. The outgoing route link selection is according to the local actual route
requirements and the outgoing number format is determined onsite.
3.9 Incoming Number Analysis Selector

Principle: The incoming selector specifications of different office directions should not
be the same. The number analyzer can be shared.
During the actual configuration, we should make the analyzed number according to the
concerted format with the opposite office, and make the planning by integrating with
the trunk indicator of the trunk group.
According to China Unicom specifications, the number transmitted in the C network

should be in the international format. To facilitate the unified configuration of the
number, the attribute “Use outgoing (incoming) office to add (delete) international
format number” must be selected corresponding to the directly connected trunk group
among MSCs in the local network. In this way, the system will automatically convert
the destination address of the IAI (IAM) message to the corresponding format.
Therefore, the format is changed as 133x national format when it enters the number
analyzer.
For non mobile exchange like PSTN, the local network analyzer and national toll
226
analyzer should be configured generally.
For the incoming of the adjacent CDMA switching office, the local network analyzer
should be configured.
3.9.1 Local Network Analyzer
Local TLDN number segment: The number analysis result is “MSC local service” the
maximum and minimum digit length is 11, and the length of toll prefix plus area code
is 0.
133 number segment: The number analysis result is “MSC local service”. Both
maximum and minimum digit lengths are 11, and the length of toll prefix plus area
code is 0. (As mobile GW)
3.9.2 National Toll Analyzer
GSM trunk group: 133 analyzed as the additional service. The voice selection is
Tone_UC_11 “Please do not add 0 before the number you are dialing”.
PSTN toll office trunk group: 133 number analysis result is “MSC common service”.
Both the maximum and minimum digit lengths are 12, and the length of toll prefix plus
area code is 1.(It is required to support the dialing in 0133 mode)
3.9.3 Other Numbers
When the local MSC works as the VMSC, the above number analysis is enough. For
the tandem office, it is necessary to tandem and forward calls sent from the VMSC.
Therefore, configure all other TLDN number segment 8613344xx. In the area where
China Unicom has built the toll network, the toll number segment should be configured.
For the forwarded TLDN number segment 8613344X, only 13344x should be analyzed
in the forwarding analysis because the forwarding number is analyzed as 13344x
during the incoming analysis. In the case of the outgoing, “Mode of called number
using international format (outgoing)?in the trunk group attribute is added with 0086,
as a result, it is in the format of 008613344XX in the outgoing. The service type is set
to national toll inter big area auto service.
3.10 Precautions for Number Analysis

For the MDN in the incoming call, the minimum and maximum digit length should be
227
11 when 0 is not contained, and the minimum and maximum digit length should be 12
when 0 is contained.
For the TLDN number in the incoming call, the minimum and maximum digit length
should be 11.
3.11 Number Transform
3.11.1 Outgoing Number Transform
There are three modes for outgoing number transform: MSC execution order: (Mode 1)
number transform upon number analysis > (Mode 2) trunk group indicator’s (outgoing )
called number in international format > (Mode 3) number transform of outgoing route
O Caution:
Note: The called number in international format used in the trunk group is an
intelligent mode. It is implemented through judging the attribute of the called number.
If it is the national number, add 0086. If it is the local number, add the toll area code
and then add 0086.
3.11.2 Incoming Number Conversion
The sequence of incoming called number conversion: Trunk number stream conversion
-> Trunk indicator -> Called number conversion at calling side in the number analysis.
The sequence of incoming calling number: Calling number revision about the calling
number according to the length change in the trunk indicator -> Add the incoming
office area code before the local call number when the local office is the mobile
network -> calling number stream conversion during the trunk incoming -> calling
number analysis performs the number conversion at the calling side.
O Caution:
The called number of trunk group indicator (incoming) deletes this country code and
prefix is an intelligent mode. Through the judgment of called number, determine
whether to add the prefix 0 after deleting 0086. If it is 13X number, delete 0086 only.
For other numbers, add the prefix 0. Therefore, analyze the PSTN number with the
prefix format during the number analysis.
228
3.11.3 Application Cases of Number Transform
The number route for the handset calling toll number 021 is required as follows:
The first route goes through C network and the called number format is
008621XXXXXXXX.
The second route goes through 193 and the called number format is
193021XXXXXXXX.
The third route goes through the telecom and the called number format is
021XXXXXXXX.
Seen from the analysis of the three existing outgoing number transform modes, it is
evident that the number transform of the first mode of number analysis does not meet
the requirements of different routes requiring different outgoing called number formats,
the (outgoing) called number in international format is not applicable; the most
appropriate method is to use the route number transform of the outgoing route. The
(outgoing) transform of the trunk group indicator can be adopted if going out through
C network; it can be implemented by adding 193 started from the first digit during the
route transform if going out through the 193 office. It can be satisfied without any
transform if going out through the telecom. The greatest advantage by using the route
transform is the flexibility. For example, it is required that the called number which is
direct called in 193021XXXXXXXX format, is sent directly to the 193 without any
changes, which can be implemented through the new route added to the 193 office.
And there is no number transform to the route. It can be seen that the red part is, in fact,
the same trunk group, but two separate outgoing routes, and the number transform of
both are not related to each other. That is because that the same trunk group can belong
to multiple routes and is the carrier layer of the outgoing route. That is to say it is
transparent to the route.
229
4 Specifications for Analyzing and Making
GT Number
4.1 Function of GT
GT number configuration functions to translate the route label in the GT number
format offered by the application layer into the destination signaling point or the GT
format of STP and DPC + SSN format (global name format and destination signaling
point code + subsystem number), and select the GT format or the DPC+SSN format for
transmission according to the actual network transmission characteristics.
GT number configuration serves SCCP routing. The MAP signaling between SGSN
and MSC/VLR or HLR is sent via SCCP. All the entities can be directly connected or
forwarded by signaling transfer point. When SCCP receives messages from MAP
application layer, it will send, receive or forward these messages according to the route
labels provided in the messages. SCCP can send messages via networks in two modes:
GT routing and DPC + SSN routing.
The two routing modes, GT and DPC+SSN, are different when there is a Signaling
Transfer Point (STP) between the source SP and the destination SP.
The DPC+SSN routing mode requires that all signaling points in the network,
including the source signaling point, the destination signaling point and STP can
identify the DPC. After signaling arrives at the intermediate node, it is directly sent via
the MTP layer, instead of the SCCP layer. In this case, much more DPC data should be
configured for the source signaling point and STP.
The GT routing can be used in the case that the source signaling point and some STPs
do not know the final DPC of this signaling. With this addressing method, when
signaling is sent to STP, GT shall be first translated via SCCP into the destination
signaling point or the DPC of STP, then messages can be transferred to MTP for
transmission. In GT routing, the source signaling point needs to send the signaling to
STP only according to the GT number prefix, so that STP can further translate it to
determine whether it should be sent to the next STP or the destination signaling point.
In this case, much less DPC data are required for the source signaling point and STP.
231
4.2 GT Number Category

The following three GT numbers should be configured in ZXG10 MSC/VLR.
1) CDMA system entity number (MSC/VLR number, HLR number and MC number)
2) Mobile subscriber number (MSISDN)
3) IMSI number (that is, number in E212 format)
Where, the numbers in E212 format are configured according to the specific analysis
result of IMSI Number Analysis. For example, if the MCC+MNC (such as 4600) is
configured as CC+NDC (such as 86133) in E164 format during the IMSI Number
Analysis, the GT number in E164 format should be configured here; If the IMSI
number analysis in the IMSI Number Analysis is configured into E212 format by using
the HLT GT mode, the relevant GT number in E212 format should be configured here.
4.3 GT Number Analysis Selector
4.3.1 GT Translation Selector
GT Type, Translation Type, Numbering Plan and GT Address Information determine a

selector and its attributes, including Country Code, National Maximum Length,
National Minimum Length, International Maximum Length, International Minimum
Length, GT Translation Direction and Selecting Default GT Number,
1. Country code: If a GT number contains a country code, it is regarded as a

national GT number. Perform GT translation with national maximum/minimum
digit length. Otherwise, perform GT translation with international maximum
(15)/minimum digit length (3).
2. GT translation direction: the rule to select GT is to start from the beginning, to

choose the minimum prefix of this number that can identify different office
directions, to make the analysis, and to select as few identifiable prefixes as
possible so as to simplify GT configuration. To facilitate the commissioning of
the project, the ZXC10-MSC/VLR starts GT translation with the longest
matchable item, and analyze the numbers from the longest to the shortest. For
example, when analyzing the number 8613309876543, the system will firstly
analyze whether there are some options matching it. If yes, end the analysis; if
no, analyze 8613309876543, 861330987654, 86133098765, 8613309876 and
232
Chapter 4 Specifications for Analyzing and Making GT Number
861330987, until some matching options are found. In general, the forward
translation is performed. Use the backward translation in the case of the
ascending.
3. Selecting Default GT Number: If the selector does not contain SCCP GT number,
the translation fails normally. However, if this option is selected, the translation
result will be replaced with the default GT number result, provided that the user
has added default GT number to the selector. The default GT number is
configured in the selector attributes. If necessary, output all data that cannot be
found in the MP to the GT translation point. In this case, less data can be made.
4. In the office configuration, if any screen translation type is selected, SCCP GT

translation will be regarded as 0. Therefore, a selector with translation type 0
needs to be made. The SCCP GT translation type is invalid. Such a case also
applies to screen numbering plan and address attributes. This aims to guarantee
flexible GT translation and improve compatibility under the condition that some
contents of GT numbers presented in networks are not well regulated, and data
entries input by some vendors are not standard.
4.3.2 GT Translation Selector Configuration
The GT translation selector corresponds to entries of various GT translation data. In the

CDMA network system, four GT translation selector entries must be configured.
233
GT selector 1
It employs the ISDN/phone numbering plan 1of the translation type 0 and is used for
the call processing route selection and the SM terminating call route selection.
Therefore, the selector should be configured with IMSIs of all CDMA subscribers to
direct to the HLR (associated) or STP (non-associated HLR subscribers).
GT selector 2
It employs the land mobile numbering plan 6 of the translation type 0 and is mainly
used for the mobile management route selection, SM notification response, and the SM
originating (terminating) response. Therefore, in this selector:
1) Configure IMSIs of all CDMA subscribers to direct to the HLR or STP

(non-associated HLR subscribers)
2) Configure MC number to direct to the associated SMC (associated) or STP

(non-associated).
3) Configure the local MSC number to direct to the local office.
4) Configure HLR number to direct to the relevant HLR (associated) or STP

(non-associated).
GT selector 3
It employs the ISDN/phone numbering plan 1 of the translation type 128 and is mainly
used for SM forwarding and SM notification information. Therefore, in this selector:
1) Configure the local subscriber MDN number to direct to the local SC (this
configuration is required for the STP office and the terminal office associated to the
SC).
2) Configure the non-local MDN number to direct to the LSTP or HSTP.
GT selector 4
It employs the land mobile numbering plan 6 of the translation type 128 and mainly
used for the call origination of short messages and transmitting of short message
notification from the MSC to the MC. Therefore, in this selector:
1) Configure all CDMA MC numbers to direct to the SMC (associated) or the LSTP
(non-associated) (non-local provinces direct to the HSTP or the opposite LSTP).
2) Configure the local subscriber IMSI number segment to direct to the local SC. If
234
there is no associated SC, it should direct to the LSTP or HSTP.
3) Configure the local MSC number to direct to the local office: the local provincial
MSC number directs to the LSTP while the non-local provincial MSC number directs
to the LSTP or HSTP.
4) Configure the non-local IMSI number segment to direct to the LSTP or HSTP.
5) Configure the GT address of the C network international GW office TSI as 11101

to direct to the LSTP or HSTP.
4.4 GT Number Analysis Data

Take some Chinese operator as an example to describe the configuration of the GT
number analysis.
4.4.1 Addressing Mode
The SCCP addressing mode of China CDMA network is: The GT addressing mode is
used for CDMA inter-province service and the addressing mode for the SCCP message
to the SMC, which comes through GT addressing twice at both the sending terminal
LSTP/HSTP and the receiving terminal LSTP/HSTP. All CDMA HSTPs serve as
the local province LSTP additionally, so they should undertake the GT task. The GT
mode is used for the intra-province service SCCP message addressing of each province
The GT addressing mode is used for No.7 addressing from each SP to non-local
provinces and each SP sends the message to the non-local provinces to the local LSTP
in the GT addressing mode. And then the message is routed to the LSTP/HSTP of the
target province through the local LSTP/HSTP. The LSTP/HSTP of the destination
translates and sends the message to the local target SP.
According to this requirement, the LSTP must be configured with all LSTP office
directions of the CDMA network and all HSTP office directions. In the GT number
translation part of the SCCP, the GT route should direct to the peer LSTP. It should not
be sent to the HSTP to translate to the peer LSTP.
4.4.2 Number Analysis Digit Length
Requirements: The exchange determines whether the message is the inter-province

service according to the H0H1H2/M1M2M3 in the called GT address of the Called
235
Party in SCCP layer. If the H0H1H2/M1M2M3 is not the local service, it will be the
inter-province service. The digit length of the GT to be analyzed by the HSTP/LSTP is:
The E.164 number should be analyzed to 86133 H0H1H2; E.212 number to 46003 0X
H0H1H2 (IMSI) (X is 9 and 3), 46003 09 44 M1M2 (MSC GT) and 46003 09
H0H1H2 (HLR GT).
4.4.3 GT Translation Data
The GT translation data configuration interface is as follows:
1. GT Translation Selector: Corresponding to the inlets of various GT translations,

a part of GT.
2. GT Number: Minimum GT number prefix that can recognize different office

directions in the configured numbers for the selector, a part of GT.
3. SP Office ID: Office direction of signaling transmission, selecting the DPC of

the signaling actually. According to the actual conditions, the DPC may be an
STP or a destination signaling point.
4. Routing indicator: 0 - GT routing by the address in the field. 1 - routing by DPC

+ SSN.
5. SPC indicator: Only active in the defined SS7 network.

236
6. SSN code: An subsystem code with meanings as shown in Table 1. In the

ZXC10-MSC/VLR, 0 is selected in most cases, indicating to forbid the SCCP
from checking the subsystem. If the target office ID is HLR, 6 can also be
selected here (home location register office).
7. Global Title Indicator: normally 4 is selected for GT routing. The meanings are
shown in Table 2.
Table 1 SSN Code Meanings
Value Explanations
0 Excluding SSN
1 SCCP management
2 Reserved
3 ISDN user part
4 OMM part
5 Mobile intelligent application part
6 Home location register
7 Visitor location register
8 MSC
9 Device identification center
10 Authentication center
11 Reserved
12 IN application part
13~252 Reserved
253 O&M application part of the BTS subsystem
254 Base station subsystem application part
Table 2 Meanings of GT Indicators
Value Explanations
0 The address field does not contain a global name
1 The global name only contains address attribute indicator
2 The global name only contains translation type

The global name contains translation type, numbering plan and address
3
information coding mode
237
Global name contains translation type, numbering plan, coding method, and
4
address attribute indicator
4.4.4 STP Data Configuration:
All CDMA MDNs (E164) should be configured in the parts of SS7 Management and
GT Selector 1 and they should be analyzed to 86133 H0H1H2. Here we take Guiyang
as an example:
Local province:
86133296 (MDN of Guiyang) > HLR (HLR of Guiyang)
Local large region (MDN of the province it belongs to):
86133209 (MDN of Chengdu) > HSTP of Chengdu (It also serves as LSTP)
Local large region (MDN of other province):
86133225 (MDN of Tibet) > LSTP of Lhasa
Other large region (MDN of the province it belongs to):
86133282 (MDN of Fujian) > LSTP of Fuzhou
All CDMA MSC numbers, HLR numbers, IMSI numbers, SMC numbers and SCP
numbers should be configured in the parts of SS7 Management and GT Selector 1 and
the E.212 numbers should be analyzed to :
46003 0X H0H1H2 (IMSI) (X is 9 and 3),
46003 09 44 M1M2 (MSC GT) and
46003 09 H0H1H2 (HLR GT)
Local province: MSC number > corresponding MSC office
HLR number > HLR
Subscriber’s IMSI number > HLR
MC number > corresponding MC office
SCP number > corresponding SCP office
Local large regions (IMSI, MC, MSC and HLR number of the province it belongs to)
(Chengdu) IMSI, MC, MSC, HLR and SCP number > HSTP of Chengdu (it also serves
as LSTP)
238
Local large regions (IMSI, MC, MSC and HLR number of other province)
(Tibet) IMSI, MC, MSC, HLR and SCP number > LSTP of Tibet
Other large regions (IMSI, MC, MSC and HLR number of the province it belongs to):
(Province it belongs to) IMSI, MC, MSC, HLR and SCP number > LSTP of the
province it belongs to
All CDMA MDN (E164) numbers should be configured in the parts of SS7
Management and GT Selector 3 and they should be analyzed to 86133 H0H1H2. Here
we take Guiyang as an example:
Local province:
86133296 (MDN of Guizhou) > SMC of the local province
Local large region (MDN of the province it belongs to):
86133209 (MDN of Chengdu) > HSTP of Chengdu (It also serves as LSTP)
Local large region (MDN of other province):
86133225 (MDN of Tibet) > LSTP of Lhasa
Other large region (MDN of the province it belongs to):
86133282 (MDN of Fujian) > LSTP of Fuzhou
the E.212 numbers should be analyzed to:
46003 0X H0H1H2 (IMSI) (X is 9 and 3)
46003 09 44 M1M2 (MSC GT) and
46003 09 H0H1H2 (HLR GT)
Local province:
MSC number > corresponding MSC office
Subscriber’s IMSI number > SMC
MC number > corresponding MC office
Local large region (IMSI, MC, MSC number of the province it belongs to)
239
(Chengdu) IMSI, MC and MSC number > HSTP of Chengdu (it also serves as LSTP)
Local large region (IMSI, MC and MSC number of other province)
(Tibet) IMSI, MC, and MSC number > LSTP of Tibet
Other large region (IMSI, MC and MSC number of the province it belongs to):
(Province it belongs to) IMSI, MC and MSC number > LSTP of the province it belongs
to
4.4.5 SP Office Data Configuration
From the terminal MSC to the HLR, if there are associated signaling links, the GT is
directed to HLR; otherwise, the MSC is required to be forwarded to the HLR through
LSTP. Other GT numbers are sent to LSTP and translated and forwarded by the LSTP.
If there are local MSC and HLR in Zunyi and the two have associated signaling link,
the GT is configured as follows:
All CDMA MDNs (E164) should be configured in the parts of SS7 Management and
GT Selector 1 and these HLR subscriber MDNs should be analyzed to 86133
H0H1H2H3.
Local region MDN:
861331248 (MDN of Zunyi) > HLR (HLR of Zunyi)
MDNs of other regions of the local province
86133H0H1H2H3 > LSTP or HLR (associated) of the local province
MDNs of other province
86133 ÆLSTP of local province
46003 0X H0H1H2 (IMSI) (X is 9 and 3)
46003 09 44 M1M2 (MSC GT) and
46003 09 H0H1H2 (HLR GT)
Local province:
240
Local MSC number > local MSC office
IMSI number of local province subscriber > LSTP or HLR (associated)
Other number: 46003 (or 46009) > LSTP
All CDMA MDN (E164) numbers should be configured in the parts of SS7
Management and GT Selector 3 and they should be analyzed to 86133 H0H1H2H3.
Local region MDN:
861331248 (MDN of Zunyi) > LSTP or SMC (associated)
MDNs of other regions of the local province
86133H0H1H2H3 > LSTP of local province
Other MDN
86133 ÆLSTP of local province
46003 0X H0H1H2 (IMSI) (X is 9 and 3)
46003 09 44 M1M2 (MSC GT) and
46003 09 H0H1H2 (HLR GT)
Local province:
Local MSC number > local MSC office
IMSI number of local province subscriber 4600309H0H1H2H3 (4600303H0H1H2H3)

> LSTP
Other number:
4600303 (or 4600309) > LSTP
241
Course Objectives:
z To get familiar with HLR/AUC data configuration
principles
z To get familiar with HLR/AUC data configuration
specifications
z To master number conversion configuration
z To master GT number configuration specifications
References:
z Related specifications of the Customer Service Dept. of
CDMA Division
1 HLR/AUC Data Configuration Principles
Key points
z HLR data configuration sequence
z Principles of adjacent office ID connection
1.1 Overview of Configuration Management System

The configuration management system of the ZXC10-HLR/AUC is a database
management system with complete functions. It manages all the data resources of the
HLR.
Through the configuration management system, the various configuration data that is
required for running the ZXC10-HLR/AUC normally can be set, and the operation
mode and operation status of the HLR can determined.
This training material introduces the basic sequence and major contents of the data
configuration. For details, please refer to ZXC10-HLR/AUC (V3.0.15) CDMA Home
Mobile Location Register/Authentication Center Configuration Manual.
1.2 Basic Configuration Sequence

The data configuration of the ZXC10-HLR/AUC is divided into two parts: Data
configuration of the No. 7 front-end processor and data configuration of the service
processor.
The data configuration sequence is: Performing the data configuration of the No. 7
front-end processor and then those of the service processor, as shown in Figure 1.2-1.
243
MP data configuration
Physical configuration
Office capacity configuration
Office configuration
MTP configuration
SCCP configuration
SSN configuration
Mobile office data

configuration
Configuration of No. 7 front-

end processor module
HLR database node

configuration
Service processor node

configuration
Service data configuration
Data synchronization
Figure 1.2-1 Basic Sequence of HLR Data Configuration
244
Chapter 1 HLR/AUC Data Configuration Principles
For the detailed configuration, please refer to ZXC10-HLR/AUC (V3.0.15) CDMA

Home Mobile Location Register/Authentication Center Configuration Manual.
1.3 Principles of Adjacent Office ID Connection

Along with increment of user capacity, the peripheral modules of the HLR increase as
well. To optimize HLR switching networking, reasonably share the loads of all office
IDs and simplify the module networking. The following principles should be abided by.
1.3.1 Principles of Signaling Office ID Connection
In the case of networking with multiple front-end processors, the signaling links to one
signaling offices must be allocated to two different CPM modules. In this way, the
signaling load sharing can be implemented, so that one module can still normally work
upon another module is faulty; and the inter-module communication complexity can be
minimized.
In the case of multi-module office with the HCOMM board adopted, if the clocks of
the modules are extracted from the upper-level office, each module must be allocated
with at least two trunk circuits with the upper-level office.
1.3.2 Principles of Adjacent Office ID MTP Routing
If the adjacent office is in dual-plane status, the signaling routing is implemented by

load sharing.
In view of reducing communication traffic between modules, the "Signaling link of

local module is preferable" function of MTP should be used.
1.4 Precautions
The configuration database is the core database of the system, and the integrity and
reliability of the data should be ensured. To prevent mis-operation from affecting the
system, the O&M personnel should pay attention to the following factors when
configuring data:
1. Before data configuration, prepare accurate and reliable data related to the office,
and work out a complete data configuration scheme. A good scheme can not
only make data more clear and systematic, but also enhance system reliability.
245
For example, in the scheme, the active and standby signaling links to the same
office should be configured to different DT boards, so that the system can run
normally in case of board failure or replacement, and thus improving system
reliability.
2. Before any data modification, the existing data should be backed up. After the
modification, synchronize the data to the foreground, check them and then
immediately back up them in two copies to respectively the harddisk of local
terminal and floppy disk. Moreover, the "Configuration report management"
function should be regularly used to print the configuration data, to make hard
backup. In other words, the habit of “Back up → Modify → Back up" should be
made to avoid the loss of data.
3. The data configured and modified in the maintenance terminal will not take
effective until being synchronized to the foreground. To modify the data of the
office that have been put into service, it is necessary to carefully check the data
and before transmitting them to the foreground, to prevent any erroneous data
from interfering with the normal operation of the switch.
4. The configuration data will take effect immediately after being transmitted to the
foreground. However, after modifying the basic data, such as office capacity and
table capacity, it is necessary to firstly transmit them to the MP, reset the MP,
and then to transmit them to the MP again. After all these operations are finished,
the data will take effect.
246
2 Data Configuration Principles of
HLR/AUC
Knowledge points
z Data configuration principles of HLR
2.1 Physical Configuration

Besides the core principle of office direction connection, you should allocate the trunk
circuits which are within the same module and at the same office direction to at least
two DT boards, and signaling links to two STBs and two DTs in different DT boards.
In the unit configuration, you should perform "Adding all units without HW" firstly.
For the units with HW, in principle, you can configure the HW number and port
number as default configurations, and you cannot change the HW sequence at will,
excepting the necessary change due to hardware fault.
2.2 Office Capacity Configuration

You should configure the office capacity by module in order. Usually, you can use the
default configuration parameters. If capacity expansion is required for some office
directions, you need to submit application to ZTE CDMA Division, and then modify
the data after getting approval. The modified parameters and synchronized data cannot
take effect until the MP is restarted.
2.3 Service Data Configuration

1. "VLR configuration of local HLR"
You need to configure all the VLRs within the area controlled by this HLR.
This configuration item serves to check the local roaming and home mobility
management of the user. This configuration is used together with VHLR, to limit
the user within the home area and restrict the user from roaming to other areas.
247
For example, the user of Area A cannot roam to Area B.
2. "VLRIN configuration of local province"
You need to configure all VLRINs of this province. This configuration item
serves to limit the user within this province.
3. "Call options and parameters"
In general, you should not modify this item. If you need to modify it, you should
refer to the actual conditions.
4. "Number collection"
In principle, you need not to modify this item, and you can keep the default
configuration.
5. "Ringing code"
In principle, you need not to modify this item, and you can keep the default
configuration.
2.4 Configuration of Security Variable Control

According to actual conditions and security variable specifications, you can configure
it on site.
2.5 Principles of Subscriber Database Configuration

When setting up a new office, you can configure the database following the installation
naming specifications.
In "Basic Data\HLR database node configuration", "Subscriber database capacity" is

the DBIO capacity and need be configured according to the actual contract capacity;
"Database capacity alarm threshold" is 90% by default.
2.6 Subscriber Database Security Management

You must configure the backup and restoration functions of the subscriber database.
You must install the database monitoring program.
You must enable the active-standby database switching function.
248
3 Number Conversion Configuration
Knowledge points
z Principles of number conversion
z Instances of number conversion configuration
During the signaling processing, the HLR receives a lot of numbers, which are in
inconsistent formats. For the sake of consistent processing, the system converts such
numbers into internal format through the number conversion.
When the HLR sends signaling to the outside, it needs to provide numbers in the
corresponding formats as required by protocols or opposite office. So, the system
converts such numbers into signaling format through the number conversion.
The HLR system provides the number conversion function, that is, converting the
numbers as required upon signaling receiving/transmitting.
Such data involve subscriber registration, calling and forwarding registration, your
configuration is necessary.
3.1 Number Conversion Modes

At present, internal mode and signaling mode are supported.
1. The internal mode means to convert numbers into the internal format, that is,
country code + area code or access number + number.
2. The signaling mode means to convert the number into the format for signaling
transmission. The converted numbers are mainly transmitted to MSC.
There are independent interfaces for the each number conversion mode, to facilitate
your processing. In the number conversion, the HLRMAP provides the conversion
mode, and the foreground configuration process function searches for the longest
number with matched conversion mode and number type, to obtain its replacement
mode and other values for replacement.
249
3.2 Field Descriptions
3.2.1 Number Type
In the configuration four number types are available: Calling, called, forwarded, and
default (indicating any type of calling, called or forwarded).
In the number conversion, the HLRMAP needs to provide the type of the number to be
converted. The foreground configuration process function will search for the longest
number prefix in the configuration data with the same number type as input. If no
record matching the input number in the configuration data with the same number type
as input, the system will continue the searching in the configuration data of the
"default" type.
3.2.2 Conversion Methods
There are four methods: Full-replacement, adding of area code, adding of country code
+ area code, and deletion.
1. Full-replacement: According to the number to be converted, number type and

conversion mode, the system searches the matched record from the
configuration database, and uses the replacement digits in the database to
replace the matched part of the number to be converted.
For example, number 13302050001 matches the record of 133 → 86133, so

number 8613302050001 will be output.
2. Adding of area code: According to the number to be converted, number type and
conversion mode, the system searches for the matched record in the
configuration database, and adds the area code to the position specified in the
configuration to form a new number. The HLRMAP provides the area code.
For example, number 8652870605 matches the record of 865 → Add area code
25, so number 862552870605 will be output (area code 25 is inserted).
3. Adding of country code + area code: According to the number to be converted,

number type and conversion mode, the system searches for the matched record
in the configuration database, and adds country code and area code to the
position specified in the configuration to form a new number.
For example, number 52870605 matches the record of 528 → Add country code
+ area code 0, so number 862552870605 will be output (with area code 25 and
250
Chapter 3 Number Conversion Configuration
country code 86 inserted).
4. Adding of country code + area code: According to the number to be converted,

number type and conversion mode, the system searches for the matched record
in the configuration database, and deletes the configured digits from the initial
digit of the number to be converted, to form a new number.
For example, number 8613302050001 matches the record of 86 → Delete mode,

so number 13302050001 will be output.
3.2.3 Properties
Besides the numeral sequence, the number also has number properties, such as digit
type, numbering plan, encoding scheme, international property, available property, and
provision property.
For each property, you can select to input property value through configuration
management or HLRMAP. If the property value is input through configuration
management, this property value should be provided in the configuration. For example,
if you select to input the digit type property through the configuration management on
the configuration interface, you must input the digit type value in this interface.
In the functional interface provided to the HLRMAP, you should judge whether a
specific property is input through configuration management. If so, the value of this
property in the configuration database will be output; otherwise, the value input by
HLRMAP will be output. The value of each property should be configured in this way
separately.
3.3 Configuration Instances

We take the country of China, with country code 86, as an example, to describe the
configuration.
Application Location Operation Example Configuration Description Remarks

Forwarding
Forwarding
to
registration *92 00…………. Internal mode; forwarding number; deletion; 00 Mandatory
international
:
position
Forwarding
Internal mode; forwarding number;
to mobile *92 13384750003 Mandatory
full-replacement; 13 → 8613
position
251

Forwarding
Internal mode; forwarding number;
to PSTN *92 0254510312 Mandatory*
position
International-
terminated *710#00…………. Internal mode; called number; deletion; 00 Mandatory
call
Single
Mobile-termi Internal mode; called number; full-replacement;
service *710#13384750003 Mandatory
nated call 13 → 8613
PSTN-termin Internal mode; called number; full-replacement;
*710#0254510312 Mandatory*
ated call 025 → 8625
Called Internal mode; called number; full-replacement;
13384750005 Mandatory
number 13 → 8613
Internal mode; calling number;
LOCREQ
Calling 13384750003 full-replacement; 13 → 8613 Mandatory
number 0254510312 (SCA) Internal mode; calling number; Mandatory*
Returning International Signaling mode; forwarding number;
Mandatory
forwarding number full-replacement; 0 → 000
number Signaling mode; forwarding number;
Mandatory
Signaling mode; forwarding number;
Mandatory
Mandatory
Mandatory
Mandatory
Mandatory
Mandatory
Mandatory
Mandatory
Mandatory
Mandatory
252
Chapter 3 Number Conversion Configuration

Mandatory
Mandatory
Mandatory
Mandatory
Mandatory
Mandatory
Mobile Signaling mode; forwarding number;
13384750003 Mandatory
number full-replacement; 8613 → 13
PSTN Signaling mode; forwarding number;
0254510312 Mandatory*
number full-replacement; 8625 → 025
O Caution:
z It is required to configure all the national toll area codes. If the PSTN call number
begins with 86, configuration is also required.
z Pay attention to the National property. For the international number, you should
configure the National property to 1; for the national number, you should configure the
National property to 0.
253
4 GT Number Configuration Specifications
Knowledge points
z GT number configuration specifications of HLR
4.1 Overview of GT
4.1.1 GT Functions
GT number configuration functions to translate the route label in the GT number

format offered by the application layer into the destination signaling point or the GT
format of STP and DPC + SSN format (global name format and destination signaling
point code + subsystem number), and select the GT format or the DPC+SSN format for
transmission according to the actual network transmission characteristics.
The GT number configuration is used for SCCP routing. In the CDMA system, MAP
signaling between HLR and such entities as MSC in the networks is sent through SCCP.
All entities are in direct connection or transfer signaling through signaling transfer
points. After SCCP receives the messages from the MAP application layer, it will
send/receive/transfer these messages according to the route labels provided in the
messages. SCCP can send messages through networks in two modes: GT routing and
DPC+SSN routing.
The two routing modes are different when there is a Signaling Transfer Point (STP)
between the source SP and the destination SP.
The DPC+SSN routing mode requires that all signaling points in the network,
including the source signaling point, the destination signaling point and STP, can
identify the DPC. After signaling arrives at the intermediate node, it is directly sent
through the MTP layer, instead of the SCCP layer. In this case, much more DPC data
should be configured for the source signaling point and STP.
The GT routing mode can be used in the case that the source signaling point and some
STPs do not know the final DPC of this signaling. With this addressing method, when
signaling is sent to STP, GT should be first translated through SCCP into the
255
destination signaling point or the DPC of STP, and then messages can be transferred to
MTP for transmission. In GT routing, the source signaling point needs to send the
signaling to STP only according to the GT number prefix, so that STP can make further
translation to determine it is the next STP or the destination signaling point to which
the signaling will be sent. In this case, much less DPC data are required for the source
signaling point and STP.
4.1.2 GT Number Categories
In the ZXC10 HLR, the following three kinds of GT numbers need be configured:
1) CDMA system entity number (MSC number, HLR number, MC number, and
SCP number)
2) Mobile subscriber number (MSISDN)
3) IMSI number (that is, number in E212 format)
You need to judge whether the number in E212 format need configuration, according to
the detailed analysis result of "IMSI number analysis". For example, if you configured
MCC+MNC in "IMSI number analysis" to CC+NDC (for example, 86139) in E164
format, you need to configure the GT number in this E164 format here; if you
configured IMSI number analysis in "IMSI number analysis" to E212 number format
through HLT GT mode, you need to configure the corresponding GT number in E212
format here.
4.2 GT Number Analysis Selector
4.2.1 GT Translation Selector
GT type, translation type, numbering plan and address properties determine a selector
and its properties, such as country code, national maximum length, national minimum
length, international maximum length, international minimum length, GT translation
direction (forward or backward) and containing default GT or not,
1. Country code: If a GT number contains a country code, it is regarded as a

national GT number. GT translation will be made with national maximum digit
length (15) and national minimum digit length (5) . Otherwise, GT translation
will be made with international maximum (15) digit length and international
minimum digit length (5).
256
Chapter 4 GT Number Configuration Specifications
2. Translation direction (forward or backward): In terms of TG translation direction,

the rule to select GT is to start from the beginning, to choose the minimum
prefix of this number that can identify different office directions for analysis,
and to select as few identifiable prefixes as possible, to simplify GT
configuration. For the sake of convenient engineering commissioning, the
ZXC10 HLR system adopts the from-rear-to-head mode for GT translation. So,
when analyzing a GT number, the system firstly searches for the longest
matching item, and analyzes the numbers from the long numbers to short
numbers. For example, the analyzed number is 8613909876543. The system first
analyzes whether there is a matching item 8613909876543. If so, the analysis
ends; if not, it analyzes 8613909876543, 861390987654, 86139098765,
8613909876, …, until a matching item is found. In general, the forward
translation is performed. The backward translation in the case of the ascending.
3. Default GT: It means the selection of the default GT translation result of a

specific encoding plan. If this selector does not contain SCCP GT number, the
translation is usually fails. However, if this option is selected, the translation
result will be replaced by the default GT number result, with the prerequisite
that you have added default GT number to the selector. The default GT number
is configured in the selector properties. If necessary, you can output all data that
cannot be found in the MP to the GT translation point. In this case, you can
configure less data.
4. In the office configuration, if any screen translation type is selected, SCCP GT

translation type will be regarded as 0. Therefore, a selector with translation type
0 needs to be configured. The SCCP GT translation type is invalid. Such a case
also applies to screen numbering plan and address properties. This aims to
guarantee flexible GT translation and improve compatibility under the condition
that some contents of GT numbers presented in the existing networks are not
well regulated, and data entries input by some vendors are not standard.
4.2.2 GT Translation Selector Configuration
The GT translation selector corresponds to entries of diversified GT translation data. In

the CDMA network system of China Unicom, usually four GT translation selector
entries must be configured, as shown in Figure 4.2-1.
257
Figure 4.2-1 Four GT Translation Selector Types
GT selector 1:
ISDN/call numbering plan 1 with translation type as 0, used for call processing
routing and terminated SM call routing. In this selector, you should configure
MDNs of all subscribers of this HLR, and direct them to the local HLR.
GT selector 2:
Terrestrial mobile numbering plan 6 with translation type as 0, used for mobility
management routing, SM notification response and SM originating/terminating
response. In this selector, you should configure IMSI numbers of all subscribers
of this HLR as directing to this HLR office, MC number as directing to the
directly-connected SMC (direct connection) or STP (indirect connection), MSC
number as directing to the STP, and HLR number of this office.
GT selector 3:
ISDN/call numbering plan 1 with translation type as 128, used for SM

transferring and SM notification. In this selector, you should configure all
MDNs of this HLR as directing to STP (or SMC for the subscribers of
directly-connected SMC).
GT selector 4:
258
Terrestrial mobile numbering plan 6 with translation type as 128, not used in
HLR at present.
4.3 GT Number Analysis Data
4.3.1 Addressing Mode
The SCCP addressing mode of the CDMA network is: GT addressing mode is adopted
for intra-CDMA inter-province service and the to-SMC messages. In this way, the
originating LSTP/HSTP and terminating LSTP/HSTP address the destination SP
through two GT translation addressing operations. All HSTPs on the CDMA network
also function as the LSTP of this province, so they are expected to implement GT
translation. The addressing mode of intra-province service SCCP message is GT mode
as well.
The SPs address the No. 7 of another province in GT addressing mode. In GT

addressing mode, each SP transmits the messages to another province to the LSTP of
the local province. And then, the LSTP/HSTP of local province makes routing for this
message to the LSTP/HSTP of the destination province. At last, the destination
LSTP/HSTP translates this message to the destination SP of local province.
According to this requirement, the LSTP must be configured with all LSTP office
directions of the CDMA network and all HSTP office directions. In the GT number
translation part of the SCCP, the GT route should direct to the opposite LSTP. It cannot
be sent to the HSTP to translate to the opposite LSTP.
4.3.2 Number Analysis Digit Length
Requirements: According to H0H1H2 /M1M2M3 in the called GT address of Called

Party on the SCCP layer, the switch judges whether the message is an inter-province
service: If H0H1H2 /M1M2M3 is not the one of this province, this message is an
inter-province service. HSTP/LSTP analyzes the digit length of GT number as follows:
For the E.164 number, performing analysis to 86133 H0H1H2; for the E.212 number,
performing analysis to 46003 0X H0H1H2(IMSI) (X is 9, 3), 46003 09 44
M1M2(MSC GT), and 46003 09 H0H1H2(HLR GT).
4.3.3 GT Translation Data
The GT translation data configuration interface is shown below.

259
Figure 4.3-1 GT Translation Data Configuration
GT selector: Corresponding to the entries of diversified GT translations, a part of GT.
GT number: Minimum GT number prefix that can recognize different office directions
in the configured numbers for the selector, a part of GT.
SP office ID: Office direction of signaling transmission, selecting the DPC of the
signaling actually. According to the actual conditions, this DPC may be an STP or a
destination signaling point.
Routing indicator: 0—Routing by GT in field address 1 - Routing by DPC + SSN.
SPC indicator: Only active in the defined SS7 network.
SSN code: An subsystem code with meanings shown in Table 4.3-1. In the ZXC10
HLR, 0 is selected in most cases, indicating to forbid the SCCP from checking the
subsystem. If the target office ID is HLR, 6 can also be selected here (home location
register office).
GT indicator: Usually selecting 4 in the case of GT routing. The detailed meanings are
described in Table 4.3-2.
260
Table 4.3-1 Meanings of SSN Code
Value Explanations
0 Excluding SSN
1 SCCP management
2 Reserved
3 ISDN user part
4 OMM part
5 Mobile intelligent user part
6 Home location register
7 Visitor location register
8 MSC
9 Device identification center
10 Authentication center
11 Reserved
12 IN application part
13~252 Reserved
253 O&M application part of the BTS subsystem
254 Application part of BTS subsystem
Table 4.3-2 Meanings of Global Indicators
Value Explanations
0 The address field does not contain a global name
1 The global name only contains address property indicator
2 The global name only contains translation type

The global name contains translation type, numbering plan and address information
3
coding mode
The global name contains translation type, numbering plan, coding mode, and address
4
property indicator
4.3.4 Data Configuration Descriptions
1. In "SS7 management", you should configure all MDNs (E164) of this HLR in
"GT translation selector 1", and such numbers should be analyzed to 86133
H0H1H2H3. For example, for Guiyang,
86133296 (MDN of Guiyang) → Corresponding HLR (HLR of Guiyang)

261
2. In "SS7 management", you should configure all MSC numbers, local HLR
number, IMSI numbers subscribers of this HLR, SMC number and SCP number
in "GT translation selector 2". For the E.212 number, the analysis should made
to:
46003 0X H0H1H2(IMSI)(X is 9, 3),
46003 09 44 M1M2(MSC GT),
46003 09 H0H1H2(HLR GT)
MSC numbers → STP or directly-connected MSC office
Local HLR number → Local office
Subscriber IMSI number → Local office
MC number → STP or directly-connected MC office
SCP number → STP or directly-connected SCP office
3. In "SS7 management", you should configure all MDNs (E164) of this HLR in
"GT translation selector 3", and such numbers should be analyzed to 86133
H0H1H2H3. For example, for Guiyang,
86133296 (MDN of Guiyang) → STP or directly-connected SMC of this

province
4. In "SS7 management", "GT translation selector 4" is not used in HLR at present.
262
ACM-204-E1 Troubleshooting
Course Objectives:
z To know about the classification of faults
z To get familiar with troubleshooting principles and methods
z To master common methods for analyzing and locating faults
References:
z Reference Manual of ZTE Product Fault Grading V2.0
z Related technical documents of Customer Service Department of

CDMA Division
1 Fault Classification
Key points
Fault Classification
Grading standards for three categories of faults
1.1 Fault Classification

According to 7518311-2005 ZTE Work Regulation for Global Customer Support
Center – For Domestic Use, product faults can be divided into three categories – key
fault, major fault and ordinary fault based on their severity. See 7518311-2005ZTE
Work Regulation for Global Customer Support Center – For Domestic Use for
definitions of the problem categories. To judge the fault classification more accurately
and determine the starting point and line of thoughts for fault grading, the Work
Regulation offers the basis for fault grading as described below:
1) Product fault grading is based on the severity of the problem (the phenomena and
objective damages).
2) Fault grading is based on the impact on the system functions or the customer
services (impact here refers to impact on functions, service ability or the system).
Impact on functions: “number allocation unavailable”, “billing file recording

unavailable”, “trunk interrupted”, “unable to complete ** function”, etc.
Impact on service ability: “conversation unavailable”, “network access unavailable”,

“unable to offer ** service”, etc.
3) Fault grading is usually not determined according to the problem emergency level
which does not cover situations of “problems that must be graded as key fault because
of emergency”, “loss of security or emergency response ability (like 110 telephone)”,
or “damages possibly harming personal safety (like fires)”.
4) Fault grading is usually not determined according to the time period of the fault.
5) Fault grading is usually not determined according to the cause of the fault.
263
ACM-204-E1. Troubleshooting
6) Fault grading is not based on the percentage of the fault influence, but the
percentage can be given as the experience suggested value.
7) Fault grading is usually not determined according to the person responsible for the
problem.
The above guideline tells that product fault grading is not based on the cause, influence
percentage, time length, emergency level, responsible party, but on the impact on the
system functions or the service ability. The experience value of the impact scope (like
the number of wires) caused by product faults of some grade can be put forward during
definition, but it is not the absolute and necessary basis for grading. (During grading,
the impact of the product fault on the whole system should be considered, whether it is
closer to key fault, major fault or ordinary fault.) Besides, the time length of the fault
impact does not serve as the basis of fault grading but as the basis for fault emergency
level.
1.2 Key Fault (Level 1 Fault)

System breakdown, total loss of functions
All callers fail in the system voice services.
All called parties fail in the system voice service.
Total function loss of two (or more) MPM modules in the multi-module system
of ZXC10-MSC/VLR
Total function loss of two (or more) CPM modules in the multi-module system
of ZXC10-HLR/AUC
The foreground MP lost accidentally the CDRs (Call Detail Record) for more
than 30 minutes and the lost CDRs cannot be recovered.
Faults occur in more than 1% of CDRs and they cannot be recovered.
The subscriber database is interrupted (active and standby machines are invalid
at the same time) and the start of the standby node fails during the time period
set by the system.
Fires caused by using products
Personal injury caused by using products
264
Chapter 1 Fault Classification
1.3 Major Fault (Level 2 Fault)

All interconnected trunk circuits are disconnected.
All interconnected signaling links are disconnected.
All services on one MPM module in the ZXC10-MSC/VLR multi-module

system are lost.
All services on one CPM module in the ZXC10-HLR/AUC multi-module

system are lost.
The foreground MP accidentally lost the CDRs of more than 10 minutes and the
lost CDRs cannot be recovered.
Faults occur in more than 0.01% and less than 1% of the CDRs and they cannot
be recovered.
The key standby/redundant nodes in the system have faults and have no spare
parts to replace them, such as MP, switching network board, server
dual-computer system, minicomputer, service processor, etc.
1.4 Ordinary Fault (Level 3, Level 4 Faults)

Some interconnected trunk circuits are disconnected.
Some interconnected signaling links are disconnected.
Some trunk circuits in A interface are disconnected or intermittently

disconnected.
Some signaling links in A interface are disconnected or intermittently

disconnected.
Some interconnected trunk circuits are disconnected or intermittently

disconnected.
Some interconnected signaling links are disconnected or intermittently

disconnected.
Supplementary services that are not of basic-voice-call-type are abnormal.
The foreground MP accidentally lost the CDRs for more than 10 minutes and the
loss cannot be recovered.
Faults occur in less than 0.01% of the CDRs and they cannot be recovered.
265
Operation and maintenance server cannot implement daily maintenance or

management.
266
2 Troubleshooting Principles and Method
Key points
Troubleshooting principles
Common troubleshooting tools
Common troubleshooting methods
Common fault information collection
2.1 Troubleshooting principles

In handling the equipment faults, the maintenance personnel should observe the basic
principles: one, observe; two, query; three, think; and four, take action.
2.1.1 View
After arriving at the site, check the fault phenomenon, that is, the part of the equipment in
failure and the alarm generated, the severity and degree of harming, to find out the real
cause.
In viewing phenomena, multiple tools provided by the system can be used, such as
performance statistics, signaling tracing, alarm query, log query and service observation.
2.1.2 Inquiring
After observing the phenomenon, ask the on-site personnel at the various phases for the
fault cause, like whether anybody has modified any data, deleted any files or replaced any
circuit board, and whether there is any electricity failure, lightning stoke or mis-operations.
2.1.3 Think
On the basis of what you have seen and the inquiry results, make consideration and analysis
on the possible causes of the fault, to get a judgment as correctly as possible.
2.1.4 Taking Action
According to the three steps above, locate the fault point and perform troubleshooting by
267
means of data modification and circuit board replacement.
In formal equipment operation, you must give a consideration to busy time and the
potential consequence of the busy-time operation. For anything unclear, you may consult
the technical support personnel of ZTE.
& Tip:
Strong technical fundamental knowledge and the skilled use of daily maintenance tools are
the most important for troubleshooting, besides following the principles.
2.2 Common troubleshooting tools
2.2.1 Fault Management
Fault management tool provides all alarm and notification messages of the system, to let
the maintenance personnel know the fault in the earliest time and provide basis for
troubleshooting.
2.2.2 Configuration management
Configuration management provides data configuration of the system as well as dynamic

management tools. As one of the most commonly used tools for daily maintenance and
troubleshooting, it can supervise and change the status of trunk circuits and signaling and
conduct management and operation over switch network resources and tone board
resources.
2.2.3 Signaling trace
Signaling trace tools can track the signaling in the system, like BSSAP, CC, VLRMAP,
MSCMAP, HLRMAP, TM, TUP and MTP messages. It can track both the signaling of a
single subscriber and all subscribers and signaling links, thus very useful for problem
judgment and solution.
2.2.4 Service observation
Service observation tool can track all failures in the system, directly find and provide the
causes through detailed description of failure causes. Together with signaling track tools, it
can solve most faults in daily life.
Service observation tool can also observe the occupancy of various data areas in the system
268
Chapter 2 Troubleshooting Principles and Method
and provide the basis for fault location, analysis and solution.
2.2.5 Performance Statistics
Performance statistics can make statistics over the system operation parameters. Through
analysis of the parameters, the system faults and operation status can be better analyzed.
2.2.6 Diagnosis test
Diagnosis test is an effective tool to test and judge hardware faults and can test easily the
faults of boards.
2.3 Common troubleshooting methods

This section tells how to locate quickly the emergent faults to entities (MSC, HLR, BSC) or
peripheral modules of CDMA system, in order to reduce the fault coverage, shorten
troubleshooting time and avoid fault expansion due to mis-operation of entities. The fault
location methods described below are edited in line with the system working principles
through direct test and observation. Thus they are very pragmatic and able to locate most
emergent faults. No doubt this section cannot cover all emergent faults. It may not apply
to individual faults that need to be located by on-site and background personnel. Some
methods also offered in the section can guide all-around collection of valid fault messages
on site and accurate and timely feedback of the messages to the background, for the
background to quickly analyze and locate faults and direct the foreground to solve them.
2.3.1 Voice call test
When a subscriber receives the fault feedback or complaint, a verification test usually
needs to be done first. Test call is the most common and simple method.
2.3.1.1 To locate faults through dials
1. To prepare one ordinary subscriber mobile and a WIN subscriber mobile, both have
not been switched on or off since faults occurred and both are on, (the purpose of
being switched on is to make sure that the subscriber is registered in VLR).
2. Use these two phones to call PSTN or GSM subscribes respectively.
3. Call these two phones respectively.
269
2.3.1.2 Voice test result diagnosis
1. If CDMA mobile calls PSTN or GSM subscribers successfully, faults are probably in
HLR. But further test is needed. If it is not successful to call CDMA mobile, then
faults are almost in HLR.
To avoid incomplete information during the test, you’d better prepare several CDMA
mobiles for test.
2. If CDMA mobile cannot call PSTN or GSM successfully and CDMA is

unsuccessfully called, the faults are mostly in MSC or BSC. Then conduct signaling
trace or fault observation to determine whether faults are in MSC or BSC. For
instance, after MSC sends signaling messages to BSC, if BSC does not respond, the
faults may be in BSC. If MSC does not send signaling message to BSC, then faults
may be in MSC.
3. If ordinary subscriber mobile calls normally but the subscriber of intelligence

network calls abnormally, the faults are usually in SCP. Further confirmation can
be made combining signaling track. For instance, when SCP has faults, MSC
cannot receive the response signaling message returned by SCP, since MSC and SCP
need to exchange signaling when MSC calls or is called.
2.3.2 Alarm test judgment
Alarm information and notification directly reflect the system running situation. During
emergent faults, alarm information or notification can be queried to locate faults.
If alarms in the Tab. 2.3-1 exist in current alarms of MSS fault management system, then
emergent faults may exist in the corresponding sub-system.
Tab. 2.3-1 Major alarms in MSS fault management system
MSC sub-system alarm HLR sub-system alarm

Switching network dual faults Active Database Temporarily Disconnected
From the System
Clock Synchronization Board (SYCK) Alarm The MPM unable to communicate with the
service processor
Optical Board Link Alarm Service processor UB over-threshold alarm
Inter-Module Communication Interruption TCAP dialogue ID over-threshold alarm
Active/Standby MP Communication Interruption of communication between the
Blocked alarm server and MP
270
MSC sub-system alarm HLR sub-system alarm

MPMP COMM board Failure Level 1 load alarm reported by service
processor
MPPP communication board fault All SYCK References Failed
All T Net Resources Faulty Standby Database Temporarily Disconnected
From the System
TCAP dialogue ID over-threshold alarm Alarm on Unreachable Signaling Point
Interruption of communication between the
alarm server and MP
Alarm on Unreachable Signaling Point
2.3.3 Performance statistic database observation
Number of all attempts, system connection ratio and voice connection ratio in the
performance statistics data directly reflect the MSC running. With MSC system structure
becoming increasingly complex, faults become more hidden. The performance statistics
data of various modules can be used to judge the module where faults occur.
2.3.3.1 Real-time statistics
During emergent faults, quickly open ZXC10-MSS performance statistics system, select
“MSC system/basic call data”, right click and select “real-time data”. Select all modules in
sequence in the right-hand data statistics box and click “start real-time observation” button
. Since the real-time statistics granularity is 15 minutes, the latest statistics data can
be observed only 15 minutes after the setting of real-time observation.
If MSC is single-module or multi-module structure, data of each module should be

included in statistics.
If MSC is central-rack structure, peripheral modules above 3# module should be included

in the statistics. 1# and 2# modules are not needed to count, so they do not have call
attempts.
2.3.3.2 Analysis according to performance statistics data
1. For central-rack system
If the system connection rate and voice answer rate of all peripheral modules in the
system are not close to each other, and that of one module is that low, then the faults
may be in that module (for example, faults of the module itself or blocked
communication between this module and central module).
271
system are close to each other, there may not be faults in peripheral modules or one
of them, but some other causes.
2. For multi-module system
system are not close to each other, and that of one module is that low, then the faults
may be in that module (for example, faults of the module itself or blocked
communication between this module and central module).
system are close to each other, there may not be faults in peripheral modules or one
of them.
3. For single-module system
If the number of call attempts is 0 or very low, then faults are usually in that module.
If the number of call attempts is high but the system connection rate and voice
answer rate are very low, then faults may be in other systems, like HLR.
2.3.4 Date area observation
Some emergent faults are caused because abnormal occupancy of data area. Resources of
some data areas are substantially occupied, resulting in the phenomena that the system
cannot get data area resources and the service fails. Sometimes the system cannot occupy
the data area and the service also fails.
2.3.4.1 Judgment according to data area occupancy
1. If the utilization rate of some data area in a module is close to 100% and the number
of utilized data areas are almost the total number, this module may be faulty.
2. If the utilization rate of all data areas in a module is always 0, then this module may
be faulty.
2.3.4.2 Data areas able to be observed during emergent faults
1. MSC System
A interface data area, CC data area, TCAP DOWN data area, TCAP UP data area,
GMSC data area, MAP data area.
2. VLR System
272
PDB data area, Remark data area, DID data area
3. HLR system
MAP data area, MAP dialogue data area, TM data area, TCAP DOWN data area,
TCAP UP data area
2.3.4.3 Data area observation
Open ZXC10-MSS service observation system, select the “statistics observation” icon pane,
as shown in Figure 2.3-1. Select data areas to be observed as “A,CC,TACP DOWN,TCAP
UP” as directed in the figure, select modules to be queried in the right, and then select
“start statistics” for observation finally. Observation results can be saved through screen
capture. In normal cases, the Percentage values of A,CC,TACP DOWN,TCAP UP are
low.
By following the same steps, select MSC, VLR for observation. Operation is the same for
HLR system.
Figure 2.3-1 Service observation - data area observation
273
2.3.5 Failure observation statistics
Since failure observation can record the current failure causes, it can provide references to
fault cause analysis after resumption of emergent faults. So when emergent faults occur,
open failure observation to record fault causes.
2.3.5.1 Methods for failure observation
Open ZXC10-MSS service observation system, select the pane of “failure observation”, as
shown in Figure 2.3-2.Delete original records before operation. Select the system to be
observed “MSC or VLR”, select modules to be queried in the right (“select all” is OK),
select “start observation” finally to observe, make calls during observation and make
analysis through observation of failure causes. Save observation results. Close
ZXC10-MSS service observation system first and find C:\ZXC10\TOOL directory. There
may be a lot of files in TOOL directory. Please only copy the files generated recently rather
than other files of history record. Compress and send back for analysis.
Following the above steps, select MSC, VLR, HLR for observation. Operation is the same
for HLR system.
Figure 2.3-2 Service Observation Tool – failure observation
274
2.3.6 Signaling trace
Singling trace is also very useful to locate faults. In the case of single user tracing,
examples include tracing BSSAP, VLRMAP, MSCMAP in the caller process, and tracing
HLRMAP in the called process.
Singling tracing analysis needs technical fundamental knowledge. Call process must be
mastered.
2.3.7 Supplementary test
2.3.7.1 Console test
When CDMA is not successfully called, query or revise subscriber data on the HLR
console. If the operation fails, then faults may be in the HLR database connection.
2.3.7.2 Checking the LAN
When broadcast storm happens in LAN, communication among the nodes becomes
abnormal. For HLR system, communication not allowed between subscriber database
server and service processor causes impact on the called party services.
Test method
Test whether there are packet losses by the client end ping IP addresses of other nodes.
Check whether the indicator at the SWITCH port is green and flashed normally (not quick
flash).
2.3.7.3 Diagnosis test
Through the “inter-module instant test” function of the diagnosis and test tool of the system,
test the inter-module communication of the MSC and determine if the inter-module
communication is normal.
2.4 Common fault message collection
2.4.1 Signaling trace result
Signaling trace provides importance evidence to fault location. On-site timely and
accurate feedback of signaling trace results including trace results of MSC/VLR and HLR
275
systems will greatly improve the fault analysis efficiency.
Collection Mode
After signaling trace is turned off, close the signaling tracing system. Then the content of
signaling tracing is saved in C:\zxc10\SigData directory and just copy the content,
compress and send back. (Note: The signaling tracing program must be turned off first
and then copy. Otherwise, the content is blank. )
2.4.2 Failure observation results
During signaling tracing, open service observation to conduct failure observation and
feedback the observation results of MSC/VLR and HLR. Failure observation content is
also important consideration for fault location and analysis.
Collection Mode
After closing service observation, copy the whole C:\zxc10\tool directory, compress and
send back.
2.4.3 Collection of performance measurement data
In the MSS performance statistics, collect the performance statistics data from two days
before the faults till present in the manner of “minimum granularity, not balanced,
according to module”, save the data in files, compress and send it back.
Note: If the data of the very day is to be collected, select “refresh data” on the performance
statistics interface.
2.4.3.1 Data collection for MSC performance statistics
1. Basic Traffic Data
If possible, collect all items of all call types, to guarantee “the number of call
attempts”, “the number of occupancies”, “the number of connections” and “the
number of answers”.
2. Circuit group traffic data (used for office fault)
If possible, collect all items of all call types, to guarantee “the number of call
attempts”, “the number of occupancies”, “the number of connections” and “the
number of answers”.
3. Resource occupation ratio
276
2.4.3.2 VLR needs to collect the following data:
1. ”Registered subscriber quantity in this VLR” in the subscriber quantity statistics
2. ”The number of paging requests”, “the number of successful paging requests” in

statistics data of other items
2.4.3.3 NO.7 needs to collect the following data:
1. “The number of answer signals for incoming/outgoing call”, “the number of

outgoing/incoming office IAM/IAI messages” in the office data.
2.4.3.4 HLR needs to collect the following data:
1. Statistic Data of Mobility Management
2. Call Statistic Data
3. Statistic Data of HLRDB Access
4. Resource occupation ratio
2.4.4 Acquisition of log files
2.4.4.1 error.log file in the ZXC10 directory of 129 server
Naming format of collected files:
Place _ mm dd_ equipment _ Error
For example, Datong _0610_MSC_ Error, Datong _0610_HLR_ Error
2.4.4.2 SerRun.log file in the ZXC10 directory of 129 server
Place _mm dd_ equipment _ SerRun
For example, Datong _0610_MSC_ SerRun, Datong _0610_HLR_ SerRun
2.4.4.3 measureEthernet.log file in WINNT directory of 129 server
Place _mm dd_ equipment _Ethernet
For example, Datong _0610_MSC_ Ethernet, Datong _0610_HLR_ Ethernet
2.4.4.4 All files in C:\trace\ of MAP service processor
277
Place _mm dd _module number _trace
For example, Datong _0610_141#_trace
2.4.4.5 C:\winnt\oErrLog.Zev files of MSC/HLR 129 server
Place _mm dd_ equipment _oErrLog
For example, Datong _0610_MSC_oErrLog, Datong _0610_HLR_oErrLog
2.4.4.6 C:\winnt\oErrLog.Zev files of billing server 132/131
For example, Datong _0610_ billing 131_oErrLog, Datong _0610_ billing 132_oErrLog
2.4.4.7 C:\winnt\oErrLog.Zev files in subscriber database server 151/152
For example, Datong _0610_HLRDB_151_oErrLog, Datong

_0610_HLRDB_152_oErrLog
2.4.4.8 SQLMonitor.txt under C:\conFigure in subscriber database server 151/152
Place _mm dd_ equipment _ node number _SQLMonitor
For example, Datong _0610_HLRDB_151_SQLMonitor, Datong

_0610_HLRDB_152_SQLMonitor
2.4.4.9 System logs and application program logs of the server
Just open the event viewer of the operation system and save as system logs and application
program logs
Naming format of the collected files:
Place _mm dd_ equipment _XX log
For example, Datong _0610_MSC129_system log, Datong _0610_MSC129_ application

program log
278
2.4.4.10 Operation Log
Collect the operation logs from a week before the fault till present:
Place Mevt yy mm dd hh mm. log
For example, DatongMEvt2004817151916.log
2.4.4.11 Server SQL log
SQL log of MSC 129 server is named as Datong_0610_MSC129_SQL log
SQL log of HLR 129 server is named as Datong_0610_HLR129_SQL log
Database dual server log is named as Datong_0610_HLRDB_SQL log.
Collection mode: Compress all files within log folder through resource manager and name
them, as shown in Figure 2.4-1.
Figure 2.4-1 Sketch map of Server SQL log directory
2.4.4.12 Alarm Message collection
Collect present alarm messages and history alarm messages one week before the faults.
279
Collection mode: Open<fault management alarm system/query present alarms>, alarms of

all classes.
Collection mode: Open <fault management alarm system/query history alarms and
notifications>, query the notifications and alarms of all classes within a week.
2.4.4.13 Check the hard disk space.
Note: The hard disk space must be observed in the active server !!!
280
3 Common Methods for Analyzing and
Locating Fault
Key points：
：
Common methods to handle problems related to hardware, trunk signaling, system

running, click and services.
This section makes preliminary analysis for the causes of some faults and offers
possible causes and solution line of thinking. Since the situation on spot is complex,
real causes of some faults may not be given in this section. Effective fault information
will be collected comprehensively on the spot and sent back to the background, and the
fault spot and the background locate the faults together.
3.1 Hardware problem

When the system hardware has problems, fault management tool will give related fault
alarm message, through which we can make further check, find the causes and adopt
measures to solve the problem.
3.1.1 DT Control Unit Failure
Fault in the digital trunk control unit in a slot is usually because the system can not
detect the unit.
Causes may include:
1) No digital trunk board is plugged in the slot.
2) The digital trunk board is powered down.
3) The board plugged mismatches the configuration type. For example, the
configuration type is DTI board, but DTEC board is plugged.
4) The board is damaged.
5) HW cable is connected incorrectly or not connected.
Check according to possible causes. If it is not board unconnected or misconnected,
281
replace the board. If the fault disappears after the board is replaced, the cause
may be board damage. If not, check HW cable connection and configuration.
3.1.2 Environment monitoring board fault
Fault management tool reports fault messages and the system cannot detect the
environment monitoring board.
The environmental monitoring board is powered down, damaged or unplugged.
Check whether the PEPD board is in position, whether the power supply is normal, and
whether the board is damaged.
3.1.3 Monitoring board fault
Fault management tool reports fault messages and the system cannot detect the MON
board.
The monitoring board is powered down, damaged or unplugged.
Check whether the MON board is in position, whether the power supply is normal, and
whether the board is damaged.
3.1.4 Single Fault with the Switching Network
Fault management tool reports fault messages, showing that one of active/standby
switch network boards (including DDSN, CDSN, CPSN) has faults. When one
DDSN board is unplugged or powered down, normal running of the switching
equipment will not be affected, but the equipment safety will be weakened.
It is worth noting that alarm messages are not necessarily sent due to hardware faults
and judgment needs to be made according to the recovery of alarm message. If alarm
messages exist for a long time, probably it is the board hardware that fails and
troubleshooting can be done by replacement of board. If the alarm messages are
recovered quickly, it is because network boards fail during running and are
automatically reset, and then it needs to collect related logs and alarms on site and
feedback to ZTE CDMA Department to get technical support.
3.1.5 SMEM Board Failure
Fault management tool reports faults and the system cannot detect the shared memory
board.
282
Chapter 3 Common Methods for Analyzing and Locating Fault
The shared memory board is the key part for the active/standby MPs to synchronize
and share data. Fault on this board will result in unsuccessful data synchronization
between active and standby MPs, changeover unable to be completed, etc., which is
harmful to the safe system running.
Handle immediately while seeing such alarms, replace the board and have further
observation.
3.1.6 Net drive board alarm
It refers to the alarm on DSNI board damage.
DSNI mainly provides interfaces for signals between MP and the T network, and
between SP and the T network, as well as performs the driving function of various
transmission signals between MPs, SP and the T network. DSNI falls into the two
categories: MP-level interface board and SP-level interface board.
The MP-level interface board converts 8Mb/s flow and 2Mb/s flow of the message
channels from SP level to MP level, and distributes the 4M and 8K clocks to the
communication board. It has active/standby difference.
The SP-level interface board changes HW from single-end driving to difference driving
or from difference driving to single-end driving, and distributes 8M and 8K clocks to
different levels of SPs. It has no active/standby difference.
Check whether DSNI board is unplugged or powered down. If this board is faulty,
replace it.
3.1.7 The standby MP faulty.
In normal running, both active and standby MPs run at the same time. The indicators of
both MPs flash synchronously. If the standby MP is faulty, RUN indicator of the
standby MP will not flash, and the alarm indicator will be on.
Main causes of this fault is that the standby MP has not been normally started or
the switch handling task has not been normally started after the start of standby MP.
Handling method is to access the MP to the displayer, start the observation to judge
whether there is problem in MP start or version running. After determination of
problems, replace MP or remake MP.
283
3.1.8 Bill data writing disk failure in the charging server
Operation fails when the charging server writes the bill into the disk array.
When a bill is generated in MP, it is sent to the charging server in real time. The
charging server will save it temporarily and provide an interface for the charging center
to read the bill. If it fails to write the bill data to the disk in the charging server, the
charging center can not extract the bill.
If a disk writing operation failure suddenly occurs on a normally running charging

system, the cause may be one of the following:
1) Disk write-protected: caused by deficient access authority or incorrect operation.
2) Disk inaccessible: caused by power failure, disk array fault, server disk array
driving failure, and disk array not correctly taken over by the active server.
3) Insufficient disk space: Although the disk space is not smaller than 200M, this
fault occurs when the size of bill file is greater than the remaining space.
Check and handle according to the possible cause.
3.2 Trunk signaling
3.2.1 DT PCM Alarm
Each digital trunk board has four PCM ports. If the board is running normally but poor
signal quality is detected in one or more PCM ports, the digital trunk PCM alarm will
be reported.
Causes may be the following:
1) Frame out of sync.
2) Multi-frame out of sync.
3) Peer end frame out of sync.
4) Peer end multi-frame out of sync.
5) All ‘1’s in TS0
The solution is to check whether the transmission circuit is smooth or whether there are
errors. If not, check the synchronization clock to synchronize the clock with the peer
end.
284
3.2.2 SCCP Alarm
The SCCP is built on No. 7 circuits which are assumed to be normal.
Main reason is that SSN configuration is not consistent at two ends. Cooperate with
the peer end to check the SSN configuration data.
3.2.3 No. 7 Circuit Out-of-service Alarm
The No. 7 circuit is configured on the PCM. This alarm occurs when this circuit is
faulty. In general, it accompanies a trunk circuit alarm.
Cause:
1) The No.7 circuit deactivated;
2) Transmission is interrupted.
3) Fault in the port;
4) Configuration data of this circuit is changed (i.e. data configuration of cic, slc
are inconsistent with the peer end).
5) Fault in the No.7 processing board.
Check if a PCM alarm or trunk alarm also exists in the port. If not, the hardware is
normal. Check and ensure that transmission circuit is normal.
Try to activate the circuit. If it cannot be activated, cooperate with the peer end to
check the configuration data of the circuit.
3.2.4 Alarm on Unreachable Signaling Point
Signaling points are connected via the signaling route that is established on No.7
circuit. Between two signaling points there may be direct signaling route, or, more
commonly, indirect signaling route.
Cause:
1) The signaling point does not exist any longer.
2) There is fault in the indirect signaling route to the signaling point.
Solution: first check whether the signaling point exists. If not, delete the signaling route
from this end to the signaling point. If the local No. 7 circuit is normal in the indirect
route from this end to the signaling point, then the fault is at some place outside this
285
end. Try to notify the transfer point to check and handle.
3.3 System Running Problem
3.3.1 Optical line board active/standby alarm
CFBI board and FBI board have inconsistent active/standby statuses.
In ordinary cases, FBI board cannot independently determine its active/standby status;
rather, it can only do so by receiving the active/standby status signals send by CFBI
board. FBI board connected with active CFBI board is active, while FBI board
connected with standby CFBI board is standby.
Forced switchover will occur when the active FBI board is faulty. At that time the
standby CFBI board will detect the signal of active FBI board and report the alarm.
When active link between active CFBI board and the peer end FBI board is found
interrupted, changeover will occur and the rest FBI boards connected with the switched
over CFBI board will follow suit. After the completion of changeover, the standby
CFBI board cannot detect the signals of active FBI board and the alarm will
automatically disappear.
The reason for this alarm is that the FBI board at the peer end works abnormally.
Check the work status of FBI board and handle the fault.
3.3.2 No.7 COMM board failure
The STB COMM board (one of COMM boards) is used to process SS7. Each
switching module has two or more STBs based on the payload in it, which are installed
in the slots from the right to the left in the control shelf. There are three kinds of
COMM boards installed in the control frame, which looks the same. STB is the one
whose indicator flashes quickly when the board runs.
Check whether the STB board (one of COMM boards) is unplugged or powered down.
If this board is faulty, replace it.
3.3.3 MPPP COMM board failure
The MPPP communication board (one of COMM boards) is used for the intra-module
communications. Each switching module has two or more MPPPs based on the payload
in it, which are installed in the slots from left to right near MPMP in the control shelf.
286
Faults in MPPP communication board are usually because MPPP comm. board is
powered down or damaged.
Check whether MPPP board (one of COMM boards) is unplugged or powered down. If
this board is faulty, replace it.
3.3.4 MPMP COMM board failure
The MPMP COMM board (one of COMM boards) is used for the inter-module
communication. Each switching module is configured with two MPMPs that are
installed in the two slots near the MP in the control shelf.
Faults in MPMP communication board are usually because MPMP comm. board is
powered down or damaged.
Check whether MPMP board (one of COMM boards) is unplugged or powered down.
If this board is faulty, replace it.
3.3.5 Inter-module Communication Breakdown
In multi-module configuration, inter-module communication breakdown shows that

communication between two modules is interrupted. Check in order the statuses of
MPMP board (one of COMM boards), FBI board, CFBI board or DTI board for
inter-module connection, optical fiber or 2M cable connected between modules.
Handle the faults accordingly.
3.3.6 OIB Alarm
Inter-module communication is conducted through optical channels. Faults in optical

interface board will usually cause inter-module communication problems, affecting the
normal operation of switches. So pay attention to OIB.
When alarms occur in OIB, check in sequence the clock reference, connection optical
fiber and optical boards. If there are faults, handle them accordingly.
3.3.7 Fault of the communication link with JFServer
Alarms when communication between MP and charging server is interrupted.
If communication between MP and charging server is interrupted, bills cannot be

transmitted to the background in real time, but temporarily saved in the hard disk of
MP. Such situation, if not changed for a long time, bill files will take up all the hard
287
disk space of MP, causing severe effects like MP unable to run. So the fault must be
immediately addressed.
First check whether the charging server runs normally and relevant application
programs are normally started.
Then check whether the network card, network cables and the HUB port of the
charging server are in good condition. Check whether communication with the
foreground is normal through ping command.
Handle the fault accordingly.
3.3.8 Interruption of communication between the alarm server and MP
Alarms generated in the foreground are sent to the alarm server (the alarm server is
generally integrated with the background O&M console, called 129 server) by the MP,
and then sent to the O&M consoles by the alarm server.
When the said alarm occurs, the foreground loses contacts with the background, and
the system is unable to detect the running situations in the foreground. It is adverse to
the system running.
Check whether the MP is running normally. Check whether the network cables and
HUB work normally and whether the network card of the alarm server is faulty.
Handle the fault according to the examination result.
3.4 Clock problem
3.4.1 Some CKI References Failed
The clock interface board (CKI) can either extract clock from many clock references or
generate clock reference by itself. When the external reference fails, CKI will provide
the clock reference generated by itself for the equipment.
The present CKI board of ZTE can generate clock reference with accuracy level 2,
which is enough for common exchange offices.
The clock reference extracted from external may be faulty. Check whether CKI board
is faulty and whether clock reference is faulty. Check the transmission cables, DTI
board and CKI clock reference extraction cable connected with clock reference. Handle
the faults accordingly.
288
3.4.2 Loss of Reference for Over 10 Minutes
If SYCK has lost the reference for over 10 minutes, the alarm will occur.
Usually, the clock reference of an exchange is synchronous with the upper-level

exchange or Bits clock. If the clock reference is lost, time of the local exchange office
remains in the maintenance state. After a period, the local office time may produce
error, compared with other interconnected offices, thus affecting signal transfer and
damaging service.
Make sure clock references are without fault. Check the transmission cables, DTI
board and SYCK clock reference extraction cable connected with clock references. If
SYCK extracts the clock from CKI board, check CKI board.
3.4.3 All CKI References Failed
If all CKI references are abnormal, this alarm will occur.
Check whether clock references are faulty. Check the transmission cables, DTI board
and CKI clock reference extraction cable connected with clock references. Check
whether CKI board is faulty itself.
3.4.4 All SYCK References Failed
If all SYCK references are abnormal, this alarm will occur.
The clocks extracted by the SYCK board have several references. The common
exchange can only provide one or two clock reference(s). If the phase of all the clock
references overrides an allowed range, this alarm may occur.
First make sure that SYCK board is without fault, then check whether clock references
are faulty. Check the transmission cables, DTI board and SYCK clock reference
extraction cable connected with clock references. If SYCK extracts clock from the CKI
board, check the CKI board.
3.5 Company service problems
3.5.1 Vacant Number Problem
The caller hears the announcement of vacant number.
The reasons for vacant number may be:
289
1) The number that the subscriber is dialing is invalid or incorrect. The MSC
number analysis result is empty.
2) The subscriber is dialing the correct number but the MSC number analysis
configuration is omitted.
3) The called number is really a vacant number.
4) The called number is forwarded to a vacant number.
5) In the network interconnecting, the opposite network returns empty signal or

voice prompt.
In the case of a vacant number, first judge whether the vacant number is generated
inside or outside the office, through the failure observation in signaling tracing tool and
service observation tool.
There are two kinds of outgoing vacant number flows:
1) After the caller sends IAI, the called returns ACM. Then the calling hears the
number-unobtainable tone played by the opposite exchange. If the called number
in IAI is correct, it is sure that the opposite exchange or other exchange in the
network is not opened.
2) After the caller sends the IAI, the called returns the UNN. Now the caller gets
the number-unobtainable tone played by the local exchange.
In both cases, corresponding signaling can be observed in signaling tracing. The

problems can be located to the peer end exchange through test calls.
If the vacant number is generated inside the exchange, concrete failures can be
observed through failure observation. Check the configuration data and the number
dialed by the subscriber to locate the fault.
3.5.2 The called number cannot be connected temporarily.
The calling hears the announcement of temporary connection failure.
The causes may be the following:
1) MSC sends paging to the called and does not receive the response, and therefore
the caller hears “temporary connection failure”.
2) In the interconnection between networks (including remote 133 call), when the
TUP sends the IAI, the peer end returns CFL (backward creation failure). CFL is
290
the only message when the TUP cannot give an exact signal for a cause in PSTN,
CDMA, the interconnection between CDMA and GSM etc. At present, the MSC
will play “The called number cannot be connected temporarily” when receiving
CFL. It can be changed into another prompt tone via the tone playing
configuration.
If it is the signal problem, a paging can be found in the signaling tracing of BSSAP to
send to BSC, but BSC does not return paging response. Due to the complexity of air
interface, it is normal to have paging not responded, in particular where signals are bad.
Make statistics over the performance indicators through performance statistics tool. If
the indicators are abnormal, try more to find reasons.
If it is the problem of interconnection between networks, the failure message returned

from the peer end can be found in the TUP message. Feedback the problem to peer end
office to find the cause together.
3.5.3 Subscriber not active
The caller hears the announcement that the subscriber has powered off.
Analyze the phenomena carefully. The cause may be:
1) The call is forwarded to a subscriber that has powered off.
2) The subscriber has activated the “Do Not Disturb Service”.
3) The MS has been in a place where there is no signal for a long period of time.
The VLR does not receive the periodical registration message from the MS
during the specified period, and the VLR (HLR) will set the MS as power-off
state.
4) The base station forward power is too high (strong signal is displayed in the MS),
while the MS reverse power cannot suffice the requirement. When the MS is in
some places far away from the base station for a long period of time, the VLR
cannot receive the periodic registration message in the specified time. Thus the
VLR (HLR) sets the MS as power-off status.
5) The mobile and the card are bad connected or the card is faulty, so after powered
on, the phone is normal but the card cannot be registered.
For the above cases, first check VLR or HLR through HLR console tool and VLR
probe tool to see whether the phone is power off.
291
Check whether the subscriber has activated the “Do Not Disturb Service”.
Check call forwarding of the subscriber. If there is call forwarding, check the state of
the MS with call forwarding.
3.5.4 Number displaying problem
When a call is received, the number is not displayed or displayed incorrectly.
Main causes:
1) The number displaying is restricted or the number is kept secret. Ordinarily, the
caller has applied the number secrecy function.
2) The number displays double area codes, which usually occurs in the calls sent
from PSTN. Observe the calling number in IAI of TUP signaling, and pay
attention to the calling number and number attribute. For example, if the calling
is “area code + XXXXXXX” and it is an urban call, dual area codes may be
displayed. Modify MSC configuration to correct it. See the operation manual for
details.
3) The number is a string of meaningless numbers or special numbers, for example,

87654321.
Problem analysis and locating
1) If the number is not displayed, it may be that the opposite party has enabled the
number secrecy function. The international toll call may also have no display.
2) The number displays double area codes. It usually occurs in the calls from PSTN.
Check the calling number in IAI of the TUP signaling, and pay attention to the
calling number and number attribute. For example, if the calling is “area code +
XXXXXXX” and it is an urban call, dual area codes may be displayed.
3) The number is a string of meaningless numbers or special numbers, for example,

87654321. Such number may be sent by the small exchange in a unit, and it can
be specified at discretion without meaning. This is normal.
If it is because the opposite office sends the wrong number attribute, coordinate with
the opposite party for modification.
3.5.5 Mute Problem
Mute when the call is connected.

292
Signaling is connected while the voice channel is not connected.
1) If mute happens in the same MSC, the cause may be the A interface terrestrial
circuit CIC error (including the interconnection error in the transmission circuit)
or the too weak air signal. If it is because of the terrestrial circuit CIC error, the
mute fault will persist till it is fixed. If it is because of the weak signal, the
conversation will be intermittent.
2) Mute happens when the MS calls the local number. If Port A circuit is faulty, the
problem may occur in all the directions instead of one. Focus on the circuit
between the MSC and PSTN.
3) The MS calls the toll service. Since the call has passed through several
intermediate exchanges, the problem cannot be tested directly. Use the following
method to check if the mute happens between the local MSC and the
neighboring office. Then solve the local problems.
Test procedure:
1) Trace the subscriber via TUP signaling, and record the CIC with the mute
problem during the process of mass calls.
2) Through the designated call of dynamic management, check whether there is

mute problem with the recorded CIC in the next call.
3) After lots of tests, if the mute occurs whenever the same CIC is occupied, the
problem is between the MSC and the PSTN. Otherwise, the problem may be in
the circuit in PSTN.
3.5.6 Echo Problem
Echo in the conversation.
Problem source
1) The mixed echo is the “Echo wave effect” that is caused by mismatched
impedance of the 2/4-wire conversion hybrid coil in PSTN. The signals received
by the 4-wire have not been converted to the 2-wire completely, and part of
them are leaked to the 4-wire and sent.
2) The acoustics echo usually happens in MS. The sound sent from the telephone
293
receiver returns to the telephone transmitter by the echoes in the space. The
exchange dose not produce echo by itself.
The mixed echo and the acoustics echo always exist in the telephone networks. But it
can only be felt by the subscriber in the following cases:
1) The echo channel delay is long enough, greater than 30 ms.
2) The echo signal is strong enough.
Mixed echo may occur in interconnection with PSTN if echo suppression is not
applied.
At present, the echo problem is usually solved by echo suppression by installing DTEC
boards with the echo suppression function at the PSTN and tandem sides.
The echo problem may be caused by the hardware of DTEC board. In this case, echo
will be heard in the MS when passing the DTEC board. Replace the board to solve the
problem. In addition, echo occurs distinctly in some MSs (the opposite party can feel
the echo in conversation state). Check the MS setting or replace the MS in this case.
3.5.7 Monolog
After the circuit between the calling and called parties is established, one party can
hear the other party, who, however, cannot hear the counter party.
Possible causes:
1) The A-interface circuits between the MSC and the BSC are mismatched, as A
wire contacts earth and B wire contacts battery. Figure 3.5-1 shows the
mismatched lines.
Tx1 Rx1 Tx2 Rx2 Tx1 Rx1 Tx2 Rx2
Rx1 Tx1 Rx2 Tx2 Rx1 Tx1 Rx2 Tx2

sketch map of A wire interleaved wire
contacting earth and B sketch map
wire contacting battery
Figure 3.5-1 Mismatched Lines
294
2) The trunk circuits between the MSC and other neighboring end offices are
mismatched.
3) Some BTS is abnormal.
4) In case of multi-module MSC, communication between the modules is

abnormal.
5) Time slot 16 of the A-interface circuits between the MSC and the BSC is not
blocked.
Handling:
1) Make clear of the complaint and determine the influence area of monolog. Are
monologs all in some office or in some site? Or monolog complaints occur in all
offices? After making it clear, handle accordingly.
2) If the monolog occurs in just one certain office direction, test a large number of
designated trunk calls between the offices to locate the fault trunk (It is generally
caused by mismatched lines).
3) If the monolog happens to one certain BTS, contact the BSC and network
optimizing personnel for help.
4) If monolog involves all offices, first consider whether the A interface circuit
between BSC and MSC is faulty. Select some safe time (like after 10:00 at night)
to block all A interface circuits between BSC and MSC except one, to make call
test and locate the faulty trunk (usually caused by mixed lines).
5) Make many a call tests on site, and open the TUP tracing and the BSSAP tracing
simultaneously to find out the CIC when the fault occurs. Find the DTI or DTEC
location corresponding to the CIC, and determine whether the monolog happens
to one board; if yes, change the board.
6) Test the boards in each module to determine whether any misdiagnosed board
exists in the modules; if yes, consider changing the board.
7) In case of single-module office, make call test. When monolog occurs, handover
between the DDSN, DSNI and other boards in the module. After handover to a
certain board, if the monolog is found disappeared, it indicates this board caused
monolog.
8) In case of multi-module office, implement inter-module diagnosis test to see
295
whether any module has problem in communicating with other modules.

Generally, modules found in the diagnosis test having call failure alarm are
much likely to cause monolog. Determine the possible faulty module, and
select two subscribers registered across the module to have the call test. When
monolog is found, do not hang up, handover between the FBI, DDSN, DSNI,
and MPMP boards in the module. After handover to a certain board, if the
monolog is found disappeared, it indicates this board caused monolog.
296

Call Flow

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Call Flow

Uploaded by

Copyright:

Available Formats

ZTE ZXC10-MSS After-sales

Competency Certification Secondary

Copyright © ZTE Corporation

All rights reserved.

Author: Pan Xiangqin , Xu Zhongquan , Wu Zhicheng

Editor: Wei Hongwei

ZTE University, Dameisha, Yantian District, Shenzhen, P.R.China

Tel: (+86755) 26778800

Client Support Hot line：（+86755）26770800 800-830-1118

Fax: (+86755) 26770801

2. About This Manual

Volume Course Code Course Name

ACM-201-E1 No.7 Signaling System (SS7)

ACM-202-E1 MSC/VLR Data Configuration

ACM-205-E1 Billing System

ACM-206-E1 MP and Alarm Box Installation and Configuration

ACM-207-E1 Tone Management

ACM-209-E1 Database Backup

ACM-210-E1 Course Module Code DBIO and Accounting System

Indicates the key points in one section.

A Note statement is used to alert the reader of installation, operation, or

Indicates a potentially hazardous situation which, if not avoided, could result

4. Manual Update history

Version Date Comments

5. From the Author

No. Manual name Description

Introduces in detail all the man-machine interfaces of the operation and

This task-oriented manual describes in detail the purpose, pre-operation setup

Introduces in detail all the man-machine commands of the operation and

Serves as a reference manual for guiding equipment maintenance and

◆ You can contact us at any time through doc@zte.com.cn.

◆ You can contribute to Maintenance Experience through weihujingyan@zte.com.cn

ACM-201-E1 No.7 Signaling System (SS7)

1 No.7 Signaling System................................................................................................................................ 1

1.1 Signaling-Related Concepts ..............................................................................................................1

1.1.1 Definition of Signaling ...........................................................................................................1

1.1.2 Signaling Types ......................................................................................................................2

1.2 SS7 Overview....................................................................................................................................3

1.2.1 Features of the SS7.................................................................................................................3

1.2.2 SS7 Hierarchy.........................................................................................................................4

1.2.3 Message Structure of the SS7.................................................................................................5

1.3 Message Transfer Part (MTP) ...........................................................................................................8

1.3.1 Signaling Data Link Level (MTP1)........................................................................................8

1.3.2 Signaling Link Function Level (MTP2) .................................................................................8

1.3.3 Signaling Link Function Level (MTP3) ...............................................................................12

1.4 Signaling Connection Control Part (SCCP) ....................................................................................16

1.4.1 SCCP Overview....................................................................................................................16

1.4.2 Structure and Principles of SCCP Messages ........................................................................19

1.4.3 Basic Functions of the SCCP................................................................................................24

1.5 Transaction Capability Application Part (TCAP)............................................................................26

1.5.1 TCAP Hierarchy ...................................................................................................................27

1.6 Mobile Application Part (MAP) ......................................................................................................29

1.6.1 Basic Functions of the MAP.................................................................................................29

1.6.2 Mobility Management ..........................................................................................................30

1.6.3 Security Management...........................................................................................................38

1.6.5 Handoff Function..................................................................................................................65

1.7 Supplementary Services ..................................................................................................................67

1.7.1 Overview ..............................................................................................................................67

1.7.2 Supplementary Service Request Procedure ..........................................................................68

1.8 Telephone User Part (TUP) .............................................................................................................70

1.8.1 Basic Functions of the TUP..................................................................................................70

1.8.2 TUP Message Format ...........................................................................................................70

1.8.3 TUP Messages ......................................................................................................................72