eCSFB-Call Flow Scenarios-08.17.2012

eCSFB Call Scenarios
Author
Ahmad Sultan
Acknowledgements
The author would like to acknowledge Larry Gassman , ND&E for his insight, continuous guidance, support, as well
as above and beyond contributions throughout the development of the eCSFB feature.
The author would like to acknowledge Yugeswar Deeno for developing the initial call scenarios for SMS, TAU, and UE-
Triggered Service Request.
The technical information compiled in this document would have not been possible without the contributions of Sprint CDMA
Teams and solution Vendors (Alcatel-Lucent, Ericson, Qualcomm and Samsung).
Table of Contents
General Flows
1 EPS UE Attach x AFS
2 1x Registration x AFS
Voice Calls
3 Mobile Originated eCSFB with Handoff to MSC (UHDM) x AFS
4 Mobile Originated eCSFB with Handoff to MSC (ECAM) x AFS
5 Mobile Originated eCSFB with Handoff to MSC (Redirect) x AFS
6 MO E911 eCSFB with Handoff to MSC (UHDM) x AFS
7 MO WPS eCSFB with Handoff to MSC with No TCH Congestion (UHDM) x AFS
8 MO WPS eCSFB with Handoff to MSC with TCH Congested (ECAM) x AFS
9 Mobile Terminated eCSFB with CPI using UHDM, via Handoff Request x AFS
10 E911 Call Back (MT) eCSFB with CPI using UHDM, via Handoff Request x AFS
11 MT WPS eCSFB with CPI using UHDM, via Handoff Request x AFS
QChat & PAM
12 QChat, PAM & Hotspots with MT Voice Call x AFS
SMS
13 Mobile Originated SMS over S102 Tunnel x YD
14 Mobile Terminated SMS (VMN, MMS) over S102 Tunnel x YD
LBS
15 LBS Network Initiated Precise x AFS
16 LBS Network Initiated Coarse x AFS
17 LBS User Initiated Precise x AFS
Other Use Cases
18 CMAS x AFS
CALEA N/A n
Femto Cell
19 Femto Registration x AFS
20 Mobile Originated CSFB to Femto with Handoff to TCS (ECAM) x AFS
21 Mobile Terminated CSFB to Femto with Handoff to TCS using ISPAGE2 x AFS
22 Femto LBS Network Initiated Precise LBS using ISPAGE2 x AFS
RAN Sharing
TBD: MOCN MO eCSFB Voice Call n
TBD: MOCN MT eCSFB Voice Call n
TBD: MO eCSFB Call with IWS Colocated with BSC n
Mobility
23 S102 Tunnel Redirection for MME Change x YD
24 S102 Tunnel Redirection with Inter eNodeB and MME Change x YD
Common Procedures
25 UE-Triggered Service Request x YD
26 S1-Release x AFS
27 MME Initiated Dedicated Bearer Deactivation x AFS
Ver 1.0 Accompanies eCSFB Detailed Requirement Document 1/113

28 Reselection from 1x to LTE x AFS
29 UE-Initiated Power Down and Detach from UE Active Mode x AFS
30 UE-Initiated Power Down and Detach from UE Idle Mode
Failure Scenarios
31 MO or MT eCSFB Call Rejected by MME x AFS
32 Mobile Originated eCSFB with Call Setup Failure x AFS
LTE: Short Term Failure n
LTE: Long Term Failure n
1xRTT: Short Term Failure n
1xRTT: Long Term Failure n
Miscellaneous
33 Change Record x AFS
34 Signaling Tunnels x AFS
35 Protocol Stacks and GCSNA Capsule x AFS
36 Handover Signaling x AFS
37 Mobile Terminated eCSFB with CPI via HUDM and AWI Bundling x AFS
Revision History
Version Ver 1.0
Dates 8/13/2012
Eng. ASultan
Rev.
Note
Ver 1.0 Accompanies eCSFB Detailed Requirement Document 2/113

eCSFB Call Scenario - UE Attach Ver 1.0
EPS Notes
UE/MS eNB New MME Old MME SGW PGW (PCEF) PCRF HSS EIR SPR Charge 3GPP TS 23.401 Section 5.3.2
1 Attach Request ( ), Selected Network, Old GUMMEI 1 The UE initiates Attach procedure by sending eNodeB an Attach Request (IMSI or
old GUTI, last visited TAI (if available), UE Core Network Capability, UE Specific DRX
parameters, Attach Type, ESM message container (Request Type, PDN Type,
Protocol Configuration Options, Ciphered Options Transfer Flag), KSI ASME , NAS
sequence number, NAS-MAC, additional GUTI, P-TMSI signature, Voice domain
preference and UE's usage setting) message together with RRC parameters
indicating the Selected Network and the old GUMMEI .
* Note: Parameters included in Attach Request vary to handle different attach
conditions.
2 S1-Initial UE message (Attach Request ( ), 2 * The eNodeB derives the MME either from old GUMMEI and the indicated
Selected Network, CSG access mode, CSG ID, Selected Network in RRC parameters, or using MME Selection Funtion (4.3.8.3 ) to
TAI+ECGI) achieve load balancing (4.3.7.2).
* The eNodeB forwards Attach Request message to new MME in a S1-MME
control message (Initial UE message) together with the Selected Network, CSG
access mode, CSG ID, and TAI+ECGI of the cell from where it received the message.
Obtaning UE Identity
3 Identification Request 3 * If sent to new MME, it uses the GUTI to derive the old MME/SGSN address, and
send an Identification Request to request the IMSI
* If sent to old MME, it verifies the request and responds with Identification
Response (IMSI, MM Context) . See 5.7.2 for Mobility Management (MM) Context
* If the UE is unknown to old MME/SGSN, error code is returned.
3 Identification Response (IMSI, MM Context) 3
4 Identity Request 4 If the UE is unknown in old MME/SGSN and new MME, new MME sends an
Identity Request to UE to request the IMSI.
4 Identity Response (IMSI) 4 The UE responds with Identity Response (IMSI) .
Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 3/113

EPS Notes
5 Authentication 5
a Authentication/Security a * If NO UE context exits anyware in the networK, and Attach Request not integrity
protected, or integrity check failed, NAS security setup (see 5.3.10 Security
Function) is invoked to activate integrity protection and NAS ciphering occurs for all
NAS messages.
* This step is skipped if MME supports Emergency Attach for unauth IMSI
b Identiy Request/Response b * The ME identity, retreived from UE, is transferred encrypted unless the UE
performs Emergency Attach and cannot be authenticated.
* Skipped, if UE included IMEI in Emergency Attach
* This step may be combined with 5a to minimize signalling delays.
c ME Identiy Check Request (ME Identity, IMSI) c * The MME may send the ME Identity Check Request (ME Identity, IMSI) to the EIR
ME Identiy Check Ack (Result) which responds with ME Identity Check Ack (Result) .
* For Emergency Attach, the IMEI check to the EIR may be performed
6 Ciphering 6
a Security command Request a If Ciphered Options Transfer Flag has been included in Attach Request, it is
retrieved from UE
b Security command Response b
7 Delete Session Request (LBI) 7 If there is active bearer contexts in the new MME for this particular UE (i.e. the UE
re-attaches to the same MME without having properly detached before), the new
MME deletes these bearer contexts by sending Delete Session Request (LBI)
messages to the GWs involved.
7 PCRF initiated IP-CAN Session Termination 7 If the PCRF is deployed, IP-CAN Session Termination procedure is employed to
indicate that resources have been released
7 Delete Session Response (cause) 7 The GWs acknowledge with Delete Session Response (Cause) message

EPS Notes
8 Update Location Request (MME Identity, IMSI, ME 8 * If the MME has changed since the last detach, or if there is no valid subscription
Identity, MME Capabilities, ULR-Flags, context for the UE in the MME, or if the ME identity has changed, or if the UE
Homogeneous Support of IMS Over PS Sessions) provides an IMSI or the UE provides an old GUTI which doesn't refer to a valid
context in the MME, or for some network sharing scenario (e.g. GWCN) if the PLMN-
ID of the TAI supplied by the eNodeB is different from that of the GUTI in the UE's
context, the MME sends an Update Location Request (MME Identity, IMSI, ME
Identity, MME Capabilities, ULR-Flags, Homogeneous Support of IMS Over PS
Sessions) message to HSS.
* Emergency Attach in which the UE was not successfully authenticated, the MME
shall not send an Update Location Request to the HSS
9 Cancel Location (IMSI, Cancellation Type) 9 The HSS sends Cancel Location (IMSI, Cancellation Type) to the old MME.
9 Cancel Location Ack (IMSI) 9 The old MME acknowledges with Cancel Location Ack (IMSI) and removes the MM
and bearer contexts.
10 Delete Session Request (LBI) 10 If there are active bearer contexts in the old MME/SGSN for this particular UE, the
old MME/SGSN deletes these bearer contexts by sending Delete Session Request
(LBI)
10 PCRF initiated IP-CAN Session Termination 10 If PCRF is deployed, IP-CAN Session Termination procedure is employed to indicate
that resources have been released
10 Delete Session Response (cause) 10 The GWs return Delete Session Response (Cause) message to the old MME/SGSN
11 Update Location Ack (IMSI, Subscription data) 11 * The HSS acknowledges the Update Location message by sending an Update
Location Ack (IMSI, Subscription data) message to the new MME.
*For an Emergency Attach, the MME shall ignore any unsuccessful Update Location
Response from HSS and continue with the Attach procedure. MME shall not check
for access/regional/subscription restrictions

EPS Notes
12 Creat Session Request 12 * The new MME selects a Serving GWusing S erving GW Selection Function (4.38.2)
and allocates an EPS Bearer Identity for the Default Bearer associated with the UE.
* It sends Create Session Request (IMSI, MSISDN, MME TEID for control plane, PDN
GW address, PDN Address, APN, RAT type, Default EPS Bearer QoS, PDN Type, APN-
AMBR, EPS Bearer Identity, Protocol Configuration Options, Handover Indication,
ME Identity, User Location Information (ECGI), UE Time Zone, User CSG Information
(CSG ID, access mode and CSG membership indication), MS Info Change Reporting
support indication, Selection Mode, Charging Characteristics, Trace Reference, Trace
Type, Trigger Id, OMC Identity, Maximum APN Restriction, Dual Address Bearer Flag,
the Protocol Type over S5/S8, Serving Network) message.
13 Create Session Request 13 * The Serving GW creates a new entry in its EPS Bearer table and sends a Create
Session Request message to the PDN GW indicated by the PDN GW address
received in the previous step.
* After this step, the Serving GW buffers any downlink packets it may receive from
the PDN GW without sending a Downlink Data Notification message to the MME
until it receives the Modify Bearer Request message below
14 PCEF Inititated IP-CAN Session Establishment 14 If dynamic PCC is deployed and the Handover Indication is not present, the PDN
GW performs an IP-CAN Session Establishment procedure, and thereby obtains the
default PCC rules for the UE.
* A number of dedicated bearers in association with the establishment of the
default bearer are set up.
* IMSI (or IMEI for unauthenticated UE), APN, UE IP address, User Location
Information (ECGI), UE Time Zone, Serving Network, RAT type, APN-AMBR, Default
EPS Bearer QoS are provided to the PCRF by the PDN GW if received by the
previous message.
a Indication of IP-CAN Session Establishment a The PCEF includes the following information: UE Identity (e.g. MN NAI), a PDN
identifier (e.g. APN), the IP CAN type and the IPv4 address and IPv6 network prefix, if
available, the PDN Connection Identifier received for IP CAN Bearer establishment
and, if available, the default charging method and the IP CAN bearer establishment
modes supported .
b Profile Request (Sub ID, PDN ID) b If the PCRF does not have the subscriber's subscription related information, it sends
a request to the SPR in order to receive the information related to the IP CAN
session. The PCRF provides the subscriber ID and, if applicable, the PDN identifier to
the SPR.

EPS Notes
c Profile Response (allowed c The PCRF stores the subscription related information containing the information
service(s), PCC Rules) about the allowed service(s) and PCC Rules information, and may include MPS EPS
Priority, MPS Priority Level and IMS Signalling Priority for establishing a PS session
NOTE : GTP with priority.
based S5/S8 * Note: Sprint implementation, does NOT provide preferential treatement is
provided over LTE, for WPS subscribers.
d d The PCRF makes the authorization and policy decision. If MPS EPS Priority, MPS
Policy Decision
Priority Level, and IMS Signalling Priority are present for the user, the PCRF takes
the information into account.
* Note: Sprint implementation, does NOT provide preferential treatement is
provided over LTE, for WPS subscribers.
e Acknolwege IP-CAN Session e The PCRF sends the decision(s) , including the chosen IP CAN bearer establishment
Establishment (IP CAN bearer mode , to the PCEF. The GW(PCEF) enforces the decision. The PCRF may provide the
establishment mode, default charging default charging method and may include the following information: the PCC Rules
method, PCC Rules, Event Triggers ) to activate and the Event Triggers to report.
NOTE : PCEF interaction with

Charging system not included
15 Create Session Response 15 The P GW creates a new entry in its EPS bearer context table and generates a
Charging Id . The new entry allows the P GW to route user plane PDUs between the
S GW and the packet data network, and to start charging.
* PDN GW returns Create Session Response (PDN GW Address for the user plane,
PDN GW TEID of the user plane, PDN GW TEID of the control plane, PDN Type, PDN
Address, EPS Bearer Identity, EPS Bearer QoS, Protocol Configuration Options,
Charging Id, Prohibit Payload Compression, APN Restriction, Cause, MS Info Change
Reporting Action (Start) (if the PDN GW decides to receive UE's location information
during the session), CSG Information Reporting Action (Start) (if the PDN GW decides
to receive UE's User CSG information during the session), APN-AMBR) message to
the Serving GW.
* PDN GW selects IP version, allocates a PDN Address
First Downlink Data (if not handover)
14f IP-CAN Session Establishment Acknolwege 14f If the PCRF in step 7 requested an acknowledgement based on PCC rule operations,
the GW(PCEF) sends the IP CAN Session Establishment Acknowledgement to the
PCRF in order to inform the PCRF of the activated PCC rules result.

EPS Notes
16 Create Session Response 16 The Serving GW returns a Create Session Response (PDN Type, PDN Address,
Serving GW address for User Plane, Serving GW TEID for User Plane, Serving GW
TEID for control plane, EPS Bearer Identity, EPS Bearer QoS, PDN GW addresses and
TEIDs (GTP-based S5/S8) or GRE keys (PMIP-based S5/S8) at the PDN GW(s) for
uplink traffic, Protocol Configuration Options, Prohibit Payload Compression, APN
Restriction, Cause, MS Info Change Reporting Action (Start), CSG Information
Reporting Action (Start), APN-AMBR) message to the new MME
17 S1-AP: Initial Context Setup Request 17 * The new MME sends an Attach Accept (APN, GUTI, PDN Type, PDN Address, TAI
(Attach Accept ( ), AS security context List, EPS Bearer Identity, Session Management Request, Protocol Configuration
information, Handover Restriction List, Options, NAS sequence number, NAS-MAC, IMS Voice over PS session supported
EPS Bearer QoS, UE-AMBR, EPS Bearer Indication, Emergency Service Support indicator, LCS Support Indication) message to
Identity, S GW TEID for user plane, IP the eNodeB
address S GW for user plane.) * This message is contained in an S1_MME control message Initial Context Setup
Request. This S1 control message also includes the AS security context information
for the UE, the Handover Restriction List, the EPS Bearer QoS , the UE-AMBR, EPS
Bearer Identity , as well as the TEID at the Serving GW used for user plane and the
address of the Serving GW for user plane .
* MME includes the EPS Bearer QoS parameter QCI and APN-AMBR into the Session
Management Request
18 RRC Connection Reconfiguration (EPS Radio Bearer ID, Attach Accept ( )) 18 * The eNodeB sends the RRC Connection Reconfiguration message including the
EPS Radio Bearer Identity to the UE, and the Attach Accept message will be sent
along to the UE.
* UE shall store QoS Negotiated, Radio Priority, Packet Flow Id and TI
19 RRC Connection Reconfiguration Complete 19 The UE sends the RRC Connection Reconfiguration Complete message to the
eNodeB
20 Initial Context Setup Response (eNodeB 20 The eNodeB sends the Initial Context Response message to the new MME. This
TEID, eNodeB downlink traffic IP address Initial Context eNodeB sends Initial Context Response message includes the TEID of
on the S1_U reference point) the eNodeB and the address of the eNodeB used for downlink traffic on the S1_U
reference point .
21 RRC-Direct Transfer (Attach Complete (EPS Bearer Identity, NAS sequence number, NAS-MAC)) 21 The UE sends a RRC-Direct Transfer message to the eNodeB, which includes the
Attach Complete (EPS Bearer Identity, NAS sequence number, NAS-MAC) message
22 S1-UL NAS Transport (Attach Complete (EPS Bearer Identity, 22 The eNodeB forwards the Attach Complete message to the new MME in an Uplink
NAS sequence number, NAS-MAC)) NAS Transport message

EPS Notes
23 First Uplink Data 23 After the Attach Accept message and once the UE has obtained a PDN Address , the
UE can then send uplink packets towards the eNodeB which will then be tunnelled
to the Serving GW and PDN GW.
24 Modify Bearer Request (EPS Bearer Identity, 24 Upon reception of both, the Initial Context Response and the Attach Complete
eNodeB address, eNodeB TEID, Handover messages, the new MME sends a Modify Bearer Request (EPS Bearer Identity,
Indication) eNodeB address, eNodeB TEID, Handover Indication) message to the Serving GW
a Modify Bearer Request (Handover Indication) a If the Handover Indication is included from previous step, , the Serving GW sends a
Modify Bearer Request (Handover Indication) message to the PDN GW to prompt
the PDN GW to tunnel packets from non 3GPP IP access to 3GPP access system and
immediately start routing packets to the Serving GW for the default and any
dedicated EPS bearers established
b Modify Bearer Response b The PDN GW acknowledges Serving GW
25 Modify Bearer Response (EPS Bearer Identity) 25 The Serving GW acknowledges by sending Update/Modify Bearer Response (EPS
Bearer Identity) message to the new MME. Then it can send its buffered downlink
packets.
26 First Downlink Data 26
27 Notify Request 27 The MME sends a Notify Request including the APN and PDN GW identity to the
HSS for mobility with non-3GPP accesses.
28 Notify Response 28 The HSS stores the APN and PDN GW identity pair and sends a Notify Response to
the MME

eCSFB Call Scenario - 1x Registration Ver 1.0
EPS CDMA Notes

UE/MS eNB MME IWS MSC 3GPP TS 23.272, 23.401, 3GPP2 A.S0008 Annex F, Qualcom 1xCSFB FDD
1 UE Attach to E-UTRAN. UE indicates support eCSFB. 1 The UE attaches to E-UTRAN, includes an indication of enhanced CS fallback to
1xRTT.
2 SIB-8 2 The LTE stack on the UE receives the SIB-8 from the eNodeB and passes it to the 1x
stack.
3 UE 3 Based on the contents of CSFB-RegistrationParam1xRTT IE , the 1x stack decides to

decision perform a registration.
to register
in 1xRTT
4 1x Stack 4 If the UE is in Idle State , trigger from the 1x stack initiates sending a Service Request
requests 1x (SR) message to the RRC layer.
Parameters
5 If UE is in Idle State, Service Request Proceedure 5
a RA Preamble a The RRC layer in turn starts the RACH procedure by sending the RA Preamble to
eNodeB.
b RA Preamble Response (TimingAdvance, UL Grant, b The eNodeB sends an RA Preamble Response that contains the TimingAdvance, UL
and Temp C-RNTI) Grant, and Temp C-RNTI.
c RRC Connection Request (Cause=MO Data, UE c The UE sends the RRC-Connection Request message. The establishment cause is set
Contention Resolution Identity MAC control to MO Data and contains the UE Contention Resolution Identity MAC control
element) element .
d RRC Connection Setup (UE Contention Resolution d The eNodeB responds with an RRC-Connection Setup message that contains a UE
Identity) Contention Resolution Identity.
e RRC Connection Setup Complete (Serive Request) e The UE sends an RRC-Connection Setup Complete message. This message contains
the Service-Request NAS message.
f S1-Initial UE message (Service Request) f The eNodeB extracts the Service-Request NAS message and sends it to the MME in
an S1-Initial UE message.
g S1-UE Initial Context Setup Request g The MME sends the S1-Initial Context Request message to the eNodeB., contains
the bearers that should be set up for the UE.
h RRCConnectionReconfiguration h The eNodeB sets up the Radio bearers based on the S1-Initial Context Request. It
sends RRC-Radio Reconfiguration message to the UE with configurations at the
bearer, MAC, and PHY layers.
i RRCConnectionReconfiguration Complete i The UE responds with an RRC-Radio Reconfiguration Complete message.

EPS CDMA Notes

j S1-UE Initial Context Setup Response j The eNodeB sends an S1-Initial Context Response message to indicate which of the
E-RABs have been established.
6 CSFBParameterRequestCDMA2000 6 The UE sends a CSFBParametersrequestCDMA2000 to retrieve the 1x parameters

needed by the 1x stack to construct the 1xRGM. This message is sent in response to
the 1x parameters request from the 1x stack to the LTE stack.
7 CSFBParameterResponse (RAND, mobilityParameterC2K) 7 The eNodeB responds with the CSFBParametersResponseCDMA2000 that contains
the 1x parameters, including the AUTH and RAND values.
1xRTT Registration Request

8 1x Stack 8 * The 1x stack constructs the 1x Registration Message (1xRGM). It encapsulates it in
sends a GCSNA 1x Circuit Service message and sends it to the LTE stack for transmission.
1xRGM to
LTE stack in
GCSNA
1xCircuit
Srvi cee
9 RRC-UL Information Transfer (GCSNA Circuit Service (1xRGM)) 9 The LTE stack encapsulates the GCSNA message in a UL-Info Transfer message and
sends it to the eNodeB.
10 S1-UL S1 CDMA2000 Tunelling (GCSNA Circuit Service (1xRGM), CDMA2000 Reference Cell ID) 10 The eNodeB passes the GCSNA (1xRGM) in S1 CDMA2000 Tunelling message
without interpreting to the MME. It also specifies the CDMA2000 Reference Cell ID.
11 S102 Direct Transfer: A21-1x Air Interface Signaling message (GCSNA (1xRGM)) 11 Based on the CDMA2000 Reference Cell ID , the MME selects the IWS. It
encapsulates the GCSNA message in an A21-1x Air Interface Signaling message and
sends it to the IWS. IMSI is used to distinguish S102 signalling transactions
belonging to different UEs.
12 Complete Layer 3 12 The IWS extracts the 1x RGM and forms the A1-Location Updating Request
Information (Location message, places it in the Complete Layer 3 Information message, and sends to the
Updating Request) MSC. 1xRTT CS registration is then performed by the 1xCS IWS node based on 3GPP2
A.S0008
13 Location Updating Accept 13 MSC sends a Location Updating Accept message to the IWS to indicate that the
Location Updating Request message has been processed.

EPS CDMA Notes

14 S102 Direct Transfer (IMSI, A21-1x Air Interface Signaling 14 * IWS sends a GCSNA encapsulated Registration Accepted Order to the MS/UE over
message (GCSNA (Registration Accepted Order ), the 3GPP Evolved Packet System (EPS) to acknowledge the registration
GCSNAL2Ack) * Since the UE has set the Ack_reqd bit to 1 in GCSNA, the IWS responds with an
A21 message containing the GCSNAL2Ack. 1xRTT CS registration response is
tunnelled back to the MME in a S102 Direct Transfer message (IMSI, 1xCS)
* The GCSNAL2Ack is used instead of BSC-Ack to conclude that the registration was
successful.
15 S1-UL S1 CDMA2000 Tunelling (GCSNA (Registration Accepted Order ), GCSNAL2aAck)) 15 The MME delivers the GCSNA message to the eNodeB in S1: DL S1 CDMA2000
Tunneling message.
RRC-DL Information Transfer (GCSNA (Registration Accepted Order ), GCSNAL2Ack)
16 16 * The eNodeB uses a RRC-DL-Info Transfer message to tunnel the content received
LTE Stack from MME without any interpretation.
extracts
GCSNAL2Ack,
and * The LTE stack extracts the GCSNAL2Ack and sends it to the 1x stack
registration
response and * The 1x stack updates its registration status.
sends to 1x
stack,w hich
updates its
registration
status.

eCSFB Call Scenario - MO Call w HO to MSC (UHDM) Ver 1.0
EPS CDMA Notes

UE/MS eNB MME SGW PGW BSC IWS MSC 3GPP TS 23.272, 23.401, 3GPP2 A.S0008 Annex F, Qualcom 1xCSFB FDD
1 UE Attach to E-UTRAN, Register with 1xRTT CS through S102. UE indicates support eCSFB. 1 The UE attaches to E-UTRAN, completed the registration with the 1x network, and
indicated capability of enhanced CS fallback to 1xRTT, but that it does not support
concurrent CS+PS HO.
2 User 2 User decides to make MO CS call. If the PSIST check is passed, a MO call inidcation
originates trigger is sent to the LTE stack, which decides to perfrom MO call in 1xRTT.
a voice
call. LTE
stack
receives
MO call
indication
. Decision
to
perform
MO Call in
1xRTT.
3 If UE is in Idle State, Service Request Procedure 3 This trigger causes the LTE NAS layer to initiate an Extended Service Request (1xCSFB
MO call) being sent to the RRC layer.
eNodeB.
c RRC Connection Request (Cause=MO Data, UE c The UE sends the RRC Connection Request message. The establishment cause is set
Contention Resolution Identity MAC control to MO Data and contains the UE Contention Resolution Identity MAC control element .
element)
d RRC Connection Setup (UE Contention Resolution d The eNodeB responds with an RRC Connection Setup message that contains a UE
4 RRC Connection Setup Complete (Extended Serive Request (MO CSFB)) 4 The UE sends an RRC Connection Setup Complete message. This message contains
the Extended Service-Request NAS message.
5 S1-Initial UE message (Extended Serive Request (MO CSFB) 5 The eNodeB extracts the Extenbded Service Request NAS message and sends it to the
MME in an S1-Initial UE message.
6 S1-UE Initial Context Setup Request/UE Context Modification Request (CSFB indicator) 6 * For a UE in Idle mode, the MME sends the S1-UE Initial Context Request message to
the eNodeB., contains the bearers that should be set up for the UE, as well as the CS
Fallback Indicator IE that informs the eNodeB that the CS Fallback procedure is to be
performed.
* For a UE in active mode, the MME sends S1-UE Context Modification Request (CS
Fallback Indicator) to E-UTRAN. CS Fallback Indicator indicates to the E UTRAN to
move the UE to 1xRTT.
7 RRCConnectionReconfiguration (MeasurementConfiguration IE) 7 * The eNodeB sets up the Radio bearers based on the S1-Initial Context Request/UE
Context Modification Request. It sends RRC Radio Reconfiguration message to the
UE with configurations at the bearer, MAC, and PHY layers.
* The message also configures 1x measurement objects to solicit a 1xRTT
measurement report from the UE to determine the target 1xRTT cell to which the CS
Fallback will be performed.
** The eNodeB can request measurement of one 1x band/carrier in the measurement

object or multiple 1x bands per measurement object.

EPS CDMA Notes

8 RRCConnectionReconfiguration Complete 8 The UE responds with an RRC Radio Reconfiguration Complete message.
9 S1-UE Initial Context Setup Response/UE Context Modification Response 9 * If the UE is in idle mode, the eNodeB sends an S1-UE Initial Context Response
message to indicate which of the E-RABs have been established.
* If the UE is in active mode, the eNodeB sends an S1-UE Context Modification
Response message to indicate which of the E-RABs have been established.
10 MeasurementReport 10 * Once the UE has completed measuring the 1x channels and pilots configured by the
eNodeB, it sends a Measurement Report.
* Depending on eNodeB configuration, if the measurement report indicates that the
1x channel is not satisfactory, the measurement configuration and reporting steps
might be repeated.
11 HandoverFromE-UTRAPreparation Request 11 The eNodeB sends a HO from EUTRA Preparation Request Command to the UE. This
(3G1x Overhead Parameters, RAND, con. HRPD HO (OFF)) message contains the 1xParameters including the RAND value.
a 1x stack a Upon receiving the 1x parameters , the 1x stack prepares the ORM and encapsulates it
receives 1x
Parameters. in a GCSNA 1x Circuit Service message.
It sends ** If the original MO call trigger did not pass through the 1x stack (PSIST check was
GCSNA(ORM, not run at step 2), the 1x stack will run a PSIST check before sending the GCSNA
Ack_reqd=0)
to LTE stack (ORM) to the LTE stack.
12 RRC-UL HandoverPreparation Transfer (MEID, GCSNA(ORM)) 12 The UE sends to the eNodeB a RRC-UL Handover Preparation Transfer message
containing GCSNA (ORM) , along with the MEID . The 1xRTT Origination message
contains called party number
13 S1-UL S1 CDMA2000 Tunneling (GCSNA(ORM), cdma2000 SectorID, RAND, CDMA2000 HO Required Indication, CDMA2000 1xRTT SRVCC Info (Pilot List, Band Classes, 13 The eNodeB acts as a passthrough and forwards the GCSNA message to the MME in
MEID, CDMA 1xRTT Mobile Subscription Information)) an S1-UL CDMA2000 Tunnelling message, along with cdma2000 SectorID, RAND , and
the following optional IEs:
* CDMA2000 HO Required Indication IE : for the MME to recognize that preparation
for handover has started and that it has to send some HO-related information to the
IWS in the A21-1x Air Interface Signaling message.
* CDMA2000 1xRTT SRVCC Info IE : which includes Pilot List that is formed using the
1x measurements, Band Classes supported by the UE, MEID, and CDMA2000 1xRTT
Mobile Subscription Information which was sent by the MME to the eNodeB as part of
the S1-UE Initial Context Setup /S1-UE Context Modification.
14 S102 Direct Transfer: A21-1x Air Interface Signanling (GCSNA(ORM), RAN, Pilot List, CDMA2000 1xRTT Mobile Subscription Information) 14 Using the cdma2000 Sector ID , the MME chooses the IWS. It encapsulates the GCSNA
(ORM) message in an A21 message and populates the Pilot list IE, RAND, and
CDMA2000 1xRTT Mobile Subscription Information in the A21 message.
The 1xIWS, 1x target BSC, and MSC interact to determine a Traffic Channel
15 CM Service Request Assignment
15 The IWS creates a CM Service Request message, sends it to the MSC, and starts timer
T303
T303
The 1xRTT MSC initiates the call with the called party number carried in the 1xRTT
Origination message.
16 Assignment Request 16 The MSC sends an Assignment Request message to the IWS and starts timer T10. The
T10 IWS stops timer T303.

EPS CDMA Notes

UE/MS eNB MME SGW PGW BSC IWS MSC T10 3GPP TS 23.272, 23.401, 3GPP2 A.S0008 Annex F, Qualcom 1xCSFB FDD
17 Assignment Complete 17 The IWS sends an Assignment Complete message to the MSC. The MSC stops timer
T10.
18 Handoff Required 18 The IWS initiates inter-BSC hard handoff for the MS/UE by sending a Handoff
Required message to the MSC. The IWS starts timer T7
19 Handoff Request 19 The MSC sends a Handoff Request message to the target BSC, and starts timer T11
T7
T11
20 Handoff Request Ack 20 The target BSC allocates appropriate radio resources as specified in the Handoff
Request message.
T9 * The target BSC sends a Handoff Request Acknowledgment message to the MSC and
starts timer T9 to wait for arrival of the MS/UE on its radio channel. MSC stops timer
T11
T7
21 Handoff Command 21 The MSC sends a Handoff Command message to the IWS. The IWS stops timer T7
22 S102 Direct Transfer: A21-1x Air Interface Signanling (GCSNA(UHDM),GCSNA Status=HO Success) 1xRTT parameters) 22 The 1xIWS forms a UHDM based on the traffic channel assignment. The UHDM is
encapsulated in a GCSNA message that is sent using an A21-1x Air Interface Signaling
message to the MS/UE to instruct it to handoff to the cdma2000 1x system. The A21
message contains a GCSNA Status field which indicates that the HO successful. This
status code differentiates it from A21 messages carrying other 1x messages.
T9
23 Handoff Commenced 23 The IWS sends a Handoff Commenced message to the MSC to notify it that the MS/UE
has been ordered to move to the target BSC channel. The IWS starts timer T306 to
await a Clear Command message from the MSC.
24 S1-DL S1 CDMA2000 Tunneling (GCSNA(UHDM), CDMA2000 HO Status IE (Success)) 24 The MME extracts the GCSNA message and sends it with e-CSFB Indicator in a S1-DL
CDMA2000 Tunneling message to the eNodeB. It maps the status code into the
CDMA2000 HO Status IE in this message.
25 MobilityFromEUTRA (1xeCSFB ind, GCSNA:UHDM, NO HRPD Redirection Info) 25 The eNodeB sends the GCSNA (UHDM) to the UE using the MobilityfromEUTRA
message when the CDMA2000 HO Status IE indicates success
26 1x Stack 26 The LTE stack extracts the GCSNA message and sends it to the 1x stack. The 1x stack
receives extracts the UHDM and tunes to the 1x channel and pilots specified in the UHDM to
GCSNA(UH Depends on RRC start the voice call.
DM) connection re-
establishment and
time to acquire 1x
TCH
27 S1 UE Context Release Request (Cause: CSFB to 1xRTT) T306
27 Upon receiving the S1: UE Context Release Request (Cause=CSFB to 1xRTT) from the
eNodeB, the S1-U bearers are released and the MME starts the preservation and
28 Suspend Notification 28 suspension of non-GBR bearers and the deactivation of GBR bearers towards S-GW
and P-GW(s). The MME sets the UE context to suspended status.
29 Suspend Acknowledge T9 29
30 S1 UE Context Release Procedure 30

T306
(cause "Redirection toward 1xRTT" to
allow bearer suspension by EPC)
31 1x Radio interface proceedure to acquire 1x traffic channel 31 The MS/UE transitions to the cdma2000 1x radio network and performs traffic channel
acquisition with the cdma2000 1xBSC.

EPS CDMA Notes

32 Handoff Completion message 32 The MS/UE sends a 1x Handoff Completion message to the cdma2000 1xBSC. The
cdma2000 1xBSC stops timer T9
33 Handoff Complete T306 33 The cdma2000 1xBSC sends a Handoff Complete message to the MSC.
34 Clear Command 34 The MSC sends a Clear Command message to the IWS and starts timer T315. The IWS
T315 stops timer T306.
35 Clear Complete 35 The IWS sends a Clear Complete message to the MSC to notify it that clearing has
been accomplished. The MSC stops timer T315.
36 After 1x call ends, UE goes to inactive state. MMSS is triggered to select the best system. 36 After the voice call ends, the UE transitions to inactive (not idle) . Thus, the
registration variables in the UE are not updated as a result of the call. The UE triggers
an MMSS procedure to reselect back to LTE, if available, by first scanning MRU[0].
** If the UE had transitioned to 1x idle (instead of inactive) , it would have updated its
registration status based on the SPM on 1x. This might lead to unnecessary
registrations after each call. Hence, the approach is for the UE to move to inactive and
attempt to move back to LTE. If the UE is in the coverage area of the same LTE
network and the LTE cell advertises the same 1x zone as before, the UE will most
likely not have to perform a 1x registration (the only corner case that could result in
the UE having to perform a registration is if the registration timer expired while the
UE was on the call).

eCSFB Call Scenario - MO Call w HO to MSC (ECAM) Ver 1.0
EPS CDMA Notes

a voice call.
LTE stack
receives
MO call
indication.
Decision to
perform
MO Call in
1xRTT.
eNodeB.
element)
4 RRC Connection Setup Complete (Extended Serive Request (MO CSFB)) 4 The UE sends an RRC-Connection Setup Complete message. This message contains
5 Initial UE message (Extended Serive Request (MO CSFB) 5 The eNodeB extracts the Extenbded Service Request NAS message and sends it to the
performed.

EPS CDMA Notes


8 RRCConnectionReconfiguration Complete 8 The UE responds with an RRC-Radio Reconfiguration Complete message.
might be repeated.
1x Upon receiving the 1x parameters , the 1x stack prepares the ORM and encapsulates it
GCSNA(ORM
, ** If the original MO call trigger did not pass through the 1x stack (PSIST check was
Ack_reqd=0) not run at step 2), the 1x stack will run a PSIST check before sending the GCSNA
(ORM) to the LTE stack.
12 UL HandoverPreparation Transfer 12 The UE sends to the eNodeB a UL-Handover Preparation Transfer message
(MEID, GCSNA(ORM)) containing GCSNA (ORM) , along with the MEID . The 1xRTT Origination message
13 S1-UL S1 CDMA2000 Tunneling (GCSNA(ORM), cdma2000 SectorID, RAND, CDMA2000 HO Required Indication, CDMA2000 1xRTT SRVCC Info (Pilot List, 13 The eNodeB acts as a passthrough and forwards the GCSNA message to the MME in
Band Classes, MEID, CDMA 1xRTT Mobile Subscription Information)) an S1-UL CDMA2000 Tunnelling message, along with cdma2000 SectorID, RAND , and

EPS CDMA Notes

T303
T303
16 Assignment Request 16 * The 1xIWS, 1x target BSC, and MSC interact to determine that a traffic channel
T10 assignment (UHDM) cannot be provided potentially due to loading conditions of the
frequency for which the UE provided measurements for 1x pilots.
Network determined to move the UE to
a 1x channel and resend the ORM * The LTE network may be capable of obtaining measurements over a specific
directly over 1x frequency even though there are multiple frequencies available in the region.
* The network decides to move the UE to 1x frequency and allow the call to proceed
directly over 1x.
The IWS stops timer T303.
T10.
T7
T11
Request message.
T11
T7
22 S102 Direct Transfer: A21-1x Air Interface Signanling (ECAM(ASSIGN_MODE=1),GCSNA Status=HO Success) 1xRTT parameters) 22 The 1xIWS forms a ECAM (ASSIGN_MODE=1) based on the frequency to which to
transition the UE. The ECAM is encapsulated in a GCSNA message that is sent using an
A21-1x Air Interface message to the MS/UE to instruct it to handoff to the cdma2000
1x system. The A21 message contains a GCSNA Status field which indicates that the
HO successful. This status code differentiates it from A21 messages carrying other 1x
messages.
T9
24 S1-DL S1 CDMA2000 Tunneling (ECAM(ASSIGN_MODE=1), CDMA2000 HO Status IE (Success)) 24 The MME extracts the GCSNA message and sends it with CSFB Indicator in a S1-DL

EPS CDMA Notes

25 MobilityFromEUTRA (1xCSFB ind, ECAM(ASSIGN_MODE=1), NO HRPD Redirection Info) 25 The eNodeB sends the GCSNA (ECAM) to the UE using the MobilityfromEUTRA
receives extracts the ECAM and tunes to the 1x channel and pilots specified in the ECAM to
GCSNA(EC start the voice call.
AM)

29 Suspend Acknowledge Depends on RRC T9 29
connection re-
S1 UE Context Release Procedure establishment and
30 30
(cause "Redirection toward 1xRTT" to time to acquire 1x
allow bearer suspension by EPC) TCH
31 UE tunes to 1xRTT and resends ORM to 1x network over the Access Channel 31 The 1x stack tunes to the 1x channel and pilots specified in the ECAM, and proceeds
to send the ORM over the 1x access channel and with the voice call. The Registration
state is updated based on the SPM received over native 1x.
36 After 1x call ends, UE goes to inactive state. MMSS is triggered to select the best system. 36 After the voice call ends, the UE transitions to inactive (not idle). It attempts to
reselect back to LTE, if available.
** Since the UE sent the ORM over native 1x, it serves as an implicit registration over
the native 1x zone. As a result, the UE may have to perform a 1x registration over S102
even if it moves back to the same LTE cell as before. This depends on the registration
parameters advertised in the SPM over native 1x and over the SIB-8.

eCSFB Call Scenario - MO Call w HO to MSC (Redirect.) Ver 1.0
EPS CDMA Notes

UE/MS eNB MME SGW PGW BSC IWS MSC VLR/HLR SMSC Charge 3GPP TS 23.272, 23.401, 3GPP2 A.S0008 Annex F, Qualcom 1xCSFB FDD
a voice
call. LTE
stack
receives
MO call
indication.
Decision to
perform
MO Call in
1xRTT.
eNodeB.
element)
performed.


eCSFB Call Scenario - MO Call w HO to MSC (Redirect.) Ver 1.0
EPS CDMA Notes

might be repeated.
11 RRC Connection Release(Redirected Carrier Info = CDMA2000) 11 The eNodeB sends an RRC Connection Release (Redirected Carrier Info=1x frequency) .
The 1x frequency can be chosen based on the LTE measurements reported by the UE
(blind redirection) or using the 1x measurements (if 1x measurements are configured).
12 1x Stack 12 The LTE stack gives a redirection indication to the 1x stack along with the redirected
receives carrier information .
Redirection
Indication
13 S1 UE Context Release Request (Cause: CSFB to 1xRTT) 13 Upon receiving the S1: UE Context Release Request (Cause=CSFB to 1xRTT) from the
and P-GW(s). The MME sets the UE context to suspended status, and sends to the S-
GW a Suspend Request (IMSI) message that requests the suspension of EPS bearers
15 Suspend Acknowledge 15
for the UE..
16 S1 UE Context Release Procedure 16

17 UE tunes to 1xRTT, Updates overheads, performs hashing (if needed), followed by access procedure. 17 UE moves to the 1xRTT channel specified in Step 11 It acquires the 1x channel,
updates overheads, and performs channel hashing (if necessary). Following this, it
starts the access procedure.
18 ORM to 1x network over the Access Channel 18 The 1x stack in the UE sends ORM to native 1xBSC. It also updates its Registration
state based on the overhead messages received on 1x.
19 19 The IWS sends a Clear Complete message to the MSC to notify it that clearing has
1x call flow procedure. been accomplished. The MSC stops timer T315.
20 After 1x call ends, UE goes to inactive state. MMSS is triggered to select the best system. 20 After the call ends, the UE changes to idle on 1x. It attempts to reselect to LTE through
Best Selection Routine (BSR) (see [Q3]) or Cell-reselection (Idle HO).

eCSFB Call Scenario - MO E911 w HO to MSC (UHDM) Ver 1.0
EPS CDMA Notes

2 User 2 User decides to make E911 MO CS call. If the PSIST check is passed, a MO call
originates inidcation trigger is sent to the LTE stack, which decides to perfrom MO call in 1xRTT.
an E911
voice call.
LTE stack
receives
MO call
indication.
Decision to
perform
MO Call in
1xRTT.
eNodeB.
element)
4 RRC Connection Setup Complete (Extended Serive Request (MO CSFB, Emergency)) 4 The UE sends an RRC-Connection Setup Complete message. This message contains
the Extended Service-Request NAS message with emergency indicator.
5 Initial UE message (Extended Serive Request (MO CSFB, Emergency) 5 The eNodeB extracts the Extenbded Service Request NAS message and sends it to the
performed.

EPS CDMA Notes


might be repeated.
Upon receiving the 1x parameters , the 1x stack prepares the ORM and encapsulates it
1x
GCSNA(ORM, ** If the original MO call trigger did not pass through the 1x stack (PSIST check was
(MEID, GCSNA(ORM), GEC "1") containing GCSNA (ORM) , along with the MEID . The 1xRTT Origination message
contains called party number. GCSNA contains GLOBAL_EMERGENCY_CALL set to 1
13 S1-UL S1 CDMA2000 Tunneling (GCSNA(ORM), cdma2000 SectorID, RAND, CDMA2000 HO Required Indication, CDMA2000 1xRTT SRVCC Info (Pilot List, Band 13 The eNodeB acts as a passthrough and forwards the GCSNA message to the MME in
Classes, MEID, CDMA 1xRTT Mobile Subscription Information), GEC "1") an S1-UL CDMA2000 Tunnelling message, along with cdma2000 SectorID, RAND , and
* GCSNA contains GLOBAL_EMERGENCY_CALL set to 1

EPS CDMA Notes

14 S102 Direct Transfer: A21-1x Air Interface Signanling (GCSNA(ORM), RAN, Pilot List, CDMA2000 1xRTT Mobile Subscription Information, GEC "1") 14 Using the cdma2000 Sector ID , the MME chooses the IWS. It encapsulates the GCSNA
* GCSNA contains GLOBAL_EMERGENCY_CALL set to 1
T303
T303
T10.
T7
T11
Request message.
T11
T7
22 S102 Direct Transfer: A21-1x Air Interface Signanling (GCSNA(UHDM),GCSNA Status=HO Success) 1xRTT parameters) 22 The 1xIWS forms a UHDM based on the traffic channel assignment. The UHDM is
T9
GCSNA(UH start the voice call.
DM)

EPS CDMA Notes


connection re-
30 S1 UE Context Release Procedure establishment and 30

eCSFB Call Scenario - MO WPS w HO to MSC TCH NC Ver 1.0
EPS CDMA Notes

2 User 2 User decides to make WPS MO CS call. If the PSIST check is passed, a MO call
originates a inidcation trigger is sent to the LTE stack, which decides to perfrom MO call in 1xRTT.
WPS voice
call by
dialing
*272. LTE
stack
receives
MO call
indication.
Decision to
perform
MO Call in
1xRTT.
eNodeB.
element)
performed.

EPS CDMA Notes


might be repeated.
11 HandoverFromE-UTRAPreparation Request (3G1x Overhead Parameters, RAND, con. HRPD HO (OFF)) 11 The eNodeB sends a HO from EUTRA Preparation Request Command to the UE. This
message contains the 1xParameters including the RAND value.
Upon receiving the 1x parameters , the 1x stack prepares the ORM and encapsulates it
1x
GCSNA(ORM, ** If the original MO call trigger did not pass through the 1x stack (PSIST check was
12 UL HandoverPreparation Transfer 12 The UE sends to the eNodeB a RRC-UL Handover Preparation Transfer message
containing GCSNA (ORM) , along with the MEID . The 1xRTT Origination message
(MEID, GCSNA(ORM))
13 S1-UL S1 CDMA2000 Tunneling (GCSNA(ORM), cdma2000 SectorID, RAND, CDMA2000 HO Required Indication, CDMA2000 1xRTT SRVCC Info (Pilot List, Band 13 The eNodeB acts as a passthrough and forwards the GCSNA message to the MME in
Classes, MEID, CDMA 1xRTT Mobile Subscription Information)) an S1-UL CDMA2000 Tunnelling message, along with cdma2000 SectorID, RAND , and

EPS CDMA Notes

T303
T303
T10.
T7
T11
Request message.
T11
T7
22 S102 Direct Transfer: A21-1x Air Interface Signanling 22 The 1xIWS forms a UHDM based on the traffic channel assignment. The UHDM is
(GCSNA(UHDM),GCSNA Status=HO Success) 1xRTT parameters)
T9

EPS CDMA Notes

GCSNA(UH start the voice call.
DM)

connection re-
30 S1 UE Context Release Procedure establishment and 30

eCSFB Call Scenario - MO WPS w HO to MSC TCH CNG Ver 1.0
EPS CDMA Notes

2 User 2 User decides to make WPS MO CS call. If the PSIST check is passed, a MO call
originates a inidcation trigger is sent to the LTE stack, which decides to perfrom MO call in 1xRTT.
WPS voice call
by dialing
*272. . LTE
stack
receives MO
call
indication.
Decision to
perform MO
Call in 1xRTT.
eNodeB.
element)
performed.


EPS CDMA Notes

might be repeated.
1x Upon receiving the 1x parameters , the 1x stack prepares the ORM and encapsulates it
GCSNA(ORM ** If the original MO call trigger did not pass through the 1x stack (PSIST check was
,
(MEID, GCSNA(ORM)) containing GCSNA (ORM) , along with the MEID . The 1xRTT Origination message
13 S1-UL S1 CDMA2000 Tunneling (GCSNA(ORM), cdma2000 SectorID, RAND, CDMA2000 HO Required Indication, CDMA2000 1xRTT SRVCC Info (Pilot List, Band Classes, 13 The eNodeB acts as a passthrough and forwards the GCSNA message to the MME in
MEID, CDMA 1xRTT Mobile Subscription Information)) an S1-UL CDMA2000 Tunnelling message, along with cdma2000 SectorID, RAND , and
T303
T303

EPS CDMA Notes

16 Assignment Request 16 * The 1xIWS, 1x target BSC, and MSC interact to determine that a traffic channel
T10 assignment (UHDM) cannot be provided potentially due to loading conditions of the
frequency for which the UE provided measurements for 1x pilots.
* The LTE network may be capable of obtaining measurements over a specific
frequency even though there are multiple frequencies available in the region.
Network determined to move the UE to * The network decides to move the UE to 1x frequency and allow the call to proceed
a 1x channel and resend the ORM directly over 1x.
directly over 1x
The IWS stops timer T303.
T10.
T7
T11
Request message.
T11
T7
22 S102 Direct Transfer: A21-1x Air Interface Signanling (ECAM(ASSIGN_MODE=1),GCSNA Status=HO Success) 1xRTT parameters) 22 The 1xIWS forms a ECAM (ASSIGN_MODE=1) based on the frequency to which to
transition the UE. The ECAM is encapsulated in a GCSNA message that is sent using an
A21-1x Air Interface message to the MS/UE to instruct it to handoff to the cdma2000
1x system. The A21 message contains a GCSNA Status field which indicates that the
HO successful. This status code differentiates it from A21 messages carrying other 1x
messages.
T9
24 S1-DL S1 CDMA2000 Tunneling (ECAM(ASSIGN_MODE=1), CDMA2000 HO Status IE (Success)) 24 The MME extracts the GCSNA message and sends it with CSFB Indicator in a S1-DL
T306 CDMA2000 Tunneling message to the eNodeB. It maps the status code into the
25 MobilityFromEUTRA (1xCSFB ind, ECAM(ASSIGN_MODE=1), NO HRPD Redirection Info) 25 The eNodeB sends the GCSNA (UHDM) to the UE using the MobilityfromEUTRA
receives extracts the ECAM and tunes to the 1x channel and pilots specified in the ECAM to
GCSNA(EC start the voice call.
AM)
27 S1 UE Context Release Request (Cause: CSFB to 1xRTT) 27 Upon receiving the S1: UE Context Release Request (Cause=CSFB to 1xRTT) from the
suspension of non-GBR bearers and the deactivation of GBR bearers towards S-GW
EPS CDMA Notes

UE/MS eNB MME SGW PGW BSC IWS MSC VLR/HLR SMSC Charge 3GPP TSthe
Upon receiving 23.272, 23.401,
S1: UE 3GPP2
Context A.S0008
Release Annex
Request F, Qualcomto1xCSFB
(Cause=CSFB 1xRTT)FDD
from the
28 Suspend Notification T306 28 suspension of non-GBR bearers and the deactivation of GBR bearers towards S-GW
29 Suspend Acknowledge T9 29
Depends on RRC
S1 UE Context Release Procedure connection re-
30 30
(cause "Redirection toward 1xRTT" to establishment and
allow bearer suspension by EPC) time to acquire 1x
TCH
31 UE tunes to 1xRTT and resends ORM (*272+ number) to 1x network over the Access Channel 31 The 1x stack tunes to the 1x channel and pilots specified in the ECAM, and proceeds
to send the ORM (with same dialed digits (*272+Digits)) over the 1x access channel.
The Registration state is updated based on the SPM received over native 1x.
32 BS-Ack The BSC responds with a BS-Ack

No resources
33 available. Call The BSC has no resources. But since the call is a WPS call, the BSC queues the call after
is queued confirms that the UE has WPS subscription
34 Feature Notificatin Message (release=0, Display =Queued, Pip tone) It responds with a Feature Notification message with release =0 and display state =
Queued. This allows UE to playback a pip tone and display that call has been queued
KAT
35 expires Resources are not available for more that KAT at the BSC,
a Status Request The BSC sends a Status Request message to prevent T42m timer from expiring at the
UE
36 Status Response The UE responds with a Status response and restarts the T42m timer
a BS-Ack The BSC responds with a BS-Ack

Resources
37 become Resources become available at the BSC
available.
a ECAM BSC sends ECAM to initiate native 1x call flow
42 After 1x call ends, UE goes to inactive state. MMSS is triggered to select the best system. 42 After the voice call ends, the UE transitions to inactive (not idle). It attempts to
reselect back to LTE, if available.
** Since the UE sent the ORM over native 1x, it serves as an implicit registration over
the native 1x zone. As a result, the UE may have to perform a 1x registration over
S102 even if it moves back to the same LTE cell as before. This depends on the
registration parameters advertised in the SPM over native 1x and over the SIB-8.

eCSFB Call Scenario - MT Call w CPI HO Req Ver 1.0
EPS CDMA Notes

UE/MS eNB MME SGW PGW PCRF HSS EIR Charge BSC IWS MSC VLR/HLR 3GPP TS 23.272, 23.401, 3GPP2 A.S0008 Annex F, Qualcom 1xCSFB FDD
Wirelss or land line phone user
places a call to a LTE subscriber
2 2 A wirelss or a landline phone user places a call to an LTE subscriber
3 A1 Paging Request 3 The 1xMSC sends a paging request to the 1xCS IWS node.
* Although the standard seems to allow delivery of Caller Line Identification along
with 1x page, this implementation will not support receiving this message and
alerting the user prior to traffic channel establishment. Feature Notification
Message (FNM) is not supported over GCSNA to provide Calling Party Information
(CPI) along with the General Paging Message (GPM).
T3113
1xRTT CS Paging
GCSNA GPM
4 S102 Direct Transfer: A21-1x Air Interface Signaling message (GCSNA (GPM)) 4 The 1xCS IWS node forwards the 1xRTT CS paging request via the S102 tunnel to the
MME in a S102 Direct Transfer message (as "1x Air Interface Signalling").
5 If UE is in Idle State, MME initiates Network Triggered Service Request 5 If the UE is in Idle state, the MME sends an LTE page to the UE and performs
network Triggered Service Request procedure to bring the UE to Active state before
tunneling the 1xRTT CS paging request toward the UE.
i Paging Request i If the UE is registered in the MME, the MME sends a Paging message (NAS ID for
paging, TAI(s), UE identity based DRX index, Paging DRX length, list of CSG IDs for
paging) to each eNodeB belonging to the tracking area(s) in which the UE is
registered.
ii Paging Request ii The eNodeB forwards the LTE page to the UE.
Random Access Proceedure The NAS sends an Service Request to RRC, which triggers a RACH procedure to go to
RRC_CONNECTED.
iii RA Preamble iii The RRC layer in turn starts the RACH procedure by sending the RA Preamble.
iv RA Preamble Response (TimingAdvance, UL Grant, iv The eNodeB sends an RA Preamble Response that contains the TimingAdvance, UL
and Temp C-RNTI) Grant, and Temp C-RNTI .
v RRC Connection Request (Cause=MO Data, UE v The UE sends the RRC-Connection Request message. The establishment cause is set
element) element .
vi RRC Connection Setup (UE Contention Resolution vi The eNodeB responds with an RRC-Connection Setup message that contains a UE
vii RRC Connection Setup Complete (Serive Request) vii The UE sends NAS message Service Request towards the MME encapsulated in an
RRC Connection Setup Complete message to the eNodeB.
viii Initial UE message (Service Request) viii Upon receiving the RRC-Connection Setup Complete message, the eNodeB extracts
the NAS message and sends it to the MME in an S1-Initial UE message.

EPS CDMA Notes

Authentication & Security Proceedure * If NO UE context exits anyware in the network, and Attach Request not integrity
protected, or integrity check failed, NAS security setup (see 5.3.10 Security Function)
is executed to activate integrity protection and NAS ciphering occurs for all NAS
messages.
ix NAS Security Mode Command ix The MME sends NAS Security Mode Command (Selected NAS algorithms, eKSI, ME
Identity request, UE Security Capability) message to the UE.
T3113
x NAS Security Mode Complete x The UE responds NAS with Security Mode Complete (NAS-MAC, ME Identity)
message. The UE includes the ME Identity if it was requested in previous step.
xi S1-UE Initial Context Setup Request (UE Capabilities, CSFB indicator) xi For a UE in Idle mode, the MME sends the S1-UE Initial Context Request message to
performed.
xii RRCConnectionReconfiguration (MeasurementConfiguration IE) xii * The eNodeB sets up the Radio bearers based on the S1-Initial Context Request. It
* The message also configures 1x measurement objects .
xiii RRCConnectionReconfiguration Complete xiii The UE responds with an RRC-Radio Reconfiguration Complete message.
xiv S1-UE Initial Context Setup Response xiv If the UE is in idle mode, the eNodeB sends an S1-UE Initial Context Response
6 S1-DL S1 CDMA2000 Tunneling (GCSNA (GPM)) 6 The MME sends a S1-DL S1 CDMA2000 Tunneling message that contains the 1x
General page message it received from the 1xIWS.
7 RRC-DL Information Transfer message (GCSNA (GPM)) 7 The eNodeB delivers the 1xGPM to the UE using a RRC-DL Information Transfer
message.
LTE stack delivers

8 1xGPM to 1X stack, 8 The LTE stack extracts the 1xGPM message and sends it transparently to the 1x stack,
which responds which in turn sends an MT 1xCSFB request indication to the LTE stack.
with MT 1xCSFB
request to LTE
stack. LTE NAS
intiated MT ESR to
This trigger causes the LTE NAS layer to initiate a MT Extended Service Request
RRC. (1xCSFB MT call) being sent to the RRC layer.
9 RRC-UL Information Trasfer (Extended Serive Request (MT CSFB)) 9 The UE sends an RRC-UL Information Trasfer message. This message contains the
Extended Service-Request NAS message.
10 S1-UE Initial Context Setup message (Extended Serive Request (MT CSFB) 10 The eNodeB extracts the Extenbded Service Request NAS message and sends it to
the MME in an S1-UE Initial Context Setup message.
11 S1-UE Context Modification Request (UE Capabilities, CSFB indicator) 11 Since the UE is in active mode, the MME sends S1-UE Context Modification Request
(CS Fallback Indicator) to E-UTRAN to indicate to the eNodeB that the UE has
initiated a 1xCSFB procedure. The CS Fallback Indicator indicates to the E UTRAN to

EPS CDMA Notes

12 RRCConnectionReconfiguration (MeasurementConfiguration IE) 12 * The eNodeB sets up the Radio bearers based on the S1-UE Context Modification
Request. It sends RRC-Radio Reconfiguration message to the UE with configurations
at the bearer, MAC, and PHY layers.
** The eNodeB can request measurement of one 1x band/carrier in the
measurement object or multiple 1x bands per measurement object.
14 S1-UE Context Modification Response 14 Since the UE is in active mode, the eNodeB sends to the MME an S1-UE Context
Modification Response message to indicate which of the E-RABs have been
established.
eNodeB, it sends a measurement report.
might be repeated.
16 HandoverFromE-UTRAPreparation Request (3G1x Overhead Parameters, RAND, con. HRPD HO (OFF)) 16 The eNodeB sends a HO from EUTRA Preparation Request Command to the UE
1X stack receives 1x
indicating a e1xCSFB procedure. This message contains the 1xParameters including
17 parameters, 17 Upon receiving the 1x parameters, the 1x stack prepares the Page Response
encapsulates 1xPRM Message (PRM) and encapsulates it in a GCSNA 1x Circuit Service message with
in 1xGCSNA and Ack_reqd=0 and sends it to the LTE stack.
sends to LTE stack.
T3113
18 UL HandoverPreparation Transfer (MEID, GCSNA(PRM)) 18 The UE sends to the eNodeB a UL-Handover Preparation Transfer message
containing GCSNA (PRM) , along with the MEID . The 1xRTT PRM message contains
called party number???
19 S1-UL S1 CDMA2000 Tunneling 19 The eNodeB acts as a passthrough and forwards the GCSNA message to the MME in
(GCSNA(PRM), cdma2000 SectorID, RAND, CDMA2000 HO Required Indication, CDMA2000 1xRTT SRVCC Info an S1-UL S1 CDMA2000 Tunnelling message, along with cdma2000 SectorID, RAND,
(Pilot List, Band Classes, MEID, CDMA 1xRTT Mobile Subscription Information)) and the following optional IEs:
* CDMA2000 HO Required Indication IE: for the MME to recognize that preparation
* CDMA2000 1xRTT SRVCC Info IE: which includes Pilot List that is formed using the
Mobile Subscription Informationwhich was sent by the MME to the eNodeB as part
of the S1: UE Initial Context Setup /S1: UE Context Modification.
20 S102 Direct Transfer: A21-1x Air Interface Signanling (GCSNA(PRM), RAN, Pilot List, CDMA2000 20 Using the cdma2000 Sector ID , the MME chooses the IWS. It encapsulates the
1xRTT Mobile Subscription Information) GCSNA (PRM) message in an A21 message and populates the Pilot list IE, RAND, and
The 1xIWS, 1x target BSC, and MSC interaction to determine a Traffic Channel
21 Complete L3 Info: 21 The IWS constructs the Paging Response message, and places it in the Complete
Paging Response Layer 3 Information message, sends the message to the MSC and starts timer T303.
T303
The MSC stops timer T3113.

EPS CDMA Notes

22 Assignment Request (CPI) 22 The MSC sends an Assignment Request message to the IWS and starts timer T10.
This message may contain an MS Information Record IE with information such as
T10 Calling Party Information (CPI). The IWS stops timer T303.
T10, and starts timer T301.
24 Handoff Required (CPI) 24 The IWS initiates inter-BSC hard handoff for the MS/UE by sending a Handoff
Required message including the MS Information Record IE with the Calling Party
T7 T301
Information (CPI) to the MSC. The IWS starts timer T7
25 Handoff Request (CPI) 25 The MSC sends a Handoff Request message to the target BSC, with the MS
Information Record IE and the IS-95 Channel Identity IE or the IS-2000 Channel
Identity IE present, if the corresponding MS Information Record IE and IS-2000 or IS-
T11 T7 T301 95 Channel Identity IE were present in the Handoff Required message. The MSC
starts timer T11.
Request message.
As the Handoff Request message can have multiple cell(s) specified, the target BSC
can also choose to set up multiple cell(s) for the handoff request. The target BSC
sends null forward traffic channel frames to the MS/UE.
The first cell in the cell identifier list IE of the message is treated as the new
designated cell by the MSC.
The change of designated cell occurs upon receipt of the Handoff Complete
message.
T9
The target BSC sends a Handoff Request Acknowledge message to the MSC and
starts timer T9 to wait for arrival of the MS/UE on its radio channel. The MSC stops
timer T11 upon the receipt of this message.
* If the service option received in the Handoff Request message is not available at
the target BSC and the target BSC selected a different service option for the handoff
then the target BSC includes the service option it selected in the service
configuration records.
27 Handoff Command 27 The MSC sends a Handoff Command message to the IWS. The MSC includes in the
Handoff Command message the service configuration records it received in the
Handoff Request Acknowledge message. The IWS stops timer T7.
28 S102 Direct Transfer: A21-1x Air Interface Signanling (GCSNA(UHDM),GCSNA Status=HO 28 The 1xIWS forms a UHDM based on the traffic channel assignment. The UHDM is
Success) 1xRTT parameters) encapsulated in a GCSNA message that is sent using an A21-1x Air Interface message
to the MS/UE to instruct it to handoff to the cdma2000 1x system. The A21 message
contains a GCSNA Status field which indicates that the HO successful . This status
code differentiates it from A21 messages carrying other 1x messages.
29 Handoff Commenced 29 The IWS sends a Handoff Commenced message to the MSC to notify it that the
MS/UE has been ordered to move to the target BSC channel. The IWS starts timer
T306 to await a Clear Command message from the MSC.
S1 CDMA2000 Tunneling message to the eNodeB. It maps the status code into the

EPS CDMA Notes

message when the CDMA2000 HO Status IE indicates success.
T306
LTE stack extracts

32 the GCSNA message 32 The LTE stack extracts the GCSNA message and sends it to the 1x stack. The 1x stack
Depends on RRC extracts the UHDM and tunes to the 1x channel and pilots specified in the UHDM.
and pass to 1X connection re-
stack, which tunes establishement and
to 1x channel in the time to acquire 1x
UHDM.
33 S1 UE Context Release Request (Cause: CSFB to 1xRTT) 33 Upon receiving the S1-UE Context Release Request (Cause=CSFB to 1xRTT) from the
and P-GW(s). The MME sets the UE context to suspended status .
36 S1 UE Context Release Proceedure 36

37 1x Radio interface proceedure to acquire 1x traffic channel 37 The MS/UE transitions to the cdma2000 1x radio network and performs traffic
channel acquisition with the cdma2000 1xBSC.
39 Handoff Complete 39 The cdma2000 1xBSC sends a Handoff Complete message to the MSC.
40 Clear Command 40 The MSC sends a Clear Command message to the IWS and starts timer T315. The
42 1x Alert With Information Message (CPI) 42 Based upon receiving the CPI in the Handoff Request step, the target BSC sends the
Alert With Information message to the MS/UE to cause ringing at the MS/UE. Any
cdma2000 Information Records in the MS Information Record IE from the Handoff
Request message step, such as CPI and signal, are included in the Alert With
Information message. This step can occur anytime after 1x Handoff Completion
message step.
T301
43 1x Connect Order 43 When the call is answered at the MS/UE, a Connect Order is transmitted to the
target BSC.
44 Connect 44 The target BSC sends a Connect message to the MSC to indicate that the call has
been answered at the MS/UE. The MSC stops timer T301 upon receipt of the
Connect message.
45 After 1x call ends, UE goes to inactive state. MMSS is triggered to select the best system. 45 After the voice call ends, the UE transitions to inactive (not idle). Thus, the
registration variables in the UE are not updated as a result of the call. The UE
triggers an MMSS procedure to reselect back to LTE, if available, by first scanning
MRU[0].

EPS CDMA Notes

** If the UE had transitioned to 1x idle (instead of inactive), it would have updated its
registrations after each call. Hence, the approach is for the UE to move to inactive
and attempt to move back to LTE. If the UE is in the coverage area of the same LTE

eCSFB Call Scenario - E911 Callback w CPI HO Req Ver 1.0
EPS CDMA Notes

PSAP determines to callback
to an Emergency Call
2 Origination 2 A call is originated by an emergency callback from PSAP, the paging request from the
1xMSC may contains and Emergency Indicator to the IWS. A.S0008-C v3.0, and
A.S0009-C v3.0.
** In sprint implementation, no preferential treatment is given to E911 callbacks,
and they look exactly as regular MT voice calls.
with 1x page, this implementation will not support receiving this message and alerting
the user prior to traffic channel establishment. Feature Notification Message (FNM) is
not supported over GCSNA to provide Calling Party Information (CPI) along with the
General Paging Message (GPM).
T3113
1xRTT CS Paging
GCSNA GPM
5 If UE is in Idle State, MME initiates Network Triggered Service Request 5 If the UE is in Idle state, the MME sends an LTE page to the UE and performs network
Triggered Service Request procedure to bring the UE to Active state before tunneling
the 1xRTT CS paging request toward the UE.
registered.
RRC_CONNECTED.
iv RA Preamble Response iv The eNodeB sends an RA Preamble Response that contains the TimingAdvance, UL
(TimingAdvance, UL Grant, and Grant, and Temp C-RNTI .
Temp C-RNTI)
v RRC Connection Request (Cause=MO v The UE sends the RRC-Connection Request message. The establishment cause is set
Data, UE Contention Resolution to MO Data and contains the UE Contention Resolution Identity MAC control element .
Identity MAC control element)
vi RRC Connection Setup (UE vi The eNodeB responds with an RRC-Connection Setup message that contains a UE
Contention Resolution Identity) Contention Resolution Identity.

EPS CDMA Notes

T3113
messages.
performed.
message.
LTE stack delivers

with MT 1xCSFB
request to LTE
stack. LTE NAS
intiated MT ESR to This trigger causes the LTE NAS layer to initiate a MT Extended Service Request
10 S1-UE Initial Context Setup message (Extended Serive Request (MT CSFB) 10 The eNodeB extracts the Extenbded Service Request NAS message and sends it to the
MME in an S1-UE Initial Context Setup message.

EPS CDMA Notes

(CS Fallback Indicator) to E-UTRAN to indicate to the eNodeB that the UE has initiated
a 1xCSFB procedure. The CS Fallback Indicator indicates to the E UTRAN to move the
UE to 1xRTT.
Request. It sends RRC-Radio Reconfiguration message to the UE with configurations at
the bearer, MAC, and PHY layers.
established.
might be repeated.
17 parameters, 17 Upon receiving the 1x parameters, the 1x stack prepares the Page Response Message
encapsulates 1xPRM (PRM) and encapsulates it in a GCSNA 1x Circuit Service message with Ack_reqd=0
in 1xGCSNA and and sends it to the LTE stack.
sends to LTE stack.
T3113
(MEID, GCSNA(PRM)) containing GCSNA (PRM) , along with the MEID . The 1xRTT PRM message contains
* CDMA2000 1xRTT SRVCC Info IE: which includes Pilot List that is formed using the 1x
measurements, Band Classes supported by the UE, MEID, and CDMA2000 1xRTT
Mobile Subscription Informationwhich was sent by the MME to the eNodeB as part of
the S1: UE Initial Context Setup /S1: UE Context Modification.
20 S102 Direct Transfer: A21-1x Air Interface Signanling (GCSNA(PRM), RAN, Pilot List, CDMA2000 1xRTT 20 Using the cdma2000 Sector ID , the MME chooses the IWS. It encapsulates the GCSNA
Mobile Subscription Information) (PRM) message in an A21 message and populates the Pilot list IE, RAND, and
Assignment

EPS CDMA Notes

21 Complete L3 Info: 21 The IWS constructs the Paging Response message, and places it in the Complete Layer
Paging Response 3 Information message, sends the message to the MSC and starts timer T303. The
T303
MSC stops timer T3113.
22 Assignment Request (CPI) 22 The MSC sends an Assignment Request message to the IWS and starts timer T10. This
message may contain an MS Information Record IE with information such as Calling
T10 Party Information (CPI). The IWS stops timer T303.
T7 T301
T11 T7 T301 95 Channel Identity IE were present in the Handoff Required message. The MSC starts
timer T11.
Request message.
The change of designated cell occurs upon receipt of the Handoff Complete message.
The target BSC sends a Handoff Request Acknowledge message to the MSC and starts
T9 timer T9 to wait for arrival of the MS/UE on its radio channel. The MSC stops timer
T11 upon the receipt of this message.
* If the service option received in the Handoff Request message is not available at the
target BSC and the target BSC selected a different service option for the handoff then
the target BSC includes the service option it selected in the service configuration
records.
contains a GCSNA Status field which indicates that the HO successful . This status code
differentiates it from A21 messages carrying other 1x messages.

EPS CDMA Notes

T306 message when the CDMA2000 HO Status IE indicates success.
LTE stack extracts

32 the GCSNA message Depends on RRC 32 The LTE stack extracts the GCSNA message and sends it to the 1x stack. The 1x stack
and pass to 1X connection re- extracts the UHDM and tunes to the 1x channel and pilots specified in the UHDM.
stack, which tunes establishement and
to 1x channel in the time to acquire 1x
UHDM.
S1 UE Context Release Proceedure

36 36
(cause "Redirection toward 1xRTT" to allow
bearer suspension by EPC)
message step.
T301
43 1x Connect Order 43 When the call is answered at the MS/UE, a Connect Order is transmitted to the target
BSC.
44 Connect 44 The target BSC sends a Connect message to the MSC to indicate that the call has been
answered at the MS/UE. The MSC stops timer T301 upon receipt of the Connect
message.

EPS CDMA Notes


eCSFB Call Scenario - MT WPS Call w CPI HO Req TCH NC Ver 1.0
EPS CDMA Notes

WPS subscriber dials *272 to
call a service or regular user
2 on LTE 2 A call is originated by an priority user, the paging request from the 1xMSC to the IWS
may contain a priority value. A.S0008-C v3.0, and A.S0009-C v3.0.
** In sprint implementation, no preferential treatment is given to WPS over control
plane. Standards does not support relaying of priority indicator from the IWS to the
EPS.
with 1x page, this implementation will not support receiving this message and alerting
the user prior to traffic channel establishment. Feature Notification Message (FNM) is
not supported over GCSNA to provide Calling Party Information (CPI) along with the
General Paging Message (GPM).
T3113
1xRTT CS Paging
GCSNA GPM
registered.
RRC_CONNECTED.
Temp C-RNTI)
v RRC Connection Request (Cause=MO v The UE sends the RRC-Connection Request message. The establishment cause is set
Data, UE Contention Resolution to MO Data and contains the UE Contention Resolution Identity MAC control element .
Identity MAC control element)

EPS CDMA Notes

T3113
messages.
performed.
message.
LTE stack delivers

with MT 1xCSFB
request to LTE
stack. LTE NAS
10 S1-UE Initial Context Setup message (Extended Serive Request (MT CSFB) 10 The eNodeB extracts the Extenbded Service Request NAS message and sends it to the
MME in an S1-UE Initial Context Setup message.

EPS CDMA Notes

(CS Fallback Indicator) to E-UTRAN to indicate to the eNodeB that the UE has initiated
a 1xCSFB procedure. The CS Fallback Indicator indicates to the E UTRAN to move the
UE to 1xRTT.
Request. It sends RRC-Radio Reconfiguration message to the UE with configurations at
the bearer, MAC, and PHY layers.
established.
might be repeated.
17 parameters, 17 Upon receiving the 1x parameters, the 1x stack prepares the Page Response Message
encapsulates 1xPRM (PRM) and encapsulates it in a GCSNA 1x Circuit Service message with Ack_reqd=0
in 1xGCSNA and and sends it to the LTE stack.
sends to LTE stack.
T3113
* CDMA2000 1xRTT SRVCC Info IE: which includes Pilot List that is formed using the 1x
measurements, Band Classes supported by the UE, MEID, and CDMA2000 1xRTT
Mobile Subscription Informationwhich was sent by the MME to the eNodeB as part of
the S1: UE Initial Context Setup /S1: UE Context Modification.
20 S102 Direct Transfer: A21-1x Air Interface Signanling (GCSNA(PRM), RAN, Pilot List, CDMA2000 1xRTT 20 Using the cdma2000 Sector ID , the MME chooses the IWS. It encapsulates the GCSNA
Mobile Subscription Information) (PRM) message in an A21 message and populates the Pilot list IE, RAND, and

EPS CDMA Notes

21 Complete L3 Info: Assignment
21 The IWS constructs the Paging Response message, and places it in the Complete Layer
Paging Response 3 Information message, sends the message to the MSC and starts timer T303. The
T303
MSC stops timer T3113.
22 Assignment Request (CPI) 22 The MSC sends an Assignment Request message to the IWS and starts timer T10. This
message may contain an MS Information Record IE with information such as Calling
T10 Party Information (CPI). The IWS stops timer T303.
T7 T301
T11 T7 T301 95 Channel Identity IE were present in the Handoff Required message. The MSC starts
timer T11.
Request message.
The change of designated cell occurs upon receipt of the Handoff Complete message.
The target BSC sends a Handoff Request Acknowledge message to the MSC and starts
T9 timer T9 to wait for arrival of the MS/UE on its radio channel. The MSC stops timer
T11 upon the receipt of this message.
* If the service option received in the Handoff Request message is not available at the
target BSC and the target BSC selected a different service option for the handoff then
the target BSC includes the service option it selected in the service configuration
records.
contains a GCSNA Status field which indicates that the HO successful . This status code
differentiates it from A21 messages carrying other 1x messages.

EPS CDMA Notes

T306 CDMA2000 HO Status IE in this message.
Depends on RRC
connection re-
establishement and
LTE stack extracts time to acquire 1x
and pass to 1X extracts the UHDM and tunes to the 1x channel and pilots specified in the UHDM.
stack, which tunes
to 1x channel in the
UHDM.

36 36
(cause "Redirection toward 1xRTT" to allow
bearer suspension by EPC)
message step.
T301
43 1x Connect Order 43 When the call is answered at the MS/UE, a Connect Order is transmitted to the target
BSC.
44 Connect 44 The target BSC sends a Connect message to the MSC to indicate that the call has been
answered at the MS/UE. The MSC stops timer T301 upon receipt of the Connect
message.

EPS CDMA Notes


eCSFB Call Scenario - QChat PAM Hotspot w MT Call Ver 1.0
EPS CDMA Notes

Wirelss or land line phone user
places a call to a LTE subscriber
QChat / PAM Bearer
2 2 A wirelss or a landline phone user places a call to an LTE subscriber
with 1x page, this implementation will not support receiving this message and
alerting the user prior to traffic channel establishment. Feature Notification
Message (FNM) is not supported over GCSNA to provide Calling Party Information
(CPI) along with the General Paging Message (GPM).
T3113
1xRTT CS Paging
GCSNA GPM
T3113
message.
LTE stack delivers

8 1xGPM to 1x stack. 8 The LTE stack extracts the 1xGPM message and sends it transparently to the 1x stack.
Since DDTM is on, Since DDTM is on, the page is ignored.
the page is ignored.
9 Page times out 9 The page response timer times out.
10 (Re) Paging Request 10 1xMSC sends a duplicate page, ore re-pages the UE.
GCSNA GPM
T3113
message.
LTE stack delivers


eCSFB Call Scenario - QChat PAM Hotspot w MT Call Ver 1.0
EPS CDMA Notes

16 (Re) Paging Request 16 1xMSC sends a duplicate page, ore re-pages the UE.
GCSNA GPM
T3113
message.
LTE stack delivers

22 MSC directs user to Voice 22 Incoming call request terminates. The 1xMSC directs calling party to voice mail
Mail Server (VMS) server.

eCSFB Call Scenario - MO SMS over S102 CCH Ver 1.0
EPS CDMA Notes

UE/MS eNB MME BSC IWS MSC SMS-C 3GPP TS 23.272, 23.401, 3GPP2 A.S0008 Annex F, Qualcom 1xCSFB FDD
2 User 2 User decides to originate an SMS. If the PSIST check is passed, a MO SMS inidcation
an SM. 1x
stack Upon receiving the DBM with SMS from higher-layers, the 1x stack initiates a
initiates CDMA2000 Parameters Request.
1xParame
ter
Request
3 RACH/SR Proceedure 3 If the UE is in Idle mode, the LTE stack initiates the RACH/Service request procedure
Random Access Proceedure
i RA Preamble i The RRC layer in turn starts the RACH procedure by sending the RA Preamble.
ii RA Preamble Response (TimingAdvance, UL ii The eNodeB sends an RA Preamble Response that contains the TimingAdvance, UL
Grant, and Temp C-RNTI) Grant, and Temp C-RNTI .
iii RRC Connection Request (Cause=MO Data, UE iii The UE sends the RRC Connection Request message. The establishment cause is set
element)
iv RRC Connection Setup (UE Contention iv The eNodeB responds with an RRC Connection Setup message that contains a UE
Resolution Identity) Contention Resolution Identity.
v RRC Connection Setup Complete (Serive Request) v The UE sends NAS message Service Request towards the MME encapsulated in an
vi Initial UE message (Service Request) vi Upon receiving the RRC Connection Setup Complete message, the eNodeB extracts
protected, or integrity check failed, NAS security setup (see 5.3.10 Security Function) is
executed to activate integrity protection and NAS ciphering occurs for all NAS
messages.
vii NAS Security Mode Command vii The MME sends NAS Security Mode Command (Selected NAS algorithms, eKSI, ME
viii NAS Security Mode Complete viii The UE responds NAS with Security Mode Complete (NAS-MAC, ME Identity)
ix S1-UE Initial Context Setup Request (UE Capabilities) ix For a UE in Idle mode, the MME sends the S1-UE Initial Context Request message to
the eNodeB., contains the bearers that should be set up for the UE

EPS CDMA Notes

x RRCConnectionReconfiguration (MeasurementConfiguration IE) x * The eNodeB sets up the Radio bearers based on the S1-Initial Context Request. It
sends RRC Radio Reconfiguration message to the UE with configurations at the
xi RRCConnectionReconfiguration Complete xi The UE responds with an RRC Radio Reconfiguration Complete message.
xii S1-UE Initial Context Setup Response xii If the UE is in idle mode, the eNodeB sends an S1-UE Initial Context Response
4 CSFBParameterRequestCDMA2000 4 The RRC layers sends the CSFBParametersRequestCDMA2000 message to the eNB to
retrieve the CDMA2000 parameters
5 CSFBParameterResponse (RAND, mobilityParameterC2K) 5 The eNB responds with the CSFBParametersResponseCDMA2000 message that
contains the RAND and CDMA2000 Parameters
6 1x stack 6
receives
1xParame
ters from
teh LTE
stack.
7 1x stack 7 The 1x stack uses the parameters to form the GCSNA message with DBM and is
forms delivered to the LTE stack
GCSNA
message
containing Note: In the call flows, it is recommended that GCSNA Ack_reqd is set to 0 for SMS
GCSNA(DB function as in CDMA systems, where the Ack is returned from the SMS-C. If GCSNA
M,
Ack_requi Ack_reqd is set to 1, then a GCNAL2Ack will be sent by IWS, which might cause
red=0) unecessary message flooding, particularly during congestion, and is not compliant
with the SMS proceedures in CDMA.
8 RRC-UL Information Transfer (GCSNA Circuit Service (DBM)) 8 The LTE stack encapsulates the GCSNA message in a UL-Info Transfer message and
9 S1-UL S1 CDMA2000 Tunelling (GCSNA Circuit Service (DBM), CDMA2000 Reference Cell ID) 9 The eNodeB passes the GCSNA (DBM) in S1 CDMA2000 Tunelling message without
interpreting to the MME. It also specifies the CDMA2000 Reference Cell ID.
10 S102 Direct Transfer: A21-1x Air Interface Signaling message (GCSNA (DBM)) 10 Based on the CDMA2000 Reference Cell ID , the MME selects the IWS. It encapsulates
the GCSNA message in an A21-1x Air Interface Signaling message and sends it to the
IWS. IMSI is used to distinguish S102 signalling transactions belonging to different
UEs.
11 A21-Ack 11
12 ADDS Transfer MSC delivers to SMSC. If UE has 12 The IWS delivers the SMS to MSC through ADDS Transfer
requested an Ack for the SMS,
the Ack is delivered as a SMS
per MT SMS call flow
If SMS Ack is Required, it is sent as MO SMS
13 ADDS Page 13 The 1xMSC the SMS as ADDS Page to the 1xCS IWS node.

EPS CDMA Notes

14 S102 Direct Transfer: A21-1x Air Interface Signaling message (GCSNA ((DBM), Ack_reqd=0)) 14 The 1xCS IWS encapsulates DBM in GCSNA message and sets Ack_required =0 and
sends it to MMEover the S102 tunnel in an S102 Direct Transfer message (as "1x Air
Interface Signalling").
15 S1-DL S1 CDMA2000 Tunneling (GCSNA ((DBM), Ack_reqd=0)) 15 Once the UE comes on RRC connection, the MME sends a S1-DL S1 CDMA2000
Tunneling message that contains the GCSNA (DBM) message it received from the
1xIWS.
16 RRC-DL Information Transfer message (GCSNA ((DBM), Ack_reqd=0)) 16 The eNodeB delivers the GCSNA (DBM) to the UE using a RRC-DL Information
Transfer message.
LTE stack delivers

17 teh SMS Ack to the 17 The LTE stack extracts the GCSNA (DBM) message and sends it transparently to the 1x
1x stack as stack.
GCSNA(DBM) If SMS Ack is needed, it is delivered from the 1x stack as MO SMS

eCSFB Call Scenario - MT SMS over S102 CCH Ver 1.0
EPS CDMA Notes

UE/MS eNB MME BSC IWS MSC SMS-C VM/MMS 3GPP TS 23.272, 23.401, 3GPP2 A.S0008 Annex F, Qualcom 1xCSFB FDD
2 User receives an SMS. It could 2 A MT SMS has reached MSC. . It could be SMS from SMS-C, VMN as SMS with
be SMS from SMS-C, VMN as Teleservice ID 4098, a MWI as SMS with Teleservice ID 4099, or a MMS as SMS
SMS with Teleservice ID 4098, containing URL to content.
a MWI as SMS with Teleservice
ID 4099, or a MMS as SMS
containing URL to content.
3 ADDS Page 3 The 1xMSC the SMS as ADDS Page to the 1xCS IWS node.
4 S102 Direct Transfer: A21-1x Air Interface Signaling message (GCSNA ((DBM), Ack_reqd=0)) 4 The 1xCS IWS encapsulates DBM in GCSNA message and sets Ack_required =0 and
sends it to MMEover the S102 tunnel in an S102 Direct Transfer message (as "1x Air
Interface Signalling").
registered.
RACH/SR Proceedure
RRC_CONNECTED.
iv RA Preamble Response (TimingAdvance, UL iv The eNodeB sends an RA Preamble Response that contains the TimingAdvance, UL
Grant, and Temp C-RNTI) Grant, and Temp C-RNTI .
v RRC Connection Request (Cause=MO Data, UE v The UE sends the RRC Connection Request message. The establishment cause is set
element)
vi RRC Connection Setup (UE Contention vi The eNodeB responds with an RRC Connection Setup message that contains a UE
Resolution Identity) Contention Resolution Identity.
viii Initial UE message (Service Request) viii Upon receiving the RRC Connection Setup Complete message, the eNodeB extracts

EPS CDMA Notes

protected, or integrity check failed, NAS security setup (see 5.3.10 Security Function) is
executed to activate integrity protection and NAS ciphering occurs for all NAS
messages.
xi S1-UE Initial Context Setup Request (UE Capabilities) xi For a UE in Idle mode, the MME sends the S1-UE Initial Context Request message to
the eNodeB., contains the bearers that should be set up for the UE
xiii RRCConnectionReconfiguration Complete xiii The UE responds with an RRC Radio Reconfiguration Complete message.
6 S1-DL S1 CDMA2000 Tunneling (GCSNA ((DBM), Ack_reqd=0)) 6 Once the UE comes on RRC connection, the MME sends a S1-DL S1 CDMA2000
Tunneling message that contains the GCSNA (DBM) message it received from the
1xIWS.
7 RRC-DL Information Transfer message (GCSNA ((DBM), Ack_reqd=0)) 7 The eNodeB delivers the GCSNA (DBM) to the UE using a RRC-DL Information
Transfer message.
LTE stack delivers

8 GCSNA(DBM) to 1x 8 The LTE stack extracts the GCSNA (DBM) message and sends it transparently to the 1x
stack. If SMS Ack is stack.
needed, it is If SMS Ack is needed, it is delivered from the 1x stack as MO SMS
delivered from the
1x stack as MO SMS
If SMS Ack is Required, it is sent as MO SMS
9 1x stack 9 The 1x stack uses the parameters to form the GCSNA message with DBM and is
forms delivered to the LTE stack
GCSNA
message
containing Note: In the call flows, it is recommended that GCSNA Ack_reqd is set to 0 for SMS
GCSNA(DB function as in CDMA systems, where the Ack is returned from the SMS-C. If GCSNA
M,
Ack_requi Ack_reqd is set to 1, then a GCNAL2Ack will be sent by IWS, which might cause
red=0) unecessary message flooding, particularly during congestion, and is not compliant
with the SMS proceedures in CDMA.

EPS CDMA Notes

10 RRC-UL Information Transfer (GCSNA Circuit Service (DBM)) 10 The LTE stack encapsulates the GCSNA message in a UL-Info Transfer message and
11 S1-UL S1 CDMA2000 Tunelling (GCSNA Circuit Service (DBM), CDMA2000 Reference Cell ID) 11 The eNodeB passes the GCSNA (DBM) in S1 CDMA2000 Tunelling message without
12 S102 Direct Transfer: A21-1x Air Interface Signaling message (GCSNA (DBM)) 12 Based on the CDMA2000 Reference Cell ID , the MME selects the IWS. It encapsulates
UEs.
13 A21-Ack 13
14 ADDS Transfer MSC delivers to SMSC. If UE has

14 The IWS delivers the SMS to MSC through ADDS Transfer
requested an Ack for the SMS,
the Ack is delivered as a SMS
per MT SMS call flow

eCSFB Call Scenario - NI Precis LBS Ver 1.0
EPS CDMA Notes

UE/MS eNB MME SGW PGW BSC IWS MSC VLR/HLR PDR/SMSC PDE LSDC/MPC LBS-GW LBS Client 3GPP TS 23.272, 23.401, 3GPP2 A.S0008 Annex F, Qualcom 1xCSFB FDD
2 MLP LBS URL complieant Invoke 2 LBS client invokes MLP LBS URL to LBS-GW
a ISPOSREQ a LBS-GW sends LCWLI Loc request to the LSDC/MPC for precise LBS.
b SMSREQ b
c smsreq r/r c
d ISPOSREQ Invoke (Action Code = 22) d
e SO35 Page/wake up e
3 SO35 Page/wake up 3 The PDR/SMSC sends Page with SO 35 to request position from the device
T3113
1xRTT CS Paging
GCSNA GPM
4 S102 Direct Transfer: A21-1x Air Interface Signaling message (GCSNA (GPM (SO 35))) 4 The 1xCS IWS node forwards the 1xRTT CS paging request via the S102 tunnel to the
network Triggered Service Request procedure to bring the UE to Active state
before tunneling the 1xRTT CS paging request toward the UE.
registered.
If UE is in Idle State, Service Request Procedure This trigger causes the LTE NAS layer to initiate an Extended Service Request
(1xCSFB MT call) being sent to the RRC layer.
iii RA Preamble iii The RRC layer in turn starts the RACH procedure by sending the RA Preamble to
eNodeB.
(TimingAdvance, UL Grant, and Grant, and Temp C-RNTI.
Temp C-RNTI)
v RRC Connection Request v The UE sends the RRC Connection Request message. The establishment cause is set
(Cause=MO Data, UE Contention to MO Data and contains the UE Contention Resolution Identity MAC control
Resolution Identity MAC control element .
element)
T3113

EPS CDMA Notes

UE/MS eNB MME SGW PGW BSC IWS MSC VLR/HLR PDR/SMSC PDE LSDC/MPC LBS-GW LBS Client T3113 3GPP TS 23.272, 23.401, 3GPP2 A.S0008 Annex F, Qualcom 1xCSFB FDD
Function) is executed to activate integrity protection and NAS ciphering occurs for
all NAS messages.
the eNodeB., contains the bearers that should be set up for the UE, as well as the
CS Fallback Indicator IE that informs the eNodeB that the CS Fallback procedure is
to be performed.
xiii RRCConnectionReconfiguration Complete xiii The UE responds with an RRC Radio Reconfiguration Complete message.
6 S1-DL S1 CDMA2000 Tunneling (GCSNA (1xGPM(SO35))) 6 The MME sends a S1-DL S1 CDMA2000 Tunneling message that contains the 1x
7 RRC-DL Information Transfer message (GCSNA (1xGPM(SO35))) 7 The eNodeB delivers the 1xGPM to the UE using a RRC-DL Information Transfer
message.
LTE stack delivers

8 1xGPM to 1X stack, 8 The LTE stack extracts the 1xGPM (SO35) message and sends it transparently to the
which responds 1x stack, which in turn sends an MT 1xCSFB request indication to the LTE stack.
with MT 1xCSFB
request to LTE
stack. LTE NAS
Request. It sends RRC Radio Reconfiguration message to the UE with configurations

EPS CDMA Notes

established.
15 MeasurementReport 15 * Once the UE has completed measuring the 1x channels and pilots configured by
the eNodeB, it sends a measurement report.
might be repeated.
sends to LTE stack.
T3113
(MEID, GCSNA(PRM)) containing GCSNA (PRM) , along with the MEID .
(GCSNA(PRM), cdma2000 SectorID, RAND, CDMA2000 HO Required Indication, CDMA2000 1xRTT SRVCC Info an S1-UL S1 CDMA2000 Tunnelling message, along with cdma2000 SectorID, RAND ,
for handover has started and that it has to send some HO-related information to
the IWS in the A21-1x Air Interface Signaling message.
1x measurements, Band Classes supported by the UE, MEID, and CDMA2000
1xRTT Mobile Subscription Information which was sent by the MME to the eNodeB
as part of the S1: UE Initial Context Setup /S1: UE Context Modification.
1xRTT Mobile Subscription Information) GCSNA (PRM) message in an A21 message and populates the Pilot list IE, RAND,
and CDMA2000 1xRTT Mobile Subscription Information in the A21 message.
Paging Response Layer 3 Information message, sends the message to the MSC and starts timer T303.
T303
The MSC stops timer T3113.
22 Assignment Request (CPI) 22 The MSC sends an Assignment Request message to the IWS and starts timer T10.
T10 Calling Party Information (CPI). The IWS stops timer T303.
T7 T301
T11 T7 T301 95 Channel Identity IE were present in the Handoff Required message. The MSC
starts timer T11.

EPS CDMA Notes

Request message.
The change of designated cell occurs upon receipt of the Handoff Complete
message.
T9
The target BSC sends a Handoff Request Acknowledge message to the MSC and
starts timer T9 to wait for arrival of the MS/UE on its radio channel. The MSC stops
timer T11 upon the receipt of this message.
* If the service option received in the Handoff Request message is not available at
the target BSC and the target BSC selected a different service option for the handoff
then the target BSC includes the service option it selected in the service
configuration records.
Success) 1xRTT parameters) encapsulated in a GCSNA message that is sent using an A21-1x Air Interface
message to the MS/UE to instruct it to handoff to the cdma2000 1x system. The
A21 message contains a GCSNA Status field which indicates that the HO successful .
This status code differentiates it from A21 messages carrying other 1x messages.
29 Handoff Commenced 29 The IWS sends a Handoff Commenced message to the MSC to notify it that the
MS/UE has been ordered to move to the target BSC channel. The IWS starts timer
T306 to await a Clear Command message from the MSC.
T306 CDMA2000 HO Status IE in this message.
Depends on RRC
connection re-
establishement and
LTE stack extracts
32 the GCSNA message time to acquire 1x 32 The LTE stack extracts the GCSNA message and sends it to the 1x stack. The 1x stack
TCH extracts the UHDM and tunes to the 1x channel and pilots specified in the UHDM.
and pass to 1X
stack, which tunes
UHDM.

EPS CDMA Notes


36 36
40 Clear Command 40 The MSC sends a Clear Command message to the IWS and starts timer T315. The
T301
42 1x Connect Order 42 When the call is answered at the MS/UE, a Connect Order is transmitted to the
target BSC.
43 Connect 43 The target BSC sends a Connect message to the MSC to indicate that the call has
been answered at the MS/UE. The MSC stops timer T301 upon receipt of the
Connect message.
44 isposreq r/r 44
45 GPOSREQ Invoke 45
46 Gposreq ack 46
47 IS-801 Session over TCH 47
48 gposreq r/r 48
49 Lcwli r/r 49 LSDC/MPC returns long/lat coordinates to the LBS-GW
50 MLP Loc r/r 50 LSDC LBS-GW returns postion info to the LBS Client
registration variables in the UE are not updated as a result of the call. The UE
triggers an MMSS procedure to reselect back to LTE, if available, by first scanning
MRU[0].
** If the UE had transitioned to 1x idle (instead of inactive), it would have updated

its registration status based on the SPM on 1x. This might lead to unnecessary

eCSFB Call Scenario - NI Coarse LBS Ver 1.0
EPS CDMA Notes

2 MLP LBS URL complieant Invoke 2 LBS client invokes MLP LBS URL to LBS-GW
a ISPOSREQ a LBS-GW sends LCWLI Loc request to the LSDC/MPC for precise LBS.
b SMSREQ b
c smsreq r/r c
d ISPOSREQ Invoke (Action Code ≠ 22) d
e SO35 Page/wake up e
3 SO35 Page/wake up 3 The PDR/SMSC sends SO 35 Page to request position from the device
T3113
1xRTT CS Paging
GCSNA GPM
4 S102 Direct Transfer: A21-1x Air Interface Signaling message (GCSNA (GPM (SO 35))) 4 The 1xCS IWS node forwards the 1xRTT CS paging request via the S102 tunnel to the
network Triggered Service Request procedure to bring the UE to Active state
before tunneling the 1xRTT CS paging request toward the UE.
registered.
If UE is in Idle State, Service Request Procedure The NAS sends an Service Request to RRC, which triggers a RACH procedure to go to
RRC_CONNECTED.
Temp C-RNTI)
v RRC Connection Request v The UE sends the RRC-Connection Request message. The establishment cause is set
(Cause=MO Data, UE Contention to MO Data and contains the UE Contention Resolution Identity MAC control
Resolution Identity MAC control element .
element)

EPS CDMA Notes

T3113
Function) is executed to activate integrity protection and NAS ciphering occurs for
all NAS messages.
the eNodeB., contains the bearers that should be set up for the UE, as well as the
CS Fallback Indicator IE that informs the eNodeB that the CS Fallback procedure is
to be performed.
6 S1-DL S1 CDMA2000 Tunneling (GCSNA (1xGPM(SO35))) 6 The MME sends a S1-DL S1 CDMA2000 Tunneling message that contains the 1x
7 RRC-DL Information Transfer message (GCSNA (1xGPM(SO35))) 7 The eNodeB delivers the 1xGPM to the UE using a RRC-DL Information Transfer
message.
LTE stack delivers

8 1xGPM to 1X stack, 8 The LTE stack extracts the 1xGPM message and sends it transparently to the 1x
which responds stack, which in turn sends an MT 1xCSFB request indication to the LTE stack.
with MT 1xCSFB
request to LTE
stack. LTE NAS
Request. It sends RRC-Radio Reconfiguration message to the UE with configurations

EPS CDMA Notes

established.
15 MeasurementReport 15 * Once the UE has completed measuring the 1x channels and pilots configured by
the eNodeB, it sends a measurement report.
might be repeated.
sends to LTE stack.
T3113
for handover has started and that it has to send some HO-related information to
the IWS in the A21-1x Air Interface Signaling message.
* CDMA2000 1xRTT SRVCC Info IE: which includes Pilot List that is formed using the
Mobile Subscription Informationwhich was sent by the MME to the eNodeB as part
of the S1: UE Initial Context Setup /S1: UE Context Modification.
1xRTT Mobile Subscription Information) GCSNA (PRM) message in an A21 message and populates the Pilot list IE, RAND,
and CDMA2000 1xRTT Mobile Subscription Information in the A21 message.
Paging Response Layer 3 Information message, sends the message to the MSC. The MSC stops timer
T3113.
22 Release Order 22 The MSC sends an Assignment Request message to the IWS and starts timer T10.
Calling Party Information (CPI). The IWS stops timer T303.
23 S102 Direct Transfer: A21-1x Air Interface Signaling message (GCSNA (Release Order)) 23 The IWS sends a Release Order message to the UE through the MME.
24 S1-DL S1 CDMA2000 Tunneling (GCSNA (Release Order)) 24 The MME sends a S1-DL S1 CDMA2000 Tunneling message that contains the 1x
Release Order message it received from the 1xIWS.
25 RRC-DL Information Transfer message (GCSNA (Release Order)) 25 The eNodeB delivers the Release Order to the UE using a RRC-DL Information
Transfer message.

EPS CDMA Notes

LTE stack extracts

and pass to 1X extracts the UHDM and tunes to the 1x channel and pilots specified in the UHDM.
stack, which realize
it will not fall back
to 1xRTT, and starts
resuming LTE
activities.
27 S1 UE Context Release Request (Cause: CSFB to 1xRTT) 27 Since the eNodeB is unaware of the contents of the GCSNA message, it proceeds per
standards by sending S1-UE Context Release Request (Cause=CSFB to 1xRTT) to the
28 Suspend Notification 28 MME. The S1-U bearers are released and the MME starts the preservation and
suspension of non-GBR bearers and the deactivation of GBR bearers towards S-GW
29 Suspend Acknowledge 29 and P-GW(s). The MME sets the UE context to suspended status .
THe UE recaptures LTE context and

30 30 After a temporary interruption of LTE data services, per the previous step, the UE
resumes service
recaptures LTE context, and resumes data service.
31 isposreq r/r 31 The 1X MSC receives the page response message (PRM), it transmits Market_ID,
MSC_ID, and Cell_ID in the isposreq_rr to the requesting MPC.
32 GPOSREQ Invoke 32 The MPC determine the cell-sector centroid Lat/Long of the serving cell and provide
that it to the request client along with uncertainty of the fix (1000, 1500, 2000, etc
meters).
33 Gposreq ack 33
34 34
35 gposreq r/r 35
36 Lcwli r/r 36 LSDC/MPC returns long/lat coordinates to the LBS-GW
37 MLP Loc r/r 37 LSDC LBS-GW returns postion info to the LBS Client

eCSFB Call Scenario - UI Precise LBS Ver 1.0
EPS Notes
UE/MS eNB MME SGW PGW PCRF HSS PDE 3GPP TS 23.272, 23.401
1 1 The UE attaches to E-UTRAN, completed the registration with the 1x network, and
UE Attach to E-UTRAN, Register with 1xRTT CS through S102. UE indicates support eCSFB.
Note: 1xRTT registration is not required for Data services on LTE. This informaiton is
included for consistency with the use of eCSFB capable UEs.
2 2 User or an applicatin decides to request UI precise LBS. If the PSIST check is passed, a
User
originates trigger is sent to the LTE stack, which decides to perfrom a Service Request.
a LBS
request to
the LTE
stack.
3 If UE is in Idle State, Service Request Procedure 3
eNodeB.
element) element .
e RRC Connection Setup Complete (Service Request) e The UE sends an RRC-Connection Setup Complete message. This message contains

4 Authentication 4
is invoked to activate integrity protection and NAS ciphering occurs for all NAS
messages.
5 S1-UE Initial Context Setup Request 5 The MME sends the S1-Initial Context Request message to the eNodeB, contains the
bearers that should be set up for the UE.
6 RRCConnectionReconfiguration 6 The eNodeB sets up the Radio bearers based on the S1-Initial Context Request. It
8 S1-UE Initial Context Setup Response 8 The eNodeB sends an S1-Initial Context Response message to indicate which of the E-
RABs have been established.
9 Modify Bearer Request 9 The MME sends a Modify Bearer Request message (eNodeB address, S1
TEID(s) (DL) for the accepted EPS bearers, Delay Downlink Packet
Notification Request, RAT Type) per PDN connection to the Serving GW.
The Serving GW is now able to transmit downlink data towards the UE.
10 Modify Bearer Request 10 If the RAT Type has changed compared to the last reported RAT Type or if
the UE's Location and/or Info IEs and/or UE Time Zone are present in step
8, the Serving GW shall send the Modify Bearer Request message (RAT
Type) per PDN connection to the PDN GW.
11 PCRF initiated IP-CAN Session Modification 11 If dynamic PCC is deployed, the PDN GW interacts with the PCRF to get the
PCC rule(s) according to the RAT Type by means of a PCEF initiated IP
CAN Session Modification procedure
12 Modify Bearer Response 12 The PDN GW sends the Modify Bearer Response to the Serving GW

13 Modify Bearer Response 13 The Serving GW sends a Modify Bearer Response to the MME
14 Uplink Data: Unsolicited provide MS Information, unsolicited provide Pilot Phase 14 In the first uplink data, the UE provides unsolicited MS Information , Pilot
measuremnts, request GPS Acusition Assistance Phase measurements , and requests GPS Acusition Assistance
15 Downlink Data: Provide GPS Acquistion Assistance 15 The PDE responsds to the UE request by providing GPS Acquisition
Assistance data
16 Uplink Data: Request GPS Sensitivity Assistance 16 The UE requests GPS Sensitivity Assistance from the PDE
17 Downlink Data: Provide GPS Sensitivity Assistance 17 The PDE responsds to the UE request by providing GPS Sensitivity
Assistance data
18 Uplink Data: Unsolicited provide psuedorange measuremnts, unsolicited provide Pilot Phase 18 The UE provides unsolicited psuedorange measurements , Pilot Phase
measuremnts, request Location Response measuremnts , and requests Location Response
19 Downlink Data: Provide Location Response 19 The PDE returns Location Response information
20 Uplink Data: Mobile sends session end flag 20 The UE terminates the LBS session by sending End Flag

eCSFB Call Scenario - CMAS Ver 1.0
EPS Service Provider Public Authority Notes

UE/MS eNB MME CBC CBE 3GPP TS 23.272, 36.413
1 UE Attach to E-UTRAN, and authenticated by the network. Device manager configure the UE 1 The UEattaches to E-UTRAN, and is authenticated by the network.
with PLMN list to receive warning message (list default is empty). * Device Management is used to configure the UE with a list of PLMNs that wish the
UE to accept warning messages. By default, the list in the UE shall be empty.
Warning Message Delivery Procedure
2 Emergency Broadcast Request 2 CBE (e.g. Information Source such as PSAP or Regulator) sends Emergency Broadcast
(emergency information (e.g. "warning Request to the CBC, with information (e.g. "warning type", "warning message",
type", "warning message", "impacted "impacted area", "time period") to the CBC. The CBC shall authenticate this request.
area", "time period"))
3 Write-Replace Warning Request (Warning message, (Message identifier, Serial 3 Using the "impacted area" information , the CBC identifies which MMEs need to be
Number, Tracking Area ID list, Warning Area, OMC ID, CWM Indicator)) contacted and determines the information to be place into the Warning Area
Information Element. The CBC sends a Write-Replace Warning Request message
containing the Warning message to be broadcast and the delivery attributes
(Message identifier, Serial Number, Tracking Area ID list, Warning Area, OMC ID,
CWM Indicator) to MMEs.
The Tracking Area ID list is only used by the MME or selecting which eNodeBs to
forward the Write-Replace Warning Request message to.
4 Write-Replace Warning Confirm 4 The MME sends a Write-Replace Warning Confirm message that indicates to the CBC
that the MME has started to distribute the warning message to eNodeBs.
5 Emergency Broadcast Response 5 Upon reception of the Write-Replace Confirm messages from the MMEs, the CBC may
confirm to the CBE that the PLMN has started to distribute the warning message.
6 Write-Replace Warning Request 6 he MME forwards Write-Replace Warning Message Request to eNodeBs. The MME
shall use the Tracking Area ID list to determine the eNodeBs in the delivery area. If
the Tracking Area ID list is empty the message is forwarded to all eNodeBs that are
connected to the MME.
7 7 The eNodeB uses the Warning Area information to determine the cell(s) in which the
message is to be broadcast.
* If any redundant messages are detected only the first one received will be
Cell Braodcast broadcasted by the cells.
delivery * The eNodeBs return a Distribute Warning Message Response to the MME, even if it
was a duplicate.
Write-Replace Warning Response
8 8 If the UE has been configured to receive warning messages on that PLMN and the UE
has authenticated the core network of the eNodeB it is camped on, then ,
1) The UE can use "warning type" values, 'earthquake', 'tsunami' or 'earthquake and
User tsunami', immediately to alert the user. When "warning type" is 'test', the UE silently
Alerting discards the primary notification, but the UE specially designed for testing purposes
may proceed with the following procedures.
2) The UE activates reception of the broadcast messages containing the "warning
message" . The UE indicates the contents of the "warning message" to the user. 3) The
UE ignores the message detected as a duplicated (based on "Message Identifier and
Serial Number" ), independently for primary and secondary notifications.

eCSFB Call Scenario - CMAS Ver 1.0
EPS Service Provider Public Authority Notes

UE/MS eNB MME CBC CBE 3GPP TS 23.272, 36.413
9 9 From the Write-Replace Warning Response messages returned by eNodeB's the MME
Record determines the success or failure of the delivery and creates a trace record . Any OMC
sucssess/failure ID received in step 3 is written to the trace record to permit the O&M system to
of message deliver them to the desired destination.
delivery in trace
record.
Warning Message Cancel Procedure
10 Stop Emergency Broadcast Request 10 CBE initiates procedure by sending Stop Emergency Broadcast Request (e.g.
(Message Identifier, Serial Number) "Message Identifier and Serial Number "), to the CBC. The CBC shall authenticate this
request.
11 Stop Warning Request (Message Identifier, Serial Number, Tracking Area ID list, 11 The CBC identifies which MMEs need to be contacted and determines the information
Warning Area, OMC ID) to be place into the Warning Area Information Element . The CBC sends a Stop
Warning Request message (Message Identifier, Serial Number, Tracking Area ID list,
Warning Area, OMC ID) to MMEs.
* If OMC ID is present, it indicates the OMC to which the Trace record generated in
step 16 is destined
12 Stop Warning Confirm 12 The MME sends a Stop Warning Confirm message that indicates to the CBC that the
MME has started to distribute the Stop Warning Request message to eNodeBs.
13 Stop Emergency Broadcast Response 13 Upon reception of the Stop Warning Confirm messages from the MMEs, the CBC may
confirm to the CBE that the PLMN has initiated the Warning message cancel
procedure.
14 Stop Warning Request 14 he MME forwards Stop Warning Request Message Request to eNodeBs. The MME
shall use the Tracking Area ID list to determine the eNodeBs in the delivery area. If
the Tracking Area ID list is empty the message is forwarded to all eNodeBs that are
connected to the MME.
15 15 The eNodeB shall stop broadcasting the warning message identified by the Message
Identifier and Serial Number in the areas identified by Warning Area IDs. If the
Stop Cell Warning Area is absent, it shall be interpreted as "all cells on the eNodeB").
Braodcast * if any redundant Stop Warning Requests are detected only the response to the first
delivery MME shall contain statistics related to the cancelled broadcast.
Stop Warning Response
16 16 From the Stop Warning Response messages returned by eNodeB's the MME creates a
Record trace record (e.g. number of times a particular message has been broadcasted in a
sucssess/failure given warning area) related to the cancelled message.
of message Any OMC ID received in step 11 is written to the trace record to permit the O&M
delivery in trace system to deliver them to the desired destination.

eCSFB Call Scenario - Femto Registration Ver 1.0
EPS CDMA Regional DC IMS Notes

UE/MS HLR FAP SG SBC FSM CSCFx TCSx DRSx CSCFy TCSx DRSy Airave Phase 2 Design Document
FAP Device IMS Registration
1 FAP Initialization: authentication and authorization 1
2 FAP downloads (FQDN of SBC, IMS Private & Public 2

user ID, IMS digest authentication credentials)
3 FAP establish IPSec 3 After the IPSec tunnel is successfully established with the security ateway, the FAP
tunnel with Security subsequently registers with the IMS core via the SBC using the information that it
Gateway downloaded from the FSM
4 SIP REGISTER (“Expires: 0”, “Contact: *” ) 4 Prior to registering with the IMS core, the FAP de-registers all contacts, associated
with the FAP IMPU after initialization, by sending a SIP REGISTER with “Expires: 0”
and “Contact: *”
5 SIP REGISTER (“Expires: 0”, “Contact: *” ) 5
6 200 OK 6
7 SIP REGISTER (“Expires: 0”, “Contact: *” ) 7 The IMS core performs a 3rd party registration (for registration/de-registration/re-
registration) with both the FAP’s home and standby CS clusters (to make the CS
clusters aware of the new Femtocell device in the network) and the Dual
Registration Server (DRS)
8 200 OK 8
9 SIP REGISTER (“Expires: 0”, “Contact: *” ) 9
10 200 OK 10
11 TCSx Acks contacts de-registration 11
12 200 OK 12
13 DRSx Acks contacts de-registration 13
14 200 OK 14
15 IMS core CSCFx Acks contacts de-registration 15
16 200 OK 16
17 IMS core CSCFx Acks contacts de-registration 17
18 SIP REGISTER (“Expires: 0”, 18 DRSx then formulates a new (de)registration request on behalf of the FAP and sends
“Contact: *” ) it to CSCFy. With DRS, load balancing between sites or a site failover should not
affect traffic in any way
19 200 OK 19


20 CSCFy updstes registration stauts 20 Note: the 3rd party registrations in Site y for the home and standby CS clusters are
of the FAP in Standby TCS suppressed. In other words the DRS is only used to register the FAP with the other
CSCF.
21 DRSy Acks contacts de-registration 21
22 200 OK 22
23 SIP REGISTER 23 FAP subsequently registers with the IMS core via the SBC using the information that
it downloaded from the FSM
24 SIP REGISTER 24
25 200 OK 25
26 SIP REGISTER 26 The IMS core performs a 3rd party registration (for registration/de-registration/re-
registration) with both the FAP’s home and standby CS clusters (to make the CS
clusters aware of the new Femtocell device in the network) and the Dual
Registration Server (DRS)
27 200 OK 27
28 SIP REGISTER 28
29 200 OK 29
30 TCSx Acks registration 30
31 200 OK 31
32 DRSx Acks registration 32
33 200 OK 33
34 IMS core CSCFx Acks registration 34
35 200 OK 35
36 IMS core CSCFx Acks registration 36
37 SIP REGISTER 37 DRSx then formulates a new (de)registration request on behalf of the FAP and sends
it to CSCFy. With DRS, load balancing between sites or a site failover should not
affect traffic in any way
38 200 OK 38
39 CSCFy updstes registration stauts

39 Note: the 3rd party registrations in Site y for the home and standby CS clusters are
of the FAP in Standby TCS suppressed. In other words the DRS is only used to register the FAP with the other
CSCF.
40 DRSy Acks registration 40
41 200 OK 41


42 42 Note: The FAP device maintains SIP registration with the IMS core regardless of
FAP device is registered with both CSCFx and CSCFy and with both its primary/active CSx cluster and its standby CSy cluster. whether any 1xRTT CDMA mobile stations are attached to it or not. In this respect
The FAP enables its radio transceiver, and is ready to accept attachments from CDMA 1xRTT MS’s FAP device registration with the IMS core network is decoupled and independent
from 1xRTT MS registration with the CS.
Femto 1xRTT MS Registration
43 Acess Parameter message (AUTH=1, RAND) 43 MS enters the FAP radio signal coverage and attempts to perform 1xRTT mobile
registration
44 Femto 1xRTT Registration Message (RGM (RANDC, ESN, IMSI, AUTHR, COUNT)) 44 MS sends RGM (RANDC, ESN, IMSI, AUTHR, COUNT )
45 Register (IMPI, IMPU) 45 FAP sends an IOS Location Updating Request as a MIME attachment in a SIP
MESSAGE. The SIP MESSAGE is constructed using the registration data (e.g.,
SIP MESSAGE (application/FemtoInterfaceMsg (IOS Location Updating Request, (IMSI/MIN, MEID/ESN, AUTHR, RAND, IMSI/MIN, MEID/ESN, AUTHR, RAND, RANDC, etc.) that it received
RANDC), P-Preferred-Identity), application/pidf+xml (PIDF-LO)) from the MS over the air interface. This originating SIP MESSAGE includes a “P-
Preferred-Identity” header field that contains the FAP-registered IMPU
In addition to the application/FemtoInterfaceMsg MIME that the FAP uses to carry

the IOS Location Updating Request, the FAP also includes a PIDF-LO object in an
application/pidf+xml MIME that contains the FAP device geographic (GPS)
coordinates.
46 200 OK 46
47 3rd Party SIP Register 47
48 200 OK 48
49 SIP MESSAGE (IOS Location Updating Request, (IMSI/MIN, MEID/ESN, 49 The registration is routed to the CS by the IMS core using the FAP IMS subscriber
AUTHR, RAND, RANDC), P-Preferred-Identity) service profile that includes an originating trigger (Initial Filter Criteria) for the SIP
MESSAGE detection point.
50 SIP MESSAGE (Location Updating Request) 50
51 200 OK 51
52 200 OK 52
53 The CS identifies the associated 53

FAP from the P-Asserted-Identity
header field and processes this MS
1xRTT registration SIP MESSAGE
regardless of the contents of the R-
URI. I.e. the CS assumes that all SIP
MESSAGE
requests that it receives are
intended to be processed by it.
54 REGNOT (MSCID, MSID, ESN, TRANSCAP, WINCAP, QUALCODE) 54


HLR Retrieves
55 TAL 55
56 REGNOT (TRIGADDRLIST) 56
57 SIP MESSAGE (IOS Location Updating Accept) 57 Once the CS successfully processes the SIP MESSAGE with IOS Location Updating
Request that it receives from the FAP on ingress, it sends the IOS Location Updating
Accept as a MIME attachment in a SIP MESSAGE back to
the FAP.
The CS populates the R-URI with the FAP-registered IMPU that is associated with
the registering 1xRTT MS that is attached to it in order for the IMS core to route the
SIP MESSAGE to the correct FAP destination.
58 200 OK 58
59 SIP MESSAGE (IOS Location Updating Accept) 59
60 200 OK 60
61 Femto 1xRTT Registration Accept Order 61
62 62
UE updates 1x
stack with
Femto
registration

eCSFB Call Scenario - Femto MO Call Ver 1.0
EPS CDMA
UE/MS eNB MME SGW PGW BSC IWS V-MSC MSC FAP TCS
UE Attach to E-UTRAN, Register with 1xRTT CS. UE indicates eCSFB support. It It sees FAP Access Parameter and registers with TC.
User initiates a circuit voice call. Callflow assumes idle case but the connected case is obvious.
If UE is in Idle State, Service Request Procedure
1 RA Preamble 1
2 RA Preamble Response (TimingAdvance, 2

UL Grant, and Temp C-RNTI)
3 RRC Connection Request (Cause=MO 3

Data, UE Contention Resolution Identity
MAC control element)
4 RRC Connection Setup (UE Contention 4

Resolution Identity)
5 RRC Connection Setup Complete (Extended Serive Request (CSFB Indicator)) 5
6 Initial UE message (ESR[CSFB]) 6
7 S1-UE Initial Context Setup Request 7
8 RRCConnectionReconfiguration (MeasurementConfiguration IE) 8
9 RRCConnectionReconfiguration Complete 9
10 S1-UE Initial Context Setup Response 10

EPS CDMA
11 MeasurementReport 11
12 Initial Context Setup Complete 12
13 HandoverFromE-UTRAPreparation Request (CDMA2000 Parameters) 13
a 1x stack a
receives 1x
Parameters. It
sends
GCSNA(ORM,
Ack_reqd=0)
to LTE stack
14 UL HandoverPreparationRequest (dedicatedInfoCDMA2000-1XRTT[GCSNA1xCircuitService(Origination)],MEID) 14
15 Uplink S1 CDMA2000 Tunneling (GCSNA1xCircuitService[Origination], HO Status) 15
16 S102[A21-1X Air Interface Signaling[GCSNA(Origination)]] 16
17 CM Service Request 17
a a
MSC determines based on Pilot
Report that the UE sees a femto
and invokes ECAM to femto.
18 Triggeres ECAM message 18
IWS creates
ECAM including
channel info.

EPS CDMA
19 S102[A21-1xAirInterfaceSignaling(GCSNA(ECAM),Status = HO Success)] 19
20 Downlink S1 CDMA2000 Tunneling[GCSNA(ECAM),HO Success] 20
21 MobilityFromEUTRA (targetRAT-Type cdma2000-1XRTT, cs-FallbackIndicator, purpose e-CSFB-r9, targetRAT- 21

MessageContainer[GCSNA(ECAM))
a 1x Stack a
receives
GCSNA(ECAM)
, and tunes to
the channel
and pilot
specified.
22 S1 UE Context Release Request(Cause=Redirection toward 1xRTT) 22
23 S1 UE Context Release Command 23
24 S1 UE Context Release Complete 24
25 Suspend Request 25
a Retune & Acquire 1X in Idle Substate . a
27 Origination 27
28 BSAck 28

EPS CDMA
30 Assignment Request 30
31 Extended Channel Assignment 31
a Acquires traffic channel. a
32 MSAck 32
33 Service Connect 33
34 Service Connect Complete 34
35 Assignment Complete 35
36 Call now 36
routes to
destination,
caller hears
ringback, and
far end
answers .
37 VP1: Voice path established 37

eCSFB Call Scenario - Femto MT Call (ISPAGE2) Ver 1.0
EPS CDMA
UE/MS eNB MME SGW PGW HSS BSC IWS V-MSC HLR I-MSC FAP TCS
UE Attach to E-UTRAN, Register with 1xRTT CS. UE indicates eCSFB support. It It sees FAP Access Parameter and registers with TCS.
User initiates a circuit voice call. Callflow assumes idle case but the connected case is obvious.
1 LOCREQ 1
2 ROUTEREQ 2
3 routreq[TLDN] 3
4 locreq [TLDN] 4
5 ISUP IAM (TLDN) 5
6 Determination that 6
UE is CSFB/LTE
attached
7 1xGPM 7
8 S102[A21-1X Air Interface Signalling(GCSNA[General Page])] 8
9 S102 [A21-Ack] 9
If UE is in Idle State, MME initiates Network Triggered Service Request
10 Paging 10
11 Paging 11
12 RA Preamble 12

EPS CDMA



16 RRCConnectionSetupComplete (Initial UE Message) 16
17 UL Information Transfer (Service Request) 17
18 UL NAS Transport (Service Request) 18
19 Authentication 19
20 UE Initial Context Setup Request 20
22 Downlink S1 CDMA2000 Tunneling (GCSNA 1xCircuitService[General Page]) 22
23 RRC-DL Information Transfer message (dedicatedInfoCDMA2000-1XRTT[GCNSA1xCircuitService(General Page)]) 23
24 RRC-UL Information Trasfer (Extended Serive Request (MT CSFB)) 24
25 Uplink NAS Transport (ESR) 25
26 S1-UE Context Modification Request (CSFB indicator) 26

EPS CDMA
eNB must configure the UE to

measure the femto channel
and/or consider the time it
takes for the UE to measure
when the pilot beacon is
hopped.
29 S1-UE Context Modification Response 29
32 UL Information Transfer (dedicatedInfoCDMA2000-1XRTT[GCSNA1xCircuitService(Page Response)]) 32
33 Uplink S1 CDMA2000 Tunneling (GCSNA1xCircuitService[Page Response]) 33
34 S102[A21-1X Air Interface Signaling[GCSNA(Page Response)]] 34
35 S102 [A21-Ack] 35
36 S102 App Checks for Femto 36

a Pilot and Power level in Mmt a
• Cancel any 1x repaging. Report.
• Start “Last page” timer
37 for ISPAGE Femto notification (new message) 37
• Peg appropriate OMs
We may need a delay here

to let TCS determine
38 ISPAGE2 (Listen Only (Ref. Cell ID)) 38
appropriate FAPs and send
page?

EPS CDMA
TCS uses Ref. Cell
39 S102[A21-1x Air Interface Signaling[GCSNA[ECAM; ASSIGN_MODE = 1]]] ID to determine 39
FAPs
40 S102 [A21-Ack] 40
41 Downlink S1 CDMA2000 Tunneling (GCSNA1xCircuitService[ECAM]) 41
42 DL Information Transfer (dedicatedInfoCDMA2000-1xRTT[GCSNACircuitService[ECAM]]) 42
a UE Acquires target FAP a
43 Page Response (resent) 43

• Lack of any “ispage2”
a response handled by FAP & TCS setup call a
normal paging code
44 ispage2 44
Remainder of flow is as per

a a
today’s behavior.
45 ISSETUP (InterMSCCircuitID) 45
46 issetup 46
47 ISANSWER 47
Connect with
a Original caller. a
48 ISUP ANM 48
49 isanswer 49
50 50

eCSFB Call Scenario - Femto NI Precise (ISPAGE2) Ver 1.0
EPS CDMA
UE/MS eNB MME SGW PGW PCRF HSS BSC IWS V-MSC HLR I-MSC FAP TCS PDR/SMSC PDE MPC LCS Client
UE Attach to E-UTRAN, Register with 1xRTT CS. UE indicates eCSFB support. It It sees FAP Access Parameter and registers with TCS.
Callflow assumes idle case but the connected case is obvious.
1 ISPOSREQ 1
2 SMSREQ (MPCID, MDN) 2
3 smsreq r/r 3
If the UE is found to be registered in Femto TCS, FAP lat/long is cached from TCS and sent back to the MPC
4 ISPOSREQ (MIN, IMSI, POSREQTYPE, PQCS) 4
5 isposreq (MPCAP, MOBINFO, SCELLID, MSCID, PCSINFO) 5
6 isposreq (POSINFO) 6
If the UE is found to be registered in 1xMSC, the postion reuest is sent to the 1xMSC
7 ISPOSREQ Invoke (Action Code 22) 7
8 1xGPM w/ SO35 8
9 1xGPM w/ SO35 9
T3113
10 S102[A21-1X Air Interface Signalling(GCSNA[General Page (SO35)])]) 10
11 S102 [A21-Ack] 11
If UE is in Idle State, MME initiates Network Triggered Service Request
12 Paging 12
13 Paging 13
14 RA Preamble 14


EPS CDMA

T3113
18 RRCConnectionSetupComplete (Initial UE Message) 18
19 UL Information Transfer (Service Request) 19
20 UL NAS Transport (Service Request) 20
21 Authentication 21
22 UE Initial Context Setup Request 22
24 Downlink S1 CDMA2000 Tunneling (GCSNA 1xCircuitService(1xGPM w/ SO 35)) 24
25 RRC-DL Information Transfer message (dedicatedInfoCDMA2000-1XRTT[(GCSNA 1xCircuitService(1xGPM w/ SO 35))]) 25
26 RRC-UL Information Trasfer (Extended Serive Request (MT CSFB)) 26
27 Uplink NAS Transport (ESR) 27
28 S1-UE Context Modification Request (CSFB indicator) 28
eNB must configure the UE to

measure the femto channel
and/or consider the time it
takes for the UE to measure
when the pilot beacon is
hopped.
31 S1-UE Context Modification Response 31

EPS CDMA
34 UL Information Transfer (dedicatedInfoCDMA2000-1XRTT[GCSNA1xCircuitService(Page Response)]) 34

T3113
35 Uplink S1 CDMA2000 Tunneling (GCSNA1xCircuitService[Page Response]) 35
36 S102[A21-1X Air Interface Signaling[GCSNA(Page Response)]] 36
37 S102 [A21-Ack] 37
S102 App Checks for Femto

38 Pilot and Power level in Mmt 38
Report.
• Cancel any 1x repaging.
• Start “Last page” timer
39 for ISPAGE Femto notification (new message) 39
• Peg appropriate OMs
We may need a delay here

40 to let TCS determine ISPAGE2 (Listen Only (Ref. Cell ID)) 40
appropriate FAPs and send
page?
TCS uses Ref. Cell
ID to determine
41 S102[A21-1x Air Interface Signaling[GCSNA[ECAM; ASSIGN_MODE = 1]]] FAPs 41
42 S102 [A21-Ack] 42
43 Downlink S1 CDMA2000 Tunneling (GCSNA1xCircuitService[ECAM]) 43
44 DL Information Transfer (dedicatedInfoCDMA2000-1xRTT[GCSNACircuitService[ECAM]]) 44
a UE Acquires target FAP a
45 Page Response (resent) 45
a FAP & TCS setup call a
46 If the IWS sees that the pilot list in the page response contains a strong femto pilot. Rather than 46
setting up a call, it directs the UE to the femto.
47 Release the UE, and 47

continue to perform
Femto NI Precise
LBS

EPS CDMA
48 ISPOSREQ (MIN, IMSI, POSREQTYPE, PQCS) 48
49 isposreq (MPCAP, MOBINFO, SCELLID, MSCID, PCSINFO) 49
51 After service ends, UE goes to inactive state. MMSS is triggered to select the best system. 51
52 If the IWS sees that the pilot list in the page response contains a strong macro pilot. It continues with regular NI Precise LBS on 1xRTT access. 52
53 HandoverFromE-UTRAPreparation Request (3G1x Overhead Parameters, RAND, con. HRPD HO (OFF)) 53
a 1X stack receives 1x a
parameters,
encapsulates 1xPRM
in 1xGCSNA and
sends to LTE stack.
T3113
54 UL HandoverPreparation Transfer (MEID, GCSNA(PRM)) 54
55 55
S1-UL S1 CDMA2000 Tunneling
(GCSNA(PRM), cdma2000 SectorID, RAND, CDMA2000 HO Required Indication, CDMA2000 1xRTT
SRVCC Info (Pilot List, Band Classes, MEID, CDMA 1xRTT Mobile Subscription Information))
56 S102 Direct Transfer: A21-1x Air Interface Signanling (GCSNA(PRM), RAN, Pilot List, CDMA2000 1xRTT Mobile Subscription Information) 56
57 Complete L3 Info: Paging Response T303 57
58 Assignment Request (CPI) T10 58
60 Handoff Required (CPI) 60
61 Handoff Request (CPI) 61

T11 T7
62 Handoff Request Ack 62
63 Handoff Command 63
64 Handoff Commenced 64
65 S102 Direct Transfer: A21-1x Air Interface Signanling (GCSNA(UHDM),GCSNA Status=HO Success) 1xRTT parameters) 65
66 S1-DL S1 CDMA2000 Tunneling (GCSNA(UHDM), CDMA2000 HO Status IE (Success)) 66
67 MobilityFromEUTRA (1xeCSFB ind, 1xRTT parameter, NO HRPD Redirection Info) 67

EPS CDMA
LTE stack extracts
a the GCSNA message a
and pass to 1X
stack, which tunes
UHDM.
68 S1 UE Context Release Request (Cause: CSFB) 68

T306 T9
69 Suspend Notification 69
a S1 UE Context Release Proceedure Depends on RRC a

(cause "Redirection toward 1xRTT" to connection re-
allow bearer suspension by EPC) establishement and
time to acquire 1x
71 1x Radio interface proceedure to acquire 1x traffic channel 71
72 Handoff Completion message 72
73 Handoff Complete 73
74 Clear Command T315 74
75 Clear Complete 75
76 Connect Order 76
77 Connect 77
78 isposreq r/r 78
79 GPOSREQ Invoke 79
80 Gposreq ack 80
81 IS-801 Session over TCH 81

LSDC/MPC returns
long/lat coordinates
82 gposreq r/r 82
to the LBS client via
LBS-GW
84 After 1x call ends, UE goes to inactive state. MMSS is triggered to select the best system. 84

eCSFB Call Scenario - S102 Redirection MME TAU Ver 1.0
EPS CDMA Notes

UE/MS eNB New MME Old MME New SGW Old SGW PGW PCRF HSS IWS 3GPP TS 23.272, 23.401
1 1x-Registration over old MME and establishment of S102 tunnel in ECM-CONNECTED state, followed by transition to ECM-IDLE state 1 UE performs 1x-registration over the source MME while in ECM-CONNECTED state,
followed by transition to ECM-IDLE state. The S102 tunnel exists between the source
MME and the 1xCS IWS.
2 2 UE perform Tracking Area Update with MME change while the UE is registered with
Trigger to
start TAU the 1xRTT CS domain for CSFB
3 TAU request 3 The UE initiates the TAU procedure by sending, to the eNodeB, a TAU Request (UE
Core Network Capability, old GUTI, last visited TAI, active flag, EPS bearer status, P
TMSI Signature, additional GUTI, eKSI, NAS sequence number, NAS-MAC, KSI, Voice
domain preference and UE's usage setting) message together with RRC parameters
4 TAU request 4 The eNodeB derives the new MME from the RRC parameters carrying the old
GUMMEI and the indicated Selected Network .
5 Context Request 5 The new MME uses the GUTI received from the UE to derive the old MME address,
and sends a Context Request (old GUTI, complete TAU Request message, P TMSI
Signature, MME Address, UE validated) message to the old MME to retrieve user
information.
6 Context Response 6 The old MME responds with a Context Response (IMSI, ME Identity (if available),
MSISDN, MM Context, EPS Bearer Context(s), Serving GW signalling Address and
TEID(s), ISR Supported, MS Info Change Reporting Action (if available), CSG
Information Reporting Action (if available), UE Time Zone, UE Core Network
Capability, UE Specific DRX Parameters) message.
7 Authentication / Security 7 If the integrity check of TAU Request message (sent in step 2) failed, then
authentication is mandatory.
8 Context Acknowledge 8 The new MME may also decide to relocate the Serving GW if a new Serving GW is
expected to serve the UE longer and/or with a more optimal UE to PDN GW path, or
if a new Serving GW can be co-located with the PDN GW.
the new MME sends a Context Acknowledge (Serving GW change indication)
message to the old MME
9 Create Session Request 9 The MME selected a new Serving GW it sends a Create Session Request (IMSI,
bearer contexts, MME Address and TEID, Type, the Protocol Type over S5/S8, RAT
type, Serving Network, UE Time Zone) message per PDN connection to the selected
new Serving GW.
10 Modify Bearer Request 10 The Serving GW informs the PDN GW(s) about the change by sending the message
Modify Bearer Request (Serving GW Address and TEID, RAT type, Serving Network)
per PDN connection to the PDN GW(s) concerned. User Location Information IE
and/or UE Time Zone IE and/or User CSG Information IE are also included if they are
present in previous step.
11 PCRF initiated IP-CAN Session Modification 11 If dynamic PCC is deployed, and RAT type information needs to be conveyed from the
PDN GW to the PCRF, then the PDN GW shall send RAT type information to the PCRF
by means of an IP CAN Session Modification procedure. The PDN GW does not need
to wait for the PCRF response, but continues in the next step.

eCSFB Call Scenario - S102 Redirection MME TAU Ver 1.0
12 Modify Bearer Response 12 The PDN GW updates its bearer contexts and returns a Modify Bearer Response
(MSISDN, Charging Id) message. The MSISDN is included if the PDN GW has it stored
in its UE context.
13 Create Session Response 13 The Serving GW updates its bearer context and returns a Create Session Response
(Serving GW address and TEID for user plane and control plane and PDN GW TEIDs
(for GTP-based S5/S8) or GRE keys (for PMIP-based S5/S8) for uplink traffic and
control plane) message to the new MME.
14 Update location 14 The new MME verifies whether it holds subscription data for the UE. If there are not,
it sends an Update Location Request (MME Identity, IMSI, ULR-Flags, MME
Capabilities, Homogeneous Support of IMS Over PS Sessions) message to the HSS.
ULR-Flags indicates that update location is sent from an MME and the MME
registration shall be updated in HSS.
15 Cancel location 15 The HSS sends the message Cancel Location (IMSI, Cancellation Type) to the old
MME with Cancellation Type set to Update Procedure.
16 Cancel location Ack 16 The old MME removes the MM context, and acknowledges with the message Cancel
Location Ack (IMSI).
17 Update location Ack 17 The HSS acknowledges the Update Location Request message by sending an Update
Location Ack (IMSI, Subscription Data) message to the new MME. If the Update
Location is rejected by the HSS, the new MME rejects the TAU Request from the UE
with an appropriate cause.
Tunnel redirection
18 S102 Redirection Command ( S102 A21 Event Notification message) 18 The target MME sends S102 Redirection Command message to the 1xCS IWS. After
receiving this message, the 1xCS IWS associates the S102 tunnel for this specific UE
with the target MME. Then the 1xCS IWS releases any context associated with the
old MME.
19 S102 Redirection Ack ( S102 A21 Event Notification message) 19 In response to the S102 Redirection Command message, the 1xCS IWS sends a S102
Redirection Ack message to the target MME.
20 Delete Session Request 20 Since the MME has changed, when the timer started in step 5 expires the old MME
releases any local MME bearer resources and if it received the Serving GW change
indication in the Context Acknowledge message, the old MME deletes the EPS
bearer resources by sending Delete Session Request (Cause) messages to the old
Serving GW. Cause indicates to the old Serving GW that the old Serving GW shall not
initiate a delete procedure towards the PDN GW.
21 Delete Session Response 21 The Serving GW acknowledges with Delete Session Response (Cause) messages. The
Serving GW discards any packets buffered for the UE.
22 TAU Accept 22 The new MME sends a TAU Accept (GUTI, TAI list, EPS bearer status, NAS sequence
number, NAS-MAC, IMS Voice over PS session supported, Emergency Service Support
indicator, LCS Support Indication) message to the UE.
23 TAU Complete 23 If GUTI was included in the TAU Accept, the UE acknowledges the received message
by returning a TAU Complete message to the MME.

eCSFB Call Scenario - S102 Redirection eNB MME S1 HO Ver 1.0
EPS CDMA
Source Target Source Target Source Target
UE/MS PGW PCRF HSS IWS
eNB eNB MME MME SGW SGW
1 1x-Registration over old MME and establishment of S102 tunnel in ECM-CONNECTED state. 1
2 2. Downlink User plane data 2
3 Decision to trigger 3
relocation via S1
4 4. Handover Required 4
Source MME provides the 1xCS IWS ID to
5 Forward Relocation Request 5
Target MME in Forward Relocation Request
6 Create Session Request 6
7 Create Session Response 7
8 Handover Request 8
9 Handover Request Acknowledge 9
10 Create Indirect Data Forwarding Tunnel Request 10
11 Create Indirect Data Forwarding Tunnel Response 11
12 Forward Relocation Response 12
13 Create Indirect Data Forwarding Tunnel Request 13
14 Create Indirect Data Forwarding Tunnel Response 14
15 Handover Command 15
16 Handover Command 16
17 eNB Status Transfer 17
18 Forward Access Context Notification 18
19 Forward Access Context Acknowledge 19
20 eNB Status Transfer 20
21a 21 a. Only for Direct forwarding of data 21a
21b 21 b. Only for Indirect forwarding of data 21b
22 Detach from old cell and 22

synchronize to new cell

EPS CDMA
23 Handover Confirm 23
24 Downlink Data 24
25 Uplink User Plane Data 25
26 Handover Notify 26
27 Forward Relocation Complete Notification 27
28 Forward Relocation Complete Acknowledge 28
29 Modify Bearer Request 29
31 Modify Bearer Response 31
33 Downlink User Plane Data 33
Tunnel redirection
34 S102 Redirection Command 34
35 S102 Redirection Command Ack 35
36 TAU request 36
37 TAU request 37
38 Context Request 38
39 Context Response 39
40 Authentication / Security 40
41 Context Acknowledge 41
42 Create Session Request 42
44 PCRF initiated IP-CAN Session Modification 44
46 Create Session Response 46
47 Update location 47

EPS CDMA
48 Cancel location 48
49 Cancel location Ack 49
50 Update location Ack 50
51 Delete Session Request 51
52 UE Context Release Command 52
53 UE Context Release Complete 53
54 Delete Session Response 54
55 TAU Accept 55
56 TAU Complete 56
57 Delete Indirect Data Forwarding Tunnel Request 57
58 Delete Indirect Data Forwarding Tunnel Response 58
59 Delete Indirect Data Forwarding Tunnel Request 59
60 Delete Indirect Data Forwarding Tunnel Response 60

eCSFB Call Scenario - UE-Triggered Service Request Ver 1.0
EPS Notes
UE/MS eNB MME SGW PGW PCRF HSS PDE 3GPP TS 23.272, 23.401
1 1 The UE attaches to E-UTRAN, completed the registration with the 1x network, and
UE Attach to E-UTRAN, Register with 1xRTT CS through S102. UE indicates support eCSFB.
Note: 1xRTT registration is not required for Data services on LTE. This informaiton is
included for consistency with the use of eCSFB capable UEs.
2 UE 2 A trigger causes the UE to initate Service Request (SR)

Triggers
SR
Procedur.
3 If UE is in Idle State, Service Request Procedure 3 If the UE is in Idle mode, RACH procedure is initiated
eNodeB.
element) element .
e RRC Connection Setup Complete (Service Request) e The UE sends an RRC-Connection Setup Complete message. This message contains

eCSFB Call Scenario - UE-Triggered Service Request Ver 1.0
4 Authentication 4
is invoked to activate integrity protection and NAS ciphering occurs for all NAS
messages.
5 S1-UE Initial Context Setup Request 5 The MME sends the S1-Initial Context Request message to the eNodeB., contains the
6 RRCConnectionReconfiguration 6 The eNodeB sets up the Radio bearers based on the S1-Initial Context Request. It
8 S1-UE Initial Context Setup Response 8 The eNodeB sends an S1-Initial Context Response message to indicate which of the E-
9 Modify Bearer Request 9 The MME sends a Modify Bearer Request message (eNodeB address, S1
TEID(s) (DL) for the accepted EPS bearers, Delay Downlink Packet
Notification Request, RAT Type) per PDN connection to the Serving GW.
The Serving GW is now able to transmit downlink data towards the UE.
10 Modify Bearer Request 10 If the RAT Type has changed compared to the last reported RAT Type or if
the UE's Location and/or Info IEs and/or UE Time Zone are present in step
8, the Serving GW shall send the Modify Bearer Request message (RAT
Type) per PDN connection to the PDN GW.
11 PCRF initiated IP-CAN Session Modification 11 If dynamic PCC is deployed, the PDN GW interacts with the PCRF to get the
PCC rule(s) according to the RAT Type by means of a PCEF initiated IP
CAN Session Modification procedure
12 Modify Bearer Response 12 The PDN GW sends the Modify Bearer Response to the Serving GW
13 Modify Bearer Response 13 The Serving GW sends a Modify Bearer Response to the MME

eCSFB Call Scenario - S1-Release Ver 1.0
EPS Notes
UE/MS eNB MME SGW PGW 3GPP TS 23.272, 23.401
1 S1-AP: S1 UE Context Release Request 1 The eNodeB detects a need to release the UE's signalling connection and
all radio bearers for the UE, due to 1xCSFB. The eNodeB sends an S1 UE
Context Release Request (Cause=CSFB) message to the MME.
2 Release Access Bearer Request 2 The MME sends a Release Access Bearers Request message to the S
GW that requests the release of all S1-U bearers for the UE. This message
is triggered either by an S1 Release Request message from the eNodeB.
3 Release Access Bearer Response 3 The S GW releases all eNodeB related information (address and TEIDs) for
the UE and responds with a Release Access Bearers Response message
to the MME. Other elements of the UE's S GW context are not affected.
The S GW retains the S1-U configuration that the S GW allocated for the
UE's bearers. The S GW starts buffering downlink packets received for the
UE and initiating the "Network Triggered Service Request" procedure,
described in clause 5.3.4.3, if downlink packets arrive for the UE
4 S1-AP: S1 UE Context Release Command 4 The MME releases S1 by sending the S1 UE Context Release Command
(Cause) message to the eNodeB.
5 RRC Connection Release 5 If the RRC connection is not already released, the eNodeB sends a RRC
Connection Release message to the UE in Acknowledged Mode . Once
the message is acknowledged by the UE, the eNodeB deletes the UE's
context.
6 S1-AP: S1 UE Context Release Complete 6 The eNodeB confirms the S1 Release by returning an S1 UE Context
Release Complete message to the MME. With this, the signalling
connection between the MME and the eNodeB for that UE is released. This
step shall be performed promptly after step 4, e.g. it shall not be delayed
in situations where the UE does not acknowledge the RRC Connection
Release.
7 7 The MME deletes any eNodeB related information (address and TEIDs)
from the UE's MME context, but, retains the rest of the UE's MME context
including the S GW's S1-U configuration information (address and TEIDs) .
All non-GBR EPS bearers established for the UE are preserved in the MME
and in the Serving GW.
8 8 To complete the CSFB bearer release and deactivation procedure, the MME
triggers the MME Initiated Dedicated Bearer Deactivation procedure
(clause 5.4.4.2) for the GBR bearer(s) of the UE after the S1 Release
procedure is completed.

eCSFB Call Scenario - MME Dedicated Bearer Deactivate Ver 1.0
EPS Notes
UE/MS eNB MME SGW PGW (PCEF) PCRF HSS AF Charge 3GPP TS 23.272, 23.203, 23.401
0 Radio Bearer Release eNodeB instructs the UE to fallback to 1xRTT to receive service
1 Indication of Bearer Release 1 The eNodeB releases radio bearers in step 0, and sends an S1-UE Context
Release Request to the MME as an indication of bearer release
2 Delete Bearer Command 2 The MME sends the Delete Bearer Command (EPS Bearer Identity)
message per PDN connection to the Serving GW to deactivate the selected
dedicated bearer.
3 Delete Bearer Command 3 The Serving GW sends the Delete Bearer Command (EPS Bearer
Identity) message per PDN connection to the PDN GW
4 PCEF Inititated IP-CAN Session Modification (PCC deployed) 4 If PCC infrastructure is deployed, the PDN GW informs the PCRF about the
loss of resources by means of a PCEF-initiated IP CAN Session
Modification procedure as defined in TS 23.203 [6]. The PCRF sends a
updated PCC decision to the PDN GW
a Indication of IP-CAN Session Modification a
b Correlate b
App/Service Info
with IP-CAN session
c Event Report c
d Ack and new App/Service info d
e Policy Decision e
f Acknolwege IP-CAN Session Modification f
g Credit Request g
h Credit Response h
i Provision Ack i
j Notification of Bearer Level Event
k Level Event Ack

eCSFB Call Scenario - MME Dedicated Bearer Deactivate Ver 1.0
5 Delete Bearer Request 5 The PDN GW sends a Delete Bearer Request (EPS Bearer Identity)
message to the Serving GW
6 Delete Bearer Request 6 The Serving GW sends the Delete Bearer Request (EPS Bearer Identity)
message to the MME.
7 Delete Bearer Response 7 The MME deletes the bearer contexts related to the deactivated EPS bearer
and acknowledges the bearer deactivation to the Serving GW by sending a
Delete Bearer Response (EPS Bearer Identity) message
8 Delete Bearer Response 8 The Serving GW deletes the bearer context related to the deactivated EPS
bearer and acknowledges the bearer deactivation to the PDN GW by
sending a Delete Bearer Response (EPS Bearer Identity) message

eCSFB Call Scenario - 1x to LTE Reselection Ver 1.0
EPS CDMA Notes

UE/MS eNB New MME Old MME New SGW Old SGW PGW PCRF HSS AF Charge 1xBTS BSC IWS MSC VLR/HLR 3GPP TS 23.272, 23.401
1xRTT UE/MS Initated Call Clear
Release Order 1 The MS initiates call clearing by transmitting a Release Order over the
1 reverse traffic channel.
2 Abis-IS-2000 FCH Rvs (Release Order) 2
Clear Request 3 The BS then sends the Clear Request message to the MSC to initiate the
T300 call clear transaction. Timer T300 is started by the BS
3
Clear Command 4 The MSC sends a Clear Command message to the BS to instruct the BS
to release the associated dedicated resource (such as terrestrial circuit)
4 and starts timer T315. The BS stops timer T300
5 Abis-IS-2000 FCH Fwd (Release Order) 5
Release 6 In response to the Clear Command message, the BS releases the

terrestrial circuit, if allocated. The BS then acknowledges the MS by
sending it a release over the forward traffic channel and releases the radio
6 resource.
7 Abis-Remove T315 7
8 Abis-Remove Ack 8
9 Abis-BTS Release Ack 9
Clear Complete 10 The BS returns a Clear Complete message to the MSC. The MSC stops
timer T315 upon receipt of the Clear Complete message. The MSC releases
10 the underlying transport connection.
UE Performs LTE TAU
11 TAU request 11 The UE initiates the TAU procedure by sending, to the eNodeB, a TAU Request (UE
Core Network Capability, old GUTI, last visited TAI, active flag, EPS bearer status, P
TMSI Signature, additional GUTI, eKSI, NAS sequence number, NAS-MAC, KSI, Voice
domain preference and UE's usage setting) message together with RRC parameters
12 TAU request 12 The eNodeB derives the new MME from the RRC parameters carrying the old
GUMMEI and the indicated Selected Network .
13 Context Request 13 The new MME uses the GUTI received from the UE to derive the old MME address,
and sends a Context Request (old GUTI, complete TAU Request message, P TMSI
Signature, MME Address, UE validated) message to the old MME to retrieve user
information.
14 Context Response 14 The old MME responds with a Context Response (IMSI, ME Identity (if available),
MSISDN, MM Context, EPS Bearer Context(s), Serving GW signalling Address and
TEID(s), ISR Supported, MS Info Change Reporting Action (if available), CSG
Information Reporting Action (if available), UE Time Zone, UE Core Network Capability,
UE Specific DRX Parameters) message.
15 Authentication / Security 15 If the integrity check of TAU Request message (sent in step 2) failed, then
authentication is mandatory.

16 Context Acknowledge 16 The new MME may also decide to relocate the Serving GW if a new Serving GW is
expected to serve the UE longer and/or with a more optimal UE to PDN GW path, or if
a new Serving GW can be co-located with the PDN GW.
the new MME sends a Context Acknowledge (Serving GW change indication) message
to the old MME
17 Create Session Request 17 The MME selected a new Serving GW it sends a Create Session Request (IMSI, bearer
contexts, MME Address and TEID, Type, the Protocol Type over S5/S8, RAT type,
Serving Network, UE Time Zone) message per PDN connection to the selected new
Serving GW.
18 Modify Bearer Request 18 The Serving GW informs the PDN GW(s) about the change by sending the message
Modify Bearer Request (Serving GW Address and TEID, RAT type, Serving Network)
per PDN connection to the PDN GW(s) concerned. User Location Information IE
and/or UE Time Zone IE and/or User CSG Information IE are also included if they are
present in previous step.
19 PCRF initiated IP-CAN Session Modification 19 If dynamic PCC is deployed, and RAT type information needs to be conveyed from the
PDN GW to the PCRF, then the PDN GW shall send RAT type information to the PCRF
by means of an IP CAN Session Modification procedure. The PDN GW does not need
to wait for the PCRF response, but continues in the next step.
20 Modify Bearer Response 20 The PDN GW updates its bearer contexts and returns a Modify Bearer Response
(MSISDN, Charging Id) message. The MSISDN is included if the PDN GW has it stored
in its UE context.
21 Create Session Response 21 The Serving GW updates its bearer context and returns a Create Session Response
(Serving GW address and TEID for user plane and control plane and PDN GW TEIDs (for
GTP-based S5/S8) or GRE keys (for PMIP-based S5/S8) for uplink traffic and control
plane) message to the new MME.
22 Update location 22 The new MME verifies whether it holds subscription data for the UE. If there are not,
it sends an Update Location Request (MME Identity, IMSI, ULR-Flags, MME
Capabilities, Homogeneous Support of IMS Over PS Sessions) message to the HSS. ULR-
Flags indicates that update location is sent from an MME and the MME registration
shall be updated in HSS.
23 Cancel location 23 The HSS sends the message Cancel Location (IMSI, Cancellation Type) to the old MME
with Cancellation Type set to Update Procedure.
24 Cancel location Ack 24 The old MME removes the MM context, and acknowledges with the message Cancel
Location Ack (IMSI).
25 Update location Ack 25 The HSS acknowledges the Update Location Request message by sending an Update
Location Ack (IMSI, Subscription Data) message to the new MME. If the Update
Location is rejected by the HSS, the new MME rejects the TAU Request from the UE
with an appropriate cause.
26 Delete Session Request 26 Since the MME has changed, when the timer started in step 5 expires the old MME
releases any local MME bearer resources and if it received the Serving GW change
indication in the Context Acknowledge message, the old MME deletes the EPS bearer
resources by sending Delete Session Request (Cause) messages to the old Serving
GW. Cause indicates to the old Serving GW that the old Serving GW shall not initiate a
delete procedure towards the PDN GW.
27 Delete Session Response 27 The Serving GW acknowledges with Delete Session Response (Cause) messages. The
Serving GW discards any packets buffered for the UE.

28 TAU Accept 28 The new MME sends a TAU Accept (GUTI, TAI list, EPS bearer status, NAS sequence
number, NAS-MAC, IMS Voice over PS session supported, Emergency Service Support
indicator, LCS Support Indication) message to the UE.
29 TAU Complete 29 If GUTI was included in the TAU Accept, the UE acknowledges the received message
by returning a TAU Complete message to the MME.
UE may see need to perform 1x re-registration
30 SIB-8 30 The LTE stack on the UE receives the SIB-8 from the eNodeB and passes it to the 1x
stack.
31 UE 31 Based on the contents of CSFB-RegistrationParam1xRTT IE , the 1x stack decides to

decision perform a registration.
to register
in 1xRTT
32 1x Stack 32 If the UE is in Idle State , trigger from the 1x stack initiates sending a Service Request
requests 1x (SR) message to the RRC layer.
Parameters
eNodeB.
element)
e RRC Connection Setup Complete (Serive Request) e The UE sends an RRC-Connection Setup Complete message. This message contains
f S1-Initial UE message (Service Request) f The eNodeB extracts the Service-Request NAS message and sends it to the MME in an
S1-Initial UE message.
g S1-UE Initial Context Setup Request g The MME sends the S1-Initial Context Request message to the eNodeB., contains the
h RRCConnectionReconfiguration h The eNodeB sets up the Radio bearers based on the S1-Initial Context Request. It
i RRCConnectionReconfiguration Complete i The UE responds with an RRC-Radio Reconfiguration Complete message.
j S1-UE Initial Context Setup Response j The eNodeB sends an S1-Initial Context Response message to indicate which of the E-
34 CSFBParameterRequestCDMA2000 34 The UE sends a CSFBParametersrequestCDMA2000 to retrieve the 1x parameters

needed by the 1x stack to construct the 1xRGM. This message is sent in response to
the 1x parameters request from the 1x stack to the LTE stack.

35 CSFBParameterResponse (RAND, mobilityParameterC2K) 35 The eNodeB responds with the CSFBParametersResponseCDMA2000 that contains
the 1x parameters, including the AUTH and RAND values.
1xRTT Registration Request

36 1x Stack 36 * The 1x stack constructs the 1x Registration Message (1xRGM). It encapsulates it in a
sends GCSNA 1x Circuit Service message and sends it to the LTE stack for transmission.
1xRGM to
LTE stack in
GCSNA
1xCircuit
Srvi cee
37 RRC-UL Information Transfer (GCSNA Circuit Service (1xRGM)) 37 The LTE stack encapsulates the GCSNA message in a UL-Info Transfer message and
38 S1-UL S1 CDMA2000 Tunelling (GCSNA Circuit Service (1xRGM), CDMA2000 Reference Cell ID) 38 The eNodeB passes the GCSNA (1xRGM) in S1 CDMA2000 Tunelling message without
39 S102 Direct Transfer: A21-1x Air Interface Signaling message (GCSNA (1xRGM)) 39 Based on the CDMA2000 Reference Cell ID , the MME selects the IWS. It encapsulates
UEs.
40 Complete Layer 3 40 The IWS extracts the 1x RGM and forms the A1-Location Updating Request message,
Information (Location places it in the Complete Layer 3 Information message, and sends to the MSC. 1xRTT
Updating Request) CS registration is then performed by the 1xCS IWS node based on 3GPP2 A.S0008
41 Location Updating Accept 41 MSC sends a Location Updating Accept message to the IWS to indicate that the
Location Updating Request message has been processed.
42 S102 Direct Transfer (IMSI, A21-1x Air Interface Signaling message (GCSNA (Registration 42 * IWS sends a GCSNA encapsulated Registration Accepted Order to the MS/UE over
Accepted Order ), GCSNAL2Ack) the 3GPP Evolved Packet System (EPS) to acknowledge the registration
* Since the UE has set the Ack_reqd bit to 1 in GCSNA, the IWS responds with an A21
message containing the GCSNAL2Ack. 1xRTT CS registration response is tunnelled
back to the MME in a S102 Direct Transfer message (IMSI, 1xCS)
* The GCSNAL2Ack is used instead of BSC-Ack to conclude that the registration was
successful.
43 S1-UL S1 CDMA2000 Tunelling (GCSNA (Registration Accepted Order ), GCSNAL2aAck)) 43 The MME delivers the GCSNA message to the eNodeB in S1: DL S1 CDMA2000
Tunneling message.
RRC-DL Information Transfer (GCSNA (Registration Accepted Order ), GCSNAL2Ack)
44 44 * The eNodeB uses a RRC-DL-Info Transfer message to tunnel the content received
LTE Stack from MME without any interpretation.
extracts
GCSNAL2Ack,
and * The LTE stack extracts the GCSNAL2Ack and sends it to the 1x stack
registration
response and * The 1x stack updates its registration status.
sends to 1x
stack,w hich
updates its
registration
status.

eCSFB Call Scenario - UE-Init Power Down Detach ACTV Ver 1.0
EPS CDMA
UE/MS eNB MME SGW PGW (PCEF) PCRF HSS AF SPR IWS MSC VLR/HLR
1xRTT Pre-registered eCSFB UE performs Power-Down Registration per 1xRTT CS via S102 Tunnel C.S0005-E v3.0
1 1
Decision to
power off
2 2. 1xRTT Power Down Registration 2

GCSNA Power Down Registration
S102: A21-1x air interface signaling message: GCSNA Power Down Registration
a,b,c a. UL RRC b. UL S1 c. S102 Direct Transfer a,b,c
Informationcdma2000
3 Transfer Tunnelling Location Update Request 3
4 Location Update Response (Release Indicator) 4
5 1xRTT Power Down Registration Response 5

S102: A21-1x air interface signaling message: GCSNA Power Down Registration Acknowledge
Acknowledge
a,b,c c. DL RRC b. DL S1 a. S102 Direct Transfer a,b,c
Informationcdma2000
Transfer Tunnelling
eCSFB UE Performs LTE Detach

6 Detach Request 6
11 PCEF Inititated IP-CAN Session Termination 11

a Indication of IP-CAN Session Termination a
b Identify affected b
Policy &
Charging Rules

eCSFB Call Scenario - UE-Init Power Down Detach ACTV Ver 1.0
NOTE : GTP based

c Remove all c
S5/S8
Policy &
d Charging Rules Notify loss of transmission d
e Notify response e
f Acknolwege IP-CAN Session Termination f

g Cancel Subscribed Notification Request Charging system not included g
h Cancel Subscribed Notification Response h
12 Detach Accept
13 Singalling Connection Release

eCSFB Call Scenario - UE-Init Power Down Detach IDLE Ver 1.0
TOC
EPS CDMA
UE/MS eNB MME SGW PGW (PCEF) PCRF HSS AF SPR IWS MSC VLR/HLR
UE is in IDLE Mode
1 Decision to 1
power off
2 CSFBParameterRequestCDMA2000 2

a RA Preamble a
b RA Preamble Response b
c RRC Connection Request c
d RRC Connection Setup d
e RRC Connection Setup Complete (Serive Request) e
f Initial UE message (Service Request) f
g S1-UE Initial Context Setup Request g
h RRCConnectionReconfiguration h
i RRCConnectionReconfiguration Complete i
j S1-UE Initial Context Setup Response j
4 CSFBParameterResponse (RAND, mobilityParameterC2K) 4
1xRTT Pre-registered eCSFB UE performs Power-Down Registration per 1xRTT CS via S102 Tunnel C.S0005-E v3.0
5 2. 1xRTT Power Down Registration 5

S102: A21-1x air interface signaling message: GCSNA Power Down Registration
a,b,c a. UL RRC b. UL S1 c. S102 Direct Transfer a,b,c
Informationcdma2000
6 Transfer Tunnelling Location Update Request 6
7 Location Update Response (Release Indicator) 7

eCSFB Call Scenario - UE-Init Power Down Detach IDLE Ver 1.0
8 1xRTT Power Down Registration Response 8

S102: A21-1x air interface signaling message: GCSNA Power Down Registration Acknowledge
Acknowledge
a,b,c c. DL RRC b. DL S1 a. S102 Direct Transfer a,b,c
Informationcdma2000
Transfer Tunnelling
eCSFB UE Performs LTE Detach

9 Detach Request 9
14 PCEF Inititated IP-CAN Session Termination 14

a Indication of IP-CAN Session Termination a
b b
Identify affected
Policy &
Charging Rules
NOTE : GTP based
c S5/S8 Remove all c
Policy &
d Charging Rules Notify loss of transmission d
e Notify response e
f Acknolwege IP-CAN Session Termination f

g Cancel Subscribed Notification Request Charging system not included g
h Cancel Subscribed Notification Response h
15 Detach Accept 15
16 Singalling Connection Release 16

eCSFB Call Scenario - MO or MT Call Rejected by MME Ver 1.0
TOC
EPS
UE/MS eNB MME SGW PGW (PCEF)
UE Attach to E-UTRAN, Register with 1xRTT CS. UE indicates 1

1
support eCSFB
2 Decision to 2
perform MO
Call in 1xRTT or
accept 1xCS
page message
3 Extended Service Request 3
4 Service Reject 4
5 5
UE Selects
1xRTT
access w/o
waiting RRC
release
6 S1 UE Context Release Command 6
7 7
eNodeB triggers RRC
Connection Release
8 S1 UE Context Release Complete 8
9 Update Bearer(s) Request 9
10 Update Bearer(s) Response 10

eCSFB Call Scenario - MO eCSFB Call Setup Failure Ver 1.0
TOC
EPS CDMA
UE/MS eNB MME SGW PGW (PCEF) IWS MSC VLR/HLR
1 UE Attach to E-UTRAN, Register with 1xRTT CS. UE indicates support eCSFB 1
2 Decision to 2
perform MO
Call in 1xRTT
3 Extended Service Request 3
4 UE Context Modification Request / initial UE Context Request 4
5 UE Context Modification Response / initial UE Context Response 5
6 Optional 6
measurement
report solicitation
7 HandoverFromE-UTRAPreparation Request 7
(3G1x Overhead Parameters, RAND, con. HRPD HO (OFF))
8 UL HandoverPreparation Transfer 8
(1xRTT Origination message)
9 UL S1 cdma2000 tunneling 9
10 S102:A21-1x air interface signanling (GCSNA: 10

Origination)
T303
12 Assignment Request 12
T10

eCSFB Call Scenario - MO eCSFB Call Setup Failure Ver 1.0
The IWS initiates a hard

14 handoff of the MS/UE to a Hard 14
1xBS. However, a hard handoff Handoff
failure occurs. (i.e., a Handoff
Required Reject message is
received or timer T7 expires).
15 Clear Request 15
14. S102:A21-1x air interface signanling
16 16
(GCSNA: Release Order)
GCSNA: Release
Order
17 DL S1 cdma2000 tunneling T300 17
18 DL Information Transfer 18
19 Clear Command 19
T315
20 Clear Complete 20

eCSFB Call Scenario - Change Record Ver 1.0
TOC
Version Change Changed by Date Reason for change

eCSFB-Call Flow Scenarios-08.17.2012

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

eCSFB-Call Flow Scenarios-08.17.2012

Uploaded by

Copyright:

Available Formats

eCSFB Call Scenarios

Ver 1.0 Accompanies eCSFB Detailed Requirement Document 1/113

Ver 1.0 Accompanies eCSFB Detailed Requirement Document 2/113

3 Identification Response (IMSI, MM Context) 3

4 Identity Response (IMSI) 4 The UE responds with Identity Response (IMSI) .

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 3/113

b Security command Response b

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 4/113

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 5/113

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 6/113

NOTE : PCEF interaction with

First Downlink Data (if not handover)

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 7/113

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 8/113

b Modify Bearer Response b The PDN GW acknowledges Serving GW

26 First Downlink Data 26

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 9/113

EPS CDMA Notes

3 UE 3 Based on the contents of CSFB-RegistrationParam1xRTT IE , the 1x stack decides to

5 If UE is in Idle State, Service Request Proceedure 5

i RRCConnectionReconfiguration Complete i The UE responds with an RRC-Radio Reconfiguration Complete message.

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 10/113

EPS CDMA Notes

6 CSFBParameterRequestCDMA2000 6 The UE sends a CSFBParametersrequestCDMA2000 to retrieve the 1x parameters

1xRTT Registration Request

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 11/113

EPS CDMA Notes

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 12/113

EPS CDMA Notes

** The eNodeB can request measurement of one 1x band/carrier in the measurement

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 13/113

EPS CDMA Notes

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 14/113

EPS CDMA Notes

30 S1 UE Context Release Procedure 30

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 15/113

EPS CDMA Notes

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 16/113

EPS CDMA Notes

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 17/113

EPS CDMA Notes

** The eNodeB can request measurement of one 1x band/carrier in the measurement

8 RRCConnectionReconfiguration Complete 8 The UE responds with an RRC-Radio Reconfiguration Complete message.

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 18/113

EPS CDMA Notes

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 19/113

EPS CDMA Notes

27 S1 UE Context Release Request (Cause: CSFB to 1xRTT) T306

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 20/113

EPS CDMA Notes

** The eNodeB can request measurement of one 1x band/carrier in the measurement

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 21/113

EPS CDMA Notes

16 S1 UE Context Release Procedure 16

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 22/113

EPS CDMA Notes

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 23/113

EPS CDMA Notes

** The eNodeB can request measurement of one 1x band/carrier in the measurement

8 RRCConnectionReconfiguration Complete 8 The UE responds with an RRC-Radio Reconfiguration Complete message.

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 24/113

EPS CDMA Notes

Ahmad Sultan Accompanies eCSFB Detailed Requirement Document 25/113