bcch_scan initialization and L1

Hi everbody I'm currently working on a project at our university where we are trying to connect bcch_scan with our existing hardware/software. The latter consists of L1 implementation partly in hardware and partly in software. The software part is also used to provide the interface towards bcch_scan. So far, the software interface does not do much it just provides the necessary domain sockets and dumps everything it receives from bcch_scan. Now, my question is whether there is some kind of initialization sequences sent from bcch_scan to the phone. And is there any other info you can provide about the messages sent from bcch_scan to the phone and the other way round? Naturally, I tried to find this out myself by looking though the source but didn't get very far. Oh and by the way, the ultimate goal of this project is that we can use bcch_scan to test our L1 hardware. This would be pretty cool Thanks in advance Benjamin