Description Value

Timer Name

4 SACCH
multiframes. That is
T100 RADIO- Detects the presence of the radio link by detecting
1.92 seconds if the
LINK-TIMEOUT SACCH frames every 480 ms.
SACCH is
completely absent.

T200 Data link Used for re-transmission on the data link. The value
155 ms for FACCH
timer varies depending on the message type.

T301 Alerting Timer used to limit the amount of time a user has to
20 seconds
(ringing) timer answer a call.

T303 Mobility Time the network waits after sending a CM SERVICE

Management REQUEST until receiving a response. This occurs before 10 seconds
connection timer initiating call clearing procedures towards the MS.

Time the network waits after transmitting a DISCONNECT

T305 Release message until receiving a RELEASE message. 10 seconds
timer
Time the network waits after transmitting a DISCONNECT
T306 In-band message while in-band tones/announcements are
10 seconds
tones release timer provided, until receiving a RELEASE message.

Time the network waits after sending a RELEASE

message until receiving a RELEASE COMPLETE
T308 Release
message. This occurs before re-transmitting the 10 seconds
timer
RELEASE or releasing the Mobility Management
connection.

Time the network waits after receiving a CALL

T310 Call CONFIRMED message until receiving a ALERTING, 10 seconds
proceeding timer CONNECT, or DISCONNECT message before initiating
clearing procedures towards the MS.

Time the network waits after transmitting a CONNECT

T313 Connect message until receiving the CONNECT ACKNOWLEDGE 10 seconds
acknowledge timer message before performing clearing procedures with the
MS.

Time the network waits after sending a MODIFY message

T323 Modify during call mode changes, until receiving a MODIFY
10 seconds
complete timer COMPLETE or MODIFY REJECT message before
initiating call clearing procedures.

T3101 Immediate Time the network waits after sending the IMMEDIATE 1 second
assignment timer ASSIGNMENT or IMMEDIATE ASSIGNMENT
 Description Value
Timer Name

EXTENDED message until the main signalling link is

established before releasing the newly allocated
channels.
Time the network waits after transmitting a HANDOVER
COMMAND message until receiving HANDOVER
COMPLETE or HANDOVER FAILURE or the MS re-
T3103 Handover establishes the call before the old channels are released.
If the timer expires and the network has not received a 2 seconds
timer
correctly decoded L2 (format A or B) or TCH frame, then
the newly allocated channels are released.
Time the network waits after sending the PHYSICAL
INFORMATION message until receiving a correctly
T3105 Physical decoded L2 (format A or B) or TCH frame. This occur
information before re-transmitting the PHYSICAL INFORMATION 50 ms
repetition timer message or releasing the newly allocated channels.
Time the network waits after transmitting an
ASSIGNMENT COMMAND message until receiving the
T3107 Channel ASSESSMENT FAILURE message or the MS re-
establishes the call before releasing the old and the new 3 seconds
assignment timer
channels.

T3109 Signaling Time the network waits after sending the CHANNEL
disconnection RELEASE message before disconnecting the signalling 5 seconds
timer link.

T3111 Channel
deactivation after Time the network waits after disconnecting the signalling
500 ms
disconnection link before deactivating the channel.
timer

Time the network waits after transmitting the PAGING

REQUEST message until receiving the PAGING
T3113 Paging
RESPONSE message. This occurs before re-transmitting 5 seconds
timer
the PAGING REQUEST (if the maximum number of re-
transmissions have not been exceeded).

The location update timer is set to zero, periodic location

T3212 Location update by the MS are disabled. If the MS camps to the
zero = infinite time
update timer BCH and decodes a new MCC or MNC from the one it
last camped on, it should perform a location update.

Time the network waits after sending the TMSI

REALLOCATION COMMAND until receiving TMSI
T3250 TMSI
REALLOCATION COMPLETE. This occurs before 5 seconds
reallocation timer
aborting the procedure and releasing the Radio Resource
connection.
 Description Value
Timer Name

Time the network waits after an AUTHENTICATION

T3260
REQUEST until receiving AUTHENTICATION
Authentication 5 seconds
RESPONSE. This occurs before aborting the procedure
response timer
and releasing the Radio Resource connection.

Used in Intra MSC handover

The T7 timer is located in the old BSS and is started

when the HND_RQD message towards the MSC has been
sent. When T7 times out, the HND_RQD message is
retransmitted. The recommendations does not say
anything about a maximum number of times this can
happen. Four situations exists where the T7 timer is
stopped:

T7 timer 1)The BSC receives a HND_CMD from the MSC.

2)A RESET message is received from the MSC, indicating
a fatal error within the communication data on the link.
The RESET message resets the A interface between the
MSC and the BSC.
3)The radio link quality towards the MS improves so a
handover is not required anymore.
4)The call is terminated either because of one of the
parties ends the call or because the radio link is lost.

GSM Timers
Timers on the mobile station side

T3122: This timer is used during random access, after the receipt of an IMMEDIATE
ASSIGN REJECT message. Its value is given by the network in the IMMEDIATE
ASSIGN REJECT message.

T3124: This timer is used in the seizure procedure during a hand-over, when the two
cells are not synchronized. Its purpose is to detect the lack of answer from the
network to the special signal. Its value is set to 675 ms if the channel type of the
channel allocated in the HANDOVER COMMAND is an SDCCH (+ SACCH);
otherwise its value is set to 320 ms.
The timer T3124 is located in the MS. T3124 is started when the MS sends the rst HND_ACC to the new
BSS; it is stopped when the MS receives a PHYS_INFO from the new BSS. If T3124 times out, the MS
tries to switch back to the old BSS, sends a HND_FAI message, and resumes normal operation as if no
handover has happend. This is of course only possible if the old radio link is good enough for
communication; otherwise the call is lost.

T3126:This timer is started either after sending the maximum allowed number of
CHANNEL REQUEST messages during an immediate assignment procedure. Or on
receipt of an IMMEDIATE ASSIGNMENT REJECT message, whichever occurs first.
It is stopped at receipt of an IMMEDIATE ASSIGNMENT message, or an
IMMEDIATE ASSIGNMENT EXTENDED message. At its expiry, the immediate
assignment procedure is aborted. The minimum value of this timer is equal to the
time taken by T+2S slots of the mobile station's RACH. S and T. The maximum value
of this timer is 5 seconds.

T3128: This timer is started when the mobile station starts the uplink investigation
procedure and the uplink is busy. It is stopped at receipt of the first UPLINK FREE
message. At its expiry, the uplink investigation procedure is aborted. The value of
this timer is set to 1 second.

T3130: This timer is started after sending the first UPLINK ACCESS message during
a VGCS uplink access procedure. It is stopped at receipt of a VGCS ACCESS
GRANT message. At its expiry, the uplink access procedure is aborted. The value of
this timer is set to 5 seconds.

T3110: This timer is used to delay the channel deactivation after the receipt of a (full)
CHANNEL RELEASE. Its purpose is to let some time for disconnection of the main
signalling link. Its value is set to such that the DISC frame is sent twice in case of no
answer from the network. (It should be chosen to obtain a good probability of normal
termination (i.e. no time out of T3109) of the channel release procedure.)

T3134:This timer is used in the seizure procedure during an RR network

commanded cell change order procedure. Its purpose is to detect the lack of answer
from the network or the lack of availability of the target cell. Its value is set to 5
seconds.

T3142: The timer is used during packet access on CCCH, after the receipt of an
IMMEDIATE ASSIGNMENT REJECT message. Its value is given by the network in
the IMMEDIATE ASSIGNMENT REJECT message.

T3146:This timer is started either after sending the maximum allowed number of
CHANNEL REQUEST messages during a packet access procedure. Or on receipt of
an IMMEDIATE ASSIGNMENT REJECT message during a packet access
procedure, whichever occurs first. It is stopped at receipt of an IMMEDIATE
ASSIGNMENT message, or an IMMEDIATE ASSIGNMENT EXTENDED message.
At its expiry, the packet access procedure is aborted. The minimum value of this
timer is equal to the time taken by T+2S slots of the mobile station's RACH. S and T
are defined in section 3.3.1.2. The maximum value of this timer is 5 seconds.

T3164: This timer is used during packet access using CCCH. It is started at the
receipt of an IMMEDIATE ASSIGNMENT message. It is stopped at the transmission
of a RLC/MAC block on the assigned temporary block flow, see GSM 04.60. At
expire, the mobile station returns to the packet idle mode. The value of the timer is 5
seconds.

T3190: The timer is used during packet downlink assignment on CCCH. It is started
at the receipt of an IMMEDIATE ASSIGNMENT message or of an PDCH
ASSIGNMENT COMMAND message when in dedicated mode.It is stopped at the
receipt of a RLC/MAC block on the assigned temporary block flow, see GSM 04.60.
At expiry, the mobile station returns to the packet idle mode. The value of the timer is
5 seconds.

Timers on the network side

T3101: This timer is started when a channel is allocated with an IMMEDIATE

ASSIGNMENT message. It is stopped when the MS has correctly seized the
channels. Its value is network dependent. NOTE: It could be higher than the
maximum time for a L2 establishment attempt.

T3103: This timer is started by the sending of a HANDOVER message and is

normally stopped when the MS has correctly seized the new channel. Its purpose is
to keep the old channels sufficiently long for the MS to be able to return to the old
channels, and to release the channels if the MS is lost. Its value is network
dependent. NOTE: It could be higher than the maximum transmission time of the
HANDOVER COMMAND, plus the value of T3124, plus the maximum duration of an
attempt to establish a data link in multiframe mode.)

It is located within the network, but its precise location is not stated. From its message involvement, we
have deduced that it must be somewhere in the old BSS.
The timer is started by the sending of a HND_CMD to the MS, which is done by the old BSS. There are
two cases where the T3103 timer is stopped:

Case 1:The network (i.e. the new BSS) receives the HND_COM.This message does not end up where the
timer is, so our interpretation is that the meaning is CLR_CMD, which is the indication to the old BSS, that
the handover has completed successfully.

Case 2:A HND_FAI message is received by the network, i.e. the MS fails to access the new BSS and sends
the HND_FAI to the old BSS

If T3103 times out, the network releases the resources on the old BSS and clears all contexts related to the
connection with the MS. This means that the call is lost.

T3105: This timer is used for the repetition of the PHYSICAL INFORMATION
message during the hand-over procedure. Its value is network dependent. NOTE:
This timer may be set to such a low value that the message is in fact continuously
transmitted.

T3107: This timer is started by the sending of an ASSIGNMENT COMMAND

message and is normally stopped when the MS has correctly seized the new
channels. Its purpose is to keep the old channel sufficiently long for the MS to be
able to return to the old channels, and to release the channels if the MS is lost. Its
value is network dependent. NOTE: It could be higher than the maximum
transmission time of the ASSIGNMENT COMMAND message plus twice the
maximum duration of an attempt to establish a data link multiframe mode.

T3109: This timer is started when a lower layer failure is detected by the network,
when it is not engaged in a RF procedure. It is also used in the channel release
procedure. Its purpose is to release the channels in case of loss of communication.
Its value is network dependent. NOTE: Its value should be large enough to ensure
that the MS detects a radio link failure.

T3111: This timer is used to delay the channel deactivation after disconnection of the
main signalling link. Its purpose is to let some time for possible repetition of the
disconnection. Its value is equal to the value of T3110.

T3113: This timer is started when the network has sent a PAGING REQUEST
message and is stopped when the network has received the PAGING RESPONSE
message. Its value is network dependent. NOTE: The value could allow for
repetitions of the Channel Request message and the requirements associated with
T3101.

T3115: This timer is used for the repetition of the VGCS UPLINK GRANT message
during the uplink access procedure. Its value is network dependent. NOTE: This
timer may be set to such a low value that the message is in fact continuously
transmitted.

T3117: This timer is started by the sending of a PDCH ASSIGNMENT COMMAND

message and is normally stopped when the MS has correctly accessed the target
TBF. Its purpose is to keep the old channel sufficiently long for the MS to be able to
return to the old channels, and to release the channels if the MS is lost. Its value is
network dependent. NOTE: It could be higher than the maximum transmission time
of the PDCH ASSIGNMENT COMMAND message plus T3132 plus the maximum
duration of an attempt to establish a data link in multiframe mode.

T3119: This timer is started by the sending of a RR-CELL CHANGE ORDER

message and is normally stopped when the MS has correctly accessed the new cell.
Its purpose is to keep the old channels sufficiently long for the MS to be able to
return to the old channels, and to release the channels if the MS is lost. Its value is
network dependent. NOTE: It could be higher than the maximum transmission time
of the RR_CELL CHANGE ORDER, plus T3134, plus the maximum duration of an
attempt to establish a data link in multiframe mode.
T3141: This timer is started when a temporary block flow is allocated with an
IMMEDIATE ASSIGNMENT message during a packet access procedure. It is
stopped when the mobile station has correctly seized the temporary block flow. Its
value is network dependent.

Engineering Field Options Menu

The "Eng Field Options" menu is supported in the 8200/6200 ver. 1.7
(37.62.39), 7500 ver. 2.1 (58.62.15) and all later revisions - The
software on the 3200 / 5200 / 7200 does not include the menu but it is
present in all the newer models like d460, 8700, 8900, StarTAC (70, 85,
130), SlimLite, cd160/920/930 & d520 (The models mentioned here are the
European / Asian GSM-900/1800 digital units). Unfortunately the menu is
never enabled from the factory but with some special tools, it is
possible to activate it. What follows here is the description of the
menu, look at the menu customization page for instructions on how to
enable it.

The Engineering menu will provide you with detailed information about
the connection between the MS and the network. This is all information
that the MS can measure by itself or decode from the BCCH which is
transmitted from the BTS. The menu only gives readout of parameters, you
are not able to change a thing with it, and consequently you can't do
any harm to your phone - it's perfectly safe to use the menu. On the
latest software revisions, the menu is available in several languages.
In german it will show as "Eng Felder Optionen", "Aktive Zelle",
"Nachbar-zellen" and "System-Parameter"

It is easier to understand these terms if you have an idea about what

the BCCH actually is: When powering on your GSM phone, it doesn't know
what frequency to tune into in order to communicate with the cell,
therefore it will start scanning all 125 GSM frequencies (GSM-900),
looking for a Frequency Correction Burst. Once this is found and the
frequency has been adjusted, it will "stay tuned" and listen for a
Synchronization burst and decode it in order to synchronize (time wise)
to the network. After successfully synchronizing frequency and time, the
BCCH channel can be received and decoded, providing network
identification and information about how the mobile should "behave" on
the net. The BCCH is on timeslot 0 - the remaining 7 timeslots are used
for traffic. The BCCH never frequency-hops - it stays put all the time,
like a beacon, transmitting information to the mobiles. The mobile will
continue to search for BCCH's and keep a list of the 6 strongest BCCH in
the area.

The "Eng Field Options" menu appears in the top level of the menus and
consists of three sub-menus:

Active Cell:

Displays what Channel the BCCH (Broadcast Control CHannel) is received

on (If available).

During idle you can view the parameters : RxLev, RxLevAM, NCC, BCC,
MSTxPwr, C1. Dualbanders will also provide: CRO, TO, C2, 2ter, 2bis &
ECSC

During dedicated mode you can view the parameters : RxLev, RxLevFull,
RxLevSub, RxQualFul, RxQualSub, Timeslot, TimeAdv and PwrLev.
Dualbanders will also provide: Vocoder, 5bis, BSIC, MBReport, MeasValid.

The ActCh (Active Channel) may read "Hopping" during a call. The GSM
system can use slow frequency hopping where the mobile station and the
base station transmit each TDMA (Time Division Multiple Access) frame on
a different carrier frequency (The hopping rate is 217 hops/second which
corresponds to one hop per. TDMA frame). The frequency hopping algorithm
is decoded from the Broadcast Control Channel which the mobile station
continuously decodes. Since multipath fading is dependent on carrier
frequency, slow frequency hopping help mitigate the problem. Frequency
hopping is operator optional down to the individual cell.

When communicating with the BTS (for the reasons below) you can see how
the SDCCH (Standalone Dedicated Control CHannel) is mapped. The DCCH
(Dedicated Control CHannels) are used for registration, location
updating, authentication and call set-up. This channel can be mapped in
two different ways: SDCCH8 ( 1/8 rate channel) if combined is off and
SDCCH4 ( 1/4 rate channel) if combined is on. See also Combined, below.

Adjacent Cells:

Lets you scroll through the 6 nearby cells with the highest C1 criterion
and view the information transmitted on their corresponding BCCH
carriers (If they can be decoded). Pressing (OK) Will let you view the
data transmitted on the selected BCCH (some of thse are only available
on dualband units): RxLev, BCCH decode status, RxLevAM, CRO, TO, NCC,
BCC, MSTxPwr, C1, C2, CBA & CBQ.

System Parameters:
During idle you can view the parameters :Combined, AcsClas, MCC, MNC,
LAC, CellID, T3212, BS-PA-MFRM and XZQTY.

During dedicated mode you can view the parameters :Combined, DTX, MCC,
MNC, LAC, CellID

Pressing (OK) while in the Eng Field Opt menu, will toggle refresh on
and off. When refresh is enabled, the phone will continuously measure
and display the strength of the signal and try to decode the BCCH. If
you disable the refresh the phone will remember and show the last set of
values until the refresh is enabled again. If you are driving around and
the info changes real fast, you can "freeze" the values so you can
examine them before they change again.

KEY TO THE READOUTS:

 ActCh: Displays the Active Channel on which the BCCH is received.

GSM-900 has 124 (001-124) channels and GSM-1800 has 374 (512-885).
The channels are split between the operators - HERE is how it is
done in Denmark (GSM-900)
 Combined: Describes the channel organization in the 51-frame
multiframe : off uses SDCCH/8 and on uses SDCCH/4. The logical
channels can be mapped differently : Off: BCCH+CCCH and SDCCH are
on different channels. On: BCCH, CCCH and SDCCH are combined on
the same channel - confused about all the channels ? Take a look
at the GSM channel structure section below
 AcsClas: Access Control Class . The Access Control class is a
parameter to control the RACH (Random Access CHannel) utilization.
15 classes are split into 10 classes randomly allocated to normal
subscribers and 5 classes allocated to specific high priority
users. This way, the operator can cut out users when the net is
getting clogged-up. Denied classes can by cycled so that in
extreme loading you may be denied for 10 minutes or so, but then
you'll have service. Other classes are reserved for the emergency
services/operators so they can be excluded and have priority
calling. What networks does use this RACH regulation ???
 RxLev:(7bits) The strength of the received BCCH signal (000 to 127
dBm), normally between -55 to -90 - the MS will look for another
BCCH carrier when the signal drops to RxLevAm* ( RxLev and RxQual
are sent regularly to the BSC during a call - )
 RxLevAm: Rx Level Access minimum - Minimum Rx signal strength
threshold (usually around -100 dBm to -110 dBm). This is related
to the minimum signal that the operator wants the network to
receive when being initially accessed by an MS.
 CRO:(6 bits) Cell Reselect Offset. Applies an offset to the C2
reselection criterion. 0 - 126 dB in 2 dB steps, i.e. 0=0dB, 1=2
dB, etc.
 TO:(3 bits) Temporary Offset. Applies a negative offset to C2 for
the duration of PENALTY_TIME. 0 - 60 dB, 10 dB steps i.e. 0=0dB,
1=10 dB, etc. and 7 = infinity
 BCC:(3 bits) Base-station Color Code (0-7)- This is used to
distinguish neighboring cells of the same operator broadcasting
BCCH on the same FDMA (Frequency Division Multiple Access) channel
from each other (Different channel "sets" are used by GSM
 operators in the same country, so their BCCH will always be on
different FDMA channels). A set of cells that covers all the
channels available for a specific operator is called a "cluster".
BCC has the same value in all the cells of a cluster, because of
each cell, in the cluster, transmits on different channels.
NCC+BCC is called BSID (Base Station Identity)
 NCC:(3 bits) Network Color Code (0-7) - this is used to
distinguish neighboring cells between operators of different
countries broadcasting BCCH on the same FDMA channel from each
other. The NCC is equal within a PLMN (Public Land Mobile
Network). It's a 3 bit value.
 MSTxPwr: The maximum power level that the MS (Mobile Station) is
allowed to access the RACH - this means that even though you have
a 8W unit, you are not always allowed to blast away at full power.
Generally MSTxPwr is low in urban areas (small cells) and high in
rural areas (large cells) - See notes on power control below
 C1: The path loss criterion parameter C1 (defined as C1=(RxLev-
RxLevAm-MAX((MSTxPwr-MSMaxTxPwr),0)) ) used for cell selection and
reselection. This is calculated by the MS and used for deciding
which cell to camp to (selection and reselection). C1 is more
useful than just RxLev, since it takes the MSTxPwr & MSMaxTxPwr
into account. MSMaxTxPwr is the phones maximum output in dBm (for
GSM normally 33 but 39 with carkit). The reason Tx power is
factored into C1 is so that an MS only camps to a cell where it
has a reasonable chance to be heard by the base station if it
transmitted.
 C2: Cell reselection criterion. Identical to C1 when camped in 900
band. You will notice that the dual band units do have a
preference for the 1800 band. The C1 can be much higher than C2
but it doesn't result in the phone switching back to the 900 band.
The reason C2 is included is to handle small cells, where an MS
may select and camp to a cell but not have long enough to do
anything before loosing it completely. C2 is time varying so it
can get bigger after a certain period. If the MS can still see it
then it will camp to it.
 CBA:(1 bit)Control parameter Cell Bar Access. If enabled and CBQ=0
then cell selection and reselection will be barred.
 CBQ:(1 bit)Control parameter Cell Bar Qualify. If enabled, then
cell selection priority will be low, but cell reselection status
(barred/normal)will be normal.
 2ter: This message is sent optionally on the BCCH by the network
to all mobile stations within the cell giving information on the
extension of the BCCH allocation in the neighbour cells.. Based on
this information the mobile station is able to decide whether and
how it may gain access to the system via the current cell. The
2ter message shall be sent if and only if this is indicated in
TYPE 3 message. Can be ignored by units only capable of GSM900.
 2bis: This message is sent optionally on the BCCH by the network
to all mobile stations within the cell giving information on
control of the RACH and of the extension of the BCCH allocation in
the neighbour cells. Based on this information the mobile station
is able to decide whether and how it may gain access to the system
via the current cell. The 2bis message shall be sent if and only
if the EXT-IND bit in the Neighbour Cells Description IE in both
the TYPE 2 and TYPE 2bis messages indicates that each IE only
 carries part of the BA. Can be ignored by units only capable of
GSM900.
 ECSC:(1 bit) Early Classmark Sending Control. This bit controls
the early sending of the classmark by the Mobile Stations
implementing the Controlled Early Classmark Sending option: 1=
Early Sending is explicitly accepted 0= Early Sending is
explicitly forbidden.
 RxLevFull:(6 bits) C1 value with continuous transmission from
tower (calculated from all the timeslots of one 51-multiframe)#
 RxLevSub:(6 bits) C1 value with discontinuous transmission from
tower (subset of the timeslots in the 51-multiframe - usually from
the SACCH timeslot)#
 RxQualFull:(3 bits) Received signal quality is derived from the
BER (Bit Error Rate) with continuous transmission from tower
(calculated from all the timeslots of one 51-multiframe) - see
notes on BER
 RxQualSub:(3 bits) Received signal quality is derived from the BER
(Bit Error Rate) with discontinuous transmission from tower
(subset of the timeslots in the 51-multiframe - usually from the
SACCH timeslot) - see notes on BER
 Timeslot:(4 bits) The current Ts (Timeslot) (0 through 7 - TDMA
allows eight channels to be accommodated on a single RF (Radio
Frequency) carrier)
 TimeAdv:(7 bits) TA (Timing Advance) (0 through 63 ) - see notes
on timing advance below
 PwrLev: Reports which power step/level the phone is transmitting
at - (See section below on power control)
 Vocoder: EFR (Enhanced FullRate) / FR (FullRate) / HR (HalfRate) /
NA (NotApplicable) - (How many of these are actually
implemented ?)
 5bis: This system information message is sent optionally on the
SACCH just after handover by the network to mobile stations within
the cell giving information on the extension of the BCCH
allocation in the neighbour cells. When received (and not ignored)
this information must be used as the list of neighbouring cells to
be reported on. Any change in the neighbour cells description must
overwrite any old data held by the mobile station. The mobile
station must, with the exception stated above, analyse all
correctly received system information type 5 messages. Can be
ignored by units only capable of GSM900.
 BSIC:(6 bits) Control parameter Base Station Identity Code = |NCC
(3 bits) BCC (3 bits)|
 MBReport:(2 bits) MultiBand report. The number of neighbour cells
(with known and allowed NCC part of the BSID) for each frequency
band supported is included in this parameter. Possible values are:
6-0, 5-1, 4-2 & 3-3
 MeasValid:(1bit) This bit indicates if the measurement results for
the dedicated channel are valid or not: 0=The measurement results
are valid, 1=the measurement results are not valid.
 DTX:(1 bit) Discontinuous transmission, a feature used to save
battery and reduce network traffic by powering down the mobile
station transmitter when there isn't any speech to transmit.
 MCC: Mobile Country Code - This is the X.121 code for the country
( 238 = Denmark etc.)
  MNC: Mobile Network Code 1 = Tele Denmark, 2 = Sonofon, 10 = TDM
GSM-1800 (These are the ones for MCC 238 )
 LAC: Local Area Code, Several cells are contained in a LA(Local
Area). The size is operator definable and may vary. A LU (Location
Update) must take place if the MS leaves the LA. The LAC is 2
bytes long and hence the value between 0 and 65535. Together with
MCC & MNC this gives the LAI (Local Area Information)
 CellID: A number that identifies the active cell. The CID (CellID)
is unique to the LA. For a truly unique description of a cell, the
CGI (Cell Global Identity) should be used. The CGI consists of the
CID, MCC, MNC & LAC
 T3212: Time between periodic LU's (0-255). The value of the T3212
timer has to be multiplied with 6 minutes to get the LU-period :
010=1 Hour, 050=5 hours the theoretical maximum is 25.5 hours - It
can be configured independently for each cell. The Location Update
Timer is much more a HLR (Home Locaton Register) time-out. If a
phone leaves the coverage area and has no chance to send a "IMSI
Detach" (to log off - please note that not all cells allow IMSI
detach/attach), then the phone would be paged in the last known
LA, which may force a lot of traffic a) on the radio channels and
b) between the BTS, the BSC (Base Station Controller) and the HLR.
The LU timer is reset if a call or SMS is sent / received.
 BS-PA-MFRM: Number (2...9) of MFRMs (MultiFRaMe) between two
transmissions of the same PAging message to MSs of the same paging
group. I assume, that when we are talking about paging, the
channel at issue here is the paging channel, which is a CCH
(Control CHannel)- here the length of a multiframe is 234 ms - see
note on TDMA frame structure & duration. The value for my operator
238-01 is 9 which corresponds to 234 ms x 9 = 2.1 seconds between
paging messages. The BS-PA-MFRM shows the Discontinuous Receive
(DRX) parameter of the network. DRX allows the mobile to
synchronize its listening period to a known paging cycle of the
network. This can typically reduce the standby power requirements
by 90%. The paging procedure has been designed to facilitate
significant battery-saving potential in the hand portable - the
larger the period between listening periods the lower battery
consumption. Unless a hand portable is used excessively the
biggest drain on its battery comes not from the time spent using
it, but from the standby cycle as it monitors the paging channel,
in case it is being called. In the GSM system the DRX allows the
mobile, once it has located the paging signal, to synchronize a
clock knowing that it will not get another signal until a
specified time has elapsed. It can thus power down its circuits
for most of the time during standby. On a 8700 with a 600 mAh
battery motorola specifies 60 hours of standby with DRX=2 and 75
hours with DRX=9
 XZQTY : From disassembling the firmware, it appears as if XZQTY is
not variable at all, but simply fixed at 14.3 all the time.

* When comparing RxLev's, remember the logarithmic nature of the dB

scale and that the signal intensity decays by a factor 4 when the
distance from the BST is doubled ; Assuming line of sight to the BST,
the signal will drop 6 dB when the distance is doubled.
Comtinue here to read my description of the technical basis for the
codes, BCCH decoding status, powerlevels, bit error rate. timing
advance, and TDMA channel structure.

I would like to thank Marcello Scata, Norbert Hüttisch, Patrick Zandl

and Thomas Kochanek for their help in the making of this page.