Content

Layer3 Message Analysis

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

AMR CS Call Phases

UE BTS DRNC SRNC CN

1. Cell search, BCCH decoding &

RACH access

2. RRC Connection Setup

3. UE <-> CS-CN signalling

4. RAB Set-up

5. UE <-> CS-CN signalling

6. Service Established

7. Branch addition/deletion & active set update

8. Service Released

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

RRC Connection Set-up Signalling Flow
UE WBTS RNC

RRC: RRC CONNECTION REQUEST (RACH)

Admission
Control
NBAP: RADIO LINK SETUP
REQUEST
NBAP: RADIO LINK SETUP
RESPONSE
ALCAP:
ERQ
ALCAP:
ECF
FP Downlink
Sync
FP Uplink
Sync

RRC: RRC CONNECTION SETUP (FACH)

L1 Sync
NBAP: SYNCH INDICATION

RRC: CONNECTION SETUP COMPLETE (DCH)

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

 UE<–> CS_CN signalling

•Location Update
•Authentication
•Security Mode Setup
t
•Paging Re ques
dat e etup
•Call Setup tion Up
t y Mode S
ca ecu r i
1. Lo S
at i o n and
t he nt ic
2. A u cce pt
pd at e A
c a t i on U
3. Lo

. P aging
4 MSC / VLR
et u p
5. Call S

UE

RNC MGW
WBTS

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

PS Call Phase

UE BTS DRNC SRNC CN

1. Cell search, BCCH

decoding & RACH access

2. RRC Connection Setup

3. GPRS Attach

4. RAB Set-up

5. UE <-> PS-CN signalling (PDP context activation Accept)

6. Radio Bearer Reconfiguration

7. PS Data Session Established

8. State Transitions

9. Branch addition/deletion & active set update

10. PS Data Session Released

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

 GPRS Attach

• UE performs cell search and RRC Connection Establishment in the same way as for an
AMR call
• The UE registers with the PS-CN through the GPRS Attach procedure

UE Node B RNC SGSN

RRC Connection

Initial Direct Transfer: GPRS Attach Request (DCH) SCCP: Connection Request
Initial UE message : GPRS Attach Request
SCCP: Connection Confirm
Downlink Direct Transfer: Authentication and Ciphering Request (DCH) Direct Transfer: Authentication and Ciphering Request
Uplink Direct Transfer: Authenication and Ciphering Response (DCH) Direct Transfer: Authentication and Ciphering Response
Security Mode Command (DCH) Security Mode Command

Secuirty Mode Complete (DCH)

Common ID
Downlink Direct Transfer: Common ID (DCH) Direct Transfer: Identity Request
Uplink Direct Transfer: Identity Response (DCH) Direct Transfer: Identity Response

Downlink Direct Transfer: Location Attach Accept (DCH) Direct Transfer: Attach Accept
Uplink Direct Transfer: Attach Complete (DCH) Direct Transfer: Attach Complete

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

PDP Context

UE Node B RNC SGSN

GPRS Attach

Uplink Direct Transfer : Activate PDP context request (DCH) Direct Transfer : Activate PDP context request
RANAP: RAB Assignment Request
RRC: Radio Bearer Setup
Radio Bearer Setup Complete
RAB Assignment Response
Measurement Control
Measurement Control

Downlink Direct Transfer : Activate PDP Context Accept (DCH) Direct Transfer: Activate PDP Context Accept

Call Established

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

 Radio Bearer Setup/Complete & RAB Assignment Response

• Once the RANAP: RAB Assignment Request message has been received from PS CN
and RNC has resources to setup the 0/0 kbps RB the RNC sends a RRC: Radio Bearer
Setup message to the UE
• The UE acknowledges the RRC: Radio Bearer Setup message with a RRC: Radio Bearer
Setup Complete message
• Once the radio bearer establishment has been acknowledged, the RNC indicates to the
PS core that the RAB has been established using the RANAP: RAB Assignment
Response message

UE Node B RNC SGSN

GPRS Attach

Uplink Direct Transfer : Activate PDP context request (DCH) Direct Transfer : Activate PDP context request
RANAP: RAB Assignment Request
RRC: Radio Bearer Setup
Radio Bearer Setup Complete
RAB Assignment Response

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

 Radio Bearer Reconfiguration
UE Node B RNC SGSN

GPRS Attach

Uplink Direct Transfer : Activate PDP context request (DCH) Direct Transfer : Activate PDP context request
RANAP: RAB Assignment Request
RRC: Radio Bearer Setup
Radio Bearer Setup Complete
RAB Assignment Response
Measurement Control
Measurement Control

Downlink Direct Transfer : Activate PDP Context Accept (DCH) Direct Transfer: Activate PDP Context Accept

Call Established

Measurement Report : e4a

NBAP: Radio Link Reconfigure Prepare

Admission Control

Radio Link Reconfigure Ready

AAL2SIG:ERQ
AAL2SIG:ECF
FP: Downlink Sync
FP: Uplink Sync
Radio Link Reconfiguration Commit
RRC: Radio Bearer Reconfiguration (DCH)
RRC: Radio Bearer Reconfiguration Complete (DCH)
Measurement Control

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

 HSPA Setup

• HSUPA cannot be established without HSDPA, HSDPA UL return channel is HSUPA

instead of R99
• High level procedure is the same as that for an NRT DCH
• RNC starts by allocation a 0/0kbps connection
• Selection between DCH and E-DCH is then completed when RNC receives the uplink or
downlink capacity request

UE Node B RNC SGSN

RRC Establishment

GPRS Attach

0/0 kbps DCH

PDP Context Activation
allocated
Measurement Report : e4a
Uplink capacity request
RNC completes channel type
selection procedure

HSUPA connection can be established

• RRC Idle mode
• directly from CELL_PCH (Cell Update with reason Uplink Capacity Request)

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

 RRC Services
• Broadcast services
• Paging and Notification services
• Dedicated Control services
• Encapsulation of NAS signaling (CC, SM, MM, GMM, SMS)

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

 RRC States

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

 RRC Procedure

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

 System Information

• Within UTRAN system information is broadcasted with the help of the RRC messages
•System Information,
•Paging Type I, and
•System Information Change Indication.
• Most system information parameters are determined by the RNC. The Node B is informed about the parameters via
the NBAP message BCCH Information. Some system parameters can be made available by the Node B, such as
interference values, which change fast.
• Given the system information, the UE is capable to decide, whether or how to access the PLMN via the existing cell.
• System information is organised in System Information Blocks (SIBs).
•System information is grouped into SIB 1 to SIB 18.
•Each SIB is responsible to carry a specific content. For instance, SIB 12 holds measurement control
information and parameters.
•Depending on the UE‘s RRC state, is reads specific SIBs, and uses the transmitted parameters.
• There is a huge amount of SIBs, which have to be read by the UE. This requires a lot of battery power. Therefore, a
Master Information Block (MIB) was introduced, which gives references and scheduling information about the SIBs.
The MIB is transmitted in every 8 th radio frame on the P-CCPCH (on position SFN mod 8 = 0, and with a TTI of 20
ms). For most of the SIBs used within the system, the MIB may carry a value tag. The only exceptions are SIB 15.2,
SIB 15.3 and SIB 16. If a value tag is unchanged, the corresponding system information has not been modified.
Thus, there is no need for the UE to read the SIB. SIB 7 has no value tag. It changes with each occurrence.
Scheduling information is used to inform the UE, where and when a specific system information is transmitted.

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

 System Information
UTRAN
System Information ( )

NBAP: BCCH Information

UE RNC
Node B TS
TS25.433:
25.433:NBAP
NBAP
8.2.16 System Information Update
8.2.16 System Information Update

MIB
value tag M position on P-CCPCH: SFN mod 8* = 0
TTI: 20 ms
MIB: Master Information Block value tag M: range 1..8
SIB: System Information Block
SFN: System Frame Number SB
value tag N

SIB 1 SIB 2 SIB 3 SIB 18

value tag 1 value tag 2 value tag 3 value tag 18

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

 System Information Blocks
• For each SIB, following characteristics were specified:
•Area scope: Where is the value tag valid: within one cell or within a PLMN/ equivalent PLMN?
•UE RRC state: When the SIB is valid?
•UE RRC state: When the SIB is read?
•Scheduling information: At which position is the SIB transmitted and what is its repetition period?
•Modification of system information: Is it indicated by a value tag, or is it timer based?

• The UE receives all SIBs via the BCCH. There is only one exception: SIB 10. If a UE is capable to receive
simultaneously on one S-CCPCH and on one DPCH, then it receives SIB 10 on a FACH.
• Master Information Block (MIB):
•The MIB informs the UE about the supported PLMN types and the PLMN identity.
•The UE finds in the MIB also references to up to maxSIB (=32) SIBs, including their scheduling information
and type.
•A MIB is valid in one cell. If a UE changes the cell, is must read the new cell‘s MIB.
•The MIB is read in the RRC modes/states RRC idle, CELL_FACH, CELL_PCH and URA PCH.
•Its parameter are valid in the same states.
•A change of the MIB information is indicated by a value tag.

• In this course documentation, we only describe the System Information Blocks (SIBs), which are used in NSN‘s
RAN, and SIB 4 and SIB16.

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

 System Information Blocks

• System Information Block 1 (SIB 1)

•This SIB is used to inform the UE about NAS system information.
•The NAS system information characterises the NAS domains.
•SIB 1 also delivers UE timers and counters, which have to be used by the UE in the RRC idle and RRC
connected mode.
•For instance, a UE in the RRC connected mode uses the timer T305 for periodic cell and URA updates.
•SIB 1 is valid in one PLMN.
• The MIB is read in the RRC modes/states RRC idle, CELL_FACH, CELL_PCH and URA PCH. Its parameter
are valid in the same states, and the the RRC sub-state CELL_DCH.
•If the UE selects a new cell, and the SIB 1 value tag has the same number as in the preceding cell, the same
content is transmitted in this SIB. There is then no necessity for the UE to read this SIB after cell re-selection.
• System Information Block 2 (SIB 2)
•This SIB contains an URA identity list.
•SIB 2 is read and valid in the RRC sub-state URA_PCH. A change of the SIB 2 information is indicated by a
value tag.
• System Information Block 3 (SIB 3)
•This SIB contains relevant parameters for cell selection and re-selection.
•It also holds the cell identity and cell restriction data, such as „cell barred“ IEs.
•SIB 3 must be read and is valid in the RRC idle mode. It is read and valid in the RRC connected mode sub-
states CELL_FACH, CELL_PCH and URA_PCH, if SIB 4 is not broadcasted.
•A change of the SIB 3 information is indicated by a value tag.

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

 System Information Blocks

• System Information Block 4 (SIB 4)

•This SIB holds mostly the same data fields as SIB 3*, but it is read and valid only, when the UE is in the RRC
connected mode. I.e, this optional SIB is read and valid in the CELL_FACH, CELL_PACH and URA_PCH sub-
state.
• A change of the SIB 4 information is indicated by a value tag.
• System Information Block 5 (SIB 5)
•The parameters for the configuration of physical channels are broadcasted in this SIB.
•The parameters cover the PICH power offset, the AICH power offset, P-CCPCH, S-CCPCH and PRACH
system information lists.
•SIB 5 must be read and is valid in the RRC idle mode.
•It is read and valid in the RRC connected mode sub-states CELL_FACH, CELL_PCH and URA_PCH, if SIB 6
is not available.
•A change of the SIB 5 information is indicated by a value tag.
• System Information Block 7 (SIB 7)
•This SIB holds fast changing parameters. Therefore no value tag is used for it.
•The UE has to read its parameters periodically.
•For that, an expiration timer (Expiration Time Factor) is broadcasted with this message.
•SIB 7 expires at max(32, 8 * Expiration Time Factor).
•Expiration Time Factor can have the values 2times, 4 times, 8 times ... 256 times. Its default value is 1.
•The fast changing parameters transmitted with SIB 7 include the UL interference and dynamic persistence
level.
•It is read and valid in all states except for the CELL_DCH sub-state.

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

 System Information
scope/
SIB broadcasted information read valid modification

MIB • PLMN types & identities# RRC idle mode, RRC idle mode, cell/
• SIB Scheduling information CELL_FACH, CELL_PCH, CELL_FACH, CELL_PCH, value tag
• SIB references URA_PCH URA_PCH

SIB 1 • NAS information RRC idle mode, RRC idle mode, PLMN/
• UE timers & counters CELL_FACH, CELL_PCH, CELL_DCH, CELL_FACH, value tag
e.g. T305: Periodic Cell/URA Update URA_PCH CELL_PCH, URA_PCH
T301, 302, 304, 307-317

SIB 2 • URA identity list URA_PCH URA_PCH cell/

value tag

SIB 3* • Cell selection RRC idle mode, RRC idle mode, cell/
and re-selection parameters° (CELL_FACH, CELL_PCH, (CELL_FACH, CELL_PCH, value tag
e.g. CPICH Ec/N0 or CPICH RSCP; Sintrasearch, URA_PCH) URA_PCH)
Sintersearch, Ssearch,RAT, Qqualmin, Qrxlevmin,..

SIB 4* • Cell selection & re- CELL_FACH, CELL_PCH, CELL_FACH, CELL_PCH, cell/
selection parameters for URA_PCH URA_PCH value tag
UEs in the connected mode

SIB 5* • Parameters for common RRC idle mode, RRC idle mode, cell/
physical channel (CELL_FACH, (CELL_FACH, value tag
configuration CELL_PCH, URA_PCH) CELL_PCH, URA_PCH)
# GSM-MAP/ANSI41; MCC+MNC; ° + Cell Access Restrictions
* Read SIB 3 / 5 in Connected Mode if SIB4 / 6 (Connected Mode) not available
Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01
 System Information Blocks
• System Information Block 11 (SIB 11)
•This SIB holds measurement control information.
•The UE gets here the relevant date for traffic measurement, intra-frequency measurements, etc.
•SIB 11 must be read and is valid in the RRC idle mode. It is read and valid in the RRC connected mode sub-
states CELL_FACH, CELL_PCH and URA_PCH, if SIB 12 is not broadcasted.
•It is also valid in the RRC sub-state CELL_DCH, as long as the UE did not get a Measurement Control
message from UTRAN and SIB 12 is not broadcasted.
•A change of the SIB 11 information is indicated by a value tag.
• System Information Block 12 (SIB 12)
•SIB 12 transmits measurement control information for UEs in the RRC connected mode.
•If not transmitted, the UEs take the parameters broadcasted with SIB 11.
•If available, SIB 12 is read and valid in the RRC connected mode sub-states CELL_FACH, CELL_PCH and
URA_PCH.
•It is also valid in the RRC sub-state CELL_DCH, as long as the UE did not get a Measurement Control
message from UTRAN. A change of the SIB 12 information is indicated by a value tag.
• System Information Block 16 (SIB 16)
•RB, TrCH, and PhyCH parameters are broadcasted, which are stored by the UE both in the RRC idle and RRC
connected mode.
•The parameters are used during a handover to UTRAN. Consequently, these parameters stay valid, when the
UE is connected to GSM and GPRS.
•This SIB is valid in all RRC states, and read in all RRC states except for the CELL_DCH. The UE reads and
stores the parameters. A change of the SIB 16 information is indicated by a value tag.

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01

 System Information Blocks
scope/
SIB broadcasted information read valid modification

SIB 7 Fast changing parameters: RRC idle mode, RRC idle mode, cell/
• UL interference level CELL_FACH, CELL_PCH, CELL_FACH, CELL_PCH, max(32, 8 * Expir-‘
• Dynamic persistence level URA_PCH URA_PCH ation Time Factor)

SIB 11 Measurement control RRC idle mode, RRC idle mode, cell/
information* (CELL_FACH, CELL_PCH, (CELL_DCH, CELL_FACH, value tag
URA_PCH) CELL_PCH, URA_PCH)

SIB 12 • Measurement control CELL_FACH, CELL_PCH, CELL_DCH, CELL_FACH, cell/

information* for UEs in the URA_PCH CELL_PCH, URA_PCH value tag
RRC connected mode

SIB 16 • RB, TrCH, and PhyCH RRC idle mode, RRC idle mode, cell/
parameters for a CELL_FACH, CELL_PCH, CELL_FACH, CELL_PCH, value tag
GSM/GPRS-UMTS HO URA_PCH URA_PCH)

Examples of other SIB’s:

SIB 13: ANSI-41 system information
* e.g. FMCx & HOPx par.; Use of HCS; Ec/N0
orRSCP; Intra-, Inter-Frequency, Inter-RAT meas. SIB 14: Only for 3.84 Mcps TDD
info; Traffic volume meas. Info (e.g. RLC buffer SIB 15: useful for UE-based or UE-assisted positioning methods
payload) SIB 17: only for TDD
SIB 18: contains PLMN identities of neighbouring cells to be considered
in idle mode as well as in connected mode.
(adopted from TS 25.331 RRC)

Copyright © All rights reserved TECHCOM Consulting  TA -TC 6250 E01