Professional Documents
Culture Documents
UMTS RNO Subject-2G3G Interoperation Analysis Guide - R2.0 PDF
UMTS RNO Subject-2G3G Interoperation Analysis Guide - R2.0 PDF
Guide
R2.0
LEGAL INFORMATION
By accepting this certain document of ZTE CORPORATION you agree to the following terms. If you do
not agree to the following terms, please notice that you are not allowed to use this document.
Copyright 2014 ZTE CORPORATION. Any rights not expressly granted herein are reserved. This
document contains proprietary information of ZTE CORPORATION. Any reproduction, transfer,
distribution, use or disclosure of this document or any portion of this document, in any form by any
means, without the prior written consent of ZTE CORPORATION is prohibited.
and
are registered trademarks of ZTE CORPORATION. ZTEs company name, logo
and product names referenced herein are either trademarks or registered trademarks of ZTE
CORPORATION. Other product and company names mentioned herein may be trademarks or trade
names of their respective owners. Without the prior written consent of ZTE CORPORATION or the
third party owner thereof, anyones access to this document should not be construed as granting, by
implication, estopped or otherwise, any license or right to use any marks appearing in the document.
The design of this product complies with requirements of environmental protection and personal
security. This product shall be stored, used or discarded in accordance with product manual, relevant
contract or laws and regulations in relevant country (countries).
This document is provided as is and as available. Information contained in this document is subject
to continuous update without further notice due to improvement and update of ZTE CORPORATIONs
products and technologies.
ZTE CORPORATION
Address:
NO. 55
Hi-tech Road South
ShenZhen
P.R.China
518057
Website:
http://support.zte.com.cn
Email:
800@zte.com.cn
Revision History
Product Version
RNC V3.07
Document Version
Serial Number
R1.0
RNC V3.09
2.
R2.0
3.
4.
Author
Date
Document Version
Prepared
by
Reviewed by
Approved by
2009-12-20
R1.0
Song
Jianjun
Expert group
Expert group
2012-05-16
R2.0
Ma Wei
Wang Zhenhai
Wang Zhenhai
II
Proposal: Before reading this document, you had better have the following knowledge and skills.
SEQ
1
Reference material
Null
2
3
Follow-up document: After reading this document, you may need the following information.
SEQ
1
Reference material
Null
Information
Null
III
Preface
Description
Gives a brief introduction to this guide.
2 Introduction to 2G/3G
Interoperability
3 2G/3G Interoperability
Parameters
4 Interoperability Problems
Analysis and Optimization
Cases Study
IV
TABLE OF CONTENTS
1
Preface ............................................................................................................ 1
2
2.1
2.2
2.2.1
2.2.2
2.3
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4
2.4.1
2.4.2
2.4.3
2.4.4
3
3.1
3.2
3.2.1
3.2.2
3.2.3
3.3
3.3.1
3.3.2
3.3.3
3.3.4
3.4
4
4.1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
5
5.1
5.1.1
5.2
5.2.1
5.2.2
5.3
5.3.1
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
VI
FIGURES
Figure 2-1 Network Elements Structure for 2G/3G Interoperability ....................................... 2
Figure 2-2 Idle Mode Process Description ............................................................................ 3
Figure 2-3 Scenario of 2G/3G Inter-RAT Cell Reselection for UE......................................... 8
Figure 2-4 General Process of Reselection from 3G to 2G ................................................. 11
Figure 2-5 Reselection Process for the Case that WCDMA Signal Strength is too Weak to
Maintain Normal Network Service ......................................................................................... 12
Figure 2-6 Handover from WCDMA to GSM in CS Domain ................................................ 14
Figure 2-7 Handover from GSM to WCDMA in CS Domain ................................................ 15
Figure 2-8 Signaling Process of Inter-RAT Handover in MSC: WCDMA->GSM ................. 17
Figure 2-9 Signaling Process of Handover from WCDMA to GSM ..................................... 20
Figure 2-10 Inter-RAT Handover in SGSN From UTUE To GSM (Group Domain) ............. 22
Figure 2-11 Handover between SGSNs From UMTS To GSM (group domain) .................. 24
Figure 2-12 nter-RAT Handover From GSM To UMTS in SGSN (Group Domain) .............. 27
Figure 2-13 Inter-RAT Handover From GSM To UMTS in SGSN (Group Domain) ............. 29
Figure 4-1 RR Cause Information Element ......................................................................... 57
Figure 5-1 Sites Locations of 3A Event Trigger and 3C Event Trigger ................................ 65
Figure 5-2 TRI358 Site Location......................................................................................... 66
Figure 5-3 Relative Location of TRI119W and TRI191 ....................................................... 68
Figure 5-4 Success Rate of Handover after Deleting 2G Neighbor Cells ............................ 68
Figure 5-5 Relocation Failure ............................................................................................. 70
Figure 5-6 Signaling Flowchart of Inter-RAT Handover ...................................................... 70
Figure 5-7 Inter-RAT Handover .......................................................................................... 71
Figure 5-8 Failure Signaling of Security Mode .................................................................... 72
Figure 5-9 Value of Failure Reason .................................................................................... 72
Figure 5-10 Encryption Algorithm for PS Service ............................................................... 72
Figure 5-11 Encryption Algorithm for CS Service ............................................................... 72
Figure 5-12 Encryption Algorithm ....................................................................................... 73
TABLES
Table 2-1 WCDMA Cell Selection Parameters ..................................................................... 6
Table 2-2 WCDMA Cell Reselection Parameters ................................................................. 9
VII
VIII
Preface
The low-speed data services of 2G voice, short message and circuit field have been
widely used in every corner of the world, in order to meet the new requirements for the
human communications better. Symbolized by high-speed data services, video telephone,
and a variety of online services, 3G communications have been pushed to the front. In
the current 3G and 2G development, 3G WCDMA and 2G GSM/GPRS are most widely
used; therefore, in the evolution from GSM/GPRS to WCDMA, the coexistence and
complementarity between the two parties are considered as a very important factor for
the seamless connection between 3G and 2G.
Generally speaking, 3G networks are not easy to be constructed, and it takes some time
to achieve better coverage and capacity. In the early stage of 3G network construction,
they cannot reach the scale as big as 2G due to the limited coverage. How 3G can
provide seamless services by using 2G, and how 2G can provide the newest services by
using 2G are urgent and actual problems. The better coexistence between 3G and 2G
depends on the seamless connection between 3G and 2G, which makes users
experience continuous and omnipresent services. The seamless connection here means
the interoperability between 3G and 2G, including reselection and handover between 3G
and 2G.
This article first describes the principles and policies of 2G/3G interoperability, and then it
makes an analysis on the key parameters involved in the interoperability. According to
the baseline of the ZXWR RNC radio parameters in the WCDMA network of China
Unicom, it also provides the recommended values of the main related parameters for the
2G/3G interoperability, which is a reference for commercial configuration in each field.
Finally it makes a detailed analysis on the various solutions to the problems of the 2G/3G
interoperability, and provides some cases for analysis.
Note:
Taking into account the complexity of the actual radio environment, the final values of the
parameters in different fields should be adjusted reasonably based on the actual radio
environment. It should not ignore the flexibility of network optimization and only comply
with the recommendations in this article completely.
2.1
2.2
2.2.1
Process Description
When a UE powers up or roams, its primary task is to find the network and contact with it,
in order to obtain the network service. The UE behaviors in the idle mode can be divided
into PLMN selection and reselection, cell selection and reselection, and location
registration. The relationship among the three processes is as follows.
Figure 2-2
User selection
of PLMN
Automatic/
Manual selection
PLMN Selection
and Reselection
Indication
to user
Location
Registration
response
PLMNs
available
PLMN
selected
NAS Control
Cell Selection
and Reselection
Radio measurements
Registration
area
changes
CM requests
Location
Registration
After the UE powers up, firstly it should select one PLMN. After one PLMN is selected, it
starts to select one cell which belongs to the PLMN. After the cell is founded, it can get
the information of the neighbor cells from system information broadcast, thus the UE can
choose one cell with the best signal to reside from all the cells. Then the UE initiates the
process of location registration, after success, the UE resides in the cell successfully.
There are four functions for cell residence:
After the UE resides in the cell and registers successfully, as it moves, the signal strength
of the current cell and the neighbor cell is changing constantly. The UE needs to choose
the most suitable cell, which is just the cell reselection process. There are some rules for
the cell reselection, and it will be described later.
After the UE reselects the cell and another cell is selected, it finds that this cell belongs to
another LA or RA, the UE needs to initiate the location update process, so that the
network can get the latest MS location information. The system information SIB1 includes
CN common GSM-MAP NAS system information and PS domain system information, in
which LAC and RAC information exists, so the UE can know whether LA or RA changes.
If location registration or update is not successful (for example, when the network refuses
the MS), or the UE leaves the current PLMN coverage area, the UE can reselect the
PLMN and select another available PLMN.
The purpose of PLMN selection/reselection is to select an available PLMN. To achieve
this purpose, the UE will maintain a PLMN list, in which PLMN is ordered by priority, and
then is searched from the high priority to find one PLMN with the highest priority.
Additionally, there are two modes for the PLMN selection and reselection: auto and
manual. The auto selection is that UE selects one PLMN automatically according to the
PLMN priority, the manual selection is to show all the available networks for the user, and
ask the user to choose one PLMN.
In the list, RPLMN (Registered PLMN) has the highest priority. The RPLMN is the PLMN
which registered successfully last time. There are two files in the USIM card, EFLOCI and
EFLOCI, which record the RPLMN information. In these two files, LAI (=MCC+MNC+LAC)
and RAI (=LAI+RAC) include MCC and MNC, which are just RPLMN.
No matter auto or manual selection, after the UE powers up, firstly it will try to select
RPLMN; if it is successful, there will be no subsequent operation. If not, the UE will
generate a PLMN list (ordered by priority):
HPLMN
The PLMN in the USIM file User Controlled PLMN Selector with Access
Technology.
The PLMN in the USIM file Operator Controlled PLMN Selector with Access
Technology.
In the USIM card, the file EFIMSI records IMSI (MCC + MNC + MSIN), from which the UE
can get HPLMN. 2) and 3) are the files EFPLMNwAcT and EFOPLMNwACT in the USIM.
4) and 5) are obtained through searching the frequency one by one by the UE. The UE
searches the PLMN one by one according to the PLMN list ordered by the priority above,
and attempts the location registration.
UMTS is evaluated from GSM and both access technologies are different completely
(GERAN vs. UTRAN), so it needs to specify the preferred access technology for each
PLMN. The priority of the access technologies is specified in the file ...with Access
Technology. If it is not specified, generally, GERAN is preferred.
In addition, PLMN needs to be reselected for the following two cases:
In any case, the user can request to initiate PLMN reselection manually.
After the user registers to VPLMN for the reason of handover/roaming, as the MCC is the
same between VPLMN and HPLMN (home PLMN), only MNC is different from each other,
and this case can be judged by the UE. For this case, the UE will return to the home
network as much as possible. The method is to search the home network periodically.
This period is specified by USIM and defined in the file EFHPLMN, from 6 minutes to 8
hours. The operator can also forbid this function, in this way the value is set to 0 in the file
EFHPLMN.
Note: HPLMN is the registration handover and HLR information, and it is defined as
follows in the protocol:
The HPLMN is the GSM network that a GSM user is a subscriber of. That implies that
GSM users subscription data resides in the HLR in that PLMN. The HLR may transfer
the subscription data to a VLR (during registration in a PLMN) or a GMSC (during mobile
terminating call handling). The HPLMN may also contain various service nodes, such as
a short message service centre (SMSC), service control point (SCP), etc.
VPLMN is the roaming handover information, and it is defined as follows in the protocol:
The VPLMN is the GSM network where a subscriber is currently registered. The
subscriber may be registered in her HPLMN or in another PLMN.
In the latter case, the subscriber is outbound roaming (from HPLMNs perspective) and
inbounds roaming (from VPLMNs perspective). When the subscriber is currently
registered in her HPLMN, then the HPLMN is at the same time VPLMN.
2.2.2
2.3
2.3.1
Cell selection process includes cell searching and reading broadcast channel.
Cell searching
Firstly, if a UE has stored some relevant information of this PLMN, such as frequency,
scrambling code, etc, the UE will use this information to search the cell (stored
information cell selection) and find the network quickly. The information is stored in the
USIM card or in the non-volatile memory of the cell phone. The purpose of cell searching
is to find a cell, and the steps are as follows:
Obtaining the main scrambling code of the cell through CPICH, and then the
UE can read the broadcast channel.
Obviously, if the UE has already known some information of this cell, such as frequency
and main scrambling code, the steps mentioned above can be speeded up.
Main information block MIBs dispatching information is already known, that is SIB_POS
= 0, SIB_REP = 8. The UE can read out the MIB in the radio frame of SFN = 0, 8, 16 ...
After reading out the MIB, the UE can judge whether the founded PLMN is the one
expected by the field PLMN identity in the MIB. If yes, according to the other SIBs
dispatching information in the MIB, the UE can the find the other SIB and obtain its
content. If not, the UE needs to find the next frequency and start the process again from
the cell searching. If the current PLMN is the one that the UE is looking for, the UE reads
SIB3 and obtains Cell selection and re-selection info, in this IE, it reads out Qqualmin,
Qrxlevmin, and Maximum allowed UL TX power (UE_TXPWR_MAX_RACH), it
calculates according to the formula below:
Description
Parameter
Description
Squal
Srxlev
Qqualmeas
Qrxlevmeas
Qqualmin
Qrxlevmin
Pcompensation
UE_TXPWR_MAX_RACH
P_MAX
If
Then the UE considers this cell as a suitable cell, it resides and reads the other system
information as needed, then the UE initiates the location registration process. If the
criteria above is not satisfied, the UE reads the SIB11 to obtain the main scrambling code
and the frequency of the neighbor cell, it can measure the Qqualmeas and Qrxlevmeas
of the neighbor cell, in the IE Cell Selection and Re-selection info for SIB11/12, the UE
can know the neighbor cells Maximum allowed UL TX power, Qqualmin and Qrxlevmin,
thus the UE can calculate the neighbor cells Squal and Srxlev, and judge whether the
neighbor cell satisfies the criteria above. If the UE can find any neighbor cell that satisfy
the selection criteria, it will reside in the cell and read the other system information as
needed, then initiate the process of location registration. If the UE cannot find a cell that
satisfies the selection criteria, the UE will consider that it is not covered and continue to
select and reselect PLMN.
2.3.2
Idle Mode
A UE performs the inter-RAT cell reselection in the idle states of WCDMA, GSM and
GPRS. The UE measures the serving cell according to the parameters of network
broadcast and determines whether to reselect another cell.
Connected Mode
A UE performs the inter-RAT cell reselection in the group connected states of Cell_FACH
and Cell_PCH/URA_PCH.
Figure 2-3
2.3.3
2.3.4
Reselection from 3G to 2G
1.
ii.
iii.
Qoffset1s,n: the offset between two cells, it is used for the FDD cell when the
measurements of the cell selection and reselection are set to be CPICH RSCP.
Qoffset2s,n: the offset between two cells, it is used for the FDD cell when the
measurements of the cell selection and reselection are set to be CPICH Ec/No.
Qhyst1s: the hysteresis value, it is used for the FDD cell when the
measurements of the cell selection and reselection are set to be CPICH RSCP.
Qhyst2s: it is used for the FDD cell when the measurements of the cell
selection and reselection are set to be CPICH Ec/No.
Description
Cell_selection_and_reselection_quality_
measure (FDD only)
Parameter
Description
quality measures Qmap,n and Qmap,s,
(read in system information).
Qmeas,s
Qmeas,n
Qoffset1s,n
Qoffset2s,n,
Qhyst1s
Qhyst2s
Treselections
2.
10
Figure 2-4
3.
11
Figure 2-5 Reselection Process for the Case that WCDMA Signal Strength is too Weak
to Maintain Normal Network Service
2.3.5
Reselection from 2G to 3G
In the idle state, inter-RAT selection can be implemented by cell selection and reselection.
Additionally, the standards for the signal quality in the two GU systems are different, so
the parameters setting for the selection and reselection needs to be very cautious, or it
may occur inappropriate cell selection or ping-pong selection.
2.4
Inter-RAT Handover
2.4.1
2.4.2
2.4.2.1
Coverage Handover
12
Load Handover
In the middle and late stages of 3G construction, 3G network extends very fast, 3G
and 2G networks overlap basically, 2G network needs to share load for 3G network,
it adopts load handover that is based on the load of 3G network.
3.
Service Handover
In the middle and late stages of 3G construction, the RNC of 3G network receives
RAB assignment message, the services should be handed over to 2G according to
the requirement from core network, thus 3G users are handed over to 2G network,
and it is called service handover.
2.4.2.2
2.4.3
2.4.3.1
13
Note: The UE also can report the signal quality periodically and the network determines
whether the trigger condition of 3A (or 3C) is satisfied.
The related process is as follows.
Figure 2-6
2.4.3.2
14
Figure 2-7
2.4.3.3
3G_SEARCH_PRIO shows that it can scan on the frame that is generally used
for BSIC decoding, because the 3G neighbor cells do not need BSIC decoding
(If indicated by the parameter 3G_SEARCH_PRIO, the UE may use up to 25
search frames per 13 seconds without considering the need for BSIC decoding
in these frames). The default value is TRUE.
15
Table 2-3
Parameter name
Description
Range
Bits
Message
Qsearch_C_Initial
0/1
BCCH D/L
Qsearch_C
Same to Qsearch_I
0-15
SACCH
D/L
REPORT_TYPE
0/1
BCCH D/L
SACCH
D/L
3G_SEARCH_PRIO
0/1
SACCH
D/L
PBCCH
D/L
PCCCH
D/L
PACCH
D/L
(**)
FDD_REP_QUANT
2.
0/1
If the measurement to a GSM cell is BSIC check, the UE behaviors are as follows:
The UE performs the initial BSIC identification according to the TGPS setting
with a target of GSM Initial BSIC identification. If there are multiple GSM cells,
16
it will perform the process according to the order of signal strength in the recent
GSM carrier RSSI measurement.
The UE performs the BSIC reconfirmation according to the TGPS setting with a
target of GSM BSIC re-confirmation.
The UE decodes the SCH on BCCH and identifies the BSIC for at least one
time, after that, the BSIC is confirmed again for each Tre-confirm_abort seconds,
then the BSIC of GSM cell is considered to be checked. Otherwise it is
considered to be unchecked.
There may be multiple cells with the same ARFCN but different BSICs among
the GSM cells in WCDMA. For the measurements without the BSIC check,
which means that the BSIC is not judged, the network cannot distinguish which
GSM cell each measurement belongs to, and the handover may fail as the
destination is not clear. Therefore it must adopt the BSIC check.
2.4.4
2.4.4.1
Intra-MSC
Figure 2-8
UE/MS
UE/MS
RNS-A
3G_MSC-A
BSS-B
Relocation-Required[1]
HO-Request[2]
HO-Request-Ack[3]
Relocation-Command[4]
RRC-HO-Command
RI-HO-Access
HO-Detect[5]
RI-HO-Complete
HO-Complete[6]
Iu-Release-Command[7]
Iu-Release-Complete[8]
17
RNS-A is the RNS where the cell phone locates before handover; BSS-B is the BSS
where the cell phone locates after handover. All the messages above can be
tracked in the user interface, Iu interface, and A interface. RI is Radio Interface.
RRC is Radio Resource Control. 3G_MSC-A is the MSC where the cell phone
locates before handover.
i.
ii.
iii.
iv.
v.
BSS-B sends the HO_DETECT message to 3G_MSC-A. At this time the cell
phone has already detected the new channel and has the condition to access
the new radio channel, but actually has not accessed yet. As it is voice
handover, the voice channel must be built up, so 3G_MSC-A connects the time
slot of the opposite end to time slot of new interface, and continues to call by
using the resource applied in the process of handover.
vi.
vii.
18
Inter-MSC
For the inter-RAT handover, if a UE only has the circuit domain service, it follows the
handover process of the circuit domain from WCDMA to GSM. The typical handover
process includes: measurement control -> measurement report -> handover
judge->handover execute.
In the stage of measurement control, the network tells UE the measurement
parameters by sending measurement control message. In the stage of
measurement report, the UE sends measurement report to the network. In the stage
of handover judge, the network determines to handover according to the
measurement report. In the stage of handover execute, the UE and the network
follow the signaling process, and take actions according to the signaling.
For the handover from WCDMA to GSM, when the user is in the edge of WCDMA
system and needs to handover between systems, WCDMA RNC notices the UE to
start an inter-RAT measurement. The UE carries out the inter-RAT measurement
and reports the result, RNC determines whether to execute the signaling process for
inter-RAT handover according to the result. As the access mode of WCDMA is code
division multiple access, all the connected UEs work under the specified frequency
for all time, in order to continue to call in the process of inter-RAT measurement,
WCDMA system and the UE may need to start the compression mode (if the UE
only has one transceiver, it must start the compression mode; if the UE has two
transceivers, the UE can test GSM cell without starting the compression mode).
The signaling process of handover from WCDMA to GSM is as follows.
19
Figure 2-9
UE
Node B
RNC
Serving
RANAP
CN
1. Relocation
Required
MSC
BSC
BTS
RANAP
MAP/E
2. Prepare
Handover
MAP/E
BSSMAP
3. Handover
Request
BSSMAP
4. Handover
Request Ack
BSSMAP
MAP/E
5. Prepare
Handover
Response
BSSMAP
MAP/E
6. Relocation
Command
RANAP
RANAP
RRC
[Hard Handover]
8. Handover
Detect
BSSMAP
BSSMAP
9. Handover Complete
RR
RR
10. Handover
Complete
BSSMAP
MAP/E
RANAP
12. Iu Release
Command
BSSMAP
MAP/E
RANAP
13. Iu Release
Complete
RANAP
RANAP
14. Send End
Signal Response
MAP/E
MAP/E
i.
ii.
iii.
iv.
After GSM BSS gets the resource ready for the handover between systems,
BSC replies the HANDOVER REQUEST ACK message to GSM UEC.
v.
20
vi.
WCDMA CN answers the initial request from SRNC through sending RANAP
message RELOCATION COMMAND.
vii.
viii. UE hands over from WCDMA to GSM (hard handover), UE sends the message
HANDOVER COMPLETE to BSC, notices BSC that the handover is
completed, BSC sends the message HANDOVER COMPLETE to GSM UEC.
ix.
x.
xi.
When detecting that UE is in the area covered by GSM, GSM UEC sends the
message SEND END SIGNAL REQUEST to WCDMA CN and notices
WCDMA CN that the handover is completed, and the WCDMA resource
occupied by this UE can be freed.
xii.
2.4.4.2
Intra-SGSN
21
It occurs when a UE radio interface hands over from UTRAN interface to GSM
interface, UTRAN interface and GSM interface are connected to one SGSN.
Figure 2-10
UE/MS
SRNS
2G+3G-SGSN
new
MSC/VLR
HLR
old
MSC/VLR
1. Intersystem change
decision
2. Routeing Area Update Request
3. SRNS Context Request
4. SRNS Context Response
5. Security Functions
6. SRNS Data Forward Command
7. Forward Packets
8. Iu Release Command
8. Iu Release Complete
9. Location Update Request
10a. Update Location
10b. Cancel Location
10c. Cancel Location Ack
10d. Insert Subscriber Data
10e. Insert Subscriber Data Ack
10f. Update Location
11. Location Update Accept
12. Routeing Area Update Accept
C1
13. Routeing Area Update Complete
14. TMSI Reallocation Complete
15. BSS Packet Flow Context Procedure
i.
The UE hands over from UTRAN to the cell which supports GSM interface.
ii.
iii.
iv.
22
v.
vi.
vii.
viii. The cached data is completed to forward, 2G+3G-SGSN releases the lu link.
ix.
If it is joint routing update and attached by IMSI or the location area changes,
2G+3G-SGSN sends the location update message to VLR.
x.
If the user data in VLR is not confirmed by HLR, the new VLR notices HLR to
delete the user data in the old VLR, and inserts users in the new VLR.
xi.
The new VLR assigns new VLR TMSI and notices SGSN.
xii.
xiii. the UE can send the ROUTING AREA UPDATE COMPLETE (Receive N-PDU
Number) message to SGSN, and notice SGSN that the serial number of
datagram has been received. SGSN continues to forward the datagram that is
after this serial number to the UE.
xiv. If the UE has accepted VLR Tthe UEI, 2G+3G-SGSN sends the Tthe UEI
REALLOCATION COMPLETE message to the new VLR.
xv.
2G+3G-SGSN and BSSs optional BSS Packet Flow Context flow, build up
BSS Packet Flow.
2.
i.
CAMEL_GPRS_Routeing_Area_Update_Session
ii.
CAMEL_GPRS_Routeing_Area_Update_Context
Inter-SGSN
The process of group domain handover between SGSNs from UMTS to GSM is as
shown in figure below.
23
Figure 2-11
UE/MS
BSS
SRNS
new
2G -SGSN
old
3G -SGSN
GGSN
new
MSC/VLR
HLR
old
MSC/VLR
1. Inter-RAT change
decision
C2
19. Routing Area Update Accept
C3
20. Routing Area Update Complete
21. TMSI Reallocation Complete
22. BSS Packet Flow Context Procedure
i.
ii.
The UE initiates routing area update request to 2G-SGSN, routing area update
or joint RA/LA update or joint RA/LA update with IMSI attached will be
specified for the update type, before the message is sent to SGSN, BSS will
add the CGI with RAC and LAC where it locates to the message received.
24
iii.
The new 2G-SGSN sends the SGSN Context Request message to the old
3G-SGSN for obtaining MM and PDP contexts, the old 3G-SGSN verifies the
PTMSI signature of the UE. If it is successful, the old SGSN will start a timer; if
the old SGSN does not recognize the UE, it will reply an appropriate error
reason.
iv.
v.
vi.
vii.
viii. If the cell phone is in the state of PMM-CONNECTED, the old 3G-SGSN sends
data forward command to SRNS. After receiving the command, SRNS starts
the data forward timer, SNNS sends the cached data PDU to the old SGSN.
ix.
The old 3G-SGSN sends GTP PDUs to 2G-SGSN by tunnel mode, the serial
number in the head of GTP (obtained from the number of PDCP) does not
change.
x.
The new 2G-SGSN sends the Update PDP CONTEXT REQUEST message to
each relevant GGSN. GGSN updates PDP context and returns Update PDP
Context Response.
xi.
The new 2G-SGSN sends the UPDATE GPRS LOCATION message to notice
HLR to change SGSN number.
xii.
HLR sends the CANCEL LOCATION message to notice the old 3G-SGSN to
cancel the location. The old 3G SGSN responses by the CANCEL LOCATION
ACK message. After the clocking of operation timeout is completed, the old
3G-SGSN deletes MM and PDP Context.
25
xv.
HLR confirms the modification is completed, and sends the UPDATE GPRS
LOCATION message to 2G-SGSN.
xvi. If the association is to be built up, the new 2G SGSN sends the LOCATION
UPDATE REQUEST message to VLR, and notices the new the UEC/VLR to
initiate location update; VLR can create or update association by saving SGSN
number.
xvii. If the user data mark in the VLR is not confirmed by HLR, VLR will notice HLR.
HLR cancels the old VLR and inserts the user data to the new VLR:
a)
b)
HLR cancels the data in the old VLR by sending the CANCEL
LOCATION message to the old VLR.
c)
d)
HLR sends the INSERT SUBSCRIBER DATA ACK message to the new
VLR.
e)
f)
xviii. The new VLR assigns TMSI for the UE, and sends the LOCATION UPDATE
ACCEPT message to notice 2G-SGSN.
xix. The new 2G-SGSN verifies the validity of the UE in the new routing area, if all
the checks are successful, 2G SGSN builds up MM context and PDP context,
and establishes a logical link between the UE and 2G SGSN through 2G
SGSN, 2G SGSN responses the ROUTING AREA UPDATE ACCEPT
message to the UE.
xx. The UE confirms the new assigned PTMSI by sending the ROUTING AREA
UPDATE COMPLETE message, including confirming the data PDU sent to the
UE successfully before the routing area update is initiated.
xxi. After confirmed by the UE, 2G-SGSN sends the TMSI REALLOCATION
COMPLETE message to notice VLR TMSI that the assignment is completed
again.
xxii. 2G-SGSN and BSS execute BSS Packet Flow Context procedure.
26
2.4.4.3
Intra-SGSN
When a UE radio interface hands over from GSM interface to UTRAN interface,
UTRAN interface and GSM interface are connected to one SGSN.
Figure 2-12
UE/MS
BSS
SRNS
2G+3G-SGSN
new
MSC/VLR
HLR
old
MSC/VLR
Set up Radio
Resources
i.
The UE hands over from UTRAN to the cell which supports UTRAN interface.
ii.
iii.
iv.
If it is joint routing update and attached by IMSI or the location area changes,
the 2G+3G-SGSN sends the LOCATION UPDATE message to VLR.
27
v.
If the user data in VLR is not confirmed by HLR, the new VLR notices HLR to
delete the user data in the old VLR, and inserts users in the new VLR.
vi.
The new VLR assigns new VLR TUEI and notices the SGSN.
vii.
viii. The UE sends the ROUTING AREA UPDATE COMPLETE message to the
SGSN by using the new P-TUEI.
ix.
x.
If the UE needs to send signaling or uplink data, the UE can initiate the service
request process. If the 2G+3G-SGSN needs to forward signaling or downlink
data, the 2G+3G-SGSN will initiate the paging process.
xi.
xii.
2.
i.
CAMEL_GPRS_Routeing_Area_Update_Session
ii.
CAMEL_GPRS_Routeing_Area_Update_Context.
Inter-SGSN
The process of group domain handover between SGSNs from GSM to UNTS is as
shown in figure below.
28
Figure 2-13
UE/M
S
BS
S
SRN
S
ne
w
3 -SGS
G N
1. Inter-RAT
change decision
Routing Area Update
2. Request
ol
d
2 -SGS
G N
GGS
N
ne
w
MSC/VLR
HLR
ol
d
MSC/VLR
3. SGSN Context
Request
4. SGSN Context
Response
5. Security
Functions
6. SGSN Context
Acknowledge
C
1
7. Forward
Packets
8. Update PDP Context
Request
8. Update PDP Context
Response
9. Update GPRS
Location
10. Cancel
Location
10. Cancel
Location
11. Insert Subscriber
Data
11. Insert Subscriber
Ack
Data
12. Update GPRS
Ack
Location
13. Location Update
Request
Ack
14a. Update
Location
14b. Cancel
Location
14b. Cancel
Location
14c. Insert Subscriber
Data
14d. Insert Subscriber
Ack
Data
14e. Update
Location
Ack
C
3
18. TMSI Reallocation
Complete
29
Ack
i.
ii.
The UE sends routing area update request to the new 3G-SGSN. Routing area
update or joint RA/LA update or joint RA/LA update with IMSI attached will be
specified for the Update Type, before the message is sent to SGSN. Before
sending the user message to SGSN, SRNC will add the RAC and LAC routing
identifiers of the area where the UE locates.
iii.
The 3G-SGSN obtains the address of the old 2G-SGSN through the old routing
area identifier from the UE, and then sends the SGSN CONTEXT REQUEST
message to the old 2G-SGSN, in order to obtain MM context and PDP context
of the user. The old 2G-SGSN verifies the P-TMSI signature of the UE, if the
P-TMSI signature is valid or 3G-SGSN indicates that the UE has already been
authenticated, the 2G-SGSN starts a timer.
iv.
v.
vi.
vii.
The 2G-SGSN copies and caches N-PDUs, and it starts to send data packet to
the 3G-SGSN. Before the timer times out, the extra N-PDUs received from
GGSN will be copied and sent to 3G-SGSN. After the timer times out, no
N-PDUs will be sent to 3G-SGSN.
viii. The 3G-SGSN sends the UPDATE PDP CONTEXT REQUEST message to
each GGSN related. Each GGSN updates its PDP context and responses the
UPDATE PDP CONTEXT RESPONSE message.
ix.
The 3G-SGSN notices HLR that the SGSN has changed by sending the
UPDATE GPRS LOCATION message.
x.
The HLR sends the CANCEL LOCATION message to the old 2G-SGSN. After
the 2G-SGSN timer times out, the old 2G- SGSN will delete MM context and
PDP context. The 2G-SGSN responds by sending the CANCEL LOCATION
ACK message.
xi.
The HLR sends the INSERT SUBSCRIBER DATA message to the 3G-SGSN.
The 3G-SGSN builds up MM context and replies the INSERT SUBSCRIBER
DATA ACK message to the HLR.
30
xii.
The HLR confirms that the modification is completed, and responds to the
3G-SGSN through the UPDATE GPRS LOCATION message by returning an
UPDATE GPRS LOCATION ACK.
xiii. If the association is to be built up, and the joint RA/LA update attached by IUEI
is specified for Update Type, or the LA changes in the routing area update, the
new SGSN will sends the LOCATION UPDATE REQUEST message to the
VLR, and notices the new VLR to initiate location update, the VLR creates or
updates association by saving SGSN number.
xiv. If the user data identifier in the VLR is not confirmed by the HLR, the VLR will
notice the HLR. The HLR cancels the old VLR and inserts user data to the new
VLR.
xv.
a)
b)
The HLR cancels the old data in the VLR by sending the CANCEL
LOCATION message to the old VLR.
c)
d)
The HLR sends the INSERT SUBSCRIBER DATA ACK to the new VLR.
e)
The new VLR responds through the INSERT SUBSCRIBER DATA ACK
message.
f)
The HLR responds to the new VLR through the UPDATE LOCATION
ACK message.
The new VLR assigns a new TUEI and notices the 3G-SGSN through the
LOCATION UPDATE ACCEPT message.
xvi. The 3G-SGSN verifies the UE in the new routing area, if all the checks are
passed, the 3G-SGSN builds up the MM context and PDP context of the user.
The 3G-SGSN sends the ROUTING AREA UPDATE ACCEPT message to
the UE.
xvii. The UE confirms the new assigned PTMSI by sending the ROUTING AREA
UPDATE COMPLETE message.
xviii. If the confirmation is obtained from the UE, the 3G-SGSN sends the TMSI
REALLOCATION COMPLETE message to the new VLR.
xix. If the UE has uplink data or signaling, it will send the SERVICE REQUEST
message to the SGSN. The requested service will be specified in Service Type
(data or signaling)
xx. If the UE has sent the service request, the 3G-SGSN sends the RAB
ASSIGNMENT REQUEST message to request SRNS to build a radio access
31
bearer. The SRNS sends the RADIO BEARER SETUP REQUEST message
to the UE. The UE responds through the RADIO BEARER SETUP
COMPLETE message. The SRNS sends the RAB ASSIGNMENT
RESPONSE message to the SGSN. The SRNS sends N-PDUs to the UE.
32
3.1
Parameters Provided to 3G by 2G
The radio parameters provided to 3G by 2G include the country code (MCC),
network code (MNC), location area code (LAC), cell ID (CI), network color code
(NCC), base station color code (BCC), band indication (900 or 1800) and BCCH.
Error! Reference source not found. shows an example of parameters for 2G, and
all the parameters are decimal in the example.
Table 3-1
Parameters Provided to 3G by 2G
MCC
MNC
460
2.
LAC
CI
NCC
0
BCC
0
Band
Indication
900
BCCH
10
Parameters Provided to 2G by 3G
The radio parameters provided to 2G by 3G include country code (MCC), network
code (MNC), location area code (LAC), RNC ID (RNC ID), cell ID (C_ID), downlink
frequency point, primary scrambling code, and frequency bandwidth. Error!
Reference source not found. shows an example of parameters for 3G, and all the
parameters are decimal in the example.
Table 3-2
MCC
460
3.2
Parameters Provided to 2G by 3G
MNC
2
LAC
20
RNC
ID
1
C_ID
Downlink
ARFCN
Primary
Scrambling
Code
Frequency
Bandwidth
1501
10687
126
33
Table 3-3
FDD_Qoffset
0 ()
FDD_Qmin
7(12 dB)
Qsearch_I
7 (always)
Table 3-4
Parameter
Description
Baseline
Value
Qqualmin
18 dB
QRxLevMin
115 dBm
SSearchRat
6 dB
QHyst1S
10 dB
Qoffset1SNSib11
10 dB
Qoffset1SNSib12
0 dB
Treselection
1s
3.2.1
3.2.1.1
FDD_Qoffset
Description
If a UTRAN neighbor cell has been switched on (a 3G cell itself should meet certain
conditions) and it satisfies the demand of starting measurement that is set in the cell,
a UE can reselect the UTRAN neighbor cell after it meets the three conditions
below:
The RSCP (received signal code power) of the neighbor cell is higher than the
RLA_C.
The RSCP of the neighbor cell is higher than the RLA_Cs of all the GSM
neighbor cells by at least FDD_Qoffset (FDD reselection offset), and it lasts at
least 5 seconds (if it reselected a GSM cell 15 seconds ago, the FDD_Qoffset
still needs 5 dB increment).
The Ec/No of the neighbor cell is higher than or equal to the FDD_Qmin set in
the cell (the minimum Ec/No of the UTRAN reselection cell).
34
If there are more than one UTRAN cells that can meet the conditions above, the cell
with the highest RSCP is selected.
3.2.1.2
FDD_Qmin
Description
When it reselects the UTRAN neighbor cell, it requires that the value of Ec/No is not
less than the value of the cell.
3.2.1.3
Qsearch_I
Description
When the RLA_C of the cell is lower (0~6) or higher (8~14) than the threshold, a UE
starts the measurement of the UTRAN reselection cells. 7 refers to always and 15
refers to never.
35
3.2.2
3.2.2.1
Qqualmin
Description
This parameter shows the minimum level of quality demand for selection and
reselection which is satisfied by a cell. When it is CPICH Ec/No for measurement, as
long as the quality value of the measured cell is bigger than the Qqualmin, it can
satisfy the condition of cell selection. The default value is -18 dB.
Table 3-5
Qqualmin Description
Wireless Parameter Name
Full Name
Qqualmin(dB)
Abbreviation
QQualMin
Description
Value Range
and Stepsize
Unit
dB
Default Value
(Remarks)
-18 dB
36
If the value of this parameter increases, the condition of cell selection is difficult to
be satisfied; if the value of this parameter decreases, the condition of cell selection
is easy to be satisfied. However, it is likely that a UE cannot receive the system
message borne by the PCCPCH correctly after it resides in the cell.
Parameter configuration
Log on the OMC-R and set in the path below.
Interface Path: view Configuration Management RNC NE RNC Radio
Resource Management Utran cell Utran cell xx Modify Advanced Parameter
SCCPCH
3.2.2.2
SsearchRAT
Description
This parameter shows the trigger threshold Ssearch,RAT of inter-RAT measurement for
reselection. The UE is used to determine whether to carry out the inter-RAT
measurement. When the HCS is not used, if the quality of the serving cell is higher
than the Ssearch,RAT , the inter-RAT measurement will not be performed, if the quality
of the serving cell is not higher than the Ssearch,RAT or the Ssearch,RAT is not configured,
the inter-RAT measurement will be performed. For details, refer to TS 25.304.
Table 3-6
SsearchRAT Description
Wireless Parameter Name
Full Name
Ssearch, RAT(dB)
Abbreviation
SSearchRat
Description
Value Range
and Stepsize
Unit
dB
Default Value
(Remarks)
6 dB
37
The factors that should be taken into account for parameter configuration include:
cell residence and UE battery consumption.
The higher the parameter is, the easier the inter-RAT measurement is triggered and
the more the UE battery consumes. The smaller the parameter is, the more difficult
the inter-RAT measurement is triggered; and it cannot reside in the cell with good
quality in time, which causes call loss easily.
Parameter configuration
Log on the OMC-R and set in the path below.
Interface Path: View Configuration Management RNC NE RNC Radio
Resource Management Advanced Parameter Manage ueCnst Waiting Time
for Receiving "In Sync" from L1 in Connected Mode (T312 in Connected Mode)
3.2.2.3
QRxLevMin
Description
This parameter shows the minimum threshold of received level for selection and
reselection which is satisfied by a cell. When it is CPICH RSCP for measurement,
the quality value of the measured cell is bigger than the Qrxlevmin, which can just
satisfy the condition of cell selection.
Table 3-7
QRxLevMin Description
Wireless Parameter Name
Full Name
Qrxlevmin(dBm)
Abbreviation
QRxLevMin
Description
Value Range
and Stepsize
Unit
dBm
Default Value
(Remarks)
-115 dBm
38
Parameter configuration
Log on the OMC-R and set in the path below.
OMC path: View Configuration Management RNC NE RNC Radio Resource
Management UltranCell UltranCellXXX Modify Advanced Parameter UTRAN
Cell Indicator of Cell Re-establishment when OCNS Codes Changed
3.2.2.4
QHyst1S
Description
This parameter shows the delay parameter of FDD cell reselection for judgment
when the measurement value is CPICH RSCP or Cpich EcNo. In the rule of value R
ordering for reselection, the R value of serving cell is equal to the measurement
value and reselection delay. When the measurement value is Cpich RSCP,
calculate and order the R values according to the Qhyst1s. When the measurement
value is Cpich EcNo, first calculate and order the R values according to the Qhyst1s,
the UTRAN cell ranks at the top, then calculate and order the R values according to
the signal quality of Cpich EcNo.
Table 3-8
QHyst1S Description
Wireless Parameter Name
Full Name
Qhyst1s(dB)
Abbreviation
QHyst1S
Description
This parameter shows the delay parameter of FDD cell reselection for
judgment when the measurement value is CPICH RSCP or Cpich
EcNo. In the rule of value R ordering for reselection, the R value of
serving cell is equal to the measurement value and reselection delay.
When the measurement value is Cpich RSCP, calculate and order the
R values according to the Qhyst1s. When the measurement value is
Cpich EcNo, first calculate and order the R values according to the
Qhyst1s, the UTRAN cell ranks at the top, then calculate and order
the R values according to the signal quality of Cpich EcNo.
Value Range
and Stepsize
Unit
dB
Default Value
(Remarks)
10 dB
39
The higher this parameter is, the more difficult the reselection is triggered, and the
less sensitive it is relatively for the signal variation. The lower this parameter is, the
easier the reselection is triggered, and the more ping-pong reselections occur,
which increase the signaling load.
Adjustment recommendation: It can be set to be higher properly for the scenario
where the signal changes fast.
Parameter configuration
Log on the OMC-R and set in the path below.
Interface Path: view Configuration Management RNC NE RNC Radio
Resource Management Utran cell Utran cell xx Modify Advanced Parameter
PICH
3.2.2.5
Qoffset1s,n in SIB11(dB)
Description
This parameter shows the quality offset of serving and neighbor cells when the
measurement value is CPICH RSCP. It is used for cell ordering in the reselection
rule. This parameter is broadcast to UE in the SIB11. The R value of the neighbor
cell is equal to be the measured signal quality of the neighbor cell subtracting this
offset.
Note:
For idle or connected mode, when the SIB12 is not broadcast, it is equal to the value of
Qoffset1SNSib11 when the reselection measurement value is RSCP; for connected
mode, when the SIB12 is broadcast, it is equal to the value of Qoffset1SNSib12 when the
reselection measurement value is RSCP.
Table 3-9
Full Name
Qoffset1s,n in SIB11(dB)
Abbreviation
Qoffset1SNSib11
Description
This parameter shows the quality offset of serving and neighbor cells
when the measurement value is CPICH RSCP. It is used for cell
ordering in the reselection rule. This parameter is broadcast to UE in
the SIB11.
Value Range
and Stepsize
Unit
dB
40
0 dB
Parameter configuration
Log on the OMC-R and set in the path below.
Interface Path: View Configuration Management RNC NE RNC Radio
Resource Management UltranCell UltranCellXXX Neighboring Cell
Advanced Parameter Manager Qoffset1s,n in SIB11(dB)
3.2.2.6
Qoffset1s,n in SIB12(dB)
Description
This parameter shows the quality offset of serving and neighbor cells when the
measurement value is CPICH RSCP. It is used for cell ordering in the reselection
rule. This parameter is broadcast to UE in the SIB12.
Note:
For idle or connected mode, when the SIB12 is not broadcast, it is equal to the value of
Qoffset1SNSib11 when the reselection measurement value is RSCP; for connected
mode, when the SIB12 is broadcast, it is equal to the value of Qoffset1SNSib12 when the
reselection measurement value is RSCP.
41
Table 3-10
Full Name
Qoffset1s,n in SIB12(dB)
Abbreviation
Qoffset1SNSib12
Description
This parameter shows the quality offset of serving and neighbor cells
when the measurement value is CPICH RSCP. It is used for cell
ordering in the reselection rule. This parameter is broadcast to UE in
the SIB12.
Value Range
and Stepsize
Unit
dB
Default Value
(Remarks)
0 dB
Parameter configuration
Log on the OMC-R and set in the path below.
Interface Path: View -> Configuration Management -> RNC NE -> RNC Radio
Resource Management -> UltranCell -> UltranCellXXX -> Neighboring Cell ->
Advanced Parameter Manager -> Qoffset1s,n in SIB12(dB)
3.2.2.7
Treselection
Description
This parameter shows the timer duration of reselection. To be a serving cell, a new
cell must be the best cell according to the ordering R principle, and it lasts for
Treselections, which can be selected the new serving cell.
42
Table 3-11
Treselection Description
Wireless Parameter Name
Full Name
Treselection(s)
Abbreviation
TReselection
Description
Value Range
and Stepsize
Unit
Default Value
(Remarks)
1s
Parameter configuration
Log on the OMC-R and set in the path below.
Interface Path: View Configuration Management RNC NE RNC Radio
Resource Management Advanced Parameter Manage ueCnst Waiting Time
for Completion of Cell Update When Radio Link Fails and Radio Bearer(s)
Associated with T315 Exist (T315)
3.2.2.8
Qhyst2s(dB)
Description
This parameter shows the delay parameter of FDD cell reselection for judgment
when the measurement value is CPICH Ec/No. In the rule of value R ordering for
reselection, the R value of serving cell is equal to the measurement value and
reselection delay. Refer to TS 25.304 for details.
43
Table 3-12
Qhyst2s(dB) Description
Wireless Parameter Name
Full Name
Qhyst2s(dB)
Abbreviation
QHyst2S
Description
This parameter shows the delay parameter of FDD cell reselection for
judgment when the measurement value is CPICH Ec/No. In the rule
of value R ordering for reselection, the R value of serving cell is equal
to the measurement value and reselection delay. Refer to TS 25.304
for details.
Value Range
and Stepsize
Unit
dB
Default Value
(Remarks)
2 dB
Parameter configuration
Log on the OMC-R and set in the path below.
Interface Path: View -> Configuration Management -> RNC NE -> RNC Radio
Resource Management -> RCP Scrambling Code Configuration Information ->
Ending No. of RCP Scrambling Code
3.2.2.9
Qoffset2s,n in SIB11(dB)
Description
This parameter shows the quality offset of serving and neighbor cells when the
measurement value is CPICH Ec/No. It is used for cell ordering in the reselection
rule. This parameter is broadcast to UE in the SIB11. The R value of the neighbor
cell is equal to be the measured signal quality of the neighbor cell subtracting this
offset.
44
Table 3-13
Full Name
Qoffset2s,n in SIB11(dB)
Abbreviation
Qoffset2SNSib11
Description
This parameter shows the quality offset of serving and neighbor cells
when the measurement value is CPICH Ec/No. It is used for cell
ordering in the reselection rule. This parameter is broadcast to UE in
the SIB11. The R value of the neighbor cell is equal to be the
measured signal quality of the neighbor cell subtracting this offset.
Value Range
and Stepsize
Unit
dB
Default Value
(Remarks)
0 dB
Parameter configuration
Log on the OMC-R and set in the path below.
Interface Path: View -> Configuration Management -> RNC NE -> RNC Radio
Resource Management -> UltranCell -> UltranCellXXX -> Neighboring Cell ->
Advanced Parameter Manager -> Qoffset2s,n in SIB11(dB)
3.2.2.10
Qoffset2s,n in SIB12(dB)
Description
45
This parameter shows the quality offset of serving and neighbor cells when the
measurement value is CPICH Ec/No. It is used for cell ordering in the reselection
rule. This parameter is broadcast to UE in the SIB12.
Table 3-14
Full Name
Qoffset2s,n in SIB12(dB)
Abbreviation
Qoffset2SNSib12
Description
This parameter shows the quality offset of serving and neighbor cells
when the measurement value is CPICH Ec/No. It is used for cell
ordering in the reselection rule. This parameter is broadcast to UE in
the SIB12.
Value Range
and Stepsize
Unit
dB
Default Value
(Remarks)
0 dB
Parameter configuration
Log on the OMC-R and set in the path below.
Interface Path: View -> Configuration Management -> RNC NE -> RNC Radio
Resource Management -> UltranCell -> UltranCellXXX -> Neighboring Cell ->
Advanced Parameter Manager -> Qoffset2s,n in SIB12(dB)
3.2.3
3G->2G Reselection
46
Table 3-15
Parameter
Description
Baseline
Value
Value of
Unicom
Qqualmin
-18 dB
-18 dB
QRxLevMin
-115 dBm
-115 dBm
SSearchRat
6 dB
4dB
QHyst1S
10 dB
10 dB
Qoffset1SNSib11
10 dB
0 dB
Qoffset1SNSib12
0 dB
0 dB
Treselection
1s
1s
Note:
The values of Unicom are different according to the different requirements from each city.
The values above are only for reference, the values for each project depend on the
actual.
2.
2G->3G Reselection
Table 3-16
FDD_Qoffset
0 ()
FDD_Qmin
7(-12 dB)
Qsearch_I
7 (always)
Note:
It shows - when the FDD_Qoffset is set to 0. The reason for setting it to be 0 is that
UE does not need to consider the strength comparison between 2G and 3G. If it
requires the UE to select 3G as far as possible in the field, this parameter can be set
to 0.
It is only reference for 2G parameters, which should be set according to the demands of
each project.
47
3.3
3.3.1
Description
This parameter shows the absolute threshold configured for 2D/2F event (used for
judging the quality of the carrier frequency being used).
Table 3-17
Full Name
Absolute threshold configured for 2D/2F event (used for judging the
quality of the carrier frequency being used).
Abbreviation
ThreshUsedFreq[MAX_INTER_MEAS_EVENT]
Description
Value Range
and Stepsize
Unit
dBm /dB
Default Value
(Remarks)
48
The 2D and 2F events are the switch of the compact model. The lower the 2D
threshold is, the more difficult the 2D is triggered. The lower the 2F threshold is, the
easier the 2F is triggered. As the requested signal quality and inter-RAT handover
policies are different according to different service types, so the inter-RAT
measurement thresholds are divided into CS and PS signaling. When a cell is in the
center of carrier frequency coverage, it will use the Ec/No measurement value as
the criterion of the 2D and 2F events. Therefore, if the compact model is expected to
start as early as possible, set the 2D event threshold to be higher, otherwise set it to
be lower. If the ping-pong handover is expected to decrease in the start and stop
processes of the compact model, it can increase the difference between the 2D and
2F thresholds. The easier the event is triggered, the more number of average
handover time there is, which increases the handover success rate, but consumes
the system resources.
Note:
It can choose Ec/Io or RSCP as the trigger threshold of each event, according to the
actual situation. At the edge of the cell coverage, the system is usually limited for the
uplink loss, which triggers the inter-RAT handover caused by coverage. The range of
Ec/Io is relatively smaller, which is not suitable for the handover caused by coverage as it
varies very fast, so it is recommended to adopt the RSCP. For the center of the cell
coverage, there is more interference and the system is usually limited for the downlink
interference, which triggers the inter-RAT handover. Therefore, the Ec/Io can better
reflect the interference degree of the system.
Currently it adopts RSCP for the trigger threshold of each event.
Parameter configuration
Log on the OMC-R and set in the path below.
Interface Path: View->Configuration Management->RNC NE->RNC Radio
Resource Management->Modify Advanced Parameter->UE Inter-frequency
Measurement Configuration-> Absolute Threshold of the Quality of the Currently
Used Frequency for 2B/2D/2F
3.3.2
Description
This parameter shows the absolute threshold value for judging the quality of other
system, which is configured for 3A/3C event. The value range and unit of this
parameter are related to the measurement value of other system cell, which is only
for the GSM Carrier RSSI of GSM system now, corresponding to the CPICH RSCP
49
of local system. Therefore, the value range and unit of this parameter correspond to
the CPICH RSCP.
Table 3-18
Full Name
Abbreviation
ThreshSys[MAX_RAT_MEAS_EVENT]
Description
This parameter shows the absolute threshold value for judging the
quality of other system, which is configured for 3A/3C event. The
value range and unit of this parameter are related to the
measurement value of other system cell, which is only for the GSM
Carrier RSSI of GSM system now, corresponding to the CPICH
RSCP of local system. Therefore, the value range and unit of this
parameter correspond to the CPICH RSCP.
MAX_RAT_MEAS_EVENT is the maximum number of inter-RAT
measurement event, and the value is 4.
Value Range
and Stepsize
Unit
dBm /dB
Default Value
(Remarks)
50
ii.
If the quality of inter-RAT neighbor cell is also poor, the service switches
rashly. There is a high rate of call drop, and the service quality cannot be
guaranteed after handover. So this threshold cannot be set to be lower, in
order to guarantee the service to be normal.
Note:
According to the current 3G strategy, let the 3G subscribers enjoy the 3G services as far
as possible, and it adopts the 3A event trigger for the network.
Parameter configuration
Log on the OMC-R and set in the path below.
Interface Path: View->Configuration Management->RNC NE->RNC Radio
Resource Management-> Modify Advanced Parameter->UE Inter-RAT
Measurement Configuration Information-> Absolute Threshold of the Quality of
Other RAT for 3A/3B/3C
3.3.3
Hysteresis(Rat)
Description
This parameter shows the delay for judging whether a event satisfies the event
trigger condition.
Table 3-19
Full Name
Hystersis(dB)
Abbreviation
Hysteresis[MAX_RAT_MEAS_EVENT]
Description
This parameter shows the delay for judging whether a event satisfies
the event trigger condition. Using this parameter will generate a
difference value between the state of triggering an event and the left
state of triggering an event, which avoids that even a little variation
can change the trigger state. It is configured for different events
individually with different values.
The MAX_INTER_MEAS_EVENT is the maximum number of
inter-frequency measurement event, and the value is 6.
Value Range
and Stepsize
Unit
dB
Default Value
(Remarks)
51
Parameter configuration
Log on the OMC-R and set in the path below.
Interface Path: View->Configuration Management->RNC NE->RNC Radio
Resource Management-> Modify Advanced Parameter->UE Inter-RAT
Measurement Configuration Information-> Hysteresis
52
3.3.4
Parameter
Definition
Class
Baseline Value of
Value
Unicom
Unit
CS
dB
13
-13
PS
dB
13
-13
CS
dBm 95
-95
PS
dBm 95
-105
CS/PS
dB
TimeToTrigger2D
CS/PS
ms
640
640
CPICH Ec/Io 2F
Threshold
2F quality threshold
CS
dB
-5
PS
dB
-5
CPICH RSCP 2F
Threshold
2F strength threshold
CS
dBm 80
-90
PS
dBm 80
-100
Hysteresis2F
CS/PS
dB
TimeToTrigger2F
CS/PS
ms
640
640
3A quality threshold
CS
dB
-6
3A quality threshold
PS
dB
-6
CS
dBm 95
-92
PS
dBm 95
-102
CPICH Ec/Io 2D
Threshold
2D quality threshold
CPICH RSCP 2D
Threshold
2D strength threshold
Hysteresis2D
CPICH Ec/Io 3A
Threshold
CPICH RSCP 3A
Threshold
3A strength threshold
Hysteresis3A
3A delay window
CS/PS
dB
TimeToTrigger3A
CS/PS
ms
100
100
Note:
The values of Unicom are different according to the different requirements from each city.
The values above are only for reference, the values for each project depend on the
actual.
3.4
53
The setting for the neighbor cell is based on the different interoperability strategies
of 2G/3G.
When the coverage is not continuous within the UMTS network, the interoperability
between the whole network and 2G system should be taken into account. The
method of configuring 2G neighbor cells for the whole network is the same as the
method of configuring neighbor cells within the system, and the traffic congestion of
the neighbor cells should also be taken into account.
When the coverage is continuous within the UMTS network, and it only switches
between the edge of the UMTS system and 2G system, it only needs to configure
the neighbor cells for the edge base stations, and the principles below should be
considered:
The co-location and co-direction cells are set to be the neighbor cells.
54
Avoid a sudden decline of the signal in the border area of WCDMA coverage, if
there is a sudden decline in the border area of ECDMA, it is suggested to optimize
the network, increase the signal strength or reselect the WCDMA signal. This
principle also applies to the signal of internal WCDMA for different frequency
handover.
Avoid the overlap between the borders of WCDMA and GSM. if GSM has a good
coverage in the border of WCDMA, it helps to handover from WCDMA to GSM
successfully, on the contrary if the border of WCDMA is not set properly, the signal
strength of GSM network is not enough while handing over, it will increase the
failure possibility of inter-RAT measurement or signaling interaction, which causes
the dropped call.
The border of WCDMA network should be chosen in the area of low density people,
avoiding the area of higher density (stations, terminals, etc.). This will not only
reduce the number of inter-RAT handover, but also avoid signaling exchange
delay/failure due to lack of processing power, and eventually leading to dropped
calls. In addition, according to the specific environment, optimizing WCDMA
measurements and switching algorithm parameters to further improve the success
rate of inter-RAT handover.
Table 4-1
Scenario
General
scenario
FAQ
Rapid changes in local
signal or high-speed
Optimization Method
1. First to improve the coverage through
network planning and optimization.
55
Scenario
FAQ
mobile users, easily
dropped calls
Optimization Method
2. Trying the optimization method in the
scenario of fast signal changing, but pay
attention to the optimized performance of the
whole network
Still,
low-speed
Fast signal
changing
Elevator coverage
scenario, better
coverage outside the
elevator, it does not
meet the inter-RAT
measurement
conditions, the
coverage of the
elevator after closing is
poor, leading to high
rate of dropped calls
The analysis of typical reselection and handover problems are described below.
4.1
56
reselection probability can improve the paging success rate of the system
correspondingly.
4.2
Table 4-2
Information
Element/
Group Name
Inter-RAT
handover
failure cause
Need
MD
Multi
Semantics
Description
Default value is
"unspecified".
11 spare values
are needed.
The returned message cell shows that gsm_MessageList is 06 28 XX. XX refers to the
GSM information as follows.
Figure 4-1
57
4.2.1
Uplink interference
Analysis
The GSM channel cannot be synchronized, and the engineers should check the
handover success rate of each 2G cell at the same time.
Solution
Delete the poor 2G neighbor cells. In some areas different frequencies vary widely,
the poor frequencies interfere a lot. If the handover success rate is lower than 80%,
it needs to summarize the rule of the deleted neighbor cells, and perform the RNC
neighbor cell deletion according to the rule.
2.
Analysis
For the operator's business marketing strategy, a part of the users are not allowed
to subscribe to 2G network.
Solution
Fundamental solutions: CN supports the service handover based on IUEI, which the
user attribute can be known by the access network.
Avoidance solution: Cancel the inter-RAT handover.
3.
Analysis
The problem is related with the cell phone.
58
Solution
If it is PS domain, avoid the handover of such kind of users, if it is CS domain, no
handle it or communicate with the cell phone users.
4.2.2
Wrong Configuration
Analysis
interRAT_HO_FailureCause.t = 1, corresponding to Configuration unacceptable
handoverFromUTRANFailure.interRATMessage.gsm_MessageList = 06 28 6f
This phenomenon is the most common failure in the foreign countries; it shows that most
inter-RAT handovers have failed, only individual cell phones with better compatibility are
successful: encryption configuration information is not filled completely.
Solution
Upgrade BSC or adopt with the CN from ZTE.
4.2.3
Protocol Error
interRAT_HO_FailureCause.t = 3, corresponding to protocol error. There is protocol error
in the location update request message received; the network sends location update
refuse message, the reasons are as follows:
Protocol error
4.2.4
Parameter Configuration
2D event threshold is not set reasonably, generally the threshold is not advised to
set to be too high, it is recommended to set more than 100 dBm, in order to assure
the handover success rate; 2D event delay also should be set reasonably.
59
4.2.5
4.2.6
Relocation failure: Check whether the LAC set by CN is complete; check the radio of
relocation failure, if it is more than 20%, please ask CN to check together.
The configuration of neighbor cell is missing; the current WCDMA cell misses the
destination GSM neighbor cell (The detected most powerful GSM cell is not the
neighbor cell of the current service cell).
Resource Refusing
There is no available radio resource in the current destination GSM cell.
60
Cases Study
5.1
5.1.1
Case 1
Phenomenon
In the A network, the handover from 3G->2G and reselection could not be performed by
using MOTO, NOKIA cell phones.
Case analysis
1.
The voice could be handed over from 3G to 2G, but after hooking on, it returned to
3G from 2G at once, it could not reside in 2G even if it met the condition to reside.
2.
The handover failed when the data service met the condition to hand over from 3G
to 2G.
3.
UE in the 3G IDLE mode could not reselect 2G even if the condition was satisfied.
A network adopted different PLMN schemes for 3G/2G, The current 2G did not need to
change, and 3G adopted the different PLMN from that of 2G.
Network reselection scheme: While UE is residing in 3G, it can reselect 2G through the
normal cell reselection; while UE is residing in 2G, it can reselect 3G through equivalent
PLMN reselection.
Network handover scheme: The voice can be handed over from 3G to 2G, and it
reselects 3G back through equivalent PLMN after hooking on. PS data service can be
handed over from 3G to 2G, and it reselects 3G back through equivalent PLMN.
Problem location
The equivalent PLMN was used in PLMN selection, cell selection, reselection and
handover. When UE was reselecting, it could access normally only when it detected that
the cell was the permitted PLMN; for the case of different PLMNs, if 2Gs PLMN was not
set to be equivalent PLMN in 3G, the following phenomenon shows:
The voice could be handed over from 3G to 2G successfully, but after hooking on in
2G, the cell phone would not update location at once, but research PLMN, the
phenomenon was that the cell phone was off the network temporarily.
61
When the data service met the condition to handover from 3G to 2G, after receiving
the CELL CHANGE ORDER issued by RNC, UE failed to search the 2G network,
and it returned CELL CHANGE ORDER FAIL.
Solution
Set 2Gs PLMN to be equivalent PLMN on both 3Gs UEC and SGSN, the handover from
3G to 2G and reselection were normal.
Experience
Understand the restrictions of different PLMNs networking, and set the parameters
reasonably.
5.2
5.2.1
Case 1
Phenomenon
It could not reselect from 3G to 2G due to the measurement for different system was not
enabled by UE.
Problem location
If it was not set to enable the measurement for different systems in the FACH (MOD
CELLMEAS), RNC would not issue the information of GSM neighbor cell in SIB 11, even
if it already met the condition to enable the measurement for different systems in 3G, it
would not reselect due to there was no neighbor cell in the different systems.
Solution
Enable the measurement for different systems.
5.2.2
Case 2
Phenomenon
UE could not reselect from 2G to 3G due to 3G neighbor cell relationship was not set.
Problem location
After setting the reselection parameters for 2G=>3G, the radio signal had met the
condition for reselection to 3G, but the cell phone still could not reselect. The most direct
method was to use the background software of the cell phone to track the 2G message
62
issued by the network and signal quality measured by UE. If the neighbor cell relationship
of 3G was not set in 2G, then there was no 2quater (2ter) message in the system
message.
Solution
Add the 3G cell as the neighbor cell of different systems for 2G cell on the 2G BSC.
5.3
Inter-RAT Handover
5.3.1
Case 1
Phenomenon
Frequent handover from 3G to 2G in the cell was caused by the handover parameters
configuration for RNC1 and RNC10.
Case analysis
We performed coverage test for this site by using Agilent tester, but the result showed
that the 3G signal of the three cells in the site was good, so the coverage problem was
excluded.
We performed CQT dialing test in one cell at TRI722W, in the process of test, both
parties called in 3G, and handed over to 2G within several seconds, and the call must be
ended for handing over to 3G, This 3G/2G handover always occurred in the tests of
dozens of times.
While moving from one cell (12552) of TRI255W which was the neighbor site of TRI722W
to another cell (17223) of TRI722W, in the soft handover area, UE remained in 3G
network when 12552 was the best cell, when 17223 became the best cell, UE handed
over to 2G network after 3 seconds. So we doubted that the problem existed in the 3 cells
of TRI722W.
Problem location
From the analysis above, we doubted that the inter-RAT handover parameters or
strategies of the 3 cells in TRI722W had problem, which speeded up the handover from
3G to 2G. We found that the judgment method of different system event of the 3 cells in
TRI722W was 3C Event Trigger, and the absolute threshold value of 3C event was -90
dBm, thus the 2G signal was very easy to achieve -90 dBm in the 3G coverage of the 3
cells in TRI722W, so the handover from 3G to 2G was easy to occur.
Solution
We modify the judgment method of different system event of the 3 cells in TRI722W to be
3A Event Trigger", in this way, the handover from 3G to 2G could happen only when the
63
3G signal RSCP tested by UE was below -95 dBm and the 2G signal RSCP was above
-90 dBm, this method was hard to achieve. we tested afer the modification, there was no
handover from 3G to 2G in the call process within the coverage of TRI722W3G.
For the whole network
We found that the handover from 3G to 2G was very easy for the configuration 3C Event
Trigger and the 2G neighbor cell was configured, thus many call traffic volume of 3G was
absorbed by 2G, then we checked the sites distribution of 3C and 3A handover trigger
parameters for the whole network, as shown in the table below.
Table 5-1 3C Handover Trigger Parameters for the Whole Network and Sites
Distribution of 3A Handover Trigger Parameters
RNC ID
Number of NodeBs
With 3A Event
Trigger for
Inter-RAT Handover
Number of NodeBs
With 3C Event
Trigger for Inter-RAT
Handover
Number of NodeBs
With 3C Event
Trigger for Inter-RAT
Handover (Configured
With 2G Neighbors)
RNC1
68
106
20
RNC10
40
50
36
RNC2
120
Sum
228
156
56
1.
If the judgment method of different system event was 3C Event Trigger, and the
absolute threshold value of 3C event was -90 dBm, thus the base station of 3C
different system trigger (2G neighbor cell was configured) could achieve -90 dBm
very easily, so the handover from 3G to 2G occurred very easily, from the statistic
form we could see that RNC1 had 20 base stations, and RNC10 had 36 base
stations, which belonged to this case, the 56 base stations totally were very easy to
handover from 3G to 2G, These sites mainly located around the airport highway and
TRIPOLI, but also there were some sites locating in the places where there were
high internal call traffic volume in TRIPOLI (for example, Fatah University, Libya's
largest university). Fortunately, it was better for the border sites; the handover to 2G
was easy, which could ensure the success rate of handover from 3G to 2G and
reduced the call drop rate due to the handover from 3G to 2G; However, for the
places where had relative densely 3G sites within TRIPOLI, the frequent handover
from 3G to 2G would result in the loss of many users and a decline in traffic. For this
case there were 2 methods to suggest:
The first method was to remove the 2G neighbor cells of the base stations which
has relative high call traffic volume in TRIPOLI, and ensure the users within the city
reside in the 3G network, but this method would lead to that 3G could not handover
to 2G in case of call drop for the indoor places where the signal was not good.
The second method was to change the judgment method of different system event
from 3C Event Trigger to 3A Event Trigger" for cells of base stations which had
64
relative high call traffic volume in TRIPOLI, which also could ensure that the users in
the city reside in the 3G network.
2.
The judgment method of different system event was 3A Event Trigger", which
made the handover from 3G to 2G occur only when the 3G signal RSCP tested by
UE was below -95 dBm and the 2G signal RSCP was above -90 dBm, this method
was hard to achieve.
3.
The current locations of 3A Event Trigger" sites and 3C Event Trigger sites in
RNC1 and RNC10 were disordered.
The locations are shown in the figure below.
Figure 5-1
Experience
For the 3C Event Trigger sites with 2G neighbor sites configured, we determined to test
th
2 sites in the dense area, on 28 Aug we tested the 3C Event Trigger sites with 2G
neighbor sites configured, RNC10s TRI101W and RNC1s TRI119W, in the test process
we found that the RSCP on the ground is around from -81 dBm to -86 dBm, which met
the requirement in the contract, it is around from -90 dBm to -100dBm in the car when UE
is in the different locations, thus 3C event is easy to be triggered by compression mode,
so it is easy to enter 2G, as the dense areas are the sensitive places for the customer
and there are many users, the 3G signal is the room is easy to be below -95 dBm, and
the users often enter 2G, which will cause the dissatisfaction of the 3G users, so change
the judgment method of different system event from 3C Event Trigger to 3A Event
Trigger", which ensures that the users reside in the 3G network.
65
5.3.2
Case 2
Phenomenon
3G neighbor cells were missed to configure for 2G, which resulted in the low call traffic
volume in the far 3G sites and no 3G signal.
Case analysis
To resolve the customer complaint, we added the site TRI358, the nearest 3G site from
the site was 16 km away, after the site operated normally, by observing KPI we found that
CS call traffic volume of each cell was lower, it was around 0.1 erl, and the customer
complained that there was no 3G signal, as shown in the figure below.
Figure 5-2
Problem location
Firstly we checked the cell parameters configuration in the 3G site, and there was no
error and alarm.
3G signal was normal by testing on site, and CS and PS services are normal.
For the test of inter-RAT handover, we found that 2G cannot handover to 3G, and it
We contacted with the engineer for 2G, and confirmed that the cell was missed to be
configured as neighbor cell in 2G.
The site was a single site, and there was only 2G site around within 16km, many local
users use 3G/2G terminals, the cell was missed to be configured as neighbor cell in 2G, it
caused that the cell phone in 2G cell cannot reselect to 3G cell, so the user complained
that there was no 3G signal, and there were few 3G users under the site.
66
Solution
The configuration of 2G neighbor cell was completed and the problem was solved.
Experience
For the scenario of single 3G site or few sites, DO configure the 2G neighbor cells
reasonably, at the same time the information of 3G sites should also be configured
reasonably in 2G.
5.3.3
Case 3
Phenomenon
A failure 2G/3G handover case in Unicom of Chongqing Wanzhou
Case analysis
In the 2G/3G handover test, the cell phone did not hangover regularly, the data
configuration was correct by checking, but we found that no increment synchronization
was performed after data configuration, which led to the failure handover due to no data
issued to RNC.
Problem location
After the increment synchronization, the handover remained to fail, we captured the
signaling of RNC, and we knew that the 2G/3G handover switch of core network was not
enabled.
Solution
5.3.4
Perform increment synchronization for the data configuration, and issue the
configuration to RNC.
Case 4
Phenomenon
The success rate of 3G/2G handover was low due to the wrong configuration of neighbor
cell.
Case analysis
The success rate of handover for RNC1 was around 89%, after troubleshooting we found
that each of the three sectors in TRI119W was configured a wrong 2G neighbor cell, so
the success rates of handover were low for the site and the sites around, it was around
67
18%, which resulted in that the success rate of handover was only 89% for the whole
network.
Problem location
1.
2.
We checked the configuration of the neighbor cell, and found that a wrong 2G
neighbor cell TRI191 was configured for the site TRI119W, as shown in the figure
below.
Figure 5-3
Solution
After the 2G neighbor cells of TRI119W were removed, the success rate of handover
increased to 93.5% for the whole network, as shown in the figure below.
Figure 5-4
68
Experience
For the success rate of 3G/2G handover, we not only need to pay attention to the
neighbor cell of 3G cell , but also need to check whether the configuration of 2G neighbor
cell is correct as the neighbor cell of 3G cell.
5.3.5
Case 5
Phenomenon
The information of 2G LAC was missed in CN, which lead to the inter-RAT handover
cannot be performed.
Case analysis
For one new 3G site in Indonesia, the service was normal by testing, but the terminal
could not handover from 3G to 2G, finally the 3G signal turned to be weak and the call
was dropped. The information of 2G neighbor cell could be tested from TEMS; for the
handover between 2G/3G systems, generally we analyze it from the points below:
Problem location
1.
We got the list of 2G neighbor cells from the customer and compared it with the
actual configuration, they were identical.
2.
The number of sites without inter-RAT handover were around 4 or 5, the other sites
were normal, handed over to the cells under the same BSC, so the parameters
problem could be excluded; from the sites location figure we could see that, the sites
could not handover normally were from the same area, the related 2G sites
belonged to one LAC area, and there was no wrong configuration for LAC.
3.
We traced the signaling of the cells which could not handover normally in the OMC
network management, and found that CN would fail to relocate directly each time
after RNC sent the request of relocation, as shown in the figure below.
69
Figure 5-5
Relocation Failure
Figure 5-6
From the signaling above we could find that after RNC sent the request of relocation, CN
refused directly, the reason was TRANAP_semantic_error, it is a kind of syntax error,
generally it is due to that the data does not match, so the problem was located at CN or
2G, finally the LAC codes of these related cells were not added in CN.
Solution
We created these LACs again in CN and the problem was solved, from OMC traffic
statistics, we could see the handover related specifications and the value of counter, the
figure below shows the chart of a typical site for inter-RAT handover.
70
Figure 5-7
Inter-RAT Handover
Experience
5.3.6
If the GSM parameter were modified in the 2G system, the GSM parameters in the
3G system must be modified synchronously.
The problem analysis follows the principle from the whole to the part, and gradually
narrows the range until the problem is solved.
Case 6
Phenomenon
WCDMA system could not use PS and CS at the same time due to the configuration of
encryption algorithm in PS domain.
Case analysis
When a user used CS voice service firstly, then he used PS service simultaneously in the
process of calling, at this time the two services could be used at the same time; but when
the user used PS service first, and used CS voice service simultaneously (no matter
calling or called), the voice service could not be used, and it was busy tone in the
telephone, there was the RNAP_SECURITY_MODE_REJECT message in the traced
signaling.
Problem location
After the user used PS service first and made voice call simultaneously, there was the
RNAP_SECURITY_MODE_REJECT message found in the traced signaling, as shown in
the figure below.
71
Figure 5-8
Figure 5-9
The value of failure reason showed that the latest issued integrity protection or encryption
information did not match the previous configuration; according to the analysis above, the
two services should be configured with different encryption algorithm; Then we checked
the encryption algorithm of each service separately: For PS: two encryption algorithms
were configured No Encryption and UEA1.
Figure 5-10
For CS: Only one encryption algorithm UEA1 was configured here.
Figure 5-11
72
The CN initiates the procedure by sending the SECURITY MODE COMMAND message.
The message may contain the Encryption Information IE and shall contain the Integrity
Protection Information IE, specifying, in preferred order with the most preferred first in the
list, which ciphering, if any, and integrity protection algorithms may be used by the
UTRAN.
RNC will give priority to the first encryption algorithm in the list issued by core network.
The user first used PS service, so RNC chose the first encryption algorithm (No
Encryption) directly in the list issued by CN. Then at the same time he used voice service,
but UEC encryption algorithm for CS is UEA1. But before that RNC has recorded that the
user's encryption algorithm was No Encryption, then it was UEA1 at this time, the two
were founded to be different, so the RNAP_SECURITY_MODE_REJECT message was
issued, which led to that the voice service cannot be established. But PS service always
could be used.
Solution
We adjusted the order of encryption algorithm for PS service, ranked UEA1 at first as
follows.
Figure 5-12
Encryption Algorithm
Encryption algorithm UEA1 ranked first or only UEA1 was configured. When only using
only one service, no matter what encryption algorithm was configured for PS or CS, the
rejection phenomenon security mode would not appear, but there would be such problem
when using the concurrent services.
Experience
Why was it possible to use CS service first and then use PS service in the process of
calling? The reason is as follows:
For the case of using CS voice service, RNC will choose the first encryption algorithm
directly in the list issued by CN, and there is only one encryption algorithm UEA1. Then
use PS service in the process of calling, at this time RNC will not choose the first
encryption algorithm directly in the list issued by CN as above, because PS is not the first
service, so it will not choose the first encryption algorithm in the list, but it checks what
encryption algorithm has been configured for PS service and compares, then it finds that
UEA1 has indeed been configured for PS service, So PS is available. As the rule of RNC
choosing the first encryption algorithm in the list issued by CN, it is only for the first
service.
73