CDMA (IS-41) Call Flows

Technical Tutorial
 Overview

• Basic SS7 Concepts

• Important Identities used in IS-41 MAP
• IS-41 Call Flows
Basic SS7 Concepts
 Basic SS7 Concepts

• Typical SS7 (Signaling System No. 7) protocol stack is depicted

below:
OMA I
GSM IS-41
P S
MAP MAP
etc. U
TCAP P
SCCP
MTP-3
MTP-2
MTP-1
• If compared with the OSI model, the MTP layer-1 does the function of
Physical layer, MTP-2 provides the Data Link layer capabilities, the MTP-
3 and SCCP layers provide Network & Transport layer functionalities.
• The different User Parts (UPs – like ISUP, TUP etc.) and Application
Parts (APs – like Mobile Application part – MAP etc.) provide the
application layer functionalities.
 Basic SS7 Concepts

• At the MTP layer (3), the routing function uses the PC (Point Code)
of the SEPs (Signaling End Points) to address them. The MTP
layer, inherently, provides ConnectionLess services only.
• The SCCP layer can provide the ConnectionLess as well as the
ConnectionOriented services. It also provides the Global Title (GT)
translation services.
• TCAP layer provides the Database Query / Response kind of
services. Some examples are – Number translation services, IN
based services like CUG (Closed User Group) / VPN (Virtual
Private Network) or Mobile Application Parts (GSM MAP / IS-41
MAP) etc.
Important Identities used in IS-41 MAP
 Important Identities used in IS-41 MAP

• Some of the important identities used in CDMA networks (in AS-41 MAP
layer) are listed below:
– MSID: An MSID (Mobile Station Identity) can be in one of the two forms – the MIN (Mobile
Identification Number): a 10-digit number identifying a subscription in CDMA network; or the
IMSI (International Mobile Station Identity): a 15-digit number conforming to E.212 standard.
– ESN: The Electronic Serial Number (ESN) is the number assigned by the manufacturer to the
Mobile Equipment.
– MDN: Mobile Directory Number is an addressable (or diallable) number on which the
subscriber can be called on.
– MSCID: MSC Identity is assigned to each network element (e.g. MSC, HLR, SMSC etc.) in an
CDMA network.
– PC_SSN: Point Code and SubSystem Number of the Network Element.
– MSCIN: MSC Identity Number is the Global Title address (or the number) assigned to the MSC.

• Some of the parameters (like the MSCIN or PC_SSN) are included at the
MTP / SCCP layer too. But, the value provided in the IS-41 MAP layer
override the values of the PC/SSN or the GT digits received at the MTP /
SCCP layer.
IS-41 Call Flows
 IS-41 Call Flows

• This presentation shows some of the important & most basic call
flows for CDMA networks. The following call flows are included in
this presentation:
– Registration
– Voice Call Origination
– Voice call Termination
– SMS Origination
– SMS Termination
 IS-41 Call Flows : Registration

• In any mobile services network, the most important network

elements are the Mobile Switching Center / Visitor Location
Register (MSC / VLR) and the Home Location Register (HLR).
Being the most essential network elements, they are also called as
Core Network elements.
• All the other network elements, required for other supplementary
or value added services are called as Adjunct Network elements
(like SMSC, SCP, VMS, OTAF etc.).
• As the name suggests, it’s the HLR, which is responsible to keep
track of the current location of a Mobile Station. Whereas the VLR
holds a temporary copy of the subscriber’s profile downloaded at
the visited network & maintained only as long as the mobile is
roaming in that network.
• It’s the combined responsibility of the MS (Mobile Station) and the
MSC that, they should keep the HLR updated about the MS’s
current location. This is done by virtue of “Registration” process.
 IS-41 Call Flows : Registration….Contd..

• To keep the location of an MS to be the latest, there are different

events when the registration can take place. Some of these events
are:
– MS Power On registration
– MS Power Down de-registration
– Timer based registration
– Zone based registration
– Distance based registration
– Autonomous registration
– Etc.
 IS-41 Call Flows : Registration….Contd..

MSC / VLR – 1 HLR / AuC MSC / VLR – 2

REGNOT (MIN, ESN, MSCID,

PC_SSN, SMSAddress) a
REGCANC (MIN)
Location Update b
Request regcanc ()
c
regnot (MDN, Profile)
d

a. Mobile Station moves from MSC/VLR–2 to MSC/VLR–1. The Mobile Station requests for “Location
Update” to the network. The MSC/VLR-1 sends IS-41 message called Registration Notification (or
REGNOT in short) to the HLR with different parameters included in it. Most important parameter
being the MIN. MIN is used as the primary key by the HLR to find the subscriber’s record in it’s
database.
b. HLR compares the received MSCID / PC_SSN parameter against the value of these parameters
stored in it’s dynamic database. As the HLR finds that the MS (identified by the MIN) was registered
at MSC/VLR-2, earlier, it sends a message called as Registration Cancellation (REGCANC) to the
MSC/VLR-2.
c. The MSC/VLR-2 deletes the record of this MIN from it’s database and sends the response to
REGCANC to the HLR. The HLR stores the new MSCID / PC_SSN parameter in it’s dynamic data.
d. On receipt of ‘regcanc’ from MSC/VLR-2, the HLR sends the ‘regnot’ response to the MSC/VLR-1
with the subscriber’s profile included in it. The profile includes the MDN of the subscriber, Call
Origination / Termination capabilities, SMS origination/termination capabilities, Data Services
capabilities, other supplementary service like Call Waiting, Call Conferencing, Call Forward etc.
For further details about Registration Process visit :: http://ashishgayal.8m.net/registration.htm
 IS-41 Call Flows : Voice Call Origination

• Once a Mobile Station is registered in a given MSC / VLR area, the

subscriber’s call origination capabilities are known to VLR. As
such, at the time of call origination, the MSC checks the
subscriber’s profile in VLR to allow or disallow the origination of
calls to the given subscriber. Apart from Authentication, at the
time of Call Origination no other IS-41 messages are exchanged.
 IS-41 Call Flows : Voice Call Termination

• In the mobile environment, a Mobile Station belongs to one and

only one HLR. Even though the subscriber might be roaming
across different networks or the MSC/VLRs, the latest location
information is stored at the subscriber’s HLR.
• As such, for every terminating call (or, for that matter, for every
Terminating SMS too) the HLR needs to be interrogated to find out
the subscriber’s current location.
• The detailed call flow for a terminating call is given in the
following slide.
 IS-41 Call Flows : Voice Call Termination ..contd..

G-MSC HLR MSC / VLR – 1

LOCREQ (MDN, MSCID, PC_SSN)

PSTN ISUP Call a
ROUTREQ (MIN)
b
routreq (MIN, TLDN)
c
locreq (TLDN, InterSystemTermination)
d
ISUP Call (TLDN)
An ISUP call arrives at an G-MSC (Gateway MSC) for a Mobile Station.
a. The G-MSC sends a message called Location Request (LOCREQ) to the HLR that is serving the
dialed MDN. The LOCREQ message includes the dialed number & the MSCID / PC_SSN of the G-
MSC.
b. By virtue of Registration Process the HLR knows that the subscriber is registered in MSC/VLR-1
area. The HLR sends a message called as Routing Request (ROUTREQ) to get a temporary routable
number using which, the G-MSC can establish a voice call with the ‘Serving’ MSC (i.e. MSC/VLR-1,
in this case).
c. On receipt of the ROUTREQ message, the Serving MSC checks the subscriber’s current status
(whether busy or otherwise etc.) and if the MS is found to be available, it picks up a temporary
routing number from it’s pool of numbers called as TLDN (Temporary Local Directory Number). The
‘Serving’ MSC stores the association between the MIN and the TLDN in the call context memory
(temporary storage area) & starts the timer for holding the TLDN.
d. On receipt of TLDN from the serving MSC, the HLR sends ‘locreq’ response to the G-MSC with the
TLDN. The G-MSC, uses the TLDN to establish voice path to the Serving MSC. On receipt of the
ISUP call, the Serving MSC, finds out the MIN (using the TLDN as a key) from the memory & ‘pages’
the MS & release the TLDN for reallocation for the next call.
 IS-41 Call Flows : SMS Call Flows

Origination Destination
Home Home
Direct SMDPP
Network SMDPP Network
MC
Indirect SMDPP MC
SMDPP / SMPP

• In case of CDMA networks, each MS belongs to one and only one Message
Center (MC or the SMSC). SMS being a store-and-forward type of
application, it is the responsibility of the Home MC of any given CDMA
subscriber, to store & subsequently deliver the terminating message to the
subscriber.
• When a CDMA user originates a Short Message, there are two methods of
routing the message to it’s destination. One method is called as the
“Direct” method & the other is called as “Indirect” method of routing. In
case of the “Direct” method, the Originating MSC delivers the message to
the Destination subscriber’s MC. In case of “Indirect” method, the
message is first delivered to Originator’s MC & then forwarded to the
Destination subscriber’s MC. Ultimately, the message gets deposited in the
destination subscriber’s MC for delivery.
 IS-41 Call Flows : SMS Call Flows (A) … Contd..

MSC-1 MC-2 HLR-2 MSC-2

REGNOT (SMSAddress)
a
regnot (profile)
b
SMDPP (SMS Bearer, MDN)
c
smdpp (ACK)
d B
SMSREQ (MDN)
e
A smsreq (MIN, SMSAddress)
f
SMDPP (MIN, SMS Bearer)
g
smdpp (ACK)
h

SMS Call Flows (A) explains the successful SMS delivery scenario.
a. MS ‘B’ registers at MSC/VLR-2. MSC sends ‘REGNOT’ message to the HLR with it’s own address (PC/SSN) as
‘SMSAddress’ to the HLR.
b. HLR Stores the ‘SMSAddress’ and sends ‘regnot’ response to the MSC/VLR-2.
c. MS ‘A’ sends an SMS for MS ‘B’. The MSC-1 delivers the message to the MC of MS ‘B’ (i.e. MC-2) through the
IS-41 message called as SMDPP (Short Message Delivery Point-to-Point).
d. The Message Center sends ‘smdpp’ response to acknowledge the receipt of the message.
e. The MC-2 sends ‘SMSREQ (SMS Request)’ message to the HLR of MS ‘B’, to find out the subscriber’s current
location & status.
f. If HLR finds that the MS ‘B’ is registered, it sends ‘smsreq’ response with the MIN & the ‘SMSAddress (the
address of the serving MSC)’ to the MC-2.
 IS-41 Call Flows : SMS Call Flows (A) … Contd..

g. On receipt of response to ‘SMSREQ’ the MC-2 sends ‘SMDPP’ message to the MSC identified by the
‘SMSAddress’.
h. The MSC-2 pages the MS ‘B’ & delivers the message & sends successful response to the MC-2 in
‘smdpp’ message.
 IS-41 Call Flows : SMS Call Flows (B) … Contd..

MSC-1 MC-2 HLR-2 MSC-2

MSINACT (MIN)
a
msinact ()
b
Power Down
SMDPP (SMS Bearer, MDN)
c De-
smdpp (ACK)
Registration B
d
A SMSREQ (MDN)
e
smsreq (MIN, SMSAccessDeniedReason)
f
SMDPF flag
REGNOT (MIN)
‘set’ g
regnot (Profile)
h Power Up
SMSNOT (MIN)
i Registration
smsnot () B
SMDPF flag j
‘reset’ SMDPP (MIN, SMS Bearer)
k
smdpp (ACK)
l

SMS Call Flows (B) explains the first unsuccessful SMS delivery attempt.
a. MS ‘B’ de-registers from MSC/VLR-2. MSC sends ‘MSINACT’ message to the HLR, which indicates
to HLR that the MS ‘B’ is not available any more.
b. HLR marks the MS ‘B’ as ‘Inactive’ and sends ‘msinact’ response to the MSC/VLR-2.
c. MS ‘A’ sends an SMS for MS ‘B’. The MSC-1 delivers the message to the MC of MS ‘B’ (i.e. MC-2)
through the IS-41 message called as SMDPP (Short Message Delivery Point-to-Point).
 IS-41 Call Flows : SMS Call Flows … Contd..

d. The Message Center sends ‘smdpp’ response to acknowledge the receipt of the message.
e. The MC-2 sends ‘SMSREQ (SMS Request)’ message to the HLR of MS ‘B’, to find out the subscriber’s
current location & status.
f. HLR finds that the MS ‘B’ is marked as ‘Inactive’ and sends ‘smsreq’ response with the
‘SMSAccessDeniedReason’ parameter set to a value indicating that the SMS to this MS (‘B’) can not
be delivered at this moment. The HLR also sets a flag called ‘SMS Delivery Pending Flag (SMDPF)’
indicating that there was an attempt to deliver an SMS to this MS, but, it was not delivered.
g. After some time when the MS ‘B’ turns ‘ON’, it performs “Power-Up Registration”. The MSC/VLR-2
sends ‘REGNOT’ to the HLR.
h. HLR responds to ‘REGNOT’ with the subscriber’s profile. The HLR also finds that, against ‘this’ MIN,
the SMDPF flag is set.
i. Because the SMDPF flag for MS ‘B’ was set, the HLR sends a message called ‘SMSNOT (SMS
Notification)’ to the Home MC of MS ‘B’. The ‘SMSNOT’ message includes the MIN, MDN & the
SMSAddress.
j. The MC-2 responds with ‘smsnot’ to the HLR. On receipt of the ‘smsnot’ message, the HLR resets
the SMDPF flag.
k. On receipt of SMSNOT, the MC-2 comes to know that the MS ‘B’ is now available & is located at the
MSC identified by the ‘SMSAddress’ received in ‘SMSNOT’. The MC-2 retries the delivery of message
by sending ‘SMDPP’ message to the MSC-2.
l. On successful delivery of message to MS ‘B’, the MSC sends the ‘smdpp’ response message to the
MC-2. If the originating MS had requested for delivery acknowledgement, then the MC-2 forms the
delivery confirmation message to be sent to MS ‘A’ & goes ahead with SMS delivery call flow for
message delivery confirmation to MS ‘A’.
 References / Related sites

• ITU MTP layers are defined in Q.701 to Q.705; SCCP layers in

Q.711 to Q.715 and TCAP in Q.771 to Q.775.
• All CDMA related standards (IS-41, IS-771, IS-826 etc.) can be
downloaded from
http://www.3gpp2.org/Public_html/specs/index.cfm
• Other interesting sites are:
– http://www.howcdmaworks.com
– http://www.ifast.org
– http://www.cdg.org