B - 01 - TD-LTE Signaling Flow and Message Analysis Guide

Operator Logo
TD-LTE Signaling Flow and

Message Analysis Guide
R1.0
TD-LTE Signaling Flow and Message Analysis Guide R1.0 Internal Use Only▲
LEGAL INFORMATION
By accepting this certain document of ZTE CORPORATION you agree to the following terms. If you
do not agree to the following terms, please notice that you are not allowed to use this document.
Copyright © 2023 ZTE CORPORATION. Any rights not expressly granted herein are reserved. This
document contains proprietary information of ZTE CORPORATION. Any reproduction, transfer,
distribution, use or disclosure of this document or any portion of this document, in any form by any
means, without the prior written consent of ZTE CORPORATION is prohibited.
and are registered trademarks of ZTE CORPORATION. ZTE’s company name, logo
and product names referenced herein are either trademarks or registered trademarks of ZTE
CORPORATION. Other product and company names mentioned herein may be trademarks or trade
names of their respective owners. Without the prior written consent of ZTE CORPORATION or the
third party owner thereof, anyone’s access to this document should not be construed as granting,
by implication, estopped or otherwise, any license or right to use any marks appearing in the
document.
The design of this product complies with requirements of environmental protection and personal
security. This product shall be stored, used or discarded in accordance with product manual,
relevant contract or laws and regulations in relevant country (countries).
This document is provided “as is” and “as available”. Information contained in this document is
subject to continuous update without further notice due to improvement and update of ZTE
CORPORATION’s products and technologies.
ZTE CORPORATION
Address: NO. 55
Hi-tech Road South
ShenZhen
P.R.China
518057
Website: http://support.zte.com.cn
Email: doc@zte.com.cn
ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. I

Revision History
Product Version Document Version Document SN Remarks
Author
Document
Written on Written by Reviewed by Approved by
Version
1.0 2011-02-25 Li Yi Yuan Haijun
ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. II

Applicable to: TD-LTE network optimization personnel
Prerequisites: The readers need to have a good command of the knowledge and skills
mentioned in the table below:
SN Knowledge and Skills Reference Materials
1 LTE theories LTE Theory and Key Technologies
LTE network parameter
2 Network Coverage Optimization Guide
optimization
3
Follow-up Document: The readers need to read the reference materials mentioned in
the table below after finishing this document:
SN Reference Materials Remarks
This guide gives an overview of basic LTE parameters
LTE Radio Parameter
1 and provides instructions on how to modify these
Configuration Guide
parameters.
This guide describes the network optimization workflow
LTE Engineering Optimization and explains solutions for some common problems, such
2
Guide as problems related to the access, handover and call
drop.
3
ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. III
About This Document
Abstract
This document begins with the description of the LTE network architecture and the interfaces in it and
then penetrates into the explanation of the LTE signaling flow.
Chapter Description
1 TD-LTE Network Architecture This chapter explains the TD-LTE network architecture
and the interfaces in this architecture. It also provides
some knowledge of the related protocol.
Error: Reference source not found This chapter describes and explains the whole signaling
Analysis of Signaling Flow flow.
ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. IV

TABLE OF CONTENTS
1 TD-LTE Network Architecture..........................................................................1

1.1 Functions of EPC and E-UTRAN........................................................................2
1.2 Protocol Model for Interfaces in E-UTRAN..........................................................4
1.3 Interface S1.........................................................................................................4
1.3.1 User Plane of Interface S1.............................................................................5
1.3.2 Control Plane of Interface S1.........................................................................6
1.4 Interface X2.........................................................................................................7
1.4.1 User Plane of Interface X2.............................................................................7
1.4.2 Control Plane of Interface X2.........................................................................8
2 Analysis of Signaling Flow...............................................................................9

2.1 Attachment Flow after UE Power-on...................................................................9
2.1.1 Attachment Flow in Normal Conditions..........................................................9
2.1.2 Attachment Flow in Abnormal Conditions....................................................13
2.2 Cell Search........................................................................................................19
2.3 Broadcast Message Analysis............................................................................20
2.3.1 MasterInformationBlock Analysis.................................................................20
2.3.2 System Information Analysis.......................................................................21
2.3.3 System Information Block Type1 Analysis...................................................27
2.4 Random Access................................................................................................29
2.5 Service Request................................................................................................30
2.5.1 Flow of UE Service Request in Normal Conditions.....................................30
2.5.2 Flow of UE Service Request in Abnormal Conditions..................................32
2.6 Paging...............................................................................................................35
2.6.1 S_TMSI Paging............................................................................................35
2.6.2 IMSI Paging.................................................................................................36
2.7 Trace Area Update............................................................................................36
2.7.1 TAU Flow Initiated by UE in Status of Idle...................................................37
2.7.2 TAU Flow Initiated by UE in Status of Connected.......................................39
2.8 Handover...........................................................................................................40
2.8.1 Inter-cell Handover.......................................................................................40
2.8.2 Inter-system Handover................................................................................42
2.9 Dedicated Bearer Setup....................................................................................43
2.9.1 Dedicated Bearer Setup Flow in Normal Conditions...................................43
2.9.2 Dedicated Bearer Setup Flow in Abnormal Conditions................................45
2.10 Dedicated Bearer Modification..........................................................................50
2.10.1 Dedicated Bearer Modification Flow in Normal Conditions..........................50
2.10.2 Dedicated Bearer Modification Flow in Abnormal Conditions......................53
2.11 Dedicated Bearer Release................................................................................54
2.12 Detachment.......................................................................................................55
2.12.1 Detachment Signaling Flow Initiated by UE in Status of Power off.............55
2.12.2 Detachment Signaling Flow Initiated by UE in Status of Power on.............55
ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. V

FIGURES
Figure 1-1 TD-LTE Network Architecture.................................................................................2

Figure 1-2 Functions of EPC and E-UTRAN............................................................................3
Figure 1-3 Protocol Model for Interfaces in E-UTRAN.............................................................4
Figure 1-4 User Plane of Interface S1.....................................................................................5
Figure 1-5 Control Plane of Interface S1..................................................................................6
Figure 1-6 User Plane of Interface X2......................................................................................8
Figure 2-1 Attachment Flow in Normal Conditions.................................................................10
Figure 2-2 RRC Connection Failure.......................................................................................13
Figure 2 -12-3 eNodeB Fails to Establish Default Bearer.......................................................34
Figure 2 -12-4 S_TMSI Paging Flow......................................................................................36
Figure 2-12-5 IMSI Paging Flow.............................................................................................36
Figure 2-12-6 TAU Flow Initiated by Idle UE when No “Active” Identifier is Added to TAU
Request...................................................................................................................................37
Figure 2-7 Inter-cell Handover................................................................................................41
TABLES
Table -1 Frequency band Indicator..........................................................................................29
ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. VI

1 TD-LTE Network Architecture

The LTE system consists of two parts: the EPC (MME/S-GW) and the E-UTRAN.
The LTE E-UTRAN is composed of evolved NodeBs (eNodeB). The UE accesses the E-
UTRAN control plane and the E-UTRAN user plane through these eNodeBs. Every two
eNodeBs are connected through the X2 interface. That is to say, there must be an X2
interface for two connected eNodeBs. The LTE E-UTRAN and the EPC are connected
through the interface S1. Every S1 interface can be connected to multiple E-UTRANs
and EPCs.
Different from the 3G network, the LTE E-TRAN is composed of only eNodeBs. In this
regard, the LTE E-TRAN network contains less nodes and its architecture is more
flattened. The flattened network architecture helps to reduce the call set-up delay and
the user data transit delay. Moreover, this structure also helps to reduce the operation
expenditure (OPEX) and the capital expenditure (CAPEX).
The connection between the eNodeB and the MME/S-GW is quite flexible, namely the
UE can reside on the same MME/S-GW while it is moving. This kind of flexible
connection helps to reduce the interconnection between the signaling of interfaces and
the workload of the MME/S-GW. However, if the distance between the MME/S-GW and
the eNodeB is quite long or the resources are re-allocated, the UE would shift to another
MME/S-GW.
ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. 1

Figure 1-1 TD-LTE Network Architecture
Note: As specified in the protocol, every eNodeB can be connected to multiple MME/S-
GW.
1.1 Functions of EPC and E-UTRAN

The EPC and the E-UTRAN in the LTE system is different from those in the 3G system.
Therefore, their functions are redefined to suit new network architecture and new system
demands. See the figure below for their new functions:

Figure 1-2 Functions of EPC and E-UTRAN
Functions of the eNodeB:
1） Manage the radio resources (including the radio bearer control, the admission
control, the mobility management, and the UL/DL resources allocation/scheduling);
2） Compress the IP heads and encrypt the user data stream;
3） Select the desired MME when the UE is attached to the network;
4） Provide routes for the data going from the S-GW to the user plane;
5） Schedule and transit the paging message;
6） Schedule and transit the system radio message;
7） Arrange the measurement and measurement reports.
Functions of the MME:
1） Distribute the paging messages to eNodeBs;
2） Provides the security control;
3） Provides the mobility management for the idle UE;
4） Control the SAE bearer;
5） Encrypt the non-E-UTRAN signaling so as to keep it intact.

Functions of Serving Gateway:
1） Terminate the data packages generated by the user plane due to the paging
occurrence;
2） Provide the support for the user plane switchover due to the movement of the UE.
1.2 Protocol Model for Interfaces in E-UTRAN

As shown in the figure below, the protocol model for the interfaces in the E-UTRAN
(namely the interface X2 and the interface X2) adopts the same interface definition
principle as that of the UTRAN. In this model, the control plane is separated from the
user plane and the radio network layer is separated from the transmission network layer,
which enable planes and layers to evolve independently and reduce the overheads
caused by the interfaces standardization.
Figure 1-3 Protocol Model for Interfaces in E-UTRAN
Radio Control Plane User Plane

Network
Layer Application
Protocol
Transport Transport Network Transport Network

Network User Plane User Plane
Layer
Signalling Data
Bearer(s) Bearer(s)
Physical Layer
1.3 Interface S1
The interface S1 serves to connect the MME/S-GW and the eNodeB. It is different from
the interface Iu in the 3G UMTS system. The interface Iu is connected to the PS domain
and CS domain, but the interface S1 is connected to the PS domain only.
1.3.1 User Plane of Interface S1

The user plane of interface S1 (S1-UP) is located between the eNodeB and the S-GW.
Its protocol stack is shown in the figure below. The transmission network layer of the S1-

UP is IP-based. As shown in the figure, the GTP-U protocol is used to transmit the user
plane PDU.
Figure 1-4 User Plane of Interface S1
As defined by the GTP-U protocol,
1） the transmission of GTP-U protocol is either IPv4/UDP-based or IPv6/UDP-based.
2） the data transmitted between tunnel endpoints finds its route based on the IP
address and the UDP port number;
3） the UDP head is irrelevant to the IP version.
The protocol of the S1-UP radio network layer functions to:
1） indicate the SAE accessing bearer for the data packet in the target node of the
interface S1;
2） reduce the data loss when the UE is moving;
3） provide the error processing mechanism;
4） provide support for the MBMS;
5） provide the packet loss detection mechanism.

1.3.2 Control Plane of Interface S1

The control plane of the interface S1 (S1-CP) is located between the eNodeB and the
MME. The transmission network layer of this plane is also IP-based. For the purpose of
reliable transmission of signaling message, the SCTP layer is added above the IP layer.
The signaling protocol for the application layer is the S1-AP. See the protocol stack of
the S1-CP in the figure below.
Figure 1-5 Control Plane of Interface S1
The control plane of the interface S1 functions to:
1） manage the SAE bearer service, namely set up/modify/release the SAE bearer;
2） release the UE context on the interface S1;
3） manage the mobility of the UE (in the status of LTE_ACTIVE), namely managing
the intra-LTE switchover and the inter-3GPP-RAT switchover;
4） send the paging message from the interface S1;
5） realize the NAS signaling transmission;
6） manage the interface S1, namely resetting the interface S1, indicating errors, and
indicating the overloading;

7） realize the network sharing;
8） provide the roaming service and define the roaming area;
9） select the NAS node;
10）set up the initial context;
11）however, it cannot control the traffic and the congestion.
1.4 Interface X2
The interface X2 serves to connect two eNodeBs. It is defined by the same principle
used for the interface S1. Therefore, the protocol stack of the interface X user plane is
similar to that of the interface S1.
1.4.1 User Plane of Interface X2

The user plane of interface X2 (X2-UP) functions to transmit the user data between
eNodeBs. Its transmission network layer is IP-based. The GTP-U above the UDP/IP
protocol is used to transmit the user plane PDUs between eNodeBs. See the X2-UP
protocol stack in the figure below.
Figure 1-6 User Plane of Interface X2

1.4.2 Control Plane of Interface X2

The interface X2 is defined by the same principle used for the interface S1. On this
control plane, the SCTP is also used here to guarantee the reliable transmission of
signaling message. See the protocol stack of the interface X2 control plane (X2-CP) in
the figure below. The X2-AP is the signaling protocol of the application layer.
Figure 1-1 Control Plane of Interface X2
The protocol of the interface X2 application layer functions to:
1） manage the mobility of UE (in the status of LTE_ACTIVE);
2） manage the interface X2, e.g. indicator errors;
3） manage the UL workload.
2 Analysis of Signaling Flow
2.1 Attachment Flow after UE Power-on
2.1.1 Attachment Flow in Normal Conditions
The UE tries to realize the DL synchronization after it is powered on. Next, it searches
and measures in order to find a suitable or acceptable cell. Finally, it resides on the cell

and attaches itself to this cell. See the attachment flow in normal conditions in the figure
below:

Figure 2-7 Attachment Flow in Normal Conditions

Note:
1） The UE goes from the step 1 to the step 5 to set up the RRC
connection. Next, it goes through the step 6 and the step 9 to set up the
S1 connection. After the UE goes from the message 1 to the message
9, it finishes the NAS signaling connection. For more details, see
protocol 24.301.
2） As for the message 7, the UE attaches itself to the cell with the help of
IMSI after it is powered on. During this period, there is no process of
identity. Afterwards, the UE attaches itself to the cell with available
GUTI and then the EPC initiates the process of identity.
3） If the UE Radio Capacity IE is used in the message 9, the eNodeB
does not send the UECapabilityEnquiry message to the UE. In this
case, the message 10, message 11 and message 12 will be not
performed. Otherwise, the UE reports the UE Radio Capacity message
to the EPC and then sends the UE Capacity Info Indication.
 For the purpose of reducing the overheads on the interface Iu, the idle MME will
store the Radio Capacity message at first and then sends it to the eNodeB when
receiving the INITIAL CONTEXT SET REQUEST message. However, when the UE
is performing the attachment flow, in the process of “first TAU following
GERAN/UTRAN Attach”, or in the process of "UE radio capability update" TAU, the
UE will not send the Radio Capacity message to the eNodeB and will delete this
message. When the eNodeB needs the UE Capacity message, it will ask the UE for
it and then reports it to the MME.
Note: The "UE radio capability update" TAU is only supported in case of changes of
GERAN and UTRAN radio capabilities in ECM-IDLE.
 The eNodeB in the status of connected will store the UE Radio Capacity message.
 If the E-UTRAN Radio Capacity message for the UE changes, the UE will detach
itself from the cell and then attach itself to the cell again.
4） The UE context release is initiated
 by the eNodeB in the event of O&M Intervention, Unspecified Failure, User

Inactivity, Repeated RRC Signaling Integrity Check Failure, Release due to
UE Generated Signaling Connection Release;
 or by the MME in the event of authentication failure or detachment.
5） When the eNodeB receives the message 3 RRCConnectionRequest,

the DCM configures the SRB1 for the USM and the sends the message
4 RRCConnectionSetup to the UE. Next, the DCM configures the
DRB/SRB2 message for the USM and then the eNodeB sends the
RRCConnectionReconfiguration message to the UE. When the
eNodeB receives the RRCConnectionReconfigurationComplete
message from the UE, the control plane declares the user plane
resource is available.

6） The eNodeB sends out the message 15

RRCConnectionReconfiguration immediately after it sends out the
message 13 SecurityModeCommand. It does not need to wait until it
receives the message 14 SecurityModeComplete.
7） If the UE tries to attach itself to the cell with the IMSI used by another
UE (this UE has been attached to the cell), the EPC will release the UE
which has been already attached to the cell. If the MNC in the IMIS is
inconsistent with that in the EPC, the EPC will repose to the UE with
the AttachReject message.
8） By using the message 9, the MME sends the Initial Context Setup
Request message to the eNodeB and asks the eNodeB to set up the
bearer resources. In this case, the MME sends out the message 9 along
with the security context. Sometimes, the user radio capacity and the
handover limits list may also be sent out along with the message 9. The
UE sends the security capacity parameter which is sent out together with
the Attach Request message to the eNodeB through the EPC. If the UE
security capacity parameter is changed, the TAU will restart immediately.

2.1.2 Attachment Flow in Abnormal Conditions
2.1.2.1 RRC Connection Setup Failure
Figure 2-8 RRC Connection Failure

2.1.2.2 EPC Rejecting the Attachment Request
Figure 2-9 EPC Rejecting the Attachment Request
1） The Attach Reject message and the PDN Connectivity Reject message
appear at the same time only when the attachment request is rejected

by the ESM. If the attachment request is rejected by the EMM, only the
Attachment Reject message appears.
2） In most cases, the attachment request is rejected when the MNC in the
IMSI is inconsistent with that in the EPC.

2.1.2.3 eNodeB Receiving No Initial Context Setup Request
Figure 2-10 eNodeB Receiving No Initial Context Setup Request

2.1.2.4 RRC Re-allocation Request Being Lost/Absent or UE Security Parameter

Configuration Failure
Figure 2-11 RRC Re-allocation Request Being Lost / Absent or UE Security Parameter
Configuration Failure

2.2 Cell Search

When the UE is searching for the cell, the UE tries to realize the time synchronization
and frequency synchronization with the cell at first, and then detect the cell ID. Different
from what the UE does in the UTRAN system, the UE in the E-UTRAN can work in
different system bandwidth, namely from 1.4MHZ to 20 MHZ. The UE searches for
desired cell by using the synchronous channel (SCH), the broadcasting channel (BCH)
and the reference signal (RS). The SCH includes the primary synchronous channel
(PSCH) and the secondary synchronous channel (SSCH). The BCH includes the
physical broadcast channel (PBCH) and the dynamic broadcast channel (DBCH).
The BCH is directly mapped to the PBCH. Both the PSCH and the SSCH are real
physical channels. They are used in the process of synchronization and cell search but
never used to transmit the L2/L3 control signaling. The DBCH is carried by the downlink
shared transport channel (DL-SCH).
Figure 2-12 Flow of Cell Search
Detect the PSCH to obtain the 5ms clock and

the cell ID in the cell ID group (0~2)
Detect the SSCH to obtain the radio

frame clock, the cell ID group (0~167)
and the BCH antenna configuration
Detect the DL reference signal (RS) to

obtain the BCH antenna configuration
and know whether the pilot displacement
is adopted
Read the BCH to obtain the information

about other cell

2.3 Broadcast Message Analysis
Figure 2-13 Broadcast Message Analysis
As shown in the figure above, the UE goes through the following steps to receive the
broadcast message after the UE is hooked on:
The UE reads the MasterInformationBlock to obtain the system bandwidth, the PHICH-
Config and the SystemFrameNumber, which helps the UE to obtain the information
about other system.
The UE reads the System Information to obtain the radio resource configuration,
including the channel configuration, the UE timer and UE counter.
The UE reads the SIB message to obtain the PLMN ID and the information about the cell
residing and the cell re-selection.
2.3.1 MasterInformationBlock Analysis
Figure 2-14 MIB Analysis
The UE obtains the following information about the cell from the Masterinformationblock:

DL_Bandwidth: It refers to the system bandwidth. There are six types of bandwidth.
Bandwidth type 0 refers to 1.4M (6RB), bandwidth type 1 refers to 3M(15RB), bandwidth
type 2 refers to 5M(25RB), bandwidth type 3 refers to 10M(50RB), bandwidth type 4
refers to 15M(75RB), and bandwidth type 5 refers to 20M(100RB). In the figure above,
the value of the DL_Bandwidth is “3”, therefore, the system bandwidth equals to 10M
(50RB).
Phich_Duration: It indicates the length of the PHICH signal. As for the normal PHICH
signal, it uses the first OFDM Symbol of a sub-frame. As for the extended PHICH signal,
it uses the first two OFDM Symbols of the sub-frame 1 and 6 and then the first three
OFDM Symbols of other sub-frames. As mentioned above, there are two kinds of
PHICH_Duration, namely the normal PHICH_Duration and the extended
PHICH_Duration. The value “0” of PHICH_Duration indicates normal one and the value
of “1” indicates the extended one.
SystemFrameNumber: It refers to the system frame number and is usually used in the
synchronization between the UE and the network.
2.3.2 System Information Analysis

The UE can obtain the information about the cell selection, the access, the radio
resources, the physical channels, the UL power control, the UE timer and UE counter
from the System Information message.

Figure 2-15 System Information Message
 Barring: This parameter is related to the cell selection and the access.
Table 2-1 Parameters Used to Differentiate the Signaling and the Data
Range of
Parameter Range of Actual Value Displayed Meaning
Value
enumerate(0，0.05，0.
1，0.15，0.2，0.25，0 This parameter
Ac_Barring indicates the
.3，0.4，0.5，0.6，0.7 0-15
Factor access ratio of the
，0.75，0.8，0.85，0. signaling.
9，0.95)

Range of
Parameter Range of Actual Value Displayed Meaning
Value
This parameter
indicates the
enumerate(4，8，16，
Ac_Barring length of the
32，64，128，256，5 0-7
Time duration when the
12) s
access is
forbidden.
 RadioResourceConfigCommon Parameters
Table 2-2 RadioResourceConfigCommon Parameters
Range of
Parameter Range of Actual
Displayed Meaning
s Value
Value
It indicates quantity
NumberOf enumerate(4,8,12,16, of the signed
RA_pream 20,24,28,32,36,40,44, 0-15 preambles for the
bles 48,52,56,60,64) conflict-based
random access.
It indicates the
SizeOfRA_ enumerate(4,8,12,16,
quantity of the
preambles 20,24,28,32,36,40,44, 0-14
signed preambles in
GroupA 48,52,56,60)
Group A.
It indicates the length
powerRam enumerate(0,2,4,6) of the step when the
0-3
pingstep dB PRACH power is
increasing.
It indicates maximum
preambleT enumerate(3,4,5,6,7, repetitions of the
0-10
ransMax 8,10,20,50,100,200) preamble
retransmission.
enumerate(-120,-
preambleIn 118,-116,-114，- It indicates the target
itialreceive 112，-110，-108，- receiving power of
0-15
dTargetPo 106，-104，-102，- the PRACH initial
wer 100，-98，-96，- preamble.
94，-92，-90) dBm
It indicates the power
MessageP enumerate(minusinfin control margin for the
owerOffset ity, 0, 5, 8, 10, 12, 15, 0-7 Message3
GroupB 18) dB configured by the
eNodeB.
It indicates the size
of the window which
RA_Rspon enumerate(2,3,4,5,6,
0-7 the UE uses to
seWinSize 7,8,10) ms
receive the random
access preambles.
MAC_Con enumerate(8,16,24,3 0-7 It indicates the timer

Range of
Parameter Range of Actual
Displayed Meaning
s Value
Value
nectionRes
used to resolve the
olutionTim 2,40,48,56,64) sf
MAC conflict.
er
It indicates the
MaxHARQ maximum repetitions
1-8 1-8
_Msg3Tx of the Message3
transmission.
 BCCH Parameters
 modificationperiodCoeff: It indicates the quantity of the BCCH update cycles.

The value of this parameter ranges from “0” to “3”. The value “0” refers to
twice update cycles, the value “1” refers to four update cycles, the value “2”
refers to eight update cycles and the value “3” refers to 16 update cycles.
 PCCH Parameters
 defaulpagingCycle: It indicates the cycle of discontinuous reception of the

paging occasion. The value of this parameter includes “0”, “1”, “2” and “3”,
which indicates 32 radio frames, 64 radio frames, 128 radio frames and 256
radio frames respectively.
 nB
 nB: This parameter refers to the factor used to adjust the paging time. The
value of this parameter includes “0”, “1”, “2” , “3”, “4”, “5“, “6” and “7”, which
indicates 4T, 2T, T, 1/2T, 1/4T, 1/8T, 1/16T and 1/32T respectively.
 PRCH Parameters
The PRACH parameters provides the UE with the initial reference number of the logical
root sequence (which is generated based on the sequence of 64 preambles on the
PRACH), the transmission configuration reference for the random access preamble and
the initial RB number of the random access preamble.

Figure 2-16 PRACH Parameters
 PDSCH Parameters
 ReferenceSignalPower: This parameter is an absolute value. It refers to the

reference signal power of a single RE.
 P_B: This parameters refers to the ratio between the PDSCH EPRE with cell
RS and the PDSCH EPRE without cell RS. Its value ranges from 0 to 3.
 PUSCH Parameters

 N_SB: This parameter refers to the number of sub-bands to be included into

the bandwidth during the system frequency hopping. It value ranges from 0 to
4.
 hoppingMode: This parameter refers to the PUSCH frequency hopping mode.

Its value includes “0” and “1”, which indicates “only inter-subframe” and “both
intra and inter-subframe” respectively.
 hoppingOffset: This parameter refers to the frequency hopping offset. Its value
ranges from 0 to 98.
 PUCCH Parameter Configuration
 DeltaPUCCH_Shift: This parameter refers to the cyclic offset when the

PUCCH format1, format 1a or format 1b is recycling in a cell. Its value ranges
from 0 to 2, which indicates the offset of 1, the offset of 2 and the offset of 3
respectively.
 nRB_CQI: This parameter refers to the number of RBs that PUCCH format
22/2a/2b uses. Its value ranges from 0 to 98.
 nCS_AN: This parameter refers to the cyclic offset when both the PUCCH
format1/1a/1b and the PUCCH format 2/2a/2b are used in one resource block.
 n1PUCCH_AN: This parameter refers to the number of PUCCH Format 1

channels which are assigned in a semi-static way. Its value ranges from 0 to
2047.
 Uplink Power Control Parameters
 P0_nominalPUSCH: This parameter refers to the ideal PUSCH receiving

power, which is configured depending on the actual conditions. As what is
shown in figure 2-10, its value is set to -81dBm.
 PoNominalPucch: This parameter refers to the ideal PUCCH receiving power,

which is configured depending on the actual conditions. As what is shown in
figure 2-10, its value is set to -105dBm.
 UE Timer & Counter Parameters
 T300: This timer counts the time span that UE takes to wait for the response
of RRC. Its value ranges from 0 to 7, which indicates (100, 200,300, 400, 600,
1000, 1500, 2000) ms respectively.
 T301: This timer counts the time span that UE takes to wait for the re-
connection with RRC. Its value ranges from 0 to 7, which indicates (100,
200,300, 400, 600, 1000, 1500, 2000) ms respectively.

 T310: This timer counts the time span that UE takes to monitor the radio link
failure. Its value ranges from 0 to 7, which indicates (1, 2, 3, 4, 6, 8, 10, 20) s
respectively.
 N310: This counter calculates the maximum quantity of downlink

asynchronization messages the UE receives. Its value ranges from 0 to 6,
which indicates (0, 50, 100, 200, 500, 1000, 2000) ms respectively.
 T311: This timer counts the time span that UE takes to change into the status
of idle after it detects the radio link failure. Its value ranges from 0 to 6, which
indicates (1000, 3000, 5000, 10000, 15000, 20000, 30000) ms respectively.
 N311: This counter calculates the maximum quantity of downlink

synchronization messages that UE receives. Its value ranges from 0 to 7,
which indicates (1, 2, 3, 4, 5, 6, 8, 10) messages respectively.
 TimeAlignmentTimer: This timer serves to start the timer (which is used to set
the time interval of regular message synchronization) at specific time. Its value
ranges from 0 to 7, which indicates (500, 750 ， 1280, 1920 ， 2560,
5120，10240，infinity)sub-frame respectively.
2.3.3 System Information Block Type1 Analysis

The system information block type1 (SIB1) provides information about the
PLMN_identity, cellReservedForOperatorUse, cellBarred, and intralfreqReselection,

Figure 2-17 SIBlock type1 Analysis
 MCC: This parameter refers to the mobile country code of the adjacent cell.
 MNC: This parameter refers to the mobile network code of the adjacent cell.
 CellIdentity: This parameter refers to the identity of the cell.
 Cellbarred: This parameter shows whether the cell access is barred or not. The
value of “0” indicates “Barred” and the value indicates “Not Barred”.
 IntraFreqReselection: This parameter shows whether the cells with the same
frequency is allowed to be reselected or not. The value of “0” indicates “Allowed”
and the value indicates “Not Allowed”.
 q_RxlevMin: This parameter refers to the minimum receiving level for the eUTRAN
cell. Its value ranges from 0 to 48, which indicates (-140…-44) dBm step 2 dB
respectively.
Note:
D= (P+140)/2
“D” refers to the displayed value of q_RxlevMin. ”D” cannot be minus or

decimal value.
“P” refers to the actual value of q_RxlevMin.
 q_RxlevMinOffset: The offset of that the cell tolerates for the minimum receiving
level. Its value ranges from 1 to 8, which indicates (2-16dB) step 2 dB respectively.
Note:
D=P/2

“D” refers to the displayed value of q_RxlevMinOffset. “D” cannot be

minus or decimal value.
“P” refers to the actual value of q_RxlevMinOffset.
 P_Max: This parameter refers to the maximum transmitting power that UE allows. It
is usually set to 23dBm.
Table 2-3 Frequency band Indicator
Frequenc Uplink Downlink Duplex Mode

y Band
32 2545MHz – 2575MHz 2545MHz – 2575MHz TDD
33 1900 MHz – 1920 MHz 1900 MHz – 1920 MHz TDD
2.4 Random Access

There are two kinds of random access, namely the conflict-based access and the non-
conflict-based access. The flows of these two random accesses differ on how they
choose the random access preamble. In the flow of conflict-based random access, the
UE chooses one conflict-based access preambles randomly. In the flow of non-conflict
random access, the preamble is assigned to the UE by the eNodeB via a specific
downlink message. Refer to figure 2-12 and figure 2-13 for details of these two flows.

Figure 2-18 Flow of Conflict-based Random Access
UE eNB
1 Random Access Preamble
Random Access Response 2
3 Scheduled Transmission
Contention Resolution 4
Step1: UE transmits a random access preamble via RACH.
Step2: eNodeB MAC layer responds to UE via DL-SCH.
Step3: UE sends RRC Connection Request to eNodeB via CCCH, the logical channel of
DL-SCH.
Step4: eNodeB sends back RRC Contention Resolution via CCCH, or DCCH (FFS), the
logical channel of DL-SCH.

Figure 2-19 Non-conflict-based Random Access Flow
Step1: eNodeB assigns a non-conflict-based random access preamble to UE via a

specific downlink message. The preamble assigned is not contained in the set broadcast
on BCH.
Step2: UE sends the assigned preamble back to eNodeB via RACH.
Step3: eNodeB MAC layer sends Random Access Response to UE via DL-SCH.
2.5 Service Request
2.5.1 Flow of UE Service Request in Normal Conditions

The idle UE initiates the flow of service request when it needs to send out the service
data or messages to eNodeB. See Figure2-14 for the flow chart.

Figure 2-20 Flow of UE Service Request in Normal Conditions

2.5.2 Flow of UE Service Request in Abnormal Conditions
2.5.2.1 RRC Connection Setup Failure
The flow chart here is the same to the flow chart in 2.1.2.1.

2.5.2.2 EPC Rejecting Service Request
Figure 2-21 EPC Rejecting Service Request
2.5.2.3 eNodeB Receiving No Initial Context Setup Request
The flow chart here is similar to the flow chart of 2.1.2.3. However, in this flow, the
service request is not resent when the flow of service request fails.

2.5.2.4 RRC Re-allocation Message Being Lost, UE Security Parameter

Configuration Failure, or Non-GBR Bearer Setup Failure
The flow chart here is similar to the flow chart of 2.1.2. 4. However, in this flow, the
service request is not resent when flow of service request fails.
2.5.2.5 eNodeB Dedicated Bearer Setup Failure
 When the eNodeB is successfully attached to the UE, and the dedicated
bearer is successfully established, RRC connection will be released and the
UE changes to the status of idle. This idle UE will initiate the service request
when it needs to send out service data. In this case, the DBR related
parameters for the dedicated bearer and the default bearer will be set up.
 When the dedicated bearer fails to be established at the eNodeB, the SGW
will be informed of this failure through the initial context setup response along
with the list of failure. In this case, the SGW will deactivate the dedicated
bearer. Meanwhile, when the UE detects that RRCConnectionReconfiguration
fails to carry the DRB of the dedicated bearer, the UE will deactivate the
dedicated bearer too. In this way, the UE and the SGW share the same
bearer. The flow chart is the same to the flow chart of 2.1.1.
2.5.2.6 eNodeB Default Bearer Setup Failure
Similar to the cases mentioned above, when the dedicated bearer is successfully
established as a non-GRB bearer but the default bearer fails to be established as a non-
GRB bearer, the SGW will be notified of the failure through the initial context setup
response along with the failure message. In this case, the SGW will detach from the UE.
Meanwhile, when the UE detects that RRCConnectionReconfiguration fails to carry the
DRB of the default bearer, the UE will activate the default bearer, connect itself to the
dedicated bearer and then detach from the bearer too. In this way, the UE and SGW
share the same bearer.

Figure 2-22 eNodeB Fails to Establish Default Bearer
2.6 Paging
2.6.1 S_TMSI Paging

The idle UE initiates the flow of paging when the network needs to send out the service
data or messages to the UE. See Figure2-17 for the flow chart.

Figure 2-23 S_TMSI Paging Flow
2.6.2 IMSI Paging

When the S_TMSI is unavailable, the flow of IMSI paging launches. The UE will detach
itself from the network and then attach itself to the network again when receiving the
IMSI paging. See Figure 2-18 for the flow chart.
Figure 2-24 IMSI Paging Flow
2.7 Trace Area Update

The flow of trace area update (TAU) happens when UE moves into a cell and detects the
trace area information (TAI) of the cell is not in the UE TAI list. The TAU flow happens
either when the UE is in the status of IDLE or when it in the status of CONNECTED (that
is during handover).

Pay attention that in the TAU signaling flow, UE is not necessary to reply to eNodeB with
TAU Complete message if no new GUTI is carried to the UE along with TAU Accept
message.
2.7.1 TAU Flow Initiated by UE in Status of Idle

“Active” Identifier: When the idle UE needs to send the uplink data or signaling
(irrelevant to TAU), it will add an “Active” identifier to the TAU Request message so as to
apply for the establishment of user resource. If the “active” identifier is added, NAS
signaling will stay connected after the completion of TAU flow. Otherwise, the NAS
signaling link will be released after the completion of TAU flow.
EPS bearer context status IE: In the TAU flow, the UE sometimes carries the EPS
bearer context status IE. MME will respond to the UE carrying this IE. The EPS bearers
of both UE and MME are kept synchronous via this IE.
See Figure 2-19 for the TAU flow initiated by the UE when no “Active” identifier is added
to the TAU Request.

Figure 2-25 TAU Flow Initiated by Idle UE when No “Active” Identifier is Added to TAU
Request

2.7.2 TAU Flow Initiated by UE in Status of Connected
Figure 2-26 TAU Flow Chart When UE is in Status of Connected
Annotation:
a. When there is no new GUTI assigned to UE, step 6 and step 7 will be skipped.
b. After the completion of TAU flow which occurs during the cell handover, the NAS
signaling link will not be disconnected.
c. When UE is in the status of connected, it cannot choose to set the “active” identifier to
the TAU Request message.

2.8 Handover
2.8.1 Inter-cell Handover

Inter-cell handover happens when the eNodeB decides the inter-cell handover is
necessary according to the measurement report from UE at CONNECTED status. The
eNodeB will then send the handover command to the UE. On this occasion, the UE don’t
care about whether the inter-cell handover leads to the shift of eNodeB.

Figure 2-27 Inter-cell Handover Flow

2.8.2 Inter-system Handover

Inter-system handover occurs when the network coverage is weak or there is no
coverage so as to provide stable and constant network services.
The inter-system handover signaling flow goes through two stages, namely, the
handover preparation and the handover implementation.
 Handover Preparation
Figure 2-28 Inter-system Handover Flow: Preparation
 Handover Implementation

Figure 2-29 Inter-system Handover Flow: Implementation
2.9 Dedicated Bearer Setup
2.9.1 Dedicated Bearer Setup Flow in Normal Conditions

The dedicated bearer setup flow is initiated by the UE or the MME when they are in the
status of connected.
This flow can not be initiated by the eNodeB.

Figure 2-30 Dedicated Bearer Setup Flow in Normal Conditions
Annotation:
a. If it is the MME that initiates the bearer setup flow, step 1 and step2 will be skipped.
b. In case the bearer setup flow is initiated by the UE, the EPC can give response to the
bearer setup/modify (step 10).
c. The system doesn’t support setting up several dedicated bearers at the same time
currently.

2.9.2 Dedicated Bearer Setup Flow in Abnormal Conditions
2.9.2.1 EPC Rejecting Bearer Resource Allocation Request
Figure 2-31 EPC Rejecting Bearer Resource Allocation Request
Annotation:
If the EPS rejects the bearer resource allocation request because of “unknown EPS
bearer context”, the UE will activate the local default bearer.
2.9.2.2 eNodeB E-RAB Setup Failure
As specified in the protocol, if the eNodeB fails to connect to the UE, the eNodeB will
send the message of EPC E-RAB SETUP RESPONSE along with the list of E-RAB
setup failure (the reason of failed is also included in the list) (e.g. radio resources not
available). But in current version of eNodeB, eNodeB will send NAS NON DELIVERY
INDICATION to MME (EPC) once eNodeB fails to connect to the UE and fails to send
RRC connection reconfiguration message to the UE.
According to the protocol, the EPC will check the eNodeB E-RAB failure cause so that it
can take some measures accordingly. But in current version of EPC, EPC won’t check
the failure cause and will directly send to UE the Deactivate EPS Bearer Context

Request message. The UE, then, will send back Deactivate EPS Bearer Context Accept
message.
Figure 2-32 Dedicated Bearer Setup Signaling Flow Chart

(eNodeB E-RAB Setup Failure)

2.9.2.3 RRC Connection Reconfiguration Time-out

(RRC Connection Reconfiguration Time-out)
Annotation:
The eNodeB will send UE CONTEXT RELEASE REQUEST to the EPC in case of RRC
connection reconfiguration time-out.
2.9.2.4 UE NAS Layer Rejecting to Activating Dedicated EPS Bearer
If the UE NAS layer rejects to activate dedicated EPS bearer, the EPC will send E-RAB
RELEASE COMMAND without NAC PDU to the eNodeB to release the S1 bearer set up
previously. Once receiving the command, the eNodeB will send out the RRC Connection
Reconfiguration message along with the DRB list to release DRB.

Figure 2-34 Dedicated Bearer Setup Signaling Flow Chart (UE NAS Layer Rejection)

2.9.2.5 Uplink Information Being Lost in Transference

(Uplink Information Lost in Transference)
Annotation:

The EPC will send the request to the UE for four times at most in case the EPC hasn’t
received the UE NAS message. The EPC will give up sending the request again if it has
tried four times.
2.10 Dedicated Bearer Modification
2.10.1 Dedicated Bearer Modification Flow in Normal Conditions

The dedicated bearer modification flow is initiated by the UE or the MME when they are
in the status of connected.
This flow can not be initiated by the eNodeB.

2.10.1.1 QoS Being Modified
Figure 2-36 Dedicated Bearer Modification Flow Chart in Normal Conditions

(in case QoS is modified)
Annotation:
a. If it is the MME that initiates the bearer setup/modify/release flow, there will be no
step1 and step2.
b. If it is the eNodeB that initiates the bearer release flow, the step 1 will be skipped.
Moreover, the E-RAB RELEASE INDICATION message is sent to the MME in the
step 2.

c. In case the bearer modification flow is initiated by the UE, the EPC can give
response to bearer setup/modify.( step 10)
2.10.1.2 TFT Being Modified

(in case TFT is modified)
Annotation:
The eNodeB is not relevant to the flow here in case that only the TFT is modified.

2.10.2 Dedicated Bearer Modification Flow in Abnormal Conditions
2.10.2.1 EPC Rejecting Bearer Resource Modification Request

(EPC Rejecting Bearer Resource Modification Request)
Annotation:
If the EPC rejects the bearer resource modification request because of “unknown EPS
bearer context”, the UE will activate the local default bearer.
2.10.2.2 eNodeB E-RAB Setup Failure & RRC Connection Reconfiguration Time-out
The flow here is the same to the flow in 2.9.2.2 and 2.9.2.3.
2.10.2.3 UE NAS Layer Rejecting Bearer Resource Modification Request
The flow here is the same to that in 2.9.2.4.

2.10.2.4 Uplink Information Lost in Transference
The flow here is the same with that in 2.9.2.5.
2.11 Dedicated Bearer Release

The dedicated bearer modification request can only be initiated by eNodeB or MME
which is in the status of connected.
Figure 2-39 Dedicated Bearer Release Signaling Flow

2.12 Detachment
2.12.1 Detachment Signaling Flow Initiated by UE in Status of Power off

The signaling flow of UE detachment is initiated when the user switches off the UE. The
UE will send the detachment request to the eNodeB to release all resources the UE has
taken up previously.
Figure 2-40 Flow of Detachment Initiated by UE in Status of Switch-off
Annotation:
The difference between the detachment flow initiated by the UE at IDLE status and the
UE at CONNECTED status is the same as the difference between TAU flow initiated by
the UE at IDLE status and the UE at CONNECTED status. (Refer to chapter 2.7.1.1 and
2.7.1.2)

2.12.2 Detachment Signaling Flow Initiated by UE in Status of Power on
2.12.2.1 Non-Switch-off Detachment Flow Initiated by UE at IDLE Status
Figure 2-41 Non-Switch-off Detachment Flow Initiated by UE at IDLE Status

2.12.2.2 Non-Switch-off Detachment Flow Initiated by UE at CONNECTED Status
Figure 2-42 Non-Switch-off Detachment Flow Initiated by UE at CONNECTED Status

B - 01 - TD-LTE Signaling Flow and Message Analysis Guide

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

B - 01 - TD-LTE Signaling Flow and Message Analysis Guide

Uploaded by

Copyright:

Available Formats

Operator Logo

TD-LTE Signaling Flow and

ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. I

Product Version Document Version Document SN Remarks

ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. II

Applicable to: TD-LTE network optimization personnel

About This Document

ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. IV

1 TD-LTE Network Architecture..........................................................................1

2 Analysis of Signaling Flow...............................................................................9

ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. V

Figure 1-1 TD-LTE Network Architecture.................................................................................2

Table -1 Frequency band Indicator..........................................................................................29

ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. VI

1 TD-LTE Network Architecture

ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. 1

Figure 1-1 TD-LTE Network Architecture

1.1 Functions of EPC and E-UTRAN

ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. 2

Figure 1-2 Functions of EPC and E-UTRAN

Functions of the eNodeB:

2） Compress the IP heads and encrypt the user data stream;

3） Select the desired MME when the UE is attached to the network;

5） Schedule and transit the paging message;

6） Schedule and transit the system radio message;

7） Arrange the measurement and measurement reports.

Functions of the MME:

1） Distribute the paging messages to eNodeBs;

2） Provides the security control;

3） Provides the mobility management for the idle UE;

4） Control the SAE bearer;

5） Encrypt the non-E-UTRAN signaling so as to keep it intact.

ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. 3

Functions of Serving Gateway:

1.2 Protocol Model for Interfaces in E-UTRAN

Figure 1-3 Protocol Model for Interfaces in E-UTRAN

Radio Control Plane User Plane

Transport Transport Network Transport Network

1.3.1 User Plane of Interface S1

ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. 4

Figure 1-4 User Plane of Interface S1

As defined by the GTP-U protocol,

1） the transmission of GTP-U protocol is either IPv4/UDP-based or IPv6/UDP-based.

3） the UDP head is irrelevant to the IP version.

The protocol of the S1-UP radio network layer functions to:

2） reduce the data loss when the UE is moving;

3） provide the error processing mechanism;

4） provide support for the MBMS;

5） provide the packet loss detection mechanism.

ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. 5

1.3.2 Control Plane of Interface S1

Figure 1-5 Control Plane of Interface S1

The control plane of the interface S1 functions to:

2） release the UE context on the interface S1;

4） send the paging message from the interface S1;

5） realize the NAS signaling transmission;

ZTE Confidential Proprietary © 2023 ZTE CORPORATION. All rights reserved. 6

7） realize the network sharing;

8） provide the roaming service and define the roaming area;

9） select the NAS node;

10）set up the initial context;

11）however, it cannot control the traffic and the congestion.

1.4.1 User Plane of Interface X2