signalling analysis of lte
DESCRIPTION
Best for ever from HuwaiiTRANSCRIPT
HUAWEI TECHNOLOGIES CO., LTD.
www.huawei.com
Huawei Confidential
Security Level: INTERNAL 04/11/2023
LTE TDDSignaling Procedure and Analysis
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 2
Upon the completion of this course,
you will be able to:
Recognize the LTE signaling
procedures. Understand the typical signaling
procedures of network access,
paging, and handover. Analyze basic problems.
Objective
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 3
Chapter 1 Network Access Signaling Procedure
Chapter 2 Handover Signaling Procedure
Chapter 3 Paging Signaling Procedure
Contents
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 4
Chapter 1 Network Access Signaling Procedure
1 Cell Searching
2 PLMN and Cell Selection
3 Attach
Contents
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 5
Cell Searching
Page 5
Cell searching, known as downlink (DL) synchronization, is a process to
resolve primary synchronization signals (PSS) and secondary synchronization
signals (SSS) on DL.
Power on
Timeslot layer-1 timer
ID
PSS monitoring
SSS monitoring
Frame timer, cell ID, CP monitoring,
TDD/FDD
PBCH decoding
MIB/ SIB
PLMN and cell selection PLMN/cell
Idle state
RSRP/RSRQRS monitoring
Neighboring-cell monitoring
Initial synchronization
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 6
Cell Searching
Page 6
In FDD mode, PSSs are on the last OFDM symbol of slot 0 and slot 10, and
SSSs on the second OFDM symbol from the end of slot 0 and slot 10.
In TDD mode, PSSs are on the second OFDM symbol from the end of slot
2 and slot 12, and SSSs on the last OFDM symbol of slot 1 and slot 11.
PSSs are the same for transmission from the two slots. Whereas, SSSs are
different for transmission from the two slots. PSS resolution triggers a timer
of 5 ms, and SSS resolution triggers a timer of 10 ms.
The cell ID on the physical layer can be obtained by using PSS resolution,
the cell group ID (504 cells are divided into 168 groups) can be obtained by
using the SSS resolution, and the physical cell identifiers (PCIs) of the
current cell (each cell group has three cell PCIs) can be obtained by using
both PSS resolution and SSS resolution. PCIs of the current cell = Cell
group ID x 3 + Cell ID.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 7
Chapter 1 Network Access Signaling Procedure
1 Cell Searching
2 PLMN and Cell Selection
3 Attachment
Contents
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 8
PLMN and Cell Selection
Page 8
After cell searching is complete, the UE obtains the PCIs of the current cell to resolve
the master information blocks (MIBs) and system information blocks (SIBs) in the
current cell. By performing MIB resolution, the UE obtains key information, including
DL synchronization and system bandwidth of the cell, detects physical dedicated
control channel (PDCCH) in the SIB time domain, and then obtains the System
Information Block Type1 (SIB1) information based on the PDCCH before resolving
other SIB information. E-UTRAN
MasterInformationBlock
UE
SystemInformationBlockType1
SystemInformation
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 9
PLMN and Cell Selection: MIB
Page 9
The transmission period for MIBs is 40 ms. In a period, the physical broadcast channel
(PBCH) is located in subframe 0 of each radio frame and occupies the first four
symbols of slot 2 within each subframe 0. PSSs and SSSs are the same in the
frequency domain, occupying 1.08 MHz in the center, that is, the 6 RBs in the middle
of the frequency domain.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 10
PLMN and Cell Selection: SIB1
Page 10
The transmission period for
SIB1 is 80 ms. The first
transmission is performed in
the radio frame numbered a
multiple of 8 within a TTI, and
repeated transmission is
performed on other even-
numbered radio frames in the
TTI. Transmission is fixed on
subframe 5 in the
corresponding frame. The UE
detects the PDCCH on these
subframes. If there is a system
information radio network
temporary identity (SI-RNTI),
the UE receives SIB1 on the
physical dedicated sharing
channel (PDSCH).
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 11
PLMN and Cell Selection: SIBn
Page 11
The transmission period for SIBn
is a multiple of 80 ms. SIB2
contains radio resource–related
configuration. SIBs 3 to 5 contain
the cell reselection configuration
of the LTE system. SIBs 6 to 8
contain the reselection
configuration of the UTRA,
GERAN, and CDMA2000
systems. SIB 9 contains the HNB
configuration. SIB 10 contains
the primary earthquake and
tsunami warning system (ETWS)
notification, and SIB 11 contains
the secondary ETWS notification.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 12
PLMN and Cell Selection
Page 12
SIB1 contains the public land mobile network (PLMN) table. The
access stratum (AS) of the UE transmits the resolved PLMN
table to the non-access stratum (NAS) of the UE. Then, the
NAS selects an appropriate PLMN.
After selecting a PLMN, the UE selects an appropriate cell of
the PLMN to camp on a cell with the strongest signal.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 13
Chapter 1 Network Access Signaling Procedure
1 Cell Searching
2 PLMN and Cell Selection
3 Attach
Contents
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 14
Attach: Attach
Page 14
UE eNB MMERRC connection Setup
RequestRRC connection Setup
RRC connection Setup Complete
Initial UE message
DL NAS Transfer
UL NAS Transfer
UL NAS Transfer
DL NAS Transfer
UL Information Transfer
DL Information Transfer
UL Information Transfer
DL Information Transfer
Initial Context Setup RequestSecurity Mode Command
Security Mode Complete
UE Capability Enquiry
UE Capability Information UE Capability Information Indication
RRC connection Reconfiguration
RRC connection Reconfiguration Complete Initial Context Setup Response
UL NAS Transfer
UL Information Transfer
Authentication
NAS Encryption
Radio Interface Encryption
UE capability reporting
NAS message: Attach Complete, Active Default
EPS Bearer Context
NAS message: Attach Accept, Active Default EPS
Bearer Context Request
NAS message: :Attach Request, PDN
Connectivity Request
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 15
Attach: RRC Connection Setup
Page 15
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 16
Attach: RRC Connection Setup Request
Page 16
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 17
Attach: RRC Connection Setup
Page 17
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 18
Attach: RRC Connection Setup Complete
Page 18
The UL dedicated control channel (DCCH) carries the UE registration information and NAS messages (Initial Direct Transfer messages).
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 19
Attach: Initial UE Message (I)
Page 19
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 20
Attach: Initial UE Message (II)
Page 20
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 21
Attach: DL/UL NAS/Information Transfer
Page 21
Uu tracing
S1 tracing
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 22
Attach: Initial Context Setup Request (I)
Page 22
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 23
Attach: Initial Context Setup Request (II)
Page 23
Message resolution
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 24
Attach: Initial Context Setup Request (III)
Page 24
Message resolution (continued)
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 25
Attach: RRC Security Mode Command/Complete
Page 25
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 26
Attach: UE Capability Enquiry/Information
Page 26
UE eNBUE Capabi l i ty Enqui ry
UE Capabi l i ty Infomation
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 27
Attach: RRC Connection Reconfiguration
Page 27
Used to establish signaling radio bearer (SRB) 2 and data radio bearer (DRB) 1.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 28
Attach: Initial UE Context Setup Response
Page 28
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 29
Attach: Signaling over the Uu and S1 Interfaces
Page 29
Signaling over the Uu interface
Signaling over the S1 interface
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 30
Attach: IMSI-Based Entire-Network Signaling Tracing (I)
Page 30
IMSI Signaling Tracing for the Entire Ne
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 31
Attach: IMSI-Based Entire-Network Signaling Tracing (II)
Page 31
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 32
Attach: IMSI-Based Entire-Network Signaling Tracing (III)
Page 32
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 33
Chapter 2 Handover Signaling Procedure
1 Introduction to a Handover
2 Intra-eNodeB Handover Between Cells
3 Inter-eNodeB Handover Between Cells
Contents
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 34
Introduction to Handovers Definition
A handover is implemented when a UE in the connected state
moves to a different cell to perform the UE context update. Objective
Coverage-based handover: to achieve continuity of services for
a moving UE Load-based handover: load-triggered handover; to ensure the
optimal performance of the whole system
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 35
Introduction to Handovers
Page 35
Three types of handovers in the LTE system
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 36
Introduction to Handovers: LTE System
Page 36
Handover is implemented in three phases: handover measurement, handover decision, and handover execution.
The whole handover procedure is performed based on UE-assisted network control. The eNodeB delivers measurement configuration to the UE, the UE reports the measurement results, and then the eNodeB performs handover decision, resource preparation, handover execution, and release of original resources.
In the handover measurement phase, the UE performs measurements according to the measurement configuration delivered by the eNodeB and reports measurement results to the eNodeB.
In the handover decision phase, the eNodeB checks the measurement results reported by the UE and determines whether to initiate a handover.
In the handover execution phase, the eNodeB controls the procedure of UE handover to the target cell based on the decision, to complete the handover.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 37
Introduction to Handovers: Measurement Control
Page 37
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 38
Introduction to Handovers: Measurement Report
Page 38
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 39
Introduction to Handovers: Handover Command
Page 39
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 40
Chapter 2 Handover Signaling Procedure
1 Introduction to a Handover
2 Intra-eNodeB Handover Between Cells
3 Inter-eNodeB Handover Between Cells
Contents
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 41
Intra-eNodeB Handover Between Cells
Page 41
Intra-eNodeB handover between cells is divided into intra-frequency handover and inter-frequency handover.
In the handover, only resources on the Uu interface are updated. The eNodeBs use internal messages to apply for and release resources of the source cell and the target cell.
Inter-eNodeB data transfer is unnecessary, so are the random access procedure of the UE and the signaling interaction with the evolved packet core (EPC).
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 42
Intra-eNodeB Handover Between Cells
Legend
UE Source Cell Target Cell Serving Gateway
Detach from old cell and synchronize to new cell
Buffer packets from MME
L3 signalling
L1/L2 signalling
User Data
Handove
r C
om
ple
tion
Ha
ndove
r E
xecu
tion
Han
dove
r P
repara
tion
MME/MMEs
Area Restriction Provided
1. Measurement Control
packet data packet data
UL allocation
2. Measurement Reports
DL allocation
4. Handover Command
5. Synchronization
6. UL allocation + TA for UE
7. Handover Confirm
eNB
packet data
3. HO decision
packet data
Flush DL buffer, continue delivering in transit packets
packet datapacket data
packet data packet data
Measurement Reports
Handover Command
Handover Confirm
The UE reports the Measurement Report message in the source cell.
The eNodeB delivers a Handover Command message after completing cell admission control and radio resource allocation in the target cell.
The UE accesses the target cell.
After the handover is complete, resources of the source cell are released.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 43
Intra-eNodeB Handover Between CellsUu tracing on the UE side
Uu tracing on the eNodeB side
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 44
Chapter 2 Handover Signaling Procedure
1 Introduction to a Handover
2 Intra-eNodeB Handover Between Cells
3 Inter-eNodeB Handover Between Cells
Contents
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 45
Inter-eNodeB Handover over the X2 Interface
Page 45
If the target cell and source cell belong to two different eNodeBs over two different X2 links, an inter-eNodeB handover needs to be triggered over the X2 interface, and event A3 or A4 is reported. The prerequisite is that the X2 relationship has been configured between the two eNodeBs.
After receiving the measurement report from the UE and deciding a UE handover to the target eNodeB, the source eNodeB applies to the target eNodeB over the X2 interface for resources for the purpose of resource preparation in the target cell, and then informs the UE to trigger a handover to the target cell through the reconfiguration message over the radio interface. After the handover is successful, the target eNodeB informs the source eNodeB to release radio resources of the source cell. In addition, the source eNodeB transfers non-transmitted data to the target eNodeB and updates the node relationship on the user plane and control plane.
Handover
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 46
Inter-eNodeB Handover over the X2 Interface (I)
Legend
packet data packet data
UL allocation
2. Measurement Reports
3. HO decision
4. Handover Request
5. Admission Control
6. Handover Request Ack
7. Handover Command
DL allocation
Data Forwarding
UE Source eNB Target eNB Serving Gateway
Detach from old cell and synchronize to new cell
Deliver buffered and in transit packets to target eNB
Buffer packets from Source eNB
9. Synchronisation
10. UL allocation + TA for UE
L3 signalling
L1/L2 signalling
User Data
1. Measurement Control
Han
dove
r E
xecu
tion
Han
dove
r P
repa
ratio
n
MME
0. Area Restriction Provided
SN Status Transfer8.
The UE has accessed to the cell and performs services.
The source eNodeB delivers measurement control information and notifies the UE of neighboring-cell measurement.
The UE returns the measurement report after detecting a cell that meets handover conditions.
The source eNodeB decides a handover based on the handover algorithm and current state.
Handover preparation: The source eNodeB sends a Handover Request message to the target eNodeB. The Handover Request message contains the service information and other access layer information (encryption, integrity, and measurement information) of the current UE.
The target eNodeB returns the admission result and radio resource configuration information to the source eNodeB, completing the handover preparation.
After receiving the Handover Request message from the source eNodeB, the target eNodeB performs admission control based on the contained service information and radio resource configuration.
The source eNodeB sends the container delivered by the target eNodeB to the UE through the radio message to inform the UE to trigger a handover.
Sequence number (SN) information is used to transfer the SN status and hyper frame number (HFN) information of the UE from the source eNodeB to the target eNodeB for the purpose of data retransmission and encryption integrity protection.
Data forwarding. For details, see subsequent description in this document.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 47
Inter-eNodeB Handover over the X2 Interface (II)
After the UE complete the random access procedure to access the target eNodeB, the UE sends a Handover Confirm message to the target eNodeB.
After receiving the Handover Confirm message from the UE, the target eNodeB initiates a path switch to the MME to complete the user data transmission.
After completing the user data transmission, the MME sends a Path Switch Request Ack message.
After the path switch procedure, the target eNodeB informs the source eNodeB to release related resources, completing the whole handover procedure.
11. Handover Confirm
17.Release Resource
12. Path Switch Request
UE Source eNB Target eNB Serving Gateway
packet data
Data Forwarding
Flush DL buffer,Contiue delivering transmited
packets
packet data
16.Path Switch Request Ack
18.Release Resources
Han
dove
r Com
plet
ion
MME
13.User Plane update request
15.User Plane update response
14.Switch DL pathEnd Marker
End Marker
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 48
Signaling Procedure for the Inter-eNodeB Handover over the X2 Interface (I)
Uu tracing on the UE side
Uu tracing on the source eNodeB side
X2 tracing on the source eNodeB side (same as X2 tracing on the target eNodeB side)
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 49
Signaling Procedure for the Inter-eNodeB Handover over the X2 Interface (II) Uu tracing on the target eNodeB side
S1 tracing on the target eNodeB side
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 50
Inter-eNodeB Handover over the S1 Interface
Page 50
Inter-eNodeB handover over the S1 interface is similar to that over the X2 interface. The only difference lies in the fact that there is no X2 link between two eNodeBs. If no X2 link is configured, an inter-eNodeB handover is performed over the S1 interface. If X2 and S1 links are configured simultaneously, an inter-eNodeB handover is preferentially performed over the X2 interface.
If a handover uses the S1 interface, the Handover Request and Handover Acknowledge messages and data are transmitted over the S1 interface.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 51
Inter-eNodeB Handover over the S1 Interface (I)
Legend
3. HO decision
7. Admission Control
UE Source eNB Target eNB Serving Gateway
Detach from old cell and synchronize to new cell
Deliver buffered and in transit packets to target eNB
Buffer packets from MME
L3 signalling
L1/L2 signalling
User Data
Hand
over
Exe
cutio
nHa
ndov
er P
repa
ratio
n
MME/MMEs
Area Restriction Provided
5. Handover Request
7. Handover Request Acknologe
1. Measurement Control
packet data packet data
UL allocation
2. Measurement Reports
4. Handover Reauired
8. Handover Command
DL allocation
9. Handover Command
10. eNB SN Status Transfer
Data Forwarding
12. Synchronization
13. UL allocation + TA for UE
11. MME SN Status Transfer
Data Forwarding
The source eNodeB sends a Handover Request message to the MME.
The MME transfers the Handover Request message to the corresponding target eNodeB for handover preparation.
After completing admission control and radio resource configuration, the target eNodeB returns a Handover Ack message to the MME.
The MME transfers the Handover ACK message to the source eNodeB.
Similar to the handover over the X2 interface, the source target send the SN information to the MME, which then transfers the SN information to the target eNodeB.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 52
UE Source eNB Target eNB Serving Gateway
Han
dove
r C
ompl
etio
n
MME/MMEs
15. Handover Notify
14. Handover Confirm
packet data
16. UE Context Release Command
16. UE Context Release Completed
Inter-eNodeB Handover over the S1 Interface (II)
The UE accesses the target eNodeB.
The target eNodeB notifies the MME of the handover completion.
The MME notifies the source eNodeB of resource release.
The source eNodeB returns a resource release completion message.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 53
Signaling Procedure for the Inter-eNodeB Handover over the S1 Interface (I) Uu tracing on the UE side
Uu tracing on the source eNodeB side
S1 tracing on the source eNodeB side
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 54
Signaling Procedure for the Inter-eNodeB Handover over the S1 Interface (II)
Uu tracing on the target eNodeB side
S1 tracing on the target eNodeB side
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 55
Chapter 3 Paging Signaling Procedure
1 Introduction to Paging
2 Paging Signaling analysis
Contents
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 56
Introduction to Paging
Page 56
Paging is triggered in the following three situations:
The UE is in the idle state and the network needs to send data to the UE.
The network notifies the UE of an SIB update.
The network notifies the UE of an available ETWS notification.
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 57
Introduction to the Paging Procedure (1)
Page 57
The UE is in the idle state and the network needs to send data to the UE.
UE eNB SAES1_Pagi ng
RRC_Pagi ng
RRC_CONN_REQ
RRC_CONN_SETUP
RRC_CONN_SETUP_CMPS1AP_I NI TI AL_UE_MSG
S1AP_I NI TI AL_CONTEXT_SETUP_REQRRC_SECUR_MODE_CMD
RRC_CONN_RECFG
RRC_SECUR_MODE_CMP
RRC_CONN_RECFG_CMPS1AP_I NI TI AL_CONTEXT_SETUP_RSP
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 58
Introduction to the Paging Procedure (2)
Page 58
The network notifies the UE of an SIB update or an ETWS notification.
If a UE receives a paging message of SIB update, the UE must resolve the SIB again and use the network configuration parameters contained in newly received SIBs.
If the UE receives a paging message containing an ETWS notification, the UE must resolve the SIB1 immediately. If the SIB1 contains the SIB10 or SIB11 scheduling, the UE must resolve SIB10 or SIB11.
UE eNB SAES1_Pagi ng
RRC_Pagi ng
HUAWEI TECHNOLOGIES CO., LTD. Huawei Confidential Page 59
3 to 5 key points upon the completion of this course
Processes of cell searching, PLMN selection, and cell selection for a UE just powered on
UE attach procedure and different types of attach procedures
LTE handover procedure and several common handover types in the LTE system
LTE paging procedure
Summary
Thank youwww.huawei.com