Lte TDD Signaling Procedure and Analysis: Security Level: INTERNAL

4/21/17 Security Level: INTERNAL
LTE TDD
Signaling Procedure and
Analysis
www.huawei.com
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential

Objective
Upon the completion of this course,
you will be able to:
Recognize the LTE signaling

procedures.

Understand the typical signaling
procedures of network access,
paging, and handover.
Analyze basic problems.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 2

Contents
Chapter 1 Network Access Signaling Procedure
Chapter 2 Handover Signaling Procedure
Chapter 3 Paging Signaling Procedure

Contents

1 Cell Searching
2 PLMN and Cell Selection
3 Attach

Cell Searching
Cell searching, known as downlink (DL) synchronization, is a process to
resolve primary synchronization signals (PSS) and secondary synchronization
signals (SSS) on DL.

Cell Searching
In FDD mode, PSSs are on the last OFDM symbol of slot 0 and slot 10, and
SSSs on the second OFDM symbol from the end of slot 0 and slot 10.
In TDD mode, PSSs are on the second OFDM symbol from the end of slot
2 and slot 12, and SSSs on the last OFDM symbol of slot 1 and slot 11.
PSSs are the same for transmission from the two slots. Whereas, SSSs are
different for transmission from the two slots. PSS resolution triggers a timer
of 5 ms, and SSS resolution triggers a timer of 10 ms.
The cell ID on the physical layer can be obtained by using PSS resolution,
the cell group ID (504 cells are divided into 168 groups) can be obtained by
using the SSS resolution, and the physical cell identifiers (PCIs) of the
current cell (each cell group has three cell PCIs) can be obtained by using
both PSS resolution and SSS resolution. PCIs of the current cell = Cell
group ID x 3 + Cell ID.

Contents

1 Cell Searching
3 Attachment

PLMN and Cell Selection
After cell searching is complete, the UE obtains the PCIs of the current cell to resolve
the master information blocks (MIBs) and system information blocks (SIBs) in the
current cell. By performing MIB resolution, the UE obtains key information, including
DL synchronization and system bandwidth of the cell, detects physical dedicated
control channel (PDCCH) in the SIB time domain, and then obtains the System
Information Block Type1 (SIB1) information based on the PDCCH before resolving
other SIB information.
UE E-UTRAN
MasterInformationBlock
SystemInformationBlockType1
SystemInformation

PLMN and Cell Selection: MIB
The transmission period for MIBs is 40 ms. In a period, the physical broadcast channel
(PBCH) is located in subframe 0 of each radio frame and occupies the first four
symbols of slot 2 within each subframe 0. PSSs and SSSs are the same in the
frequency domain, occupying 1.08 MHz in the center, that is, the 6 RBs in the middle
of the frequency domain.

PLMN and Cell Selection: SIB1
The transmission period for
SIB1 is 80 ms. The first
transmission is performed in
the radio frame numbered a
multiple of 8 within a TTI, and
repeated transmission is
performed on other even-
numbered radio frames in the
TTI. Transmission is fixed on
subframe 5 in the
corresponding frame. The UE
detects the PDCCH on these
subframes. If there is a system
information radio network
temporary identity (SI-RNTI),
the UE receives SIB1 on the
physical dedicated sharing
channel (PDSCH).

PLMN and Cell Selection: SIBn
The transmission period for SIBn
is a multiple of 80 ms. SIB2
contains radio resourcerelated
configuration. SIBs 3 to 5 contain
the cell reselection configuration
of the LTE system. SIBs 6 to 8
contain the reselection
configuration of the UTRA,
GERAN, and CDMA2000
systems. SIB 9 contains the HNB
configuration. SIB 10 contains
the primary earthquake and
tsunami warning system (ETWS)
notification, and SIB 11 contains
the secondary ETWS notification.

PLMN and Cell Selection
SIB1 contains the public land mobile network (PLMN) table. The
access stratum (AS) of the UE transmits the resolved PLMN
table to the non-access stratum (NAS) of the UE. Then, the
NAS selects an appropriate PLMN.
After selecting a PLMN, the UE selects an appropriate cell of
the PLMN to camp on a cell with the strongest signal.

Contents

1 Cell Searching
3 Attach

Attach: Attach

Attach: RRC Connection Setup

Attach: RRC Connection Setup Request

Attach: RRC Connection Setup

Attach: RRC Connection Setup Complete
The UL dedicated control channel (DCCH) carries the UE registration
information and NAS messages (Initial Direct Transfer messages).

Attach: Initial UE Message (I)

Attach: Initial UE Message (II)

Attach: DL/UL NAS/Information Transfer
Uu tracing
S1 tracing

Attach: Initial Context Setup Request (I)

Attach: Initial Context Setup Request (II)
Message resolution

Attach: Initial Context Setup Request (III)
Message resolution (continued)

Attach: RRC Security Mode Command/Complete

Attach: UE Capability Enquiry/Information

Attach: RRC Connection Reconfiguration
Used to establish signaling radio bearer (SRB) 2 and data radio bearer
(DRB) 1.

Attach: Initial UE Context Setup Response

Attach: Signaling over the Uu and S1 Interfaces
Signaling over the Uu interface
Signaling over the S1 interface

Attach: IMSI-Based Entire-Network Signaling Tracing (I)
IMSI Signaling
Tracing for the Entire Ne

Attach: IMSI-Based Entire-Network Signaling
Tracing (II)

Attach: IMSI-Based Entire-Network Signaling
Tracing (III)

Contents

1 Introduction to a Handover
2 Intra-eNodeB Handover Between Cells
3 Inter-eNodeB Handover Between Cells

Introduction to Handovers
Definition
A handover is implemented when a UE in the connected state
moves to a different cell to perform the UE context update.
Objective
Coverage-based handover: to achieve continuity of services for
a moving UE
Load-based handover: load-triggered handover; to ensure the
optimal performance of the whole system

Page 34
Introduction to Handovers
Three types of handovers in the LTE system

Introduction to Handovers: LTE System
Handover is implemented in three phases: handover
measurement, handover decision, and handover execution.
In the handover measurement phase, the UE performs measurements

according to the measurement configuration delivered by the eNodeB
and reports measurement results to the eNodeB.
In the handover decision phase, the eNodeB checks the measurement
results reported by the UE and determines whether to initiate a handover.
In the handover execution phase, the eNodeB controls the procedure of
UE handover to the target cell based on the decision, to complete the
handover.
The whole handover procedure is performed based on UE-assisted

network control. The eNodeB delivers measurement configuration to
the UE, the UE reports the measurement results, and then the
eNodeB performs handover decision, resource preparation, handover
execution, and release of original resources.

Introduction to Handovers: Measurement Control

Introduction to Handovers: Measurement Report

Introduction to Handovers: Handover Command

Contents


Intra-eNodeB Handover Between Cells
Intra-eNodeB handover between cells is divided into
intra-frequency handover and inter-frequency handover.
In the handover, only resources on the Uu interface are
updated. The eNodeBs use internal messages to apply for and
release resources of the source cell and the target cell.
Inter-eNodeB data transfer is unnecessary, so are the random
access procedure of the UE and the signaling interaction with
the evolved packet core (EPC).

The UE reports the

Measurement Report
message in the source cell.
The eNodeB delivers a Handover Command

message after completing cell admission control
and radio resource allocation in the target cell.
The UE accesses the target cell.
After the handover is complete,

resources of the source cell are
released.

Page 42
Uu tracing on the UE side
Uu tracing on the eNodeB side

Page 43
Contents


Inter-eNodeB Handover over the X2 Interface
If the target cell and source cell belong to two different eNodeBs
over two different X2 links, an inter-eNodeB handover needs to be
triggered over the X2 interface, and event A3 or A4 is reported.
The prerequisite is that the X2 relationship has been configured
between the two eNodeBs.
After receiving the measurement report from the UE and deciding a
UE handover to the target eNodeB, the source eNodeB applies to the
target eNodeB over the X2 interface for resources for the purpose of
resource preparation in the target cell, and then informs the UE to
trigger a handover to the target cell through the reconfiguration
message over the radio interface. After the handover is successful,
the target eNodeB informs the source eNodeB to release radio
resources of the source cell. In addition, the source eNodeB transfers
non-transmitted data to the target eNodeB and updates the node
relationship on the user plane and control plane.
Handover

Inter-eNodeB Handover over the X2 Interface (I)
Handover preparation: The source eNodeB sends a
The UE has accessed to the cell and Handover Request message to the target eNodeB.
performs services. The Handover Request message contains the service
information and other access layer information
The source eNodeB delivers (encryption, integrity, and measurement information)
measurement control information of the current UE.
and notifies the UE of
neighboring-cell measurement.
The UE returns the

measurement report after The source eNodeB decides a
detecting a cell that meets handover based on the handover
handover conditions. algorithm and current state.
The source eNodeB sends the container delivered by

the target eNodeB to the UE through the radio
message to inform the UE to trigger a handover.
Sequence number (SN) information is used to transfer the SN

status and hyper frame number (HFN) information of the UE
from the source eNodeB to the target eNodeB for the purpose
of data retransmission and encryption integrity protection.
The target eNodeB returns the admission Data forwarding. For details, see
result and radio resource configuration subsequent description in this
information to the source eNodeB, document.
completing the handover preparation.
After receiving the Handover Request message from

the source eNodeB, the target eNodeB performs
admission control based on the contained service
information and radio resource configuration.

Page 46
Inter-eNodeB Handover over the X2
Interface (II)
After the UE complete the random

access procedure to access the target
eNodeB, the UE sends a Handover
Confirm message to the target eNodeB.
After receiving the Handover Confirm message

from the UE, the target eNodeB initiates a path
switch to the MME to complete the user data
transmission.
After completing the user data transmission,

the MME sends a Path Switch Request Ack
message.
After the path switch procedure, the target

eNodeB informs the source eNodeB to release
related resources, completing the whole
handover procedure.

Page 47
Signaling Procedure for the Inter-eNodeB Handover
over the X2 Interface (I)
Uu tracing on the source eNodeB side
X2 tracing on the source eNodeB side (same as X2 tracing on the target

eNodeB side)

Page 48
Signaling Procedure for the Inter-eNodeB
Handover over the X2 Interface (II)
Uu tracing on the target eNodeB side
S1 tracing on the target eNodeB side

Page 49
Inter-eNodeB Handover over the S1 Interface
Inter-eNodeB handover over the S1 interface is similar to that over
the X2 interface. The only difference lies in the fact that there is no
X2 link between two eNodeBs. If no X2 link is configured, an inter-
eNodeB handover is performed over the S1 interface. If X2 and S1
links are configured simultaneously, an inter-eNodeB handover is
preferentially performed over the X2 interface.
If a handover uses the S1 interface, the Handover Request and

Handover Acknowledge messages and data are transmitted over the
S1 interface.

Inter-eNodeB Handover over the S1 Interface (I)
The source eNodeB sends a Handover

Request message to the MME.
The MME transfers the Handover
Request message to the corresponding
target eNodeB for handover
preparation.
After completing admission control and radio

resource configuration, the target eNodeB
returns a Handover Ack message to the MME.
Similar to the handover over the X2

interface, the source target send the SN
information to the MME, which then
transfers the SN information to the
target eNodeB.
The MME transfers the Handover ACK

message to the source eNodeB.

Page 51
Inter-eNodeB Handover over the S1 Interface (II)
The target eNodeB notifies the

MME of the handover completion.
The UE accesses the
target eNodeB.
The MME notifies the source
eNodeB of resource release.
The source eNodeB returns a resource

release completion message.

Page 52
Handover over the S1 Interface (I)
Uu tracing on the source eNodeB side
S1 tracing on the source eNodeB side

Page 53
Handover over the S1 Interface (II)
Uu tracing on the target eNodeB side
S1 tracing on the target eNodeB side

Page 54
Contents
Chapter 3 Paging Signaling Procedure

1 Introduction to Paging
2 Paging Signaling analysis

Introduction to Paging
Paging is triggered in the following three situations:
The UE is in the idle state and the network needs

to send data to the UE.
The network notifies the UE of an SIB update.
The network notifies the UE of an available ETWS

notification.

Introduction to the Paging Procedure (1)
The UE is in the idle state and the network needs to send data
to the UE.

Introduction to the Paging Procedure (2)
The network notifies the UE of an SIB update or an ETWS
notification.
If a UE receives a paging message of SIB update, the UE must
resolve the SIB again and use the network configuration parameters
contained in newly received SIBs.
If the UE receives a paging message containing an ETWS notification,

the UE must resolve the SIB1 immediately. If the SIB1 contains the
SIB10 or SIB11 scheduling, the UE must resolve SIB10 or SIB11.

Summary
Processes of cell searching, PLMN selection, and cell selection
for a UE just powered on
UE attach procedure and different types of attach procedures
LTE handover procedure and several common handover types in

the LTE system
LTE paging procedure
3 to 5 key points upon the completion of this course

Thank you
www.huawei.com

Lte TDD Signaling Procedure and Analysis: Security Level: INTERNAL

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lte TDD Signaling Procedure and Analysis: Security Level: INTERNAL

Uploaded by

Copyright:

Available Formats

4/21/17 Security Level: INTERNAL

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential

Recognize the LTE signaling

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 2

Chapter 1 Network Access Signaling Procedure

Chapter 2 Handover Signaling Procedure

Chapter 3 Paging Signaling Procedure

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 3

Chapter 1 Network Access Signaling Procedure

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 4

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 5

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 6

Chapter 1 Network Access Signaling Procedure

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 7

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 8

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 9

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 10

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 11

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 12

Chapter 1 Network Access Signaling Procedure

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 13

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 14

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 15

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 16

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 17

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 18

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 19

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 20

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 21

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 22

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 23

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 24

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 25

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 26

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 27

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 28

Signaling over the S1 interface

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 29

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 30

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 31

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 32

Chapter 2 Handover Signaling Procedure

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 33

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 35

In the handover measurement phase, the UE performs measurements

The whole handover procedure is performed based on UE-assisted

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 36

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 37

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 38

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 39

Chapter 2 Handover Signaling Procedure

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 40

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 41

The UE reports the

The eNodeB delivers a Handover Command

The UE accesses the target cell.

After the handover is complete,

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential

Uu tracing on the eNodeB side

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential

Chapter 2 Handover Signaling Procedure

HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 44