Umts Signaling 111128180007 Phpapp02 Libre PDF

UMTS Signaling
Copyright Tekt ronix Berlin Gm bH & Co KG. Com pany confident ial.
UMTS Signaling
UMTS Signaling
UMTS INTERFACES, PROTOCOLS,
MESSAGE FLOWS, AND PROCEDURES
ANALYZED AND EXPLAINED
Ra lf Kr e h e r
Tekt ronix, I nc., Germ any
Tor st e n Ru e de bu sch
Tekt ronix, I nc., Germ any
PREFACE
The successful t rial, deploym ent , operat ion and t roubleshoot ing of 3G or UMTS infrast ruct ures and applicat ions is
one of t he m ost excit ing, fascinat ing and challenging t asks in t odays m obile com m unicat ions. I nt eroperabilit y ,
roam ing or QoS awareness bet ween m ult i operat ors and m ult i t echnology net work infrast ruct ures are j ust a few
of t he problem s, which need t o be m et . I n t odays early deploy m ent s of UMTS net works five m ain cat egor ies of
problem s can be different iat ed:
1.
2.
3.
4.
5.
Net work Elem ent I nst abilit y

Net work Elem ent I nt erwork ing
Mult i Vendor I nt erwork ing ( MVI )
Configurat ion Fault s
Net work Planning Fault s
To m eet t hese challenges, it is vit al t o underst and and analyze t he m essage flow s associat ed w it h UMTS.
UMTS Signaling focuses on providing an overview and reference t o UMTS, det ails of t he st andards, t he net work
archit ect ure, obj ect ives and funct ions of t he different int erfaces and prot ocols. Addit ionally it com prehensiv ely
describes various procedures from Node B Set up t o different Handover t ypes in t he UTRAN and t he Core Net work.
The focus on w ireline int erfaces is unique in t he m arket . All signaling sequences are based upon UMTS t races
from various UMTS net works ( t rial and com m ercial net works) around t he world. Wit h t his book t he reader has
access t o t he first universal UMTS prot ocol sequence reference, which allows t o quick ly different iat e valid from
invalid call cont rol procedures. I n addit ion all m ain signaling st ages are being explained, m any of which had been
left unclear in t he st andards so far and valuable t ips for prot ocol m onit oring are provided.
What w ill you get out of UMTS Signaling ?
A com prehensiv e overv iew on UMTS UTRAN and Core net works
o Lat est updat es for Rel. 4, Rel. 5 and Rel. 6 feat ures are included
o Descript ion of t he real- world st ruct ure of ATM t ransport net work on I ub and I u int erfaces
o Valuable t ips and t ricks for pract ical int erface m onit oring
I n- dept h descript ion of t he t asks and funct ions of UMTS int erfaces and Prot ocols
A deep prot ocol knowledge im provem ent
Pot ent ial t o analyze specific prot ocol m essages
Support t o reduce t im e and effort t o det ect and analyze problem s
Explanat ions how t o locat e problem s in t he net work.
Com prehensiv e descript ions and docum ent at ion of UMTS reference scenarios for different UMTS
procedures
o UTRAN Signaling Procedures
Descript ion of RRC m easurem ent procedures for radio net work opt im izat ion
Analysis and ex planat ion of PS calls w it h socalled channel t ype sw it ching, which is
one of t he m ost com m on perform ance problem s of packet sw it ched serv ices in
t oday's 3G net w orks
SRNS Relocat ion scenarios - including full descript ion of RANAP and RRC cont ainers
UMTS Signaling
More t han 35 decoded m essage exam ples using Tekt ronix' prot ocol t est ers giv e a
deep insight int o cont rol plane prot ocols on different layers
Core Net work Signaling Procedures
I n- dept h evaluat ions on m obilit y m anagem ent , session m anagem ent and call cont rol
procedures
Exam ple call flows of t he CS dom ain including pract ical ideas for t roubleshoot ing
Tunnel m anagem ent on Gn int erfaces
Mobilit y m anagem ent using opt ional Gs int erface
Discussion on core net work sw it ch ( MSC, SGSN) and dat abase ( HLR, VLR)
inform at ion exchange over Mobile Applicat ion Part ( MAP) .
Short int roduct ion t o 3G int elligent serv ices w it h CAMEL Applicat ion Part ( CAP)
prot ocol
Com prehensiv e descript ion of I nt er- MSC handover procedures for 3G 3G, 3G- GSM
and GSM- 3G handovers
Det ailed descript ion of RANAP, BSSAP and RRC inform at ion
UMTS Signaling readers should be rat her fam iliar w it h UMTS t echnology at a fairly det ailed level as t he book is
direct ed t o UMTS expert s, who need t o analyze UMTS signaling procedures at t he m ost det ailed level. This is why
only an int roduct ionary overv iew sect ion discusses t he UMTS Net work archit ect ure, t he obj ect ives and funct ions
of t he different int erfaces and t he various UMTS prot ocols. Then t he book leads right int o t he m ain part t he
analysis of all m ain signaling processes in a UMTS net works, so called UMTS scenarios. All m ain procedures from
Node B Set up t o Hard Handover- are described and explained com prehensiv ely.
The com binat ion of a net work of UMTS expert s around t he world from m any different com panies w it h Tekt ronix
m any years of experience in prot ocol analysis have result ed in t his unique book, com pendium and reference. I
hope it w ill prov e helpful for t he successful im plem ent at ion and deploym ent of UMTS.
Alois Hauk
General Manager
Monit oring and Prot ocol Test
Tekt ronix I nc.
I f you have any kind of feedback or quest ions feel free t o send us an em ail t o
um t s- signaling@t ekt ronix.com
For help w it h acronym s or abbrev iat ions, refer t o t he glossary at t he end of t his book.
UMTS Signaling
ACKN OW LED GM EN TS
The Tekt ronix Net work Diagnost ics Academ y t rained already hundreds of st udent s in UMTS and ot her experience
m obile t echnologies and in t est ing m obile net works.
The experience from t hese t rainings and our close cust om er relat ions point ed out , t hat a book on UMTS Signaling
is desperat ely needed.
We collect ed all t he m at erial t hat was available at Tekt ronix and t hat was provided by our part ners at net work
equipm ent vendors and net work operat ors t o add it t o t his unique select ion.
The aut hors would like t o acknowledge t he effort and t im e invest ed by all our colleagues
at Tekt ronix, w ho have cont ribut ed t o t his book.
Special t hanks go t o Jens I rrgang and Christ ian Villwock, Tekt ronix MPT, Berlin for t heir Co- Aut horship and t heir
valuable adv ice and input for chapt er 1.6 UMTS Securit y .
Wit hout Juergen Placht ( Sanchar Gm bH) t his book would not exist . His unbelievable know ledge, experience and
effort s in preparing t he very first slide set s for UMTS scenarios laid t he basis for t he m at erial you have now in
front of you.
Addit ionally, t he m at erial t hat Magnar Norderhus, Hum m ingbird, Duesseldorf, prepared for t he first UMTS
Training for Tekt ronix was t he very first source t hat we hav e blow n up for part one of t his book.
Many t hanks go t o Joerg Nest le Product Design, Munich, for doing a great j ob in t he creat ion of all t he basic
graphics.
We would like t o express t hanks t o Ot hm ar Kyas, Market ing Manager of Tekt ronix
Monit or & Prot ocol Test for his st rong believe in t he Tek t ronix Net work Diagnost ics Academ y, in UMTS Signaling
and for challenging us t o m ake t his book becom e real.
Of course we m ust not forget t o t hank Mark Ham m ond and t he t eam at Wiley . Mark want ed us t o do t he book
and kept us m oving, ev en t hough it t ook so m uch t im e t o get all t he perm issions aligned w it h Tekt ronix.
Last but not least a special 't hank you' t o our fam ilies and friends for t heir ongoing and infinit e pat ience and t heir
support t hroughout t his proj ect .
Berlin, Germ any

Ralf Kreher, Torst en Ruedebusch
UMTS Signaling
ABOUT TH E AUTH ORS

Ra lf Kr e h e r , Manager for Cust om er Training, Mobile Prot ocol Test , Tekt ronix, I nc.
Ralf Kreher leads t he Cust om er Training Depart m ent for Tekt ronix Mobile Prot ocol Test ( MPT) business. He is
responsible for t he world- class sem inar port folio for m obile t echnologies and m easurem ent product s. Before
j oining Tekt ronix, he held a t rainer assignm ent for swit ching equipm ent at Teles AG. He holds a Com m unicat ion
Engineering Degree of t he Technical College Deut sche Telekom Leipzig. He current ly r esides in Germ any.
Tor st e n Ru e de bu sch, Head of Knowledgeware and Training Depart m ent , Mobile Prot ocol Test , Tekt ronix , I nc.
Torst en Ruedebusch is t he head of t he Knowledgeware and Training Depart m ent for Tek t ronix Mobile Prot ocol
Test ( MPT) business. He is responsible for prov iding leading edge t echnology and product sem inars and t he
creat ion of know ledgeware product s using t he ext ensive Tekt ronix expert ise. Before j oining Tekt ronix , he held an
applicat ion engineer assignm ent at Siem ens CTE. He holds a Com m unicat ion Engineering Degree of t he
Technical College Deut sche Telekom Berlin. He current ly resides in Germ any.
UMTS Signaling
1 UM TS BASI CS
UMTS is real. I n several part s of t he world we can walk in t he st ores of m obile net work operat ors or resellers and
t ake UMTS PC- Cards or even 3G phones hom e and use t hem inst ant ly. Every day t he num ber of equipm ent and
t heir feat ure set s get s broader. The dream of m ult im edia on m obile connect ions, online gam ing, video
conferencing or even real- t im e video becom es realit y.
Wit h rapid t echnical innovat ion t he m obile t elecom m unicat ion sect or has cont inued t o grow and evolve st rongly .
The t echnologies used t o prov ide w ireless voice and dat a services t o subscribers, such as Tim e Div ision Mult iple
Access ( TDMA) , Universal Mobile Telecom m unicat ions Syst em s ( UMTS) and Code Div ision Mult iple Access ( CDMA) ,
cont inue t o grow in t heir com plexit y. This com plexit y cont inues t o im part a t im e- consum ing hurdle t o overcom e
when m ov ing from 2G t o 2.5G and t o t hird- generat ion ( 3G) net works.
GSM ( Global Sy st em for Mobile Com m unicat ion) is t he m ost w idely inst alled w ireless t echnology in t he world.
Som e est im at es put GSM m ark et share at up t o 80% . Long dom inant in Europe, GSM is now gaining a foot hold in
Brazil and is ex panding it s penet rat ion in t he Nort h Am erican m arket .
One reason for t his t rend is t he em ergence of reliable, profit able 2.5G GPRS elem ent s and services. Adding a
2.5G layer t o t he exist ing GSM foundat ion has been a cost - effect ive solut ion t o current barriers while st ill bringing
desired dat a services t o m arket . The enhancem ent t o EGPRS ( EDGE) allows a speed of 384kbit / s. This is t he
m axim um lim it . Now EDGE goes under pressure, because High Speed Downlink Packet Access ( HSDPA; see 1.2.3)
and it s speed of 2Mbit / s w ill t ake huge port s of t he m arket share once it is largely available.
So, t he EGPRS operat ors w ill sooner or lat er sw it ch t o 3G UMTS ( Figure 1.1) serv ices, t he lat est of which is UMTS
Release 6 ( R6) . This t ransit ion brings new opport unit ies and new t est ing challenges, bot h in t erm s of revenue
pot ent ial and addressing int eroperabilit y issues t o ensure QoS.
Wit h 3G m obile net works, t he revolut ion of m obile com m unicat ion has begun. 4G and 5G net works w ill m ake t he
net work t ransparent t o t he users applicat ions. I n addit ion t o horizont al handovers ( for exam ple bet ween Node
Bs) , handovers w ill occur vert ically bet w een applicat ions and t he t errest rial UTRAN ( UMTS Terrest rial Radio
Access) w ill be ext ended by a sat ellit e- based RAN ( Radio Access Net work) , ensuring global coverage.
Figure 1 1 - Com ponent Overview of a UMTS Net work
Every day t he num ber of com m ercial net works in different part s of t he world increases rapidly. Therefore,
net work operat ors and equipm ent suppliers are desperat e t o underst and how t o handle and analyze UMTS
signaling procedures in order t o get t he net work int o operat ion, det ect errors, and t roubleshoot fault s.
Those experienced w it h GSM w ill recognize m any sim ilarit ies w it h UMTS, especially in Non- Access- St rat um or
NAS- m essaging. However, in t he lower layers w it hin t he UTRAN and Core net work, UMTS int roduces a set of new
prot ocols, which deserve close underst anding and at t ent ion.
The philosophy of UMTS is t o separat e t he user plane from t he cont rol plane, t he radio net work from t he
t ransport net work, t he access net work from t he core net work, and t he access st rat um from t he nonaccess
st rat um .
The first part of t his book is a refresher on UMTS basics, t he second part cont inues w it h in- dept h m essage flow
scenarios of all kinds.
UMTS Signaling
1 .1 STAN D ARD S
I TU ( t he I nt ernat ional Telecom m unicat ion Union) solicit ed several int ernat ional organizat ions for descript ions of
t heir ideas for a t hird generat ion m obile net work:
CW TS: China Wireless Telecom m unicat ion St andard group

ARI B: Associat ion of Radio I ndust ries and Businesses, Japan
T1 : St andards Com m it t ee T1 Telecom m unicat ions, USA
TTA: Telecom m unicat ions Technology Associat ion, Korea
TTC: Telecom m unicat ion Technology Com m it t ee, Japan
ETSI : European Telecom m unicat ions St andards I nst it ut e
I TU decided which st andards w ould be used for I nt ernat ional Mobile Telecom m unicat ion at 2000 MHz. Many
different t echnologies w ere com bined in I MT- 2000 st andards.
Figure 1 2 - I MT- 2000
The m ain advant age of I MT- 2000 is t hat it specifies int ernat ional st andards and also t he int erworking w it h
ex ist ing PLMN st andards, such as GSM.
Figure 1 3 - I MT- 2000 St andards benefit users, operat ors, and vendors.
I n general t he qualit y of t ransm ission w ill be im proved. The dat a t ransfer rat e w ill increase dram at ically. Transfer
rat es of 384 kbit / s are already available; 2Mbit / s ( wit h HSDPA t echnology) is under t est and alm ost ready t o go
live in cert ain part s of Asia. New serv ice offerings w ill help UMTS t o becom e financially successful for operat or
and at t ract ive t o users.
The im provem ent for t he user w ill be t he worldwide access available w it h a m obile phone, and t he look and feel
of serv ices w ill be t he sam e wherev er he or she m ay be.
UMTS Signaling
There is a m igrat ion pat h from 2G t o 3G syst em s ( Figure 1.4) t hat m ay include an int erm ediat e st ep, t he socalled 2.5G net work. Pack et sw it ches - GGSN or SGSN in case of a GSM net work- are im plem ent ed in t he already
exist ing CN while t he RAN is not changed significant ly.
I n case of a m igrat ion from GSM t o UMTS a new radio access t echnology ( W- CDMA inst ead of TDMA) is
int roduced. This m eans t he net works w ill be equipped w it h com plet ely new radio access net w orks t hat replace
t he 2G net work elem ent s in t he RAN. However, EDGE ( Enhanced Dat a Rat es for GSM Evolut ion) opens a different
way t o offer high- speed I P serv ices t o GSM subscribers w it hout int roducing W- CDMA.
The already ex ist ing CDMA cellular net works, which are especially popular in t he Am ericas w ill undergo an
evolut ion t o becom e CDMA2000 net works w it h larger bandw idt h and higher dat a t ransm ission rat es.
Figure 1 4 Possible m igrat ion pat hs from 2G t o 3G
UMTS Signaling
1 .2 N ETW ORK ARCH I TECTURE

UMTS m aint ains a st rict separat ion bet w een t he radio subsyst em and t he net w ork subsyst em , allow ing t he
net work subsyst em t o be reused wit h ot her radio access t echnology. The core net work is adopt ed from GSM and
consist s of t wo user t raffic- dependent dom ains and several com m only used ent it ies.
Traffic- dependent dom ains correspond t o t he GSM or GPRS core net works and handle:
Circuit sw it ched t ype t raffic in t he CS Dom ain

Packet sw it ched t ype t raffic in t he PS Dom ain
Bot h t raffic- dependent dom ains use t he funct ions of t he rem aining ent it ies t he Hom e Locat ion Regist er ( HLR)
t oget her w it h t he Aut hent icat ion Cent er ( AC) , or t he Equipm ent I dent it y Regist er ( EI R) - for subscriber
m anagem ent , m obile st at ion roam ing and ident ificat ion, and handling different serv ices. Thus t he HLR cont ains
GSM, GPRS, and UMTS subscriber inform at ion.
Two dom ains handle t heir t raffic t ypes at t he sam e t im e for bot h t he GSM and t he UMTS access net works. The CS
dom ain handles all circuit sw it ched t ype of t raffic for t he GSM as well as for t he UMTS access net work; sim ilarly,
t he PS dom ain t akes care of all packet sw it ched t raffic in bot h access net works.
1 .2 .1 GSM
The second generat ion of PLMN is represent ed by a GSM net w ork consist ing of Net work Sw it ching Subsyst em
( NSS) and a Base St at ion Subsyst em ( BSS) .The first evolut ion st ep ( 2.5G) is a GPRS PLMN connect ed t o a GSM
PLMN for packet - orient ed t ransm ission.
Figure 1 5 - GSM Net work Archit ect ure
The m ain elem ent in t he NSS is t he Mobile Sw it ching Cent er ( M SC) , which cont ains t he Visit or Locat ion Regist er
( VLR) . The MSC represent s t he edge t ow ards t he BSS and on t he ot her side as Gat eway MSC ( GM SC) , t he
connect ion point t o all ex t ernal net works, such as t he Public Sw it ched Telephone Net work or I SDN. GSM is a
circuit sw it ched net work, which m eans t hat t here are t wo different t ypes of physical links t o t ransport cont rol
UMTS Signaling
inform at ion ( signaling) and t raffic dat a ( circuit ) . The signaling links are connect ed t o Signaling Transfer Point s
( STP) for cent ralized rout ing w hereas circuit s are connect ed t o special sw it ching equipm ent .
H LR
Hom e Locat ion Regist er
SGSN
Serv ing GPRS Support Node wit h Locat ion Regist er

Funct ion
GGSN
Gat eway GPRS Support Node
Au C
Aut hent icat ion Cent er
SCP
Serv ice Cont rol Point
SM SC
Short Message Service Cent er
CSE
CAMEL Service Ent it y ( Cust om ized Applicat ion for Mobile

net work Enhanced Logic)
The m ost im port ant ent it y in BSS is t he Base St at ion Cont roller, which, along w it h t he Pack et Cont rol Unit ( PCU) ,
serves as t he int erface w it h t he GPRS PLMN. Several Base St at ions ( BTS) can be connect ed t o t he BSC.
1 .2 .2 UM TS Re le a se 9 9
Figure 1 6 - UMTS Rel. 99 Net w ork Archit ect ure
UMTS Signaling
The figure above shows t he basic st ruct ure of a UMTS Rel. 99 net work . I t consist of t he t wo different radio access
part s BSS and UTRAN and t he core net work part s for circuit sw it ched ( e.g. voice) and packet sw it ched ( e.g. em ail
download) applicat ions.
To im plem ent UMTS m eans t o set up a UMTS Terrest rial Radio Access Net work ( UTRAN ) , which is connect ed t o a
circuit sw it ched core net work ( GSM w it h MSC/ VLR) and t o a packet sw it ched core net work ( GPRS w it h SGSN plus
Locat ion Regist er Funct ion - SLR) . The int erfaces are nam ed I u whereas I uCS goes t o t he MSC and I uPS goes t o
t he SGSN. Alt ernat ively t he circuit and packet net work connect ions could also be realized w it h an UMSC t hat
com bines MSC and SGSN funct ionalit ies in one net work elem ent .
The corresponding edge wit hin UTRAN is t he Radio Net work Cont roller ( RN C) . Ot her t han in t he BSS t he RNCs of
one UTRAN are connect ed w it h each ot her v ia t he I ur int erface.
The base st at ions in UMTS are called N ode B, which is j ust it s work ing nam e and has no ot her m eaning. The
int erface bet ween Node B and RNC is t he I ub int erface.
Release 99 ( som et im es also nam ed Release 3) specifies t he basic requirem ent s t o roll out a 3G UMTS Radio
Access Net work. All follow ing releases ( 4, 5, 6 et c.) int roduce a num ber of feat ures t hat allow operat ors t o
opt im ize t heir net works and t o offer new serv ices. A real net work env ironm ent in t he fut ure w ill never be
designed st rict ly following any defined release st andard. Rat her it m ust be seen as a kind of pat chwork t hat is
st ruct ured follow ing t he requirem ent s of net w ork operat ors and serv ice prov iders. So it is possible t o int roduce
e.g. High Speed Downlink Pack et Access ( HSDPA) , which is a feat ure clearly defined in Release 5 in com binat ion
w it h a Release 99 radio access net work.
I n addit ion it m ust be kept in m ind t hat due t o changing needs of operat ors and growing experience of equipm ent
m anufact urers every t hree m ont hs ( four t im e per year! ) all st andard docum ent s of all releases are revised and
published w it h a new version. So also developm ent of Rel. 99 st andards is not even finished yet .
I t also m ight be possible t hat in lat er st andard versions int roduct ion of feat ures prom ised in earlier version is
delayed. This becam e t rue for inst ance for definit ion of Hom e Subscriber Serv er ( HSS) t hat w as originally
int roduced in early Rel. 4 st andards, but t hen delayed t o be defined det ailed in Rel. 5.
The feat ure descript ions for higher releases in next chapt ers are based on docum ent s not older t han 2004- 06
rev ision.
1 .2 .3 UM TS Re le a se 4
3GPP Release 4 int roduces som e m aj or changes and new feat ures in t he core net work dom ains and t he GERAN
( GPRS/ EDGE Radio Access Net w ork) , which replaces GSM BSS. Som e of t he m aj or changes are:
Separat ion of t ransport bearer and bearer cont rol in t he CS core net work
I nt roduct ion of new int erfaces in CS core net w ork
ATM ( AAL2) or I P can now be used as dat a t ransport bearer in t he CS dom ain
I nt roduct ion of low chip rat e ( also called: narrowband) TDD. Describes t he radio access t echnology
behind t he Chinese TD- SCDMA st andard while UMTS TDD ( w ideband TDD, TD- CDMA) is seen as
dom inat ing TDD t echnology in European and Asian st andards out side China. I t is expect ed t hat
int erference in low chiprat e TDD has less im pact on cell capacit y com pared t o sam e effect in w ideband
TDD. I n addit ion low chiprat e TDD equipm ent shall support advanced radio t ransm ission t echnologies
like " sm art ant ennas" and beam form ing, which m eans t o point a single ant enna or a set of ant ennas at
t he signal source t o reduce int erference and im prove com m unicat ion qualit y.
I P- based Gb I nt erface
I Pv6 Support ( opt ional)
UMTS Signaling
Figure 1 7 - UMTS Rel. 4 Net work Archit ect ure
The new feat ures and Serv ices are :
Mult im edia Serv ices in t he CS Dom ain

Handover of real t im e applicat ion in t he PS Dom ain
UTRAN Transport Evolut ions
o AAL2 connect ion QoS opt im izat ion over I ub and I ur int erfaces
o Transport bearer m odificat ion procedure on I ub, I ur, and I u
I P t ransport of Core Net work ( CN) prot ocols
RAB QoS Negot iat ion over I u int erface during Relocat ion
Radio I nt erface I m provem ent s

o UTRA repeat er specificat ion
o DSCH power cont rol im provem ent
RAN im provem ent s
o Node B Synchronizat ion for TDD
o RAB support enhancem ent
Transparent End- t o- End PS Mobile St ream ing Applicat ions
Em ergency call enhancem ent s for CS based calls
Bearer independent CS archit ect ure
Real t im e Facsim ile
Tandem Free Operat ion
Transcoder Free Operat ion
ODB ( Operat or Det erm ined Barring) for Packet Orient ed Serv ices
Mult im edia Messaging Serv ice
UI CC/ ( U) SI M enhancem ent s and int erwork ing
( U) SI M t oolk it enhancem ent s
o USAT local link
o UI CC API t est ing
o Prot ocol St andardizat ion of a SI M Toolkit I nt erpret er
Advanced Speech Call I t em s enhancem ent s
Reliable QoS for PS dom ain
UMTS Signaling
The m ain t rend in Rel. 4 is t he separat ion of cont rol and serv ices of CS connect ions and at t he sam e t im e t he
conversat ion of t he net work t o be com plet ely I P- based.
I n CS CN t he user dat a flow w ill go t hrough Media Gat eways ( M GW ) , which are elem ent s m aint aining t he
connect ion and perform ing sw it ching funct ions when required ( bearer sw it ching funct ions of t he MSC are
provided by t he MGW) . The process is cont rolled by a separat e elem ent evolv ed from MSC/ VLR called M SC
Se r ve r ( cont rol funct ions of t he MSC are provided by t he MSC Server and also cont ains t he Visit or Locat ion
Regist er ( VLR) funct ionalit y) , w hich is in t erm s of voice over I P net works a signaling gat eway. One MSC Server
cont rols num erous MGWs. To increm ent cont rol capacit ies, a new MSC Server w ill be added. To increase t he
sw it ching capacit y, one has t o add MGWs.
I n 3GPP Release 5, t he UMTS evolut ion cont inues. The shift t o an all I P env ironm ent w ill be realized: all t raffic
com ing from UTRAN is supposed t o be I P- based.
By changing GERAN, t he BSC w ill be able t o generat e I P- based applicat ion packet s. That is why t he circuit
sw it ched core net work w ill not be part of UMTS Rel. 5 anym ore.
All int erfaces w ill be I P- rat her t han ATM- based.
The dat abases known from GSM/ GPRS w ill be cent ralized in a Hom e Subscriber Server ( H SS) . Toget her w it h
Value Added Services and CAMEL it represent s t he Hom e Environm ent ( H E) . CAMEL could perform t he
com m unicat ion w it h t he HE com plet ely .
When t he net w ork has m oved t owards I P, t he relat ionship bet ween circuit and packet sw it ched t raffic w ill change.
The m aj orit y of t raffic w ill be packet - orient ed because som e t radit ionally circuit - sw it ched services, including
speech, w ill becom e packet sw it ched ( VoI P) .
To offer uniform m et hods of I P applicat ion t ransport , Rel. 5 w ill cont ain an I P Mult im edia Subsyst em ( I M S) ,
which efficient ly support s m ult iple m edia com ponent s. E.g. video, audio, shared whit eboards, et c.
HSDPA w ill provide dat a rat es of up t o 10 Mbps in downlink direct ion and low er rat es in uplink ( e.g. I nt ernet
browsing or Video on dem and) t hrough t he new High Speed Downlink Shared Channel ( HS- DSCH) ( for det ails see
3GPP 25.855) .
Figure 1 8 - UMTS Rel. 5 Basic Archit ect ure
N e w in Re le a se 5
UMTS Signaling
All net work node int erfaces connect ed t o I P net work

Hom e Subscriber Server ( HSS) replaces HLR/ AUC/ EI R
I P m ult im edia syst em ( I MS)
o Opt ional I Pv6 im plem ent at ion
o Session I nit iat ion Prot ocol ( SI P) for CS signaling and m anagem ent of I P m ult im edia sessions
o SI P support s addressing form at s for voice and packet calls and num ber t ranslat ion
requirem ent s for SI P < - > E.164
High Speed Downlink Packet Access ( HSDPA) int egrat ion
o Dat a rat es of up t o 10 Mbps in downlink direct ion; low er rat es in uplink ( e.g. I nt ernet
browsing or Video on dem and)
o New High Speed Downlink Shared Channel ( HS- DSCH)
All voice t raffic is voice over packet
MGW required at point of int erconnect ion ( POI )
SGW ( MSC Serv er) t ranslat es signaling t o legacy ( SS7) net works
AMR- WB, an enhanced Adapt ive Mult irat e AMR ( Wideband) codec for voice services
New net work elem ent MRF ( Media Resource Funct ion)
o Part of t he Virt ual Hom e Env ironm ent ( VHE) for port abilit y across net work boundaries and
bet ween t erm inals. Users experience t he sam e personalized feat ures and serv ices in what ev er
net work and what ever t erm inal
o Very sim ilar in funct ion t o a MGCF ( Media Gat eway Cont rol Funct ion) and MGW ( Media
Gat eway) using H.248/ MEGACO t o est ablish suit able I P or SS7 bearers t o support different
kinds of m edia st ream s
New net work elem ent CSCF ( Call Session Cont rol Funct ion)
o Provides session cont rol m echanism s for subscribers accessing services w it hin t he I M ( I P
Mult im edia) CN.
o CSCF is a SI P Server t o int eract w it h net work dat abases ( e.g. HSS for m obilit y and AAA
( Access, Aut horizat ion and Account ing) for securit y)
New net work elem ent SGW ( Signaling Gat eway)
o I n CS dom ain t he user signaling will go t hrough t he SGW, w hich is t he gat ew ay for signaling
inform at ion t o/ from t he PSTN
New net work elem ent CS- GW ( Circuit Sw it ched Gat eway)
o The CS- GW is t he gat ew ay from t he I MS int o t o/ from t he PSTN ( e.g. for VoI P calls)
Locat ion Serv ices for PS/ GPRS
I u Flex
Break ing hierarchical m apping of RNCs t o SGSNs ( MSCs)
Wideband AMR ( new 16 kHz codec)

End- t o- end QoS in t he PS dom ain
GTT: Global Text Telephony ( Service for handicapped users)
Messaging and Securit y Enhancem ent s
CAMEL Phase 4
o New funct ions such as m id call procedures, int eract ion w it h opt im al rout ing, et c.
Load sharing
o UTRAN ( Radio Net work for WCDMA)
o GERAN ( Radio Net work for GSM/ EDGE)
o WCDMA in 1800/ 1900 MHz frequency spect rum s
o Mobile Ex ecut ion Environm ent ( MExE) support for Java and WAP applicat ions
I MS
UMTS Signaling
Figure 1 9 - Overview of I MS archit ect ure
The Proxy- Call St at e Cont rol Funct ion ( P- CSCF) is locat ed t oget her w it h t he GGSN in t he sam e net work. I t s m ain
t ask is t o select t he I - CSCF in t he users hom e net work and do som e basic local analysis, e.g. QoS surveillance or
num ber t ranslat ion.
The I nt errogat ing- CSCF ( I - CSCF) provides access t o t he users Hom e Net work and select s t he S- CSCF ( in t he
Hom e Net work, t oo) .
The Serv ing- CSCF ( S- CSCF) is responsible for t he Session Cont rol, handles SI P request s and t akes care of all
necessary procedures, such as bearer est ablishm ent bet w een hom e and visit ed net work .
The Hom e Subscriber Server ( HSS) is t he form er Hom e Locat ion Regist er ( HLR) . I t was renam ed t o em phasis
t hat t he dat abase does not only cont ain locat ion- relat ed, but subscript ion- relat ed dat a ( subscribed serv ices and
t heir param et ers, et c.) , t oo.
H SD PA
HSDPA is a packet - based dat a service w it h dat a speed of up t o 1.2- 14.4 Mbps ( and 20 Mbps for MI MO syst em s)
over a 5MHz bandwidt h in downlink. HSDPA im plem ent at ions include Adapt ive Modulat ion and Coding ( AMC) ,
Mult iple- I nput Mult iple- Out put ( MI MO) , Hybrid Aut om at ic Repeat Request ( HARQ) , fast cell search, and advanced
receiver design ( Figure 1.10) .
Figure 1 10 - HSDPA Prot ocol Archit ect ure
I u Fle x
Before UMTS Rel. 5 t he RNC < - > SGSN relat ion was hierarchical: Each RNC w as assigned t o exact ly one SGSN;
each SGSN serv ed one or m ore RNCs:
UMTS Signaling
Figure 1 11 - Hierarchical RNC < - > SGSN relat ion
Wit h Rel. 5 I uFlex allows m any- t o- m any relat ions of RNCs, SGSNs or MSCs) , where RNCs and SGSNs are
belonging t o Pool Areas ( can be serv ed by one or m ore SGSNs/ MSCs in parallel) . All cells cont rolled by a RNC
belong t o one or m ore Pool Area[ s] so t hat a UE m ay roam in Pool Areas w it hout changing t he SGSN/ MSC.
The int egrat ion of I uFlex offers now load balancing bet w een SGSNs/ MSCs in one Pool Area, reduct ion of SGSN
relocat ions and reduced signaling and access t o HLR / HSS. An overlap of Pool Areas m ight allow m apping
m obilit y pat t erns ont o Pool Areas ( e.g. cov er cert ain resident ial zones plus cit y cent er) .
Figure 1 12 - I uFlex Basic Descript ion
When t he UE perform s a GPRS At t ach t he RNC select s a suit able SGSN and est ablishes t he connect ion. The SGSN
encodes it s NRI ( Net work Resource I dent ificat ion) int o t he PTMSI . Now UE, RNC and Serv ing SGSN know t he
m apping I MSI < > NRI and RNC and SGSN are able t o rout e t he packet s accordingly.
As long as t he UE is in PMM- Connect ed m ode t he RNC ret ains m apping I MSI < > NRI . I f t he st at us changes t o
PMM- I dle m ode t he RNC delet es UE dat a ( No packet s from / t o UE need t o be rout ed) . I f t he UE re- ent ers PMMConnect ed m ode, it prov ides again NRI of it s Serv ing SGSN t o t he RNC.
UMTS Rel. 6 is st ill under m assive developm ent , howev er m aj or im provem ent s are already very clear: a clear
pat h t owards UMTS/ WLAN I nt erwork ing, I MS Phase 2 , Push- t o- Talk serv ice, Packet Sw it ched St ream ing
Serv ices, Mult im edia Broadcast and Mult icast Serv ice ( MBMS) , Net work Sharing, Presence Serv ice and t he
definit ion of various ot her new m ult im edia serv ices. The pict ure below describes t he basic Rel. 6 archit ect ure
followed by a m ore det ailed descript ion of t he new feat ures and serv ices t hat Rel. 6 w ill have t o offer.
UMTS Signaling
Figure 1 13 3GPP UMTS Rel. 6 Net work Model
The Proxy- Call St at e Cont rol Funct ion ( P- CSCF) is t he first cont act point for t he GGSN t o t he I MS aft er PDP
cont ext act ivat ion. The Serv ing- CSCF ( S- CSCF) is responsible for t he Session Cont rol for t he UE and m aint ains
and st ores session st at es t o support t he services.
The Breakout - CSCF ( B- CSCF) select s t he I MS CN ( if wit hin t he sam e I MS CN) or forwards t he request ( if breakout
is w it hin anot her I MS CN) for t he PSTN breakout and t he Media Gat eway Cont rol Funct ion ( MGCF) for PSTN
int erwork ing. Prot ocol m apping funct ionalit y is provided by t he MGCF ( e.g. handling of SI P and I SUP) while
bearer channel m apping is being handled by t he Media Gat eway ( MGW) . Signaling bet w een MGW and MGCF
follows H.248 prot ocol st andard and handles signaling and session m anagem ent . The Media Resource funct ion
( MRF) provides specific funct ions ( e.g. conferencing or m ult ipart y calls) , including bearer and service validat ion.
N e w in Re le a se 6
UM TS/ W LAN I n t e r w or k in g ( Figu r e 1 .1 4 )
WLAN could be used at hot spot s as access net work for I MS inst ead of t he UMTS PS Dom ain ( saves
expensive 3G spect rum and cell space)
Access t hrough ( m ore expensiv e) PS Dom ain allows broadest coverage out side hot spot s
Handovers bet w een 3G ( even GPRS) and WLAN shall be support ed ( roam ing)
WLANs m ight be operat ed eit her by m obile operat ors or by 3rd part y
Archit ect ure Definit ion for support ing aut hent icat ion, aut horizat ion and charging ( st andard I ETF AAA
Server) included
o AAA Server receives dat a from HSS / HLR
UMTS Signaling
Figure 1 14 - WLAN/ UMTS Support Archit ect ure
Pu sh - t o- Ta lk ove r Ce llu la r ( PoC) se r vice
Push- t o- Talk is a real- t im e one- t o- one or one- t o- m any voice com m unicat ion ( like w it h a walk ie- t alk ie,
half duplex only) over dat a net works
I nst ead of dialing a num ber a subscriber m ight be select ed e.g. from a buddy list
Pa ck e t Sw it che d St r e a m in g Se r vice s ( PSS)
PSS is used t o t ransm it st ream ing cont ent ( subscriber can st art t o view, list en in real- t im e, even t hough
t he ent ire cont ent has not been downloaded)
Support of End- t o- End- Bit rat e- Adapt at ion t o m eet t he different condit ions in m obile net works ( allows t o
offer QoS from best effort t o Guarant eed )
Digit al Right s Managem ent ( DRM) is support ed
Different Codecs w ill be support ed ( e.g. MPEG- 4 or Windows Media Video 9)
N e t w or k Sh a r in g
Allows cost efficient sharing of net work resources such as Net w ork Equipm ent ( Node B, RNC, et c.) or
Spect rum ( Ant enna Sit es) , reduces t im e t o m arket and deploym ent and finally let s operat ors get earlier
int o profit generat ion.
Sharing can be realized w it h different m odels
o Mult iple core net works share com m on RANs ( each operat or m aint ains indiv idual cells w it h
separat e frequencies and separat e MNC ( Mobile Net work Code) ; BTSs and RNCs are shared,
but t he MSCs and HLRs are st ill separat ed)
o Sharing of a com m on core net work ( CN) wit h separat ed RANs ( like above)
o Operat ors agree on a geographical split of net w orks in defined t errit ories w it h roam ing
cont ract s so t hat all t he m obile users have full coverage over t he t errit ory
Pr e se n ce Se r vice
User w ill have t he opt ion t o m ake t hem selves visible or inv isible t o ot her part ies and allow or decline
services t o be offerd
Users can creat e buddy list s and be inform ed about st at e changes
Subscriber own user- profiles t hat m ake service delivery independent of t he t ype of UE or access t o t he
net work
Mult im edia Broadcast and Mult icast Serv ice ( MBMS)
MBMS is an unidirect ional point - t o- m ult ipoint bearer serv ice ( push serv ice)
Dat a is t ransm it t ed from a single source t o m ult iple subscribers over a com m on radio channel
Service could t ransm it e.g. t ext , audio, pict ure, video
User shall be able t o enable/ disable t he serv ice
UMTS Signaling
Broadcast m ode sends t o every user w it hin reach ( t ypically not charged, e.g. advert isem ent )
Mult icast m ode select ively t ransm it s only t o subscribed users ( t ypically charged serv ice)
Applicat ion Exam ples
o Mult icast of e.g. sport event s
o Mult ipart y Conferencing
o Broadcast of em ergency inform at ion
o Soft ware Download
o Push- t o- Talk
I M S Ph a se 2
The I MS archit ect ure of Rel. 5 was im proved and enhanced for Rel. 6
QoS needed for voice and m ult im edia services is int egrat ed
Main purpose is t he int egrat ion all t he Core Net work ( CN) t o provide I P m ult im edia sessions on basis of
I P m ult im edia sessions, support real t im e int eract ive serv ices, provide flex ibilit y t o t he user and t o
reduce cost
Exam ples of support ed Services
o Voice Telephony ( VoI P)
o Call- Conferencing
o Group Managem ent
Set t ing up and m aint aining user groups
Support ing service for ot her services ( Mult ipart y conferencing, Push- t o- t alk)
o Messaging
SI P- based m essaging
I nst ant m essaging
Chat room
Deferred m essaging ( equivalent t o MMS)
I nt erworks w it h Presence Serv ice t o det erm ine whet her addressee is available
o Locat ion Based Serv ices
UE indicat es local serv ice request
S- CSCF rout es request back t o visit ed net work
Mechanism for UE t o ret rieve / receive inform at ion about locally available serv ices
o I P< - > I MS I nt erwork ing funct ions
o I MS< - > CS I nt erwork ing funct ions
o Lawful int ercept ion int egrat ion
UMTS Signaling
1 .3 UM TS I N TERFACES
Figure 1.15 shows a basic overview of t he different int erfaces in an UMTS Rel. 99 net work . A det ailed descript ion
of obj ect ives and funct ions follows in t his chapt er.
Figure 1 15 - UMTS I nt erface Overview
1 .3 .1 I u I n t e r fa ce
The I u int erface is locat ed bet w een t he RNC and MSC for circuit - sw it ched t raffic and bet ween RNC and SGSN for
packet - sw it ched t raffic. I u provides t he connect ion t o classic voice services at t he sam e t im e as t he connect ion
for all k inds of packet serv ices. I t plays a v it al role for t he handover procedures in t he UMTS net work.
Obj ect ives & Funct ions of t he I u I nt erface
The I u I nt erface shall t ake care of t he int erconnect ion of RNCs w it h t he Core Net work Access Point s w it hin a
single PLMN and t he int erconnect ion of RNCs w it h Core Net w ork Access Point s irrespect ive of t he m anufact urer of
any of t he elem ent s. Ot her t ask s are t he int erw orking t owards GSM, t he support of all UMTS serv ices, t he
support of independent evolut ion of Core, Radio Access, and Transport Net works and finally t he m igrat ion of
serv ices from CS t o PS.
The I u int erface is split int o t wo t ypes of int erfaces
I uPS ( Packet Sw it ched) , corresponding int erface t owards t he PS dom ain

I uCS ( Circuit Sw it ched) , corresponding int erface t owards t he CS dom ain
The I u int erface support s t he follow ing funct ions:
Est ablishing, m aint aining, and releasing Radio Access Bearers
Perform ing int ra- and int ersyst em handover and SRNS relocat ion
A set of general procedures, not relat ed t o a specific UE
Separat ion of each UE on t he prot ocol level for user- specific signaling m anagem ent
Transfer of NAS signaling m essages bet ween UE and CN
Locat ion services by t ransferring request s from t he CN t o UTRAN, and locat ion inform at ion from UTRAN
t o CN
Sim ult aneous access t o m ult iple CN dom ains for a single UE
Mechanism s for resource reservat ion for packet dat a st ream s
UMTS Signaling
1 .3 .2 I u b I n t e r fa ce
The I ub int erface is locat ed bet ween an RNC and a Node B. Via t he I ub int erface, t he RNC ( Radio Net work
Cont roller) cont rols t he Node B. For exam ple, t he RNC allows t he negot iat ing of radio resources, t he adding and
delet ing of cells cont rolled by t he individual Node B, or t he support ing of t he different com m unicat ion and cont rol
links. One Node B can serve one or m ult iple cells.
Obj e ct ive s & Fu n ct ion s of t he I u b I n t e r fa ce
The I ub int erface enables cont inuous t ransm ission sharing bet ween t he GSM/ GPRS Abis int erface and t he I ub
int erface and m inim izes t he num ber of opt ions available in t he funct ional division bet ween RNC and Node B. I t
cont rols - t hrough Node B- a num ber of cells and adds or rem ove radio link s in t hose cells. Anot her t ask is t he
logical O&M support of t he Node B and t o avoid com plex funct ionalit y as far as possible over t he I ub. Finally
accom m odat e t he probabilit y of frequent swit ching bet w een different channel t ypes.
The I ub I nt erface support s t he funct ions described in t he t able below.
Funct ion
Descript ion
Relocat ing serving

RNC
Changes t he serving RNC funct ionalit y as

well as t he relat ed I u resources ( RAB( s)
and Signaling connect ion) from one RNC
t o anot her.
Overall RAB
m anagem ent
Set s up, m odifies, and releases RAB
Queuing t he set up of
RAB
Allows placing som e request ed RABs int o

a queue and indicat e t he peer ent it y
about t he queuing
Request ing RAB

release
Request s t he release of RAB ( Overall RAB

m anagem ent is a funct ion of t he CN)
Release of all I u
connect ion resources
Explicit ly releases all resources relat ed t o

one I u connect ion
Request ing t he
release of all I u
Request s release of all I u connect ion
connect ion resources
resources from t he corresponding I u

connect ion ( I u release is m anaged from
t he CN)
Managem ent of I ub
Transport Resources
Logical O&M of Node

B
I ub Link Managem ent

Cell Configurat ion Managem ent
Radio Net work Perform ance
Measurem ent s
Resource Event Managem ent
Com m on Transport Channel
Managem ent
Radio Resource Managem ent
UMTS Signaling
Radio Net work Configurat ion

Alignm ent
I m plem ent at ionSpecific O&M

Transport
Syst em I nform at ion

Managem ent
Traffic Managem ent

of Com m on Channels
Traffic Managem ent

of Dedicat ed
Channels
Traffic Managem ent

of Shared Channels
Tim ing and

Synchronizat ion
Managem ent
Adm ission Cont rol

Power Managem ent
Dat a Transfer
Radio Link Managem ent , Radio

Link Superv ision
Channel Allocat ion / Deallocat ion
Power Managem ent
Measurem ent Report ing
Dedicat ed Transport Channel
Managem ent
Dat a Transfer
Channel Allocat ion / Deallocat ion

Power Managem ent
Transport Channel Managem ent
Dat a Transfer
Transport Channel
Synchronizat ion ( Fram e
synchronizat ion)
Node B - RNC node
Synchronizat ion
I nt er Node B node
Synchronizat ion
UMTS Signaling
Table 1 1 I ub Funct ion Overview
1 .3 .3 I u r I n t e r fa ce
The I ur int erface connect s RNCs inside one UTRAN.
Obj ect ives & Funct ions of t he I ur I nt erface
The I ur int erface provides an open int erface archit ect ure and support s signaling and dat a st ream s bet ween RNCs,
allows point - t o- point connect ion and t he addit ion or delet ion of radio links support ed by cells belonging t o any
RNS wit hin t he UTRAN. Addit ionally it allows an RNC t o address any ot her RNC w it hin t he UTRAN t o est ablish
signaling bearer or user dat a bearers for I ur dat a st ream s.
The I ur I nt erface support s t hese funct ions
Transport Net w ork Managem ent

Traffic m anagem ent of Com m on Transport Channels
Preparat ion of Com m on Transport Channel resources
o Paging
Traffic Managem ent of Dedicat ed Transport Channels
o Radio Link Set up/ Addit ion/ Delet ion
o Measurem ent Report ing
Measurem ent report ing for com m on and dedicat ed m easurem ent obj ect s
UMTS Signaling
1 .4 UM TS D OM AI N ARCH I TECTURE
UMTS t ried from it s beginning t o be very m odular in it s st ruct ure. This is t he base of becom ing an int ernat ional
st andard ev en t hough cert ain m odules w ill be nat ional specific.
Figure 1 16 - UMTS Dom ain Archit ect ure
The t wo im port ant big m odules are t he Acce ss St r a t u m ( Mobile and UTRAN) and t he N on - Acce ss St r a t u m
( cont aining serv ing core net work, Access St rat um and USI M) .
UMTS Signaling
1 .5 UTRAN
Figure 1 17 - UMTS UTRAN

Two new net work elem ent s are int roduced in UTRAN: Radio Net work Cont roller ( RNC) , and Node B. UTRAN is
subdiv ided int o indiv idual Radio Net work Syst em s ( RNS) , where a Radio Net w ork Cont roller ( RNC) cont rols each
RNS.
The RNC is connect ed t o a set of Node B elem ent s, each of w hich can serve one or sev eral cells.
Exist ing net work elem ent s, such as MSC, SGSN, and HLR, can be ext ended t o adopt t he UMTS requirem ent s, but
RNC and Node B require com plet ely new designs. RNC w ill becom e t he replacem ent for BSC, and Node B fulfills
nearly t he sam e funct ionalit y as BTS. GSM and GPRS net works w ill be ext ended and new serv ices w ill be
int egrat ed int o an overall net w ork t hat cont ains bot h exist ing int erfaces, such as A, Gb, and Abis, and new
int erfaces t hat include I u, I ub, and I ur.
The m ain UTRAN t asks are:
Adm ission Con t r ol ( AC)
Adm it s or denies new users, new radio access bearers, or new radio links. The adm ission cont rol should t ry t o
avoid overload sit uat ions and w ill not det eriorat e t he qualit y of t he ex ist ing radio links. Decisions are based on
int erference and resource m easurem ent s ( power or on t he t hroughput m easurem ent s) . Toget her w it h Pack et
Scheduler it allocat es t he bit rat es set s ( t ransm ission powers) for Non- Realt im e connect ions. The adm ission
cont rol is em ployed at , for exam ple, t he init ial UE access, t he RAB assignm ent / reconfigurat ion, and at handov er.
The funct ionalit y is locat ed in t he RNC.
Power based AC needs t he reliable Received Tot al Wideband Power m easurem ent s from t he NB and assures t he
coverage st abilit y. I n t he pow er based case, t he upper boundary for t he AC operat ion is defined by t he m axim um
allowed det eriorat ion of t he qualit y for t he exist ing links ( = t he m axim um allow ed det eriorat ion of t he pat h loss) .
This lim it is usually defined as PRX Target [ dB] ( Figure 1.18) .
Throughput Based AC assures t he const ant m axim um cell t hroughput in every m om ent of t he operat ion, but
allows excessiv e cell breat hing. On t he linear scale t he receiv ed power changes [ dB] can be expressed as t he cell
loading [ % ] . Via a sim ple equat ion t he cell loading [ % ] is bounded w it h t he cell t hroughput [ kbps] and call
qualit y [ Eb / N0] .
UMTS Signaling
Figure 1 18 - Throughput Based Adm ission Cont rol

Conge st ion Cont r ol
Monit ors, det ect s, and handles sit uat ions when t he syst em is reaching a near overload or an overload sit uat ion
w it h t he already connect ed users.
Syst e m I n for m a t ion Br oa dca st in g
Prov ides t he UE w it h t he Access- St rat um and Non- Access- St rat um inform at ion, which are needed by t he UE for
it s operat ion w it hin t he net work.
Ciphe r in g
Encrypt s inform at ion exchange and is locat ed bet ween UE and RNC.
H a n dove r ( H O)
Manages t he m obilit y of t he radio int erface. I t is based on radio m easurem ent s and for Soft / Soft er HO it is used
t o m aint ain t he Qualit y of Service request ed by t he Core Net work. An I nt ersyst em HO is necessary t o avoid
loosing t he UEs net work connect ion. I n t hat case a even a lower QoS m ight be accept ed. Handover m ay be
direct ed t o or from anot her syst em ( for exam ple, UMTS t o GSM handover) .
Furt her funct ions of UTRAN are configurat ion and m aint enance of t he radio int erface, pow er cont rol, paging, and
m acro diversit y.
1 .5 .1 RN C
The RNC is t he m ain elem ent in t he RNS ( Radio Net work Subsyst em ) and cont rols usage and reliabilit y of radio
resources. There are t hree t ypes of RNCs: SRNC ( Serv ing RNC) , DRNC ( Drift RNC) and CRNC ( Cont rolling RNC) .
Tasks of t he Radio Net work Cont roller are:
Ca ll Adm ission Con t r ol
Provides resource check procedures before new users access t he net work, as required by t he CDMA air int erface
t echnology.
Ra dio Be a r e r M a na ge m e nt
Set s up and disconnect s radio bearers and m anages t heir QoS.
Code Alloca t ion
Manages t he code planning t hat t he CDMA t echnology requires.
Pow e r Con t r ol
Perform s t he out er loop power cont rol 10- 100 t im es per second and defines t he SI R for a giv en QoS.
Conge st ion Cont r ol
Schedules packet s for PS CN dat a t ransm ission.
O& M t a sk s
Perform s general m anagem ent funct ions and connect ion t o OMC.
Addit ionally, t he RNC can act as a m acro div ersit y point ; for exam ple a collect ion of dat a from one UE t hat is
received via several Node Bs.
UMTS Signaling
D iffe r e n t RN C t ype s
Figure 1 19 - Different RNC Types

Con t r ollin g RN C ( CRN C)
The CRNC cont rols, configures and m anages an RNS and com m unicat es w it h NBAP w it h t he physical resources of
all Node Bs connect ed via t he I ub int erfaces. Access request s of UEs w ill be forwarded from t he relat ed Node B t o
t he CRNC.
D r ift RN C ( D RN C)
The DRNC receives connect ed UEs t hat are handed over ( drift ed) from a SRNC cell connect ed t o a different RNS
( Radio Net work Subsyst em ) because e.g. t he received level of t hat cell becam e crit ical ( m obilit y) . The RRC
however st ill t erm inat es w it h t he SRNC. The DRNC exchanges t hen rout ing inform at ion bet w een SRNC and UE.
DRNC in I nt er- RNC Soft HO sit uat ion is t he only DRNC from SRNC point of v iew. I t lends radio resources t o SRNC
t o allow Soft HO. However, radio resources are cont rolled by CRNC funct ion of t he sam e phy sical RNC m achine.
Funct ions can be dist inguished by prot ocol used: DRNC " speaks" RNSAP w it h SRNC via I ur, CRNC " speaks" NBAP
w it h cells via I ub.
Se r vin g RN C ( SRN C)
The SRNC cont rols a users m obilit y w it hin a UTRAN and is t he connect ion point t o t he Core Net work ( CN)
t owards MSC or SGSN, t oo. The RNC t hat has a RRC connect ion w it h an UE is it s SRNC. The SRNC " speaks" RRC
wit h UE via I ub, Uu and if necessary v ia I ur and " foreign" I ub ( cont rolled by DRNC) .
1 .5 .2 N ode B
The Node B provides t he physical radio link bet ween t he UE and t he net work. I t organizes t ransm ission and
recept ion of dat a across t he radio int erface and also applies codes t hat are necessary t o describe channels in
CDMA sy st em s. The t asks of a Node B are sim ilar t han t hose of a BTS ( Base Transceiv er St at ion) . The Node B is
responsible for:
Pow e r Con t r ol
Perform s t he inner loop power cont rol, which m easures t he act ual SI R, com pares it w it h t he specific defined value,
and m ay t rigger changes in t he TX- Power of a UE.
M e a sur e m e nt Re por t
Gives t he m easured values t o t he RNC.
M icr o D ive r sit y
Com bines signals ( from t he m ult iple sect ors of t he ant enna t hat a UE is connect ed t o) int o one dat a st ream
before t ransm it t ing t he sum - signal t o t he RNC. ( The UE is connect ed t o m ore t han one sect or of an ant enna t o
allow for a soft er handover.)
The Node B is t he physical unit t o carry one or m ore cells ( 1 cell = 1 ant enna) .
There are t hree t ypes of Node Bs:
UTRA- FDD Node B

UTRA- TDD Node B
Dual Mode Node B ( UTRA- TDD and UTRA- FDD)
UMTS Signaling
N ot e : I t is not expect ed t o have 3.84 TDD and 1.28 TDD cells in t he sam e net work, but operat ors in sam e area
are expect ed t o work wit h different TDD versions.
So, 3- band- Node Bs are not necessary .
1 .5 .3 Ar e a Con ce pt
The areas of 2G w ill be cont inuously used in UMTS.
UMTS w ill add a new group of locat ions specify ing t he UTRAN Regist rat ion Areas ( URA) . These areas w ill be
sm aller Rout ing or Locat ion Areas and w ill be m aint ained by UTRAN it self, covered by a num ber of cells. The URA
is configured in t he UTRAN, and broadcast ed in relevant cells.
The different areas are used for Mobilit y Managem ent e.g. Locat ion Updat e and Paging procedures.
Figure 1 20 - UMTS Areas

LA Locat ion Area
The LA ( Locat ion Area) is a set of cells ( defined by t he m obile operat or) t hroughout which a m obile w ill be paged.
The LA is ident ified by t he LAI ( Locat ion Area I dent ifier) w it hin a PLMN ( Public Land Mobile Net work) and consist s
of MCC ( Mobile Count ry Code) , MNC ( Mobile Net work Code) and LAC ( Locat ion Area Code) .
LAI = MCC + MNC + LAC
RA Rout ing Area
One or m ore RA is cont rolled by t he SGSN. Each UE inform s t he SGSN about t he current RA. RAs can consist of
on one or m ore cells. Each Rout ing Area is ident ified by a RAI ( Rout ing Area I dent ificat ion) . The RAI is used for
paging and regist rat ion purposes and consist s of LAC and RAC. The RAC ( Lengt h: 1 oct et fixed) ident ifies a
rout ing area w it hin a locat ion area and is part of t he RAI .
RAI = LAI + RAC
SA Serv ice Area
The SA ident ifies an area of one or m ore cells of t he sam e LA ( Locat ion Area) . And is used t o indicat e t he locat ion
of a UE ( User Equipm ent ) t o t he CN ( Core Net work) .
The com binat ion of SAC ( Service Area Code) , PLMN - I d ( Public Land Mobile Net work I dent ifier) and LAC ( Locat ion
Area Code) is t he Serv ice Area I dent ifier.
SAI = PLMN- I d + LAC + SAC
URA UTRAN Regist rat ion Area
The URA is configured in t he UTRAN, broadcast ed in relevant cells and cov ers an area of a num ber of cells.
UMTS Signaling
1 .5 .4 UM TS Use r Equ ipm e nt & USI M
Figure 1 21 - UMTS User Equipm ent
I n UMTS t he m obile st at ion is called User Equipm ent ( UE) and is const ruct ed in a very m odular way. I t consist s of
follow ing part s:
M obile Te r m in a t ion ( M T)
Represent s t he t erm inat ion of t he radio int erface and, by t hat , t he t erm inat ion of an I MT- 2000 fam ily- specific
unit . There are different MT m essages for UMTS in Europe as opposed t o in t he USA.
Te r m in a l Ada pt e r
Represent s t he t erm inat ion of t he applicat ionspecific serv ice prot ocols, for ex am ple, AMR for speech. This
funct ion w ill perform all necessary m odificat ions t o t he dat a.
Te r m in a l Equ ipm e n t
Bepresent s t he t erm inat ion of t he serv ice.
USI M ( UMTS Subscriber I dent it y Module)
I s a user subscript ion t o t he UMTS m obile net w ork and cont ains all relevant dat a t hat enables access ont o t he
subscribed net w ork. Every UE m ay cont ain one or m ore USI M sim ult aneously ( 100% flexibilit y) . Higher layer
st andards lik e MM/ CC/ SM address 1 UE + 1 ( of t he sev eral) USI M when t hey m ent ion a MS.
Figure 1 22 - UMTS Service I dent it y Module ( USI M)

The m ain difference bet ween a USI M and a GSM- SI M is t hat t he USI M is downloadable ( by default ) , can be
accessed v ia t he air int erface, and can be m odified by t he net work.
The USI M is a Universal I nt egrat ed Circuit Card ( UI CC) , which has m uch m ore capacit y t han a GSM SI M. I t can
st ore Java applicat ions. I t can also st ore profiles cont aining user m anagem ent and right s inform at ion and
descript ions of t he way applicat ions can be used.
UMTS Signaling
1 .5 .5 M obile s
M obile Te r m in a t ion s
The Mobile Ter m inat ions are divided int o differ ent groups:
Figure 1 23 - Types of Mobile Term inat ions
Single Ra dio M ode M T

t he UE can work w it h only one t ype of net work because only one Radio Access Technology ( RAT) is im plem ent ed.
M ult i Ra dio M ode M T
m ore t han one Radio Access Technology ( RAT) is support ed. 3GPP specifies handover bet ween different RATs in
great det ail.
Sin gle N e t w or k M T
independent of t he Radio Mode, t he Single Net work MT is capable of using only one t ype of core net work; for
exam ple only t he packet sw it ched CN ( PC- Card) .
M u lt i N e t w or k M T
I ndependent of t he Radio Mode, t he Mult i Net w ork MT can work w it h different t ypes of core net works. At t he
beginning of UMTS, t he m ult i net work operat ions w ill hav e t o be perform ed sequent ially, but , at a lat er st age,
parallel operat ions could also be possible. This abilit y w ill depend heavily on t he overall perform ance of t he UE
and t he net work capacit y.
The first UMTS m obiles should be Mult i Radio - Mult i Net work m obiles.
M obile Ca pa bilit ie s
The possible feat ures of UTRAN and CN will be t ransm it t ed via Syst em I nform at ion on t he radio int erface via
broadcast channels. A UE can, by list ening on t hese channels, configure it s ow n set t ings t o work w it h t he act ual
net work .
UMTS Signaling
Figure 1 24 - Mobile Capabilit ies
On t he ot her hand, t he UE w ill also indicat e it s own capabilit ies t o t he net work by sending MS Classm ark and MS
Radio Access Capabilit y inform at ion t o t he net w ork.
Below an ext ract of possible capabilit ies:
Available W- CDMA m odes, FDD or/ and TDD

Dual m ode capabilit ies, support of different GSM frequencies
Support of GSM PS feat ures, GPRS or/ and HSCSD
Available encrypt ion algorit hm s
Propert ies of m easurem ent funct ions, t im ing
Abilit y of posit ioning m et hods
Abilit y t o use univ ersal charact er set 2 ( 16bit charact ers)
I n GSM, MS Classm ark 1 and 2 were used. I n UMTS, MS Classm ark 2 and t he new MS Classm ark 3 are used. The
difference is t he num ber of param et er for different feat ures can be t ransm it t ed.
1 .5 .6 QoS Ar ch it e ct u r e
There is 1: 1 relat ion bet w een Bearer Serv ices and Qualit y of Serv ice ( QoS) in UMTS net works.
Ot her t han in 2G syst em s where a Bearer was a t raffic channel in 3G t he Bearer represent s a select ed QoS for a
specific serv ice. Only from t he point of v iew of t he physical lay er a Bearer is a t ype of channel.
A Bearer Serv ice is a serv ice t hat guarant ees a Qualit y of Serv ice bet w een t wo endpoint s of com m unicat ion.
Several param et ers w ill have t o be defined from operat ors.
A Bearer Service is classified by a set of values for t hese param et ers:
Traffic class
Maxim um bit rat e
Guarant eed bit rat e
Deliv ery order
Maxim um SDU ( Service Dat a Unit ) size
SDU form at inform at ion
SDU error rat io
Residual bit error rat io
Deliv ery of erroneous SDUs
Transfer delay
Traffic handling priorit y
Allocat ion/ ret ent ion priorit y
The End- t o- end Serv ice w ill define t he const raint s for t he QoS. These const raint s w ill be given t o t he low er Bearer
Serv ices, t ranslat ed int o t heir configurat ion param et ers and again passed t o t he lower layer. By t hat , UMTS set s
up a connect ion t hrough it s ow n layer archit ect ure fulfilling t he request ed QoS.
UMTS Signaling
Figure 1 25 - UMTS Bearer / QoS Archit ect ure
Problem s are foreseen in t he Ex t ernal Bearer Serv ices because t hey are out side of UMTS and t he responsibilit y of
t he UMTS net work operat or.
QoS Classes w it h QoS At t ribut es have been specified in t o m eet t he needs of different End- t o- end services.
Conve r sa t ion a l Cla ss
Real- t im e applicat ions w it h short predict able response t im e. Sym m et ric t ransm ission w it hout buffering of dat a
and w it h a guarant eed dat a rat e.
St r e a m in g Cla ss
Real- t im e applicat ions w it h short predict able response t im e. Asym m et ric t ransm ission w it h possible buffering of
dat a and wit h a guarant eed dat a rat e.
I nt e r a ct ive Cla ss
Non- real- t im e applicat ions w it h accept able variable response t im e. Asym m et ric t ransm ission w it h possible
buffering of dat a but w it hout guarant eed dat a rat e.
Ba ck gr ound Cla ss
Non- real- t im e applicat ions w it h long response t im es. Asym m et ric t ransm ission w it h possible buffering of dat a but
w it hout a guarant eed dat a rat e.
Figure 1 26 - UMTS Bearer / QoS Classes
UMTS Signaling
1 .6 UM TS SECURI TY
Aft er experiencing GSM, t he 3GPP creat ors want ed t o im prove t he securit y aspect s for UMTS.
For exam ple, UMTS addresses t he Man- in- t he- Middle Fake BTS problem by int roducing a signaling int egrit y
funct ion.
Figure 1 27 - Ciphering in ancient Greece
The m ost im port ant securit y feat ures in t he access securit y of UMTS are:
Use of t em porary ident it ies ( TMSI , PTMSI )

Mut ual aut hent icat ion of t he user and t he net w ork
Radio access net work encrypt ion
Prot ect ion of signaling int egrit y inside UTRAN
1 .6 .1 H ist or ic de ve lopm e n t
Alt hough Ciphering and Crypt analysis becam e a hot t opic accelerat ed by t he current geo polit ic environm ent ,
inform at ion securit y is not a new issue.
400 years B.C. t he ancient Greeks used so called skyt als ( germ . Skyt ale) for encrypt ion. A skyt al is a wooden
st ick of fixed diam et er w it h a long paper st rip w inded around t he st ick. The sender wrot e a m essage on t he paper
in longit udinal direct ion. The unw inded paper st rip gave no m eaningful inform at ion t o t he courier or ot her
unaut horized person. Only a receiver who owns a st ick w it h t he sam e diam et er was able t o decipher t he m essage
( Figure 1 27) .
Caesar was ciphering secret inform at ion sim ply by replacing ev ery charact er w it h anot her one t hat was in t he
alphabet t hree places behind it . The word crypt ology would be ciphered as fubswrorj b . Code books were
w idely used in t he 12t h cent ury. Cert ain key w ords of a t ext w ere replaced by ot her predefined words w it h
com plet ely different m eaning. A receiver who owns an ident ical code book is able t o derive t he original m essage.
Kasiskis and William F. Friedm ans fundam ent al research about st at ist ical m et hods in t he 19t h cent ury are t he
foundat ion of m odern m et hods for ciphering and crypt analysis.
The Second World War gave anot her boost for ciphering t echnologies. The Enigm a was an exam ple of advanced
ciphering m achines used by t he Germ an m ilit ary. Great Brit ain under Alan Turing w it h his bom b was able t o
crack Enigm a ( Figure 1 28) .
UMTS Signaling
Figure 1 28 - Enigm a and Bom b as exam ples for decrypt ion and encrypt ion
Anot her m ilest one was Claude E. Shannons art icle Com m unicat ion Theory of Secret Syst em s published in 1949.
I t gives t he inform at ion- t heoret ic basis for crypt ology and prov es Vernam s One- Tim e- Pad as a secure crypt osyst em .
I n t he last cent ury several ciphering t echnologies has been dev eloped, which can be div ided in sym m et ric and
asym m et ric m et hods. Sym m et ric m et hods are less secure because t he sam e key is used for ciphering and
deciphering. Exam ples are t he Dat a Encrypt ion St andard ( DES) developed by I BM and t he I nt ernat ional Dat a
Encrypt ed Algorit hm ( I DEA) proposed by Lai and Massey.
Asym m et ric t echnologies use one encrypt ion k ey ( public key) and anot her decrypt ion key ( privat e key) . I t is not
possible t o calculat e t he decry pt ion k ey only by knowing t he encrypt ion key . The m ost com m on asym m et ric
ciphering m et hod is RSA, developed by Riv est , Sham ir and Adlem an in 1978. The m et hod is based on t he
principle of big prim e num bers: I t is relat ively easy t o det ect t wo prim e num bers x and y wit h 1000 and m ore
digit s. How ever, even t oday it is not possible t o calculat e t he fact ors of t he product x * y in reasonable t im e.
Kasum i from Mit subishi dev eloped an algorit hm for ciphering and int egrit y prot ect ion used in UMTS net works. The
3GPP st andard is open for ot her ciphering m et hods, but t oday Kasum i is t he first and only ciphering algorit hm
used in UMTS.
Se cu r it y t h r e a t s a n d pr ot e ct ion in m obile n e t w or k s
I n a digit al m obile net work t he subscriber is exposed several basic at t acks as described below ( Figure 1.29) :
Eavesdropping ( t heft of voice and dat a inform at ion)

Unaut horized I dent ificat ion
Unaut horized usage of services
Offending t he dat a int egrit y ( dat a falsificat ion by an int ruder)
Observat ion
o Det ect ion of t he current locat ion
o Observat ion of com m unicat ion relat ions ( Who is com m unicat ing wit h whom ?)
o Generat ion of behav ior profiles
UMTS Signaling
Figure 1 29 - Pot ent ial at t ack point s of int ruders

As an exam ple for unlawful observat ion, Figure 1 30 shows a part of a Measurem ent Report Message capt ured on
t he GSM Abis I nt erface. An act ive m obile perm anent ly m easures t he pow er level and t he bit error rat e of it s
serv ing cell and up t o six neighbor cells. This inform at ion is t ransm it t ed from t he m obile over t he base
t ransceiver st at ion ( BTS) t o t he base st at ion cont roller ( BSC) . I n addit ion, t he BTS sends t he Tim ing Advance
I nform at ion t o t he m obile. The Tim ing Advance is a value in t he range from 0 t o 63. The Tim ing Advance is an
indicat or of t he dist ance bet w een BTS and m obile. Assum ing t hat t he m ax im um cell size in GSM is 30 km , t he
Tim ing Advance value allows est im at ing t he dist ance w it h 500 m precision. I n urban places however, t he cell size
is m uch sm aller. Com bining t hat inform at ion, a pot ent ial int ruder can relat ively exact ly det erm ine t he locat ion of
t he m obile subscriber.
GSM was originally designed as a circuit - sw it ched voice net work. I n cont radict ion t o t he voice dat a, cont rolling
inform at ion are never ciphered in GSM. I n addit ion, t he ciphering is lim it ed t o t he air int erface. Needless t o say,
t hat Short Messages are t ransferred over t he signaling net work and t herefore are nev er ciphered.
Figure 1 30 - Measurem ent result m essage sent unciphered via GSM radio channels
GPRS as ext ension t o GSM already offers significant securit y im provem ent s. User a n d cont rolling inform at ion are
ciphered not only over air int erface but also over t he Gb I nt erface bet w een BSC and SGSN. Com m only used in
com m ercial net works are GEA1 and GEA2, recent ly under developm ent is GEA3. The m ost secure m obile net work
is t he UMTS net work.
UMTS act ively com bat s prior m ent ioned t hreat s offering t he follow ing securit y procedures:
Ciphering of cont rol inform at ion and user dat a

Aut hent icat ion of t he user t ow ards t he net work
UMTS Signaling
Aut hent icat ion of t he net work t owards t he user

I nt egrit y prot ect ion
Anonym it y
The UMTS securit y procedures are described in t he follow ing chapt ers. Securit y m echanism over t ransport
net works ( Tunneling, I Psec) are not part of t his book.
Pr in ciple s of GSM Se cu r it y a n d t h e e volu t ion t o UM TS Se cu r it y
As UMTS can be seen as an evolut ion of t he 2G ( GSM) com m unicat ion m obile syst em s, t he securit y feat ures for
UMTS are based on t he GSM securit y feat ures and are enhanced. When UMTS was defined from t he Third
Generat ion Part nership Proj ect , bet t er known as 3GPP, t here w as t he basic requirem ent t o adopt t he securit y
feat ures from GSM t hat have proved t o be needed and robust and t o be as com pat ible wit h t he 2G securit y
archit ect ure as possible. UMTS should correct t he problem s w it h GSM by addressing it s real and perceiv ed
securit y weaknesses and t o added new securit y feat ures t o secure t he new services offered by 3G.
The lim it at ions and weaknesses of t he GSM securit y archit ect ure st em by large from designing lim it at ions rat her
t han on defect s in t he securit y m echanism s t hem selves. GSM has t he follow ing specific w eaknesses t hat are
correct ed w it hin UMTS.
Act iv e at t acks using a false base st at ion

o Used as I MSI cat cher ( collect real I MSI s of MSs t hat t ry t o connect w it h t he base st at ions) ?
cloning risk
o Used t o int ercept m obile originat ed calls - Encrypt ion is cont rolled by net work, so user is
unaware if it is not on
Cipher keys and aut hent icat ion dat a are t ransm it t ed in clear bet ween and w it hin net works
o Signaling sy st em vulnerable t o int ercept ion and im personat ion
Encrypt ion of t he user and signaling dat a does not carry far enough t rough t he net work t o prevent
being sent over m icrowave links ( BTS t o BSC) Encrypt ion t erm inat ed t oo soon
Possibilit y of channel hij ack in net works t hat does not offer confident ialit y
Dat a int egrit y is not provided, except t radit ional non- crypt ographic link- lay er checksum s
I MEI ( I nt ernat ional Mobile Equipm ent ident ifier - unique) is an unsecured ident it y and should be t reat ed
as such as t he Term inal is an unsecured env ironm ent , t rust in t he t erm inal ident it y is m isplaced
Fraud and lawful int ercept ion w as not considered in t he design phase of 2G
t here is no HE k now ledge or cont rol of how an SN uses aut hent icat ion param et ers for HE subscribers
roam ing in t hat SN
Syst em s do not have t he flexibilit y t o upgrade and im prove securit y funct ionalit y over t im e
Confidence in st rengt h of algorit hm s
o Failure t o choose best aut hent icat ion algorit hm
o I m provem ent s in crypt analysis of A5/ 1
Key lengt h t oo short
Lack of openness in design and publicat ion
Furt herm ore t here are challenges t hat securit y serv ices w ill have t o cope w it hin 3G syst em s t hat w ill probably be
Tot ally new services are likely t o be int roduced

There w ill be new and different providers of services
Mobile syst em s will be posit ioned as preferable t o fix ed line syst em s for users
Users w ill t ypically have m ore cont rol over t heir serv ice profile
Dat a serv ices w ill be m ore im port ant t han voice serv ices
The Term inal w ill be used as a plat form for e- com m erce and ot her sensit ive applicat ions
The follow ing feat ures of GSM securit y are reused for UMTS
User Aut hent icat ion and radio int erface encrypt ion
Subscriber ident it y confident ialit y on t he radio int erface
SI M as a rem ov able, hardware securit y m odule, in UMTS called USI M
o Term inal independent
o Managem ent of all cust om er param et er
Operat ion w it hout user assist ance
Minim ized t rust of t he SN ( Serv ing Net work) by t he HE ( Hom e environm ent )
UMTS Signaling
1 .6 .2 UM TS Se cu r it y Ar chit e ct u r e
Based on t he follow ing pict ure, show ing t he order of all t ransact ions of a connect ion, t he next chapt ers w ill cover
t he Aut hent icat ion and Securit y Cont rol part and explain t he overall securit y funct ions for t he connect ion.
The 3G securit y archit ect ure ( Figure 1.32 / 1.33) is a set of securit y feat ures and enhancem ent s t hat are fully
described in t he 3GPP 33.102 and is based on t he t hree securit y principles:
Au t h e n t ica t ion a n d Ke y Agr e e m e n t ( AKA)
Aut hent icat ion is provided t o assure t he claim ed ident it y bet w een t he user and t he net work, divided in int o t w o
part s
Aut hent icat ion of t he user t ow ards t he net work

Aut hent icat ion of t he net work t owards t he user ( new in UMTS)
This is done in so called onepass aut hent icat ion reducing m essages sent back and fort h. Aft er t hese
procedures t he user w ill be sure t hat he is connect ed t o his served/ t rust ed net work and t he net work is sure t hat
t he claim ed ident it y of t he user is t rue. Aut hent icat ion is needed for t he ot her securit y m echanism s as
confident ialit y and int egrit y.
Figure 1 31 - Net work Transit ions
I n t e gr it y
I nt egrit y prot ect ion is used t o secure t hat t he cont ent of a signaling m essage bet ween t he user and t he net work
has not been m anipulat ed, ev en if t he m essage m ight not be confident ial. This is done by generat ing st am ps
individually from t he User and t he net work t hat are added t o t he t ransferred signaling m essages. The st am ps are
generat ed based on a pre- shared secret key K, t hat is st ored in t he USI M and t he AuC. At t ransport lev el, t he
int egrit y is checked by CRC checksum , but t hese m easures are only t o achieve bit - error free com m unicat ion and
are not equivalent t o t ransport level int egrit y.
UMTS Signaling
Figure 1 32 - UMTS Securit y Archit ect ure
Figure 1 33 - UMTS I nt erface and Dom ain Archit ect ure Overview
Con fide n t ia lit y
Confident ialit y is used t o keep inform at ion secured from unwant ed part ies. This is achiev ed by ciphering of t he
user/ signaling dat a bet w een t he subscriber and t he net work and by referring t o t he subscriber by t em porary
ident it ies ( TMSI / P- TMSI ) inst ead of using t he global ident it y, I MSI . Ciphering is carried out bet ween t he Users
t erm inal ( USI M) and t he RNC. User confident ialit y is bet w een t he subscriber and t he VLR/ SGSN. I f t he net work
does not prov ide user dat a confident ialit y , t he subscriber is inform ed and has t he opport unit y t o refuse
connect ions.
Part s t hat are confident ial are:
Subscriber ident it y
Subscribers current locat ion
User Dat a ( Voice and dat a)
Signaling dat a
UMTS Signaling
1 .6 .3 Au t h e n t ica t ion a n d Ke y Agr e e m e n t ( AKA)

UMTS securit y st art s w it h t he Aut hent icat ion and Key Agreem ent ( AKA) , t he m ost im port ant feat ure in t he UMTS
syst em . All ot her serv ices depend on t hem since no higher lev el serv ices can be used w it hout aut hent icat ion of
t he user.
M u t u a l Au t h e n t ica t ion
I dent ifying t he user t o t he net work

I dent ify ing t he net work t o t he user
Ke y a gr e e m e n t
Generat ing t he cipher k ey

Generat ion t he I nt egrit y key
Aft e r Au t h e n t ica t ion a n d Ke y Agr e e m e n t
I nt egrit y prot ect ion of m essages

Confident ialit y prot ect ion of signaling dat a
Confident ialit y prot ect ion of user dat a
The m echanism of m ut ual aut hent icat ion is achieved by t he user and t he net w ork show ing knowledge of a secret
key ( K) which is shared bet ween and available only t o t he USI M and t he AuC in t he user's HE. The m et hod was
chosen in such a way as t o achieve m axim um com pat ibilit y w it h t he current GSM securit y archit ect ure and
facilit at e m igrat ion from GSM t o UMTS. The m et hod is com posed of a challenge/ response prot ocol ident ical t o t he
GSM subscriber aut hent icat ion and key est ablishm ent prot ocol com bined w it h a sequence num ber- based onepass prot ocol for net work aut hent icat ion
The aut hent icat ing part ies are t he AuC of t he user's HE ( HLR/ AuC) and t he USI M in t he user's m obile st at ion. The
m echanism consist s of t he dist ribut ion of aut hent icat ion dat a from t he HLR/ AuC t o t he VLR/ SGSN and a
procedure t o aut hent icat e and est ablish new cipher and int egrit y keys bet ween t he VLR/ SGSN and t he MS.
AKA Pr oce du r e
UMTS Signaling
Figure 1 34 - Exam ple for AV ( Aut hent icat ion Vect or) sending from HE t o SN in Aut hent icat ion dat a response
Once t he HE/ AuC has received a request from t he VLR/ SGSN, it sends an ordered array of n aut hent icat ion
vect ors t o t he VLR/ SGSN ( Figure 1.35) . Each aut hent icat ion vect or consist s of t he follow ing com ponent s: a
random num ber RAND, an expect ed response XRES, a cipher key CK, an int egrit y key I K and an aut hent icat ion
t oken AUTN. Each aut hent icat ion vect or is only valid for one aut hent icat ion and key agreem ent bet ween t he
VLR/ SGSN and t he USI M and are ordered based on sequence num ber. The VLR/ SGSN init iat es an aut hent icat ion
and key agreem ent by select ing t he next aut hent icat ion v ect or from t he ordered array and sending t he
param et ers RAND and AUTN t o t he user. I f t he AUTN is accept ed by t he USI M, it produces a response RES t hat is
sent back t o t he VLR/ SGSN. Aut hent icat ion vect ors in a part icular node are used on a first - in / first - out basis. The
USI M also com put es CK and I K. The VLR/ SGSN com pares t he receiv ed RES w it h XRES. I f t hey m at ch t he
VLR/ SGSN considers t he aut hent icat ion and key agreem ent exchange t o be successfully com plet ed. The
est ablished key s CK and I K will t hen be t ransferred by t he USI M and t he VLR/ SGSN t o t he ent it ies t hat perform
ciphering and int egrit y funct ions. VLR/ SGSNs can offer secure serv ice ev en when HE/ AuC links are unavailable by
allow ing t hem t o use previously derived cipher and int egrit y keys for a user so t hat a secure connect ion can st ill
be set up w it hout t he need for an aut hent icat ion and key agreem ent . Aut hent icat ion is in t hat case based on a
shared int egrit y key, by m eans of dat a int egrit y prot ect ion of signalling m essages.
AKA is perform ed when t he follow ing event s happen:
Regist rat ion of a user in a Serving Net work

Aft er a service request
Locat ion Updat e Request
At t ach Request
Det ach request
Connect ion re- est ablishm ent request
Regist rat ion of a subscriber in a serving net work t ypically occurs when t he user goes t o anot her count ry. The
coverage area of an operat or is nat ionw ide, and roam ing bet ween nat ional operat ors w ill t herefore be lim it ed.
The first t im e t he subscriber t hen connect s t o t he serv ing net work, he get s regist ered in t he Serv ing Net work .
Service Request is t he possibilit y for higher- level prot ocols/ applicat ions t o ask for AKA t o be perform ed. E.g.
perform ing AKA t o increase securit y before an online bank ing t ransact ion. The t erm inal updat es t he HLR regularly
w it h it s posit ion in Locat ion Updat e Request s.
At t ach request and det ach request are procedures t o connect and disconnect t he subscriber t o t he net work.
UMTS Signaling
Connect ion re- est ablishm ent request is perform ed when t he m axim um num ber of local aut hent icat ions has been
conduct ed.
A weakness of t he AKA is, t hat t he HLR/ AuC does not check if t he inform at ion sent from t he VLR/ SGSN
( Aut hent icat ion inform at ion) is correct or not .
Algor it h m s u se d for AKA ( Ta ble s 1 .2 a n d 1 .3 )
The securit y feat ures of UMTS are fulfilled w it h a set of crypt ographic funct ions and algorit hm s. A t ot al of 10
funct ions are needed t o perform all t he necessary feat ures, f0- f5, f8 and f9.
f0 is t he random challenge generat ing funct ions, t he next sev en are k ey generat ing funct ions, so t hey are all
operat or specific. The keys used for aut hent icat ion are only generat ed in USI M and t he AuC, t he t wo dom ains
t hat t he sam e operat or is always in charge of.
Figure 1 35 - AKA procedure Sequence Diagram
UMTS Signaling
Table 1 2 AKA Funct ion Overview
Table 1 3 - AKA Param et er Ov erview

Funct ion f8 and f9 are used in USI M and RNC, and since t hese t wo dom ains m ay be of different operat ors, t hey
cannot be operat or specific. The funct ions use t he pre- shared secret key ( K) indirect ly. This is t o keep from
dist ribut ing K in t he net work, and keep it safe in t he USI M and AuC.
The funct ions f1- f5 are called key generat ing funct ions and are used in t he init ial Aut hent icat ion and Key
agreem ent procedure. The life t im e of Key is depended on how long t he keys have been used. The m axim um
lim it s for use of sam e keys are defended by t he operat or, and whenever t he USI M finds t he keys being used for
as long as allow ed, it w ill t rigger t he VLR/ SGSN t o use a new AV.
The funct ions f1- f5 shall be designed so t hat t hey can be im plem ent ed w it h a 8- bit m icroprocessor running at
3.25MHz w it h 8kbyt e ROM and 300byt e RAM and produce AK, XMAC- A, RES, CK and I K in less t han 500m s
execut ion t im e.
UMTS Signaling
Figure 1 36 - Aut hent icat ion Vect or generat ion on t he AuC side ( HE)
When generat ing a new AV t he AuC reads t he st ored value of t he sequence num ber, SQN and t hen generat es a
new SQN and a random challenge RAND. Toget her w it h t he st ored AV and Key Managem ent Field ( AMF) and t he
pre- shared secret key ( K) , t hese four input param et ers are ready t o be used. The funct ions f1..f5 uses t hese
input s and generat es t he values for t he m essage aut hent icat ion code, MAC- A, t he expect ed result , XRES, t he
Cipher Key ( CK) , t he I nt egrit y Key ( I K) and t he Anonym it y Key ( AK) . Wit h t he SQN xored AK, AMF and MAC, t he
Aut hent icat ion Token, AUTN is m ade. The Aut hent icat ion vect or ( AV) is send t o t he SGSN/ VLR and st ored t here,
while t he param et er pair AUTN and RAND are t hen send from t he SGSN/ VLR t o t he User. The cipher k ey ( Ck) and
int egrit y key ( I k) are used, aft er a successful aut hent icat ion, for confident ialit y ( ciphering) and int egrit y.
Figure 1 37 - User Aut hent icat ion Response on t he User side
Only one of t he four param et ers t hat t he AuC has is st ored in t he USI M, t he pre- shared secret key ( K) . The rest
of t he param et ers it has t o receive from t he net work ( RAND and AUTN) .
The secret k ey K is t hen used w it h t he receiv ed AMF, SQN and RAND t o generat e t he Expect ed Message
Aut hent icat ion Code ( XMAC- A) . This is t hen com pared w it h t he MAC- A. I f t he X- MAC and MAC m at ches, t he USI M
have aut hent icat ed t hat t he m essage is originat ed in it s Hom e Environm ent and t hereby connect ed t o a Serving
Net work t hat is t rust ed by t he HE.
Wit h a successful net work aut hent icat ion, t he USI M verifies if t he sequence num ber received is in w it hin t he
UMTS Signaling
correct range. Wit h a sequence num ber w it hin t he correct range, t he USI M cont inues t o generat e t he RES, which
is send back t o t he net work t o verify a successful user aut hent icat ion ( Figure 1.37) .
1 .6 .4 Ka su m i/ M ist y
The Kasum i algorit hm is t he core algorit hm used in funct ions f8 ( Confident ialit y) and f9 ( I nt egrit y) . Kasum i is
based on t he block cipher Mist y proposed by Mit suru Mat sui ( Mit subishi) , first published in 1996. Mist y
t ranslat ed from English t o Japanese m eans Kasum i.Mist y was designed t o fulfill t he follow ing design crit eria:
High securit y
Provable securit y against different ial and linear crypt analysis
M u lt i pla t for m
High speed in bot h soft ware and hardware im plem ent at ions
o Pent ium I I I ( 800MHz) ( Assem bly Language Program )
Encrypt ion speed 230Mbps
o ASI C H/ W ( Mit subishi 0.35 m icron CMOS Design Library)
Gat e size 50Kgat es
Com pa ct
Low gat e count and low pow er consum pt ion in hardware

o ASI C ( Mit subishi 0.35 m icron CMOS Design Library)
Gat e size 7.6Kgat es
o A requirem ent for W- CDMA encrypt ion algorit hm : gat e size m ust be sm aller t han 10Kgat es
KASUMI is a variant of MI STY1 designed for W- CDMA syst em s and has been adopt ed as a m andat ory algorit hm
for dat a confident ialit y and dat a int egrit y in W- CDMA by 3GPP in 1999. Here are som e exam ples of im provem ent :
Sim pler k ey schedule

Addit ional funct ions t o com plicat e crypt analysis w it hout affect ion provable securit y aspect s
Changes t o im prove st at ist ical propert ies
Minor changes t o speed up
St ream ciphering f8 uses Kasum i in a from of out put feedback, but w it h :
o BLKCNT added t o prevent cycling
o I nit ial ext ra encrypt ion added t o prot ect against chosen plaint ext at t ack and collision
I nt egrit y f9 uses Kasum i t o form CBC MAC w it h
o Non- st andard addit ion of 2nd feedforward
Mit subishi Elect ric Corporat ion holds t he right s on essent ial pat ent s on t he Algorit hm s. Therefore t he Beneficiary
m ust get a separat e royalt y free I PR License Agreem ent from Mit subishi Elect ronic Corporat ion Japan.
Basically KASUMI is a block cipher t hat produces a 64- bit out put from a 64- bit input under t he cont rol of a 128bit k ey. A det ailed descript ion can be found in t he 3GPP Specificat ion TS 35.202. MI STY1 and KASUMI have been
w idely st udied since it s publicat ion, but no serious flaws have been found.
UMTS Signaling
1 .6 .5 I n t e gr it y - Air I n t e r fa ce I n t e gr it y M e cha n ism

Most cont rol signaling inform at ion elem ent s t hat are sent bet w een t he User Equipm ent ( UE) and t he net work are
considered sensit ive and m ust be int egrit y prot ect ed. I nt egrit y prot ect ion shall apply at t he RRC lay er. A m essage
int egrit y funct ion ( f9) shall be applied on t he signaling inform at ion t ransm it t ed bet ween t he UE and t he RNC.
User dat a are on t he ot her hand not int egrit y prot ect ed and it s up t o higher- level prot ocols t o add t his if needed.
I nt egrit y prot ect ion is required, not opt ional, in UMTS for signaling m essages.
Aft er t he RRC connect ion has been est ablished and t he securit y m ode set - up procedure has been perform ed, all
dedicat ed cont rol signaling m essages bet w een UE and t he net work shall be int egrit y- prot ect ed ( Figure 1.38) .
Thr e a t s a ga in st in t e gr it y
Manipulat ion of m essages is t he one generic t hreat against int egrit y. This includes deliberat e or accident al
m odificat ion, insert ion, replay ing or delet ion by an int ruder.
Figure 1 38 - I ub Cont rol plane
Bot h user dat a and signaling/ cont rol dat a are venerable t o m anipulat ion. And t he at t acks m ay be conduct ed on
t he radio int erface, in t he fix ed net work or on t he t erm inal and t he USI M/ UI CC.
The t hreat s against int egrit y can be sum m arized t o:
Manipulat ion of t ransm it t ed dat a: I nt ruders m ay m anipulat e dat a t ransm it t ed over all reachable
int erfaces.
Manipulat ion of st ored dat a: I nt ruders m ay m anipulat e dat a t hat are st ored on syst em ent it ies, in t he
t erm inal or st ored by t he USI M. These dat a includes t he I MEI st ored on t he t erm inal, and dat a and
applicat ions downloaded t o t he t erm inal or USI M. Only t he risks associat ed w it h t he t hreat s t o dat a
st ored on t he t erm inal or USI M are regarded t o be significant , and only t he risk for m anipulat ion of t he
I MEI is regarded as being of m aj or im port ance.
Manipulat ion by m asquerading: I nt ruders m ay m asquerade as a com m unicat ion part icipant and t hereby
m anipulat e dat a on any int erface. I t is also possible t o m anipulat e t he USI M behavior by m asquerading
as t he originat or of m alicious applicat ions or dat a downloaded t o t he t erm inal or USI M.
On t he radio int erface t his is considered t o be a m aj or t hreat , whereas m anipulat ion of t he t erm inal or USI M
behavior by m asquerading as t he originat or of applicat ions and/ or dat a is considered t o be of m edium
significance. Masquerading could be done bot h t o fake a legal user and t o fake a serv ing net work.
D ist r ibu t ion of k e ys
The int egrit y prot ect ion in UMTS is im plem ent ed bet ween t he RNC and t he UE. Therefore
I K m ust be dist ribut ed from t he AuC t o t he RNC. The I K is part of an aut hent icat ion vect or which is sent t o t he
SN ( VLR/ SGSN) from t he AuC follow ing an aut hent icat ion dat a request . To facilit at e subsequent aut hent icat ions,
up t o 5 aut hent icat ion vect ors are sent for each request . The I K is sent from t he VLR/ SGSN t o t he RNC as part of
a RANAP m essage called securit y m ode com m and.
I n t e gr it y fu n ct ion f9
The funct ion f9 is used in a sim ilar way as t he Aut hent icat ion t oken ( AUTN) . I t adds a st am p t o m essages t o
ensure t hat t he m essage is generat ed at t he claim ed ident it y, eit her t he USI M or t he Serving Net work, on behalf
of t he HE. I t also m akes sure t hat t he m essage has not been t am pered w it h.
UMTS Signaling
Figure 1 39 - I nt egrit y check procedure
The input param et ers t o t he algorit hm are t he I nt egrit y Key ( I K) , t he int egrit y sequence num ber ( COUNT I ) , a
random value generat ed by t he net work side ( FRESH) , t he direct ion bit DI RECTI ON and t he signaling dat a
MESSAGE. Based on t hese input param et ers t he user com put es m essage aut hent icat ion code for dat a int egrit y
MAC- I using t he int egrit y algorit hm f9. The MAC- I is t hen appended t o t he m essage when sent over t he radio
access link. The receiver com put es XMAC- I on t he m essage received in t he sam e way as t he sender com put ed
MAC- I on t he m essage sent and verifies t he dat a int egrit y of t he m essage by com paring it t o t he received MAC- I .
Prot ect ion against replay is im port ant and guarant eed w it h:
The value of COUNT- I is increm ent ed for each m essage, while t he generat ion of a new FRESH value and
init ializat ion of COUNT- I t ake place at connect ion set - up.
The COUNT- I value is init ialized in t he UE and t herefore prim arily prot ect s t he user side from replay
at t acks. Likew ise t he FRESH value prim arily provides replay prot ect ion for t he net work side.
I n t e gr it y I n it ia t ion - Se cu r it y M ode Se t u p pr oce du r e

The VLR/ SGSN init iat es int egrit y prot ect ion ( and encrypt ion) by sending t he RANAP m essage securit y m ode
cont rol t o t he SRNC. This m essage cont ains a list of allow ed int egrit y algorit hm s and t he I K t o be used. Since t he
UE can have t wo ciphering and int egrit y key set s ( for t he PS and CS dom ains, respect ively) , t he net work includes
a Core Net work t ype indicat or in t he securit y m ode com m and m essage.
The securit y m ode com m and t o UE st art s t he downlink int egrit y prot ect ion, i.e. all subsequent downlink
m essages sent t o t he UE are int egrit y prot ect ed. The securit y m ode com plet e from UE st art s t he uplink int egrit y
prot ect ion, i.e. all subsequent m essages sent from t he UE are int egrit y prot ect ed. The net work m ust have t he
UE securit y capabilit y inform at ion before t he int egrit y prot ect ion can st art , i.e. t he UE securit y capabilit y m ust
be sent t o t he net work in an UMTS securit y int egrit y prot ect ion unprot ect ed m essage. Ret urning t he UE
securit y capabilit y t o t he UE in a prot ect ed m essage lat er w ill allow UE t o v erify t hat it was t he correct " UE
securit y capabilit y" t hat reached t he net work.
UMTS Signaling
Figure 1 40 - Ex am ple of st am ped m essage for I nt egrit y check

Som e m essages does not include int egrit y prot ect ion, t hese m essages are:
HANDOVER TO UTRAN COMPLETE

PAGI NG TYPE 1
PUSCH CAPACI TY REQUEST
PHYSI CAL SHARED CHANNEL ALLOCATI ON
RRC CONNECTI ON REQUEST
RRC CONNECTI ON SETUP
RRC CONNECTI ON SETUP COMPLETE
RRC CONNECTI ON REJECT
RRC CONNECTI ON RELEASE ( CCCH only)
SYSTEM I NFORMATI ON ( BROADCAST I NFORMATI ON)
SYSTEM I NFORMATI ON CHANGE I NDI CATI ON
TRANSPORT FORMAT COMBI NATI ON CONTROL ( TM DCCH only)
Ke y life t im e
To avoid at t ack s using com prom ised k eys, a m echanism is needed t o ensure t hat a part icular int egrit y k ey set is
not used for an unlim it ed period of t im e. Each t im e an RRC connect ion is released, t he values STARTcs and
STARTps of t he bearers t hat were prot ect ed in t hat RRC connect ion are st ored in t he USI M. When t he next RRC
connect ion is est ablished t hese values are read from t he USI M.
The operat or shall decide on a m axim um value for STARTCS and STARTPS. This value is st ored in t he USI M.
When t he m ax im um value has been reached, t he cipher key and int egrit y key st ored on USI M shall be delet ed,
and t he ME shall t rigger t he generat ion of a new access link key set ( a cipher key and int egrit y key) at t he next
RRC connect ion request m essage.
W e a k n e sse s
The m ain weaknesses in UMTS int egrit y prot ect ion m echanism s are:
I nt egrit y k eys used bet ween UE and RNC generat ed in VLR/ SGSN are t ransm it t ed unencrypt ed t o t he
RNC ( and som et im es bet ween RNCs)
I nt egrit y of user dat a is not offered
UMTS Signaling
For a short t im e during signaling procedures, signaling dat a are unprot ect ed and hence exposed t o
t am pering.
1 .6 .6 Confide n t ia lit y - Encr ypt ion ( Ciphe r in g) on Uu a nd I u b

Threat s against confident ialit y
There are several different t hreat s against confident ialit y- prot ect ed dat a in UMTS. The m ost im port ant t hreat s are:
Ea ve sdr oppin g:
on user t raffic, signaling or cont rol dat a on t he radio int erface
Pa ssive t r a ffic a na lysis:
I nt ruders m ay observe t he t im e, rat e, lengt h, sources or dest inat ions of m essages on t he radio
int erface t o obt ain access t o inform at ion
Con fide n t ia lit y of a u t h e n t ica t ion da t a in t h e UI CC/ USI M :
I nt ruders m ay obt ain access t o aut hent icat ion dat a st ored by t he serv ice prov ider in t he UI CC/ USI M
The radio int erface is t he easiest int erface t o eavesdrop, and should t herefore always be encry pt ed. I f t here is a
penet rat ion of t he crypt ographic m echanism , t he confident ial dat a would be accessible on any int erface bet ween
t he UE and t he RNC. Passive t raffic analysis is considered as a m aj or t hreat . I nit iat ing a call and observing t he
response, act ive t raffic analysis, is not considered as a m aj or t hreat . Disclosure of im port ant aut hent icat ion dat a
in t he USI M, as i.e. t he long- t erm secret K, is considered a m aj or t hreat . The risk of eavesdropping on t he links
bet ween RNCs and t he UI CC- t erm inal int erface is not considered a m aj or t hreat , since t hese links are less
accessible for int ruders t han t he radio access link.
Eavesdropping of signaling or cont rol dat a, however, m ay be used t o access securit y m anagem ent dat a or ot her
inform at ion, w hich m ay be useful in conduct ing act ive at t acks on t he syst em .
Ciphe r in g pr oce dur e
Ciphering in UMTS is perform ed bet ween UE and RNC over Air and I ub I nt erface. Figure 1.41 shows t he prot ocol
st ack of t he I ub int erface for Rel. 99.
Figure 1 41 - I ub Prot ocol st ack
The I ub prot ocol st ack cont ains a Radio Net work Cont rol Plane, a Transport Net work Cont rol Plane and a User
Plane for AMR coded voice, I P packages, video st ream ing, et c. The Radio Net w ork Cont rol Plane is spit t ed int o
t wo part s, t he nonaccess st rat um ( NAS) and t he Node- B applicat ion part ( NBAP) . The nonaccess st rat um
cont ains m obilit y m anagem ent ( MM) , session m anagem ent ( SM) and call cont rol m anagem ent ( CC) for
com m unicat ion bet ween UE and core net work.
Before UE and RNC are able t o exchange NAS m essages and user dat a, one or m ore t ransport channel is required.
All inform at ion relat ed t o t he est ablishm ent , m odificat ion and release of t ransport channels are exchanged
bet ween RNC and Node- B over NBAP and ALCAP. Transport channels are based on AAL2 connect ions. The
concept of t hose t ransport channels is very im port ant for t he underst anding of ciphering and int egrit y prot ect ion.
Task of t he t ransport channel is an opt im al propagat ion of signaling inform at ion and user dat a over t he air
int erface. I n order t o do so, a t ransport channel is com posed of several RBs. The charact erist ic of every RB is
defined during est ablishm ent by t he NBAP and RRC lay er. This is done by a list of at t ribut es, so called Transport
UMTS Signaling
Form at Set ( TFS) . The Transport Form at Set describes t he way of dat a t ransm ission using different param et ers,
like block size, t ransm ission t im e int erval ( TTI ) , channel coding t ype.
The UTRAN select s for t he com m unicat ion bet ween m obile and net work t hese Radio Access Bearers, which use
t he radio resources in t he m ost efficient way. Every RAB has it s own ident ifier and every t ransport block has it s
own sequence num ber. This t echnique allows from one side a fast sw it ch- over bet ween Radio Bearers and from
t he ot her one a parallel com m unicat ion over several Radio Access Bearers. This t echnique requires a bearerindependent ciphering m echanism .
Figure 1 42 - Ciphering act ivat ion procedure
Ciphering w ill be act ivat ed w it h t he m essages flow shown in Figure 1 42. Ciphering is always relat ed t o a cert ain
t ransport channels. Therefore ciphering w ill be act ivat ed independent ly for Cont rol and User Plane and
independent ly for packet - sw it ched and circuit - sw it ched plane. I n ot her words, if a m obile subscriber has t wo
independent sessions ( voice calls and I P packet t ransfer) act ivat ed, UE and RNC need t o exchange t he ciphering
act ivat ion procedure t wo t im es. I m port ant t o not e t hat NAS m essages exchanged prior ciphering act ivat ion
( t ypically t he Aut hent icat ion procedure) are not ciphered.
Message securit yModeCom m and est ablishes t he Act ivat ion Tim e for t he Radio Access Bearers in downlink
direct ion and t he m essage securit yModeCom plet e det erm ines t he Act ivat ion Tim e in uplink direct ion. Ciphering
for a cert ain RAB st art s for t hat RLC block where Sequence Num ber is equal t o Act ivat ion Tim e.
UMTS Signaling
Figure 1 43 - RLC: Ciphering Act ivat ion Tim e
The ciphering dept h depends on t he RLC m ode. The RLC prot ocol cont ains Cont rol PDUs ( never ciphered) and
Dat a PDUs. For Dat a PDUs, t he RLC prot ocol works in t hree different m odes:
UM Unacknowledged Mode
AM Acknow ledged Mode
TM Transparent Mode
UM and AM m essages ( e.g. Dat a) are secured against bit errors w it h a check sequence, while TM inform at ion ( e.g.
AMR voice) arent . Therefore RLC UM and RLC AM are ciphered beginning w it h RLC lay er and above, while
ciphering for RLC TM already st art s w it h t he MAC layer.
The Kasum i algorit hm it self needs t he follow ing param et ers ( Figure 1 44) :
Figure 1 44 - RLC/ MAC Encrypt ion
Cipher Sequence Num ber COUNT

Direct ion ( uplink or downlink)
RB I dent ifier
Block Lengt h
Ciphering Key CK
UMTS Signaling
CK is never sent over t he Uu and I ub- I nt erface. The RNC receiv es t his value from MSC or SGSN and t he USI M
calculat es CK as described before.
COUNT is init ially derived from t he START value of t he rrcConnect ionSet upCom plet e m essage. The START value
is not const ant during a ciphering session. I t can be m odified by different procedures, like Cell Reselect ion or
Channel Type Sw it ching. The follow ing m essages can t rigger an updat e of t he COUNT value:
RRC_Connect ionSet upCom plet e

RRC_physicalChannelReconfigurat ionCom plet e
RRC_t ransport ChannelReconfigurat ionCom plet e
RRC_radioBearerSet upCom plet e
RRC_radioBearerReconfigurat ionCom plet e
RRC_radioBearerReleaseCom plet e
RRC_ut ranMobilit yI nform at ionCom plet e
RRC_init ialDirect Transfer
I f t he m essage securit yModeFailure is receiv ed t he ciphering inform at ion shall be rem oved from USI M and RNC.
Adva n t a ge of t h is m e t h od:
1.
2.
The key can be generat ed ev en before t he m essage is available t o t he algorit hm .

To decipher, t he receiving side generat es t he sam e Keyst ream Block ( Mask) and adds it , bit - by- bit , t o
t he receiv ed encrypt ed m essage. This second addit ion of t he m ask cancels out t he m ask t hat was
previously added and t hereby decrypt s t he m essage.
A second bit - by - bit addit ion negat es t he first addit ion = successful deciphering!
Te st in g UM TS N e t w or k s W h e n Ciph e r in g is Act ive

As described earlier, Ciphering in UMTS Net works is also perform ed bet ween t he UE and RNC over t he Uu- ( Air)
and t he I ub int erface.
Ciphering causes t he Radio Resource Cont rol ( RRC) and Non Access St rat um ( NAS) m essages t o be encrypt ed
( Figure 1 45) .
RRC and NAS m essages cont ain key inform at ion t o perform net work opt im izat ion and t roubleshoot ing which
result s in t he fact t hat when ciphering is act iv e, t radit ional prot ocol analyzer and net work m onit oring syst em s can
not be used t o carry out t hese t wo very im port ant t asks.
Figure 1 45 - Ciphered I ub Prot ocol St ack
UMTS Signaling
Figure 1 46 - UMTS Net work Transact ions.
I n UMTS Net works, in order t o perform Net work opt im izat ion and t roubleshoot ing, prot ocol t est equipm ent would
need t he abilit y t o decipher t he m essages. As shown here for t he I ub I nt erface, connect ed t o t he I u and I ub,
prot ocol analyzers collect t he ciphering param et ers, feed t hem t o t he deciphering algorit hm and allow full access
t o t he cont ent of t he prot ocol m essages. I n addit ion t o Net work opt im izat ion and t roubleshoot ing, it also enables
t o t est t he im pact of I ub ciphering/ deciphering on net work elem ent / net work behav ior and perform ance.
Please see Chapt er 2 for a Short I nt roduct ion t o Net work Monit oring, Trouble Shoot ing and Net work
Opt im izat ion .
1 .6 .7 UM TS N e t w or k Tr a nsa ct ion s
The follow ing figure shows t he order of t he necessary t ransact ions of a connect ion. I t furt her indicat es t he
int erworking of pure signaling exchange and Radio Bearer procedures.
The procedures running bet ween UE, Node B, and RNC will exchange Access- St rat um ( AS) m essages whereas
procedures going t hrough t o t he core net work, MSC and SGSN, w ill exchange Non- Access St rat um ( NAS)
m essages.
UMTS Signaling
1 .7 RAD I O I N TERFACE BASI CS

To underst and t he relat ion bet w een UTRAN signaling m essages and t he user equipm ent it is also necessary t o
discuss som e procedures and m et hods used on UMTS air int erface, which is done in t his chapt er.
Figure 1 47 - Duplex Met hods
1 .7 .1 D uple x M e t h ods
Duplex m et hods are used t o separat e t ransm it and receive signals, for exam ple, speak and list en signals.
Two different m et hods of duplex cont rol are used on t he radio int erface. By t hese m et hods it is guarant eed t hat
TX and RX dat a can be separat ed from each ot her. These m et hods have no lim it s for parallel usage of t he radio
int erface.
Frequency Division Duplex is used also by GSM, whereas t he unidirect ional frequency is 200 kHz. I n UMTS bot h
form s will be used as UTRA- FDD and lat er also UTRA- TDD. The bandw idt h of f1 and f2 w ill be 5 MHz, t he duplex
dist ance w ill be 190 MHz.
1 .7 .2 M ult iple Acce ss M e t hods

The Mult iple Access Met hods feat ure specifies how user signals can be separat ed from each ot her. Again, t here is
no overall capacit y of a cell or a radio access sy st em t hat could be deriv ed from t his m et hod.
Mult iplex m et hods are used t o divide t he lim it ed resources of a cell bet ween t he different m obile st at ions in a cell.
UMTS Signaling
Figure 1 48 - Mult iple Access Met hod
FDMA
uses different frequencies t o separat e t he users. This

t echnique is used in analogue syst em s.
TDMA
uses different t im eslot s over t he whole frequency t o

separat e t he users. I n t his case, different users use t he
air int erface resources at different t im es. This
t echnique is used in GSM.
CDMA
uses t he whole frequency bandw idt h over t he whole

t im e. Using different codes applied t o t heir dat a
separat es different users. This w ill be used in UMTS.
For net work operat ors, t he difference in planning is t hat , for FDMA and TDMA, frequency planning is t he m aj or
t ask, whereas, for CDMA, code planning is t he m aj or t ask.
1 .7 .3 UM TS CD M A
The t asks, which result from t he CDMA t echnique, are m ainly im plem ent ed in Node B and in t he UE.
The following work st eps m ust be perform ed before t he signal can be t ransm it t ed via t he ant enna:
Spreading of t he dat a wit h OVSF- Codes

Scram bling of t he spread st ream wit h Scram bling Codes
Modulat ion of t he digit al signal ont o t he air int erface
Figure 1 49 - UMTS CDMA
OVSF Ort hogonal Codes w it h Variable Spreading Fact or

The receiv er w ill hav e t o perform t hese st eps in reverse order.
Since spreading codes and scram bling codes are im port ant t o ident ify UTRAN signaling m essages belonging t o a
defined user a short int roduct ion int o t hese t echniques given, while m odulat ion is out side t he scope of t his book.
However, t he follow ing pages w ill dem onst rat e t he process for CDMA- FDD only , because TDD is close t o
im plem ent at ion, but t ypically not int roduced int o t he net works yet .
UMTS Signaling
1 .7 .4 CD M A Spr e a din g
CDMA can use different m et hods of spreading:
Direct Spreading CDMA ( DS- CDMA)

Frequency Hopping CDMA ( FH- CDMA)
Tim e Hopping CDMA ( TH- CDMA)
Hybrid Modulat ion CDMA ( HM- CDMA)
Mult i Carrier CDMA ( MC- CDMA)
UMTS w ill use, in t he first st age, t he DS- CDMA t echnique. Spr e a din g is a lso ca lle d ch a n n e liza t ion .
Every bit of t he dat a ( sym bol) st ream w ill be spread ( code d) by a num ber of code- bit s ( ch ips) . By t his, t he
dat a st ream becom es a chip- st ream w it h t he lengt h:
da t a bit s x code ch ips
The input dat a rat e is also called sym bol rat e.
For t he spreading, t he dat a bit values hav e t o be t urned t o non- ret urn t o zero ( N RZ) codes; for exam ple + 1 or - 1.
Binary Zero is present ed as + 1 and binary One is present ed as - 1.
Mult iplying t he code t o t he bit using t he XOR funct ion perform s t he spreading. As can be seen t he chip st ream is
a pict ure of t he code, i.e. if a binary Zero has t o be spread, t he chip st ream is t he code. I f a binary " 1" has t o be
spread, t he chip st ream is t he invert ed code.
Figure 1 50 - Spreading using Direct Sequence CDMA
One of t he m ain reasons for spreading is t o convert a narrowband signal t o a w ideband signal, nearly as w ide as
t he radio int erface frequency band.
I n UM TS, t h e ch ip st r e a m h a s a lw a ys t h e size of 3 .8 4 0 .0 0 0 ch ips/ se con d, for exam ple 3.84Mcps, equal t o
a frequency of 3.84 MHz.
Depending on t he dat a st ream variable, spreading codes have t o be used. First of all, t he value of t he code is not
im port ant , but it s lengt h is.
Secondly, t he used codes should be ort hogonal; t hey differ com plet ely from each ot her. I n t he uplink direct ion,
t he UE separat es different dat a channels from each other by using different codes for each dat a channel.
1 .7 .5 M icr o D ive r sit y - M ult ipa t h

The t ransm ission of a radio w ave is not st raight . Because of reflect ion, diffract ion, and scat t ering of t he radio
wave, t he received signal appears as a m ult iple of t he sent signal, different in t im e. This phenom enon is called
M u lt ipa t h .
UMTS Signaling
I n UMTS, it m eans t hat t he UE and t he Node B receiv e m ult iple signals from each ot her.
A special RAKE r e ce ive r is im plem ent ed in bot h unit s t o overcom e t his problem . I t receiv es each of t he parallel
signals in a finger and com bines t hem t o one st rong out put signal, which w ill be given t o t he higher layer.
M icr o D ive r sit y st ands for t he sm all diversit y t he receiver has t o deal w it h
1 .7 .6 M icr o D ive r sit y Soft e r H a n dove r
Figure 1 51 Mult ipat h
Figure 1 52 - Soft er Handover
A special case where m icro div ersit y is used is t he Soft e r H a n dove r . I n t his sit uat ion t he UE is connect ed t o
m ore t han one sect ors of a Node B. The advant age is t o get a st ronger RX signal. The disadvant age is t hat m ore
radio resources are in use t han necessary. I t is up t o t he net work planning if and when t his feat ure is used.
1 .7 .7 M a cr o D ive r sit y Soft H a n dove r

The funct ion of M a cr o D ive r sit y is t o collect dat a from one UE com ing int o t he net work v ia different Node Bs.
Macro Div ersit y is im plem ent ed in t he Serv ing RNC. The m ax im um num ber of parallel serv ing Node Bs in Rel. 99
is t hree, but m aybe increased in furt her releases of UMTS st andards.
The described sit uat ion is called Soft H a n dove r . I t w ill again use m ore resources t han necessary for a single
UMTS Signaling
connect ion not only on t he radio int erface, but also in t he UTRAN on t he different I ub and I ur int erfaces. The
advant age is t hat in case of t ransm ission errors on one radio link t here is a high chance t o get t he sam e fram e
errorfree on a different link . The S- RNC com pares t he incom ing m essages from all links and select s t he errorfree fram es. So it is prevent ed t hat t he Node Bs needs t o change t heir t ransm ission pow er t o keep cont act w it h
t he UE t hat is close t o t he cell border. A change of t ransm ission power could cause int erference of t he
neighborhood cells or cell breat hing effect s.
I n t he downlink direct ion, several Node Bs m ay send dat a t o t he UE, but t he UE w ill only receive t he dat a of t he
sender w it h t he st rongest RX signal.
Figure 1 53 - Soft Handover
Figure 1 54 - UMTS Spreading
1 .7 .8 UM TS Spr e a din g
The figure list s possible Spreading Fact or values bot h for CDMA form s and for t he uplink and downlink direct ion.
The t able also shows t he Spreading Fact ors ( SF) t hat should apply for cert ain dat a rat es t o reach 3,84 Mcps.
Possible SF
FDD UL: 4 8 16 32 64 - 128 256

FDD DL: 4 8 16 32 64 - 128 256 512
TDD : 1 2 4 8 16
Transm ission of pure signaling inform at ion should always use SF= 256.
UMTS Signaling
1 .7 .9 Scr a m blin g
Scram bling describes t he m ult iplicat ion of anot her code t o t he chip st ream w it hout changing it s lengt h and is
done t o rem ove t he quasi- ort hogonal signals from different users and t o ident ify different sources:
Scr a m blin g in Uplin k
Short scram bling codes ( 256 bit s) are used in Node B if t here is advanced m ult i- user det ect ion or an
int erference cancellat ion receiv er.
Long scram bling codes ( 38.400 bit s) are used if t he RAKE receiver im plem ent ed in t he Node B.
Scr a m blin g in D ow n lin k
Long scram bling codes ( 38.400 bit s) are used.
N ot e : Scram bling does not spread t he chip st ream .
Table 1 4 - Channelisat ion and Scram bling.
A Scr a m blin g code is a random code called Gold code, and, because of t heir random appearance, t hey are also
called Pse u do- N oise ( PN ) Code s.
Scram bled signals of different users are ort hogonal t o each ot her again. Scram bling Codes are of lengt h 38.400
bit s ( lon g scr a m blin g code ) . Wit h evolved Node Bs sh or t scr a m blin g code s, 256 bit s w ill be used.
1 .7 .1 0 Codin g Su m m a r y
Table 1 4 and Figure 1 55 gives an overview of channelizat ion and scram bling. I n uplink and downlink, t hese
codes have different m eaning as it is described in t he figure.
UMTS Signaling
Figure 1 55 - Channelisat ion and Scram bling.
Figure 1 56 - Signal- t o- I nt erference.
1 .7 .1 1 Sign a l t o I n t e r fe r e nce
Every user is an int erference source t o all ot her users in one cell ( also in neighboring cells) .
To guarant ee t he success of t he request QoS, a special rat io has t o be calculat ed: Eb/ N 0 . This value represent s
t he rat io bet w een t he e n e r gy of on e sign a l ( bit ) com pared t o t he int erference at t he receiver.
The value is t he SI R ( Signal- t o- I nt erference- Rat io) m ult iplied by t he Processing Gain, which is m ore or less t he
SF ( Spreading Fact or) ( Figure 1 56) .
I f for any reason Eb/ N0 get s t oo low , one way of increasing t he rat io is t o increase t he Spreading Fact or. Wit h a
fixed chip st ream rat e of 3,84 Mcps, t he SF cannot j ust be increased. So t he dat a rat e has t o be changed also;
t he dat a rat e m ust be decreased and t hen t he SF can be increased.
UMTS Signaling
1 .7 .1 2 Ce ll Br e a t hin g
Cell breat hing describes a const ant change of t he range of a geographical area covered by a Node B cell based on
t he am ount of t raffic current ly using t hat t ransm it t er. When a cell becom es heavily loaded, it shrinks. Subscriber
t raffic is t hen redirect ed t o a neighboring cell t hat is m ore light ly loaded, which is called load balancing. Cell
breat hing is a com m on phenom enon of 2G and 3G w ireless syst em s including CDMA.
The cause of cell breat hing is t he given QoS. The QoS t hen defines/ causes Eb/ N0, lim it ed bandwidt h and lim it ed
TX power.
Part of t he cell breat hing is also t he N e a r - Fa r - Effe ct , where users who are closer t o a Node B use less TX power
t han users who are furt her away from t he Node B. The reason for t his cell breat hing effect is t he fact t hat t he RX
power should, ideally, be t he sam e for all users; for exam ple t he SI R should be t he sam e for all users.
Figure 1 57 - Cell Breat hing.
Figure 1 58 - UMTS Channels.

Sum m a r y
Every serv ice requires a cert ain Eb/ N0 rat io ( QoS) .

Receiv ed S/ N rat io should be t he sam e for all users in a cell.
Users w it h longer dist ance t o Node B t han ot hers m ust use higher t ransm it power.
Users w it h higher dat a rat es ( sm aller Spreading Fact or) m ust use higher t ransm it pow er.
I f int erference increases, t he signal pow er m ust be increased.
Signal pow er can only be increased t o a m axim um . ( ~ 0.5 W)
Result : t he useable area of a cell shrinks!
1 .7 .1 3 UM TS Ch a n ne ls
Three t ypes of UMTS channel levels are defined :
UMTS Signaling
Ph ysica l Ch a n n e ls
Each Physical Channel is ident ified by it s frequency, spreading code, scram bling code and phase of t he signal.
Physical Channels prov ide t he bearers for t he different TrCHs ( see overv iews below) .
Dedicat ed Physical Channels ident ify a dest inat ion UE by Spreading Fact or and scram bling code. One or m ore
Dedicat ed Physical Dat a Channels ( DPDCH) can be configured in uplink or downlink direct ion. The DPCCH is used
for radio int erface relat ed cont rol info only. One Dedicat ed Phy sical Cont rol Channel ( DPCCH) always belongs t o
t he set of DPDCHs and is used for RRC m essages and ot her signaling bet ween UE and net work .
Tr a n spor t Ch a n n e ls
Transport Channels are unidirect ional v irt ual channels, m apped ont o physical channels. They provide bearers for
inform at ion exchange bet ween MAC prot ocol and physical lay er. Only TrChs of t ype ( e.g. DCHs) are m apped.
Logica l Ch a n n e ls
Logical Channels are uni- or bi- direct ional and provide bearers for inform at ion exchange bet w een MAC- prot ocol
and RLC- prot ocol. There are t w o t ypes of Logical Channels:
Cont rol Channels for signaling inform at ion of t he cont rol planes
Traffic Channels for user dat a of t he user planes
The list shows all physical channels available in a UMTS net work.
Different Types of Physical Channels in UTRA- FDD
D e dica t e d Ph ysica l D a t a Ch a n n e l ( D PD CH )
Transm ission of user dat a and higher lay er signaling ( RRC, NAS) in uplink direct ion com ing from higher layers.
D e dica t e d Ph ysica l Con t r ol Ch a n n e l ( D PCCH )
Transm ission of radio cont rol inform at ion in uplink direct ion. This channel ex ist s only once per radio connect ion.
D e dica t e d Ph ysica l Ch a n n e l ( D PCH )
Transm ission of user dat a and cont rol inform at ion in downlink direct ion. Bot h t ypes of inform at ion w ill be m apped
ont o t he DPCH.
Syn ch r on iza t ion Ch a n n e l ( SCH )
Cell search and synchronizat ion of t he UE t o t he Node B signal. Subdiv ided by Pr im a r y Syn ch r on iza t ion
Cha nne l ( P- SCH ) a nd Se conda r y Syn ch r on iza t ion Ch a n n e l ( S- SCH ) .
Table 1 5- Physical Channels in UMTS.
Com m on Con t r ol Ph ysica l Ch a n n e l ( CCPCH )

Transm ission of com m on inform at ion and is divided by Pr im a r y Com m on Con t r ol Ph ysica l Ch a n n e l ( PCCPCH ) and Se conda r y Com m on Cont r ol Physica l Cha nn e l ( S- CCPCH ) . P- CCPCH t ransm it s t he broadcast
UMTS Signaling
channel ( BCH) and S- CCPCH t ransport s t he Forward Access Channel ( FACH) and t he Paging Channel ( PCH) .
FACHs and PCH can be m apped t o t he sam e or t o separat e S- CCPCHs.
Com m on Pilot Ch a n n e l ( CPI CH )
Support s channel est im at ion and allows est im at ions in t erm s of power cont rol. I t is subdiv ided int o Pr im a r y
Com m on Pilot Cha nne l ( P- CPI CH ) and Se con da r y Com m on Pilot Ch a n n e l ( S- CPI CH ) , which differ in
scram bling code and availabilit y w it hin a cell.
Ph ysica l Ra n dom Acce ss Cha n n e l ( PRACH )
Transm ission of t he Random Access Channel ( RACH) , which is used for t he random access of a UE and for
t ransm ission of a sm all am ount of dat a in t he uplink direct ion.
Ph ysica l Com m on Pa ck e t Ch a n n e l ( PCPCH )
Com m on dat a t ransm ission using t he collision det ect ion CSMA/ CD- m et hod.
Pa gin g I n dica t or Ch a n n e l ( PI CH )
Transm ission of t he Page I ndicat or ( PI ) t o realize t he paging in t he downlink direct ion. One PI CH is always relat ed
t o an S- CCPCH, which t ransport s t he PCH.
Acqu isit ion I ndica t or Ch a n n e l ( AI CH )
Transm it s t he posit ive acknow ledgem ent of a random access of a UE v ia PRACH or PCPCH.
Ph ysica l D ow nlin k Sh a r e d Ch a n n e l ( PD SCH )
Com m on t ransm ission of dat a in downlink direct ion. Parallel UEs w ill have different codes assigned.
D iffe r e n t Type s of Ph ysica l Ch a n n e ls in UTRA- TD D
D e dica t e d Ph ysica l Ch a n n e l ( D PCH )
Bi- direct ional t ransm ission channel for user dat a and cont rol inform at ion.
Com m on Con t r ol Ph ysica l Ch a n n e l ( CCPCH )
sam e as in FDD m ode.
Ph ysica l Ra n dom Acce ss Cha n n e l ( PRACH )
Ph ysica l Uplink Sh a r e d Ch a n n e l ( PUSCH )
Com m on t ransm ission of dat a and cont rol inform at ion in t he uplink direct ion. Parallel UEs w ill have different
codes assigned.
Ph ysica l D ow nlin k Sh a r e d Ch a n n e l ( PD SCH )
Com m on t ransm ission of dat a in downlink direct ion.
Pa gin g I n dica t ion Ch a n n e l ( PI CH )
1 .7 .1 4 Tr a n spor t Ch a nn e ls
Wideband- CDMA ( 3GPP 25.302, 25.211- 25.215) is int erwork ing w it h t he higher lay er, Medium Access Cont rol
prot ocol.
I t offers t he t ransport channels t o t he MAC. To be flexible in dat a rat es, et c. all inform at ion on t he t ransport
channel is described by t ransport form at s and cert ain at t ribut es.
1 .7 .1 5 Com m on Tr a n spor t Ch a nn e ls
Com m on Transport Channels can be used by all UEs locat ed in t he sam e cell. A special ident ifier, t he socalled
RNTI ( radio net work t em porary ident ifier) , is used t o m ark m essages com ing from or sent t o a single UE on RACH,
FACH or shared channels.
To t he com m on t ransport channels belong ( Figure 1.59) :
UMTS Signaling
Figure 1 59 - Com m on Transport Channels.
Figure 1 60 - Com m on Transport Channels.

Br oa dca st Ch a nne l ( BCH )
Transm it s syst em inform at ion.
( Mandat ory)
Pa ging Cha nn e l ( PCH )
Calls a UE, which has no RRC connect ion.
( Mandat ory)
For w a r d Acce ss Ch a n n e l ( FACH )
Transm it s a sm all am ount of dat a in t he dow nlink direct ion. There can be m ult iple FACHs in one cell w it h different
bandwidt hs.
( Mandat ory)
Ra n dom Acce ss Ch a n n e l ( RACH )
Transm it s t he acknow ledgm ent t o a Paging Request and t ransm it s a sm all am ount of dat a in t he uplink direct ion.
( Mandat ory)
Uplin k Com m on Pa ck e t Ch a n n e l ( CPCH )
Transm it s a sm all num ber of dat a packet s in t he uplink direct ion. The difference from RACH are fast pow er
cont rol, collision det ect ion, and a st at us m onit oring funct ion.
( Opt ional)
D ow n lin k Sh a r e d Ch a n n e l ( D SCH )
Transm it s a sm all num ber of user dat a pack et s or cont rol inform at ion in t he downlink direct ion. I t is shared
bet ween different users. The difference from FACH are fast power cont rol and a variable bit rat e on a Fram e- byFram e- base. DSCH is not m andat ory in every cell, but , if it exist s, it is relat ed t o a Dedicat ed Transport Channel
[ sim ilar t o GSM Associat ed Cont rol Channel ( ACCH) ] .
N ot e : Shared Channels requires a param et er t o ident ify a UE, t he RNTI .
The DSCH is always relat ed t o DCHs: Several DCHs can be m apped int o one DSCH.
( Opt ional)
UMTS Signaling
1 .7 .1 6 D e dica t e d Tr a n spor t Ch a n n e ls
D e dica t e d Tr a n spor t Cha nne l ( D CH )
DCHs are used for t he t ransport of user dat a and cont rol inform at ion for a part icular UE com ing from layers
above t he physical layer, including service dat a, such as speech fram es, as w ell as higher layer cont rol
inform at ion, such as handover com m ands or m easurem ent report s.
There is no need for a UE ident ifying param et er. One UE can have several DCHs for dat a t ransm ission but only
one for cont rol inform at ion t ransm ission.
Code d Com posit e Tr a nspor t Cha nne l ( CCTr CH )
The CCTrCH encodes and m ult iplexes all t ransport channels of t he sam e t ype on t he physical layer.
M a ppin g of Tr a n spor t Ch a n n e ls on t o Ph ysica l Ch a n n e ls
The com m on t ransport channels as well as t he dedicat ed t ransport channels are m apped ont o physical channels.
The follow ing pict ure gives an exam ple about t he relat ionship bet ween different t ransport channels and physical
channels:
UE- Ex a m ple for QoS H a n dlin g a n d D ist r ibu t ion of Logica l- , Tr a n spor t a n d Ph ysica l Ch a n n e ls ( Figu r e
1 .6 1 )
Figure 1 61- Exam ple for Mapping of Transport Channels.
1 .7 .1 7 I nit ia l UE Ra dio Acce ss

I f a UE is sw it ched on t he first t im e in a cell of t he UMTS net work it st art s t o perform t he follow ing I nit ial UE
Radio Access procedure t hat can be described in four st eps:
UMTS Signaling
Figure 1 62 - I nit ial UE Radio Access.

1.
2.
3.
4.
UE reads t he Prim ary Synchronizat ion Channel, which is not scram bled and spread by a predefined
spreading code ( SF= 256) . By reading t his, t he UE becom e t im e synchronic w it h t he Node B.
UE reads t he Secondary Synchronizat ion Channel, w hich is also not scram bled. The S- SCH w ill t ransm it
5 hex values, w hich com e out of a t able. By reading t hese values t he UE w ill becom e fram e synchronic
wit h t he Node B and will get t he scram bling group t he act ual Node B is using ( see t able 4) .
UE can now read t he Com m on Pilot Channel, w hich is scram bled wit h one of 8 prim ary scram bling codes
of t he scram bling group. I t is a m at t er of t rial and error t o find t he correct code. The Pilot Channel w ill
cont ain furt her inform at ion about ot her necessary codes and about t he DL Macro Diversit y
synchronizat ion pat t ern.
UE w ill read t he Com m on Cont rol Physical Channel, which uses t he sam e scram bling code as t he CPI CH,
t o get det ailed inform at ion about UTRAN and t he core net work , t o allow t he P- CCPCH t o t ransport t he
BCH, and t o be able t o get paged, and t o allow t he S- CCPCH t o t ransport PCH. The syst em inform at ion
in t he Broadcast Channel ( BCH) will also indicat e t he secondary scram bling code of t he act ual Node B
for furt her dat a t ransm ission on t he dedicat ed channels ( DCHs) .
1 .7 .1 8 Pow e r Con t r ol
Because of t he fact t hat t he SI R ( S/ N) should be t he sam e for all users in a cell, t he dem and for power cont rol in
UMTS is very high. Two form s of power cont rol ex ist in UMTS.
Ope n Loop Pow e r Con t r ol a kind of one- way power cont rol used before t he UE is connect ed t o t he RRC and
describes t he abilit y of t he UE t ransm it t er t o set t he out put power t o a specific value for init ial u plin k and
dow n lin k t ransm ission pow ers. The power cont rol t olerance is 9 dB ( norm al condit ions) or 12 dB ( ext rem e
condit ions) .
S/ N should be t he sam e for all users in a cell.

Each user produces a Signal, w hich, t o ot her users, is j ust noise.
Received Signal = S ( User 1) +
N ( User n- 1) .
The goal m ust be t o keep Signal S at a m inim um so t hat t he noise w ill be low.
Close d Loop Pow e r Con t r ol is perform ed when t he UE has a RRC connect ion, it cont ains an I nne r a nd Ou t e r
Loop Pow e r Con t r ol m echanism .
UMTS Signaling
Figure 1 63 - Power Cont rol.
I nner Loop Power Cont rol ( 1500Hz) runs in t he uplink and describes t he abilit y of an UE t ransm it t er t o adj ust
out put power in accordance w it h one or m ore Transm it Pow er Cont rol ( TPC) com m ands of t he downlink . The
received uplink Signal- t o- I nt erference Rat io ( SI R) shall be kept at a given SI R t arget . UE t ransm it t ers m ight
change t he out put power ( st ep size of 1, 2 and 3 dB) in t he slot aft er TPC_cm d was deriv ed. Serv ing cells
est im at e SI R of received uplink DPCH, generat e TPC com m ands ( TPC_cm d) and t ransm it t he com m ands once per
slot according t o:
I f SI Rest > SI Rt arget TPC com m and is " 0"

I f SI Rest < SI Rt arget TPC com m and " 1"
Aft er recept ion of TPC com m ands, t he UE derives a TPC com m ands for each slot . The UE- Specific Higher- Layer
Param et er, " PowerCont rolAlgorit hm " det erm ines which of t he t wo algorit hm s is used for t he evaluat ion
Out er loop power cont rol is m aint ains t he qualit y of com m unicat ion for bearer service qualit y requirem ent s, using
as low power as possible. Uplink out er loop power cont rol t akes care of set t ing a t arget SI R in Node Bs for
individual uplink inner loop pow er cont rol. This t arget SI R is updat ed for each UE according t o t he est im at ed
uplink qualit y ( BLock Error Rat ion, Bit Error Rat io) for each Radio Resource Cont rol connect ion. Downlink out er
loop power cont rol describes t he abilit y of t he UE receiver t o converge t o required link qualit y ( BLER) defined by
t he net work ( RNC) in downlink .
Ope n Loop Pow e r Con t r ol
Figure 1 64 - Open Loop Power Cont rol.
By receiving t he CPI CH and t he BCCH I nform at ion param et ers on t he BCH, t he UE can est im at e a TX power. The
st ronger t he RX signal, t he less t he TX power w ill be.
Close d Loop Pow e r Con t r ol
UMTS Signaling
Figure 1 65 - Closed Loop Power Cont rol.
Aft er finding out what t ype of service t he UE w ant s t o get , t he Serving RNC w ill define a QoS t arget for t he Radio
Bearer ( SI R) . Node B will st ore t he t arget SI R and w ill com pare it w it h t he act ual m easurem ent s of t hat UE. The
result of t he com parison w ill be given t o t he SRNC, which in t urn w ill send a new t arget . The com m unicat ion
bet ween Node B and SRNC is called t he Ou t e r Loop Pow e r Con t r ol and will be perform ed bet ween 10 and 100
t im es per second. This is w hy t his m et hod is called Slow Pow er Cont rol !
On t he ot her side, t he Node B m ust cont rol t he UE TX power t o reach t he given SI R. Node B sends Tr a n sm it
Pow e r Com m a n ds ( TPC) t o t he UE t o indicat e eit her t o increase or t o decrease t he TX power. UE w ill have t o
m odify it s TX power im m ediat ely. This m et hod is called t he I n n e r Loop Pow e r Con t r ol and is perform ed up t o
1500 t im es per second, Fast Power Cont rol .
Power Cont rol m echanism s w ill becom e a very im port ant part of net work opt im izat ion in t he fut ure, but in current
st at e of deploym ent t here is st ill only lit t le experience in t his field for net work operat ors.
1 .7 .1 9 UE Ra n dom Acce ss
Aft er est im at ing t he TX power ( Open Loop Power Cont rol) t he UE w ill send an I nit ial Access fram e on t he Phy sical
Random Access Channel. I t w ill t hen wait for an acknow ledgm ent . I f t here is no acknow ledgm ent , t hen t he UE
w ill increase TX power and send t he fram e again. I t w ill perform t his unt il it receives an Access Det ect ed m essage
via t he Acquisit ion I ndicat ion Channel ( AI CH) or unt il it reaches t he m ax im um value for TX power.
UMTS Signaling
Figure 1 66 - UE Random Access.

Now t he UE knows about good TX power st rengt h and w ill send t he real Random Access I nform at ion cont aining
t he RRC Connect ion Request .
1 .7 .2 0 Pow e r Con t r ol in Soft H a n dove r

I n Soft Handover, t he UE is connect ed t o m ore t han one Node B. All Node Bs w ill by default t ransm it Transm it
Power Com m and m essages. The rule t o follow is t hat t he less TX power t he bet t er! I n t he exam ple, one Node B
indicat es t o decrease t he TX power. That would m ean t o t he UE t o decrease t he TX power ev en if it would loose
t he cont act t o t he ot her Node Bs. By t his rule t he Near- Far- Effect cannot becom e an endless problem .
Figure 1 67 - Power Cont rol in Soft Handover.
A special alt ernat ive is t he Sit e Se le ct ion D ive r sit y ( SSD T) . Using t his UTRAN opt ion t he RNC will get t he
m easurem ent s of t he act ual radio int erface connect ion t owards one UE by several Node Bs and decide t hat som e
of t he Node Bs should st op t ransm it t ing DCHs and also st op t ransm it t ing TPCs ( Transm it Pow er Com m ands) t o
t he UE. Only t he Node B wit h t he best radio cont act w ill be t he UE server in downlink.
UMTS Signaling
1 .8 UM TS N ETW ORK PROTOCOL ARCH I TECTURE
Figure 1 68 - UMTS Net work Prot ocol Archit ect ure.
The prot ocol archit ect ure of UTRAN is subdiv ided int o t hree lay ers:
1.
2.
3.
Tr a n spor t N e t w or k La ye r physical and t ransport prot ocols and funct ions t o provide AAL2 resources
and allow com m unicat ion w it hin UTRAN and core net work. The prot ocols are not UMTS specific.
Ra dio N e t w or k La ye r prot ocols and funct ions t o allow m anagem ent of radio int erface and
com m unicat ion bet ween UTRAN com ponent s and bet ween UTRAN and UE.
Syst e m N e t w or k La ye r NAS prot ocols t o allow com m unicat ion bet ween CN and UE.
Each of t he lay ers is div ided int o a cont rol and a user plane.
Cont r ol pla ne t ransm ission of cont rol signaling inform at ion.
Use r pla n e t ransm ission of user dat a t raffic.
The next paragraphs give an overview about prot ocol st acks on t he different int erfaces in UTRAN and t he core
net work. The descript ion of funct ions of prot ocol lay ers, t heir m essages and procedures follows in chapt er 2,
dealing wit h all prot ocol det ails.
1 .8 .1 I u b Con t r ol Pla ne
Figure 1 69 - I ub Cont rol- Plane
The prot ocol st ack of Uu and I ub int erface, cont rol plane cont ain:
UMTS Signaling
ATM
Asynchronous Transfer Mode is used in UMTS as t he t ransm ission form on all I u int erfaces. The physical layer is
SDH over fiber. The sm allest unit in ATM is t he ATM cell. I t w ill be t ransm it t ed in Vir t ua l Cha n ne l. Many v irt ual
channels are running w it hin a Vir t ua l Pa t h.
AAL
ATM Adapt at ion Layer
To t ransm it higher prot ocols via ATM, it is required t o hav e adapt at ion sublayers. These sublayers cont ain a
com m on adapt at ion and a serv ice- specific adapt at ion part .
UP FP
User Plane Fram ing Prot ocol
Used on I ur and I ub int erface t o fram e channels support ed bet ween SRNC and Node Bs.
SSCOP
Serv ice Specific Connect ion Orient ed Prot ocol
Prov ides m echanism s for est ablishm ent and release of connect ions and reliable exchange of signalling
inform at ion bet ween signaling ent it ies.
M AC
Medium Access Cont rol Prot ocol
Coordinat es access t o physical layer. Logical channels of higher lay ers are m apped ont o t ransport channels of
low er layers. MAC also select s appropriat e t ransport form at set s depending on necessary t ransm ission rat e and
organizes t he priorit y handling bet ween different dat a flows of one single UE.
RLC
Radio Link Cont rol Prot ocol
Offers t ransport serv ices t o t he higher lay ers called Radio Bearer Serv ices; t he t hree work m odi are t ransparent ,
acknowledged and unacknowledged m ode.
SSCF
Serv ice Specific Coordinat ion Funct ion
( User- Net work- I / F, Net work- Net work- I / F)
Not a prot ocol but an int ernal coordinat ion funct ion, which does int ernal adapt at ion of t he inform at ion com ing or
going t o higher lay ers, for exam ple, MTP3- B rout ing inform at ion.
STC
Signaling Transport Convert er
I s an int ernal funct ion, w hich has no own m essages; it convert s prim it ives from lower and higher lay ers ( eit her
MTP3 or MTP3B prim it ives) and t heir param et ers fit t ing t he requirem ent s of t he ot her.
RRC
Radio Resource Cont rol Prot ocol
I s a sublay er of Layer 3 on UMTS radio int erface and ex ist s in t he cont rol plane only . I t prov ides inform at ion
t ransfer service t o t he NAS ( Non Access St rat um ) and is responsible for cont rolling t he configurat ion of UMTS
radio int erface Layers 1 and 2.
AAL2 L3
AAL t ype 2 Layer 3 Prot ocol
Generic nam e for t ransport signalling prot ocol t o set up and release t ransport bearers. I n UMTS t he m ain ALCAP
prot ocol is t he AAL2 signalling prot ocol.
N BAP
Node B Applicat ion Part
Prot ocol is used bet ween RNC and Node B t o configure and m anage t he Node B and set up channels on I ub and
Uu int erfaces.
MM
Mobilit y Managem ent
A generic t erm for t he specific m obilit y funct ions provided by a PLMN including e.g. t racking a m obile as it m oves
around a net work and ensuring t hat com m unicat ion is m aint ained
SM
Session Managem ent prot ocol is used bet w een UE and SGSN and creat es, m odifies, m onit ors and t erm inat es
sessions w it h ono or m ore part icipant s, including m ult im edia conferences and int ernet t elephone calls.
CC
Call Cont rol includes som e basic procedures for m obile call cont rol ( no t ransport cont rol! ) : Call Est ablishm ent ,
Call Clearing, Call I nform at ion Phase and ot her m iscellaneous procedures
UMTS Signaling
1 .8 .2 I u b- Use r Pla n e
Figure 1 70 - I ub- User- Plane.

The user plane prot ocol st acks of Uu and I ub int erface int roduce som e new lay ers:
PD CP
Packet Dat a Convergence Prot ocol
I s used t o form at dat a int o a suit able st ruct ure prior t o t ransfer over t he air int erface and provides it s services t o
t he NAS at t he UE or t he relay at t he Radio Net work Cont roller ( RNC) .
BM C
Broadcast / Mult icast Prot ocol
Adapt s broadcast and m ult icast serv ices on t he radio int erface and is a sublayer of L2 t hat ex ist s in t he UserPlane only
Applica t ion D a t a
I P- based packet prot ocols
Speech ( AMR) w ill be t ransport ed t ransparent ly on AAL2.
1 .8 .3 I u r Use r - / Con t r ol Pla ne
Figure 1 71 - I ur User- / Cont rol- Plane
The I ur int erface bet w een RNCs shows t wo alt ernat iv e solut ions on t he t ransport net work layer. Eit her SCCP and
RNSAP m essages can be t ransport ed using MTP3- B running on t op of SSCOP. Or it is possible t o run SCCP on t op
of M3UA if t he lower t ransport layer is I P- based.
IP
I nt ernet Prot ocol
Provides connect ionless services bet ween net w orks and includes feat ures for addressing, t ype- of- service
specificat ion, fragm ent at ion and reassem bly , and securit y.
SCTP
St ream Cont rol Transm ission Prot ocol
Transport prot ocol t hat provides acknow ledged error free non duplicat ed t ransfer of dat a. I t Dat a corrupt ion, loss
UMTS Signaling
of dat a and duplicat ion of dat a is det ect ed by checksum s and sequence num bers. Ret ransm ission m echanism s
are applied t o correct loss or corrupt ion of dat a
M TP3 - B
Message Transfer Part Level 3 Broadband
Fulfils t he sam e sort of work as t he st andard narrowband MTP; it prov ides ident ificat ion and t ransport of higher
lay er m essages ( PDUs) , rout ing, and load sharing
M 3 UA
MTP Level 3 User Adapt at ion Layer
Provides equivalent prim it ives t o MTP3 users as provided by MTP Level 3. I SUP and/ or SCCP are unaware t hat
expect ed MTP3 services are offered rem ot ely and not by local MTP3 layer. M3UA ext ends access t o MTP3 layer
services t o a rem ot e I P based applicat ion
SCCP
Signaling Connect ion Cont rol Part
Provides a service for t ransfer of m essages bet ween any t wo signalling point s in t he sam e or different net work
RN SAP
Radio Net work Subsyst em Applicat ion Part
Com m unicat ion prot ocol used on t he I ur int erface bet w een RNCs and is specified using ASN.1 Packed Encoding
Rules ( PER)
Speech ( AMR) w ill be t ransport ed t ransparent ly on AAL2.
1 .8 .4 I u CS Use r - / Con t r ol- Pla ne
Figure 1 72 - I uCS User- / Cont rol- Plane
The prot ocol st ack of I uCS int erface, cont rol and user plane cont ains:
AM R
Adapt ive Mult i- Rat e Codec ( speech)
Offers a w ide range of dat a rat es and is used t o low er codec rat es as int erference increases on t he air int erface
TAF
Term inal Adapt at ion Funct ion ( V. and X. series t erm inals)
A convert er prot ocol t o support t he connect ion of various kinds of t erm inal equipm ent ( TE) t o t he Mobile
Term inat ion ( MT)
RLP
Radio Link Prot ocol
Cont rols circuit - sw it ched dat a t ransm ission w it hin t he GSM and UMTS PLMN
The circuit - sw it ched ( CS) dom ain refers t o t he set of all ent it ies handling t he circuit - sw it ched t ype of user t raffic
as well as ent it ies support ing t he relat ed signaling. These are t he Mobile- serv ices Sw it ching Cent er ( MSC) , t he
Gat eway MSC ( GMSC) , t he Visit or Locat ion Regist er ( VLR) , and t he I nt erWork ing Funct ion( s) ( I WF) t owards t he
PSTN/ I SDN net works.
UMTS Signaling
1 .8 .5 I uPS Use r - / Con t r ol- Pla ne

The packet sw it ched ( PS) dom ain includes t he relat ed ent it ies for packet t ransm ission, t he Serv ing GPRS Support
Node ( SGSN) , Gat eway GPRS Support Node ( GGSN) , and Border Gat eway ( BG) .
N ot e : The user plane payload ( I P- t raffic) is t ransport ed using AAL5. So t here is no ALCAP layer necessary in t he
cont rol plane t o set up and delet e swit ched virt ual AAL2 ATM connect ions.
Figure 1 73 - I uPS User- / Cont rol- Plane
1 .8 .6 E Use r - / Con t r ol- Pla n e
Figure 1 74 - E User- / Cont rol- Plane

The E int erface prot ocol st ack is well- known form GSM environm ent w it h bot h, cont rol and user plane.
PCM
Pulse Code Modulat ion
An analogue signal is encoded int o a digit al bit st ream by first sam pling, t hen quant izing and finally encoding int o
a bit st ream . The m ost com m on version of PCM convert s a voice circuit int o a 64Kbps st ream
TCAP
Transact ion Capabilit y Applicat ion Part
Enables deploym ent of advanced int elligence in net works by support ing non circuit relat ed inform at ion exchange
bet ween Signalling Point s using SCCP connect ionless serv ice.
M AP
Mobile Applicat ion Part
Enables real t im e com m unicat ion bet ween nodes in m obile net works. Exam ple: t ransfer of locat ion inform at ion
from VLR t o t he HLR
UMTS Signaling
I SUP
I SDN User Part
Part of SS7 prot ocol layer, used for set t ing up, m anagem ent and release of voice calls and dat a bet ween calling
and called part ies
M TP- L2
Message Transfer Part Level 2
Takes care of reliable t ransm ission t hrough ret ransm ission t echniques of signaling unit s over Signaling Links
M TP- L3
Message Transfer Part Level 3
Represent s t he highest level of MTP and t akes care of t he general MTP m anagem ent and t he discrim inat ion,
dist ribut ion and rout ing of signaling m essages
N ot e : The Mobile Applicat ion Part ( MAP) is also able t o carry cont ainers wit h, for exam ple RANAP and BSSAP
m essages t o exchange t hese m essages bet ween different MSC in case of int er MSC or int er syst em handover
procedures.
1 .8 .7 Gn Use r - / Con t r ol- Pla ne
Figure 1 75 - Gn - User- / Cont rol- Plane

The prot ocol st ack on GPRS Gn int erface has not changed significant ly in com parison w it h 2.5G net works.
GTP- C
GPRS Tunneling Prot ocol Cont rol
GTP- C m essages are exchanged bet ween GSNs t o creat e, updat e and delet e GTP t unnels, for pat h m anagem ent
and t o t ransfer GSN capabilit y inform at ion bet ween GSN pairs. GTP- C is also used for com m unicat ion bet ween
GSNs and t he charging gat eways ( CG) .
GTP- U
GPRS Tunneling Prot ocol - User
GTP- U m essages are exchanged bet ween GSN pairs or GSN/ RNC pairs for pat h m anagem ent and error indicat ion,
t o carry user dat a packet s and signaling m essages
UD P
User Dat agram Prot ocol
UDP is a connect ionless, host - t o- host prot ocol t hat is used on PS net works for real t im e applicat ions
TCP
Transm ission Cont rol Prot ocol provides reliable connect ion- orient ed, full- duplex point - t o- point services
UMTS Signaling
1 .9 ATM
Asyn ch r on ou s Tr a n sfe r M ode ( ATM ) is used in UMTS as t he t ransm ission form on all I u int erfaces. The
physical lay er is SDH over fiber.
The sm allest unit in ATM is t he ATM cell. I t w ill be t ransm it t ed in a Vir t u a l Ch a n n e l. Many virt ual channels are
running w it hin a Vir t ua l Pa t h.
Figure 1 76 - Asynchronous Transfer Mode.
A v irt ual pat h is for exam ple t he perm anent v irt ual connect ions ( PVC) for exchanging NBAP and ALCAP m essages
bet ween RNC and Node B. This connect ion w ill be set up once and w ill run unt il it is changed or delet ed by O&M
operat ion. Over t his PVC ( Perm anent Virt ual Connect ion) m any user connect ions are running, which represent s
virt ual channels.
1 .9 .1 ATM Ce ll
An ATM cell cont ains t wo address param et ers, virt ual pat h ident ifier ( VPI ) and virt ual channel ident ifier ( VCI ) , an
ident ificat ion of t he t ype of pay load, a cell loss priorit y and a header CRC. That m eans t hat t he t ransm ission of
t he payload cont ent s is not secured by a checksum . For t ransm ission error det ect ion and correct ion, t he higher
lay ers m ust hav e cert ain funct ions.
UMTS Signaling
Figure 1 77 - ATM Cell.
The header is 5 byt es and t he payload is 48 byt es long.

The exam ple in t he figure show s a possible configurat ion of t he UMTS I ur int erface. Cert ain signaling prot ocols
are running over different VCI s as well as t he user dat a t raffic. The VCI s for t raffic are sw it ch e d vir t u a l
con n e ct ion s ( SVC) , for exam ple, t hey w ill be set up only on request .
1 .9 .2 ATM La ye r Ar ch it e ct u r e
Figure 1 78 - ATM Layer Archit ect ure
To t ransm it higher prot ocols via ATM, it is required t o hav e adapt at ion sublayers. These sublayers cont ains a
com m on adapt at ion and a serv ice- specific adapt at ion part .
The Con ve r ge n ce Su bla ye r is responsible for get t ing t he PDU of t he higher layer and for m odifying it s size so
t hat each of t hem fit s int o a SSCS and a CPCS m essage, respect ively. Addit ionally ext ra param et ers w ill be
insert ed t o guarant ee t hat a receiver can allocat e each m essage t o a specific st ream of inform at ion.
The Se gm e n t a t ion Su bla ye r is responsible for segm ent ing t he SSCS or CPCS m essage so t hat each part of t he
original w ill fit int o t he ATM cell payload. Reassem bly is t he count erpart t o segm ent at ion and is perform ed at t he
receiver side.
UMTS Signaling
1 .9 .3 ATM Ada pt ion La ye r ( AAL)
Figure 1 79 - ATM Adapt ion Layer.

The ATM adapt at ion layer is specified by 4 classes ( A- D) t hat differ from each ot her in bit rat e, synchronizat ion
m et hod, and connect ion t ype.
A:
B:
C:
D:
Const ant Bit Rat e Serv ice ( CBR)

Unspecified Bit Rat e Serv ice ( UBR)
Available Bit Rat e Serv ice ( ABR)
Variable Bit Rat e Serv ice ( VBR)
For each class a specific adapt at ion layer has been developed t o support t he specific use of it . These are ATM
Adapt at ion Layers 1, 2, 3/ 4 and 5.
Each of t he AALs cont ains a different fram e st ruct ure which cont ains all necessary param et ers t o support t he
need. Part of every AAL fram e is a dat a field in which t he AAL- SDU m essage, or segm ent of a m essage of a
higher prot ocol, will be placed and t ransm it t ed.
1 .9 .4 AAL2
The ATM Ada pt a t ion La ye r ( AAL) t ype 2 ( I TU- T I .363.2) provides for t he bandw idt h- efficient t ransm ission of
low- rat e, short , and variable lengt h packet s in delay sensit iv e applicat ions. More t han one AAL t ype 2 user
inform at ion st ream can be support ed on a single ATM connect ion.
The AAL t ype 2 is subdiv ided int o t he Com m on Pa r t Su bla ye r ( CPS) and t he Se r vice Spe cific Con ve r ge n ce
Su bla ye r ( SSCS) . Different SSCS prot ocols m ay be defined t o support specific AAL t ype 2 user serv ices, or
groups of serv ices. The SSCS m ay also be null, m erely prov iding for t he m apping of t he equiv alent AAL prim it iv es
t o t he AAL t ype 2 CPS prim it ives and vice versa.
UMTS Signaling
Figure 1 80 - AAL2 Form at
AAL t ype 2 has been dev eloped t o t ransport m ult iple dat a st ream s. The Con n e ct ion I de n t ifie r ( CI D ) ident ifies
every st ream . The CI D value can be found in t he layer 3 signaling as a reference ( AAL2L3/ ALCAP signaling
prot ocol) .
The St a r t Fie ld ( STF) is used t o point t o t he payload or pa dding ( PAD ) as well as for t ransm ission error
det ect ion.
1 .9 .5 AAL5
Figure 1 81 - AAL5 Form at
The ATM Ada pt a t ion La ye r ( AAL) t ype 5 ( I TU- T I .363.5) enhances t he service prov ided by t he ATM layer t o
support funct ions required by t he next higher layer. This AAL perform s funct ions required by t he user, cont rol
and m anagem ent planes, and support s t he m apping bet ween t he ATM layer and t he next higher lay er.
The AAL t ype 5 support s t he non- assured t ransfer of user dat a fram es. The dat a sequence int egrit y is m aint ained
and t ransm ission errors are det ect ed. The AAL t ype 5 is charact erized by t ransm it t ing in ev ery ATM cell ( but t he
last ) of a PDU, 48 oct et s of user dat a. I n m ost of t he cells, t here is no overhead encount ered.
AAL5 does not support input dat a st ream s; it support s fram es. Max im um size of a fram e is 64 kbyt e. The higher
layer m essage will be put in t he CPCS- PD U payload field. One of t he t ail param et ers w ill indicat e t he lengt h of
UMTS Signaling
t he payload. The CRC field w ill also prot ect t he payload. I n t his way, t he t ransm ission is prot ect ed and is m ainly
used for t ransm ission of cont rol inform at ion, for exam ple signaling.
UMTS Signaling
1 .1 0 USER PLAN E FRAM I N G PROTOCOL

The user plane Fram ing Prot ocol ( FP, defined in 3GPP 25.427) t ransport s Transport Block Set s ( TBS) across t he
I ub and I ur int erface. I t is also responsible for t ransm ission of out er loop power cont rol inform at ion bet w een
Node B and SRNC and for t ransfer of radio int erface param et ers from SRNC t o Node B. A set of FP signaling
m essages support s m echanism s for t ransport channel synchronizat ion and node synchronizat ion. I n addit ion FP
provides also t ransport services for Downlink Shared Channels ( DSCH) Transport Form at I ndicat ors ( TFI ) from
SRNC t o Node B.
Transport channels on t he I ur t hat lead from SRNC t o DRNC m ust have t he sam e configurat ion param et ers as t he
sam e t ransport channels on I ub bet ween DRNC and Node B.
The SRNC is responsible for t he com plet e configurat ion of t he t ransport channels. Appropriat e signaling m essages
are exchanged bet ween SRNC and Node B( s) via I ub and - if necessary - v ia I ur cont rol plane. Transport channels
in downlink direct ion are m ult iplexed by t he Node B ont o radio physical channels, and de- m ult iplexed in uplink
direct ion from t he radio physical channels.
1 .1 0 .1 Fr a m e Ar chit e ct u r e
There are t wo different FP fram e form at s for dat a and cont rol fram es. I n case of FP dat a fram e t he fram e t ype
field in t he header is set t o " 0" .
H e a de r
Fram e Type ( FT) : 0= dat a
Connect ion Fram e Num ber ( CFN) : reference t o radio fram e
Transport Form at I ndicat or ( TFI ) : inform at ion about dat a block
Figure 1 82 - UP FP Fram ing Archit ect ure
Pa yloa d
Transport Block s ( TB) : block of dat a of DCH
CFN : I ndicat or as t o which radio fram e t he first dat a was received on uplink or w ill be t ransm it t ed on downlink.
TFI : t he local num ber of t he t ransport form at used for t he t ransm ission t im e int erval.
Tr a n spor t Block ( TB) : A block of dat a t o be t ransm it t ed or received over t he air int erface. The t ransport form at
indicat ed by t he TFI describes t he t ransport block lengt h and t ransport block set size.
1 .1 0 .2 FP Con t r ol Fr a m e Ar ch it e ct u r e
I n case of a FP cont rol fram e t he fram e t ype field is set t o " 1" and cont rol fram e t ype indicat es t he nam e of t he
FP signalling m essage.
Figure 1 83 - UP FP Cont rol Fram e Archit ect ure.
H e a de r
UMTS Signaling
Fram e Type ( FT) :

Cont rol Fram e Type:
0= dat a, 1= cont rol

OUTER LOOP POWER CONTROL
TI MI NG ADJUSTMENT
DL SYNCHRONI SATI ON
UL SYNCHRONI SATI ON
DSCH TFCI SI GNALI NG
DL NODE SYNCHRONI ZATI ON
UL NODE SYNCHRONI ZATI ON
RX TI MI NG DEVI ATI ON
RADI O I NTERFACE PARAMETER UPDATE
TI MI NG ADVANCE
Pa yloa d
Cont ains only param et ers ( CFN, Tim e of Arrival, UP SI R Target , ot her Tim ing I nform at ion, et c.)
UMTS Signaling
1 .1 1 M ED I UM ACCESS PROTOCOL ( M AC)

The MAC prot ocol ( 3GPP 25.321) coordinat es t he access of t he physical lay er. The logical channels of higher
layers are m apped ont o t ransport channels of lower layers. MAC also select s t he appropriat e t ransport form at
set s depending on necessary t ransm ission rat e and organizes t he priorit y handling bet w een different dat a flow s
of one single UE.
I f t he UE uses Com m on Transport Channels MAC prov ides a unique Ra dio N e t w or k Te m por a r y I de n t ifie r
( RN TI ) for each single UE, which is known also by t he RRC.
I n case of random access t o t he net work v ia RACH, MAC defines a priorit y by assigning an Acce ss Se r vice Cla ss.
The values of ASC can be 0 7, whereas 0 is t he highest priorit y. An Em ergency Call would for exam ple get t he
ASC= 0. During Radio Bearer connect ion set up MAC w ill receive a M AC Logica l Lin k Pr ior it y ( M LP) . This
corresponds w it h ASC.
1 .1 1 .1 M AC Ar ch it e ct u r e
Figure 1 84 - MAC Archit ect ure.
The diagram s t hat describe t he MAC archit ect ure show t he different MAC ent it ies, which are:
M AC- b is t he MAC ent it y t hat handles t he follow ing t ransport channels:
broadcast channel ( BCH)
M AC- c/ sh is t he MAC ent it y t hat handles t he follow ing t ransport channels:
Paging Channel ( PCH)

Forward Access Channel ( FACH)
Random Access Channel ( RACH)
Com m on Packet Channel ( UL CPCH) . The CPCH ex ist s only in FDD m ode.
Downlink Shared Channel ( DSCH)
Uplink Shared Channel ( USCH) . The USCH ex ist s only in TDD m ode.
M AC- d is t he MAC ent it y t hat handles t he follow ing t ransport channels:
UMTS Signaling
Dedicat ed Transport Channels ( DCH)
All ent it ies are cont rolled v ia t he Mac Cont rol SAP which is connect ed t o t he RRC unit .
1 .1 1 .2 M AC D a t a PD U
1.11.2 MAC Dat a PDU
The MAC Dat a PDU cont ains t he follow ing inform at ion elem ent s ( definit ions follow ing 3GPP 25.321) .
Figure 1 85 - MAC Dat a PDU

Ta r ge t Ch a n n e l Type Fie ld
The TCTF field is a flag t hat provides ident ificat ion of t he logical channel class on FACH and RACH t ransport
channels. The flag t ells whet her t he channel carries BCCH, CCCH, CTCH, SHCCH, or dedicat ed logical channel
inform at ion.
UE- I d ( D iffe r en t RN TI s)
The UE- I d field provides an ident ifier of t he UE on com m on t ransport channels.
The following t y pes of UE- I d used on MAC are defined:
The Ce ll Ra dio N e t w or k Te m por a r y I de n t it y ( C- RN TI ) ident ifies an UE uniquely w it hin one cell and
is assigned by t he SRNC ( = CRNC) .
I t is used on DTCH and DCCH in uplink, m ay be used on DCCH in downlink and is used on DTCH in
downlink when m apped ont o com m on t ransport channels except when m apped ont o t he DSCH t ransport
channel.
The DSCH Radio Net work Tem porary I dent it y ( DSCH- RNTI ) uniquely ident ifies an UE w it hin one cell, in
case t hat DSCH- TrCHs are used as bearers for DCCH/ DTCH. The DSCH- RNTI is assigned by t he CRNC.
I n FDD, t he DSCH- RNTI is used on DTCH and DCCH in downlink when m apped ont o t he DSCH t ransport
channel.
UMTS Signaling
The SRNC Radio Net work Tem porary I dent it y ( S- RNTI ) uniquely ident ifies an UE in t he SRNS ( e.g. in
RNSAP m essages) and is assigned by SRNC for a RRC- connect ion est ablishm ent . A S- RNTI is discarded,
if t he RRC connect ion is released or when t he SRNC changes ( e.g. during a SRNC Relocat ion)
The Drift RNC Radio Net work Tem porary I dent it y ( D- RNTI ) uniquely ident ifies an UE in RNSAP m essages
from SRNC t o DRNC and is assigned by DRNC.
UTRAN Radio Net work Tem porary I dent it y ( U- RNTI ) uniquely ident ifies t he UE w it hin t he UTRAN,
because t he SRNC- I d is included. I t consist s of S- RNTI and SRNC- I d and is assigned/ rleased upon an
RRC connect ion est ablishm ent / release.
C/ T fie ld
The C/ T field provides ident ificat ion of t he logical channel inst ance when m ult iple logical channels are carried on
t he sam e t ransport channel ( for exam ple it indicat es which radio signaling bearer is used in case of RRC m essage
t ransport ) . The C/ T field is used also t o provide ident ificat ion of t he logical channel t ype on dedicat ed t ransport
channels and on FACH and RACH when used for user dat a t ransm ission.
1 .1 1 .3 M AC H e a de r Alt e r na t ive s
Depending on t he channel used, t he MAC header can cont ain a different param et er:
Figure 1 86 - MAC Header Alt ernat ives.
A: DTCH or DCCH w ill be m apped on DCH; t here is no m ult iplex ing of dedicat ed channels in MAC. No header
inform at ion is required.
B:
DTCH or DCCH w ill be m apped on DCH. MAC perform s m ult iplex ing of dedicat ed channels. C/ T is required.
C: DTCH or DCCH w ill be m apped on RACH / FACH. I f m ult iplexing of dedicat ed channels is necessary, C/ T is
included.
D : DTCH or DCCH w ill be m apped on DSCH / USCH as long as DTCH or DCCH are t he only logical channels. I f
m ult iplex ing of dedicat ed channels is necessary, C/ T is included.
UMTS Signaling
E: Could be used if BCCH is m apped on FACH and m ust be used if CCCH is m apped on RACH / FACH and CTCH
m essages are used.
UMTS Signaling
1 .1 2 RAD I O LI N K CON TROL ( RLC)

The Radio Link Cont rol prot ocol ( RLC) offers t ransport serv ices t o t he higher layers called Radio Bearer Serv ices
and is specified in 3GPP 25.322.
RLC support s segm ent at ion and t he t ransport of user and signaling inform at ion.
The RLC sublay er consist s of RLC ent it ies for t he UE- UTRAN int erface, of which t here are t hree m odes of
operat ion:
Transparent Mode ( TM) ,

Unacknowledged Mode ( UM) ,
Acknowledged Mode ( AM)
1 .1 2 .1 RLC Se r vice s
Con n e ct ion Est a blish m e n t / Re le a se
The RLC Connect ion Est ablishm ent and Release organizes t he set up or ending of RLC connect ions.
Tr a nspa r e nt D a t a Tr a n sfe r
Transm it s higher layer PDUs w it hout adding any prot ocol inform at ion, possibly including segm ent at ion and
reassem bly funct ionalit y
Un a ck now le dge d D a t a Tr a n sfe r
Transm it s higher layer PDUs w it hout guarant eeing delivery t o peer ent it y. The unacknow ledged dat a t ransfer
m ode has t he follow ing charact erist ics:
Det ect s erroneous dat a by using a sequence- num ber check funct ion. The RLC sublayer delivers t o t he
receiving higher layer only SDUs t hat are free of t ransm ission errors
Un iqu e D e live r y
Using duplicat ion det ect ion, t he RLC sublay er delivers each SDU t o t he receiv ing upper layer only once.
I m m e dia t e D e live r y
The receiving RLC sublayer ent it y delivers an SDU t o t he higher layer receiving ent it y as soon as t he SDU arrives
at t he receiver.
Ack now le dge d D a t a Tr a nsfe r
Transm it s higher layer PDUs and guarant ees delivery t o peer ent it y. I n case RLC is unable t o deliver dat a
correct ly, t he user of RLC at t he t ransm it t ing side is not ified. I n- sequence and out - of- sequence delivery is
support ed.
Acknow ledged Dat a Transfer Mode has t hese charact erist ics:
Error- free delivery

Ensured by m eans of ret ransm ission; t he receiving ent it y delivers only errorfree SDUs t o t he higher
lay er.
Unique Delivery
Using duplicat ion det ect ion, t he RLC sublay er delivers each SDU t o t he receiv ing upper layer only once.
I n- Sequence Delivery
RLC sublayer provides support for a sequencial delivery of SDUs. RLC sublayer delivers SDUs t o t he
receiving higher layer ent it y in t he sam e order as t he t ransm it t ing higher layer ent it y subm it s t o RLC
sublay er.
Out - of- Sequence Delivery
As an alt ernat iv e t o in- sequence deliv ery , t he receiv ing RLC ent it y delivers SDUs t o t he higher lay er in a
different order t han t hey w ere subm it t ed t o t he RLC sublayer at t he t ransm it t ing side.
UMTS Signaling
1 .1 2 .2 RLC Fu n ct ion s
Se gm e n t a t ion a n d r e a sse m bly
Used for variable- lengt h of higher layer PDUs int o or from sm aller RLC Pay load Unit s ( PUs) . The PDU size
depends on t he act ual set of t ransport form at s.
Conca t e na t ion
Concat enat es t he cont ent s of RLC SDU w it h t he first segm ent of t he next RLC if t hey do not fill an int eger num ber
of RLC PUs. The SDU m ay be put int o RLC PU in concat enat ion w it h t he last segm ent of t he previous RLC SDU.
Pa dding
When concat enat ion is not applicable and t he rem aining dat a t o be t ransm it t ed does not fill t he ent ire RLC PDU of
a given size, t hen t he rem ainder of t he dat a field is filled w it h padding bit s.
Tr a n sfe r of Use r D a t a
RLC conveys dat a bet w een users of RLC serv ices and support s acknow ledged, unacknow ledged, and t ransparent
dat a t ransfer. The QoS set t ing cont rols t he t ransfer of user dat a.
Er r or Cor r e ct ion
Errors are correct ed by ret ransm it t ing t he dat a while in t he acknow ledged dat a t ransfer m ode. Dat a can be
ret ransm it t ed using com m ands such as Select ive Repeat , Go Back N, or a St op- and- Wait ARQ.
I n - Se qu e n ce D e live r y of h igh e r la ye r PD Us
Ensure t ransfer of higher lay er PDUs ( subm it t ed for t ransfer by RLC) in t he correct order, using acknowledged
dat a t ransfer. I f t he funct ion is not used, out - of- sequence delivery is provided.
D u plica t e D e t e ct ion
The RLC det ect s duplicat ed PDUs t hat it receives and ensures t hat t he result ant higher layer PDU is delivered only
once t o t he upper lay er.
Flow con t r ol
The RLC receiver cont rols t he rat e at which a peer RLC t ransm it t ing ent it y m ay send inform at ion.
Se que nce num be r ch e ck ( Una ck now le dge d da t a t r a nsfe r m ode )
The RLC guarant ees int egrit y of reassem bled PDUs and prov ides a m echanism for det ect ion of corrupt ed RLC
SDUs t hrough check ing t he sequence num ber in RLC PDUs when t he PDUs are reassem bled int o an RLC SDU. All
corrupt ed RLC SDUs w ill be discarded.
Pr ot ocol Er r or D e t e ct ion a n d Re cove r y
The RLC det ect s and recovers from errors in t he operat ion of it s prot ocol.
Ciphe r in g
Ciphering prev ent s unaut horized acquisit ion of dat a and is perform ed in t he RLC layer for non- t ransparent RLC
m ode.
Su spe n d/ Re su m e fu n ct ion
Suspend/ Resum e funct ion of dat a t ransfer works in t he sam e w ay as in LAPDm ( ref. GSM 04. 05)
Tr a nspa r e nt M ode
No RLC inform at ion will be added t o t he m essage. Erroneous m essages w ill be det ect ed, regist ered and discarded.
There is no sequence cont rol funct ion available.
Table 1 6 - RLC Funct ion Overview Table.
UMTS Signaling
This m ode is used for st ream ing applicat ion dat a where t he dat a does not have t o be segm ent ed.
Applicat ions using t ransparent m ode are Video- and Audio dat a applicat ions.
Un a ck now le dge d M ode
By using t he sequence num ber, t he uniqueness of a dat a package can be checked, but t here is no error
correct ion m et hod specified in t his m ode. Cert ain RLC inform at ion will be added t o t he m essage, and
segm ent at ion and ciphering will be perform ed.
Applicat ions using unacknow ledged m ode are cert ain RRC procedures, where t he RRC layer is responsible for t he
receive acknow ledgem ent , t he Cell Broadcast Service, and t he VoI P.
Ack now le dge d M ode
Support s Aut om at ic Repeat Request ( ARQ) w it h all necessary param et ers; perform s segm ent at ion and ciphering
Applicat ions using acknowledged m ode are secure t ransm ission and packet orient ed dat a t ransfer.
The Table 1 6 below explains t he funct ions in com binat ion w it h t he different m odes:
N ot e : Ciphering is not part of RLC in t he t ransparent ent it y.
1 .1 2 .3 RLC Ar chit e ct ur e
Figure 1 87 - RLC Archit ect ure.
A UM and a Tr RLC ent it y can be configured t o be a t ransm it t ing RLC ent it y or a receiv ing RLC ent it y. The
t ransm it t ing RLC ent it y t ransm it s RLC PDUs; t he receiv ing RLC ent it y receives RLC PDUs.
An AM RLC ent it y consist s of a t ransm it t ing side and a receiv ing side, w here t he t ransm it t ing side of t he AM RLC
ent it y t ransm it s RLC PDUs and t he receiv ing side of t he AM RLC ent it y receiv es RLC PDUs.
Elem ent ary procedures are defined bet w een a " Sender" and a " Receiver" . I n UM and Tr, t he t ransm it t ing RLC
ent it y act s as a Sender and t he peer RLC ent it y act s as a Receiv er. An AM RLC ent it y act s eit her as a Sender or
as a Receiv er depending on t he elem ent ary procedure. The Sender is t he t ransm it t er of AMD PDUs and t he
Receiv er is t he receiver of AMD PDUs. A Sender or a Receiver can reside eit her at t he UE or at t he UTRAN.
There is one t ransm it t ing and one receiving RLC ent it y for each t ransparent m ode ( TM) and unacknow ledged
m ode ( UM) service. There is one com bined, t ransm it t ing and receiving ent it y for t he acknow ledged m ode ( AM)
service.
Each RLC UM and TM ent it y uses one logical channel t o send or receive dat a PDUs. An AM RLC ent it y can be
configured t o use one or t wo logical channels t o send or receive dat a and cont rol PDUs. I f t wo logical channels
are configured, t hey are of t he sam e t ype ( DCCH or DTCH) .
1 .1 2 .4 RLC D a t a PD Us
Figure 1 87 shows t he t hree different t ypes of RLC Dat a PDUs:
UMTS Signaling
Figure 1 88 - RLC Dat a PDUs.

Tr D PD U ( Transparent Mode Dat a PDU) .
The TMD PDU is used t o convey RLC SDU dat a w it hout adding any RLC overhead. RLC uses t he TMD PDU w hen
RLC is in t ransparent m ode.
UM D PD U ( Unacknowledged Mode Dat a PDU) .
The UMD PDU is used t o convey sequent ially num bered PDUs cont aining RLC SDU dat a. RLC uses UMD PDUs
when RLC is configured for unacknow ledged dat a t ransfer.
AM D PD U ( Acknowledged Mode Dat a PDU) .
The AMD PDU is used t o convey sequent ially num bered PDUs cont aining RLC SDU dat a. RLC uses AMD PDUs
when RLC is configured for ack nowledged dat a t ransfer.
1 .1 2 .5 Ot h e r RLC PD Us
Ot her RLC PDUs are:
RESET PDU - t o reset RLC prot ocol ent it ies and all t heir syst em variables
RESET ACK PDU - acknowledgem ent t o RESET PDU
Cont rol PDUs are only used in acknow ledged m ode.

STATUS PD U and Piggybacked STATUS PD U are used:
By t he Receiver t o inform t he Sender about m issing and receiv ed AMD PDUs in t he Receiver; select ive
and group acknowledgem ent is possible.
By t he Receiver t o inform t he Sender about t he size of t he allowed t ransm ission w indow.
By t he Sender t o request t hat t he Receiver m ove t he recept ion w indow.
By t he Receiver t o acknow ledge t o t he Sender t he receipt of t he request t o m ove t he recept ion w indow.
RESET PD U is used:
To reset all prot ocol st at es, prot ocol variables, and prot ocol t im ers of t he peer RLC ent it y in order t o
synchronize t he t wo peer ent it ies ( sent from Sender t o Receiver) .
UMTS Signaling
To increm ent t he Hyper Fram e Num ber ( Ciphering) .
RESET ACK PD U is an acknow ledgem ent of t he RESET PDU ( sent from Receiv er t o Sender) .
UMTS Signaling
1 .1 3 SERVI CE SPECI FI C CON N ECTI ON ORI EN TED PROTOCOL

( SSCOP)
The SSCOP ( I TU- T Q.2110) has been defined t o provide funct ions required in t he Signaling AAL ( SAAL) . The SAAL
is a com binat ion of t wo sublay ers: a com m on part and a serv ice- specific part . The serv ice- specific part is also
known as t he Serv ice Specific Convergence Sublay er ( SSCS) . I n t he SAAL, t he SSCS it self is funct ionally div ided
int o t he SSCOP and a Serv ice Specific Coordinat ion Funct ion ( SSCF) which m aps t he serv ices provided by t he
SSCOP t o t he needs of t he user of t he SAAL. This st ruct ure allows a com m on connect ion- orient ed prot ocol w it h
error recov ery ( t he SSCOP) t o provide a generic reliable dat a t ransfer serv ice for different AAL int erfaces defined
by t he SSCF. Two such SSCFs, one for signaling at t he User- Net work I nt erface ( UNI ) and one for signaling at t he
Net work- t o- Net work I nt erface ( NNI ) , have been defined. I t is also possible t o define addit ional SSCFs over t he
com m on SSCOP t o provide different AAL serv ices.
Se qu e n ce I n t e gr it y
Preserv es t he order of SSCOP SDUs t hat w ere subm it t ed for t ransfer by SSCOP.
Er r or Cor r e ct ion by Se le ct ive Re t r a n sm ission
Through a sequencing m echanism , t he receiving SSCOP ent it y can det ect m issing SSCOP SDUs. This funct ion
correct s sequence errors t hrough ret ransm ission.
Flow Con t r ol
Allows an SSCOP receiver t o cont rol t he rat e at which t he peer SSCOP
t ransm it t er ent it y m ay send inform at ion.
Er r or Re por t in g t o La ye r M a n a ge m e n t
I ndicat es t o t he lay er which m anagem ent errors have occurred.
Ke e p Alive
Verifies t hat t he t wo peer SSCOP ent it ies part icipat ing in a connect ion are rem aining in a link- connect ionest ablished st at e even in t he case of a prolonged absence of dat a t ransfer.
Loca l D a t a Re t r ie va l
Allows t he local SSCOP user t o ret rieve in- sequence SDUs t hat have not yet been released by t he SSCOP ent it y.
Con n e ct ion Con t r ol
Perform s t he est ablishm ent , release, and resynchronizat ion of an SSCOP connect ion. I t also allow s t he
t ransm ission of variable lengt h user- t o- user inform at ion w it hout a guarant ee of delivery .
Tr a n sfe r of Use r - D a t a
Conveys user dat a bet w een users of t he SSCOP. SSCOP support s bot h assured and unassured dat a t ransfer.
Pr ot ocol Er r or D e t e ct ion a n d Re cove r y
Det ect s and recovers from errors in t he operat ion of t he prot ocol.
St a t u s Re por t in g
Allows t he t ransm it t er and receiver peer ent it ies t o exchange st at us inform at ion.
1 .1 3 .1 Ex a m ple SSCOP
The exam ple shows t he set up, connect ion, and release phase of an SSCOP connect ion on t he I uPS.
UMTS Signaling
Figure 1 89 - SSCOP ( Message Flow) .
BGN ( Begin) and BGAK ( Begin Ack) represent t he connect ion set up.
During connect ion, dat a of higher layers w ill be t ransm it t ed w it h Sequenced Dat a PDUs, SD .
Every SD cont ains a sequence num ber, N( S) . Aft er t he int ernal t im eout of Tim er- POLL, an acknowledgem ent w ill
be request ed, POLL- PDU. The acknow ledgem ent is t hen t he STAT m essage cont aining a receive sequence
num ber, N( R) . I f t here are no SD m essages on t he link in t he m eant im e, t hen t he POLL- STAT procedure w ill also
run. The POLL- STAT procedure confirm s t hat t he SSCOP connect ion ( link int egrit y) is est ablished.
EN D and EN D AK represent t he disconnect procedure.
N.B. An SSCOP connect ion is a perm anent connect ion; it is not user dependent . The connect ion is set up for each
signaling link, for exam ple VPI / VCI for signaling inform at ion. All user signaling w ill be t ransferred via an SSCOP
connect ion.
UMTS Signaling
1 .1 4 SERVI CE SPECI FI C COORD I N ATI ON FUN CTI ON ( SSCF)

SSCF ( I TU- T Q.2140) is not a prot ocol but an int ernal coordinat ion funct ion, which does int ernal adapt at ion of
t he inform at ion com ing or going t o higher lay ers, for exam ple, MTP3- B rout ing inform at ion. SSCF provides t he
follow ing m apping funct ions:
Mapping of prim it ives from lay er 3 t o signals of t he SSCOP

Mapping of dest inat ion address ( SPC) t o SSCOP connect ion
Because of t his m odular concept , SSCOP can w ork w it h m any different higher layer prot ocols.
UMTS Signaling
1 .1 5 M ESSAGE TRAN SFER PART LEVEL 3 BROAD BAN D ( M TP3 - B)

M TP3 - B ( I TU.T Q.2210) fulfils t he sam e sort of work as t he st andard narrowband MTP; it provides ident ificat ion
and t ransport of higher lay er m essages ( PDUs) , rout ing, and load sharing.
The m ain address param et ers are Originat ing and Dest inat ion Point Code. Their unique value represent s t he
Signaling Point Code ( SPC) of a net work com ponent .
N e t w or k I n dica t or
I s used on Point s of I nt erconnect ion ( POI ) t o build v irt ual int erconnect ion net w orks on or bet w een nat ional and
int ernat ional net work lev el.
Se r vice I n dica t or
I dent ifies t he cont ent s of t he user dat a field ( for exam ple t he higher layer prot ocol)
Figure 1 90 - MTP3- B.
UMTS Signaling
1 .1 6 I N TERN ET PROTOCOL ( I P)
The I n t e r n e t Pr ot ocol ( RFC 791) , act ual version 4, I Pv4, connect ionless services bet ween net works and
includes feat ures for addressing, t ype- of- serv ice specificat ion, fragm ent at ion and reassem bly , and securit y.
I P t ransm it s dat a w it hout a connect ion and w it hout prot ect ion of t he dat a, such as ciphering, aut hent icat ion, flow
cont rol, or any ot her error correct ion m echanism .
The addressing is sym m et rical; t he source and dest inat ion addresses are always in t he header.
The dat a cont ained in an I P m essage can be 64 kilobyt es m axim um , whereas every I P node m ust be able t o
handle packet sizes of 576 byt es m inim um .
The next generat ion is I P version 6. The goal was t o im prove t hese negat ive feat ures of I Pv4.
The address range has been enhanced t o 128 bit . This version now includes prot ect ion m echanism s, including
ciphering and int egrit y check of dat a and address. I t also now support s real QoS.
I P version 4
o No error cont rol or correct ion
o No sequence or flow cont rol
o Fragm ent at ion and Reassem bly of dat a; Header m inim um of 20 byt es
o Address size: 32 bit s, source and dest inat ion included
I P version 6
o Qos param et er included and used
o Rem ot e configurat ion of I P users
o Aut hent icat ion and ciphering m echanism included
o Signat ure of address and cont ent s
o Fragm ent at ion and Reassem bly of dat a; Header m inim um of 40 byt es
o Address size: 128 bit s, source and dest inat ion included
1 .1 6 .1 I PV4 Fr a m e Ar ch it e ct u r e
Figure 1 91 - I Pv4 Fram e Archit ect ure
Fla gs and Fr a gm e n t Offse t will indicat e if t he dat a part cont ains a full m essage or j ust a segm ent of one. The
offset value w ill indicat e a m ult iple of 8 byt es.
Tim e - t o- Live is not a t im er but a hop- count er which has t o be decrem ent ed by every I P node. I f it reaches zero,
t he packet w ill be delet ed.
Pr ot ocol ident ifies t he next higher lay er prot ocol. Table 1. 7 gives som e exam ples.
Sou r ce a n d D est in a t ion Addr e ss cont ains t he 32- bit node address, for exam ple 192.168.1.17.
Opt ion s are opt ional and usually not included.
UMTS Signaling
1 .1 7 SI GN ALLI N G TRAN SPORT CON VERTER ( STC)

STC ( I TU- T Q.2150.1) is an int ernal funct ion, which has none of it s own m essages.
I t convert s prim it ives from low er and higher lay ers ( eit her MTP3 or MTP3B prim it iv es) and t heir param et ers fit t ing
t he requirem ent s of t he ot her. Ot her funct ions:
Prov ision of OPC, DPC and SI O value

UMTS: Service I ndicat or ( part of SI O) = 12 ( AAL2- L3)
I n UM TS t h e AAL2 La ye r 3 Sign a lin g ( AAL2 L3 ) pr ot ocol cou ld be on STC. To allow AAL2L3 t o set up user
connect ions in t he net work, it has t o send cert ain m essages t o t he part ner inst ances. The rout ing and select ion of
SPCs is t he responsibilit y of STC.
Table 1 7 Prot ocol Param et er Meaning.
UMTS Signaling
1 .1 8 SI GN ALLI N G CON N ECTI ON CON TROL PART ( SCCP)

SCCP ( I TU- T Q.711 - 716) Prov ides a serv ice for t ransfer of m essages bet ween any t wo signalling point s in t he
sam e or different net work and is used in t he sam e way as it is known from SS7 and GSM. I t can act as
connect ionless ( CL) or connect ion orient ed ( CO) t ransport prot ocol and prov ides t hese connect ion t ypes:
Connect ionless ( Class 0&1) and connect ion orient ed ( Class 2&3)
Class 0
Addressing purposes, DPC or Global Tit le
Class 2
o
o
o
Used on I uCS, I uPS and I ur int erface t o organize connect ionsClass 3

Planned t o be used on I ur int erface by som e sw it ch m anufact urers
SCCP user is called Sub- Syst em and ident ified by a subsyst em num ber ( SSN)
Class 3
o
o
Flow cont rol connect ion- orient ed class

( Probably) not used on I ur
The SCCP user is called Sub- Syst em and ident ified by a subsyst em num ber ( SSN) t hat has t he sam e funct ion as
prot ocol field described in t he I P prot ocol part ( 1.16) before. For inst ance on I u int erface RANAP is a SCCP
subsyst em . However, a subsyst em can be bot h, a higher layer prot ocol or a net work elem ent / funct ion.
Table 1. 8 gives and overview of SSN used in live net work environm ent s:
The differences bet ween connect ionless and connect ion orient ed dat a exchange are:
Con n e ct ion le ss
SCCP is responsible for t he end- t o- end addressing. SCCP creat es addresses by eit her giving t he DPC or a Global
Tit le ( GT) of t he endpoint . A Global Tit le has t o be t ranslat ed ( GTT- Global Tit le Translat ion) on t he way t o t he
dest inat ion. On t he last link t o t he dest inat ion point , t he GT w ill be replaced w it h a DPC.
Table 1 8 - SSN Overview.
Con n e ct ion or ie n t e d
SCCP is responsible for t he user connect ion running on one int erface. I t is not cont rolling an end- t o- end
connect ion. The connect ion is ident ified by a Source and a Dest inat ion Local Reference Num ber ( SLR, DLR) .
To ident ify t he t ransport ed higher prot ocol, SCCP uses a subsyst em num ber ( SSN) .
1 .1 8 .1 Ex a m ple SCCP
Con n e ct ion or ie n t e d e x a m ple
Connect ion Request ( CR) and Connect ion Confirm ( CC) represent t he set - up phase. I n t he set - up phase, t he t wo
sides exchange t he local reference num bers. A negat ive response would be t he Connect ion Refused ( CREF)
UMTS Signaling
m essage which would cont ain a cause, explaining t he problem .

Som e procedures use t he CREF m essage as a fast m et hod t o release t he procedure, for exam ple, if all necessary
inform at ion has been send already in t he CC.
Figure 1 92 - SCCP CO ( Message Flow) .
During t he connect ion Dat a Form 1 ( D T1 ) m essage w ill t ransport higher layer m essages.
To release t he SCCP connect ion, a Released ( RLSD ) and a Release Com plet e ( RLC) m essage w ill be exchanged.
Every m ain user procedure has it s own SCCP connect ion on t he I u int erfaces.
UMTS Signaling
1 .1 9 ABSTRACT SYN TAX N OTATI ON ON E I N UM TS ( ASN .1 )

The prot ocols RANAP, RNSAP, NBAP, RRC ( Basic- PER, oct et aligned) , MAP, and CAP ( BER) are specified by using
ASN.1 ( I SO/ I EC 8824- 1) , a prot ocol descript ion language.
ASN.1 prov ides t hese funct ions:
Aut om at ic generat ion of net work com ponent prot ocol soft ware
Fast access of inform at ion by receiv ing ent it y
Com pact form of inform at ion t ransm ission by using special encoding rules
o Basic Encoding Rules ( BER; I SO/ I EC 8825 and 8825- 1) : used for MAP and CAP, easy- t o- read
raw dat a cont ent s, m essages are quit e large,
Dat a clearly st ruct ured, big m essages
o Packed Encoding Rules ( PER; I SO/ I EC 8825- 2) : used for t he ot her nam ed prot ocols ( running
w it hin UTRAN) , very com pact raw dat a cont ent s, and m essages get s sm all
Dat a st ruct ure is known by sender and receiver ? om it s ext ra dat a- specific
inform at ion, com pact and sm aller m essage
1 .1 9 .1 ASN .1 Ba sic En codin g Ru le s ( BER)

Every prot ocol elem ent is represent ed by an ident ifying TAG, a lengt h field, and a cont ent s field.
I n case of prim it ive cont ent s form , t he cont ent s field consist s of one value.
I n case of const ruct or cont ent s form s, t he cont ent field consist s of one or m ore ot her Tag- Lengt h- Cont ent s
const ruct ions. I n t his case, t he first byt e of t he cont ent s field is a Tag.
BER ASN.1 is used by MAP and CAP in t he core net work.
Figure 1 93 - ASN.1 - BER.
UMTS Signaling
1 .1 9 .2 ASN .1 Pa ck e d Encoding Rule s ( PER)

The packed encoding rules have t he goal t o t ransm it as lit t le dat a as possible.
That is why a pream ble ( sim ilar t o a t ag field) and t he lengt h field can be m issing. Sender and receiver have t o
use t he sam e prot ocol v ersions; ot herw ise t he receiv er w ill not underst and t he cont ent s of a received m essage.
There are t wo alt ernat iv e PER: oct et aligned and not oct et aligned.
I n UMTS t he oct et aligned version will be used, w it h t he except ion of t he RRC, which uses unaligned. That m eans
t hat even if a field requires j ust one bit ( see t he num ber in t he exam ple below ) , t he field would be of size one
byt e, seven bit s filled w it h zeros ( x) .
PER ASN.1 is used by NBAP, RNSAP, RRC and RANAP in t he UTRAN.
Figure 1 94 - ASN.1 - PER.
UMTS Signaling
1 .2 0 RAD I O RESOURCE CON TROL ( RRC)

The RRC ( 3GPP 25.331) prot ocol is t he m ost com plex one in UMTS. I t reflect s t he t asks of t he Radio Net work
Cont roller ( RNC) .
RRC is a sublay er of Layer 3 on UMTS radio int erface and ex ist s in t he cont rol plane only. I t provides inform at ion
t ransfer service t o t he NAS ( Non Access St rat um ) and is responsible for cont rolling t he configurat ion of UMTS
radio int erface Layers 1 and 2.
Because RNC is a net work node bet ween UE and CN, RRC m ust be able t o t ransport NAS m essage across t he
UTRAN.
The Radio Bearer cont rol funct ion is also im plem ent ed in RRC. This funct ion is perform ed by a special RRC
signaling procedure but also int ernally by cont rolling bot h t he lower layers and t he user plane prot ocols v ia t he
RRC cont rol SAP.
Figure 1 95 - RRC Archit ect ure
The m anagem ent of an UE during a RRC connect ion is cont rolled by RNC using t he RRC prot ocol as well.
Main Funct ions and serv ices of RRC are:
Rout ing of higher lay er m essages t o different Mobilit y Managem ent / Call Managem ent ( MM/ CM) ent it ies
on UE side or t o different core net work dom ains
Creat ion and m anagem ent of Radio Bearers
Broadcast ing of syst em inform at ion
Paging of UEs
Dedicat ed Cont rol handles all funct ions specific t o one UE
o Locat ion Managem ent
o Handover
SMS Rout ing
Power Managem ent ( out er loop power cont rol)
Configurat ion of low er layer prot ocols
Set up of RRC m easurem ent set t ings
Managem ent of m easurem ent report s
UMTS Signaling
1 .2 0 .1 RRC St a t e s
To underst and som e of t he signaling procedures lat er in t his book, for exam ple cases of physical channel
reconfigurat ion ( channel t ype sw it ching) , it is necessary t o hav e a closer look at t he RRC st at e m achine ( Figure
1.95) . The RRC st at e m achine ( Figure 1.96) provides furt her det ails..
Figure 1 96 Overview of Different RRC St at es.
Aft er pow er on, t he UE st ays in I dle Mode ( RRC I dle) unt il it t ransm it s a request t o est ablish an RRC Connect ion.
I n I dle Mode t he connect ion of t he UE is closed on all layers of t he access st rat um . I n I dle Mode t he UE is
ident ified by nonaccess st rat um ident it ies such as I MSI , TMSI , and P- TMSI . I n addit ion, t he UTRAN has no
inform at ion about t he indiv idual I dle Mode UEs, and it can only address all UEs in a cell or all UEs m onit oring a
paging occasion.
The UTRAN Connect ed Mode is ent ered when t he RRC Connect ion is est ablished. The UE is assigned a radio
net work t em porary ident it y ( RNTI ) t o be used as UE ident it y on com m on t ransport channels.
The RRC st at es w it hin t he UTRAN Connect ed Mode reflect t he level of t he UE connect ion and which t ransport
channels can be used by t he UE.
For inact iv e st at ionary dat a users, t he UE m ay fall back t o PCH on bot h t he Cell and URA levels. Upon t he need
for paging, t he UTRAN w ill check t he current level of connect ion of t he given UE, and w ill decide whet her t he
paging m essage should be sent w it hin t he URA or via a specific cell.
The RRC_ I dle st at e is charact erized by:
UE is unknown in UTRAN, no RNTI s have been assigned; TMSI or P- TMSI m ight be allocat ed if UE was
regist ered t o t he net work in prev iously
UE m onit ors Downlink PI CH/ PCH ( Paging m ust be det ect ed t o change int o RRC connect ed m ode)
I f UE is m ov ing, it w ill perform Rout ing and Locat ion Area Updat e Procedures
Cell Reselect ion w ill be perform ed depending on t he radio condit ions but no Cell Updat es nor URA
Updat es w ill happen
DCCHs or DPCHs do not exist
UE sends RRC_CONN_REQ on RACH t o change int o RRC- Connect ed Mode
UMTS Signaling
Figure 1 97 - RRC St at e Overview.
N ot e : Not all st at es m ay be applicable for all UE connect ions. For a given QoS requirem ent on t he UE connect ion,
only a subset of t he st at es m ay be relevant .
The t ransit ion t o t he UTRAN Connect ed Mode from t he I dle Mode can only be init iat ed by t he UE by t ransm it t ing a
request for an RRC Connect ion. The event is t riggered eit her by a paging request from t he net work or by a
request from upper layers in t he UE.
When t he UE receives a m essage from t he net work t hat confirm s t he RRC connect ion est ablishm ent , t he UE
ent ers t he CELL_FACH or CELL_ DCH st at e of UTRAN Connect ed Mode.
I n t he case of a failure, t o est ablish t he RRC Connect ion, t he UE goes back t o I dle Mode. Possible causes are
radio link failure, a receiv ed rej ect response from t he net work or lack of response from t he net work ( t im eout ) .
Con n e ct e d M ode St a t e s
Figure 1 98 - UTRAN - Connect ed Mode St at es.

The CELL_ D CH st at e is charact erized by t he follow ing:
A dedicat ed physical channel is allocat ed t o t he UE in uplink and downlink.

Com m on/ Shared channels m ight be configured.
The UE is know n on cell level according t o it s current act ive set .
UMTS Signaling
Soft and Hard Handover m ight be init iat ed.

No Cell Updat e nor URA Updat e is init iat ed by t he UE.
The UE sends Measurem ent Report s t o RNC according t o t he RNC set up.
The UE can use dedicat ed t ransport channels ( DCH) , downlink and uplink ( TDD) shared t ransport
channels ( TCH) and a com binat ion of t hese t ransport channels.
The CELL_ D CH st at e is ent ered from t he I dle Mode t hrough t he set up of an RRC connect ion, or by est ablishing a
dedicat ed physical channel from t he CELL_FACH st at e.
A PDSCH m ay be assigned t o t he UE in t his st at e, t o be used for a DSCH. I n TDD a PUSCH m ay also be assigned
t o t he UE in t his st at e, t o be used for a USCH. I f PDSCH or PUSCH are used for TDD, a FACH t ransport channel
m ay be assigned t o t he UE for recept ion of phy sical shared channel allocat ion m essages.
The CELL_ FACH st at e is charact erized by:
No dedicat ed physical channel is allocat ed t o t he UE.

The UE cont inuously m onit ors a FACH in downlink.
The UE is assigned a default com m on or shared t ransport channel in t he uplink ( e.g. RACH or CPCH)
t hat it can use anyt im e according t o t he access procedure for t hat t ransport channel.
No Soft or Hard Handover m ight be init iat ed.
UTRAN knows t he posit ion of t he UE on t he cell lev el according t o t he cell where t he UE last m ade a cell
updat e.
The UE perform s Cell Updat es, but no URA updat es.
I n TDD m ode, one or sev eral USCH or DSCH t ransport channels m ay have been est ablished.
I n t he CELL_ FACH sub st at e, t he UE perform s t he following act ions:
List ens t o all FACHs in t he cell

List ens t o t he BCH t ransport channel of t he serving cell for t he decoding of syst em inform at ion
m essages
I nit iat es a cell updat e procedure on cell change of anot her UTRA cell
Uses C- RNTI assigned in t he current cell as t he UE ident it y on com m on t ransport channels ex cept for
when a new cell is select ed
Transm it s uplink cont rol signals and sm all dat a packet s on t he RACH
I n FDD m ode, t ransm it s uplink cont rol signals and larger dat a packet s on CPCH when resources are
allocat ed t o t he cell and UE is assigned use of t hose CPCH resources
I n TDD m ode, t ransm it s signaling m essages or user dat a in t he uplink and/ or t he downlink using USCH
and/ or DSCH w hen resources are allocat ed t o t he cell and t he UE is assigned use of t hose USCH/ DSCH
resources
I n TDD m ode, t ransm it s m easurem ent report s in t he uplink using USCH when resources are allocat ed t o
it in order t o t rigger a handover procedure in t he UTRAN
The CELL_ PCH st at e is charact erized by:
No dedicat ed physical channel is allocat ed t o t he UE

UE select s a PCH wit h t he algorit hm and uses DRX for m onit oring t he select ed PCH v ia an associat ed
PI CH
DCCHs/ DTCHs are configured but cannot be used
No Soft or Hard Handover m ight be init iat ed.
No uplink act iv it y is possible ( st at e change t o Cell_FACH is needed)
The UE perform s Cell Updat es, but no URA updat es.
Posit ion of t he UE is known by UTRAN on t he cell level according t o t he cell w here t he UE last m ade a
cell updat e in t he CELL_FACH st at e
The UE sends Measurem ent Report s t o RNC according t o t he RNC set up.
I n t he CELL_ PCH st at e t he UE perform s t he follow ing act ions:
Monit or t he paging occasions according t o t he DRX cycle and receive paging inform at ion on t he PCH
m essages
UMTS Signaling
I nit iat es a cell updat e procedure on cell change
The DCCH logical channel cannot be used in t his st at e. I f t he net work want s t o init iat e any act ivit y, it needs t o
m ake a paging request on t he PCCH logical channel in t he known cell t o init iat e any downlink act iv it y .
The URA_ PCH st at e is charact erized by:
No dedicat ed channel is allocat ed t o t he UE

UE select s a PCH wit h an algorit hm and uses DRX for m onit oring t he select ed PCH v ia an associat ed
PI CH
UE m onit ors Downlink PI CH/ PCH ( Paging m ust be det ect ed t o change int o RRC connect ed m ode)
No uplink act ivit y is possible
DCCHs/ DTCHs are configured but cannot be used
No uplink act iv it y is possible ( st at e change t o Cell_FACH is needed)
Locat ion of t he UE is known on t he UTRAN Regist rat ion area level according t o t he URA assigned t o t he
UE during t he last URA updat e in CELL_FACH st at e
I n t he URA_ PCH st at e t he UE perform s t he follow ing act ions:
Monit ors t he paging occasions according t o t he DRX cycle and receive paging inform at ion on t he PCH
m essages
I nit iat es a URA updat ing procedure on URA change
The DCCH logical channel cannot be used in t his st at e. I f t he net work want s t o init iat e any act ivit y, it needs t o
m ake a paging request on t he PCCH logical channel w it hin t he URA where t he locat ion of t he UE is known. I f t he
UE needs t o t ransm it anyt hing t o t he net work, it goes t o t he CELL_FACH st at e. The t ransit ion t o URA_PCH St at e
can be cont rolled wit h an inact ivit y t im er, and, opt ionally, w it h a count er, which count s t he num ber of cell
updat es. When t he num ber of cell updat es has exceeded cert ain lim it s ( a net w ork param et er) , t hen t he UE
changes t o t he URA_PCH St at e.
URA updat ing is init iat ed by t he UE, which, upon t he det ect ion of t he Regist rat ion area, sends t he net work t he
Regist rat ion area updat e inform at ion on t he RACH of t he new cell.
N ot e : A UE support ing Cell Broadcast Service ( CBS) should be capable t o receive BMC m essages in t he
CELL_PCH or URA_PCH RRC st at e. I f PCH and t he FACH carrying CTCH are not m apped ont o t he sam e SCCPCH,
UEs wit h basic service capabilit ies m ay not be able t o m onit or Cell Broadcast m essages cont inuously in CELL_PCH
st at e. I n t his case, UEs wit h basic service capabilit ies are capable t o change from t he SCCPCH t hat carries t he
PCH select ed for paging t o anot her SCCPCH which carries Cell Broadcast m essages ( for exam ple t he CT CH
m apped t o an FACH) and receiv e BMC m essages during t im e int ervals which do not conflict w it h t he UE specific
paging occasions.
1 .2 0 .2 Syst e m in for m a t ion block s ( SI B)

The syst em inform at ion elem ent s are broadcast in syst e m in for m a t ion block s ( SI B) t hat can be m onit ored,
for exam ple in Syst em I nform at ion Updat e m essages during Node B set up/ rest art . A syst em inform at ion block
groups t oget her syst em inform at ion elem ent s of t he sam e nat ure. Different syst em inform at ion blocks m ay hav e
different charact erist ics, for exam ple, regarding t heir repet it ion rat e and t he requirem ent s on UEs t o re- read t he
syst em inform at ion blocks.
The syst em inform at ion is organized as a t ree. A m a st e r in for m a t ion block ( M I B) gives references t o a
num ber of syst em inform at ion blocks in a cell, including scheduling inform at ion for t hose syst em inform at ion
blocks. The syst em inform at ion blocks cont ain t he act ual syst em inform at ion and opt ionally references t o ot her
syst em inform at ion blocks including scheduling inform at ion for t hose syst em inform at ion block s. The referenced
syst em inform at ion blocks m ust have t he sam e area scope and use t he sam e updat e m echanism as t he parent
syst em inform at ion block.
Som e syst em inform at ion block s m ay occur m ore t han once w it h different cont ent . I n t his case, scheduling
inform at ion is provided for each occurrence of t he syst em inform at ion block . This opt ion is only allowed for
syst em inform at ion block t ype 16.
All SI Bs, except SI B 15.2, 15.3, and 16, use a random I D called a Va lu e Ta g. As long as t he value t ag cont ains
t he sam e value, t he cont ent s of t he SI Bs are unchanged. That m eans t hat a UE receives SI B and st ores t he value
UMTS Signaling
t ag. The next occurrence of t hat SI B and UE w ill com pare value t ags. I f t he value is equal t o t he st ored value,
t hen t he cont ent s of t he SI B can be discarded. I f t he value is different , t hen UE w ill read t he SI B cont ent s and
st ore t he new value t ag.
Figure 1 99 - SI B Overview.
UMTS Signaling
Table 1 9 - SI B Cont ent .
SI B 15.2, 15.3, and 16 cont ain a value t ag, t oo, but t heir cont ent s m ust always be read.
Depending on SI B, t he cont ent s and t he value t ag is valid w it hin a cell or w it hin UTRAN.
SI B Con t e n t
N ot e : Due t o t he fact t hat SI Bs are defined in RRC, but t ransm it t ed in NBAP special decoders needed t o m onit or
SI Bs wit h a prot ocol t est er, t hat has t o cope wit h t he fact t hat one prot ocol is oct et - aligned encoded, t he ot her
prot ocol not .
Ex a m ple - Br oa dca st Syst e m I nfor m a t ion
The syst e m in for m a t ion is cont inuously repeat ed on a regular basis in accordance w it h t he scheduling defined
for each syst em inform at ion block.
The UE reads SYSTEM I NFORMATI ON m essages broadcast on a BCH t ransport channel in idle m ode as well as in
st at es CELL_FACH, CELL_PCH, URA_PCH, and CELL_DCH ( TDD only) . Furt her, t he UE reads SYSTEM
I NFORMATI ON m essages broadcast on a FACH t ransport channel when in t he CELL_FACH st at e. I n addit ion, UEs
t hat support sim ult aneous recept ion of one SCCPCH and one DPCH read syst em inform at ion on an FACH
t ransport channel when in t he CELL_DCH st at e.
UMTS Signaling
I dle m ode and connect ed m ode UEs m ay acquire different com binat ions of syst em inform at ion blocks. Before
each acquisit ion, t he UE should ident ify w hich syst em inform at ion blocks are needed.
Figure 1 100 - Broadcast Syst em I nform at ion ( Message Flow)
The UE m ay st ore syst em inform at ion blocks ( including t heir value t ag) for different cells and different PLMNs, t o
be used if t he UE ret urns t o t hese cells. The UE considers t he syst em inform at ion blocks valid for a period of 6
hours from recept ion. Moreover, t he UE considers all st ored syst em inform at ion blocks as invalid aft er t he UE has
been sw it ched off.
When select ing a new cell w it hin t he current ly used PLMN, t he UE considers all current syst em inform at ion blocks
w it h area scope cell t o be invalid. I f t he UE has st ored valid syst em inform at ion blocks for t he new ly select ed cell,
t he UE m ay set t hose as current syst em inform at ion blocks.
Aft er select ing a new PLMN, t he UE considers all current syst em inform at ion blocks t o be invalid. I f t he UE has
prev iously st ored valid sy st em inform at ion blocks for t he select ed cell of t he new PLMN, t he UE m ay set t hose as
current syst em inform at ion blocks. Upon select ion of a new PLMN, t he UE st ores all inform at ion elem ent s
specified w it hin t he variable SELECTED_PLMN for t he new PLMN w it hin t his variable.
For m odifica t ion of som e syst e m in for m a t ion elem ent s ( for exam ple, reconfigurat ion of t he channels) , it is
im port ant for t he UE t o know exact ly when a change occurs. I n such cases, t he UTRAN should perform t he
follow ing act ions t o indicat e t he change t o t he UEs:
Send t he PAGI N G TYPE 1 m essage on t he PCCH in order t o reach idle m ode UEs as well as connect ed m ode UEs
in st at e CELL_PCH and URA_PCH. I n t he I E " BCCH Modificat ion I nform at ion" , UTRAN indicat es t he SFN when t he
change w ill occur and t he new value t ag t hat w ill apply for t he m ast er inform at ion block aft er t he change has
occurred. The PAGI NG TYPE 1 m essage is sent in all paging occasions.
Send t he m essage SYSTEM I N FORM ATI ON CH AN GE I N D I CATI ON on t he BCCH m apped on FACH on all
FACHs in order t o reach all UEs in st at e CELL_FACH. I n t he I E " BCCH Modificat ion I nform at ion" , UTRAN indicat es
t he SFN when t he change w ill occur and t he new value t ag t hat w ill apply for t he m ast er inform at ion block aft er
t he change has occurred. UTRAN m ay repeat t he SYSTEM I NFORMATI ON CHANGE I NDI CATI ON on all FACHs t o
increase t he probabilit y of proper recept ion in all UEs needing t he inform at ion.
Ex a m ple RRC Con n e ct ion Est a blish m e n t
UMTS Signaling
Figure 1 101 - RRC Connect ion Est ablishm ent ( Message Flow) .
The nonaccess st rat um in t he UE m ay request t he est ablishm ent of only one RRC connect ion.
Upon in it ia t ion of t h e pr oce du r e , t he UE w ill:
Set Connect ion Fram e Num ber ( CFN) in relat ion t o Syst em Fram e Num ber ( SFN) of current cell
according t o 8.5.17
Transm it an RRC CONNECTI ON REQUEST m essage on t he uplink CCCH, reset count er V300, and st art
t im er T300
Perform t he m apping of t he Access Class t o an Access Service Class and apply t he given Access Service
Class when accessing t he RACH
Set t he I E " Est ablishm ent cause" reflect ing t he cause of est ablishm ent in t he upper layers
Set t he I E " I nit ial UE ident it y" t o I MSI or TMSI
I nclude a m easurem ent report , as specified in t he I E " I nt rafrequency report ing quant it y for RACH
report ing" and t he I E " Maxim um num ber of report ed cells on RACH" in syst em inform at ion block t ype 11
Upon r e ce iving a n RRC CON N ECTI ON REQUEST m e ssa ge , UTRAN w ill do one of t he follow ing:
Transm it an RRC CONNECTI ON SETUP m essage on t he downlink CCCH.

Transm it an RRC CON N ECTI ON REJECT m essage on t he downlink CCCH. I n t he RRC CONNECTI ON
REJECT m essage, t he UTRAN m ay direct t he UE t o anot her UTRA carrier or t o anot her syst em . Aft er t he
RRC CONNECTI ON REJECT m essage has been sent , all cont ext inform at ion for t he UE m ay be delet ed in
UTRA.
Upon r e ce iving a n RRC CON N ECTI ON SETUP m e ssa ge, t he UE com pares t he value of t he I E " I nit ial UE
ident it y" in t he received RRC CONNECTI ON SETUP m essage w it h t he value of t he I E " I nit ial UE ident it y " in t he
m ost recent RRC CONNECTI ON REQUEST m essage sent by t he UE.
I f t he values are different , t he UE w ill:
I gnore t he rest of t he m essage
I f t he values are ident ical, t he UE w ill:
St op t im er T300, and act upon all receiv ed inform at ion elem ent s;
St ore t he value of t he I E " New U- RNTI "
I nit iat e t he signaling link param et ers according t o t he I E " RB m apping info" ;
I f neit her t he I E " PRACH info ( for RACH) " , nor t he I E " Uplink DPCH info" is included, let t he physical
channel of t ype PRACH t hat is given in t he syst em inform at ion be t he default in uplink t o which t he
RACH is m apped
UMTS Signaling
I f neit her t he I E " Secondary CCPCH info" , nor t he I E " Downlink DPCH info" is included, st art t o receiv e
t he physical channel of t ype Secondary CCPCH t hat is given in syst em inform at ion t o be used as t he
default by FACH
Transm it an RRC CONNECTI ON SETUP COMPLETE m essage on t he uplink DCCH aft er successful st at e
t ransit ion, w it h t he cont ent s set as specified below:
o I nclude START [ 3GPP 33.102] values t o be used in ciphering and int egrit y prot ect ion for each
CN dom ain
o I f request ed in t he I E " Capabilit y updat e requirem ent " sent in t he RRC CONNECTI ON SETUP
m essage, include it s UTRAN- specific capabilit ies in t he I E " UE radio access capabilit y"
o I f request ed in t he I E " Capabilit y updat e requirem ent " sent in t he RRC CONNECTI ON SETUP
m essage, include it s int ersyst em capabilit ies in t he I E " UE syst em specific capabilit y"
Ex a m ple RRC Con n e ct ion Re le a se
Figure 1 102 - RRC Connect ion Release ( Message Flow) .

The purpose of t he exam ple in t his procedure is t o release t he RRC connect ion including t he signaling link and all
radio bearers bet ween t he UE and t he UTRAN. By doing so, all est ablished signaling flows and signaling
connect ions w ill be released.
When t he UE is in t he st at e CELL_DCH or CELL_FACH, t he UTRAN m ay at anyt im e init iat e an RRC connect ion
release by t ransm it t ing an RRC CONNECTI ON RELEASE m essage using UM RLC. When UTRAN t ransm it s an RRC
CONNECTI ON RELEASE m essage as response t o a receiv ed RRC CONNECTI ON RE- ESTABLI SHMENT REQUEST,
CELL UPDATE or URA UPDATE m essage from t he UE, UTRAN w ill use t he dow nlink CCCH t o t ransm it t he m essage.
I n all ot her cases, t he downlink DCCH w ill be used, alt hough t he downlink CCCH m ay be used as well.
UTRAN m ay t ransm it several RRC CONNECTI ON RELEASE m essages t o increase t he probabilit y of proper
recept ion of t he m essage by t he UE. The num ber of repeat ed m essages and t he int erval bet w een t he m essages is
a net work opt ion.
The UE w ill r e ce ive a n d a ct on a n RRC CON N ECTI ON RELEASE m essage in st at es CELL_DCH and CELL_FACH.
Furt herm ore t his procedure can int errupt any ongoing procedures w it h t he UE in t he above list ed st at es.
When t he UE receives t he first RRC CONNECTI ON RELEASE m essage, it w ill:
I n st at e CELL_DCH:
o I nit ialize t he count er T308 w it h t he value of t he I E " Num ber of RRC Message Transm issions" ,
which indicat es t he num ber of t im es t he RRC CONNECTI ON RELEASE COMPLETE m essage is
sent ;
o Transm it an RRC CONNECTI ON RELEASE COMPLETE m essage using UM RLC on t he DCCH t o
t he UTRAN;
o St art t im er T308.
I n st at e CELL_FACH and if t he RRC CONNECTI ON RELEASE m essage was received on t he DCCH
o Transm it an RRC CONNECTI ON RELEASE COMPLETE m essage using AM RLC on t he DCCH t o
t he UTRAN.
When in st at e CELL_FACH and if t he RRC CONNECTI ON RELEASE m essage was received on t he CCCH, t he UE w ill
not t ransm it an RRC CONNECTI ON RELEASE COMPLETE m essage.
UMTS Signaling
The UE w ill ignore any succeeding RRC CONNECTI ON RELEASE m essages t hat it receiv es. The UE w ill indicat e
release of all current signaling flow s and radio access bearers t o t he nonaccess st rat um and pass t he value of
t he I E " Release cause" received in t he RRC CONNECTI ON RELEASE m essage t o t he nonaccess st rat um .
From t he t im e of t he indicat ion of release t o t he nonaccess st rat um unt il t he UE has ent ered idle m ode, any nonaccess st rat um request t o est ablish a new RRC connect ion w ill be queued. This new request m ay be processed
only aft er t he UE has ent ered idle m ode.
When in st at e CELL_FACH, and if t he RRC CONNECTI ON RELEASE m essage w as received on t he CCCH, t he UE
w ill release all it s radio resources, ent er idle m ode, and end t he procedure on t he UE side.
Ex a m ple RRC Signa lin g Conne ct ion
Figure 1 103 - RRC Signaling Connect ion ( Message Flow) .
The in it ia l dir e ct t r a n sfe r procedure is used in t he uplink t o est ablish signaling connect ions and signaling flows.
I t is also used t o carry t he init ial higher layer ( NAS) m essages over t he radio int erface.
A signaling connect ion com prises one or several signaling flow s. This procedure request s t he est ablishm ent of a
new flow, and t riggers, depending on t he rout ing and if no signaling connect ion exist s for t he chosen rout e for
t he flow , t he est ablishm ent of a signaling connect ion.
Th e dow n lin k dir e ct t r a n sfe r procedure is used in t he dow nlink direct ion t o carry higher layer ( NAS) m essages
over t he radio int erface.
The u plin k dir e ct t r a n sfe r procedure is used in t he uplink direct ion t o carry all subsequent higher layer ( NAS)
m essages over t he radio int erface belonging t o a signaling flow.
The sign a lin g con n e ct ion r e le a se request procedure is used by t he UE t o request from t he UTRAN t hat one of
it s signaling connect ions should be released. The procedure m ay, in t urn, init iat e t he signaling flow release or
RRC connect ion release procedure.
UMTS Signaling
1 .2 1 N OD E B APPLI CATI ON PART N BAP

NBAP ( 3GPP 25.433) is t he com m unicat ion prot ocol used on t he I ub int erface, bet ween RNC and Node B, and is
specified using ASN.1 Packet Encoding Rules ( PER) .
1 .2 1 .1 N BAP fu n ct ion s
NBAP covers a large range of different funct ions as described in t he overview below:
Table 1 10 NBAP Funct ion Overview.
1 .2 1 .2 N BAP Ele m e n t a r y Pr oce du r e s ( EPs)

The NBAP prot ocol is used bet w een RNC and Node B t o configure and m anage t he Node B and set up channels on
I ub and Uu int erfaces. I t consist s of Elem ent ary Procedures ( EPs) . An Elem ent ary Procedure is a unit of
UMTS Signaling
int eract ion bet w een t he CRNC and t he Node B; t he NBAP I nit iat ing Message is t ransport ing t he procedure request .
The elem ent ary procedure is ident ified by t he param et er Procedure I dent ificat ion Code. The CRNC
Com m unicat ion Cont ext cont ains all info for t he CRNC t o com m unicat e w it h a specific UE.
The Cont ex t is ident ified by t he param et er CRNC Com m unicat ion Cont ext I dent ifier.
An EP consist s of an init iat ing m essage and possibly a response m essage.
Two kinds of EPs are used:
Class 1: Elem ent ary Procedures w it h response ( success or failure)

Class 2: Elem ent ary Procedures w it hout response
For Cla ss 1 EPs, t he t ypes of responses can be as follows:

Su cce ssfu l ( Successful Out com e Message)
A signaling m essage explicit ly indicat es t hat t he elem ent ary procedure has been successfully com plet ed
w it h t he receipt of t he response
Un su cce ssfu l ( Unsuccessful Out com e Message)

A signaling m essage explicit ly indicat es t hat t he EP failed
Cla ss 2 EPs are considered alw ays successful.
1 .2 1 .3 Ex a m ple - N BAP
Figure 1 104 - NBAP ( Message Flow) .

The exam ple above shows t he Radio Link Set up procedure, class 1, bot h successful and unsuccessful.
UMTS Signaling
1 .2 2 RAD I O N ETW ORK SUBSYSTEM APPLI CATI ON PART ( RN SAP)

RNSAP ( 3GPP 25.423) is t he com m unicat ion prot ocol used on t he I ur int erface bet ween RNCs and is specified
using ASN.1 Packet Encoding Rules ( PER) .
1 .2 2 .1 RN SAP Fun ct ion s

The RNSAP prot ocol cov ers different funct ions as described in t he overview below:
Table 1 11 RNSAP Funct ion Overview.
RNSAP cont ains t wo classes of elem ent ary procedures. The handling is t he sam e as w it h NBAP.
The I ur int erface RNSAP procedures are divided int o four m odules:
1.
2.
3.
4.
RN SAP Ba sic M obilit y Pr oce du r e s

Cont ain procedures used t o handle t he m obilit y w it hin UTRAN.
RN SAP D CH Proce du r e s
Cont ain procedures t hat are used t o handle DCHs, DSCHs, and USCHs bet ween t wo RNSs. I f procedures
from t his m odule are not used in a specific I ur, t hen t he usage of DCH, DSCH, and USCH t raffic bet ween
corresponding RNSs is not possible
RN SAP Com m on Tr a n spor t Ch a n n e l Pr oce du r e s
Cont ain procedures t hat are used t o cont rol com m on t ransport channel dat a st ream s ( excluding t he
DSCH and USCH) over I ur int erface.
RN SAP Globa l Pr oce du r e s
Cont ain procedures t hat are not relat ed t o a specific UE. The procedures in t his m odule are in cont rast
t o t he above m odules involving t wo peer CRNCs.
UMTS Signaling
1 .2 2 .2 Ex a m ple RN SAP Pr oce du re s
Figure 1 105 - RNSAP Procedure Exam ple 1
The first exam ple shows t he t ransport of L3 inform at ion on t he I ur int erface, using class 2 elem ent ary procedures.
Figure 1 106 - RNSAP Procedure Exam ple 2 & 3.
The exam ple 2 shows t he Paging procedure, class 2; exam ple 3 shows a successful Radio Link Set up procedure,
using class 1.
UMTS Signaling
1 .2 3 RAD I O ACCESS N ETW ORK APPLI CATI ON PART ( RAN AP)

RANAP ( 3GPP 25.413) prov ides t he signaling serv ice bet w een UTRAN and CN t hat is required t o fulfill t he RANAP
funct ions. RANAP services are divided int o t hree groups based on Service Access Point s ( SAP) :
1.
2.
3.
Ge n e r a l con t r ol se r vice s: They are relat ed t o t he whole I u int erface inst ance bet w een t he RNC and
t he logical CN dom ain, and are accessed in CN t hrough t he General Cont rol SAP. They ut ilize
connect ionless signaling t ransport provided by t he I u signaling bearer.
N ot ifica t ion ser vice s: They are relat ed t o specified UEs or all UEs in a specified area, and are
accessed in CN t hrough t he Not ificat ion SAP. They ut ilize connect ionless signaling t ransport provided by
t he I u signaling bearer.
D e dica t e d cont r ol se r vice s: They are relat ed t o one UE, and are accessed in CN t hrough t he
Dedicat ed Cont rol SAP. RANAP funct ions t hat provide t hese services are associat ed w it h I u signaling
connect ion t hat is m aint ained for t he UE in quest ion. The I u signaling bearer provides connect ion
orient ed signaling t ransport t o realize t he I u signaling connect ion.
RANAP prot ocol has t he follow ing funct ions:

The RNSAP prot ocol cov ers different funct ions as described in t he overview below:
1 .2 3 .1 RAN AP Ele m e n t a r y Pr oce du r e s ( EPs)

The RANAP prot ocol consist s of Elem ent ary Procedures ( EPs) . An Elem ent ary Procedure is a unit of int eract ion
bet ween t he RNS and t he CN; RANAP I nit iat ing Message is t ransport ing t he procedure request .
The Elem ent ary Procedures are defined separat ely and are int ended t o be used t o build up com plet e sequences in
a flex ible m anner. I f t he independence bet ween som e EPs is rest rict ed, it is described under t he relevant EP
descript ion.
Unless ot herw ise st at ed by t he rest rict ions, t he EPs m ay be invoked independent ly of each ot her as st and alone
procedures, which can be act ive in parallel.
An EP consist s of an init iat ing m essage and possibly a response m essage.
Three k inds of EPs are used:
Class 1: Elem ent ary Procedures w it h response ( success and/ or failure) .

Class 2: Elem ent ary Procedures w it hout response.
Class 3: Elem ent ary Procedures w it h possibilit y of m ult iple responses.
For Cla ss 1 EPs, t he t ypes of responses can be as follows:

Su cce ssfu l ( Successful Out com e Message)
A signaling m essage explicit ly indicat es t hat t he elem ent ary procedure successfully com plet ed w it h t he
receipt of t he response
Un su cce ssfu l ( Unsuccessful Out com e Message) :
A signaling m essage explicit ly indicat es t hat t he EP failed

On t im e supervision expiry ( for exam ple absence of expect ed response)
Su cce ssfu l a nd Un su cce ssful:
One signaling m essage report s bot h a successful and an unsuccessful out com e for t he different included
request s. The response m essage used is t he one defined for a successful out com e
Cla ss 2 EPs are always considered successful.
UMTS Signaling
Cla ss 3 EPs have one or sev eral response m essages report ing bot h successful, unsuccessful out com e of t he
request s, and t em porary st at us inform at ion about t he request s. This t ype of EP only t erm inat es t hrough
response( s) or t he EP t im er expiry; t he response is t ransm it t ed as Ou t com e Message.
Table 1 12 RANAP Funct ion Overview.
UMTS Signaling
1 .2 3 .2 Ex a m ple RAN AP Pr oce du r e
Figure 1 107 - RANAP Procedure ( Message Flow) .
The exam ple shows all t ypes of elem ent ary procedure classes of RANAP signaling.
1.
2.
3.
EP: I NI TI AL UE MESSAGE, class 2

EP: SECURI TY MODE CONTROL, class 1, successful
EP: RAB ASSI GNMENT, class 3, w it h response
UMTS Signaling
1 .2 4 ATM AD APTATI ON LAYER TYPE 2 LAYER 3 ( AAL2 L3 / ALCAP)

On UMTS I u int erfaces AAL2L3 ( I TU- T Q.2630) represent s t he ALCAP funct ion. ALCAP is a generic nam e for t he
t ransport signaling prot ocol used t o set up and t ear down t ransport bearers.
The AAL t ype 2 signaling prot ocol provides t he signaling capabilit y t o est ablish, release, and m aint ain AAL t ype 2
point - t o- point connect ions across a series of ATM VCCs t hat carry AAL t ype 2 links.
The AAL t ype 2 signaling prot ocol also provides m aint enance funct ions associat ed w it h t he AAL t ype 2 signaling.
I n t he UTRAN t he RNC always st art s set up and release of AAL2 SVCs using AAL2L3 signaling procedures.
1 .2 4 .1 AAL2 L3 M e ssa ge For m a t

An AAL2L3 connect ion is ident ified by a pair of Dest inat ion and Originat ing Signaling Associat ion I Ds.
The Binding I D provided by t he radio net work layer is copied int o t he Served User Generat ed Reference ( SUGR)
param et er of ESTABLI SH.request prim it ive. User Plane Transport bearers for I ur int erface are est ablished and
released by t he AAL2L3 in t he Serving RNC. The binding ident it y w ill already have been assigned and t ied t o a
radio applicat ion procedure when t he first AAL2L3 m essage w as received over t he I ur int erface in t he Drift RNC.
Figure 1 108 - AAL2L3 Message Form at .
User Plane Transport bearers for I ub int erface are est ablished and released by t he AAL2L3 in t he Cont rolling RNC.
AAL2 t ransport layer addressing is based on em bedded E.164 or AESA variant s of t he NSAP addressing form at
( E.191) . Nat ive E.164 addressing will not be used.
UMTS Signaling
1 .2 4 .2 Ex a m ple AAL2 L3 Pr oce du r e
Figure 1 109 - AAL2L3 Est ablish and Release Exam ple.
Sign a lin g Associa t ion I de n t ifie r s ( SAI Ds) are t reat ed in t he follow ing w ay :
1.
2.
3.
4.
5.
Whenever a new signaling associat ion is creat ed, a new prot ocol ent it y inst ance is creat ed and an
OSAI D is allocat ed t o it ; t his I D is t hen t ransport ed in t he first m essage in t he OSAI D param et er. The
DSAI D in t his m essage cont ains t he value " unk nown" , m eaning t hat all oct et s are set t o " 0" . ( I n t he
figures, t his is indicat ed by " DSAI D = 0" .)
Upon receipt of a m essage t hat has a DSAI D field set t o " unknown" , a new prot ocol ent it y inst ance is
creat ed and an OSAI D is allocat ed t o it .
I n t he first m essage ret urned t o t he originat or of t he associat ion, t he OSAI D of t he sending prot ocol
ent it y inst ance is t ransport ed in t he OSAI D param et er. The DSAI D field carries t he prev iously received
OSAI D of t he originat or of t he associat ion.
I n all subsequent m essages, t he DSAI D field carries t he prev iously received OSAI D of t he dest inat ion
ent it y .
The first m essage ret urned t o t he originat or of t he associat ion is also t he last one for t his signaling
associat ion ( Release Confirm ) ; no OSAI D param et er is carried in t he m essage. The SAI D field carries
t he previously received OSAI D of t he originat or of t he associat ion.
I n order t o m inim ize t he likelihood of CI D collision, t he follow ing CI D allocat ion m echanism is used:
I f t he AAL t ype 2 node owns t he AAL t ype 2 pat h t hat carries t he new connect ion, it allocat es CI D
values from CI D value 8 upw ards.
I f t he AAL t ype 2 node does not own t he AAL t y pe 2 pat h t hat carries t he new connect ion, it allocat es
CI D values from CI D value 255 downwards.
Each AAL t ype 2 connect ion request ( regardless of whet her it com es direct ly from an AAL t ype 2 served user or
from an adj acent AAL t ype 2 node) will cont ain an AAL t ype 2 service endpoint address w hich indicat es t he
dest inat ion of t he int ended AAL t ype 2 connect ion inst ance. This inform at ion is used t o rout e t he AAL t ype 2
connect ions via t he AAL t ype 2 net work t o it s dest inat ion endpoint . I n capabilit y set 1, t he support ed address
form at s are: NSAP and E.164.
I t is up t o t he applicat ion area or t he operat or of a part icular net work t o decide what addressing plan is used in
t he AAL t ype 2 net work. The addressing plan in t he AAL t ype 2 net work can be a reuse of t he addressing plan in
t he underlying ATM net work, but it can also be an independent addressing plan defined ex clusiv ely for t he AAL
t ype 2 net work .
UMTS Signaling
1 .2 5 I U USER PLAN E PROTOCOL

The I u UP prot ocol ( 3GPP 25.415) is locat ed in t he User plane of t he Radio Net work layer over t he I u int erface,
t he I u UP prot ocol layer. I t is used t o convey user dat a associat ed t o Radio Access Bearers t o m eet t he needs of
CS and PS dom ain user dat a t raffic.
One I u UP prot ocol inst ance is associat ed t o one RAB and one RAB only . I f sev eral RABs are est ablished t owards
one given UE, t hen t hese RABs m ake use of several I u UP prot ocol inst ances.
These I u UP prot ocol inst ances are est ablished, relocat ed, and released t oget her w it h t he associat ed RAB.
The I u UP prot ocol operat es in m odes. Modes of operat ion of t he prot ocol are defined:
1.
2.
Tr a nspa r e nt m ode ( Tr M )
The t ransparent m ode is int ended for t hose RABs t hat do not require any part icular feat ure from t he I u
UP prot ocol ot her t han t ransfer of user dat a.
o Null- prot ocol
o Non- real t im e dat a in plain GTP- U form at
Suppor t m ode for pr e de fin e d SD U size ( SM pSD U) .
The support m odes are int ended for t hose RABs t hat do require part icular feat ures from t he I u UP
prot ocol in addit ion t o t ransfer of user dat a.
o Rat e cont rol, t im e alignm ent
o Procedure cont rol funct ion, such as AMR speech dat a
When operat ing in a support m ode, t he peer I u UP prot ocol inst ances exchange I u UP fram es whereas in
t ransparent m ode, no I u UP fram es are generat ed.
Det erm inat ion of t he I u UP prot ocol inst ance m ode of operat ion is a CN decision t aken at RAB est ablishm ent
based on ,for exam ple, t he RAB charact erist ics. I t is signaled in t he Radio Net work layer cont rol plane at RAB
assignm ent and at relocat ion for each RAB. I t is int ernally indicat ed t o t he I u UP prot ocol layer at user plane
est ablishm ent . The choice of a m ode is bound t o t he nat ure of t he associat ed RAB and cannot be changed unless
t he RAB is changed.
1 .2 5 .1 I u UP Tr a n spa r e n t M ode
I n t his m ode, t he I u UP prot ocol inst ance does not perform any I u UP prot ocol inform at ion exchange w it h it s peer
over t he I u int erface: no I u fram e is sent ( Null Prot ocol) . The I u UP prot ocol layer is crossed t hrough by PDUs
being exchanged bet ween upper layers and t he t ransport net w ork lay er.
UMTS Signaling
Figure 1 110 - I u UP Transparent Mode.
For inst ance, t he t ransfer of GTP- U PDUs could ut ilize t he t ransparent m ode of t he I u UP prot ocol.
Not e t hat t he dat a is t ransm it t ed on user plane channels, w hich have t o be est ablished earlier on by t he RANAP
RAB Assignm ent procedure. At t he end of t he connect ion, RANAP needs t o release t he user plane channel again.
1 .2 5 .2 I u UP Suppor t M ode D a t a Fr a m e s
Support Mode dat a fram es represent t he I u UP Non Access St rat um Dat a St ream s specific funct ion.
These funct ions are responsible for a lim it ed m anipulat ion of t he pay load and t he consist ency check of t he fram e
num ber. I f a fram e loss is det ect ed due t o a gap in t he sequence of t he received fram e num bers ( for a RAB
where fram e num bers does not relat e t o t im e) , t hen t his gap is report ed t o t he Procedure Cont rol funct ion. These
funct ions are responsible for t he CRC check and calculat ion of t he I u UP fram e payload part . These funct ions are
also responsible for t he Fram e Qualit y Classificat ion handling as described below.
Figure 1 111 - I u UP Support Mode Dat a Fram es.
PD U Type 0 is defined t o t ransfer user dat a ov er t he I u UP in support m ode for predefined SDU sizes. An error
det ect ion schem e is provided over t he I u UP for t he payload part .
PD U Type 1 is defined t o t ransfer user dat a ov er t he I u UP in support m ode for predefined SDU sizes when no
payload error det ect ion schem e is necessary over t he I u UP, m eaning t here is no payload CRC.
1 .2 5 .3 I u UP Su ppor t M ode Con t r ol Fr a m e s

Fr a m e num be r
A Fram e Num ber handles t he I u UP fram e num bering. The fram e num bering can be based on eit her t im e or sent
I u UP PDU.
UMTS Signaling
Figure 1 112 - I u UP Support Mode Cont rol Fram es.
Fr a m e Qu a lit y Cla ssifica t ion is used t o classify t he I u UP fram es depending on whet her errors have occurred in
t he fram e or not . Fram e Qualit y Classificat ion is dependent on t he RAB at t ribut e Delivery of Erroneous SDU I E.
RAB su b- Flow Com bin a t ion I n dica t or ident ifies t he st ruct ure of t he payload. This can be used t o specify t he
sizes of t he sub flows. Sub flow s are AMR Classes, m eaning t he m axim um num ber of sub flows is t hree and t hey
correspond w it h AMR Class A, Class B, and Class C bit s.
1 .2 5 .4 Ex a m ple I u UP Su ppor t M ode M e ssa ge Flow
Figure 1 113 - I u UP Support Mode Sim ple Message Flow.
The I N I TI ALI SATI ON procedure is m andat ory for RABs using t he support m ode for predefined SDU size. The
purpose of t he procedure is t o configure bot h t erm inat ion point s of t he I u UP w it h RAB Sub flow Com binat ions,
RFCI s, and associat ed RAB Sub Flows SDU sizes necessary t o be support ed during t he t ransfer of user dat a phase.
Addit ional param et ers m ay also be passed, such as t he I nt er PDU Tim ing I nt erval ( I PTI ) inform at ion.
The I nit ializat ion procedure is always cont rolled by t he ent it y in charge of est ablishing t he Radio Net work Layer
User Plane, m eaning SRNC.
The I nit ializat ion procedure is invoked whenev er indicat ed by t he I u UP Procedure Cont rol funct ion, for exam ple,
UMTS Signaling
as a result of a relocat ion of SRNS or at RAB est ablishm ent over I u. The I nit ializat ion procedure w ill not be reinvok ed for t he RAB w it hout a RAB m odificat ion request ed v ia RANAP.
The I u user plane dat a could be speech, using AMR. The dat a packet s w ill be t ransm it t ed w it h I u UP PDU t ype 0
fram es.
There is no I u UP release cont rol fram e. I nst ead t he RANAP w ill release t he resource.
UMTS Signaling
1 .2 6 AD APTI VE M ULTI - RATE COD EC AM R

The AMR codec ( 3GPP 26.101) offers a w ide range of dat a rat es and is used t o low er codec rat es as int erference
increases on t he air int erface. I t is also used t o harm onize codec st andards am ongst different cellular syst em s.
AMR consist s of t he m ult i- rat e speech coder, a source cont rolled rat e schem e including a voice act iv it y det ect or, a
com fort noise generat ion syst em , and an error concealm ent m echanism t o com bat t he effect s of t ransm ission
errors and lost packet s.
The m ult i- rat e speech coder is a single int egrat ed speech codec w it h eight source rat es from 4.75 Kbps t o 12.2
Kbps, and a low rat e background noise- encoding m ode. The speech coder is capable of sw it ching it s bit - rat e
every 20 m s speech fram e upon com m and.
There are t wo form at s of AM R fr a m e s. AMR I nt erface Form at 1 ( AMR I F1) is t he generic fram e form at for bot h
t he speech and com fort noise fram es of t he AMR speech codec. AMR I nt erface Form at 2 ( AMR I F2) is useful, for
exam ple, w hen t he AMR codec is used in connect ion w it h applicable I TU- T H- series of recom m endat ions.
The m apping of t he AMR Speech Codec param et ers t o t he I u int erface specifies t he fram e st ruct ure of t he speech
dat a exchanged bet ween t he RNC and t he Transcoder ( TC) during norm al operat ion. This m apping is independent
from t he radio int erface in t he sense t hat it has t he sam e st ruct ure for bot h FDD and TDD m odes of t he UTRAN.
The RAB param et ers are defined during t he RANAP RAB Assign m e n t pr oce du r e init iat ed by t he CN t o est ablish
t he RAB for AMR. The AMR RAB is est ablished w it h one or m ore RAB coordinat ed sub- flows w it h predefined sizes
and QoS param et ers. I n t his w ay, each RAB subflow com binat ion corresponds t o one AMR fram e t ype. On t he I u
int erface, t hese RAB param et ers define t he corresponding param et ers regarding t he t ransport of AMR fram es.
Som e of t he QoS param et ers in t he RAB assignm ent procedure are det erm ined from t he Bearer Capabilit y
I nform at ion Elem ent used at call set up.
1 .2 6 .1 AM R I F 1 Fr a m e Ar ch it e ct u r e
The AMR I F1 fram e is used in UMTS for t ransm ission of speech inform at ion.
Fram e Type w ill indicat e t he t y pe and size of t he core fram e cont ent s.
Mode I ndicat ion and Mode Type are also used t o specify t he AMR codec m ode.
The Fram e Qualit y I ndicat or indicat es whet her t he dat a in t he fram e cont ains errors. Not e t hat t he param et er is
also used in t he I u UP prot ocol w it h inv ert ed value m eaning.
Figure 1 114 - AMR I F1 Fram e Archit ect ure
The m apping of t he bit s bet w een t he generic AMR fram es and t he PDU is t he sam e for bot h uplink and downlink
fram es.
UMTS Signaling
The num ber of RAB sub- flows, t heir corresponding sizes, and t heir at t ribut es, such as " Deliv ery of erroneous
SDUs" , are defined at t he RAB est ablishm ent and are signaled in t he RANAP RAB est ablishm ent request . The
num ber of RAB sub- flows is corresponding t o t he desired bit prot ect ion classes. The t ot al num ber of bit s in all
sub- flows for one RFC has t o correspond t o t he t ot al num ber of a generic AMR fram e form at I F1, for t he
corresponding Codec Mode and Fram e Type.
The RFCI definit ion is given in sequence of increasing SDU sizes. The definit ion describes Codec Type UMTS_AMR,
wit h all eight codec m odes t he Act ive Codec Set ( ACS) and provision for Source Cont rolled Rat e operat ion ( SCR) .
UMTS Signaling
1 .2 7 TERM I N AL AD APTI ON FUN CTI ON ( TAF)

TAF ( 3GPP 27.001, 27.002, 27.003) is based on t he principles of t erm inal adapt or funct ions present ed in t he I TUT I - series of recom m endat ions ( I .460 t o I .463) .
The PLMN support s a w ide range of voice and non- voice services in t he sam e net work. To enable non- voice t raffic
in t he PLMN, t here is a need t o connect various kinds of t erm inal equipm ent t o t he Mobile Term inat ion ( MT) .
The m ain funct ions of t he MT t o support dat a serv ices are:
Ensures conform it y of t erm inal service request s t o net work capabilit y

Physically connect s t he reference point s R and S
Cont rols flow of signaling and m apping of user signaling t o/ from GSM PLMN access signaling
Adapt s rat e of user dat a ( see GSM 04.21) and dat a form at t ing for t he t ransm ission SAP
Cont rols flow of non- t ransparent user dat a and m apping of flow cont rol for asy nchronous dat a serv ices
Support s dat a int egrit y bet w een t he MS and t he int erwork ing funct ion in t he GSM PLMN
Provides end- t o- end synchronizat ion bet w een t erm inals
Filt ers st at us inform at ion
Support s non- t ransparent bearer services, for exam ple, t erm inat ion of t he Radio Link Prot ocol ( RLP)
and t he Layer 2 Relay funct ion ( L2R) including opt ional dat a com pression funct ion ( where applicable)
Checks t erm inal com pat ibilit y
Opt ionally support s local t est loops
UMTS Signaling
1 .2 8 RAD I O LI N K PROTOCOL RLP

The Radio Link Prot ocol ( 3GPP 24.022) ut ilizes reliabilit y m echanism s of t he underly ing prot ocols in order t o
deliver dat a and t erm inat es at t he Mobile St at ion and I nt erwork ing Funct ion ( t y pically at t he MSC) . I t has been
specified for circuit - sw it ched dat a t ransm ission w it hin t he GSM and UMTS PLMN. RLP covers t he Layer 2
funct ionalit y of t he I SO/ OSI Reference Model. RLP has been t ailored t o t he special needs of digit al radio
t ransm ission.
RLP is int ended for use w it h non- t ransparent dat a- t ransfer. Prot ocol conv ersion m ay be provided for a variet y of
prot ocol configurat ions. Som e m ore feat ures of RLP:
Nearly ident ical t o LAPD ( Link Access Procedures on t he D- Channel)

I nt ended for use w it h non- t ransparent dat a- t ransfer
Foreseen dat a applicat ions
o Charact er- m ode prot ocols using st art - st op t ransm ission ( I A5)
o X.25 LAP- B ( Link Access Procedures on t he Bearer Channel)
Locat ed in MT and I nt erworking Funct ion ( I WF) of t he PLMN
I n UMTS RLP support t he 576 bit fram e lengt h, in GSM 240 bit
Two m odes of operat ion
o AD M Asynchronous Disconnect ed Mode
o ABM Asynchronous Balanced Mode
Three RLP v ersions
o Version 0: single- link basic version
o Version 1: single- link ex t ended ( dat a com pression) version
o Version 2: m ult i- link version ( 1- 4 physical links)
I n UMTS, t he RLP- fram e has a fix ed lengt h of 576 bit s.

A fram e consist s of a header, an inform at ion field, and an FCS ( fram e check sequence) field. The size of t he
com ponent s depends on t he radio channel t ype, on t he RLP version, and on t he RLP fram e. As a benefit of using
st rict alignm ent w it h underlying radio t ransm ission, t here is no need for fram e delim it ers ( such as flags) in RLP.
I n consequence, t here is no " bit - st uffing" necessary in order t o achieve code t ransparency.
UMTS Signaling
1 .2 9 PACKET D ATA CON VERGEN CE PROTOCOL ( PD CP)

PDCP ( 3GPP 25.323) is used t o form at dat a int o a suit able st ruct ure prior t o t ransfer over t he air int erface and
provides it s services t o t he NAS at t he UE or t he relay at t he Radio Net work Cont roller ( RNC) .
PDCP uses t he services provided by t he Radio Link Cont rol ( RLC) sublayer.
PDCP perform s t he following funct ions:
Header com pression and decom pression of I P dat a st ream s ( for exam ple, TCP/ I P and RTP/ UDP/ I P
headers) at t he t ransm it t ing and receiving ent it y, respect ively. The header com pression m et hod is
specific t o t he part icular net work lay er, t ransport layer or upper layer prot ocol com binat ions ( for
exam ple, TCP/ I P and RTP/ UDP/ I P)
Transfer of user dat a ( Transm ission of user dat a m eans t hat PDCP receives PDCP SDU from t he NAS
and forwards it t o t he RLC layer and vice versa)
Maint enance of PDCP sequence num bers for radio bearers t hat are configured t o support lossless SRNS
relocat ion
Mult iplex ing of different RBs ont o t he sam e RLC ent it y. Mult iplex ing is not part of Release 1999 but w ill
be included in Release 2000
1 .2 9 .1 PD CP PD U For m a t
Figure 1 115 - PDCP PDU Form at .

Dat a using t he Transparent SAP ( Tr- SAP) w ill use t he PD CP- N o- H e a de r - PD U.
Dat a using t he UM- SAP w ill use t he PD CP- D a t a - PD U.
Dat a using t he AM- SAP w ill use t he PD CP- Se qN u m - PD U. The sequence num ber w ill allow t he det ect ion of fram e
loss.
The Pa ck e t I de n t ifie r ( PI D ) ident ifies t he t y pe of com pression.
UMTS Signaling
1 .3 0 BROAD CAST / M ULTI CAST CON TROL ( BM C)

BMC ( 3GPP 25.324) adapt s broadcast and m ult icast services on t he radio int erface and is a sublayer of L2 t hat
ex ist s in t he User- Plane only . I t is locat ed abov e RLC. The L2/ BMC sublayer is assum ed t o be t ransparent for all
serv ices except broadcast / m ult icast .
BM C Fu n ct ion s
St orage of Cell Broadcast m essages

Traffic volum e m onit oring and radio resource request for CBS
Scheduling of BMC m essages
Transm ission of BMC m essages t o UE
Delivery of Cell Broadcast m essages t o upper layer ( NAS)
Only one procedure: BMC Message Broadcast
At t he UTRAN side, t he BMC sublayer consist s of one BMC prot ocol ent it y per cell. Each BMC ent it y requires a
single CTCH, w hich is prov ided by t he MAC sublay er, t hrough t he RLC sublayer. The BMC request s t he
Unacknowledged Mode serv ice of t he RLC.
The BMC ent it y on t he net work side predict s periodically t he expect ed am ount of CBS t raffic volum e ( CTCH
t ransm ission rat e in Kbps) , which is needed for t ransm ission of CBM ( Cell Broadcast Messages) current ly and
indicat es t his t o RRC. The algorit hm s used for t raffic volum e predict ion are im plem ent at ion- dependent and t hus
do not need t o be specified. Som e param et ers m ay be set by t he O&M syst em .
The algorit hm s depend on t he chosen algorit hm s for CB m essage scheduling. This procedure calculat es t he CBS
schedule periods and assigns BMC m essages ( for exam ple CBS Messages and Schedule Messages) t o t he CBS
schedule periods. The procedure t hen gives an indicat ion of which of t he CTCH Block Set s cont aining part of or
t he com plet e BMC m essages has t he st at us " new" .
1 .3 0 .1 BM C Ar ch it e ct u r e
Figure 1 116 - BMC Archit ect ure.
I t is assum ed t hat t here is a funct ion in t he RNC above BMC t hat resolv es t he geographical area inform at ion of
t he CB m essage ( or, if applicable, perform s evaluat ion of a cell list ) received from t he Cell Broadcast Cent er
( CBC) . A BMC prot ocol ent it y serves only t hose m essages at BMC- SAP t hat are t o be broadcast int o a specified
cell.
UMTS Signaling
1 .3 1 CI RCUI T SW I TCH ED M OBI LI TY M AN AGEM EN T ( M M )

Mobilit y Managem ent is a generic t erm for t he specific m obilit y funct ions provided by a PLMN. Such funct ions
include e.g. t racking a m obile as it m oves around a net work and ensuring t hat com m unicat ion is m aint ained.
The Circuit Sw it ched ( CS) specific Mobilit y Managem ent part is well know n from GSM and is used quit e
unchanged for UMTS Rel.99 ( 3GPP 24.008) .
M M Funct ion s
MM procedures t o est ablish and release connect ions

Transfer of Call Managem ent ( CM) sublayer m essages
MM com m on procedures for securit y funct ions, for exam ple, t he Aut hent icat ion procedure
MM- specific procedures for locat ion funct ions such as Periodic locat ion updat ing or I MSI at t ach
procedure
UE ident ified by I MSI or TMSI
Mobilit y Managem ent procedures are used t o set up t he connect ion bet w een UE and t he CS core net work.
Procedure like Aut hent icat ion and Locat ion Updat e are also part of CS MM.
A CS CN w ill recognize a UE by t he I nt ernat ional Mobile Subscriber I dent it y ( I MSI ) or by a previously assigned
Tem porary Mobile Subscriber I dent it y ( TMSI ) .
UMTS Signaling
1 .3 2 CI RCUI T SW I TCH ED CALL CON TROL ( CC)

The Circuit - sw it ched Call Cont rol prot ocol ( CC) includes som e basic procedures for m obile call cont rol ( no
t ransport cont rol! ) :
Call est ablishm ent procedures

Call clearing procedures
Call inform at ion phase procedures
Miscellaneous procedures
CC ent it ies are described as com m unicat ing finit e st at e m achines t hat exchange m essages across Radio
int erfaces and com m unicat e int ernally w it h ot her prot ocol ( sub) layers.
The Circuit Sw it ched Call Cont rol prot ocol part has only slight ly changed from GSM t o UMTS Rel.99 ( 3GPP
24.008) .
Param et ers for QoS ( for exam ple, t he Radio Access Bearer specificat ion) have been added t o t he signaling
prot ocol.
CC Funct ion s
Procedures sim ilar t o GSM

CC est ablishes and releases CC connect ions bet ween UE and CN
Act ivat ion of voice/ m ult im edia codec
o Based on 3G- 324M, variant of H.324. See 3GPP 26.111
I nt erworking w it h RANAP for est ablishm ent of a RAB
o CC SETUP QoS w ill be m apped ont o RANAP RAB assignm ent
UMTS Signaling
1 .3 3 EXAM PLE - M OBI LE ORI GI N ATED CALL ( CI RCUI T SW I TCH ED )

As shown in t he Figure 1 117, t he procedure is ident ical t o GSM from t he Mobilit y Managem ent and Call Cont rol
point of v iew.
However, t he Ciphering is not perform ed by t he CN in t he sam e way as known from GSM. I nst ead t he ot her m ain
prot ocol of t he I uCS int erface, t he RANAP, is in charge of all t ypes of RAB signaling.
The init ial UE m essage, in t his exam ple t he CM Se r vice Re qu e st , w ill t ransport t he UE I dent it y, whereas t he Call
Cont rol Se t u p m essage w ill cont ain t he dialed t elephone num ber.
All given m essages w ill run on t op of RANAP, w hich w ill run on t op of SCCP prot ocol. The SCCP is responsible t o
define t he UE procedure connect ion.
UMTS Signaling
1 .3 4 PACKET SW I TCH ED M OBI LI TY M AN AGEM EN T ( GM M )

The GPRS M obilit y M a n a ge m e n t prot ocol ( 3GPP 24.008) is used t o m ake a UE known t o t he packet sw it ched
CN and t o follow it s m obilit y . The procedures have only changed by a m essage, which is used as t he init ial UE
m essage when connect ing UE w it h t he packet net work, Session Managem ent Act ivat e PDP Cont ext . This new
m essage is t he SERVI CE REQUEST m essage and is used t o set up a secure connect ion w it h t he abilit y t o define a
QoS for t he signaling inform at ion bet ween UE and SGSN.
Figure 1 117 Mobile Originat ed Call ( m essage flow) .
GM M Funct ion s
Procedures sim ilar t o GPRS ( GMM)

GMM prot ocol m akes use of a signaling connect ion bet ween UE and SGSN
GMM est ablishes and releases GMM cont ex t s, for exam ple, GPRS At t ach
GMM- specific procedures for locat ion funct ions lik e periodic rout ing area updat ing
New m essage im plem ent ed t o provide service t o CM sublayer on t op of GMM:
o SERVI CE REQUEST m essage
o I nit iat ed by UE, used t o est ablish a secure connect ion t o t he net work and t o request t he
bearer est ablishm ent for sending dat a
UE ident ified by I MSI or P- TMSI
UMTS Signaling
1 .3 5 PACKET SW I TCH ED SESSI ON M AN AGEM EN T ( SM )

The GPRS Se ssion M a n a ge m e n t prot ocol ( 3GPP 24.008) is sim ilar t o t he CS CC and is used t o define t he
connect ion of a UE t o a packet net work .
SM exist s in t he UE and in t he SGSN and handles PDP Cont ext Act ivat ion, Modificat ion, Deact ivat ion, and
Preservat ion Funct ions.
The GPRS SM prot ocol is used bet ween UE and SGSN whereas t he SGSN act s as relay funct ion t owards t he GGSN.
SM Fu n ct ion s
rocedures sim ilar t o GPRS ( SM) .

Count erpart t o CS CC prot ocol, m eaning SM prot ocol is used t o est ablish and release packet dat a
sessions.
SM procedures t o set up and release one or m ore PDP cont ext s.
PDP Cont ext s are handled in UE and GGSN.
SGSN represent s int erworking funct ion.
UMTS Signaling
1 .3 6 EXAM PLE - ACTI VATE PD P CON TEXT ( PACKET SW I TCH ED )
Figure 1 118 - Act ivat e PD Cont ext ( Message Flow) .
The exam ple above shows t he new signaling flow for act ivat ing and deact ivat ing t he PDP Cont ext on t he I uPS
int erface.
As m ent ioned earlier, t he GM M Se r vice Re que st and Se r vice Acce pt are new t o PS CN. The Service Request
w ill cont ain t he UE ident it y and t he MS Classm ark t o define a QoS and an RB for t he signaling. The Act ivat e PDP
Cont ext m essage w ill cont ain t he QoS param et er for t he user plane RB.
2 SHORT I NTRODUCTI ON TO NETWORK MONI TORI NG, TROUBLE SHOOTI NG AND NETWORK OPTI MI ZATI ON
This chapt er shall give som e pract ical t ips and t ricks regarding net work m onit oring, t rouble shoot ing and net work
opt im izat ion. The em phasis is on general ideas t hat help t o operat e and opt im ize t he net work. I t m ust always be
kept in m ind t hat configurat ions and resource planning differs from m anufact urer t o m anufact urer and from
operat or t o operat or. Also cust om er specific inform at ion m ust be t reat ed as confident ial and cannot be published.
For t his reason not every gap analy sis can be drilled down as deep as possible.
UMTS Signaling
2 Sh or t in t r odu ct ion t o ne t w or k m on it or in g, t r ou ble sh oot in g a n d

n e t w or k opt im iza t ion
This chapt er shall give som e pract ical t ips and t ricks regarding net work m onit oring, t rouble shoot ing and net work
opt im izat ion. The em phasis is on general ideas t hat help t o operat e and opt im ize t he net work. I t m ust always be
kept in m ind t hat configurat ions and resource planning differs from m anufact urer t o m anufact urer and from
operat or t o operat or. Also cust om er specific inform at ion m ust be t reat ed as confident ial and cannot be published.
For t his reason not every gap analy sis can be drilled down as deep as possible.
UMTS Signaling
2 .1 I UB M ON I TORI N G
Most Node Bs are not connect ed direct ly t o CRNC using a STM- 1 line. As a rule t he STM- 1 lines from CRNC lead
t o one or m ore ATM rout ers t hat also act as int erface conv ert er. From ATM rout ers/ int erface convert ers oft en E1
lines lead t o t he Node B. The reason for t his k ind of connect ion is t hat t hese E1 lines hav e already ex ist ed so
t hey j ust need t o be configured t o fit t o UTRAN configurat ion needs. I n a m inim um configurat ion t wo E1 lines lead
t o one Node B, where t he second line m irrors t he configurat ion of t he first one for redundancy and load sharing
reasons. Howev er, an E1 line has t ot al dat a t ransm ission capacit y of 2 Mbit / s, but a single user in an UTRAN FDD
cell shall already be able t o set up a connect ion w it h 384 kpbs. So it is clear t hat for high speed dat a t ransm ission
services one or t wo E1 lines are not enough. For his reason I nverse Mult iplex Access ( I MA) was int roduced.
Figure 2 1 Possible Transport Net work Configurat ions on I ub
2 .1 .1 I M A
I MA provides t he inverse m ult iplex ing of an ATM cell st ream over up t o 32 physical links ( E1 lines) and t o ret riev e
t he original st ream at t he far- end from t hese physical links. The m ult iplex ing of t he ATM cell st ream is perform ed
on a cell- by- cell basis across t hese physical links.
The ATM I nverse Mult iplex ing t echnique involv es inverse m ult iplex ing and de- m ult iplex ing of ATM cells in a
cyclical fashion am ong links grouped t o form a higher bandw idt h logical link whose rat e is approxim at ely t he sum
of t he link rat es. This is referred t o as an I MA Group. An m easurem ent unit lik e Tekt ronix K1297- G20 m ust be
able t o m onit or all E1 lines belonging t o an I MA group and t o m ult iplex/ dem ult iplex ATM cells in t he sam e way as
sending/ receiv ing ent it ies of t he net work ( Figure 2.2) .
Figure 2 2 I MA: Monit oring of Mult iplexed ATM Cells on E1 Lines
UMTS Signaling
2 .1 .2 Fr a ct ion a l ATM
Anot her t echnology t hat is becom ing m ore and m ore im port ant is fract ional ATM. Fract ional ATM allows net work
operat ors t o m inim ize t heir infrast ruct ure cost s, especially during t he UMTS deploym ent phase when t he net w ork
load is low. The UMTS UTRAN and t he GSM BSS share t he sam e physical m edium and exchange user and cont rol
inform at ion over t his m edium w it h t he core net work. The K1297- G20 t im e slot edit or allows t he assignm ent of an
ATM Fract ion in any com binat ion and is a good exam ple t o explain t he fract ional ATM principle. I n Figure 2 2 t he
ATM sect ion t hat form s t he UMTS I ub- I nt erface in shown in dark blue. The rem aining t im e slot s ( light blue) can
be used for GPRS Gb or GSM A int erface.
Figure 2 3 Tim e Slot Assignm ent for Fract ional ATM
2 .1 .3 Loa dsh a r in g a n d Addr e ssin g on I u b

There are several concept s for loadsharing on I ub, which m eans: t here are oft en sev eral NBAP and ALCAP links
bet ween one RNC and one Node B. Loadsharing does not only increase t he available t ransport capacit y bet w een
t wo prot ocol peer ent it ies, it also brings redundancy t o t he net work. I n case one link crashes for any reason,
t here w ill always be alt ernat ive ways for m essage exchange and t he connect ion bet ween RNC and Node B will not
be broken.
I n addit ion som e m anufact urers have div ided t heir NBAP links int o such used for com m on procedures and such
used for dedicat ed procedures. A t ypical addressing and configurat ion case of a Node B wit h t hree cells could look
like t his:
Table 2 1 Typical Node B Configurat ion w it h t hree cells 1

The DCHs m ay also run in t he sam e VPI / VCI as com m on t ransport channels. Then of course only t hose CI D
values can be used for DCH t hat are not occupied by com m on t ransport channels ( in t he exam ple: CI D 20- 254 on
VPI / VCI = A/ g) .
To m onit or t he com m on t ransport channels RACH, FACH and PCH it is necessary t o know not only t he VPI / VCI ,
but also t he correct t ransport form at set , because here it is defined e.g. how big RACH, FACH or PCH RLC blocks
UMTS Signaling
are and how oft en t hey are sent ( t im e t ransm ission int erval) . Transport form at set param et er values can follow
3GPP recom m endat ions or can be defined by net work operat ors/ m anufact urers!
2 .1 .4 Tr ou ble shoot in g I u b M onit or in g Sce n a r ios

Three com m on problem s when m onit oring I ub links ( w it hout Aut oconfigurat ion) are:
1.
2.
There is no dat a m onit ored on Com m on Transport Channels RACH, FACH and PCH.
Solut ion: Rem em ber t hat ATM lines are UNI DI RECTI ONAL! Ensure t hat m easurem ent configurat ion is
looking for RACH on uplink ATM line, while FACH and PCH can be found on downlink ATM line only!
I n case of NBAP or ALCAP only uplink or only downlink m essages are capt ured, e.g. only ALCAP ECF,
but ERQ m essages are m issed.
Solut ion: I t m ay happen t hat loadsharing of NBAP is not organized following com m on and dedicat ed
procedures, but follow ing uplink and downlink t raffic. I n a sim ilar way ALCAP uplink t raffic m ay be sent
on a different VPI / VCI t han downlink t raffic.
Exam ple:
3.
ALCAP1 DL ( ERQ) on VPI / VCI = A/ e ALCAP1 UL ( ECF) on VPI / VCI = A/ f

ALCAP2 DL ( ERQ) on VPI / VCI = A/ g ALCAP2 UL ( ECF) on VPI / VCI = A/ h
A m onit oring configurat ion t hat worked som e hours or days ago does not work anym ore despit e no
configurat ion param et er was changed.
Solut ion: Most likely a Node B Reset Procedure was perform ed. The Node B Reset is perform ed in t he
sam e way as Node B Set up ( described in chapt er 3.1 of t his book) , but it m ay happen t hat ATM
addressing param et ers are assigned dynam ically during t he set up procedure. This m eans aft er
successful rest art t he sam e link s w ill hav e been est ablished as before t he reset , but especially t he
com m on t ransport channels w ill have assigned different CI D values t han before.
Exam ple ( based on prev ious configurat ion exam ple) :
Channel Nam e VPI / VCI CI D before Reset CI D aft er Reset
RACH ( 1 per cell) A/ g 8; 12; 16 20; 24; 28
PCH ( 1 per cell) A/ g 9; 13; 17 21; 25; 29
FACH 1 ( for cont rol plane 1 per cell) A/ g 10; 14; 18 22; 26; 30
FACH 2 ( for user plane I P pay load 1 per cell) A/ g 11; 15; 19 23; 27; 31
Table 2 2 Typical Node B Configurat ion w it h t hree cells 2

4.
There are decoding errors in RRC m essages on recent ly opened DCHs.

Solut ion: The fram es t hat cannot be decoded m ay be ciphered. The necessary input param et ers for
deciphering are t aken from RANAP Securit y Mode Cont rol procedure, but also from RRC Connect ion
Set up Com plet e m essage on I ub int erface ( cont ains e.g. st art values for ciphering sent from UE t o each
dom ain see next figure) .
UMTS Signaling
Figure 2 4 St art Values for Ciphering in RRC Connect ion Com plet e Message
Hence, in case of soft handover scenarios a successful deciphering is only possible if t he first I ub int erface ( UE in
posit ion 1) is m onit ored during call set up.
Figure 2 5 - I ub Deciphering
An indicat or of successful deciphering are proper decoded RLC Acknow ledged Dat a PDUs in t he VPI / VCI / CI D t hat
carries t he DCH for DCCH aft er RRC Securit y Mode Com plet e m essage w it h rb- UL- CiphAct ivat ionTim eI nfo was
received from UE:
Figure 2 6 Correct decode of RLC Acknowledged Dat a PDU
UMTS Signaling
I n t he unsuccessful case, t he I ub int erface used for call est ablishm ent , cannot be m onit ored. Before UE m oves
int o posit ion 2 and a second radio link as w ell as necessary resources for t his second link on new I ub are
est ablished it w ill not be possible t o decipher t he m essages exchanged bet w een UE and net work v ia t his second
link, because RRC Connect ion Set up Com plet e is m issed. This case is show n in Figure 2 7.
Figure 2 7 - I ub Deciphering Problem
An indicat or t hat t he deciphering is not execut ed successfully is RLC Acknow ledged Dat a PDUs, which show
invalid lengt h field inform at ion. This is because t he lengt h info of RLC fram es is also ciphered and so t he value is
changed and becom es incorrect .
Figure 2 8 - I ub Deciphering Prot ocol Trace
UMTS Signaling
2 .2 I U M ON I TORI N G
I n t he cont ext of t his chapt er t he t erm " I u m onit oring" includes m onit oring of I uCS, I uPS and I ur int erfaces.
Looking forward t o Release 5 feat ures also I urg int erface bet ween UTRAN RNC and GERAN BSC can be included,
because inform at ion exchange on I urg will be done using a set of RNSAP ( Rel. 5) m essages.
Also on I u int erfaces load sharing is used for capacit y and redundancy reasons. However, it m ay be also possible
t hat dat a from several int erfaces is exchanged using t he sam e link.
Figure 2 9 show s a possible configurat ion scenario.
Bet ween RNCs and core net work elem ent s t here are Transit Exchanges ( TEX 1 and TEX 2) . These t ransit
exchanges m ust be seen as m ult ifunct ional sw it ches. They hav e an all- in- one funct ionalit y and work
sim ult aneously as ATM rout er, SS# 7 Signaling Transfer Point and int erface/ prot ocol conv ert er. I f CS core net w ork
dom ain is st ruct ured as described in Release 4 specificat ions t he Transit Exchanges m ay also include t he Media
Gat eway ( MGW) funct ion.
There are 4 STM- 1 fibre lines ( 4 fibres uplink , 4 fibres dow nlink) t hat lead from each RNC t o t wo different t ransit
exchanges ( TEX 1 and TEX 2) . I n t he t ransit ex change t he VPI / VCI from t he RNC ( e.g. VPI / VCI = B/ b) is
t erm inat ed and higher lay er m essages lik e SCCP/ RANAP are rout ed depending on Dest inat ion Point Code ( DPC) of
MTP Rout ing Label ( MTP RL) .
I n ot her words: all m essages on I uCS, I uPS and I ur int erfaces belonging t o a single RNC are t ransport ed on t he 4
STM- 1 w it h t wo different VPI / VCI values bet ween t he RNC and a TEX and t here is no dist inguished STM- 1 line for
any int erface lik e I uCS, I uPS or I ur. The exam ple in t he pict ure shows t he w ay of a Locat ion Updat e Request
m essage ( LUREQ) t hat is em bedded in a SCCP Connect ion Request ( SCCP CR) / RANAP I nit ial Message and sent
from RNC1 t o t he MSC. This m essage is sent on STM- 1 line w it h VPI / VCI = B/ b t o TEX 1 and is t hen rout ed based
on DPC = Y t o t he MSC no m at t er if t he t ransport net work bet ween TEX 1 and MSC is ATM as well or j ust a set
of SS7 links on E1 line( s) . I f t he LUREQ m essage is sent on VPI / VCI = B/ a or B/ b is decided by load sharing
funct ion of RNC 1, which also does not depend on any int erface charact erist ics.
Figure 2 9 Configurat ion of Transport Net work for I uCS, I uPS and I ur
2 .2 .1 Tr ou ble shoot in g I u M on it or in g
Usually it is not difficult t o find t he ATM links on I u int erfaces. The only problem when using a prot ocol t est er for
m essage analysis is t o use t he correct decoder when t he links are m onit ored on t he STM- 1 bet ween RNC and TEX
1/ 2.
For t hose readers who are not fam iliar w it h prot ocol t est ers it should be m ent ioned t hat in a prot ocol t est er t he
decoder layers are arranged in quit e t he sam e way as t he layers of t he prot ocol st ack on t he m onit ored link.
The problem on t he com bined I u link ( w it h I uCS, I uPS and I ur) is t hat t here m ust be a dynam ical decision which
m essages are RANAP and which m essages are RNSAP m essages. Bot h, RANAP and RNSAP are user of SCCP
ident ified by different Subsyst em Num bers ( RANAP: SSN= 142, RNSAP: SSN= 143) . But subsyst em num bers are
only exchanged during SCCP connect ion set up using t he SCCP Connect ion Request ( CR) and SCCP Connect ion
UMTS Signaling
Confirm ed ( CC) m essages. SCCP DT1 m essages used t o t ransport NAS PDUs do not have a SSN in header, but
prot ocol t est er decoder lay ers need t o decide for every single DT1 m essage t o which higher layer decoder t he
DT1 cont ent s shall be send.
I f t his is not clear a t ypical decoder problem looks like t he following exam ple:
Figure 2 10 RNSAP Decoding Errors in DT1 Messages on Com bined I u Link

I n t he I u signaling scenarios it was already explained t hat t here is a single SCCP class 2 connect ion for each
RANAP or RNSAP t ransact ion. Different SCCP class 2 connect ions are dist inguished on behalf of t heir source local
reference and dest inat ion local reference num bers ( SLR/ DLR) . So it is necessary t o have SLR/ DLR cont ext - relat ed
prot ocol decoder as im plem ent ed in Tekt ronix K12/ K15 prot ocol t est ers t o ensure correct decoding of all
RANAP/ RNSAP m essages on t he com bined link ( Figure 2.11) . Here t he SLR/ DLR com binat ion of t he act iv e SCCP
connect ion is st ored in relat ion t o t he higher layer decoder indicat ed by subsyst em num ber. Using t his int elligent
feat ure t he decoding errors on I ur disappear:
Figure 2 11 Correct Decoding of RNSAP Messages on Com bined I u Link
Anot her problem t hat m ight appear is t hat single RNSAP m essages on I ur int erface, especially RNSAP Radio Link
Set up m essages are not show n in prot ocol t est er m onit or w indow. This happens because of SCCP segm ent at ion
( described in I ur handover scenarios) . Figure 2.12 shows an m essage flow exam ple w it h RNSAP fram es
successfully reassem bled by prot ocol t est er.
Figure 2 12 Segm ent ed and Reassem bled RNSAP Messages on I ur I nt erface
UMTS Signaling
2 .3 N e t w or k Opt im iza t ion a n d N e t w or k Tr ou ble shoot in g

Especially in Europe UMTS net work deploym ent aft er successful field t rials and serv ice launches ent ered a new
crit ical st age: t he phase of net work opt im izat ion and net work t roubleshoot ing. Despit e t he fact t hat users can
already use 3G services t here are st ill m any problem s in t he net works and t he qualit y of services does not always
m eet expect at ions. The obj ect ive of net work opt im izat ion is t o evaluat e and im prove t he qualit y of services.
Net work t roubleshoot ing m eans t o det ect problem s, t hen find and elim inat e t he root causes of t hese problem s.
The few er problem s one finds t he higher qualit y of serv ices can be guarant eed.
To evaluat e problem s ( find out , which problem s appear and how oft en t hey appear in a net work) special
indicat ors are defined t hat are based on m easurem ent result s. These indicat ors are called Key Perform ance
I ndicat ors ( KPI ) .
I n general now adays t he t erm " KPI " becom es m ore and m ore a m arket ing phrase, " because it sounds good" . The
result is t hat not everybody using t he t erm " KPI " really m eans a KPI follow ing t he correct definit ion. Oft en t his
abbreviat ion is used t o cover a w ide field of m easurem ent result s t hat includes e.g. count ers of prot ocol event s
as described in 3GPP 42.403 as well as various m easurem ent set t ings and m easurem ent report s ext ract ed
direct ly from signaling m essages or m easurem ent s derived from analysis of dat a st ream s.
A real KPI is m ost ly a m at hem at ical form ula used t o define a m et rics rat io t hat describes net work qualit y and
behaviour for net work opt im izat ion purposes. Com parison of KPI values shall point out in a sim ple and
underst andable way if act ions t hat have been m ade t o im prov e net work and service qualit y have been successful
or not .
All ot her m easurem ent s are input for KPI form ulas and it is possible t hat also addit ional dat a is added com ing e.g.
from equipm ent m anufact urers and net work operat ors as shown in Fig. 2.13.
Figure 2.13 KPI as Key Elem ent of KQI

A good exam ple of perform ance relat ed dat a are event count ers used t o count prot ocol m essages t hat indicat e
successful or unsuccessful procedures.
A sim ple KPI defined based on such count ers could be a success or failure rat e.
Exam ple:
Count er 1 = Sum of all GPRS At t ach Request m essages capt ured w it hin a defined t im e period
Count er 2 = Sum of all GPRS At t ach Rej ect m essages capt ured w it hin a defined t im e period
KPI : GPRS At t a ch Fa ilu r e Ra t io [ in % ]
=
There is a long list of sim ilar Success and Failure Rat ios t hat are relat ively easy t o be defined using perform ance
m easurem ent definit ions found in 3GPP 32.403. All t hese values are useful, because t hey give a first overview of
net work qualit y and behav iour and t hey m ay also be helpful t o ident ify possible problem s in defined areas of t he
net work . Howev er, sim ple count ers and sim ple rat io form ulas are oft en not enough.
For inst ance, if t he already defined GRPS At t ach Failure Rat io is calculat ed per SGSN it can be used t o indicat e if
t here is an ext rem ely high rat e of rej ect ed GPRS At t ach Request s in a defined SGSN area. However, such a high
At t ach Failure Rat io does not need t o indicat e a net work problem by it self. Alw ays a furt her analysis is necessary
t o find t he root cause of net work behaviour. Based on t he root cause analysis it can be det erm ined if t here are
problem s or not . This procedure is also called drill- down analysis.
I n case of rej ect ed GPRS at t ach t he first st ep of analysis w ill alw ays be t o check t he rej ect cause value of t he
At t ach Rej ect m essage. A value t hat is oft en seen here is t he cause " net work failure" . From 3GPP 24.008
UMTS Signaling
( Mobilit y Managem ent , Call Cont rol, Session Managem ent ) it is known t hat t he cause value " net work failure" is
used " if t he MSC or SGSN cannot serv ice an MS generat ed request because of PLMN failures, e.g. problem s in
MAP."
A problem in MAP m ay be caused by t ransm ission problem s on Gr int erface bet ween SGSN and HLR. The address
of a subscriber's HLR is derived from I MSI as explained in chapt er 4.4 and t he best way t o analyze t he procedure
is t o follow up t he MAP signaling on Gr int erface aft er GRPS At t ach Request arrived at SGSN.
On Gr it can be seen if t here is a response from HLR or not and how long does it t ake unt il t he response is
received.
Com m on reasons why GPRS at t ach at t em pt s are rej ect ed w it h cause " net work failure" are:
expiry of t im ers while wait ing for answer from HLR, because of t oo m uch delay on signaling rout e
bet ween SGSN and HLR
abort ion of MAP t ransact ions due t o problem s wit h different soft ware v ersions ( applicat ion cont ext s) in
SGSN and HLR ( see chapt er 4.4.2)
invalid I MSI ( e.g. if a serv ice provider does not ex ist anym ore, but it s USI M cards are st ill out in t he
field)
rout ing of MAP m essages from foreign SGSN t o hom e HLR of subscriber im possible, because t here is no
roam ing cont ract bet w een foreign and hom e net work operat ors
The first t wo reasons indicat e net work problem s t hat shall be solv ed t o im prove general qualit y of net work
service. The lat t er t wo reasons show a correct behavior of t he net work t hat prevent s m isusage of net work
resources by unaut horized subscribers.
This exam ple shows how difficult it is t o dist inguish bet w een " good cases" ( no problem ) and " bad cases"
( problem ) in case of a single rej ect cause value. I n general four m ain feat ures can be ident ified as m ain
requirem ent s of good KPI analysis:
int elligent m ult i- int erface call filt ering

provision of useful event count ers
flexible present at ion of m easurem ent result s from different point s of view ( som et im es called
dim ensions) , e.g. show first At t ach Rej ect s m essages by cause values and t hen show I MSI of rej ect ed
subscribers relat ed t o one single cause value ( t o find out if t hey are roam ing subscribers or not )
lat ency m easurem ent t o calculat e t im e differences e.g. bet ween request and response m essages
Anot her exam ple t hat dem onst rat es t hese needs is shown in Figure 2.14.
UMTS Signaling
Figure 2.14 Drill- down analysis of rej ect ed Locat ion Updat e procedure.
The call flow diagram in t he figure shows t hat MSC rej ect s a locat ion updat e request belonging t o a com bined
Locat ion/ Rout ing Area Updat e procedure, because RNC is obv iously not able t o execut e Securit y Mode funct ions
required by CS core net work dom ain wit hin an accept able t im e fram e. Once again t he rej ect cause value in t his
case is " net work failure" , but t his t im e t he root cause of t he problem is not in core net work. A classical locat ion
updat e failure rat e would show t he problem relat ed t o MSC only, but using m ult i- int erface call t race funct ion and
call- relat ed lat ency m easurem ent it becom es possible t o ident ify t he RNC as t he problem child of t he net work in
t his case.
I n addit ion t o root cause analysis lat ency m easurem ent is also useful t o calculat e call set up t im es as well as
delivery t im es for short m essages and dat a fram es. Furt her im port ant net work perform ance param et ers are
t hroughput ( dat a t ransm ission rat e on single int erfaces or for single applicat ions, e.g. file t ransfer) .
Qualit y of services on radio int erface can be det erm ined on behalf of socalled radio link perform ance indicat ors
t o which belong:
BLER
Long- t im e average block error rat e calculat ed from t ransport blocks. A t ransport block is considered t o
be erroneous if a CRC error is indicat ed by appropriat e inform at ion elem ent of Fram ing Prot ocol for
uplink dat a. Unfort unat ely t here is not good downlink BLER report specified yet t hat could be sent by
user equipm ent . Only RRC m easurem ent report w it h event - I D e5a indicat es t hat downlink BLER
exceeded a defined t hreshold.
BER
Bit error rat e ( BER) can eit her be m easured as Transport Channel BER or Physical Channel BER. Report s
are sent by Node B t o RNC for uplink dat a. The uplink BER is encoded in Fram ing Prot ocol Qualit y
Est im at e value.
SI R Er r or :
shows t he gap bet ween t he assigned SI R t arget and m easured SI R. Analysis of SI R error per connect ion
shows how good t he SRNC is able t o adj ust uplink t ransm ission power of UE, which m eans: accuracy of
Open Loop Power Cont rol.
Tr a nsm it t e d Code Pow e r
Power allocat ed per connect ion. Based on t his m easurem ent DL load of any user per connect ion can be
est im at ed. Purpose of t his procedure in RNC is t o avoid t hat all available DL power resources are
blocked by single UEs.
I n order t o est ablish t he radio link w it h t he defined bit rat e, t he appropriat e t ransm ission pow er is also
needed: t he higher required bit rat e t he higher out put power per connect ion. Adm ission cont roller and
packet scheduler should allow UE t o use as m uch power as needed t o reach t he Node B at a predefined
UMTS Signaling
qualit y level. The allow ed UE t ransm it t ed power should be on as low lev el as possible, t o save t he short
radio resources.
Qualit y lev el per connect ion is defined in t he planning phase and should be kept const ant as long as
cust om er sat isfact ion is ensured.
Receiv ed Tot al Wideband Power
RTWP reflect s t he t ot al noise level w it hin t he UMTS frequency band of one single cell. Call adm ission
cont rol and packet scheduler funct ions in RNC m ay use RTWP for calculat ion of necessary dedicat ed
resources ( load- based adm ission cont rol funct ion) . A high RTWP level indicat es increasing int erferences
in cell. To prev ent excessive cell- breat hing RNC m ay reconfigure all exist ing radio bearers used in t his
cell. As a result short - t im e peak s of int ra- cell handover rat e KPI s can be m easured.
How event count ers and perform ance param et ers depend on each ot her is st ill pret t y unknow n. Hence, one of t he
m ain challenges of UMTS net work opt im izat ion is t o define socalled co- relat ed KPI s t hat link prot ocol event s wit h
QoS param et ers. The general difficult y is t o define useful KPI s on one hand and t o giv e a correct int erpret at ion of
m easured KPI s on ot her hand. I ndeed, a high level of expert ise is necessary t o work on t his t ask and j ust t o list
all possible known problem s would exceed t he cont ent s of t his book.
However, finally anot her nice exam ple shall be given t hat show s how prot ocol analysis can be used t o opt im ize
t he net work .
As t he reader w ill learn in chapt er 3 soft er and soft handovers play an im port ant role t o guarant ee a st able radio
link qualit y. The prerequisit e t o perform handovers is t hat cells overlap, but overlapping shall only happen in
border areas. I f one UMTS cell overlaps anot her one t oo m uch t he int erference level of t he overlapped cells w ill
rise, which is indicat ed by increased Received Tot al Wideband Power level and t his w ill in t urn lower t he QoS of
radio links. How ever, if overlapping areas are t oo sm all t here is a quit e big risk t hat UE can loose cont act w it h
net work, which leads t o a dropped call.
At any t im e of radio net work planning and opt im izat ion t here is t he quest ion how m uch neighbour cells ov erlap
and if t he expect ed overlapping fact or is reached or not . The t ool t hat helps radio net work planners t o opt im ize
t heir set t ings it called " cell overlapping m at rix" or " cell neighbour m at rix" .
Using int elligent call filt er funct ions and st at ist ic funct ions t his m at rix can easily be calculat ed based on dat a
found in different RRC m essages.
Figure 2.15 RRC m essages used t o calculat e cell neighbour m at rix.
As shown in Figure 2.15 prim ary scram bling code included in RRC Connect ion Set up m essage helps t o ident ify t he
cell in which a UE is locat ed during call set up. Then, aft er call set up, t his UE w ill send RRC Measurem ent Report
m essages t o SRNC ( see chapt er 3.7) . Those RRC Measurem ent Report s include m easured signal st rengt h of
prim ary CPI CH of all cells t he UE is able t o m easure on radio int erface: t he cell in which t he call was set up as
well as neighbour cells of t his cell. All cells are ident ified by t heir prim ary scram bling codes and now t hese
UMTS Signaling
prim ary scram bling codes are used t o nam e colum ns and lines of cell neighbour m at rix.
The cell in which t he call was originally set up and where t he m easurem ent report s com e from is used t o define a
line of t he m at rix, e.g. SC= 9 in first line of Figure 2.16. Neighbour cell prim ary scram bling codes are found in t he
colum n nam es of t he m at rix.
Figure 2.16 Cell neighbour m at rix calculat ed by analysis t ool.
The final cell neighbour m at rix ( Figure 2.16) shows how oft en a single neighbour cell was report ed by an UE w it h
an act ive radio link in t he cell t hat st ands in front of a m at rix line. I f t he cell w as report ed in 2 out of 10 t ot al
m easurem ent report s t he overlapping fact or is 20% . The figure shows neighbour cells for cells w it h prim ary
scram bling codes ( SC) = 9, 18, 37, 60, 72 and 84.
UMTS Signaling
3 UM TS UTRAN SI GN ALI N G PROCED URES

Aft er t he com prehensive UMTS refresher t he focus changes now t owards det ails of m ult iple ex am ples of com m on
signaling procedures on UMTS UTRAN line int erfaces.
To achieve a bet t er underst anding of how t he prot ocols of t he different int erfaces int eract t he first focus is on I ub
procedures. I n t he second part it is shown how m essages from I ub are forwarded t o t he core net work dom ains.
Finally t he t hird part deals w it h explanat ion of handover procedures t hat include I ur signaling.
All signaling procedures are based on real t race files from real net work operat ion, field t rials or t est beds.
However, it should be not iced t hat 3GPP st andards offer a w ide range of possibilit ies how procedures could be
designed. So t he focus here is not t o show what is possible follow ing t he 3GPP st andards, but what is
im plem ent ed in present UMTS equipm ent .
I t also m ust be m ent ioned t hat especially on I ub int erface a w ide range of m anufact urer specific solut ions can be
found and t here are also m any opt ions for t he net work operat ors. Not all of t hese opt ions and specific solut ions
can be explained in t ext and graphics, only a few are highlight ed.
As oft en as possible we have added exam ples of signaling m essages and param et ers so t hat not only t he
variables in t he call flow diagram s are present ed, but also exam ples how real values of t hese variables look like
in a prot ocol t est er's env ironm ent . Unfort unat ely m any UMTS signaling m essages are pret t y volum inous. Hence,
we oft en can only show t he m essage header and som e select ed inform at ion elem ent s relat ed t o t he call flow
procedures. All param et er values t hat would allow ident ificat ion of subscribers, net work operat ors or equipm ent
m anufact urers have been changed. Our int ension t o show m essage exam ples is t o giv e a bet t er underst anding of
call param et ers. The given exam ples shall not be t aken as recom m endat ion for net work configurat ion and
set t ings. They have been ext ract ed from different t race file sources and it cannot be guarant eed t hat t wo
consecut iv e m essage exam ples ( also if t hey are present ed in t he sam e procedure descript ion) have t he sam e
origin.
Procedures, m essages and param et ers are based on 3GPP st andards as described in Release 99 and Release 4
specificat ions. The reader should keep in m ind t hat t hese specificat ions are im proved const ant ly . As a rule every
t hree m ont hs a new prot ocol v ersion is released.
N ot e : I n t he cont ext of t his book t he t erm " DCH" is oft en used t o describe a dedicat ed AAL2 SVC on I ub int erface
t hat is act ually only a t ransport bearer for dedicat ed signaling or user t raffic. Dat a t ransm it t ed in sam e AAL2 SVC
is sent on m ore t han j ust one radio int erface DCH. I n a sim ilar way t he t erm " DCCH" or " DTCH" is used in som e
cases, but of course t here is m ore t han j ust one DCCH or DTCH assigned t o a single connect ion. I ndeed, when
I ub int erface is m onit ored t he differences bet w een used radio DCHs are not significant , but cont rol plane and user
plane t raffic is always running on different t ransport bearers. Wit hin a single connect ion t hese t ransport bearers
can be easily dist inguished on behalf of different VPI / VCI / CI D values. To indicat e t he purpose of each AAL2 SVC
we nam ed t hese t ransport bearers DCH, DTCH or DCCH, which will hopefully increase t he underst andabilit y of t he
t ext despit e it is incorrect from point of view of 3GPP st andards.
UMTS Signaling
3 .1 I UB - N OD E B SETUP
A Node B Set up needs t o be perform ed if a new Node B has been inst alled, changes in configurat ion have been
m ade or aft er a syst em reset ( e.g. for inst allat ion of a new soft ware v ersion) . To announce t hese changes t o
t he net work t he Node B init iat es t he Set up scenario.
3 .1 .1 Ove r vie w
Figure 3 1 - NodeB Set up Overview
I f a Node B is set up against a Radio Net work Cont roller ( RNC) t his w ill happen in t hree st eps.
St e p 1 :
The Node B request s t o be audit ed by t he RNC. During t he audit t he RNC is inform ed how m uch ( j ust one or
m ore) cells belonging t o t he Node B and which local cell ident ifiers t hey have.
St e p 2 :
For each cell a Cell Set up is perform ed by t he RNC. During t he Cell Set up t he physical ( radio int erface) channels
are param et erized. These channels are m andat ory in case of a User Equipm ent ( UE) init ial access. I n ot her w ords:
if t hey are not available it is im possible for t he UE aft er it is sw it ched on t o get access t o t he net work via t he
radio int erface.
St e p 3 :
The com m on t ransport channels Paging Channel ( PCH) , Forward Access Channel ( FACH) and Random Access
Channel ( RACH) are set up and opt ionally param et erized in each cell of t he new Node B. On I ub int erface t hese
com m on t ransport channels are carried by AAL2 connect ions on ATM lines. ATM/ AAL2 header values
( VPI / VCI / CI D) are im port ant , because w it hout know ing t hem it is im possible t o m onit or signaling and dat a
t ransport on PCH, RACH and FACH. I f t hese channels are not m onit ored som e of t he m ost im port ant m essages
for call set up and m obilit y m anagem ent procedures like Paging m essages, RRC Connect ion Set up et c. w ill be
m issed in call t races. Once t he AAL2 connect ion for a com m on t ransport channel is inst alled during Node B set up
it w ill not be released unt il t his Node B is t aken out of service or reset .
UMTS Signaling
3 .1 .2 M e ssa ge Flow
Figure 3 2 - NodeB Set up Call Flow 1/ 4
The Node B Set up scenario is execut ed w hen a new Node B is t aken int o Serv ice or aft er reset .
Wit h audit Required m essage t he Node B request s an audit sequence by RNC. One audit sequence consist s of one
or m ore audit procedures ( our exam ple: one) . Audit Required procedure code is t ransm it t ed in a NBAP Class 2)
Elem ent ary procedure w it hout response ( connect ionless) . Hence, longTransact ionI D has no m eaning ( value is 0)
N BAP UL init iat ingMessage I d- a u dit Re qu ir e d ( longTransAct ionI D= a)
Audit procedure belongs t o NBAP Class 1 Elem ent ary Procedures w it h response ( connect ion- orient ed) . Bot h,
I nit iat ing Message and Successful Out com e are linked w it h t he sam e longTransact ionI D value b.
N BAP DL init iat ingMessage I d- a u dit ( longTransAct ionI D= b)
N BAP UL successfulOut com e I d- a u dit ( longTransAct ion I D= b, id- local Cell I D s= { 0,1,2,...} )
Wit h SuccessfulOut com e response of t he audit procedure t he RNC is inform ed how m any cells belong t o t he Node
B, which is audit ed and a local Cell- I D is assigned by t he Node B t o each of it s cells. I n addit ion for all cells power
consum pt ion law values for com m on and dedicat ed channels are report ed t o t he RNC, so t hat it is from now on
able t o cont rol t he power resources of each cell as one of t he m ost crit ical param et ers for UMTS air int erface
operat ion.
UMTS Signaling
Message Exam ple 3 1: Ext ract NBAP SuccessfulOut com e ( id- audit )
N ot e : The crit icalit y inform at ion elem ent indicat es for each param et er in t he m essage how a peer ent it y t hat
receives t his m essage shall react if t he param et er is not known on receiver side.
I n t he next st ep it is possible t hat fram ing prot ocol ( FP) Uplink and Downlink Node Synchronizat ion fram es can be
m onit ored on an AAL2 SVC if m anufact urer specific node Operat ion & Maint enance prot ocol is running on such an
AAL 2 channel. Synchronizat ion in case of Fram ing Prot ocol m eans alignm ent of fram e num bers and t im ers on
RNC and Node B side.
Th e follow in g pr oce du r e is e x e cu t e d pe r ce ll. I n t h e e x a m ple ca ll flow w e w ill h a ve a look a t t h e ce ll
w it h id- C- I D = e .
Wit h CellSet up m essage t he RNC assignes a Cell- I D ( id- C- I D) t o each single local Cell I D. Ot her im port ant
param et ers inside t he cell set up m essage are:
Prim ary Scram bling Code

Com m on Physical Channel I Ds of:
o Prim ary Synchronisat ion Channel ( P- SCH)
o Secondary Synchronisat ion Channel ( S- SCH)
o Prim ary Com m on Pilot Channel ( CPI CH)
o Com m on Cont rol Physical Channel ( CCPCH) t hat carries t he Broadcast Channel ( BCH)
The com m on physicals channels are necessary t o ensure successful init ial UE access. I n addit ion t he m essage
also cont ains inform at ion about UMTS absolut e radio frequency code num ber ( UARFCN) and m axim um
t ransm ission power of t he cell's ant enna as w ell as furt her ant enna param et ers. I n addit ion
N BAP DL init iat ingMessage I d- Ce llSe t u p ( longTransAct ionI D= c, I d- local Cell I D= { 0 } , id- C- I D= e , Prim ary
Scram bling Code, Com m on Phy sical Channel I nfo, Com m on Transport Channel I D of BCH)
UMTS Signaling
Message Exam ple 3 2: Ext ract NBAP I nit iat ing Message ( id- cellset up)
Node B confirm s t he t ransm ission of param et ers w it h:
N BAP UL successfulOut com e I d- Ce llSe t u p ( longTransAct ion I D= c)
Message Exam ple 3 3: Ext ract NBAP SuccessfulOut com e ( id- cellSet up)
UMTS Signaling
Opt ion a l:
I n t he Syst em I nform at ion Updat e t hat follows opt ionally t he Cell Set up a num ber of Syst em I nform at ion Blocks
( SI B) is t ransm it t ed. They cont ain param et ers like t im ers and count ers for changing RRC st at es and UMTS
Regist rat ion Area ( URA) I dent it y. A Mast er I nform at ion Block ( MI B) cont ains inform at ion, which of t he m any
different SI Bs are provided for a cell t hat is defined by it s Cell- I D. Syst em I nform at ion Updat e can also be
execut ed at t he end of t he whole Node B Set up procedure. I n t his case all necessary SI Bs are t ransm it t ed t o
Node B at once.
N BAP DL init iat ingMessage I d- Syst e m I n for m a t ion Upda t e ( longTransAct ionI D= d, id- C- I D= e , MI B + SI Bs) )
N BAP UL successfulOut com e I d- Syst e m I n for m a t ion Upda t e ( longTransAct ion I D= d) )
Message Exam ple 3 4: Ext ract of Mast er I nform at ion Block ( MI B) from NBAP Syst em I nform at ion Updat e
Message Exam ple 3 5: Ext ract of Syst em I nform at ion Block 11 ( SI B 11) t hat cont ains broadcast inform at ion for
cell ( re- ) select ion and int ra frequency cell m easurem ent
N ot e : To learn m ore about int ra frequency cell m easurem ent see chapt er RRC Measurem ent Procedures of t his
book.
UMTS Signaling
Aft er successful Cell Set up RNC st art s Com m on Transport Channel ( CTCH) Set up for each cell. A Com m on
Transport Channel Set up request is sent t o t he Node B t hat serves t he cell, w hich is regist ered on RNC side w it h
it s Cell I D. The m essage cont ains a list of param et ers for t he Transport Channel ( in t his case: PCH) . I t includes
inform at ion on which physical channel t he CTCH will be m apped ont o and beside ot her radio relat ed it em s ,
t he Com m on Transport Channel I D ( CTCH- I D) and t he Transport Form at Set ( TFS) of t he CTCH.
I n case of Com m on Transport Channel Set up for t he PCH t he m essage also cont ains t he param et ers for t he
appropriat e paging indicat or channel ( PI CH) .
N BAP DL init iat ingMessage I d- com m on Tr a n spor t Ch a n n e lSe t u p ( longTransAct ionI D= f, id- C- I D= e , Com m on
Physical Channel Type for CTCH Set up, PCH- Param et ers, com m onTransport ChannelI D= g, PI CH Param et ers)
UMTS Signaling
Message Exam ple 3 6: NBAP I nit ial Message ( Com m on Transport Channel Set up) for PCH
Message exam ple 6 show s a NBAP Com m on Transport Channel Set up Request for a paging channel w it h com m on
t ransport channel I D = 12. Transport blocks of t his PCH w ill have a size of 240 bit s and t here is only one
t ransport block sent ev ery 10 m illiseconds. To define t he first t ransport form at w it h 0 t ransport blocks
( 1.5.1.3.3.1.9.3.2.1.1.1) is m andat ory t o ensure synchronizat ion of t he t ransport channel also if no inform at ion
needs t o be current ly t ransm it t ed, a sit uat ion t hat is also know n as " silent m ode" .
To provide redundancy on radio int erface a convolut ional code w it h a coding rat e of is used. This m eans: for
every real bit of PCH inform at ion t wo bit s of inform at ion are sent on radio int erface t o decrease t he num ber of
t ransm ission errors on air. The addit ional CRC size of PCH fram es is 16 bit . The PCH in t he exam ple w ill be
m apped ont o a secondary com m on cont rol physical channel ( S- CCPCH) w it h physical channel I D = 10 t hat can be
ident ified on radio int erface using downlink channelizat ion code = 4. Relat ed t o t his PCH is a Paging I ndicat ion
Channel ( PI CH) t hat has com m on physical channel I D = 11 and is encoded using downlink channelizat ion code =
3.
Aft er t he m essage is sent RNC await s t he appropriat e Com m on Transport Channel Set up Response:
N BAP UL successfulOut com e I d- com m on Tr a n spor t Ch a n n e lSe t u p ( longTransAct ion I D= f,
com m onTransport ChannelI D= g, bindingI D= h )
The Node B answers w it h a NBAP Successful Out com e m essage including t he sam e procedure code " Com m on
Transport Channel Set up" and t he sam e CTCH- I D. I n addit ion a binding- I D ( bind- I D) is prov ided.
UMTS Signaling
Message Exam ple 3 7: NBAP SuccessfulOut com e ( Com m on Transport Channel Set up)
This binding- I D connect s t he NBAP lay er w it h t he ALCAP funct ion t hat is realized in our exam ple m essage flow by
an AAL2L3 signaling procedure. However, som e m anufact urers have int egrat ed t he ALCAP funct ion in t heir
( propriet ary) NBAP soft ware. The advant age of such a solut ion is increased efficiency regarding t he usage of
net work resources and a m ost likely fast er set up of AAL2 SVC. The disadvant age of any propriet ary solut ion is
t hat it ant icipat es deploym ent of m ult i- vendor env ironm ent for net work operat ors, because int eroperabilit y
bet ween net work nodes of different m anufact ures becom es quit e im possible.
I f AAL2L3 is used t he value of t he binding I D can be found back as Serv ed User Generat ed Reference ( SUGR) in
t he AAL2L3 Est ablish Request ( ERQ) m essage.
I t m ay happen t hat bind- I D and SUGR are decoded in different form at s since NBAP specificat ion defines binding
I D as a 4 oct et st ring only w hile AAL2L3 says t he coding of SUGR depends on im plem ent at ion. Hence, for
exam ple t he NBAP binding I D could be shown in hexadecim al form at while t he SUGR is decoded as a decim al
num ber - but t he value rem ains t he sam e. This also t rue for our m essage exam ples: 0 1 8 0 ( hex) = 3 8 4 ( dec) !
ALCAP DL ERQ ( Originat ing Signal. Ass. I D= i, AAL2 Pat h= k , AAL2 Channel id= l, serv ed user gen reference= h )
ALCAP UL ECF ( Originat ing Signal. Ass. I D= m , Dest inat ion Sign. Assoc. I D= i,)
Message Exam ple 3 8: Ext ract from AAL2L3 ERQ

As already m ent ioned ALCAP/ AAL2L3 is used t o set up a Sw it ched Virt ual AAL2 Connect ion ( AAL2 SVC) . AAL2
SVC is required, because is w ill be t he physical lay er for t he com m on t ransport channel on I ub int erface, which is
not inst alled yet . Each AAL2 v irt ual connect ion is uniquely ident ified by:
ATM Virt ual Pat h I dent ifier ( VPI )

ATM Virt ual Channel I dent ifier ( VCI )
AAL2 Connect ion I dent ifier ( CI D)
The AAL2L3 Est ablish Request ( ERQ) sent by t he RNC includes already t wo im port ant param et ers:
Pat h- I D
Channel- I D ( Ch- I D)
UMTS Signaling
However, t he Pa t h - I D in t he ERQ m essage is n ot ide n t ica l wit h t he VPI ! I t is a point er t o an ent ry in a RNC
configurat ion t able. While t he Channel- I D of t he ERQ m essage w ill be used as value for AAL2 Connect ion I D ( CI D)
t he VPI / VCI com binat ion of t he ATM header can be found in t his configurat ion t able. I t only depends on t he
m anufact urer specific im plem ent at ions of t he sw it ching soft w are how Pat h- I D and VPI / VCI are linked. The t able
below int roduces t hree t ypical exam ples:
Table 3 1 - Configurat ion Exam ple
On behalf of t hese exam ples it em erges v ery clearly t hat Ch- I D and CI D w ill always have t he sam e value while
Pat h- I D and VCI m ay have t he sam e value or not hing in com m on at all. Hence, t h is Pa t h - I D in ERQ m e ssa ge
m u st be se e n a s a poin t e r t o a specific record in t he ATM configurat ion t able.
The AAL2L3 ERQ m essage is answered by a Est ablish Confirm ( ECF) m essage. Originat ing/ Dest inat ion Signaling
Associat ion I D ( OSAI D/ DSAI D) links bot h AAL2L3 m essages. The OSAI D value sent w it h ERQ com es back as
DSAI D value w it h t he ECF m essage.
Message Exam ple 3 9: Ext ract from AAL2L3 ECF
Finally Fram ing Prot ocol Synchronizat ion fram es are seen on t he VPI / VCI / CI D t hat carries t he Paging Channel
( PCH) .
FP Uplin k a n d D ow n lin k Synch r on isa t ion ( in AAL2 Pat h/ Connect ion= k [ VPI / VCI ] and AAL2
Connect ionI D= l [ CI D ] )
Message Exam ple 3 10: Fram ing Prot ocol Downlink Synchronizat ion
RNC st art s sending DL synchronizat ion fram es t o t he Node B and Node B responds w it h UL synch fram es. UL
synchronizat ion fram es include t he Tim e of Arrival ( ToA) value relat ed t o t he Connect ion Fram e Num ber ( CFN)
value included in bot h of t he synch fram es. Based on t he ToA t he RNC adj ust s t he sending t im e inst ant of t he
next DL synchronizat ion fram e. The connect ion is sy nchronized when t he DL sy nch fram es are received at Node B
w it hin t he predefined t im ing w indow i.e. t he ToA values in UL synch fram es are w it hin t he set boundaries. Aft er
t his st art up sy nchronizat ion t he PCH can be used t o t ransm it paging m essages.
N ot e : I n addit ion t o t he Paging Channel ( PCH) t he Paging I ndicat ion Channel ( PI CH) is t aken int o serv ice as well.
The PI CH is used t o carry t he paging indicat ors. The PI CH is always associat ed wit h an S- CCPCH t o which a PCH
UMTS Signaling
t ransport channel is m apped. I f a paging indicat or is set t o " 1" it is an indicat ion t hat UEs associat ed w it h t his
paging indicat or should read t he corresponding fram e of t he associat ed S- CCPCH. The PI CH param et ers can be
found in t he sect ion aft er t he PCH param et ers in t he first NBAP m essage of PCH Com m on Transport Channel
Set up.
Opt ional once again a Syst em I nform at ion Updat e procedure m ay follow PCH set up t o t ransm it SI B 5 inform at ion
t o Node B. SI B 5 cont ains inform at ion about physical channels PI CH, PRACH and AI CH as well as t ransport form at
set definit ions of PCH, RACH and FACH t hat w ill be broadcast ed on radio int erface. I ndeed, SI B 5 would fill up t he
next few pages if w e would giv e a m essage exam ple, but from point of v iew of a signaling expert it is drop- dead
gorgeous
N BAP DL init iat ingMessage I d- Syst e m I n for m a t ion Upda t e ( longTransAct ionI D= n , id- C- I D= e , MI B + SI B 5)
N BAP UL successfulOut cm e I d- Syst e m I n for m a t ion Upda t e ( longTransAct ion I D= n )
The set up procedure for t he Forward Access Channel ( FACH) deals w it h t he sam e m essages for com m on
t ransport channel set up in NBAP and ALCAP layer t hat have been already int roduced in t he PCH set up. How ever,
t here m ay be som e differences if m ore t han j ust one FACH is inst alled. Depending on m anufact urer- specific
soft ware im plem ent at ion, it is possible t hat t w o FACHs w it h different TFSs w ill be used, e.g., t o have one FACH
for RRC signaling and t he ot her one for t ransm it t ing I P pay load fram es in downlink direct ion when UE is in RRC
CELL FACH st at e ( see Sect ions 3.8 and 3.9) .
N BAP DL init iat ingMessage I d- com m on Tr a n spor t Ch a n n e lSe t u p ( longTransAct ionI D= q, id- C- I D= e , FACHParam et ers: com m onTransport ChannelI D= o + Transport Form at Set 1, com m onTransport ChannelI D= p +
Transport Form at Set 2)
UMTS Signaling
Message Exam ple 3 11: NBAP I nit iat ing Message ( Com m on Transport Channel Set up) for t wo FACH
Com pared t o t he com m on t ransport channel set up for PCH it is evident if one looks at bot h m essage exam ples
t hat PCH and FACHs are m apped ont o separat e secondary CCPCH ( which is an opt ion, because 3GPP defines t hat
in general one S- CCPCH can serve all com m on t ransport channels) . The downlink scram bling code is t he sam e,
because t he FACHs are est ablished in t he sam e cell as PCH before, but com m on physical channel I D and DL
channelizat ion code num ber are different .
I f t he t ransport form at set s of t he t wo FACH are com pared t o each ot her it em erges t hat bot h set s t ransm it
blocks in t he sam e t im e int erval of 10 m s, but block size is different . The fast er channel sends larger t ransport
blocks ( 360 bit com pared t o 168 bit ) w it hin t he sam e t im e int erval of 10 m s. The larger blocks are sent w it h
m ore redundancy using a t urbo coding w it h coding rat e 1/ 3 ( 3 radio bit s cont ain one bit of FACH inform at ion)
while for sm aller blocks ( 168 bit ) convolut ional coding w it h rat e is enough. Most likely t he FACH w it h larger
blocks w ill be used for downlink t ransm ission of I P payload if necessary, t he ot her one carries RRC signaling of
t he connect ion t hat usually does not require highest dat a t ransm ission rat es.
UMTS Signaling
N BAP UL successfulOut com e I d- com m on Tr a n spor t Ch a n n e lSe t u p ( longTransAct ion I D= q,

com m onTransport ChannelI D= o, bindingI D= r , com m onTransport ChannelI D= p, bindingI D= v)
Already w it h t he NBAP Com m on Transport Channel Set up request m essage t w o different FACHs w it h t heir
Com m on Transport Channel I Ds ( CTCH- I D) and Transport Form at Set s ( TFS) are defined. The TFS param et ers
indicat e differences in t ransm ission qualit y and t ransm ission speed.
For each FACH a new binding I D is assigned, which leads t o t wo independent Est ablish procedures in
ALCAP/ AAL2L3. The result is t hat bot h FACHs w ill have t heir ow n physical t ransport layer in form of an AAL2
sw it ched virt ual connect ion.
ALCAP DL ERQ ( Originat ing Signal. Ass. I D= s, AAL2 Pat h= k , AAL2 Channel id= u , served user gen reference= r )
ALCAP UL ECF ( Originat ing Signal. Ass. I D= t , Dest inat ion Sign. Assoc. I D= s,)
FP FACH1 D ow n lin k Syn ch r on iza t ion ( in AAL2 Pat h= k and AAL2 Channel id= u )
ALCAP DL ERQ ( Originat ing Signal. Ass. I D= w , AAL2 Pat h= k , AAL2 Channel id= x , served user gen reference= v)
ALCAP UL ECF ( Originat ing Signal. Ass. I D= x , Dest inat ion Sign. Assoc. I D= w ,)
FP FACH2 D ow n lin k Syn ch r on iza t ion ( in AAL2 Pat h= k and AAL2 Channel id= x)
Opt ional possible:
N BAP DL init iat ingMessage I d- Syst e m I n for m a t ion Upda t e ( longTransAct ionI D= y, id- C- I D= e , MI B + SI Bs)
N BAP UL successfulOut com e I d- Syst e m I n for m a t ion Upda t e ( longTransAct ion I D= y)
The Ra n dom Acce ss Ch a n n e l ( RACH) is set up in t he sam e w ay as t he PCH. The only difference t o PCH and
FACH set up is t hat aft er AAL2L3 Est ablish Confirm ( ECF) no Fram ing Prot ocol Synchronizat ion fram es are sent .
UMTS Signaling
Message Exam ple 3 12: NBAP I nit iat ing Message ( Com m on Transport Channel Set up) for RACH
RACH is m apped ont o physical random access channel ( PRACH) t hat has it s own uplink scram bling code. The
t ransport form at set s of RACH correspond t o t hose defined for FACH( s) before ( t ransport block size eit her 168 or
360 bit ) . The m essage also cont ains acquisit ion indicat ion channel ( AI CH) param et ers.
The set up of t he Com m on Transport Channels is always com plet ed w it h at least one Syst em I nform at ion Updat e
procedure t hat is used t o t ransm it t o Node B all SI Bs t hat have not been sent yet . I t is also possible t hat som e
SI Bs will be ret ransm it t ed, especially SI B 5 t o updat e t he t ransport form at set set t ings of RACH t hat have not
been available in an earlier st age. I f t here hav e not been any SI B sent before t hey all w ill be sent .
As a rule Com m on Measurem ent I nit iat ion procedure for each single cell follow s. Since t here are m ost ly at least
t wo different com m on m easurem ent t ypes ( received- t ot al- wideband- power and t ransm it t ed- carrier- power) t here
w ill be t wo different Com m on Measurem ent I nit iat ion procedures per cell. I n addit ion t o received t ot al w ideband
power and t ransm it t ed carrier power Com m on Measurem ent I nt it iat ion m essage m ay also include inform at ion
about used m et hod and accuracy of locat ion m easurem ent .
The first init ializat ion is relat ed t o received t ot al w ideband pow er, a param et er t hat indicat es t he overall level of
all received signals in t he UMTS frequency band of t he cell. The m easurem ent result s of received t ot al w ideband
power are used by adm ission cont rol and packet scheduler funct ion of RNC t o ( re- ) calculat e t he allocat ed radio
bearers of all UEs in t he cell.
I n t he exam ple received t ot al w ideband power m easurem ent is init iat ed for cell w it h Cell- I D = e and an
appropriat e NBAP Com m on Measurem ent Report m essage w it h sam e m easurem ent - I D =
is expect ed ev ery 10
seconds.
N BAP DL init iat ingMessage I d- Com m on M e a su r e m e n t I n it ia t ion ( longTransAct ionI D= z, id- Measurem ent - I D
=
, id- Com m onMeasurem ent Obj ect Type- CM- Rqst - > c- I D= e , id- Com m onMeasurem ent Type = r e ce ive d- t ot a lw ide ba n d- pow e r , id- Report Charact erist ics: periodic 10 seconds)
A second m easurem ent init iat ion for t he sam e cell cont ains set t ings for t ransm it t ed carrier power m easurem ent .
This is t he TX power of t he cell's ant enna report ed in a range from 0 t o 100% . An appropriat e NBAP Com m on
Measurem ent Report m essage is expect ed every 1 second.
UMTS Signaling
N BAP DL init iat ingMessage I d- Com m on M e a su r e m e n t I n it ia t ion ( longTransAct ionI D= a a , id- Measurem ent - I D
= , id- Com m onMeasurem ent Obj ect Type- CM- Rqst - > c- I D= e , id- Com m onMeasurem ent Type = t r a nsm it t e dca r r ie r - pow e r , id- Report Charact erist ics: periodic 1 second)
N ot e : 3GPP 25.133 recom m ends for all NBAP com m on m easurem ent t ypes a report ing int erval of 100 m s, but as
long as not m any subscribers are seen in t he present UMTS net works t he report ing int ervals are longer ( in som e
cases up t o 2 m inut es) , because as long as only 1, 2 or 3 users are served by one cell t here w ill be no significant
changes in m easurem ent result s.
Finally t he Node B Set up procedure is finished w it h t he confirm at ion of NBAP Com m on Measurem ent I nit iat ion:
N BAP UL SuccessfulOut com e I d- Com m on M e a su r e m e n t I n it ia t ion ( longTransAct ionI D= z)
N BAP UL SuccessfulOut com e I d- Com m on M e a su r e m e n t I n it ia t ion ( longTransAct ionI D= a a )
UMTS Signaling
3 .2 I UB - I M SI / GPRS ATTACH PROCED URE

A Locat ion Updat e ( I MSI At t ach) and/ or At t ach ( for GPRS) procedure is perform ed if a UE is sw it ched on in a
defined area of t he net work. The Locat ion Updat e procedure as known from GSM st andards is also used t o
indicat e t he change of a locat ion area aft er t he UE is I MSI at t ached t o t he CS core net work dom ain.
3 .2 .1 Ove r vie w
Figure 3 6 I ub I MSI / GPRS At t ach Procedure Overview

A Locat ion Updat e Type ( LUT) ident ifier in t he Non- Access St rat um ( NAS) m essage shows if t he t ype of locat ion
updat e is:
I MSI at t ach
Norm al locat ion updat ing
Periodic locat ion updat ing
Before NAS m essages can be exchanged bet w een t he USI M and t he dat abases in t he core net work dom ains, it is
necessary t o build up a RRC connect ion bet w een t he UE and t he RNC:
St e p 1 :
A RRC Connect ion Request is sent from UE t o RNC.
St e p 2 :
Radio resources m ust be prov ided for t he set up of a dedicat ed ( t ransport ) channel ( DCH) t hat carries t he logical
dedicat ed cont rol channels ( DCCHs) . The DCCHs are used for t ransm ission of RRC and NAS m essages.
St e p 3 :
As long as DCH w it h DCCHs are not available t he signaling m essages for RRC connect ion set up are t ransm it t ed
using com m on t ransport channels RACH ( uplink) and FACH ( downlink) . RRC Connect ion Set up is com plet ed aft er
DCH set up.
St e p 4 :
Locat ion Updat e/ GPRS At t ach NAS m essages em bedded in RRC Direct Transfer m essages are sent from UE t o
RNC and t hen forwarded t o CS or PS Dom ain v ia I u int erfaces. The dom ains eit her accept or rej ect t he At t ach
request s com ing from t he UE. An appropriat e answer m essage is sent and once again included in RRC m essages
t ransport ed from RNC t o UE.
UMTS Signaling
St e p 5 :
RRC connect ion is released; DCH and Radio link are delet ed.
I ub CS I M SI At t a ch / Loca t ion Upda t e
The follow ing exam ple shows a Locat ion Updat e general procedure t owards CS core net work dom ain as it is seen
in all t hree cases: I MSI At t ach, Norm al and Periodic Locat ion Updat e.
As in all ot her cases of Access St rat um signaling exchange bet ween UE and RNC it st art s w it h a RRC Connect ion
Request sent by UE. Since t here is st ill no dedicat ed t ransport channel available yet t his first m essage is sent on
Com m on Cont rol Channel ( logical channel) t hat is m apped ont o Random Access Channel ( RACH) . RACH prov ides
t ransport serv ices for dat a and signaling in uplink direct ion.
Figure 3 7 I ub I MSI At t ach Procedure Call Flow 1/ 4
RACH : UL RLC TMD r r cCon n e ct ion Re qu e st ( I M SI or TM SI , est ablishm ent Cause= r e gist r a t ion)
On air int erface t he rrcConnect ionRequest m essage is t ransm it t ed in Radio link Cont rol ( RLC) t ransparent m ode
( TMD) . The m essage cont ains a UE ident ifier t hat can be eit her I nt ernat ional Mobile Subscriber I dent it y ( I MSI ) or
Tem porary Mobile Subscriber I dent it y ( TMSI ) if a TMSI was provided by Visit or Locat ion Regist er ( VLR) before.
This UE ident ifier is necessary, because RACH is used by all users of t he cell w here t he UE is locat ed and t here is
st ill no RNTI assigned t o ident ify t his UE on com m on air int erface channels uniquely.
The next st ep is t he Radio Link Set up procedure perform ed by NBAP prot ocol. The radio link set up is used t o
est ablish t he necessary air int erface resources for a dedicat ed channel ( DCH) t hat is relat ed t o a Node B
Com m unicat ion Cont ext in t he Node B. Since t his is NBAP Class 1 elem ent ary procedure I nit iat ingMessage and
Successful Out com e are linked w it h a Transact ionI D ( in t his case: longTransAct ionI D) . A pair of CRNC
Com m unicat ion Cont ext I D ( CRNCCC- I D) and Node B Com m unicat ion Cont ex t I D ident ifies all NBAP m essages
regarding a single UE exchanged bet ween t his Node B and t his single ( C) RNC during t he whole LU procedure.
Also t he cell I D ( c- I D) of t he used cell is applied and t he radio link I D of t his link for t his specific UE. A pair of
uplink Scram bling Code ( ScrCd) and downlink Channelisat ion Code ( ChCd) is used t o ident ify uniquely all
m essages from t his UE on air int erface. I t describes a dedicat ed physical channel ( DPCH) on radio int erface ( or t o
say it m ore exact ly: a DPCH in downlink and a pair of separat ed dedicat ed phy sical dat a channel/ dedicat ed
physical cont rol channel [ DPDCH/ DPCCH] in uplink direct ion) . As shown lat er t his dedicat ed physical channel w ill
carry dedicat ed t ransport channels ( DCHs) . For t he DCHs t here need t o be defined uplink and downlink t ransport
form at set s ( TFS) in t he Radio link set up request . Logical dedicat ed cont rol channels ( DCCHs) t hat t ransport s
RRC m essages including NAS m essages w ill be m apped ont o t hese DCHs. There is also a downlink scram bling
UMTS Signaling
code assigned in t he sam e m essage, but t his is j ust an ident ifier of t he cell ant enna t hat sends t he signals on
radio int erface. From t he point of view of UE t his param et er is of course very im port ant , but for signaling analysis
on I ub it is not useful, because it cannot help filt ering out m essages relat ed t o a single UE on I ub int erface. That
is t he reason w hy DL Scram bling code is not highlight ed in our call flow exam ples. For t he Uplink Channelizat ion
Code only t he code lengt h is predefined by t he net work. The code it self is select ed by UE using a random
procedure. I n t he uplink direct ion t he spreading code can indeed only be used for signal spreading, but
ident ificat ion funct ion is lim it ed. Only DPCCH and DPDCH of a single UE can be dist inguished by different uplink
spreading codes. Uplink channels of different UEs cannot be dist inguished, because t he ort hogonalit y concept of
t he spreading code t able requires synchronizat ion of all senders for errorfree code det ect ion and different UEs
cannot be synchronized t o each ot her.
N BAP DL init iat ingMessage I d- r a dioLin k Se t u p ( longTransAct ionI D= c, id- CRNC- Com m unicat ionCont ext I D= d,
ULscram blingCode/ DLchannelisat ionCode= b/
Set , DL Transport Form at Set )
, DCH- SpecificI nform at ionList : DCH- I D= z, UL Transport Form at
Message Exam ple 3 13: NBAP I nit iat ing Message ( Radio link set up)
UMTS Signaling
The answ er t o NBAP I nit iat ing Message is t he successful out com e:
N BAP UL successfulOut com e I d- r a dioLin k Se t u p ( longTransAct ion I D= c, id- CRNC- Com m unicat ionCont ext I D= d,
DCH- I D= z, bindingI D= e , NodeBCom m unicat ionsCont ext - I D= p)
As already seen in t he set up of Com m on Transport Channels t he bindingI D links t he NBAP procedure w it h t he
appropriat e ALCAP procedure. I n addit ion t he Node B Com m unicat ion Cont ext I D is sent t o t he RNC.
Message Exam ple 3 14: NBAP Successful Out com e ( Radio link set up)
Furt her param et ers in t he successful out com e of radio link set up are t he radio link I D ( rL- I D) and radio link set I D
( rL- Set - I D) t hat w ill becom e bot h im port ant for signaling analysis of soft handovers. I n addit ion t he Node B
report s an act ual received- t ot al- wide- band- power m easurem ent result t o t he RNC. A specific indicat or shows if
SSDT feat ure is support ed by Node B or not .
The ALCAP Est ablish procedure works in t he sam e way as seen during Com m on Transport Channel set up. The
served user generat ed reference has t he sam e value as t he bindingI D in Radio link set up response.
ALCAP DL ERQ ( Originat ing Signal. Ass. I D= f, AAL2 Pat h= g, AAL2 Channel id= h , served user gen reference= e )
ALCAP UL ECF ( Originat ing Signal. Ass. I D= i, Dest inat ion Sign. Assoc. I D= f,)
Aft er ALCAP est ablish procedure t he AAL 2 SVC for t he Dedicat ed Channel ( DCH) bet ween UE and RNC on I ub
int erface is t aken int o serv ice w it h a synchronizat ion procedure. The VPI / VCI / CI D values correspond t o Pat h- I D
and Channel- I D in ALCAP ERQ m essage as described for com m on t ransport channel set up before.
D CH in AAL2 Pat h= g and Connect ion= h : downlink and uplink synchronizat ion FP fram es
UMTS Signaling
Now t he resources for t he DCH are est ablished, but st ill t he UE is in CELL_FACH st at e. To change from
CELL_FACH t o CELL_DCH st at e it wait s for an incom ing m essage t hat com plet es t he DCH assignm ent by t elling
t he UE ( ident ified by it s I MSI or TMSI ) , which physical and logical resources t hat m eans: which dedicat ed
physical channels ident ified by a pair of UL scram bling code/ DL channelisat ion code and which Signaling Radio
Bearers ( logical cont rol channels) m apped ont o which dedicat ed t ransport channel DCH - hav e been prov ided for
t he request ed RRC connect ion. I n addit ion t o t he DL channelisat ion code t he prim ary scram bling code ( PScrCd) of
t he cell is included. The m essage called RRC Connect ion Set up is sent on Forw ard Access Channel ( FACH) in
downlink direct ion:
FACH : DL RLC UMD r r cCon n e ct ion Se t u p ( rrc- Transact ion I dent ifier [ rrc- TAI D] = a, I M SI or TM SI , u- RNTI = r ,
ULscram blingCode/ DLchannelisat ionCode= b/ , Prim ary Scram bling Code =
Bearers)
, MappingI nfo for Signaling Radio
The rrcConnect ionSet up m essage ( fig. 3.8) cont ains a rrcTransact ionI D, t hat w ill be used t o ident ify all follow ing
RRC m essages of t his RRC Set up procedure. rrcTransact ionI D value is only v alid for a single RRC procedure of a
single UE. That is t he reason w hy m ost RRC m essages of t he sam e connect ion have t he sam e rrcTransact ionI D
value.
ULscram blingCode/ DLchannelisat ionCode in t his RRC connect ion set up are t he sam e as in NBAP Radio link set up
procedure before. The difference is t hat NBAP is t he " language" in t he dialog bet ween Node B and ( C) RNC while
RRC is " spoken" bet ween UE and ( S) RNC. So we have t wo different com m unicat ions w it h different part ners, but
t hey are " t alking" about t he sam e t opic!
Aft er receiv ing RRC Connect ion Set up m essage t he UE know s, which physical resources ( DPCH) have been
provided for it t o be used on radio int erface. I MSI or TMSI is used t o ensure correct UE ident ificat ion and in
addit ion a u- RNTI is assigned. U- RNTI consist s of: Serving RNC ident it y ( SRNC- I D) and SRNC Radio Net work
Tem porary I dent it y ( S- RNTI ) , which is a 20 bit random num ber t hat ident ifies a UE w it h a RRC connect ion w it hin
t he UTRAN uniquely.
Furt herm ore rrcConnect ionSet up m essage cont ains t he channel m apping info for t he Signaling Radio Bearers
( SRBs) . Each SRB st ands for a logical channel ( DCCH) t hat carries specific signaling m essages, e.g. t here are
different channels used for RRC cont rol m essages and RRC fram es t hat cont ain NAS m essages. The used channel
is lat er indicat ed by C/ T field value of MAC Dat a PDU.
UMTS Signaling
Message Exam ple 3 15: Ext ract from RRC Connect ion Set up
The m essage ex am ple shows a very com prehensiv e ext ract of RRC connect ion set up m essage cont ent s. As seen
init ial user equipm ent ident ifier is I MSI , which is em bedded in t he m essage digit by digit ( in t he exam ple only t he
first 3 digit s [ MCC] are show n) . Then w e see rrcTransact ionI D and u- RNTI . The RRC st at e indicat or orders t he UE
t o change it s st at e int o CELL_DCH aft er t he dedicat ed resource inform at ion w as received. Then follows radio
bearer m apping info: all logical channels ( DCCHs) are m apped ont o a dedicat ed t ransport channel ( DCH)
ident ified by RRC t ransport channel ident it y = 32. How ever, if look ing back at NBAP Radio link set up procedure it
em erges t hat CRNC set up a dedicat ed channel w it h DCH- I D = 31. Why t his difference?
As writ t en in 3GPP 25.433 ( NBAP) : " The DCH I D is t he ident ifier of an act iv e dedicat ed t ransport channel. I t is
unique for each act ive DCH am ong t he act iv e DCHs sim ult aneously allocat ed for t he sam e UE."
DCH I D in NBAP is described as I NTEGER ( 0255) .
RRC ( 3GPP 25.331) defines t he param et er Transport Channel I dent it y as " t he I D of a DCH t hat ... Radio Bearer
could be m apped ont o."
Transport Channel I D in RRC is described as I NTEGER ( 132) .
I ndeed, t here is a correlat ion bet ween bot h ident it ies despit e t he num ber range is different . As a rule it can be
m onit ored t hat a DCH t hat was set up w it h DCH I D = 31 e.g. during NBAP Radio link set up procedure w ill be
ident ified in RRC Radio Bearer Set up by Transport Channel I d = 32, t his m eans: RRC Transport Channel I dent it y
= NBAP DCH I D + 1. How ever, not all equipm ent m anufact urers adhere t o t his unwrit t en rule. There hav e been
also cases m onit ored in t he field where values of RRC and NBAP are equal. That could becom e anot her reason for
int eroperabilit y problem s in a m ult i- vendor env ironm ent .
Signaling radio bearer I D in RRC Connect ion
SRB defined ( only t wo of t hem are shown in
( DCCH) : for signaling m essages t ransport ed
( SRB 2) , for NAS signaling wit h high priorit y
Set up exam ple is t he sam e as logical channel I D. I n t ot al t here are 4

m essage exam ple) . Each SRB represent s a dedicat ed cont rol channel
in RLC unacknowledged m ode ( SRB 1) , for RLC acknowledged m ode
( SRB 3) and for NAS signaling w it h low er priorit y ( SRB 4) .
UMTS Signaling
Unfort unat ely also t he num bering schem e for SRBs som et im es depends on t he vendor t here are cases where
radio bearer I D 2, 3, 4 and 5 are used inst ead of 1, 2, 3 and 4.
Finally one can find uplink scram bling code and uplink channelizat ion code lengt h of t he dedicat ed physical
channels in t he m essage as w ell as dow nlink spreading fact or ( equal t o spreading code lengt h) and downlink
spreading code num ber of downlink DPCH. Using t his inform at ion t he UE is able t o find and use t he already
provided dedicat ed physical channel resources on radio int erface.
I n next st ep NBAP Radio link Rest orat ion m essage indicat es t hat UE and Node B are now synchronized on air
int erface. I n ot her words: t he UE found t he provided dedicat ed physical channels. CRNC Com m unicat ion Cont ext
I D ident ifies once again t he NBAP signaling connect ion regarding t his single UE.
N BAP UL init iat ingMessage id- r a dioLin k Re st or a t ion ( short TransAct ion I D= j , id- CRNCCom m unicat ionCont ext I D= d)
Now, aft er synchronizat ion on air int erface t he DCH is available and RRC m e ssa ge s ( RLC AMD) are carried on
I ub int erface in AAL2 Pat h= g and Connect ion= h :
DL RLC AMD r r cM e a su r e m e n t Con t r ol
One or m ore RRC Measurem ent Cont rol m essages are sent t o init ialize RRC m easurem ent funct ions on UE side.
To learn m ore about t he specific opt ions of t his m essage read RRC Measurem ent chapt er.
UL RLC AMD r r cCon n e ct ion Se t u pCom ple t e ( rrc- Transact ionI dent ifier= a ) confirm s t he RRC connect ion
est ablishm ent . The rrc- Transact ionI dent ifier links t his m essage t o t he previous RRC Connect ion Set up t hat was
sent on FACH. I n case t hat ciphering w ill be sw it ched on t he m essage cont ains t he st art values for CS and PS
core net work dom ain t hat are necessary t o init ialize encrypt ion funct ions.
Then t he t ransport of NAS m essages st art s. They are sent on DCH em bedded in RRC m essages. The funct ion and
param et ers of NAS m essages are well known from GSM st andards, so only a general descript ion is giv en.
UL init ialDirect Transfer LUREQ Locat ion Updat e Request is sent t o VLR t o indicat e change of Locat ion or I MSI
at t ach of UE. The Message cont ains UE ident it y ( I MSI or TMSI ) and Locat ion Area I nform at ion ( LAI ) . Beside t his a
num ber of MS Classm ark elem ent s are included t hat inform t he net work about capabilit ies like support ed
algorit hm s for ciphering and int egrit y prot ect ion.
Downlink Direct Transfer AUTREQ Aut hent icat ion Request is sent by net work t o check UE ident it y.
UplinkDirect Transfer AUTREP Aut hent icat ion Response cont ains Signed Response ( SRES) I nform at ion Elem ent
const ruct ed by UE t hat is com pared w it h Expect ed Response ( XRES) in VLR. I f SRES = XRES aut hent icat ion UE
was aut hent icat ed successfully.
I f ciphering was request ed by net work t he RRC Se cu r it y M ode Com m a n d m essage is used t o st art / st op
ciphering and t o st art or m odify int egrit y prot ect ion.
RRC Se cu r it yM ode Com ple t e m essage confirm s t he configurat ion of ciphering and/ or int egrit y prot ect ion. Here
a list can be found t hat shows for each signaling radio bearer t he RLC sequence num ber of t he first ciphered RLC
fram e.
UMTS Signaling
Now t he t ransfer of NAS m essages can be cont inued.

RRC DownlinkDirect Transfer LUACC ( opt . TMSI ) or LUREJ: Locat ion Updat e Accept or Locat ion Updat e Rej ect
These m essages show if t he Locat ion Updat e w as accept ed by t he core net work dom ain or rej ect ed. I f t he
request was accept ed a new TMSI m ay be allocat ed t o t he UE. This always happens in case of I MSI at t ach, but in
case of norm al or periodic locat ion updat e it is j ust an opt ion. I n case t hat t he locat ion updat e is rej ect ed t he
LUREJ m essage cont ains a cause value t hat indicat es t he reason for rej ect ion.
N ot e : I n general all request ed act ions can eit her be accept ed or rej ect ed by t he core net work. I n t he sam e w ay
as described for locat ion updat e request also GPRS at t ach request , connect ion m anagem ent service request t hat
st art s a voice call or SMS or act ivat e PDP cont ext request can be eit her accept ed or rej ect ed. A rej ect m essage in
such cases oft en indicat es a gap in t he net work t hat requires t roubleshoot ing t o be resolv ed. For t his reason such
procedures are oft en called " bad case" inst ead of a " good case" when t he request is accept ed.
I f a new TMSI was assigned w it h LUACC m essage a RRC UplinkDirect Transfer TMSI Reallocat ion Com plet e
( TRCM P) m essage is send by t he UE t o com plet e t he m essage exchange w it h t he core net w ork dom ain. Now t he
m obile is using t he ( new) TMSI .
Then it is not longer necessary t o keep t he RRC connect ion act ive, because t he locat ion updat e procedure is
finished. So RRC connect ion is released w it h:
( RLC UMD) DL RRC r r cCon n e ct ion Re le a se ( rrc- Transact ion I dent ifier [ rrc- TAI D] = a )
( RLC UMD) UL RRC r r cCon n e ct ion Re le a se Com ple t e ( rrc- Transact ion I dent ifier [ rrc- TAI D] = a )
On behalf of t he next t wo m essages

N BAP DL init iat ingMessage I d- Ra dioLin k D e le t ion ( short TransAct ion I D= j , id- CRNCCom m unicat ionCont ext I D= d, NodeBCom m unicat ionsCont ext - I D= p)
and
N BAP UL successfulOut com e I d- RadioLinkDelet ion ( short TransAct ion I D= j , id- CRNCCom m unicat ionCont ext I D= d)
t he radio resources for t he DCH/ DCCH are released. And w it h
ALCAP DL RELease Request ( Dest . Sign. Assoc. I D= i)
ALCAP UL Re Lease Confirm ( Dest . Sign. Assoc. I D= f)
t he physical lay er ( AAL2 SVC) for t his DCH on I ub int erface is released, t oo.
I u b PS At t a ch
I n case of GPRS At t ach t he RRC connect ion set up is t he sam e as for CS locat ion updat e. Depending on t ype and
feat ures of t he UE it is possible t o have a com bined I MSI / GPRS at t ach. I n t his case t he sam e DCHs/ DCCHs as in
locat ion updat e procedure exam ple would be used for t ransport of NAS m essages. NAS m essage w ill be
forwarded by SRNC t o Serv ing GPRS Support Node ( SGSN) t hat has it s own Locat ion Regist er funct ion
( som et im es called SGSN Locat ion Regist er [ SLR] ) .
UMTS Signaling
Figure 3 11 I ub GPRS At t ach Procedure Call Flow 1/ 3
M e ssa ge s in de t a il:
RACH : UL RLC TMD rrcConnect ionRequest ( I MSI or P- TMSI , est ablishm ent Cause= r e gist r a t ion)
Set , DL Transport Form at Set )
, DCH- SpecificI nform at ionList : DCH- I D= z, UL Transport Form at
DCH- I D= z, bindingI D= e , NodeBCom m unicat ionsCont ext - I D= p)
D CH in AAL2 Pat h= g and Channel= h w ill be init ialized by sending downlink and uplink synchronizat ion FP
fram es.
UMTS Signaling
Since t he RRC connect ion w ill be used for a GPRS At t ach t he P- TMSI ( packet TMSI ) w ill be used as t em porary
ident it y of t he UE in t he rrcConnect ionSet up m essage if any P- TMSI was assigned by SGSN locat ion regist er
funct ion before.
FACH : DL RLC UMD r r cCon n e ct ion Se t u p ( rrc- Transact ion I dent ifier [ rrc- TAI D] = a , I M SI or P- TM SI , uRNTI = r , ULscram blingCode/ DLchannelisat ionCode= b/
Signaling Radio Bearers)
,Prim ary Scram bling Code =
, MappingI nfo for
N BAP UL init iat ingMessage id- r a dioLin k Re st or a t ion ( short TransAct ion I D= j , id- CRNCCom m unicat ionCont exit I D= d)
Follow ing RRC m e ssa ge s ( RLC AMD) are carried on I ub int erface in AAL2 Pat h= g and Connect ion= h :
DL RLC AMD r r cM e a su r e m e n t Con t r ol ( rrc- Transact ionI dent ifier= a )
UL RLC AMD r r cCon n e ct ion Se t u pCom ple t e ( rrc- Transact ionI dent ifier= a ) .
UL init ialDirect Transfer ATRQ GPRS At t ach Request m essage cont ains UE ident ifier I MSI or P- TMSI , Locat ion
and Rout ing Area I dent it y ( LAI , RAI )
The net work m ay or m ay not perform t he aut hent icat ion procedure. Ciphering and/ or int egrit y prot ect ion are
act ivat ed w it h:
DL RRC Se cu r it yM ode Com m a n d
UL RRC Se cu r it yM ode Com ple t e
UMTS Signaling
RRC DownlinkDirect Transfer ATAC GPRS At t ach Accept m essage ( Figure 3.13) confirm s from SGSN/ SLR t hat
subscriber is GPRS at t ached now, opt ional a ( new) P- TMSI is assigned
RRC UplinkDirect Transfer ACOM GPRS At t ach Com plet e m essage is opt ional sent in case of ( new) P- TMSI
assignm ent using ATAC m essage.
Release of RRC Connect ion:
( RLC UMD) DL r r cCon n e ct ion Re le a se
( RLC UMD) UL r r cCon n e ct ion Re le a se Com ple t e
Release of radio resources:
N BAP DL init iat ingMessage I d- Ra dioLin k D e let ion ( short TransAct ion I D= j , id- CRNCCom m unicat ionCont ext I D= d, NodeBCom m unicat ionsCont ext - I D= p)
N BAP UL successfulOut cm e I d- Ra dioLin k D e le t ion ( short TransAct ion I D= j , id- CRNCCom m unicat ionCont ext I D= d)
Release of AAL2 SVC for DCH/ DCCH on I ub:
ALCAP DL REL ( Dest . Sign. Assoc. I D= i)
ALCAP UL RLC ( Dest . Sign. Assoc. I D= f)
UMTS Signaling
3 .3 I UB CS - M OBI LE ORI GI N ATED CALL

This scenario describes t he m essage flow for a user- init iat ed v oice call, which includes t he allocat ion and release
of radio access bearers.
3 .3 .1 Ove r vie w
Figure 3 14 I ub Mobile Originat ed Voice Call Overview

The St eps 1 t o 3 for t he m obile originat ed voice call ( MOC) are t he sam e as described for I MSI / GPRS At t ach
procedure.
St e p 4 :
The opt ional ciphering/ aut hent icat ion procedure request ed by t he net work is used t o double- check UE ident it y
and t o swit ch on ciphering bet ween RNC and UE if necessary.
St e p 5 :
The voice call set up st art s w it h a SETUP m essage in MM/ SM/ CC layer. The SETUP m essage includes t he dialed
called part y num ber and is forwarded by t he RNC t o t he CS core net work dom ain.
St e p 6 :
The CS core net work dom ain defines a Qualit y of Serv ice ( QoS) for t he voice call. QoS values are key param et ers
of t he Radio Access Bearer ( RAB) . The RAB Assignm ent procedure can be com pared w it h t he set up of a bearer
channel in CCS# 7 based net works. The Radio Access Bearer Service provides a channel for user dat a ( voice
packet s) bet w een t he Mobile Term inat ion ( MT) of t he UE and t he serving MSC in t he CS core net work dom ain.
St e p 7 :
The Radio link Reconfigurat ion provides radio resources for t he est ablishm ent of t he Radio Bearer in t he next st ep.
St e p 8 :
On behalf of t he param et er values negot iat ed in RAB Assignm ent procedure a new radio bearer is set up t o carry
t he ( logical) dedicat ed t raffic channels ( DTCHs) . I f AMR codec is used t o encode t he voice inform at ion t hree
DTCHs are set up, one for each class of AMR bit s: class A, class B, class C bit s.
St e p 9 :
The release of t he voice call follows t he release of t he RRC connect ion if no ot her serv ices are act ive. Then bot h,
t he dedicat ed cont rol channel and t he dedicat ed t raffic channel are release as well. Finally t he RNC releases t he
radio resources t hat have been blocked for bot h channels. Also t he AAL2 SVCs are delet ed.
UMTS Signaling
Figure 3 15 I ub MOC Call Flow 1/ 6
Already t he rrcConnect ionRequest m essage cont ains t he call est ablishm ent cause t hat indicat es t hat a MOC is
st art ed. Since in t he call flow exam ple t here is st ill no dedicat ed cont rol channel available t his first m essage is
sent via Random Access Channel:
RACH : UL RLC TMD r r cCon n e ct ion Re qu e st ( I M SI or TM SI ,
est ablishm ent Cause= or igin a t in gCon ve r sa t ion a lCa ll)
As in t he procedures described before t he NBAP is responsible for t he radio link set up. How ev er, t his t im e it w ill
int erest ing t o w at ch a lit t le bit closer t he downlink channelisat ion code and m inim um uplink channelisat ion code
lengt h as w ell as DCH- I Ds:
N BAP DL init iat ingMessage I d- radioLink Set up ( longTransAct ionI D= c, id- CRNC- Com m unicat ionCont ext I D= d,
ULscram blingCode/ DLchannelisat ionCode= b/ , m inULChCdLen=
Transport Form at Set , DL Transport Form at Set )
, DCH- SpecificI nform at ionList : DCH- I D= z, UL
UMTS Signaling
Message Exam ple 3 16: NBAP Radio Link Set up for voice call
N BAP UL successfulOut com e I d- radioLinkSet up ( longTransAct ion I D= c, id- CRNC- Com m unicat ionCont ext I D= d,
DCH- I D= z, bindingI D= e , NodeBCom m unicat ionCont ext - I D= p)
Then ALCAP prot ocol set s up t he AAL2 SVC for t he dedicat ed cont rol channel ( DCH/ DCCH) :
Downlink and uplink Fr a m in g Pr ot ocol Syn ch r on iza t ion m essages are m onit ored on t his DCH in AAL2
Pat h= g and Channel= h .
However, t he DCCH cannot be used for t ransm it t ing RRC m essages before t he UE has not received t he
param et ers for t he assigned physical resources on radio int erface ( UL scram bling code, DL channelisat ion code
et c.) . The scram bling code/ channelisat ion code is sent in dow nlink direct ion w it h:
FACH : DL RLC UMD r r cCon n e ct ion Se t u p ( rrc- Transact ion I dent ifier [ rrc- TAI D] = a , I M SI or TM SI , u- RNTI = r ,
Bearers)
, Prim ary Scram bling Code =
, MappingI nfo for Signaling Radio
As shown in locat ion updat e scenario t his m essage also cont ains m apping info for t he logical channels ( signaling
radio bearers) . They w ill be m apped ont o t he DCH defined already in NBAP Radio link set up m essage.
UMTS Signaling
That UE found t he dedicat ed physical channels on air int erface is indicat ed by sending:
N BAP UL init iat ing Message id- r a dioLin k Re st or a t ion ( short TransAct ion I D= j , id- CRNCCom m unicat ionCont ext I D= d)
All follow ing RRC m essages ( RLC AMD) are running in AAL2 SVC w it h CI D= h :
DL RLC AMD r r cM e a su r e m e n t Con t r ol
UL RLC AMD r r cCon n e ct ion Se t u pCom ple t e ( rrc- Transact ionI dent ifier= a ) .
MM/ SM/ CC m essages in t he RRC Signaling Connect ion are:
UL init ialDirect Transfer CM SREQ Connect ion Managem ent Service Request ( can be answered opt ionally w it h
Connect ion Managem ent Service Accept m essage CM SACC or can be rej ect ed by sending CM SREJ)
Downlink Direct Transfer AUTREQ Aut hent icat ion Request , net work request s double- check of UE ident it y
UplinkDirect Transfer AUTREP Aut hent icat ion Response, UE answers t he aut hent icat ion request w it h a signed
response
I n case t hat t he signed response is ident ical w it h t he expect ed response ciphering/ int egrit y prot ect ion is act iv at ed
bet ween UE and RNC by sending RRC Se cu r it yM ode Com m a n d m essage.
UMTS Signaling
RRC Se cu r it yM ode Com ple t e m essage com plet es ciphering act ivat ion procedure.
Furt her MM/ SM/ CC m essages are follow ing em bedded in RRC uplink/ downlink direct t ransfer m essages:
UplinkDirect Transfer SETUP includes t he called part y ( B- part y) num ber t hat was dialed by t he UMTS subscriber
and as an opt ion t he st ream ident ifier ( SI ) if t he UE support s m ult i- call capabilit y. SI value w ill lat er be used as
RAB- I D value by RRC prot ocol ent it ies. All em bedded MM/ SM/ CC m essages belonging t o t his call are m arked w it h
t he sam e t ransact ion I D ( TI O) value.
Message Exam ple 3 17: Call Cont rol SETUP ( MOC)
I n t he m essage exam ple it is furt her show n on which channels t he m essage is t ransport ed. Physical t ransport
bearer on I ub int erface is an AAL2 SVC w it h VPI / VCI / CI D = 10/ 26/ 183. On t his physical t ransport bearer a
UMTS Signaling
dedicat ed ( t ransport ) channel ( DCH) is running and because SETUP is a NAS signaling m essage it is carried by a
logical DCCH w it h logical channel I D = 3, which is ident ical w it h signaling radio bearer I D = 3 ( NAS signaling w it h
high priorit y) . The CN- Dom ainI dent it y of RRC Uplink Direct Transfer m essage indicat es t hat t he m essage w ill be
forwarded t o CS core net work dom ain represent ed by MSC ( Rel. 99) or MSC Server ( Rel. 4 and higher) . Since
t ype of num ber and num ber plan of called part y num ber are unknown it is sure t hat t he called part y num ber
st ring cont ains all digit s as t hey have been dialed by subscriber.
Recept ion of SETUP is answered by core net work w it h
Downlink Direct Transfer CPROC This m essage indicat es t hat t he call is being processed by core net work ent it ies.
On UE side t he call cont rol st at e is changed when t his m essage is received. Wit h ent ering t he new st at e it
becom es im possible t o send any addit ional dialing inform at ion.
Now Radio Resources for dedicat ed t raffic channels ( DTCHs) need t o be prov ided by ( C) RNC. A dedicat ed physical
channel in uplink and downlink direct ion already ex ist s and it is ident ified by UL scram bling code num ber and DL
channelisat ion code num ber. Hence, t his channel needs t o be reconfigured, because m ore dat a t raffic bet ween UE
and net work is expect ed when DTCHs are m apped on t his physical channel. The higher t he dat a t ransfer rat e on
radio int erface is t he low er m ust be t he chosen spreading fact or assigned w it h channelisat ion code. So a new
downlink channelisat ion code w it h low er spreading fact or t han before is found in t he Synchronized Radio Link
Reconfigurat ion Preparat ion m essage as well as a new m inim um uplink channelisat ion code lengt h
( m inULChCdLen) , which value is also sm aller t han in Radio Link Set up m essage before ( < ) .
N BAP DL: init iat ingMessage I d- syn ch r on ise dRa dioLin k Re con figu r a t ion Pr e pa r a t ion ( short TransAct ion I D= j ,
NodeBCom m unicat ionsCont ext - I D= p, ULscram blingCode/ DLchannelisat ionCode= b/
Transport Form at Set s of DCHs)
, m inULChCdLen=
Please not e in t he m essage exam ple t hat for t he prot ocol t est er decoder unit already t he nam e of t his procedure
code is t oo long t o display it correct ly , which is w it h no doubt one of t he big disadvant ages of excessiv e ASN.1
PER usage.
UMTS Signaling
Message Exam ple 3 18: NBAP Synchronized Radio Link Reconfigurat ion Preparat ion for voice call
The m essage exam ple shows how uplink channelisat ion code lengt h and downlink scram bling code values are
changed and t hat t hree DCHs are set up, each w it h a different t ransport block size t hat is charact erist ic in t his
com binat ion for AMR encoded voice calls. Also for all AMR encoded speech t he t ransm ission t im e int erval is
always 20 m s.
The answ er from Node B is given as already seen in case of Radio link set up by sending a Successful
Out com e m essage:
N BAP UL: successfulOut com e I d- syn ch r on ise dRa dioLin k Re con figu r a t ion Pr e pa r a t ion ( short TransAct ion
I D= j , id- CRNC- Com m unicat ionCont ext I D= d. bindingI D= k )
Now anot her AAL2 SVC is set up by ALCAP funct ion. Despit e t here are t hree DCHs t hey are seen as a set of
coordinat ed t ransport channels t hat are always set up and released in com binat ion. I ndiv idual DCHs w it hin such a
set cannot operat e individually. I f t he set up of one of t hese channels fails t he set up of all ot her channels in t he
set fails as well. And a set of coordinat ed DCHs is t ransferred over one t ransport bearer. Hence, only one AAL2
SVC is necessary t o t ransport t he dedicat ed t raffic channels on I ub int erface:
UMTS Signaling
ALCAP DL ERQ ( Originat ing Signal. Ass. I D= l, AAL2 Pat h= m , AAL2 Channel id= n , served user gen reference= k )
ALCAP UL ECF ( Originat ing Signal. Ass. I D= q, Dest inat ion Sign. Assoc. I D= l)
When t his t raffic channel AAL2 SVC ( Pat h= m and Connect ion = n) on I ub is opened, downlink and uplink FP
synchronizat ion fram es can be m onit ored.
Sending a N BAP DL init iat ingMessage I d- syn ch r on ize dRa dioLin k Re con figur a t ion Com m it ( short TransAct ion
I D= j , NodeBCom m unicat ionsCont ext - I D= p) is necessary t o order t he Node B t o sw it ch t o t he new radio link
prev iously prepared by t he Synchronized Radio Link Reconfigurat ion Preparat ion procedure.
The follow ing m essages in t his DCH on AAL2 Pat h= g and Channel= h are:
DL RRC Ra dioBe a r e r Se t u p ( ULscram blingCode/ DLchannelisat ionCode= b/
Form at Set s of DCHs, MappingI nfo for radio bearers)
, m inULChCdLen=
, Transport
This m essage st art s set up of a radio bearer t hat is part of a user plane radio access bearer ( RAB) . The connect ion
is ident ified by it s RAB- I D, t he user is ident ified by it s uplink scram bling code. The m essage cont ains t he
t ransport form at set s of t he DCHs, t his t im e sent t o UE plus t he appropr iat e info which radio bearer ( DTCH) is
m apped ont o which DCH.
The exam ple m essage show s t hat radio bearer I D = 5 ( rem em ber t hat I D 1 t o 4 are already occupied by SRBs)
w ill be m apped ont o t he first dedicat ed channel for AMR info. I n a sim ilar way t hat is not show n in t he m essage
exam ple radio bearer no. 6 and 7 are m apped ont o DCH 2 and DCH 3 ( rem em ber: NBAP DCH- I D + 1! ) . I n
addit ion t he inform at ion about changed uplink channelisat ion code lengt h and downlink channelisat ion code
num ber is included.
UMTS Signaling
Message Exam ple 3 19: Ext ract of RRC Radio Bearer Set up for voice call
The answ er of UE t o RRC Radio Bearer Set up request is:

UL RRC Ra dioBe a r e r Se t u pCom ple t e
I t indicat es t hat new radio bearer configurat ion was accept ed and act ivat ed. Now t he UE is ready t o send and
receive AMR speech codec fram es using t he previously set up dedicat ed t ransport channels.
The call flow is cont inued w it h exchanging NAS m essages:
Downlink Direct Transfer ALERT indicat es call present at ion ( ringing) t o B- part y, B- part y receiv es t he call
Downlink Direct Transfer CON N ECT B- part y has accept ed t he call, t hey t alk t o each ot her
UplinkDirect Transfer CON ACK A- part y confirm s receiv ing CONNECT t o B- part y. This m essage ex ist s due t o
hist orical reasons in developm ent of GSM and I SDN st andards. Act ually it was specified t o sw it ch on CDR
recording in t he appropriat e local exchange or serv ing MSC in earlier GSM/ I SDN st andard releases.
UMTS Signaling
The follow ing m essages are used t o release t he voice call:

UplinkDirect Transfer D I SC Disconnect m essage, can be sent by A- or B- part y. I ndicat es begin of call release
procedure aft er successful call set up. A cause v alue indicat es t he reason for disconnect request . This param et er is
new com pared t o GSM/ I SDN. The net work is allow ed in som e cases t o st art call release procedure w it hout hav ing
sent a Disconnect m essage before ( see 3GPP 24.008, Ch. 5.4) .
or / a n d
Downlink Direct Transfer RELEASE request t o release signaling resources for t his call, also used t o rej ect a call
est ablishm ent . A cause value indicat es t he release cause, e.g. norm al call clearing .
UplinkDirect Transfer RELCMP Release com plet e m essage indicat es com plet e release of signaling resources, e.g.
st ream ident ifier value can be used again.
The RRC connect ion is released w it h:
Radio link delet ion is cont inued by NBAP ent it y:
N BAP DL init iat ingMessage I d- Ra dioLin k D e let ion ( short TransAct ion I D= j , id- CRNCCom m unicat ionCont ext I D= d, NodeBCom m unicat ionsCont ext - I D= p)
N BAP UL successfulOut com e I d- Ra dioLin k D ele t ion ( short TransAct ion I D= j , id- CRNCCom m unicat ionCont ext I D= d)
Finally t he dedicat ed t ransport channels for DCCH and DTCH are also released again.
ALCAP
ALCAP
ALCAP
ALCAP
DL
UL
DL
UL
REL
RLC
REL
RLC
( Dest .
( Dest .
( Dest .
( Dest .
Sign.
Sign.
Sign.
Sign.
Assoc.
Assoc.
Assoc.
Assoc.
I D= i)
I D= f)
I D= q)
I D= l)
UMTS Signaling
3 .4 I UB CS M OBI LE TERM I N ATED CALL

This scenario describes t he m essage flow for a user- t erm inat ed voice call ( t he m obile receives a call) , which
includes t he allocat ion and release of a radio access bearer.
3 .4 .1 Ove r vie w
Figure 3 21 I ub Mobile Term inat ed Voice Call Overview
The m ain difference bet ween m obile originat ed call ( MOC) and m obile t erm inat ed call ( MTC) is t hat t he MTC is
init iat ed by a paging m essage sent from t he CS core net work dom ain.
There are t wo different t ypes of paging m essages defined.
Pa ging Type 1 m essage is used if t he UE is in RRC_I DLE, RRC CELL_PCH or URA_PCH st at e, t hat m eans: if no
ot her connect ion using eit her DCH or com m on cont rol channels is act iv e before.
Pa ging Type 2 m essage is used if t he UE is already in RRC CELL_FACH or CELL_DCH st at e, t hat m eans: if a RRC
connect ion was already set up due t o request t o est ablish a DCCH for RRC/ MMSMCC t owards PS Dom ain. I n
addit ion an act ive PDP cont ext m ay be running using DCH/ DTCH or in background on com m on t ransport channels
RACH and FACH.
The paging m essages are sent on t he paging channel ( PCH) in downlink direct ion. The logical channel relat ed t o
t his t ransport channel is t he paging cont rol channel ( PCCH) .
The paging m essage is answ ered wit h a paging response t hat indicat es t hat t he UE is able t o accept t he call
request . Aft er receiving paging response t he net work( ! ) sends SETUP m essage. The follow ing m essages are
sim ilar t o t he m essages seen in case of a MOC, but t his t im e calling part y is on t he net work side.
UMTS Signaling
Figure 3 22 I ub MTC Call Flow 1/ 6
Only t he differences bet ween m obile t erm inat ed call and MOC are highlight ed, because m ost part s of t he general
procedure, m essage param et ers and values are ident ical w it h MOC scenario.
The paging t ype 1 m essage is sent downlink in t he paging channel ( PCH) and cont ains a paging cause value t hat
indicat es t he paging reason. I n case t hat MS I n RRC_I DLE st at e a signal on Paging I ndicat ion Channel ( PI CH) is
sent cont aining a paging indicat or t hat t ells all m obiles in RRC I DLE st at e t hat belong t o a specified paging
group t o list en t o t he paging channel ( PCH) . The paging group num ber ( = paging indicat or) of t he UE is derived
from t he UE s I MSI .
PCH : DL RLC TMD Paging Type 1 ( Pa gin gCa u se = t e r m in a t in gCon ve r sa t ion a lCa ll, I M SI or TM SI )
Message Exam ple 3 20: RRC Paging Type 1
The UE answers aft er recept ion of t he paging m essage w it h RRC connect ion request on t he ( uplink) random
access channel ( RACH) . The est ablishm ent cause indicat es t hat RRC connect ion request was t riggered by a
paging m essage and so all follow ing m essages belonging t o a t erm inat ing conversat ional call.
RACH : UL RLC TMD rrcConnect ionRequest ( I M SI or TM SI ,
e st a blish m e n t Ca u se = t e r m in a t in gCon ve r sa t ion a lCa ll)
No differences t o MOC scenario are found in m essages:
ULscram blingCode/ DLchannelisat ionCode= b/ )
bindingI D= e , NodeBCom m unicat ionsCont ext - I D= p, Com m unicat ionPort I D= o)
UMTS Signaling
D CH in AAL2 Pat h= g and Channel= h : downlink and uplink FP synchronizat ion

FACH : DL RLC UMD r r cCon n e ct ion Se t u p ( rrc- Transact ion I dent ifier= a ,
, I MSI or TMSI )
N BAP UL init iat ing Message id- r a dioLin k Re st or a t ion ( short TransAct ion I D= j , id- CRNCCom m unicat ionCont ext I D= d)
RRC m essages ( RLC AMD) in t his AAL2 channel ( DCH) = h :
DL RLC AMD r r cM e a su r e m e n t Con t r ol ( rrc- Transact ionI dent ifier= a ) .
UL RLC AMD rrcConnect ionSet upCom plet e ( rrc- Transact ionI dent ifier= a ) .
The follow ing m essages are:
UL init ialDirect Transfer PRES paging response m essage is sent by UE t o t he serving MSC t o indicat e t hat
paging was successful and UE is able t o cont inue w it h call set up. Enclosed in t his m essage t he m obile ident it y ( as
a rule TMSI ) and inform at ion about t he UEs t echnical capabilit ies ( MS Classm ark) are t ransm it t ed.
Downlink Direct Transfer AUTREQ
UplinkDirect Transfer AUTREP
DL RRC Se cu r it yM ode Com m a n d
UMTS Signaling
UL RRC Se cu r it yM ode Com ple t e

Opt .: Downlink Direct Transfer TRCM D TMSI reallocat ion com m and: new TMSI is assigned by CS core net work
dom ain
Opt .: UplinkDirect Transfer TRCM P indicat es successful TMSI reallocat ion
Downlink Direct Transfer SETUP called part y num ber inform at ion elem ent in t his m essage is only opt ional,
because t he UE does not know it s MSI SDN. Hence, called part y num ber is not necessary t o rout e t he call.
UplinkDirect Transfer CCON F UE confirm s t he incom ing call set up request and assigns a st ream ident ifier ( SI )
)
I D= j , id- CRNC- Com m unicat ionCont ext I D= d. bindingI D= k )
UMTS Signaling
Now t he t raffic channel on I ub ( AAL2 Pat h= m and Channel= n) will be opened, downlink and uplink FP
syncronizat ion are sent .
N BAP DL init iat ingMessage I d- syn ch r on ise dRa dioLin k Re con figu r a t ion Com m it ( short TransAct ion I D= j ,
NodeBCom m unicat ionsCont ext - I D= p)
The follow ing RRC m essages in t he DCCH are:
DL RRC Ra dioBe a r e r Se t u p
MM/ SM/ CC m essages t hat follow:
UplinkDirect Transfer ALERT
UplinkDirect Transfer CON N ECT
DownLinkDirect Transfer CON ACK
Finally t he call is act ive.
UMTS Signaling
Release of t he call is basically t he sam e as in MOC:

UpLink Direct Transfer D I SC
or / a n d
Downlink Direct Transfer RELEASE
UpLink Direct Transfe RELCM P
N BAP UL successfulOut com e I d- Ra dioLin k D e le t ion ( short TransAct ion I D= j , id- CRNCCom m unicat ionCont ext I D= d)
UMTS Signaling
ALCAP
ALCAP
ALCAP
ALCAP
DL
UL
DL
UL
REL
RLC
REL
RLC
( Dest .
( Dest .
( Dest .
( Dest .
Sign.
Sign.
Sign.
Sign.
Assoc.
Assoc.
Assoc.
Assoc.
I D= i)
I D= f)
I D= q)
I D= l)
UMTS Signaling
3 .5 I UB PS - PD P CON TEXT ACTI VATI ON / D EACTI VATI ON

I f t he user or t he net work act ivat es any kind of dat a t ransm ission a PDP Cont ext is act ivat ed and deact ivat ed
again aft er t he t ransm ission is finished or aft er a cert ain t im e period.
3 .5 .1 Ove r vie w
Figure 3 28 I ub PDP Cont ext Act ivat ion/ Deact ivat ion Ov ererv iew
I n case of PDP Cont ext ( PDPC) act ivat ion w it h t he PDPC running in a dedicat ed channel st eps 1 t o 3 are t he sam e
as in case of m obile originat ed voice call ( MOC) and I MSI / GPRS At t ach procedure.
St e p 4 :
A new m andat ory session m anagem ent m essage is t he Service Request m essage. I t shows if ( and if yes: how
m any) PDP cont ext s are already running on subscriber side. The opt ional ciphering/ aut hent icat ion procedure is
t he sam e as before.
St e p 5 :
The PDPC act ivat ion st art s w it h a Act ivat e PDP Cont ext Request m essage in MM/ SM/ CC layer. This m essage is
forwarded by t he RNC t o t he SGSN in t he PS core net work dom ain.
St e p 6 :
The PS core net work dom ain negot iat es a Qualit y of Service ( QoS) for t he PDP cont ext . Radio Access Bearer ( RAB)
w it h t his QoS is est ablished. On I uPS int erface t he RAB is seen as GTP t unnel on user plane. On I ub int erface t he
RAB is represent ed by a AAL2 SVC t hat is set up in St ep 8.
St e p 7 :
Again t he NBAP Radio Link Reconfigurat ion procedure provides radio resources for t he est ablishm ent of t he Radio
Bearer.
St e p 8 :
On behalf of t he param et er values negot iat ed in RAB Assignm ent procedure a new radio bearer is set up t o carry
t he ( logical) dedicat ed t raffic channel ( DTCH) .
St e p 9 :
The release procedures follow ing a PDP cont ext deact ivat ion are t he sam e as t he release procedures in case of a
voice call.
UMTS Signaling
Figure 3 29 I ub PDP Cont ext Act ivat ion/ Deact ivat ion Call Flow 1/ 6
The set up of radio link and RRC connect ion in case of PDP cont ext act ivat ion are t he sam e as in case of a m obile
originat ed call. However, P- TMSI is used as t em porary ident ifier. P- TMSI is t he t em porary ident ifier for SGSNbased serv ices and is discrim inat ed from circuit sw it ched TMSI by t he value of t he last t wo significant bit s. Value
11 is used by SGSN, values 00, 01 and 10 are used by VLR.
RACH : UL RLC TMD rrcConnect ionRequest ( I M SI or P- TM SI , est ablishm ent Cause= originat ingBackgroundCall)
NBAP Radio link set up procedure is t he sam e as in all cases described before, t he sam e w it h AAL2 connect ion
set up:
ULscram blingCode/ DLchannelisat ionCode= b/ )
N BAP UL successfulOut cm e I d- r a dioLin k Se t u p ( longTransAct ion I D= c, id- CRNC- Com m unicat ionCont ext I D= d,
ALCAP UL ECF ( Originat ing Signal. Ass. I D= i, Dest inat ion Sign. Assoc. I D= f)
D CH Ch a n n e l in AAL2 Pat h= g and Channel= h : downlink and uplink synchronizat ion FP fram es are exchanged.
RRC connect ion set up can once again cont ain t he P- TMSI .
, I M SI or P- TM SI )
UMTS Signaling
All follow ing RRC m essages ( RLC AMD) are running in D( C) CH ( AAL2 channel= h) :
D CH DL r r cM e a su r e m e n t Con t r ol ( rrc- Transact ionI dent ifier= a )
D CH UL r r cCon n e ct ion Se t u pCom ple t e ( rrc- Transact ionI dent ifier= a )
The Service Request m essage enclosed in a RRC I nit ial Direct Transfer m essage is sent t o est ablish a logical
associat ion bet ween m obile st at ion and net work. I t cont ains a list of all available NSAPI s and whet her t hey are in
use by ot her PDP cont ext s or not . I n addit ion t he P- TMSI is included as well.
DCH UL RRC init ialDirect Transfer SREQ ( N SAPI St a t u s List , P- TM SI )
Ciphering/ I nt egrit y Prot ect ion is act ivat ed and t he UE aut hent icat ed:
DCH DL RRC Se cu r it yM ode Com m a n d
DCH UL RRC Se cu r it yM ode Com ple t e
DCH RRC DownlinkDirect Transfer ACRQ - GPRS Aut hent icat ion and Ciphering Request fulfills sam e funct ion as
AUTREQ for CS calls, but cont ains in addit ion inform at ion about used ciphering algorit hm and ciphering key
sequence num ber
DCH RRC Uplink Direct Transfer ACRE - GPRS Aut hent icat ion and Ciphering Response is used t o send signed
response ( SRES) value back t o RNC
The net work accept s t he serv ice request sent by t he UE w it h a Serv ice Accept t hat opt ionally m ay cont ain a
NSAPI st at us list as well.
DCH RRC DownlinkDirect Transfer SACC
The general purpose of t he Service Request procedure is t o bring t he MS from PMM- I DLE int o t he PMMCONNECTED m ode ( Ready t im er is st art ed) and/ or t o assign radio access bearer in case of PDP cont ex t s are
act ivat ed w it hout radio access bearer assigned.
UMTS Signaling
Now t he net work perform s P- TMSI reallocat ion before t he MS sends a Act ivat e PDP Cont ex t Request m essage
( APCR) :
DCH DownlinkDirect Transfer PTRM
DCH UplinkDirect Transfer PTRP
DCH UplinkDirect Transfer APCR
( N SAPI , LLC SAPI , QoS r e q., PD P Add., opt . APN , PPP D ia l- in in fo)
The Act ivat e PDP address Cont ext Request m essage cont ains t he request ed NSAPI , a LLC SAPI value ( m andat ory
in case of handover t o 2.5 G radio access net w ork) , t he QoS request ed by t he user and a PDP Address, e.g. an
I Pv4 or I Pv6 Address, which is t he t arget of t he PDP cont ext . I n case t hat a dynam ic PDP address w ill be assigned
by t he net work t he PDP Address elem ent is used as a placeholder and Access Point Nam e ( APN) is included t his
is t he net work server t hat w ill assign t he dynam ic PDP address. I n addit ion t his m essage carries oft en a PPP
( Point - t o- Point ) prot ocol port ion t hat encloses CHAP/ PAP ( Challenge Handshake Aut hent icat ion Prot ocol/ Password
Aut hent icat ion Prot ocol) inform at ion. PPP and CHAP/ PAP are used t o t ransm it usernam e and password for dial- in
serv ice at int ernet serv ice prov ider ( I SP) side. I SP can be t he PLMN operat or him self or any 3rd part y out side t he
PLMN. I n lat t er case t his kind of PPP signaling w ill be t ransparent ly forw arded via Gi int erface.
UMTS Signaling
Message Exam ple 3 21: RRC Uplink Direct Transfer wit h GPRS SM Act ivat e PDP Cont ext Request
I n t he m essage exam ple RRC Uplink Direct Transfer is shown t oget her w it h t he em bedded GPRS Session
Managem ent ( unfort unat ely in som e cases abbrev iat ed: GSM) Act ivat e PDP Cont ext Request ( APCR) . I t em erges
t hat RRC m essage cont ains only t he int egrit y prot ect ion m essage aut hent icat ion code, CN dom ain ident ifier for
proper m essage rout ing t o SGSN and m essage t ype. Then st art s APCR t hat has a t ransact ion id ( TI O) as already
described for circuit sw it ched call cont rol m essages like SETUP. I t will link all SM m essages relat ed t o t he sam e
PDP cont ext t oget her. The NSAPI value 5 indicat es t hat t his is t he first PDP cont ext request ed by t his subscriber
( t hat was ident ified by it s P- TMSI in Serv ice Request m essage before) . NSAPI values 0 t o 4 are reserv ed by
int ernat ional st andards. Usable for m obile subscriber are values in t he range from 5 t o 15. So in t ot al a single UE
can have act ive t heoret ically up t o 11 PDP cont ext s sim ult aneously. General idea of t he st andard people was t o
have 10 int ernet connect ions plus one WAP connect ion running sim ult aneously.
LLC SAPI as already m ent ioned w ill only becom e im port ant if t he call is handed over t o a 2G GSM cell. The
qualit y of serv ice param et ers request ed by subscriber in t he ex am ple indicat e t hat user w ill accept any QoS
set t ings assigned by t he net work ( as subscribed in HLR) . We see a placeholder for a st ill em pt y I Pv4 address,
access point nam e and PPP prot ocol configurat ion opt ions. The access point nam e in t he exam ple follows a
descript ion given in 3GPP 23.003 ( Num bering and Addressing) . " Usernam e/ password for I SP" is j ust a com m ent
insert ed inst ead of any bit of real inform at ion.
UMTS Signaling
The follow ing procedures are necessary t o act ivat e t he dedicat ed t raffic channel for t his PDP cont ext . For reasons
we have explained in t he MOC scenario DL channelizat ion code is changed:
N BAP DL init iat ingMessage I d- syn ch r on ise dRa dioLin k Re con figu r a t ion Pr e pa r a t ion( short TransAct ion I D= j ,
NodeBCom m unicat ionsCont ext - I D= p, ULscram blingCode/ DLchannelisat ionCode= b/ ?)
N BAP UL successfulOut com e I d- syn ch r on ise dRa dioLin k Re con figu r a t ion Pr e pa r a t ion ( short TransAct ion I D= j ,
id- CRNC- Com m unicat ionCont ex t I D= d. bindingI D= k)
Dedicat ed Traffic Channel: Uplink and Downlink FP Sync indicat e successful DTCH set up.
NodeBCom m unicat ionsCont ext - I D= p) indicat es successful synchronizat ion on air int erface.
The follow ing RRC procedure w it h m essages
DCH DL RRC Ra dioBe a r e r Se t u p
DCH UL RRC Ra dioBe a r e r Se t u pCom ple t e
is used t o inform UE about t he reconfigurat ion of it s dedicat ed radio link.
Wit h DCH RRC DownlinkDirect Transfer APCA ( ne g. LLC SAPI , ne g. QoS, Ra dio Pr io., opt . dyn. PD P Add.)
t he net work confirm s t he PDP cont ext act ivat ion. The m essage cont ains t he negot iat ed LLC SAPI , negot iat ed QoS
( as regist ered for t his user in t he HLR subscript ion dat a) , a radio priorit y t o specify t he priorit y level of dat a
relat ed t o t his PDP cont ext on t he lower layers and opt ionally t he dynam ic PDP address as assigned by APN
server.
UMTS Signaling
Message Exam ple 3 22: GPRS SM Act ivat e PDP Cont ext Accept
When Act ivat e PDP Cont ext Accept is received on UE side t he PDP cont ext becom es act ive and packet dat a can be
t ransm it t ed in uplink and downlink direct ion.
UMTS Signaling
The release of t he PDP Cont ex t st art s w it h Deact ivat e PDP Cont ext procedure:
DCH RRC UpLinkDirect Transfer DPCR D e a ct iva t e PD P Con t e x t Re qu e st
The im port ant inform at ion in t his m essage is t he t ransact ion id value ( TI O) t hat is t he only inform at ion t hat links
t his m essage w it h t he prev ious PDP cont ext act ivat ion procedure and t he SM cause value t hat inform s about t he
reasons for deact ivat ing t he PDP cont ext .
Message Exam ple 3 23: GPRS SM Deact ivat e PDP Cont ext Request
Deact iv at e PDP Cont ext Request is answ ered w it h
DCH RRC DownlinkDirect Transfer D PCA D e a ct iva t e PD P Con t e x t Acce pt
Aft er t his GPRS SM procedure ot her release procedures are following as already seen in case of MOC and MTC:
DCH DL RRC Ra dio Be a r e r Re le a se
DCH UL RRC Ra dio Be a r e r Re le a se Com ple t e
ALCAP DL REL ( Dest . Sign. Assoc. I D= q) ( DTCH)
ALCAP UL RLC ( Dest . Sign. Assoc. I D= l)
UMTS Signaling
DCH ( RLC UMD) DL r r cCon n e ct ion Re le a se

DCH ( RLC UMD) UL r r cCon n e ct ion Re le a se Com ple t e
ALCAP DL REL ( Dest . Sign. Assoc. I D= i) ( DCCH)
UMTS Signaling
3 .6 I UB - I M SI / GPRS D ETACH PROCED URE
3 .6 .1 Ove r vie w
Figure 3 35 I ub I MSI / GPRS Det ach Procedure Overview
Det ach can be execut ed eit her t owards CS Dom ain or t owards PS Dom ain separat ely or as a com bined
I MSI / GPRS Det ach, e.g. in case t hat t he UE is sw it ched off.
I f t he UE has no ongoing RRC connect ion, t his m eans: t here are no ongoing CS or PS connect ions t o t he net w ork,
a new RRC connect ion needs t o be set up in t he sam e way as shown for all ot her procedures before ( st ep 1 t o 3) .
St e p 4 :
I MSI Det ach I ndicat ion m essage is send by t he UE t o t he net w ork. No response is ret urned t o t he m obile st at ion!
GPRS det ach is st art ed w it h sending Det ach Request m essage. The det ach t ype inform at ion elem ent in t his
m essage m ay indicat e " GPRS det ach w it h sw it ching off" , " GPRS det ach w it hout sw it ching off" , " I MSI det ach" ,
" GPRS/ I MSI det ach w it h sw it ching off" or " GPRS/ I MSI det ach w it hout sw it ching off" . I f t he m obile st at ion is not
sw it ched off a Det ach Accept m essage is sent by t he net work.
St e p 5 :
Release of RRC connect ion, radio resources and AAL2 SVC for dedicat ed cont rol channel.
UMTS Signaling
Figure 3 36 I ub I MSI / GPRS Det ach Call Flow 1/ 3
Since t here are no new radio net work layer m essages in t his scenario com pared t o I MSI / GPRS we j ust want t o
show t he m essage flow as a reference for signaling analysis w it hout any com m ent s.
RACH : UL RLC TMD r r cCon n e ct ion Re qu e st ( I M SI or P- TM SI , est ablishm ent Cause= Det ach)
NBAP UL successfulOut com e I d- radioLinkSet up ( longTransAct ion I D= c, id- CRNC- Com m unicat ionCont ext I D= d,
D CH Ch a n n e l in AAL2 Pat h= g and Channel= h : downlink and uplink synchronizat ion FP fr a m e s.
, I M SI or P- TM SI )
UMTS Signaling
RRC m e ssa ge s ( RLC AM D ) in t h is D CH ( AAL2 ch a n n e l= h )
DCH DL r r cM e a su r e m e n t Con t r ol ( rrc- Transact ionI dent ifier= a )
DCH UL r r cCon n e ct ion Se t u pCom ple t e ( rrc- Transact ionI dent ifier= a )
The follow ing m essages are:
DCH UL RRC init ialDirect Transfer ( Dom ain I ndicat or= CS- Dom ain) I M D ETI N
DCH UL RRC init ialDirect Transfer ( Dom ain I ndicat or= PS- Dom ain) D TRQ
UMTS Signaling
DCH ( RLC UMD) DL r r cCon n e ct ion Re le a se

DCH ( RLC UMD) UL r r cCon n e ct ion Re le a se Com ple t e
ALCAP DL REL ( Dest . Sign. Assoc. I D= i)
UMTS Signaling
3 .7 RRC M EASUREM EN T PROCED URES

To underst and t he following chapt ers t hat deal wit h descript ion of handover procedures it is first necessary t o get
a deeper know ledge about RRC m easurem ent procedures. As already show n in t he previous call flows t he serving
RNC sends a RRC Measurem ent Cont rol m essage t o t he UE aft er est ablishm ent of RRC connect ion. This RRC
Measurem ent Cont rol m essage cont ains inform at ion which neighbor cells t he UE shall m onit or and which kinds of
m easurem ent report s t he SRNC expect s t o receive from t he m obile.
The different t ypes of m easurem ent are divided int o different groups. Each m easurem ent t ype group can also be
described by an appropriat e group of Event - I Ds. These Event - I Ds are used in case of event - t riggered
m easurem ent report s, t his m eans: a defined k ey m easurem ent param et er reaches a predefined t hreshold and
t riggers so t he sending of a m easurem ent report . On t he ot her hand t he SRNC m ay also order t he UE t o send
RRC m easurem ent report s periodically, but t ypically t his is not t he default set t ing. Howev er, it m akes sense in
select ed scenarios, for inst ance if t he SRNC is not able t o add a st rong cell t o t he act iv e link set due t o capacit y
short age and a link addit ion shall be ret ried aft er a defined t im e period if t he cell is st ill st rong enough.
N ot e : I n t his book we will use t he event - I D nam es as defined in ASN.1 specificat ion of RRC prot ocol, e.g. " e1a" ,
while in t he RRC st andard docum ent general descript ion t he sam e event is nam ed " Event 1A" . The m eaning is t he
sam e.
3 .7 .1 RRC M e a su r e m e n t Type s
I n 3GPP 25.331 t he follow ing RRC m easurem ent t ypes are defined:
Table 3 2 RRC Measurem ent Types and Event - I D Groups
The evolut ion of UMTS st andards m ay enhance t he num ber of Event - I Ds and Event - I D groups in t he fut ure st ep
by st ep.
3 .7 .2 Ce ll Ca t e gor ie s
The cells t o be m easured are cat egorized int o t hree different set s:
Act ive Se t Ce lls are all t hose FDD cells involv ed in Soft er and/ or Soft Handover scenarios. I n ot her words: all
cells belonging t o an act ive link set .
N ot e : I n TDD m ode t here is always only ONE act ive cell, because t here is not soft er/ soft handover in TDD!
M on it or e d Se t Ce lls do not belong t o t he act ive set , but m onit ored according t o a neighbor list assigned by
SRNC in t he m easurem ent cont rol inform at ion. The UE can receiv e t his list on t wo different ways: using a RRC
UMTS Signaling
Measurem ent Cont rol m essage sent on a DCCH or reading SI B 11 or 12 ( depending on radio infrast ruct ure of cell)
of Broadcast Cont rol Channel ( BCCH) . And as shown in an earlier chapt er t hese SI Bs have been sent during Node
B Set up from CRNC t o t he Node B using t he NBAP Syst em I nform at ion Updat e procedure.
D e t e ct e d Se t Ce lls have been det ect ed by t he UE despit e t he fact t hat t hey do neit her belong t o t he act iv e set
nor t hey have been m ent ioned in t he neighbor cell list . An int rafrequency m easurem ent of t hese cells is only
done if UE is in CELL_DCH st at e.
The follow ing pict ures w ill int roduce som e t ypical procedures how m easurem ent set t ings are done and how t he
appropriat e m easurem ent report s are receiv ed.
3 .7 .3 M e a su r e m e n t I nit ia t ion for I nt r a - Fr e que n cy M e a su r e m e nt
Figure 3 39 I nit iat ion RRC I nt ra- Frequency Measurem ent
There are t wo different ways t o init iat e RRC m easurem ent . The first way is t hat UE reads SI B 11 and/ or 12 from
Broadcast Channel of t he current cell ident ified by a prim ary scram bling code t hat is also v isible in RRC
Connect ion Set up m essage. The second way is t hat SRNC sends a RRC Measurem ent Cont rol m essage t o t he UE
aft er successful est ablishm ent of RRC connect ion.
I t is possible t hat several RRC Measurem ent Cont rol m essages are sent according t o t he different t ypes of RRC
m easurem ent t ask. Also cell info list s ( neighbor cell list s) and event crit eria list s m ay be sent in separat e
m essages. For inst ance t he first RRC Measurem ent Cont rol m essage cont ains t he I nt ra Frequency Cell I nfo List ,
t he second one t he Event Crit eria List w it h act ivat ed t rigger condit ions. I n such a case bot h m essages m ay have
different Measurem ent I D values and different RRC Transact ion I Ds.
The RRC Measurem ent Cont rol m essages are sent on a DCCH in downlink direct ion. A m easurem ent ident it y is
used as t he set t ing ident ifier and will be used lat er in m easurem ent report s relat ed t o t hese set t ings.
The Measurem ent Com m and value shows if set t ings are init ial for t he UE ( set up) , if prev ious set t ings are
m odified ( m odify) or if prev ious set t ings are delet ed ( delet ion) .
I n case of int ra frequency m easurem ent an int ra frequency cell info list ( neighbor cell list ) is sent t o t he UE. I t
cont ains t he prim ary scram bling code ( PScrCd) of cells t o be m easured and assigns an appropriat e I nt ra
Frequency Cell I D t o each cell of t he list . Then t he m easurem ent quant it y is defined, in t he exam ple: t he Ec/ No
relat ion value of t he prim ary CPI CH signal of t he list ed FDD cells.
Ec/ No ( act ually Ec/ I o, but ASN.1 source code of RRC prot ocol uses Ec/ No) st ands for Energy per chip- t o- t ot al
noise and int erference power spect ral densit y. I n ot her words: it is t he received signal code power ( RSCP) of a PCPI CH in relat ion t o t he t ot al signal st rengt h ( RSSI ) of an UTRA carrier frequency, which m ust be im agined as t he
sum of all signals com ing from cells received at a cert ain locat ion:
UMTS Signaling
Figure 3 40 RSSI and P- CPI CH RSCP
I n t he next sect ion of t he RRC Measurem ent Cont rol m essage t he report crit eria are defined in an event crit eria
list . I n t he exam ple ( Figure 3.39) , t he UE is request ed t o report t riggered ev ent s e1a, e1b and e1c t o t he SRNC if
a defined CPI CH Ec/ No value t hreshold is reached. Addit ional param et ers lik e hyst eresis and t im e- t o- t rigger are
used t o opt im ize t he num ber of m easurem ent report s. I t is furt her defined t hat RRC Measurem ent Report
m essages w ill be sent using acknow ledged RLC m ode and t hat m easurem ent report sending is only event t riggered and not periodically.
3 .7 .4 I n t r a Fr e que n cy M e a su r e m e nt Eve n t s
3GPP 25.331 ( Rel. 99) defines t he follow ing m easurem ent event s for int ra frequency m easurem ent of FDD cells:
e 1 a : A Pr im a r y CPI CH e n t e r s t h e r e por t in g r a n ge
e 1 b: A pr im a r y CPI CH le a ve s t h e r e por t in g r a n ge
e 1 c: A non- a ct ive pr im a r y CPI CH be com e s be t t e r t ha n a n a ct ive pr im a r y CPI CH
e 1 d: Cha n ge of be st ce ll
e 1 e : A Pr im a r y CPI CH be com e s be t t e r t h a n a n a bsolu t e t h r e sh old
e 1 f: A Pr im a r y CPI CH be com e s w or se t ha n a n a bsolu t e t hr e shold
The event - I Ds e 1 a and e 1 b are used if Ec- No value of prim ary CPI CH is t o be m easured, e 1 e and e 1 f are used if
absolut e st renght of prim ary CPI CH is m easured. Eit her first or second possibilit y w ill be chosen. I n bot h cases
e 1 a or e 1 e w ill t rigger a radio link addit ion in a soft er or soft handover sit uat ion while e 1 b or e 1 f will t rigger
radio link delet ion. e 1 c m ay t rigger an radio link delet ion w it h subsequent radio link addit ion in case t hat t he
act ive link set already cont ains t he m axim um num ber of links. This act ion is also called radio link replacem ent .
However, it should be not ed t hat in any case t he SRNC m akes t he decision if radio link addit ions/ delet ions are
perform ed. e 1 d w ill not t rigger any change in t he radio link set necessarily.
Event - I Ds e 1 g, e 1 h and e 1 i describe event s of TDD int ra frequency m easurem ent .
UMTS Signaling
Figure 3 41 Report ing Range and Event - I D
The report ing range is a band bound t o t he lev el of t he st rongest cell of act ive set . The figure above shows t he
point s when a neighbor cell prim ary CPI CH lev el ent ers and leaves t he report ing range and an appropriat e
m easurem ent report is sent t o SRNC.
As shown in next figure t he hyst eresis is used t o define a border area on t op of low est report ing range lev el.
Hyst eresis ensures t hat only significant changes are report ed.
Figure 3 42 Hyst eresis and I nfluence on Ev ent Report
I n t he exam ple e 1 a and e 1 b for prim ary CPI CH of cell 1 are report ed while change of cell 2 prim ary CPI CH level
does not becom e significant enough t o t rigger a report ing event .
Anot her param et er t o lim it t he am ount of RRC m easurem ent report s is " Tim e t o t rigger" . I t elim inat es
m easurem ent report s t hat would be caused by short - t im e peaks of signal lev el. Only a cell t hat st ays good over a
longer t im e period ( defined by " t im e t o t rigger" ) is added t o t he act iv e link set as shown in t he figure below:
UMTS Signaling
Figure 3 43 Tim e- t o- t rigger and I nfluence on Event Report
Anot her param et er wort h t o be discussed is t he Offset . The Offset is a value added or subt ract ed from t he
originally m easured signal lev el. I t is unique for each cell t o be m easured. As a result an ev ent w ill be report ed
earlier as shown in t he figure or lat er t han t he t hreshold is reached in t he giv en cell. This could be useful if
t he operat or knows t hat a specific cell is int erest ing t o m onit or m ore carefully, even t hough it is not so good for
t he m om ent ( posit ive offset ) . Or experience has shown t hat it is good t o rem ove a defined cell earlier from t he
act ive set since it t ends t o loose st rengt h very quickly ( negat ive offset ) . As st at ed in 3GPP 25.331 t his offset
m echanism provides t he net work w it h an efficient t ool t o change t he report ing of an indiv idual prim ary CPI CH.
Figure 3 44 Offset and I nfluence on Event Report
Finally it should be not ed t hat it is also possible t hat in case of radio link replacem ent m easurem ent ( e.g. Event I D e 1 c) it is also possible t o forbid defined Prim ary CPI CHs t o effect t he report ing range. This m eans: som e cells
can be excluded from RRC m easurem ent .
UMTS Signaling
3 .7 .5 I n t r a Fr e que n cy M e a su r e m e nt Re por t
The next figure shows a RRC Measurem ent Report t hat is relat ed t o t he previous RRC Measurem ent I nit iat ion by
t he sam e Measurem ent I dent it y = 9.
The sect ion Measured Result s cont ains t he int ra frequency m easured result list . Here are CPI CH Ec/ No values
report ed for t w o cells t hat have been defined as cells t o be m onit ored in t he set up m essage before. An addit ional
sect ion cont ains t he ev ent result t hat was t he reason why t he m easurem ent report was sent . I n t he exam ple t he
Prim ary CPI CH of cell w it h Prim ary Scram bling Code ( PScrCd) = 163 ent ered t he report ing range, which w ill lead
t o a NBAP Radio Link Addit ion procedure in case of soft er handover or NBAP Radio Link Set up procedure in case
of soft handover procedure. I n bot h cases t he NBAP procedure w ill be followed by a RRC Act ive Set Updat e
procedure t hat cont ains once again t he PScrCd of t he cell t hat is added t o t he act ive set .
Figure 3 45 I nt rafrequency Measurem ent Report
3 .7 .6 I n t r a Fr e que n cy M e a su r e m e nt M odifica t ion

Now aft er t he SRNC receiv ed t he first m easurem ent report it m ay decide t o change t he RRC m easurem ent
configurat ion. I n t his case a new RRC Measurem ent Cont rol m essage is sent form SRNC t o UE cont aining t he
sam e m easurem ent ident it y ( = 9) as in m easurem ent set up m essage, but Measurem ent Com m and t his t im e is
set t o " m odify" .
The cell t hat was ordered t o be m easured, but not found by UE can be rem oved from int ra frequency cell info list .
I t is indicat ed in t his procedure using t he int ra frequency cell I D defined in t he m easurem ent set up m essage. I n
addit ion t he event crit eria list is included in t he m essage as w ell, eit her having t he sam e or different param et ers
set t ings for t he defined t rigger event s.
UMTS Signaling
Figure 3 46 I nt rafrequency Measurem ent Modificat ion
A new m easurem ent report w ill be received aft er t his m odificat ion depending on changing posit ion of UE or
changing t ransm ission condit ions on radio int erface. I n t he ex am ple it is report ed t hat cell w it h PScrCd = 163
becom es weak, which is also docum ent ed w it h t he low CPI CH Ec/ No value from t he int ra frequency m easured
result list . As a result t he radio link from t his cell w ill be rem oved from act ive link set w it h RRC Act ive Set Updat e
( Radio link Rem oval List : PScrCd = 163) . This procedure w ill be followed now by NBAP Radio link Delet ion.
Figure 3 47 New I nt rafrequency Measurem ent Report
UMTS Signaling
3 .7 .7 M e a su r e m e n t I nit ia t ion for I nt e r Fr e que n cy M e a su r e m e nt

I nt er frequency m easurem ent is init iat ed in quit e t he sam e way as m easurem ent of cells w it h sam e frequency as
present cell. There is a Measurem ent Cont rol m essage sent by SRNC t o UE cont aining an opt ional int er frequency
cell info list and report ing crit eria, e.g. prim ary CPI CH Ec/ No. The int er frequency event list cont ains all event - I Ds
of event - I D group e2 t o be act ivat ed on UE side.
3GPP 25.331 ( Rel. 99) specifies t he follow ing event s in t his group:
e 2 a : Cha n ge of be st fr e que ncy

e 2 b: Th e e st im a t e d qu a lit y of t h e cu r r e n t ly u se d fr e qu e n cy is be low a ce r t a in t h r e sh old a n d
t h e e st im a t e d qu a lit y of a n on - u se d fr e que ncy is a bove a ce r t a in t hr e shold
e 2 c: Th e e st im a t e d qu a lit y of a n on - u se d fr e que ncy is a bove a ce r t a in t hr e shold
e 2 d: Th e e st im a t e d qu a lit y of t h e cu r r e n t ly u se d fr e qu e n cy is be low a ce r t a in t h r e sh old
e 2 e : Th e e st im a t e d qu a lit y of a n on - u se d fr e qu e n cy is be low a ce r t a in t h r e sh old
e 2 f: Th e e st im a t e d qu a lit y of t h e cu r r e n t ly u se d fr e qu e n cy is a bove a ce r t a in t h r e sh old
Oft en it is observed in net work environm ent s t hat all int er frequency m easurem ent is set up and report ed
separat ed from ot her m easurem ent , which m eans t his kind of m easurem ent is relat ed t o a dedicat ed
m easurem ent ident it y. I n t he exam ple m easurem ent I D = 12.
Figure 3 48 RRC I nt er- frequency Measurm ent I nit iat ion
The appropriat e Measurem ent Report m essage is received lat er in t he sam e w ay and based on t he sam e
condit ions as in case of int ra frequency m easurem ent .
3 .7 .8 Fu r t h e r RRC M e a su r e m e n t Gr ou ps
Event - I D group e 3 deals w it h int er- RAT ( Radio Access Technology) m easurem ent . For inst ance cells of GSM,
CDMA2000 or TDMA net works can be m onit ored and reported t o SRNC t o change over t o a different RAT if
UTRAN operat ion condit ions becom e t oo bad for t he UE.
The event s defined for int er- RAT m easurem ent are:
UMTS Signaling
e 3 a : Th e e st im a t e d qu a lit y of t h e cu r r e n t ly u se d UTRAN fr e qu e n cy is be low a ce r t a in

t h r e sh old a n d t h e e st im a t e d qu a lit y of t h e ot he r syst e m is a bove a ce r t a in t hr e shold
e 3 b: Th e e st im a t e d qu a lit y of ot h e r syst e m is be low a ce r t a in t h r e sh old
e 3 c: Th e e st im a t e d qu a lit y of ot h e r syst e m is a bove a ce r t a in t h r e sh old
e 3 d: Ch a n ge of be st ce ll in ot h e r syst e m
Event - I D group e4 allows SRNC t o decide on behalf of UE's RLC payload buffer in which RRC st at e t he UE shall
operat e during an act ive PDP cont ext . The t ype of hard handover t hat is ex ecut ed when m easurem ent report s
w it h e4 event s are received is also known as channel t ype sw it ching. A full scenario of such a procedure is
shown in one of t he following chapt ers.
The event s defined for RLC payload buffer m easurem ent ( Figure 3.49) are:
4a: RLC buffer payload ex ceeds an absolut e t hreshold

e4b: RLC buffer payload becom es sm aller t han an absolut e t hreshold
Figure 3 49 Traffic Volum e Measurem ent and event s ( from 3GPP 25.331) .
A param et er t o lim it and opt im ize t he num ber of m easurem ent report s in t his group is Pending Tim e aft er Trigger.
I t is a t im er t hat ensures t hat posit ive or negat ive short t im e buffer peaks w ill not result in consecut ive
m easurem ent report s.
UMTS Signaling
Figure 3 50 Pending t im e aft er t rigger ( from 3GPP 25.331) .
Event - I D e 5 a is used t o report t hat t he num ber of CRC errors on a cert ain t ransport channel ( downlink t ransport
channel block error rat e [ BLER] ) in downlink direct ion exceeds a t hreshold. Once again t he Pending Tim e aft er
Trigger param et er is used in case of t his event t o lim it t he num ber of m easurem ent report s.
For event - I D group e6 t he following t rigger event s are defined:
e 6 a : Th e UE Tx pow e r be com e s la r ge r t h a n a n a bsolu t e t h r e sh old

e 6 b: Th e UE Tx pow e r be com e s le ss t h a n a n a bsolu t e t h r e sh old
e 6 c: Th e UE Tx pow e r r e a ch e s it s m in im um va lu e
e 6 d: Th e UE Tx pow e r r e a ch e s it s m a x im u m va lu e
e 6 e : Th e UE RSSI r e a ch e s t h e UE's dyn a m ic r e ce ive r ra n ge
e 6 f: Th e UE Rx - Tx t im e diffe r e n ce for a RL in clu de d in t h e a ct ive se t be com e s la r ge r t h a n a n
a bsolu t e t h r e sh old
e 6 g: Th e UE Rx - Tx t im e diffe r e n ce for a RL in clu de d in t h e a ct ive se t be com e s le ss t h a n a n
a bsolu t e t h r e sh old
3 .7 .9 Ch a n gin g Re por t in g Con dit ions a ft e r Tr a n sit ion t o

CELL_ FACH
Aft er t ransit ion t o RRC CELL_FACH st at e UE st ops sending int rafrequency, int er- frequency and int ersyst em
m easurem ent report s according t o previous definit ion in Measurem ent Cont rol m essages. Then it st art s
m onit oring neighboring cells list ed in BCH Syst em I nform at ion Block 12 or 11 and st ores report ing crit eria
received from sam e SI B.
Traffic volum e m easurem ent report ing ( Event - I D Group e4) is cont inued if UE st at e of report ing = all st at es or
all st at es except CELL_DCH in prev ious Measurem ent Cont rol. I f no t raffic volum e m easurem ent was defined in
prev ious Measurem ent Cont rol UE st art s t raffic volum e m easurem ent according t o info in BCH SI B 12 or 11.
Prev ious m easurem ent definit ions ( received in form er CELL_DCH st at e) can be resum ed when UE changes back
t o CELL_DCH. I n t his case it should be not ed t hat report ing crit eria defined in Measurem ent Cont rol m essage
have a higher priorit y in com parison t o t he sam e m easurem ent definit ions sent on BCH SI B 12 or 11.
UMTS Signaling
3 .8 I UB - PH YSI CAL CH AN N EL RECON FI GURATI ON ( PD PC)
Figure 3 51 I ub Physical Channel Reconfigurat ion during Act ive PDP Cont ext Overview
This scenario describes t he case of PDP Cont ext Act ivat ion w it h physical channel reconfigurat ion. Aft er regular
set up of PDP cont ext w it h dedicat ed channels for DCCH and DTCH ( st ep 1- 4) t he UE sends a m easurem ent report
including an ev ent I D ( st ep 5) .
The event I D indicat es t hat t here is only a sm all am ount of dat a t o be t ransport ed from UE t o t he net work. Hence,
it m ade t he decision t o change int o CELL_FACH st at e and perform user dat a t ransm ission on RACH/ FACH.
St e p 6 :
The Physical Channel Reconfigurat ion and Cell Updat e procedures are perform ed t o release t he radio resources
provided for t he DCH t hat carried t he DTCH. However, t he AAL2 SVC for t he DTCH st ays act iv e on I ub int erface.
St e p 7 :
Since t he dedicat ed channels are not used anym ore t hey are delet ed as w ell as t heir appropriat e AAL2 SVCs and
radio resources.
St e p 8 :
The PDP cont ex t w ill finally be deact ivat ed by a GPRS Det ach procedure.
UMTS Signaling
Figure 3 52 I ub Physical Channel Reconfigurat ion ( PDP Cont ext ) Call Flow 1/ 6
The follow ing descript ion w ill only highlight t he m essages and param et ers t hat are im port ant t o underst and t he
physical channel reconfigurat ion. All ot her m essages/ param et ers are as described in PDP Cont ext
Act ivat ion/ Deact ivat ion.
3 .8 .1 .1 .1 I u b PS PD P Act iva t ion a n d Ph ysica l Ch a n n e l Re con figu r a t ion
To analyze t his scenario it is recom m ended t o set an em phasis on wat ching som e param et ers already show n in
RRC Connect ion Set up m essage exam ple before, especially RNTI and RRC st at e indicat or. The m apping info for
signaling radio bearers ( SRB) will show from t he beginning t w o m apping opt ions: eit her DCH can be used t o
exchange signaling or DCCHs can alt ernat ively be m apped ont o RACH ( uplink) and FACH ( downlink) .
FACH DL RLC UMD r r cCon n e ct ion Se t u p ( rrc- Transact ion I dent ifier= a ,
ULscram blingCode/ DLchannelisat ionCode= b/ , P- TMSI , u- RNTI : SRNC- I D + s- RNTI , SRB Mapping Opt ions for
DCH and RACH/ FACH, RRC St at e I ndicat or = CELL_DCH) .
UMTS Signaling
Message Exam ple 3 24: RRC Connect ion Set up wit h RB Mapping Opt ions
The m essage exam ple shows only t he radio bearer m apping opt ions for SRB 1. All ot her SRBs have sim ilar
m apping opt ions.
UMTS Signaling
On behalf of t he Measurem ent Cont rol m essage RRC relat ed m easurem ent in t he UE is act ivat ed ( see prev ious
chapt er) .
DCH DL rrc m easurem ent Cont rol ( rrc- Transact ionI dent ifier= a , m easurem ent I dent it y= r , Ev ent t rigger enabled for
event - I D: e 4 a , e 4 b)
A DCH for a dedicat ed t raffic channel ( DTCH) is inst alled by t he RNC aft er receiving Act ivat e PDP Cont ext Request
m essage from t he m obile ( Figure 3.54 t o 3.55) .
UMTS Signaling
I n t he Radio Bearer Set up m essage t he t ransport channel used for t he payload t ransm ission is ident ified as dch x
( RRC Transport Channel I D) . Lat er RRC m easurem ent report s w ill refer t o t his ident it y. I n addit ion a new DL
channelizat ion code is assigned according t o ex pect ed higher dat a t ransm ission rat e on radio int erface.
DCH DL RRC Ra dioBe a r e r Se t u p ( ULscram blingCode/ DLchannelisat ionCode= b/
, dch x )
UMTS Signaling
Message Exam ple 3 25: RRC Radio Bearer Set up wit h RB Mapping Opt ions
The m essage exam ple shows t hat t here are RB m apping opt ions for t he DTCH ( for I P services like w ebbrowsing
only one RB is necessary) sim ilar t o t hose for t he DCCHs seen in RRC Connect ion Set up m essage exam ple.
Scram bling codes and channelizat ion codes are not shown in t he m essage exam ple.
When t he UE received t he Act ivat e PDP Cont ext Accept m essage t he PDP Cont ext becom es act ive.
A RRC Measurem ent Report including event I D= e4b t riggers t he physical channel reconfigurat ion ( Figure 3.56) :
DCH UL RLC AMD r r cM e a su r e m e n t Re por t ( m easurem ent I dent it y = r , dch x , event I D= e4b)
Message Exam ple 3 26: RRC Measurem ent Report ( event I D = e4b)
I t is indicat ed by event I D= e4b t hat RLC buffer payload becam e sm aller t han an absolut e t hreshold. Hence, t he
decision is m ade by t he RNC t o sw it ch t he UE int o t he CELL_FACH st at e and release t he radio resources for t he
DCH w it h ident ifier dch x t hat carried t he DTCH.
DCH DL RLC AMD RRC Ph ysica lCa n n e lRe con figu r a t ion ( rrc- TI D= a , rrcSt at eI ndicat or= CELL_FACH)
UMTS Signaling
Message Exam ple 3 27: RRC Physical Channel Reconfigurat ion

Aft er t ransit ion int o CELL_FACH st at e UE sends a Cell Updat e m essage t o confirm t he successful change of RRC
st at e and t o request a c- RNTI t hat was not assigned so far. The Cell Updat e m essage cont ains u- RNTI as UE
ident ifier, st art values t o cont inue t he act ive ciphering of I P payload on RACH/ FACH and a cell updat e cause =
" cell reselect ion" .
RACH UL RLC TMD RRC Ce llUpda t e ( u- RNTI : srnc- I Dent it y= c + s- RNTI =
updat e cause= " ce ll r e se le ct ion " )
, st art values for ciphering, cell
Message Exam ple 3 28: RRC Cell Updat e

Wit h Cell Updat e confirm m essage t he UE receives t he request ed new c- RNTI t hat w ill be valid UE ident ifier for all
RLC/ MAC fram es cont aining I P payload as long as UE st ays in t he present cell.
FACH DL RLC TMD RRC Ce llUpda t e Con fir m ( new C- RNTI =
,RRC St at e I ndicat or = CELL_FACH)
Message Exam ple 3 29: RRC Cell Updat e Confirm
RACH UL RLC AMD RRC UTRAN M obilit yI n for m a t ion Con fir m ( rrc- TI D= a ) confirm s t hat t he new c- RNTI was
received and is valid. RRC Transact ion I dent ifier ( rrc- TI D) value links t his m essage t o t he Physical Channel
Reconfigurat ion procedure.
Aft er t he next m essage
RACH UL RLC AMD RRC Ph ysica lCh a n n e lRe con figu r a t ion Com ple t e ( rrc- TI D= a )
t he PDP Cont ext is act ive over Com m on Channels and I P packet s w ill t ransm it t ed using RACH and FACH channels.
All user plane packet s on com m on t ransport channels w ill be ident ified by c- RNTI .
UMTS Signaling
All radio and AAL2 resources for dedicat ed channels, which are not used anym ore, are delet ed ( as shown in
Figure 3.57) , but t he PDP Cont ext is st ill act ive over Com m on Channels. Th e Re le a se of t h is con n e ct ion w ill
h a ppe n w it h a GPRS de t a ch pr oce du r e if t h e r e is n o ch a n ge ba ck t o CELL_ D CH RRC st a t e !
UMTS Signaling
3 .9 CH AN N EL TYPE SW I TCH I N G
3 .9 .1 Ove r vie w
Figure 3 58 PDP Cont ext Channel Type Swit ching Overview
The procedure t hat uses Physical Channel Reconfigurat ion t o change t he st at e of RRC connect ion is also called
Channel Type Sw it ching. Channel Type Sw it ching can be t riggered by ev ent s det ect ed by t he UE or by t he
net work ( SRNC) . I f during an act ive PDP cont ext t he RLC buffer of t he connect ion st ays for a defined t im e period
below a cert rain t hreshold dedicat ed cont rol channels as w ell as dedicat ed t raffic channels w ill be m apped ont o
com m on t ransport channels ( RACH and FACH) , which are used t o t ransport signaling and I P payload in uplink or
downlink direct ion. I s t hen t he RLC buffer filled up again dedicat ed resources w ill be assigned once again t o serve
t he request ed qualit y of service.
From net work opt im izat ion point of view, Channel Type Swit ching is one of t odays biggest problem s especially
for web- browsing. The source of t he problem is locat ed in t he user plane. Here HTTP ( HyperText Transfer
Prot ocol) uses connect ion- orient ed t ransport services of TCP ( Transm ission Cont rol Prot ocol) . TCP is designed in a
way t hat every TCP fram e sent need t o be acknowledge by t he peer ent it iy. The w indow size param et er t hat
defines aft er how m any sent fram es t he connect ion is set on hold by sending ent it y t o wait for t he
acknowledgem ent of t he peer ent it y cannot be changed by users. ( Well, expert s say TCP w indow size could be
changed if Windows regist ry files are edit ed, but t his is not what norm al Windows users w ill do.)
I t is a pret t y long dist ance bet w een t he com put er connect ed t o UE and t he w ebserver, which is it s TCP peer
ent it y. I n ot her words: t he delay t im e for a TCP acknow ledgem ent fram e under t hese condit ions is v ery long so
long t hat RLC buffer for eit her uplink or downlink dat a t ransfer becom es em pt y while wait ing for TCP
acknow ledgem ent and t his t riggers change t o RRC st at e CELL_FACH, because UTRAN does not expect a high dat a
t ransfer rat e for t he connect ion aft er t he long delay t im e.
But suddenly aft er successful acknow ledgem ent t here is anot her wave of TCP dat a ent ering t he RLC buffer and
now packet scheduler expert s a very high dat a t ransm ission rat e on user plane. Hence, dedicat ed resources are
assigned t o guarant ee high dat a t ransm ission rat e, but next delay caused by w ait ing for TCP acknow ledgem ent
com es soon et c.
There is only one t rue solut ion t o overcom e t his problem in t he fut ure: design a new TCP st andard w it h a new
flex ible w indow size param et er. However, t o define a new prot ocol st andard w ill t ak e som e years. Meanwhile
net work operat ors t ry t o reduce t he TCP delay t im es by inst alling proxy serv ers on Gi int erface close t o GGSNs t o
UMTS Signaling
speed up at least t he connect ions for frequent ly visit ed w ebsit es. Alt hough t here are st ill far t oo m any channel
t ype sw it ching procedures are m onit ored in t he UTRAN. An int erest ing exam ple t hat is m ore sophist icat ed t han
t he one described in previous scenario is given now:
St e p 1 :
Set up of a RRC Connect ion is request ed by UE. This m essage is sent on RACH.
St e p 2 :
A RRC Connect ion is set up t hat does not use dedicat ed resources. All signaling m essages w ill be t ransport ed on
RACH ( uplink) and FACH ( downlink) . The dedicat ed cont rol channels are m apped ont o t hese com m on t ransport
channels.
St e p 3 :
A PDP Cont ex t Act ivat ion Request m essage is sent from UE side.
St e p 4 :
Before t he PDP Cont ext is act ivat ed a dedicat ed radio link t hat w ill carry a also set up radio beaer is est ablished.
SRNC orders UE t o sw it ch int o t he st at e CELL_DCH.
St e p 5 :
Using t he t ransport capabilit ies of t he est ablished DCHs PDP cont ext act ivat ion is confirm ed by t he net work.
St e p 6 :
Caused by first TCP acknow ledgem ent delay t he RLC buffer on net work side is below a cert ain t hreshold. Hence,
SRNC orders UE t o change t o CELL_FACH st at e.
St e p 7 :
Physical channel reconfigurat ion is perform ed t o m ap DCCHs and DTCHs ont o com m on t ransport channels RACH
and FACH. Cell Updat e procedure is em bedded t o assign new UE indent it y ( new c- RNTI ) .
St e p 8 :
Dedicat ed resources for radio links and AAL2 SVCs on I ub are delet ed.
St e p 9 :
UE sends RRC m easurem ent report t o announce t hat RLC buffer is full again. This t riggers SRNC t o order change
back t o CELL_DCH st at e and t o re- assign dedicat ed resources.
St e p 1 0 :
New radio link set up. DCCHs and DTCHs are m apped on t o DCHs, RRC st at e is changed t o CELL_DCH, but it is
predict able t hat RLC buffer eit her on UE or on net work side w ill be soon em pt y again and channel t ype sw it ching
is t riggered once again
Figure 3 59 PDP Cont ext Channel Type Swit ching Call Flow 1/ 9
UMTS Signaling
St a ge 1 - ATTACH a n d PD P Con t e x t Act iva t ion :
As usual t he procedure st art s w it h a RRC Connect ion Request sent by UE. The est blishm ent cause is regist rat ion ,
because t his UE is not at t ached t o t he PS dom ain y et .
RACH: UL RLC TMD r r cCon n e ct ion Re qu e st ( P- TM SI , est ablishm ent Cause= regist rat ion)
The RNC decided t hat for t he exchange of signaling m essages t he com m on t ransport channels w ill be used. This
decision can be driven by present t raffic sit uat ion in t he cell. Maybe t here are already m any dedicat ed resources
in use. I n RRC Connect ion Set up m essage sent on FACH t he RRC st at e indicat or orders t he UE t o cont inue t he
RRC connect ion in CELL_FACH st at e. This is t he reason why not only a u- RNTI , also a c- RNTI is assigned. Uplink
channel t ype of t he signaling radio bearers is RACH, downlink channel t ype of SRBs is FACH. The t ransport
channel ident it ies are t hose assigned during com m on t ransport channel set up ( see Node B set up scenario) .
FACH: DL RLC UMD r r cCon n e ct ion Se t u p ( rrc- Transact ionI dent ifier= a , P- TM SI , U- RN TI : SRNC- I D= c + SRNTI = d, C- RNTI = e , rrc- St at eI ndicat or= ce ll- FACH , ul- t ranspor t ChannelType= RACH , dlt ransport ChannelType= FACH, ul/ dl- t ransport ChannelI dent it y)
UMTS Signaling
Message Exam ple 3 30: RRC Connect ion Set up for PDP Cont ex t in CELL_FACH
The m essage ex am ple shows t hat t he sam e radio bearer m apping opt ions are giv en as in case of PDP cont ex t
act ivat ion in CELL_DCH st at e, but beside t he different RRC St at e I ndicat or t here is also no uplink scram bling code
and downlink channelizat ion code sent t o UE, because t here is no dedicat ed physical channel assigned.
On RACH UE sends RRC Connect ion Set up Com plet e. The RRC m essage it self is linked t o t he prev ious RRC
Connect ion Set up by RRC Transact ion I dent ifier, but it does not cont ain an UE ident ifier. While in CELL_FACH
st at e t he UE is known by it s c- RNTI t hat is part of t he MAC fram e. I t is possible t hat t he RRC m essage is
t ransport ed in several segm ent s by RLC/ MAC and finally reassem bled by RNC or m easurem ent equipm ent t hat
m onit ors I ub int erface. Depending on used m easurem ent softw are it is possible t hat c- RNTI is only shown for t he
segm ent ed fram es, but not for t he reassem bled RRC m essage.
UMTS Signaling
Figure 3 60 RRC Connect ion Set up: Segm ent ed and Reassem bled RLC Fram es
RACH: UL MAC: UE- I D Type= C- RNTI , MAC: UE- I D= e , RLC AMD r r cCon n e ct ion Se t u pCom ple t e ( rrcTransact ionI dent ifier= a , UE- RadioAccessCapabilit y) .
Wit h an RRC I nit it ial Direct Transfer t he At t ach Request ( ATRQ) m essage is sent on RACH t o RNC and forwarded
t o SGSN and aft er successfully sw it ch on of securit y funct ions t he At t ach is accept ed and a new P- TMSI is
assigned wit h ATAC m essage. Recept ion of new P- TMSI is confirm ed w it h At t ach Com plet e ( ACOM) :
RACH: UL MAC: UE- I D Type= C- RNTI , MAC: UE- I D= e , RLC AMD RRC init ialDirect Transfer ATRQ
FACH: DL MAC: UE- I D Type= C- RNTI , MAC: UE- I D= e , RRC Securit yModeCom m and
RACH: UL MAC: UE- I D Type= C- RNTI , MAC: UE- I D= e , RRC Securit yModeCom plet e
Figure 3 61 PDP Channel Type Swit ching 2/ 9
FACH: DL MAC: UE- I D Type= C- RNTI , MAC: UE- I D= e, Downlink Direct Transfer ATAC
RACH: UL MAC: UE- I D Type= C- RNTI , MAC: UE- I D= e, UplinkDirect Transfer ACOM
Now t he subscriber want s t o act ivat e a PDP cont ext . St ill on RACH Act ivat e PDP Cont ext Request ( APCR) is sent
t o t he net work cont aining Access Point Nam e ( APN) t o get a dynam ic I P address assigned by t his server. I n
addit ion t he request ed QoS at t ribut es are included.
RACH: UL MAC: UE- I D Type= C- RNTI , MAC: UE- I D= e , RRC UplinkDirect Transfer APCR ( APN, request ed Qualit y of
Serv ice)
Recept ion of APCR in SGSN t riggers RANAP RAB assignm ent procedure on I uPS. Based on t he QoS request ed for
t he RAB SRNC packet scheduler funct ion decides t o set up dedicat ed channels for signaling and user t raffic. I n
next st ep SRNC ( t hat is also CRNC for t his Node B) perform s NBAP Radio Link Set up procedure. I n NBAP
I nit iat ing Message of t his procedure for each DCH t he uplink and downlink t ransport form at set ( TFS) is defined
as shown in form er scenarios.
N BAP DL init iat ingMessage I d- r a dioLin k Se t u p ( longTransAct ionI D= f, id- CRNC- Com m unicat ionCont ext I D= g,
ULscram blingCode= b, DCH- I D= h [ UL/ DL TFS: nrOfTransport Blocks, t ransport BlockSize,
t ransm issionTim eI nt erval, channelCoding, codingRat e, cRC- Size] , DCH- I D= i [ UL/ DL TFS: nrOfTransport Block s,
t ransport Block Size, t ransm issionTim eI nt erval, channelCoding, codingRat e, cRC- Size] , rL- I D= j , C- I D= k )
UMTS Signaling
Successful Out com e for radio link set up cont ains t wo binding- I Ds t hat w ill be used t o ident ify ALCAP Est ablish
procedure for Signaling DCH and User Traffic DCH as already described in previous scenarios.
N BAP UL successfulOut com e I d- r a dioLin k Se t u p ( longTransAct ion I D= f, id- CRNC- Com m unicat ionCont ext I D= g,
id- NodeB- Com m unicat ionCont ext I D= l, Com m unicat ionPort I D= m , rL- I D= j , rL- Set - I D= n , dCH- I D= h
bindingI D= o, dCH- I D= i
bindingI D= p)
ALCAP DL ERQ ( Originat ing Signal. Ass. I D= q, AAL2 Pat h= r , AAL2 Channel id= s, served user gen reference= o)
ALCAP UL ECF ( Originat ing Signal. Ass. I D= t , Dest inat ion Sign. Assoc. I D= q)
Figure 3 62 PDP Cont ext Channel Type Swit ching 3/ 9
ALCAP DL ERQ ( Originat ing Signal. Ass. I D= u , AAL2 Pat h= r , AAL2 Channel id= v, served user generat ed
reference= p)
ALCAP UL ECF ( Originat ing Signal. Ass. I D= w , Dest inat ion Sign. Assoc. I D= u )
Then follows t he synchroizat ion procedures of Fram ing Prot ocol ( FP) on bot h AAL2 SVCs.
D CH 1 for D CCH s in AAL2 Pat h= r and Channel= s: downlink and uplink synchronizat ion fram ing prot ocol ( FP)
fram es
D CH 2 for D TCH s in AAL2 Pat h= r and Channel= v: downlink and uplink synchronizat ion FP fram es
Now RRC Radio Bearer Set up is sent t o UE using FACH, because t he UE st ill does not know anyt hing about t he
provided dedicat ed resources. The m essage cont ains also RRC St at e I ndicat or t hat orders UE t o change int o st at e
CELL_DCH.
FACH : DL MAC: UE- I D Type= C- RNTI , MAC: UE- I D= e , RLC AMD RRC r a dioBe a r e r Se t u p ( rrc- Transact ion
I dent ifier= a , rrc- St at eI ndicat or= ce ll- D CH , gsm - MAP- RAB- I dent it y= 5 , ul/ dl- t ransport ChannelType= DCH, ul/ dlt ransport ChannelI dent it y= h ,i, UL_scram blingCode/ DL_channelizat ionCode= b/ , prim ary Scram blingCode= x )
NBAP Radio Link Rest orat ion indicat es t hat t he dedicat ed physical channels have been found by UE on radio
int erface.
N BAP UL init iat ingMessage id- r a dioLin k Re st or a t ion ( short TransAct ion I D= y, id- CRNCCom m unicat ionCont exit I D= g, rL- Set - I D= n )
UMTS Signaling
Aft er radio bearer set up com plet ion act ivat ion of PDP cont ext s is confirm ed including t he negot iat ed qualt it y of
service t hat is based on t he subscribed QoS values st ored in HLR.
DCH UL RLC AMD RRC Ra dioBe a r e r Se t u pCom ple t e ( rrc- Transact ion I dent ifier= a )
DCH DL RLC AMD RRC Downlink Direct Transfer APCA ( subscribed Qualit y of Serv ice)
Now t he PDP Cont ext is act iv e and RRC t raffic v olum e m easurem ent on UE side is init ialized by SRNC.
DCH DL RLC AMD RRC m e a su r e m e n t Con t r ol ( t rafficVolum eMeasurem ent , dCH- I D= i, event - I D= e 4 a , event I D= e 4 b, )
Figure 3 64 PDP Cont ext Channel Type Swit ching Overview 5/ 9

St age 2 - Change back t o CELL_FACH ( Figure 3.64/ 3.65) :
UMTS Signaling
The delay in I P payload t ransm ission caused by TCP acknow ledgem ent procedure leads t o a em pt y RLC buffer on
RNC side. Because of t he obv iously low dat a t ranm ission rat e RNC decides t o cont inue t he connect ion in
CELL_FACH and release t he previously assigned dedicat ed radio resources. A RRC Cell Updat e procedure is
perform ed t o assign a new c- RNTI :
DCH DL RLC AMD RRC PhysicalChannelReconfigurat ion ( rrc- St at eI ndicat or= cell- FACH)
RACH UL RLC TMD RRC cellUpdat e ( u- RNTI : srnc- I Dent it y = c + s- RNTI = d, cellUpdat eCause = cellReselect ion)
FACH DL MAC: UE- I D Type= U- RNTI , MAC: UE- I D= c+ d, RLC UMD RRC ce llUpda t e Con fir m ( new C- RNTI = z { in
follow ing m essage exam ple z = 9} , rrc- St at eI ndicat or= cell- FACH)
RACH UL MAC: UE- I D Type= C- RNTI , MAC: UE- I D= z, RLC AMD RRC
ph ysica lCh a n n e lRe con figu r a t ion Com ple t e ( rrc- Transact ion I dent ifier= a )
RACH UL MAC: UE- I D Type= C- RNTI , MAC: UE- I D= z, RLC AMD RRC u t r a n M obilit yI n for m a t ion Con fir m ( rrcTransact ion I dent ifier= a )
N BAP DL init iat ingMessage I d- Ra dioLin k D e le t ion ( id- CRNC- Com m unicat ionCont ext I D= g,
NodeBCom m unicat ionsCont exr- I D= l,
rL- I D= j )
N BAP UL successfulOut com e I d- Ra dioLin k D e le t ion ( id- CRNC- Com m unicat ionCont ext I D= g)
ALCAP DL REL ( Dest . Sign. Assoc. I D= t ) ( DCH)
ALCAP UL RLC ( Dest . Sign. Assoc. I D= q)
ALCAP DL REL ( Dest . Sign. Assoc. I D= w ) ( Traffic)
ALCAP UL RLC ( Dest . Sign. Assoc. I D= u )
UMTS Signaling
Aft er release of all dedicat ed resources I P payload as well as signaling m essages are t ransport ed using RACH and
FACH. This goes on unt il a RRC Measurm ent Report inform s t he net work using t hat RLC buffer on UE side is quit e
full ( event I D e 4 a ) and higher dat a t ransm ission rat e can be expect ed.
RACH: UL MAC: UE- I D Type= C- RNTI , MAC: UE- I D= z, RLC AMD I P pa yloa d
Message Exam ple 3 31: Uplink I Pv4 Payload Fram e sent over RACH
I n t he m essage exam ple we see an I Pv4 fram e sent in uplink direct ion over RACH. C- RNTI of t he UE is 9 and
higher lay er prot ocol on t op of I Pv4 is UDP. I P source address ident ifies t he I P t erm inal connect ed t o UE,
dest inat ion I P address ident ifies e.g. a serv er in t he int ernet ( expressions " xx x" are used t o hide real address
values) .
FACH: DL MAC: UE- I D Type= C- RNTI , MAC: UE- I D= z, RLC AMD I P pa yloa d
St a ge 3 - Cha n ge ba ck t o CELL_ D CH :
RACH: UL MAC: UE- I D Type= C- RNTI , MAC: UE- I D= z, RLC AMD RRC m e a su r e m e n t Re por t
( t rafficVolum eEvent I dent it y= e 4 a )
Based on t he event in t he received RRC m easurem ent report SRNC decides once again t o assign dedicat ed
resources and cont inue connect ion in RRC CELL_DCH st at e ( Figure 3.66/ 3.67) .
N BAP DL init iat ingMessage I d- r a dioLin k Se t u p ( longTransAct ionI D= a a , id- CRNC- Com m unicat ionCont ext I D= bb,
scram blingCode= b,
UMTS Signaling
DCH- I D= h + TFS ( nrOfTransport Blocks, t ransport BlockSize, t ransm issionTim eI nt erval, channelCoding,
codingRat e, cRC- Size) , DCH- I D= I + TFS
( nrOfTransport Blocks, t ransport BlockSize, t ransm issionTim eI nt erval, channelCoding, codingRat e, cRC- Size) , rLI D= j , C- I D= k )
N BAP UL successfulOut com e I d- r a dioLin k Se t u p ( longTransAct ion I D= aa, id- CRNCCom m unicat ionCont ext I D= bb, id- NodeB- Com m unicat ionCont ext I D= cc, Com m unicat ionPort I D= m , rL- I D= j , rLSet - I D= n , dCH- I D= h , bindingI D= dd, dCH- I D= i, bindingI D= e e )
ALCAP DL ERQ ( Originat ing Signal. Ass. I D= ff, AAL2 Pat h= r , AAL2 Channel id= h h , served user gen
reference= dd)
ALCAP UL ECF ( Originat ing Signal. Ass. I D= gg, Dest inat ion Sign. Assoc. I D= ff)
ALCAP DL ERQ ( Originat ing Signal. Ass. I D= ii, AAL2 Pat h= r , AAL2 Channel id= j j , served user gen reference= e e )
ALCAP UL ECF ( Originat ing Signal. Ass. I D= k k , Dest inat ion Sign. Assoc. I D= gg)
D CH 1 for D CCH s in AAL2 Pat h= r and Channel= h h : downlink and uplink synchronizat ion FP fram es
D CH 2 for D TCH s in AAL2 Pat h= r and Channel= j j : downlink and uplink synchronizat ion FP fram es
Because t he previously used scram bling codes and channelizat ion codes are st ill reserved for t his connect ion t his
t im e a Transport Channel Reconfigurat ion is perform ed ( Figure 3.67/ 3.68) :
FACH: DL MAC: UE- I D Type= C- RNTI , MAC: UE- I D= z, RLC AMD RRC t r a n spor t Ch a n n e lRe con figu r a t ion ( rrcTransact ion I dent ifier= a ,
rrc- St at eI ndicat or= ce ll- D CH , ul/ dl- t ransport ChanelType= DCH, ul/ dl- t ransport ChanelI dent it y= h ,i,
prim aryScram blingCode= x ,
UL_scram blingCode/ DL_channelizat ioncode= b/
, P- TM SI )
UMTS Signaling
N BAP UL init iat ingMessage id- r a dioLin k Re st or a t ion ( short TransAct ion I D= j , id- CRNCCom m unicat ionCont exit I D= bb, rL- Set - I D= n )
DCH1 UL RLC AMD RRC t r a n spor t Ch a n n e lRe con figu r a t ion Com ple t e ( rrc- Transact ionI dent ifier= a )
DCH2 UL RLC AMD I P pa yloa d
DCH2 DL RLC AMD I P pa yloa d
Furt her channel t ype sw it ching procedures can be expect ed during t his connect ion because of furt her TCP
acknowledgem ent delays.
UMTS Signaling
3 .1 0 I UB - M OBI LE ORI GI N ATED CALL W I TH SOFT H AN D OVER
3 .1 0 .1 Ove r vie w
Figure 3 69 I ub Mobile Originat ed Voice Call ( MOC) wit h Soft Handover Overv iew
The Soft - Handover of a m obile originat ed call ( MOC) consist s of t hree phases. Each phase is relat ed t o t he
posit ion of t he Mobile St at ion ( MS) , also nam ed User Equipm ent ( UE) . Bot h nam es are used in UMTS st andards.
The exam ple described in t his chapt er is an I nt er Node B / I nt ra RNC handover procedure.
N ot e : A soft handover m ay not only appear during a voice call. I t is also seen if plain RRC signaling is exchanged
and during act ive PDP Cont ext . This is because t he m ain purpose of soft handover is not t o updat e t he net work
wit h t he current locat ion of t he subscriber, but t o keep t ransm ission power levels low also when UE is m oving
along cell borders. Less necessary t ransm ission power is less int erference in cell and a low er int erference level
grant s t he cell a higher capacit y: m ore users and services can be served.
Posit ion 1 :
The call is aft er set up in an act ive st at e. Dedicat ed cont rol channels for ex change of signaling m essages and
dedicat ed t raffic channels for t ransport of user dat a ( voice packet s) are act ive bet ween t he MS and t he RNC. For
each of t hem , DCCH and DTCH, t here is an I ub t ransport bearer ( AAL2 SVC) running bet ween SRNC and NodeB 1.
The MS is only able t o have radio cont act w it h a cell of NodeB 1.
Posit ion 2 :
The MS changed it s posit ion and is now able t o have radio cont act w it h bot h, t he cell of NodeB 1 and anot her cell
belonging t o NodeB 2. The MS det ect s t he availabilit y of t he new cell and sends a m easurem ent report including
an event I D t o t he RNC. Triggered by t his m easurem ent report SRNC decides t o set up a second connect ion
( radio link plus appropriat e I ub bearers) t o t he MS via NodeB 2. Finally t wo different connect ions bet w een RNC
and MS are act ive; bot h belong t o t he sam e act ive set . An act ive set can handle up t o six connect ions
sim ult aneously.
Posit ion 3 :
The MS lost radio cont act w it h NodeB 1 and sends an appropriat e m easurem ent report again. I ub t ransport
bearers for DCCH and DTCH( s) on I ub t o NodeB 1 are released.
UMTS Signaling
3 .1 0 .2 M e ssa ge Flow
Figure 3 70 I ub MOC wit h Soft Handover 1/ 9
I ub CS M OC a n d H a ndove r fr om N ode B1 t o N ode B2

To m ake t he whole process bet t er underst andable and show t he com plet e signaling first t he m essages of t he
MOC set up are described as already done in scenario MOC:
RACH : UL RLC TMD rrcConnect ionRequest ( I M SI or TM SI ,
est ablishm ent Cause= or igin a t in gCon ve r sa t ion a lCa ll)
, rL- I D= 0 , c- I D = 1 4 )
Beside ot her param et ers ( already discussed in locat ion updat e and m obile originat ed call scenarios) t his m essage
( as shown in m essage exam ple 11) cont ains radio link I D ( rL- I D) and cell I D ( c- I D) of t he cell where t he radio
link is originally set up.
I n NBAP Successful Out com e m essage of Radio Link Set up procedure t here is anot her m andat ory inform at ion
elem ent , which is very im port ant for t he m onit oring of Handover procedures: radio link set I D ( rL- Set - I D)
relat ed t o radio link I D prev iously assigned by SRNC funct ion of radio net work cont roller. Values of rL- I D and rLSet - I D in t he exam ple are decim al int eger num bers t o prevent a grow ing num ber of variables:
bindingI D= e , NodeBCom m unicat ionsCont ext - I D= p, Com m unicat ionPort I D= o, rL- I D= 0 , rL- Set - I D= 1 )
D CH in AAL2 Pat h= g and Channel= h : downlink and uplink FP synchronizat ion
, I M SI or TM SI )
UMTS Signaling
Also NBAP Radio Link Rest orat ion m essage cont ains t he radio link set I D, but neit her radio link I D nor cell I D:
N BAP UL init iat ing Message id- r a dioLin k Re st or a t ion ( short TransAct ion I D= j , id- CRNCCom m unicat ionCont ext I D= d. rL- Set - I D= 1 )
D CH 1 a RRC m e ssa ge s ( RLC AM D ) in t h is AAL2 ch a n n e l= h :
The RRC Measurem ent Cont rol m essage in t his call flow cont ains definit ions of int rafrequency cell m easurem ent :
a list of neighbour cells t hat use sam e frequency as t he cell used for set up t he present radio link and a list of
event - I Ds out of event - I D group e 1 t hat need t o be report ed t o SRNC.
DCH DL RLC AMD r r cM e a su r e m e n t Con t r ol ( r r c- Tr a n sa ct ion I de n t ifie r = a , m easurem ent I dent it y = r , List of
cells t o be m easured ide n t ifie d by t h e ir Pr im a r y Scr a m blin g Code s [ PScr Cd] , List of e ve n t - I D s t o be
report ed)
DCH UL RLC AMD r r cCon n e ct ion Se t u pCom ple t e ( rrc- Transact ionI dent ifier= a ) .
DCH
DCH
DCH
DCH
UL
DL
UL
DL
RLC AMD
RLC AMD
RLC AMD
RLC AMD
RRC init ialDirect Transfer CM SREQ

RRC Downlink Direct Transfer AUTREQ
RRC Uplink Direct Transfer AU TREP
RRC Se cu r it yM ode Com m a n d
UMTS Signaling
DCH UL RLC AMD RRC Se cu r it yM ode Com ple t e

DCH UL RLC AMD RRC Uplink Direct Transfer SETUP
DCH DL RLC AMD RRC Downlink Direct Transfer CPROC
)
I D= j , id- CRNC- Com m unicat ionCont ext I D= d. bindingI D= k , rL- I D= 0 )
UMTS Signaling
N ow t h e t r a n spor t be a r e r for t r a ffic ch a n ne ls ( Pa t h = m a n d Ch a n n e l = n ) on I u b w ill be ope n e d,

dow n lin k a n d u plin k FP syn ch r on iza t ion fra m e s a r e t r a n sm it t e d.
NodeBCom m unicat ionsCont ext - I D= p)
The follow ing m essages in DCH AAL2 Pat h= g and Channel= h are:
DCH
DCH
DCH
DCH
DCH
DL RRC Ra dioBe a r e r Se t u p ( ULscram blingCode/ DLchannelisat ionCode= b/

RRC DownlinkDirect Transfer ALERT
RRC DownlinkDirect Transfer CON N ECT
RRC Uplink Direct Transfer CON ACK
UMTS Signaling
The handover procedure is t riggered by a m easurem ent report sent by t he MS v ia NodeB 1. This m easurem ent
report m essages is relat ed t o t he Measurem ent Cont rol sent during call set up on behalf of t he sam e
m easurem ent ident it y . The report indicat es t he occurrence of an event t hat is described by it s event I D. Follow ing
RRC prot ocol specificat ion TS 25.331 report ev ent 1a ( e1a) m eans t he m obile det ect ed a new prim ary Com m on
Pilot Channel ( CPI CH) . This m eans a new cell ( from t he list of cells t o be m easured in t he Measurem ent Cont rol
m essage) cam e close enough and can now be used for com m unicat ion bet ween MS and net work. The new cell is
ident ified on radio int erface by it s prim ary scram bling code:
DCH1a UL RLC AMD r r cM e a su r e m e n t Re por t ( m easurem ent I dent it y = r , Ev ent Result s: ev ent I D= e1a= a prim ary
CPI CH ent ers t he report ing range , Prim ary Scram blingCode= h h )
Based on t he m easurem ent report t he RNC decides t o hand ov er t he call t o t he new cell. First radio resources
m ust be prov ided using NBAP Radio Link Set up Request m essage sent t o Node B2, t hen AAL2 SVCs for DCCH and
DTCH are set up on t he I ub int erface bet w een RNC and Node B2. Since in I nt ra- RNC Soft Handover case all radio
resources are adm inist rat ed by t he sam e RNC, second NBAP Radio link set up w ill m ost lik ely cont ain t he sam e
CRNC Com m unicat ion Cont ext value t han first m essage of t his t ype during call set up. How ever, in som e cases it
was also seen t hat a new CRNC com m unicat ion cont ext value was assigned.
Node B Com m unicat ion Cont ex t w ill definit ely have a new value, because Node B and hence I ub int erface is a
different one com pared t o first radio link set up. Radio link I D and radio link set I D in Successful Out com e
m essage of Radio link set up procedure show t hat a new link is set up, but belonging t o t he sam e link set as t he
already ex ist ing one.
The downlink channelizat ion code of t he new radio link does not need t o be t he sam e as for t he first link in link
set . Oft en a new downlink channelizat ion code is assigned for t he second radio link in addit ion t o t he one used for
first link of act iv e set and UE is inform ed about addit ional code num ber during RRC Act ive Set Updat e procedure.
N BAP DL init iat ingMessage I d- Ra dioLin k Se t up ( longTransAct ion I D= s, id- CRNC- Com m unicat ionsCont ext - I D= d
[ in som e cases: t ] ) , ULscram blingCode/ DLchannelisat ionCode= b/
[ new! ! ! ] , DCH- I ds [ Transport Form at Set s] )
N BAP UL successfulOut com e I d- r a dioLin k Se t u p ( longTransAct ion I D= s, id- CRNC- Com m unicat ionCont ext I D= t ,
NodeBCom m unicat ionCont ext - I D= u , Com m unicat ionPort I D= v, DCH- I d, bindingI D= w , DCH- I d, bindingI D= x , rLI D= 1 , rL- Set - I D= 1 )
ALCAP DL ERQ ( Originat ing Signal. Ass. I D= y, AAL2 Pat h= z, AAL2 Channel id= a a , serv ed user gen
reference= w )
ALCAP UL ECF ( Originat ing Signal. Ass. I D= bb, Dest inat ion Sign. Assoc. I D= y)
ALCAP DL ERQ ( Originat ing Signal. Ass. I D= cc, AAL2 Pat h= dd, AAL2 Channel id= e e , served user gen
reference= x )
ALCAP UL ECF ( Originat ing Signal. Ass. I D= ff, Dest inat ion Sign. Assoc. I D= cc)
UMTS Signaling
The NBAP m essage Synchronized Radio Link Rest orat ion indicat es t hat NodeB 2 becam e uplink synchronic w it h
UE/ MS. This is possible because t he m obile st ill uses t he sam e uplink scram bling code t hat was giv en w it h second
Radio Link Set up procedure t o NodeB 2 as well. So NodeB 2 is able t o list en t o UE while t he m obile has not
received any inform at ion yet how t o det ect t he provided new physical resources.
N ot e : Specific synchronizat ion and report ing crit erias as far as defined in int ernat ional st andards can be
found in 3GPP 25.214 ( Physical Layer Procedures [ FDD] ) .
N BAP UL init iat ingMessage I d- Ra dioLink Re st or a t ion ( short TransAct ion I D= gg, id- CRNCCom m unicat ionsCont ext - I D= d [ or t ] )
Fram ing Prot ocol Uplink and Downlink Synchronizat ion m essages are used for init ial alignm ent of physical
t ransport bearers for DCCH and DTCH t owards Node B2:
Dedicat ed Cont rol Channel DCH 1b FP Uplin k and D ow n lin k Syn c Messages in t he AAL2 Pat h= z and AAL2
Channel= a a
Dedicat ed Traffic Channel DCH2b FP Uplin k and D ow n lin k Syn c Messages in t he AAL2 Pat h= dd and AAL2
Channel= e e
Then an RRC Act ive Set Updat e m essage is sent from RNC t o t he MS st ill via t he old Node B. This is because MS
st ill does not know t hat a second radio link in a new cell was successfully est ablished. Aft er receiv ing RRC Act ive
Set Updat e w it h included radio link addit ion inform at ion list t he UE/ MS knows in which cell ( ident ified by a
prim ary scram bling code) t he addit ional link was est ablished.
DCH1a DL RLC AMD RRC a ct ivSe t Upda t e ( rrc- Transact ionI dent ifier= a , RLAddit ionI nform at ionLI st :
Prim aryScram blingCode= h h )
Message Exam ple 3 32: RRC Act ive Set Updat e ( Radio Link Addit ion)
I n t he m essage exam ple we see furt her t hat a new downlink channelizat ion code was assigned during NBAP Link
Set up procedure on I ub 2. The param et er scram blingCodeChange " indicat es whet her t he alt ernat iv e scram bling
code is used for com pressed m ode m et hod 'SF/ 2' " ( 3GPP 25.331 [ RRC] ) . This m eans t he downlink, not t he
uplink scram bling code!
Aft er UE added t he new radio link t o it s radio link set it sends RRC Act ive Set Updat e Com plet e m essage using
DCCH on bot h, old and new I ub int erface. That t he m essage on bot h int erfaces is indeed t he sam e and has t he
sam e origin can be proved by check ing t he m essage aut hent icat ion code t hat is equal:
DCH1a UL RLC AMD RRC a ct ivSe t Upda t e Com ple t e ( m essageAut hent icat ionCode= x x , rrcTransact ionI dent ifier= a )
DCH1b UL RLC AMD RRC a ct ivSe t Upda t e Com ple t e ( m essageAut hent icat ionCode= x x , rrcTransact ionI dent ifier= a )
I n general all downlink m essages can be m onit ored now on bot h I ub int erfaces sim ult aneously as long as t here is
no sit e select ion diversit y ( SSDT) act ivat ed. Uplink RLC fram es can also be found on bot h I ub int erfaces, but t hey
are not necessarily errorfree.
Soft H a n dove r a n d M a cr o- D ive r sit y
When m onit oring a UE in soft handover t he physical links ( FP connect ions on I ub/ I ur int erface( s) ) are t erm inat ed
in SRNC and following t he rules of m acrodiversit y. SRNC com pares FP fram es ( an each FP fram e cont ains one
single RLC fram e) incom ing from different I ub int erfaces. Good fram es are t aken t o reassem ble t he original sent
uplink m essages, bad fram es are delet ed.
I n t he next pict ure t his is explained for an act ive link set w it h 3 radio links. CRC errors occur during t ransm ission
on radio int erface, but can also be m onit ored while look ing at FP fram es on different I ub int erfaces.
UMTS Signaling
Figure 3 76 RLC Reassem bly and Macro- Diversit y
Whet her a fram e is good or bad is indicat ed by qualit y est im at e param et er t hat is part of t he fram ing prot ocol
t railer. Qualit y est im at e ( QE) value is bound t o radio int erface bit error rat io ( BER) . How BER is m apped ont o QE
depends on m anufact urer im plem ent at ion; t here is no general rule given by 3GPP st andards. Oft en t he best
qualit y est im at e value is 0, t he worst 255 ( = CRC error) . SRNC w ill always use t he fram e w it h low est qualit y
est im at e value for reassem bly of higher lay er m essages.
Qualit y est im at e values are found in all uplink fram es t hat do no cont ain RLC st at us inform at ion ( cont rol
m essages of RLC acknow ledged m ode) as shown in t he t able below for RLC fram es t hat carry RRC signaling
m essages of a single call. How ever, qualit y est im at e is also used in case t hat RLC encloses user plane t raffic.
These st at em ent s m ade for RRC signaling m essages in soft handover sit uat ions are also valid ( and probably
m uch m ore im port ant ) for user plane voice/ dat a:
Figure 3 77 Qualit y est im at e values for uplink RLC fram es
To give an overview how qualit y est im at es dev elops during a call a diagram can be used. I t w ill show t hat
especially in soft handover sit uat ions qualit y est im at e and hence t he BER on radio int erface is not very good
but t his is what is expect ed in soft handover. A bad BER is t aken accept ed as long as on t he ot her hand
UMTS Signaling
t ransm ission power of UE and cell ant enna rem ains low so t hat any unnecessary int erference and excessive cell
breat hing effect s are prevent ed. However, in a well opt im ized radio net work it is for sure also a t arget t o k eep
BER/ qualit y est im at e as good as possible.
Figure 3 78 Qualit y Est im at e Values indicat ing Soft Handover Sit uat ion
Aft er link set inform at ion was updat ed sam e RRC Measurem ent Cont rol m essage is sent t w ice, via t he old and via
t he new radio link for reasons m ent ioned abov e:
DCH1a DL RLC AMD r r cM e a su r e m e n t Con t r ol ( m easurem ent I dent it y = r )
DCH1b DL RLC AMD r r cM e a su r e m e n t Con t r ol ( m easurem ent I dent it y = r )
When t he m obile m oves furt her and loses cont act w it h old cell of Node B1 a new m easurem ent report is sent .
Once again an event I D indicat es t hat t he old cell becam e t oo bad ( on behalf of CPI CH m easurem ent result ) and
t he prim ary scram bling code ident ifies t he old cell ( different one t han in Act iv e Set Updat e m essage before! ) :
DCH1b UL RLC AMD r r cM e a su r e m e n t Re por t ( m easurem ent I dent it y = r , Ev ent Result s: ev ent I D= e1b= a prim ary
CPI CH leav es t he report ing range , Prim ary Scram blingCode= j j )
UMTS Signaling
The recept ion of t he new m easurem ent report t riggers t he release procedures bet ween RNC and Node B1.
St ill Act ive Set Updat e m essage is sent v ia bot h, t he old and t he new DCCH, but in com parison t o t he first Act ive
Set Updat e t his t im e t he m essage cont ains a Radio Link Rem oval I nform at ion List w it h t he prim ary scram bling
code as ident ifier of t he old cell on Node B1.
DCH1a DL RLC AMD RRC a ct ivSe t Upda t e ( rrc- Transact ionI dent ifier= a , Radio Link Rem oval I nform at ion List :
Prim aryScram blingCode= j j )
Message Exam ple 3 33: RRC Act ive Set Updat e ( Radio Link Rem oval)
Sam e m essage on second I ub:

DCH1b DL RLC AMD RRC a ct ivSe t Upda t e ( rrc- Transact ionI dent ifier= a , Radio Link Rem ove I nform at ion List :
Prim aryScram blingCode= j j )
The UE t hat rem oved t he link t owards Node B1 answers via Node B2 w it h an Act ive Set Updat e Com plet e
m essage:
DCH1b UL RLC AMD RRC a ct ivSe t Upda t e Com ple t e ( rrc- Transact ionI dent ifier= a )
Now t he radio links and t he AAL2 SVCs bet w een RNC and Node B1 are delet ed. Radio Link Delet ion Request
m essage cont ains t he Radio Link I D= 0, so t his is t he old link.
N BAP DL init iat ingMessage I d- Ra dioLin k D e le t ion ( short TransAct ion I D= ii, id- CRNCCom m unicat ionCont ext I D= d, NodeBCom m unicat ionsCont ext - I D= p, rL- I D= 0 )
N BAP UL successfulOut com e I d- Ra dioLin k D e le t ion ( short TransAct ion I D= ii, id- CRNCCom m unicat ionCont ext I D= d)
ALCAP DL REL ( Dest . Sign. Assoc. I D= q) ( Traffic Channel t o Node B1)
ALCAP UL RLC ( Dest . Sign. Assoc. I D= l)
ALCAP DL REL ( Dest . Sign. Assoc. I D= i) ( DCCH t o Node B1)
UMTS Signaling
The release procedure, st art ing w it h MM/ CC/ SM Disconnect m essage is also already known from t he MOC
scenario. However, since t he call was handed over t o Node B2 now all signaling m essages are exchanged v ia t he
channels on t he new I ub int erface:
DCH1b UL
or / a n d
DCH1b DL
DCH1b UL
DCH1b DL
DCH1b UL
RLC AMD RRC UpLin k D ir e ct Tr a n sfe r D I SC

RLC AMD
RLC AMD
RLC UMD
RLC UMD
RRC D ow n lin k D ir e ct Tr an sfe r RELEASE

RRC UpLin k D ir e ct Tr a n sfe RELCMP
DL r r cCon n e ct ion Re le a se ( rrc- Transact ionI dent ifier= a )
UL r r cCon n e ct ion Re le a se Com ple t e ( rrc- Transact ionI dent ifier= a )
N BAP DL init iat ingMessage I d- Ra dioLin k D e le t ion ( short TransAct ion I D= j j , id- CRNCCom m unicat ionCont ext I D= t , NodeBCom m unicat ionsCont ext - I D= u )
N BAP UL successfulOut com e I d- Ra dioLin k D e le t ion ( short TransAct ion I D= j j , id- CRNCCom m unicat ionCont ext I D= t )
UMTS Signaling
ALCAP
ALCAP
ALCAP
ALCAP
DL
UL
DL
UL
REL
RLC
REL
RLC
( Dest .
( Dest .
( Dest .
( Dest .
Sign.
Sign.
Sign.
Sign.
Assoc.
Assoc.
Assoc.
Assoc.
I D= bb)
I D= y)
I D= ff)
I D= cc)
UMTS Signaling
3 .1 1 I UB SOFTER H AN D OVER
3 .1 1 .1 Ove r vie w
Figure 3 82 I ub Soft er Handover Overview
The Soft er Handover is based on t he sam e m oving st eps as t he Soft Handover procedure, but in case of Soft er
HO t he neighbor cells belong t o t he sam e Node B. So t here is no need t o set up addit ional phy sical t ransport
bearers ( AAL2 SVCs) . All signaling m essages can be m onit ored on t he sam e I ub int erface.
To illust rat e bet t er t he int eract ions bet ween radio links and cells c- I Ds w ill be shown as int eger num bers in t he
call flow diagram . The focus in t he follow ing call t race exam ple is on m essages and param et ers direct ly relat ed t o
t he Soft er Handover procedure. That is t he reason why ALCAP m essages w ill not be shown and MM/ CC/ SM
m essages can j ust be found in a kind of short cut .
UMTS Signaling
Figure 3 83 I ub Soft er Handover Call Flow 1/ 4
M OC w it h Soft e r H a n dove r
During call est ablishm ent phase of t he first radio link im port ant link ident ifiers like Radio link I D and Radio link
set I D are assigned t o t he NBAP connect ion represent ed by CRNC/ Node B Com m unicat ion Cont ext and t o t he UE
represent ed by it s uplink scram bling code ScrCd. An opt ional indicat or says t hat it is t he first radio link set for
t his UE and cell I D ( C- I D) nam es t he t arget cell t hat is addressed by RNC.
I n RRC Connect ion Set up m essage t he Radio link set I D binds t he RRC Connect ion t o t he radio link set . Aft er RRC
Connect ion Set up Com plet e all RRC m essages w ill be t ransm it t ed in Dedicat ed Cont rol Channel ( DCCH) as long
as t he UE is in st at e CELL_DCH.
RRC Measurem ent Cont rol Message are sent by RNC and used t o request m easurem ent s by t he UE. The m essage
cont ains a m easurem ent I D. Lat er report s referring t o t his Meas. Cont rol m essage will have t he sam e m eas- I D.
I n t he sam e m essage a list of cells t o be m onit ored by t he UE are found. All t hese cells are represent ed by t heir
unique prim ary scram bling codes ( PScrCd) .
UMTS Signaling
Som e t im e aft er t he call is act ive an RRC Measurem ent Report indicat es t hat t he prim ary CPI CH of a new cell
ent ered t he report ing range, t his m eans: becam e st rong enough. This new cell is one of t he list of cells from
Measurem ent Cont rol m essage, it is ident ified by prim ary scram bling code PScrCd = 1.
RNC st art s a NBAP Radio Link Addit ion procedure ( inst ead of Radio Link Set up procedure in case of soft handover)
for radio link w it h rL- I D = 1 t o cell w it h c- I D= 0, which is t he cell w it h prim ary scram bling code = 1. Since t he I ub
int erface is t he sam e, Node B Com m unicat ion Cont ext and CRNC Com m unicat ion Cont ext are t he sam e. Also
radio link set I D is const ant .
The RRC Act ive Set Updat e procedure act ivat es t he new radio link for t he UE and adds it t o t he link set .
Measurem ent Cont rol is sent t o request t he UE t o inform RNC about lat est updat es, especially if event s are
t riggered.
The next m easurem ent report cont ains such an event report again. This t im e t he prim ary CPI CH of cell w it h
prim ary scram bling code = 3 is out side t he report ing range, t he beam is t oo w eak. The RNC decides t o clear all
links running over t his cell t o t his UE.
The cell w it h PScrCd= 3 is t aken out of t he UEs act ive set .
UMTS Signaling
The radio link ( rL- I D= 0) is delet ed by NBAP procedure.

Obv iously t he m obile is m oving back now, because w it h t he t hird m easurem ent report in t his t race t he old cell
wit h prim ary scram bling code = 3 becom es av ailable again, t he radio link is added by NBAP and t he act iv e set of
t he UE updat ed by RRC.
Finally t he UE goes back int o it s very first posit ion ( before voice call w as act ive) so now t he cell w it h PScrCd= 1
goes out of range and t he radio link is delet ed again.
Aft er release of t he voice call t he last act ive radio link ( w it h rL- I D= 0) is delet ed as well.
UMTS Signaling
3 .1 2 I UB- I U - LOCATI ON UPD ATE
Figure 3 87 I ub- I u Locat ion Updat e Procedure Overv iew
Now we w ill have a m ore det ailed look at t he signaling procedures on I u int erfaces ( Figure 3.87) . First we w ill
have look at basic procedures on I uCS and I uPS before I nt er RNC handover and relocat ion via I ur int erface w ill
be explained. To underst and I u procedures it is also necessary t o look back what is running on I ub as described
in t he call flow exam ples before. However, t he focus w ill be on t hose I ub m essages t hat t rigger I u act iv it ies.
The st art is t he already w ell- known Locat ion Updat e ( LUP) procedure ( Figure 3.87) .
St e p 1 :
Set up t he dedicat ed cont rol channel ( DCCH) for t he RRC connect ion on I ub int erface.
St e p 2 :
MM/ CC/ SM ( Mobilit y Managem ent / Call Cont rol/ Session Managem ent ) m essages are t ransparent ly forw arded t o
t he RNC on behalf of RRC direct t ransfer m essages, in t his case: Locat ion Updat e Request ( LUREQ) m essage.
St e p 3 :
The recept ion of t he LUREQ m essage on RNC t riggers t he set up of a SCCP/ RANAP connect ion on I uCS int erface
t owards MSC/ VLR. The LUREQ is em bedded in a RANAP I nit ial Message, which is also em bedded in a SCCP
Connect ion Request . The answ er can be Locat ion Updat e Accept ( LUACC) or Locat ion Updat e Rej ect ( LUREJ) .
St e p 4 :
Aft er sending t he answer m essage t he SCCP/ RANAP connect ion on I uCS is released.
St e p 5 :
Triggered by t he release m essages from t he I uCS t he RRC connect ion and it s DCCH are also released.
UMTS Signaling
Figure 3 88 I ub- I u Locat ion Updat e Procedure Call Flow 1/ 4
I u - LUP:
First t he DCCH on I ub int erface is set up ( Figure 3.88) .
Aft er RRC connect ion is est ablished, MM/ CC/ SM m essages can be exchanged em bedded in RRC Direct Transfer
m essages. The m obile sends a Locat ion Updat e Request .
When RNC receives t he NAS ( Non Access St rat um ) m essage it st art s set t ing up SCCP connect ion on I uCS
int erface on behalf of SCCP Connect ion Request m essage. This CR m essage includes a RANAP I nit ial_UE_Message
UMTS Signaling
t hat carries t he em bedded NAS m essage Locat ion Updat e Request ( LUREQ) . The Source Local Reference Num ber
in t he CR m essage ident ifies t he calling part y of t his SCCP connect ion. I t w ill be used as dest inat ion local
reference num ber in all m essages sent by t he ot her side ( called part y) of t he SCCP connect ion, in t his case t he
ot her part y is t he MSC/ VLR:
SCCP CR ( source local reference= a, RANAP I nit ial_UE_Message, NAS m essage= LUREQ)
UMTS Signaling
UMTS Signaling
Message Exam ple 3 34: Locat ion Updat e Request including RANAP and SCCP Transport
Locat ion Updat e Request m essage exam ple shows SCCP Connect ion Request and RANAP I nit ial Direct Tranfer
m essages as well. From t he rout ing label it can be det ect ed t hat SS# 7 Signaling Point Code ( SPC) of MSC is 1000
while SPC of sending RNC is 2000. SCCP Connect ion Request m essage show s source local reference num ber and
a called part y num ber based on SPC addressing. Called part y on SCCP lev el is once again t he MSC ( SPC = 1000) .
A short descript ion of global t it le addressing can be found in core net work signaling procedures part of t his book
( chapt er 4) .
The RANAP I nit ial Direct Transfer m essage furt her includes dom ain indent ifier t o indicat e t he core net work
dom ain t o which t he m essage is rout ed t o. Then current locat ion area inform at ion ( LAI ) and serv ice area
inform at ion ( SAI ) of t he subscriber t hat sent locat ion updat e request is part of t he RANAP m essage as well as
global RNC ident it y t hat leav es no doubt which RNC sent in t he world t his m essage.
Locat ion Updat e Request m essage in t he exam ple shows locat ion updat e t ype ( LUT) = I MSI at t ach and because it
is an I MSI at t ach I MSI is included and ( old) locat ion area code as st ored on USI M shows default values of digit s.
This is t he default LAI found on every new USI M when it is bought for inst ance in a shop w it hout have been used
for at t ach t o a net work before.
When t he RNC receiv es t he SCCP Connect ion Confirm m essage from MSC t he SCCP connect ion is est ablished
successfully:
SCCP CC ( source local reference= b, dest inat ion local reference = a )
Message Exam ple 3 35: SCCP Connect ion Confirm of previous shown SCCP Connect ion Request
SCCP CC exam ple m essage shows rout ing label when m essage is sent from MSC t o RNC as well as bot h, SLR and
DLR values.
For exchange of user dat a SCCP provides Dat a Form at 1 ( DT1) m essages in case of a SCCP Class 2 connect ion
like t his. I n t hese DT1 m essage once again RANAP m essages and NAS m essages ( MM/ CC/ SM) are em bedded, but
only dest inat ion local reference ( DLR) is used on SCCP lev el t o ident ify t he receiver of t he m essage:
SCCP DT1 ( dest inat ion local reference= a , RANAP init iat ingMessage, NASm essage= AUTREQ)
SCCP DT1 ( dest inat ion local reference= b, RANAP successfulOut com e, NASm essage= AUTREP)
The Aut hent icat ion procedure shown in t his call flow exam ple is opt ional.
UMTS Signaling
Wit h t he RANAP I nit iat ing Message t hat cont ains t he Com m on I D procedure code t he t rue ident it y ( I MSI ) is sent
t o RNC. Radio net work cont roller needs t his inform at ion and a frequent ly updat e of it t o ensure proper paging
serv ices for t he user ident ified by t his I MSI .
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage, Com m on I D )
Wit h t he RANAP Securit y Mode Cont rol procedure ciphering and/ or int egrit y prot ect ion bet w een RNC and UE are
act ivat ed:
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage, Se cu r it yM ode Con t r ol)
SCCP D T1 ( dest inat ion local reference= b, RANAP successfulOut com e, Se cu r it yM ode Con t r ol)
The Locat ion Updat e Accept m essage confirm s t he regist rat ion of t he new UE locat ion in VLR/ HLR dat abases.
Opt ionally a new TMSI m ay be assigned by t he VLR:
SCCP D T1 ( dest inat ion local reference= a , RANAP Direct Transfer, NASm essage= LUACC ( opt . TMSI ) )
Message Exam ple 3 36: Locat ion Updat e Accept
Locat ion Updat e Accept m essage exam ple show s anwer t o previous locat ion updat e request exam ple. Locat ion
area inform at ion ( LAI ) digit s have now t he sam e values as in RANAP I nit ial Direct Transfer and a TMSI is
assigned.
UMTS Signaling
I n case of new TMSI assignm ent a TMSI Reallocat ion Com plet e ( TRCMP) m essage is sent back by t he UE:
Opt . SCCP D T1 ( dest inat ion local reference= b, RANAP Direct Transfer, NASm essage= TRCM P)
Nowe Locat ion Updat e procedure is com plet e and t he SCCP/ RANAP connect ion can be released. The first
I uRelease cont ains a release cause for t he RANAP layer.
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage, I u Re le a se ( I d Cause) )
SCCP D T1 ( dest inat ion local reference= a , RANAP successfulOut com e, I u Re le a se )
RANAP I uRelease m essage t riggers t he RRC Connect ion Release on I ub int erface.
While on I ub t he radio links are delet ed t he MSC sends SCCP Released ( RLSD) m essage t hat t riggers sending
ALCAP Release Request ( for t he DCCH) on I ub int erface. The SCCP Released m essage cont ains a release cause
for t he SCCP layer:
SCCP RLSD ( source local reference= b, dest inat ion local reference= a , Release Cause)
SCCP RLC ( source local reference= a , dest inat ion local reference= b)
UMTS Signaling
3 .1 3 I UB- I U M OBI LE ORI GI N ATED CALL
3 .1 3 .1 Ove r vie w
Figure 3 92 I ub- I u Mobile Originat ed Voice Call ( MOC) Procedure Ov erview
St e p 1 :
St e p 2 :
Non Access St rat um ( NAS) m essages of MM/ CC/ SM ( Mobilit y Managem ent / Call Cont rol/ Session Managem ent )
prot ocol are t ransparent ly forwarded t o t he RNC on behalf of RRC direct t ransfer m essages.
St e p 3 :
The recept ion of t he first MM/ CC/ SM m essage at RNC t riggers t he set up of a SCCP/ RANAP connect ion on I uCS
int erface t owards MSC. The NAS m essage is em bedded in a RANAP I nit ial Message, which is also em bedded in a
SCCP Connect ion Request . The furt her NAS m essages for call set up and release are exchanged in t he sam e
SCCP/ RANAP connect ion.
St e p 4 :
Aft er call set up process reached a defined st at e when it is necessary t o have t raffic channel a RANAP RAB
Assignm ent m essage is sent by t he MSC. RAB st ands for Radio Access Bearer, which includes t he I u Bearer and
t he Radio Bearer.
St e p 5 :
Triggered by recept ion of RAB Assignm ent m essage RNC st art s set up of a Dedicat ed Traffic Channel ( DTCH) ,
which is follow ing t he UMTS Bearer concept seen as t he Radio Bearer.
St e p 6 :
I u User Plane prot ocol packet s t hat cont ain voice inform at ion are exchanged bet ween t he MS and t he MSC using
t he Radio Access Bearer as t raffic channel.
St e p 7 :
Aft er release of t he call in MM/ CC/ SM lay er ( m essages are exchanged v ia SCCP/ RANAP) t he I u Bearer and t he
SCCP/ RANAP connect ion on I uCS are released as well
St e p 8 :
UMTS Signaling
Figure 3 93 I ub- I u MOC Call Flow 1/ 6
Unt il t he first NAS m essage is sent by t he m obile t he already described procedures on t he I ub int erface can be
m onit ored.
UMTS Signaling
The first NAS m essage is Connect ion Managem ent Service Request t hat is sent by t he m obile st at ion t o t he
net work t o request ciphering for t he follow ing connect ion m anagem ent procedure ( Figure 3.94) . The m essage is
forwarded by t he RNC using a SCCP/ RANAP connect ion t owards t he MSC. The SCCP Connect ion Request ( CR)
m essage includes bot h, t he first RANAP and t he first NAS m essage. The RANAP I nit ial_UE_Message cont ains a
dom ain indicat or t o enable t he RNC t o m ake a decision t o w hich core net work dom ain ( in t his case: CS dom ain)
t he CMSREQ m essage should be forwarded. CMSREQ cont ains an MS ident ifier, eit her I MSI or TMSI .
SCCP CR ( source local reference= a , RANAP I nit ial_UE_Message ( I d- CN- Dom ainI ndicat or) ,
NASm essage= CM SREQ ( I MSI or TMSI ) )
SCCP Connect ion Confirm indicat es t hat t he SCCP connect ion was set up successfully. Source and Dest inat ion
Local Reference st and for called and calling part y of t he SCCP connect ion. Value a ident ifies t he calling part y
( RNC) , value b t he called part y ( MSC) :
Now t he already described Aut hent icat ion procedure follows opt ional:
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage, NASm essage= AUTREQ)
SCCP D T1 ( dest inat ion local reference= b, RANAP successfulOut com e, NASm essage= AUTREP)
As in case of Locat ion Updat e procedure t he MSC sends t he t rue MS ident it y t o t he RNC using a RANAP I nit iat ing
Message including a Com m on I D procedure code:
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage, Com m on I D ( I M SI ) )
Securit y Mode Cont rol procedure of RANAP t riggers act ivat ion of ciphering and/ or int egrit y prot ect ion bet ween
RNC and MS:

The SETUP m essage cont ains t he Called Part y Address, t he num ber dialed by t he user of t he MS.
SCCP D T1 ( dest inat ion local reference= b, RANAP Direct Transfer, NASm essage= SETUP ( Called Part y Address,
St ream I dent ifier [ SI ] = h ) )
Call Proceeding m essage indicat es t hat t he call request was accept ed and no m ore call est ablishm ent inform at ion
for t his call w ill be accept ed by MSC. The call request is now forwarded on t he E int erface.
SCCP D T1 ( dest inat ion local reference= a , RANAP Direct Transfer, NASm essage= CPROC)
Now it is necessary t o set up a t raffic channel or follow ing t he wording of UMTS bearer concept a Radio
Access Bearer. Sending a RANAP RAB Assignm ent m essage from t he MSC t o t he RNC st art s t his procedure. The
RAB I D is t he ident ifier of t he t raffic channel for t his connect ion. The RAB I D has t he sam e value as t he St ream
I dent ifier discussed in I ub MOC scenario.
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage, RAB Assignm ent ( bindingI D= c, RAB I D= h ) )
UMTS Signaling
Message Exam ple 3 37: RANAP RAB Assignm ent
RAB Assignm ent m essage exam ple shows param et ers m ent ioned in call flow diagram . Not shown, but im port ant
are RAB subflow param et ers. Here is especially t he subflow SDU size defined t hat is necessary t o guarant ee t he
QoS of t he call. RNC receives subflow param et ers from core net work and uses t hem t o define t ransport form at
set s t ransm it t ed in NBAP and RRC m essages.
As already known from ALCAP procedures on I ub t he binding I D w ill be used as Serv ed User Generat ed Reference
in t he ALCAP ERQ m essage. AAL2 Pat h I D and AAL2 CI D ( channel I D) are used t o select appropriat e AAL2
param et ers. I t should be not ed t hat it is always t he RNC t hat sends ALCAP ERQ m essages.
ALCAP ERQ ( orig.Sign.Asso.I D= d, served user generat ed reference= c, AAL2 Pat h I D= f, AAL2_CI D= g)
ALCAP ECF ( orig.Sign.Asso.I D= e , dest .Sign.Asso.I D= d)
Now t he I u Bearer ( I uCS " t raffic channel" ) on AAL2 Pat h= f and AAL2_CI D= g is available. This I u Bearer is used
t o exchange I u User Prot ocol ( I uUP) fram es bet ween RNC and MSC.
Before user dat a can be exchanged t he I uUP connect ion m ust be init ialized. This is done by sending a Cont rol
Procedure Fram e ( PROCOD) w it h init ializat ion procedure indicat or and an I nit ializat ion Acknow ledge ( ACK) . The
init ializat ion fram e ( PROCOD) includes RAB sub- Flow Com binat ion I ndicat ors ( RFCI s) cont aining inform at ion
about different at t ribut es of t his peer- t o- peer connect ion bet w een I uUP inst ances, e.g. t he size of exchanged
I uUP fram es in t he connect ion.
I uUP PROCOD ( Type 14, Cont rol procedure fram e, I nit ializat ion: RFCI Form at s)
I u UP ACK ( Type 14, Posit ive Acknow ledgem ent , I nit ializat ion)
UMTS Signaling
The AMR voice fram es w ill be t ransm it t ed lat er em bedded in I uUP Type 0 m essages, which are sent const ant ly
every 20 m illiseconds:
I u UP Type 0 ( RFCI Num ber, Payload ( AMR Speech every 20m s) )
Aft er t he I uUP init iat ion t he RAB Assignm ent can be com plet ed:
SCCP D T1 ( dest inat ion local reference= b, RANAP successfulOut com e, RAB Assign m e n t ( RAB I D= h ) )
ALERT m essage indicat es t hat t he call was successfully forwarded t o t he B- part y, it can be seen as a ringing
indicat or.
SCCP D T1 ( dest inat ion local reference= a , RANAP Direct Transfer, NASm essage= ALERT)
CONNECT is sent when t he B- part y accept s t he call, e.g. picks up t he handset .
SCCP D T1 ( dest inat ion local reference= a , RANAP Direct Transfer, NASm essage= CON N ECT)
Wit h sending CONNECT ACKNOWLEDGE A- part y ( MS) confirm s t he successful call set up.
SCCP D T1 ( dest inat ion local reference= b, RANAP Direct Transfer, NASm essage= CON ACK)
Now t he call is act ive.
Call release st art s when A- or B- part y sends a DI SCONNECT m essage including a cause, e.g. norm al call
clearing .
SCCP D T1 ( dest inat ion local reference= b, RANAP Direct Transfer, NASm essage= D I SC ( cause) )
I n som e cases also a RELEASE m essage can be sent t o st op t he call. The RELEASE is used t o set free all used
t ransact ion ident ifiers for t his connect ion, e.g. t he used St ream I dent ifier.
SCCP D T1 ( dest inat ion local reference= a , RANAP Direct Transfer, NASm essage= RELEASE ( cause) )
The peer ent it y sends RELEASE COMPLETE t o confirm :
SCCP D T1 ( dest inat ion local reference= b, RANAP Direct Transfer, NASm essage= RELCM P)
Now t he release of t he I u bearer st art s w it h RANAP procedure I uRelease. The I nit iat ing Message cont ains a
release cause for RANAP layer.
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage, I u Re le a se ( I d cause)
UMTS Signaling
I u Bearer release is com plet ed w it h delet ing t he appropriat e AAL2 SVC and SCCP Connect ion:
ALCAP REL ( dest .Sign.Asso.I D= e , cause)
ALCAP RLC ( dest .Sign.Asso.I D= d)
UMTS Signaling
3 .1 4 I UB- I U M OBI LE TERM I N ATED CALL
3 .1 4 .1 Ove r vie w
Figure 3 99 I ub- I u Mobile Term inat ed Voice Call ( MTC) Procedure Overview
The m ain difference bet ween m obile t erm inat ed call ( MTC) and m obile originat ed call ( MOC) is t he paging
procedure.
St ep 0: The paging is sent from MSC t o t he MS.
All ot her st eps are ident ical w it h t he st eps discussed in MOC scenario.
I t should be not ed t hat Paging Response is one of t he NAS m essages exchanged in DCCH/ RRC Connect ion on I ub
int erface and lat er em bedded in SCCP/ RANAP m essages on t he I uCS int erface.
UMTS Signaling
Figure 3 100 I ub- I u MTC Call Flow 1/ 6
Since t he m ost m essages in t he MTC scenario are ident ical or quit e sim ilar t o t he ones described in MOC scenario
only t hose m essages w ill be explained in det ail t hat m ake t he m ain differences.
The call scenrio st art s w it h a Paging m essage t hat is sent in RANAP layer from MSC t o RNC. The m essage
cont ains a core net work indicat or and t he subscriber ident it y ( TMSI and I MSI ) . I t should be not ed t hat t he I MSI is
m andat ory in t his m essage, because RNC needs t o derive t he paging indicat or or paging group num ber used on
paging indicat ion channel ( PI CH) from I MSI .
Since t here is no defined connect ion bet w een MS and net work in t his phase of t he call t he Paging is sent enclosed
in a SCCP Unit dat a ( UDT) m essage. I n case t hat t here is no paging response received w it hin a defined t im e
int erval cont rolled by a count er, t he Paging w ill be repeat ed.
SCCP UD T ( RANAP I d- Paging ( I d- CN- I ndicat or, I MSI , TMSI )
UMTS Signaling
The Paging Response m essage ( PRES) t riggers t he set up of t he SCCP/ RANAP connect ion on I uCS int erface. I t
cont ains t he MS ident it y .
SCCP CR ( source local reference= a , RANAP I nit ial_UE_Message ( I d- CN- Dom ainI ndicat or) , NAS m essage= PRES
( I MSI or TMSI ) )
Next m essages are known from t he MOC scenario:
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage, Com m on I D ( I MSI ) )
UMTS Signaling
Since t his is a m obile t erm inat ed call t he SETUP m essage is sent from MSC t o RNC t o be forwarded t o t he MS. I t
also does not cont ain a called part y num ber, because t he MS has no idea about t he MSI SDN relat ed t o it s I MSI .
SCCP D T1 ( dest inat ion local reference= a , RANAP Direct Transfer, NASm essage= SETUP)
The MS confirm s t he incom ing call request by sending CALL CONFI RMI NG m essage:
SCCP D T1 ( dest inat ion local reference= b, RANAP Direct Transfer, NASm essage= CCON F)
Set up of t raffic channels ( Radio Access Bearer) , I uUP init ializat ion and NAS m essages unt il call is act ive are t he
sam e procedures as explained in MOC scenario:
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage, RAB Assignm ent ( bindingI D= c, RAB I D= h ) )
ALCAP ERQ ( orig.Sign.Asso.I D= d, served user generat ed reference= c, AAL2 Pat h I D= f, AAL2_CI D= g)
ALCAP ECF ( orig.Sign.Asso.I D= e , dest .Sign.Asso.I D= d)
UMTS Signaling
I n t he AAL2 Pat h= f and AAL2_CI D= g t he t raffic channel ( I uUP) w ill st art :

I uUP PROCOD ( Type 14, Cont rol procedure fram e, I nit iat ion of RFCI s)
I uU PACK ( Type 14, Posit iv Acknow ledgem ent , I nit iat ion)
I u UP Type 0 ( RFCI Num ber, Payload ( AMR Speech every 20m s) )
SCCP D T1 ( dest inat ion local reference= b, RANAP successfulOut com e, RAB Assign m e n t ( RAB I D= h )
SCCP D T1 ( dest inat ion local reference= b, RANAP Direct Transfer, NASm essage= ALERT)
SCCP D T1 ( dest inat ion local reference= b, RANAP Direct Transfer, NASm essage= CON N ECT)
SCCP D T1 ( dest inat ion local reference= a , RANAP Direct Transfer, NASm essage= CON ACK)
The procedures follow ing DI SCONNECT m essage are also t he sam e as in case of a MOC:
SCCP D T1 ( dest inat ion local reference= b, RAN AP D ir e ct Tr a n sfe r , NASm essage= D I SC ( cause) )
An d/ or
SCCP D T1 ( dest inat ion local reference= a , RANAP Direct Transfer, NASm essage= RELEASE ( cause) )
SCCP D T1 ( dest inat ion local reference= b, RANAP Direct Transfer, NASm essage= RELCM P)
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage, I uRelease ( I d cause)
UMTS Signaling
ALCAP REL ( dest .Sign.Asso.I D= e , cause)

ALCAP RLC ( dest .Sign.Asso.I D= d)
SCCP D T1 ( dest inat ion local reference= a , RANAP successfulOut com e, I u Release)
UMTS Signaling
3 .1 5 I UB- I U ATTACH
3 .1 5 .1 Ove r vie w
Figure 3 106 I ub- I u GPRS At t ach Procedure Overview
The At t ach procedure on I uPS int erface ( Figure 3.106) is quit e sim ilar t o t he Locat ion Updat e procedure on I uCS
( see Figure 3.87) . Only NAS m essages and t he SGSN as core net work elem ent are different .
St e p 1 :
St e p 2 :
MM/ CC/ SM ( Mobilit y Managem ent / Call Cont rol/ Session Managem ent ) m essages are t ransparent ly forw arded t o
t he RNC on behalf of RRC direct t ransfer m essages, in t his case: At t ach ( ATRQ) m essage.
St e p 3 :
The recept ion of t he ATRQ m essage t riggers t he set up of a SCCP/ RANAP connect ion on I uPS int erface t owards
t he SGSN. The ATRQ is em bedded in a RANAP I nit ial Message, which is also em bedded in a SCCP Connect ion
Request . The answer can be At t ach Accept ( ATAC) or At t ach Rej ect ( ATRJ) .
St e p 4 :
Aft er sending t he answer m essage t he SCCP/ RANAP connect ion on I uPS is released.
St e p 5 :
UMTS Signaling
Figure 3 107 I ub- I u GPRS At t ach Call Flow 1/ 3
Since all m essages in t his call flow have been already discussed, eit her in I ub- I u LUP scenario or in I ub
I MSI / GPRS At t ach scenario only t he m essages and t heir param et ers w ill be list ed in t he follow ing paragraphs
( see Figures 3.107 t o 3.109) .
SCCP CR ( source local reference= a , RANAP I nit ial_UE_Message ( I d- CN- Dom ainI ndicat or= PS- Dom ain) , NAS
m essage= ATRQ ( I MSI or TMSI ) )
UMTS Signaling

SCCP D T1 ( dest inat ion local reference= a , RANAP Direct Transfer, NASm essage= ATAC ( opt .: n e w P- TM SI ) )
Opt ional ( if new P- TMSI in ATAC) : SCCP D T1 ( dest inat ion local reference= b, RANAP Direct Transfer,
NASm essage= ACOM )
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage, I u Re le a se ( I d cause)
UMTS Signaling
3 .1 6 I UB- I U PD P CON TEXT ACT./ D EACT.
3 .1 6 .1 Ove r vie w
Figure 3 110 I ub- I u PDP Cont ext Act ivat ion/ Deact ivat ion Procedure Overview
The m ain difference bet ween a m obile originat ed voice call and a m obile originat ed PDP cont ext act ivat ion are t he
SGSN as peer core net work elem ent t o t he RNC and t hat t he I u Bearer is represent ed by a GTP Tunnel ( GTP =
GPRS Tunneling Prot ocol) running on a AAL5 connect ion.
St e p 1 :
St e p 2 :
Non Access St rat um ( NAS) m essages of MM/ CC/ SM ( Mobilit y Managem ent / Call Cont rol/ Session Managem ent )
prot ocol are t ransparent ly forwarded t o t he RNC on behalf of RRC direct t ransfer m essages.
St e p 3 :
The recept ion of t he first MM/ CC/ SM m essage at RNC t riggers t he set up of a SCCP/ RANAP connect ion on I uPS
int erface t owards SCGS. The NAS m essage is em bedded in a RANAP I nit ial Message, which is also em bedded in a
SCCP Connect ion Request . The furt her NAS m essages for PDP cont ext act ivat ion and deact ivat ion are exchanged
in t he sam e SCCP/ RANAP connect ion.
St e p 4 :
Aft er PDP cont ext act ivat ion process reached a defined st at e w hen it is necessary t o have a t raffic channel RANAP
RAB Assignm ent m essage is sent by t he SGSN. RAB st ands for Radio Access Bearer, which includes t he I u Bearer
and t he Radio Bearer. The I u bearer w ill be realized w it h opening a GTP t unnel on a AAL5 connect ion.
St e p 5 :
Triggered by recept ion of RAB Assignm ent m essage RNC st art s set up of a Dedicat ed Traffic Channel ( DTCH) ,
which is follow ing t he UMTS Bearer concept seen as t he Radio Bearer.
St e p 6 :
I P ( I nt ernet Prot ocol) pack et s are exchanged bet ween t he MS and t he MSC using t he Radio Access Bearer as
t raffic channel.
St e p 7 :
Aft er release of t he call in MM/ CC/ SM lay er ( m essages are exchanged v ia SCCP/ RANAP) t he I u Bearer and t he
SCCP/ RANAP connect ion on I uPS are released as well. The delet ion of t he GTP t unnel is realized by anot her RAB
Assignm ent procedure t o ensure t hat ot her PDP cont ext s of t he sam e MS w ill not be affect ed.
UMTS Signaling
St e p 8 :
Triggered by t he release m essages from t he I uPS t he RRC connect ion and it s DCCH are also released.
Figure 3 111 I ub- I u PDP Cont ext Act ivat ion/ Deact ivat ion Call Flow 1/ 6
Since m ost m essages have been already discussed in ot her scenarios before only t hose, which are unique for PDP
Cont ext Act ivat ion/ Deact ivat ion w ill be explained in det ail. For descript ion of NAS m essages like PDP Cont ext
Act ivat ion Request see I ub PDP Cont ext Act ivat ion/ Deact ivat ion scenario.
UMTS Signaling
SCCP CR ( source local reference= a , RANAP I nit ial_UE_Message ( I d- CN- Dom ainI ndicat or) , NAS m essage= SREQ
( I MSI or TMSI , List of available NSAPI s) )
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage, NASm essage= ACRQ)
SCCP D T1 ( dest inat ion local reference= b, RANAP successfulOut com e, NASm essage= ACRE)
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage, Com m on I D ( I MSI ) )
UMTS Signaling
SCCP D T1 ( dest inat ion local reference= a , RANAP Direct Transfer, NASm essage= SACC)
SCCP D T1 ( dest inat ion local reference= a , RANAP Direct Transfer, NASm essage= PTRM )
SCCP D T1 ( dest inat ion local reference= b, RANAP Direct Transfer, NASm essage= PTRP)
The PDP Cont ex t Act ivat ion procedure is used t o act ivat e t he first PDP cont ex t for a giv en PDP address and APN,
whereas all addit ional cont ext s associat ed t o t he sam e PDP address and APN are act ivat ed w it h t he secondary
PDP cont ext act ivat ion procedure. The NSAPI v alue used in Act ivat e PDP Cont ext Request m essage w ill be used
as RAB- I D value in RAB Assignm ent procedure. The Transact ion I D ( TI O) will be used by all furt her session
m anagem ent m essages relat ed t o t his single PDP cont ext , especially for PDPC m odificat ion and deact ivat ion:
SCCP D T1 ( dest inat ion local reference= b, RANAP Direct Transfer, NASm essage= APCR ( NSAPI = h , TI O= j ) )
The Tunnel Endpoint I dent ifier used in t he first RAB Assignm ent m essage is t he ident ifier of t he GTP user plane
ent it y on SGSN side.
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage, RAB Assign m e n t ( GTP- TEI D= c, RAB I D= h) )
The TEI D used in t he RANAP Successful Out com e RAB Assignm ent m essage ident ifies t he GTP user plane ent it y
on RNC side:
SCCP D T1 ( dest inat ion local reference= b, RANAP successfulOut com e, RAB Assign m e n t ( GTP- TEI D = d, RAB
I D= h )
SCCP D T1 ( dest inat ion local reference= a , RANAP Direct Transfer, NASm essage= APCA ( TI = j ) )
Now t he GTP t unnel is set up bet ween t he t wo endpoint s ( each nam ed by it s own TEI D) and I P packet s w ill be
exchanged using a AAL5 connect ion w it h unique VPI / VCI param et er com binat ion.
UMTS Signaling
The release of t he PDPC is st art ed when t he user sends Deact ivat e PDP Cont ext Request ( DPCR) m essage. This
m essage opt ionally includes a Tear Down I ndicat or t hat indicat es if only t his single PDP Cont ext ( ident ified by it s
Transact ion I D [ TI O] ) shall be delet ed or all PDPCs sharing t he sam e PDP address w it h t his single PDPC.
SCCP D T1 ( dest inat ion local reference= b, RANAP Direct Transfer, NASm essage= D PCR ( TI O= j , SM Cause, opt .:
t eardown indicat or) )
SCCP D T1 ( dest inat ion local reference= a , RANAP Direct Transfer, NASm essage= D PCA ( TI O= j ) )
Aft er t he user request ed deact ivat ion of t he PDP Cont ext and t he net work accept ed t his request t he assigned RAB
m ust be delet ed as well. Since several PDP Cont ext m ay be act ive for t he sam e user a RAB Release list is sent t o
specify, which RABs shall be delet ed and which not ( or all) .
SCCP D T1 ( dest inat ion local reference= a, RANAP init iat ingMessage, RAB Assign m e n t ( RAB Release List : RAB
I D= h , cause) )
UMTS Signaling
SCCP D T1 ( dest inat ion local reference= b, RANAP successfulOut com e, RAB Assign m e n t ( RAB I D= h )
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage, I uRelease ( I d cause)
SCCP RLSD ( source local reference= b, dest inat ion local reference= a, Release Cause)
UMTS Signaling
3 .1 7 I UB- I U D ETACH
3 .1 7 .1 Ove r vie w
Figure 3 117 I ub- I u I MSI / GPRS Det ach Procedure Overview
The Det ach procedure m ay be running on bot h, I uCS and I uPS or j ust on I uPS int erface as described in I ub
I MSI / GPRS Det ach scenario.
St e p 1 :
St e p 2 :
I MSI Det ach I ndicat ion ( I MDETI N) m essage and/ or GPRS Det ach Request ( DTRQ) is/ are sent from MS t o RNC.
For different opt ions in case of DTRQ see I ub I MSI / GPRS Det ach scenario overv iew .
St e p 3 :
I MSI Det ach I ndicat ion ( I MDETI N) is forwarded in a SCCP CR m essage t o MSC/ VLR. Since t here is no response t o
t his m essage t he SCCP connect ion request is refused by MSC t o save resources for signaling t raffic on I uCS
int erface.
St e p 4 :
GPRS Det ach Request is forwarded t o t he SGSN/ SLR. I n case t hat MS was sw it ched off t he SCCP Connect ion
Request is also rej ect ed. Ot herw ise a Det ach Accept ( DTAC) m essage could be sent back t o t he MS.
St e p 5 :
As far as I uPS SCCP connect ion was not refused it is released now including t he RANAP connect ion.
St e p 5 :
Triggered by t he release/ refuse m essages from t he I uCS/ I uPS int erface t he RRC connect ion and it s DCCH are
also released.
UMTS Signaling
Figure 3 118 I ub- I u I MSI / GPRS Det ach Call Flow 1/ 3
Com pare t he follow ing call flow diagram s ( Figures 3.118 t o 3.120) w it h t he descript ions of st eps in t he overview
t o get som e m ore det ails. There are no com m ent s, because all SCCP and RANAP m essages have already been
described in previous scenarios.
SCCP CR ( source local reference= a , RANAP I nit ial_UE_Message ( I d- CN- Dom ainI ndicat or) , NAS
m essage= I M D ETI N ( I MSI or TMSI ) )
SCCP CREF ( dest inat ion local reference = a , RefusalCause)
UMTS Signaling
SCCP CR ( source local reference= a , RANAP I nit ial_UE_Message ( I d- CN- Dom ainI ndicat or) , NAS m essage= D TRQ
( I MSI or P- TMSI ) )
SCCP CREF ( dest inat ion local reference = a , RefusalCause)
UMTS Signaling
3 .1 8 I UB- I UR - SOFT H AN D OVER
3 .1 8 .1 Ove r vie w
Figure 3 121 I ub- I ur Soft Handover Procedure Overv iew
I n com parison t o t he I nt er Node B/ I nt ra RNC Soft Handover procedure t his I nt er Node B/ I nt er RNC handover
int roduces a new net work elem ent , t he Drift RNC ( DRNC) and a new int erface, t he I ur used for int erconnect ion
of RNCs.
I n all scenarios discussed before t he RNC was always t he serv ing RNC ( SRNC) : t he RNC t hat cont rols t he
connect ions t o t he core net work dom ains, t o MSC and SGSN.
I f t he MS m oves from Posit ion 1 t o Posit ion 2 int o t he range of a cell t hat is act ually cont rolled by a different RNC
t han t he SRNC of t he connect ion t he signaling and t raffic channels from Node B2 m ust not only be set up on I ub
int erface, but also on t he I ur bet ween SRNC and DRNC. The procedure is cont rolled by t he SRNC and t riggered
by incom ing m easurem ent report . The old DTCH/ DCCH via Node B1 is out of scope of t he signaling exam ple call
flow and m ay st ay act ive or be delet ed depending on furt her m oves of t he UE.
St e p 1 :
Aft er successful radio link set up ( also t riggered by SRNC) t he DCCH and DTCH on I ur int erface are inst alled on
behalf of RNSAP ( Radio Net work Subsyst em Applicat ion Part ) and ALCAP m essages.
St e p 2 :
The sam e DCCH and DTCH are set up on I ub int erface bet w een DRNC and Node B2. During t his procedure DRNC
assign downlink resources for dedicat ed physical channel in new cell and report s t he assigned values back t o
SRNC.
St e p 3 :
An Act ive Set Updat e procedure bet w een SRNC and UE t akes t he new est ablished links int o serv ice.
N ot e : I f t here is no I ur int erface available or if t he new RNC is in a different UTRAN ( connect ed t o a different
MSC/ SGSN pair) soft handover is not possible anym ore. I n such cases an I nt er- 3G_MSC as described in core
net work signaling part of t his book will be perform ed.
UMTS Signaling
Figure 3 122 I ub- I ur Soft Handover Call Flow 1/ 3
The procedure st art s w it h set up of a SCCP connect ion on I ur int erface:

I ur: SCCP CR ( source local reference= a )
I ur: SCCP CC ( source local reference= b, dest inat ion local reference= a )
The signaling inform at ion field of t he first DT1 m essage is t oo sm all t o carry t he whole first RNSAP m essage. So
t he RNSAP m essage is segm ent ed on SRNC and reassem bled on DRNC side. The m ore dat a bit = 1 indicat es t hat
t he RNSAP dat a cont ent in t he m essage is j ust a fragm ent and m ore fragm ent s for reassem bly w ill follow.
The m essages in RNSAP prot ocol are oft en t he sam e as in NBAP, but t hey cont ain specific inform at ion elem ent
necessary for m essage rout ing and com m unicat ion bet w een t w o RNCs. Furt herm ore it w ill em erge which radio
resources are assigned by SRNC and DRNC during t he procedure.
The new t hing in t he follow ing Radio Link Set up procedure is t hat it cont ains t he ident it y of t he sender ( SRNC- I D)
and, t he ident it y of t he UE for signaling exchange over com m on cont rol channels ( S- RNTI = Serving Radio
Net work Tem porary I dent ifier) . On I ub during call set up procedure ( see I ub MOC and I ub MTC scenarios) bot h
elem ent s t oget her represent t he u- RNTI . However, u- RNTI is not m ent ioned anym ore in RNSAP.
I ncluded in t he m essage is t he uplink scram bling code of t he dedicat ed physical channel proviced by SRNC during
call set up scenario. I t is t he only physical radio ident ifier t hat w ill rem ain unchanged during t he whole procedure.
Next sect ion cont ains inform at ion about dedicat ed t ransport channels ( DCHs) t o be set up on bot h, I ur as well as
new I ub int erface. I t depends on act ive services of t he UE how m any DCHs are necessary and how t heir t ransport
form at set s hav e t o be defined. Our exam ple m essage show s radio link set up for an act ive voice call w it h one
DCH for RRC signaling and 3 DCHs for AMR speech. How ever, it would be also possible t hat j ust one DCH is
necessary ( plain RRC signaling connect ion) or t wo DCHs hav e t o be set up: one DCCH for RRC, one DTCH for I P
payload.
Depending on included am ount inform at ion it is necessary in our call flow exam ple ( not always) t o segm ent
RNSAP Radio Link Set up Request m essage and t ransport it in m ult iple SCCP DT1 m essages. I f t he m essage is
relat ively short it m ay be included already in SCCP Connect ion Request ( CR) .
I ur: SCCP D T1 ( dest inat ion local reference= b, m ore dat a= 1)
I ur: SCCP D T1 ( dest inat ion local reference= b, m ore dat a= 0 ( RNSAP init iat ingMessage procedureCode= idr a dioLin k Se t u p ( longTI D= c, SRNC- I D= d, s- RNTI = e , ULscram blingCode= f, DCH- I D= g + UL/ DL Transport
Form at Set , DCH- I D= g' + UL/ DL Transport Form at Set , DCH- I D= g'' + UL/ DL Transport Form at Set , DCH- I D= h + ,
UL/ DL Transport Form at Set , rL- I D = p, c- I D= m m , I MSI = n n ) ) )
UMTS Signaling
The DCHs for AMR form a group of coordinat ed DCHs. I n ot her words: t hey are bound t oget her. That is t he
reason for using variables g, g' and g''. The following m essage exam ples for RNSAP Radio Link Set up w ill m ake
t his fact bet t er underst andable:
Message Exam ple 3 38: RNSAP I nit iat ing Message Radio Link Set up
I n t he m essage exam ple we see procedure code, long t ransact ion I D ( sam e value in RNSAP Successful Out com e
Radio Link Set up m essage exam ple) and SRNC- I D plus s- RNTI . Four dedicat ed t ransport channels shall be set up:
channel 8, 9 and 10 for speech, channel 31 w ill carry RRC signaling. The cell I D of t he new cell is 45429 ( t he
SRNC is able t o t ranslat e t he prim ary scram bling code of t he cell received in RRC m easurem ent report int o a valid
cell I D on behalf of a configurat ion t able inst alled by O&M operat ion) .
The NBAP Radio Link Set up cont ains m any param et ers received from SRNC. However, especially t he codes for
t he downlink dedicat ed physical resources on radio int erface are assigned by CRNC, which is t he RNC t hat
cont rols t he cell direct ly and com m unicat es w it h t he cell using NBAP prot ocol. I n case of radio link set up on new
I ub int erface for I nt er RNC handover CRNC is t he sam e physical net work elem ent as DRNC. Since CRNC of I ub 2
is independent form SRNC t he downlink channelizat ion code assigned for t he new cell w it h NBAP Radio Link Set up
procedure can be com plet ely different form t he one used in old cell. Howev er, t he t ransport form at set s are t he
sam e on bot h links, because t hese set t ings are cont rolled by SRNC.
I ub: NBAP DL init iat ingMessage, procedureCode= id- radioLinkSet up ( longTI D= i, id- CRNCCom m unicat ionCont ext I D= j , ULscram blingCode/ DLchannelisat ionCode= f/ ?, DCH- I D= g + UL/ DL Transport Form at
UMTS Signaling
Set , DCH- I D= g' + UL/ DL Transport Form at Set , DCH- I D= g'' + UL/ DL Transport Form at Set , DCH- I D= h + , UL/ DL
Transport Form at Set , rL- I D = p, c- I D= m m )
NBAP Successful Out com e m essage of Radio Link Set up procedure cont ians t w o binding I Ds, one for each DCH
( one t o carry DCCHs, t he ot her one t o carry DTCHs) . Because of t he coordinat ed set of DCHs for AMR speech
( see explanat ion in I ub MOC scenario) only DCH- I D = g is included in t he m essage t o indicat e, which binding I D
is relat ed t o speech channels. The ot her binding I D is relat ed t o RRC signaling channel.
I ub: N BAP UL successfulOut com e, procedureCode= id- r a dioLin k Se t u p ( longTI D= i, id- CRNCCom m unicat ionCont ext I D= j , id- NodeB- Com m unicat ionCont ext I D= k , DCH- I D= g, bindingI D= m , DCH- I D= h ,
bindingI D= n , rL- I D = p, rL- Set - I D= q)
Also on I ur a Successful Out com e m essage for t he Radio Link Set up procedure is m onit ored. This is t he
appropriat e RNSAP m essage forwarded t o t he SRNC. Due t o a long appendix cont aining neighbouring cell
inform at ion t his m essage could be one of t he largest t o be m onit ored on UTRAN int erfaces. So it is segm ent ed
again:
I ur: SCCP D T1 ( dest inat ion local reference= a , m ore dat a= 1 )
I ur: SCCP D T1 ( dest inat ion local reference= a , m ore dat a= 0, RNSAP ( successfulOut com e procedureCode= idr a dioLin k Se t u p ( longTI D= c, d- RNTI = o, id- CN- PS- Dom ainI dent ifier, id- CN- CS Dom ainI dent ifier, rL- I D= p, rLSet - I D= q, DCH- I D= g, bindingI D= r , DCH- I D= h , bindingI D= s, id- Neighbouring- UMTS- CellI nform at ion, idNeighbouring- GSM- CellI nform at ion) )
The follow ing m essage exam ple w ill show only fragm ent s of neighbouring cell inform at ion part . As a rule t here
can be m ore t han 30 neighbour cells w it h t heir specific param et ers report ed t o SRNC.
UMTS Signaling
UMTS Signaling
Message Exam ple 3 39: RNSAP Successful Out com e Radio Link Set up
A new ident ifier is t he drift RNTI ( d- RNTI ) . D- RNTI is allocat ed by drift RNC ( DRNC) when SRNC request s set up of
dedicat ed channels in DRNC's RNS. I t shall be unique w it hin t he DRNC. SRNC knows t he m apping bet ween sRNTI and d- RNTI . DRNC shall k now t he s- RNTI and SRNC- I D relat ed t o exist ing d- RNTI wit hin t he drift RNC.
Core net ident it ies are self- explaining, radio link I D ( rL- I D) has t he value assigned by SRNC before, but radio link
set I D ( rL- Set - I D) m ight have a different value t han t he one in t he NBAP Radio Link Set up procedure on I ub2.
The reason is t hat rL- Set - I D in NBAP is relat ed t o an act ive NodeB Com m unicat ion Cont ex t . Hence, it is valid on
CRNC level only , but not for com m unicat ion bet ween SRNC and DRNC.
The serv ice area ident ifier ( SAI ) indent ifies t he serv ice area t o which t he new cell in t he link set belongs. DL
codes for dedicat ed physical channels hav e been assigned by DRNC already w it h NBAP Radio Link Set up request .
Now SRNC is inform ed which param et ers have been t ak en in use successfully t o ident ify dedicat ed physical
downlink channel of t he new cell.
Once again we see t wo binding I Ds and t wo t ransport layer addresses bound t o DCH- I Ds of DCCH and DTCH. The
binding I D values are com plet ely different from t he values used on I ub 2, because I ur is a different part of t he
t ransport net work. Transport layer addresses m ay ident ify t he peer RNC on ATM level, but if t here is an ATM
net work used t o int erconnect UTRAN net works elem ent s it m ight only be t he end user address of t he next ATM
sw it ch. Transport layer address num bering follows I TU- T E.191 num bering plan. These addresses are also known
as E.164 AESA addresses for broadband I SDN ( B- I SDN) . They cont ain of an init ial dom ain part ( I DP) and a
dom ain specific part ( DSP) . I DP is subdiv ided int o aut horit y and form at ident ifier ( AFI ) and init ial dom ain
ident ifier ( I DI ) . I f AFI = 0x45 ( 45 hex) I DI consist s of an I SDN t elephony num ber follow ing E.164 st andard ( see
chapt er about global t it le t ranslat ion in chapt er 4 of t his book t o have an exam ple of E.164 addressing) . I n t he
m essage exam ple t he address v alues are shown as " XXX" t o hide t he t rue address ident it ies.
Figure 3 123 E.191 Address Form at
Aft er DCH inform at ion response it em s t he neighourhood cell inform at ion list s are found. UTRAN cells are report ed
acconding t o I Ds of t heir CRNCs. So it becom es clear which RNC cont rols which neighbour cell and could act as a
new DRNC in follow ing soft handover sit uat ions. The cells it self are ident ified by t heir cell I Ds, prim ary scram bling
codes and UTRA absolut e radio frequency channel num ber ( uARFCN) . This uARFCN designat es t he carrier
frequency. The value of t he uARFCN in t he I MT2000 band is defined as follows:
Uplin k u ARFCN ( N u ) = 5 x Fr e qu e n cy ( M H z) a n d D ow n lin k u ARFCN ( N d) = 5 x Fr e qu e n cy ( M H z) .
GSM cells in t he next sect ion are ident ified on behalf of t heir Cell Global I dent it y ( CGI ) . This param et er is a
concat enat ion of t he LAI ( Locat ion Area I dent it y) and t he CI ( Cell I dent it y) and uniquely ident ifies a given GSM
cell in t he w ire lined net work.
To ensure t hat t he sam e cell can be ident ified on radio int erface as well base st at ion ident it y code ( BSI C) is
necessary. BSI C is broadcast on synchronizat ion channel ( SCH) of a GSM cell t o inform MS about net work color
code ( NCC) and base st at ion color code ( BCC) before regist ering on t he net w ork. Net work Color Code ( NCC) is
used t o different iat e bet w een operat ors ut ilizing t he sam e GSM frequency, for inst ance on an int ernat ional border.
Base St at ion Color Code ( BCC) is used t o discrim inat e cells using t he sam e frequency during cell select ion and
cam ping on GSM process. BCC is also used t o ident ify t raining sequence code ( TSC) t o be used when reading
BCCH of a GSM cell.
UMTS Signaling
Now on I ur and I ub t he AAL2 SVCs for DCCH and DTCH are est ablished:
I ur: ALCAP D L ERQ ( Originat ing Signal. Ass. I D= l, AAL2 Pat h= m , AAL2 Channel id= n , served user gen
reference= r )
I ur: ALCAP UL ECF ( Originat ing Signal. Ass. I D= q, Dest inat ion Sign. Assoc. I D= l)
I ur: ALCAP D L ERQ ( Originat ing Signal. Ass. I D= t , AAL2 Pat h= u , AAL2 Channel id= v, served user gen
reference= s)
I ur: ALCAP UL ECF ( Originat ing Signal. Ass. I D= w , Dest inat ion Sign. Assoc. I D= t )
Also t he RNSAP Dedicat ed Measurem ent I nit iat ion will lat er be forwarded t o Node B2 using NBAP on I ub. There
m ight be one or m ore dedicat ed m easurem ent init iat ed over I ur. A t ypical exam ple is m easurem ent of
t ransm it t ed code power. I t is also possible t hat RNSAP Downlink Power Com m ands are sent during t his part of
t he procedure from SRNC t o DRNC.
I ur: SCCP D T1 ( dest inat ion local reference= b, m ore dat a= 0, RNSAP SuccessfulOut com e procedureCode= idde dica t e dM e a su r e m e n t I n it ia t ion , id- Measurem ent I D= ff, det ails and param et ers t o be m easured, e.g.
t ransm it t ed code power)
I ub: ALCAP D L ERQ ( Originat ing Signal. Ass. I D= x , AAL2 Pat h= y, AAL2 Channel id= z, served user gen
reference= m )
I ub: ALCAP UL ECF ( Originat ing Signal. Ass. I D= a a , Dest inat ion Sign. Assoc. I D= x )
I ub: ALCAP D L ERQ ( Originat ing Signal. Ass. I D= bb, AAL2 Pat h= cc, AAL2 Channel id= dd, served user gen
reference= n )
I ub: ALCAP UL ECF ( Originat ing Signal. Ass. I D= e e , Dest inat ion Sign. Assoc. I D= bb)
UMTS Signaling
The CRNC Com m unicat ion Cont ext is valid bet ween t he Node B2 and t he DRNC, which act s as CRNC relat ed t o
t his Node B on NBAP layer.
I ub: N BAP init iat ingMessage procedureCode= id- r a dioLink Re st or a t ion ( short Transact ionI D= gg, id- CRNCCom m unicat ionCont ext I D= j )
I ur: SCCP D T1 dest inat ionLocalReference= a , RNSAP ( init iat ingMessage, procedureCode= idr a dioLin k Re sor a t ion , longTransact ionI D= h h , rL- Set - I D= q)
I ub: N BAP init iat ingMessage procedureCode= idde dica t e dM e a su r e m e n t I n it ia t ion , short Transact ionI D= ii, idNodeB- Com m unicat ionCont ext I D= k , id- Measurem ent I D= ff, det ails and param et ers t o be m easured)
Successful Out com e m essage of Dedicat ed Measurem ent I nit iat ion indicat es t hat t he UE accept ed t he
m easurem ent t asks and param et ers sent before. The NBAP m essage is forwarded via I ur t o SRNC using RNSAP
prot ocol.
I ub: N BAP successfulOut com e procedureCode= idde dica t e dM e a su r e m e n t I n it ia t ion , longTransact ionI D= ii,
id- Measurem ent I D= ff)
I ur: SCCP D T1 ( dest inat ion local reference= a , m ore dat a= 0 , RNSAP ( init iat ingMessage procedureCode= idde dica t e dM e a su r e m e n t I n it ia t ion , id- Measurem ent I D= ff)
The Fram ing Prot ocol Uplink and Downlink Sy nchronizat ion m essages are used t o align bot h channels, DCCH and
DTCH on I ur and I ub int erface.
I ur: DCH FP Up and Downlink Sync for bot h channels
I ub: DCH FP Up and Downlink Sync for bot h channels
Wit h t he Act ive Set Updat e procedure perform ed on bot h, I ur and I ub int erface t he new links are t aken int o
serv ice and t he t raffic channel becom es available for t he UE.
I ur:
I ub:
I ub:
I ur:
DCH RRC AM Act ive Se t Upda t e

DCH RRC AM Act ive Se t Upda t e
DCH RRC AM Act ive Se t Upda t e Com ple t e
DCH RRC AM Act ive Se t Upda t e Com ple t e
UMTS Signaling
3 .1 9 I UB- I U - FORW ARD H AN D OVER ( I N TER N OD E B, I N TER RN C)

There are t wo general t ypes of hard handovers defined for t he UTRAN in 3GPP 25.931: forward and backward
handover. The Mobile St at ion init iat es t he forward handover by sending RRC Cell Updat e m essage while t he
backward handover is init iat ed by t he net work aft er SRNC received a RRC Measurem ent Report . The confusing
t hing is if one reads ot her 3GPP specs relat ed t o handover scenarios, especially 3GPP 25.832 and 3GPP 23.009,
t he t erm s " forw ard handover" and " backward handover" are not used again. I n addit ion backw ard handovers
using I ur resources have not been m onit ored y et by t he aut hors. I f net work resources are t ak en int o account it
m akes m ore sense t o perform int er- frequency handovers bet w een FDD cells using SRNS relocat ion ( UE involv ed)
procedure, which is a hard handover plus relocat ion w it hout using I ur resources. On t he ot her hand int rafrequency as w ell as int er- frequency hard handover bet w een TDD cells ( t here is no Soft Handover in TDD! ) w ill
be probably m ore efficient using I ur procedures inst ead of RANAP relocat ion funct ions t hat cause a higher
signaling load on I uCS and I uPS. All in all t his subj ect is int erest ing for furt her st udies.
While Hard Handover can be bot h, Forward or Backward Handover, Soft Handover procedures are always
cont rolled by t he SRNC so t hat all Soft ( and Soft er) Handover belong t o t he group of Backward Handover. To
underst and t he relat ions see next t able:
Table 3 3 - Handover Types

When a hard handover is perform ed - in difference t o a soft handover - t he MS loses cont act w it h t he net work
( when it sw it ches from old radio link t o t he new one) for a very short t im e period ( short enough t o be not not iced
by t he user who has an ongoing act ive voice call) . Usually t his t im e period shall be not m ore t han 200 m s t o
avoid int errupt ions of voice call. However, t here have been longer delays m easured in case a forward handover.
This indicat es t hat a forward handover is never a preferred solut ion from point of view of net work opt im izat ion,
but only a recov ery funct ion in case t hat radio cont act w it h UE is suddenly com plet ely lost .
3 .1 9 .1 Ove r vie w
The case of forward handover described in t his chapt er can also be described as a kind of
t ransport channel re- est ablishm ent . I t happens in case radio links are suddenely lost . The aut hors are not even
sure if t he procedure described in t his chapt er m eet s t he definit ion behind t he t erm " forward handover" as giv en
in 3GPP 25.931. Maybe a " forw ard handover" in case of 3GPP only happens if a UE w it h act ive PS call perform s
cell reselct ion/ cell updat e in CELL_FACH st at e. Hence, t here is probably no forward handover for CS calls defined
by 3GPP, but t he scenario described in t his chapt er is seen pret t y oft en and hence it should have it s own nam e.
Possible reasons for losing radio cont act are cell breat hing effect s ( as shown in Figure 3.126) , but also t here can
be t echnical problem s on t he SRNC side. For inst ance, t he aut hors m onit ored a case when SRNC received RRC
Measurem ent report including Event - I D e c ( A nonact ive prim ary CPI CH becom es bet t er t han an act ive prim ary
CPI CH) . The correct react ion of SRNC would have been t o delet e t he m ost w eak radio link of t he act iv e set and
subsecquent ly add t he new st rong radio link t o t he act ive set . I nst ead, SRNC delet ed all radio links of t he act ive
set and UE lost cont act w it h all dedicat ed radio links at t he sam e t im e.
UMTS Signaling
Figure 3 126 - I ub- I ur Forward Hard Handover Overview
St e p 1 :
MS looses radio cont act wit h cell of Node B1 ( f1) and falls back int o CELL_FACH st at e, because t here are no
dedicat ed channels available anym ore. Only a m acro- cell t hat is cont rolled by a different RNC ( here called: new
DRNC) is st ill reachable. MS perform s cell reselect ion and sends a Cell Updat e m essage via new I ub and I ur t o
SRNC.
St e p 2 :
SRNC orders set up of radio link s and DCCH/ DTCH on I ur int erface bet ween it self and t he new DRNC.
St e p 3 :
Triggered by t he m essages com ing from SRNC a Radio link set up procedure on I ub int erface bet ween new DRNC
and Node B2 is perform ed. DCCH and DTCH are creat ed as well.
St e p 4 :
SRNC confirm s Cell Updat e t o t he MS using t he new signaling link. For t he MS t his is t he com m and t o sw it ch int o
t he new cell cont rolled by Node B2. MS w ill confirm successful sw it ching by sending RRC UTRAN Mobilit y I nfo
m essage.
St e p 5 :
Sim ult aneously w it h sw it ching t o t he new cell t he cont act w it h t he old cell is lost and Node B1 sends Radio link
Failure I ndicat ion t o SRNC.
UMTS Signaling
Figure 3 127 - I ub- I ur Forward Hard Handover Call Flow 1/ 4.
The procedure st art s when t he MS sends a Cell Updat e m essage v ia new I ub/ I ur int erface. The m essage cont ains
t he u- RNTI including SRNC- I D t hat enables t he net work t o decide which RNC shall finally receiv e t he m essage
and t he s- RNTI , which is t he ident ifier of t he UE on t he com m on t ransport channels. The cell updat e cause " radio
link failure" indicat es t hat t he connect ion t o t he previously used UTRAN cell w as lost .
I ub: RACH RRC Ce llUpda t e ( u- RNTI : S- RNC- I D= h h + s- RNTI = e , CS and/ or PS Dom ain I d,
cellUpdat eCause= " radioLinkFailure" )
The Layer 3 m essage Cell Updat e is included in RNSAP Uplink Signaling Transfer m essage and on behalf of t his
forwarded from t he new DRNC t o t he SRNC. Since t here is no Dedicat ed Cont rol Channel ( DCCH) available on t his
I ur int erface SCCP uses t he Ext ended Unit dat a ( XUDT) m essage form at t o t ransport t he Uplink Signaling Transfer.
XUDT has in com parison t o UDT an ext ended header w it h a hop count er inform at ion elem ent t o prevent rout ing
loops and a segm ent at ion indicat or ( " m ore dat a" bit ) t o allow segm ent ed t ransport and reassem bly of large
higher layer m essages on receiver side if necessary.
SRNC- I D received w it h Cell Updat e m essage is t ranslat ed by DRNC int o a SS# 7 Signaling Point Code address t hat
is used as Called Part y Num ber in SCCP XUDT while DRNC ident ifies it self by using an E.164 Global Tit le address.
( Refer t o core net work signaling part [ chapt er 4] of t his book t o learn m ore about SCCP addressing.)
There are different k inds of locat ion inform at ion included in RNSAP Uplink Signaling Transfer, especially
inform at ion t o which Locat ion Area ( LA) , Rout ing Area ( RA) , Serv ice Area ( SA) t he new cell ( ident ified by it s cell
I D [ c- I D] ) belongs. For t he different areas appropriat e area codes ( LAC, RAC, SAC) are included t oget her w it h
PLMN I dent it y t hat cont ains Mobile Count ry Code and Mobile Net work Code according t o I TU- T E.212 num bering
plan.
Since t he UE is in CELL_FACH st at e CRNC funct ion of t he new DRNC assigns a c- RNTI t o ident ify t he UE uniquely
w it hin t he new cell. I n addit ion t here is a relat ion bet ween t his c- RNTI and t he d- RNTI t hat is assigned as w ell
and valid for t im e of RNSAP connect ion via I ur int erface. D- RNTI will nev er be used on I ub/ Uu int erface! D- RNTI
value is t ransm it t ed t o SRNC t oget her w it h t he s- RNTI so t hat SRNC can st ore a fixed relat ion bet ween t he
RNSAP cont ext on I ur and t he RRC cont ext t hat is valid for t he whole connect ion bet ween SRNC and UE including
links on I ub and Uu int erface.
I ur: SCCP XUD T RNSAP init iat ingMessage, id- u plin k Sign a lin gTr a n sfe r ( s- RNTI = e , c- RNTI = k k , d- RNTI = o, cI D= m m , RNC- I D= n n , Layer3- I nfo: RRC Ce llUpda t e )
Aft er receiv ing t he Cell Updat e m essage SRNC st art s set up a SCCP Class 2 connect ion on I ur t owards t he new
DRNC.
I ur: SCCP CR ( source local reference= a )
I ur: SCCP CC ( source local reference= b, dest inat ion local reference= a )
Then SRNC st art s Radio link set up procedure and, follow ing t his, t he set up of DCCH and DTCH on I ur t hat
t riggers t he sam e procedure on I ub. Depending on m anufact urer's im plem ent at ion t he procedure m ight be
guided by short or long t ransact ion I D. Beside t his t he m essage is nearly ident ical w it h t he one shown in m essage
UMTS Signaling
exam ple 38. However, first radio link set indicat or t his t im e is set t o " first RLS" , because t here is no act iv e radio
link t o t his UE anym ore.
I ur: SCCP D T1 ( dest inat ion local reference= b, m ore dat a= 1 )

I ur: SCCP D T1 ( dest inat ion local reference= b, m ore dat a= 0 , RNSAP [ init iat ingMessage procedureCode= idr a dioLin k Se t u p, short TI D= c, u- RNTI : SRNC- I D= d + s- RNTI = e , ULscram blingCode= f, DCH- I D= g + UL/ DL
Transport Form at Set , DCH- I D= g' + UL/ DL Transport Form at Set , DCH- I D= g' ' + UL/ DL Transport Form at Set ,
DCH- I D= h + UL/ DL Transport Form at Set , rL- I D= p, c- I D= m m , First Radio Link Set I ndicat or = " first RLS" , I MSI
= oo] )
UMTS Signaling
I t shall be not iced again t hat SRNC only assigns t he uplink radio resources ( UL scram bling code and UL
channelizat ion code lenght ) , but CRNC funct ion on DRNC side assignes downlink resources, especially DL
channelizat ion code for t he radio link. This dow nlink channelizat ion code assignm ent is com plet ely independent
form t he sam e procedure used during call set up. The values m ay be equal by chance, but t hey do not need t o be
t he sam e. NBAP t ransport channel set t ings direct ly using t he definit ions received w it h RNSAP Radio Link Set up
Request :
I ub: N BAP DL init iat ingMessage, procedureCode= id- r a dioLin k Se t u p ( longTI D= i, id- CRNCCom m unicat ionCont ext I D= j , ULscram blingCode/ DLchannelisat ionCode= f/ , DCH- I D= g + UL/ DL Transport
Form at Set , DCH- I D= g' + UL/ DL Transport Form at Set , DCH- I D= g'' + UL/ DL Transport Form at Set , DCH- I D= h +
UL/ DL Transport Form at Set , rL- I D= p, c- I D= m m , First Radio Link Set I ndicat or = " first RLS" )
NBAP Radio Link Set up Request is successfully answered w it h NBAP Radio Link Set up Response:
I ub: N BAP UL successfulOut com e, procedureCode= id- r a dioLin k Se t u p ( longTI D= i, id- CRNCCom m unicat ionCont ext I D= j , id- NodeB- Com m unicat ionCont ext I D= k , id- Com m unicat ionCont rolPort I D= l, DCHI D= g + bindingI D= m + Transport Layer Address = qq, DCH- I D= h + bindingI D= n + Transport Layer Address =
qq, rL- I D= p, rL- Set - I D= q)
Aft er DRNC received NBAP Radio Link Set up Response it sends RNSAP Radio Link Set up Response t o SRNC. Once
again t his m essage is quit e t he sam e as t he one shown in appropriat e m essage exam ple of previous call flow
scenario. To leave no doubt t hat t his m essage is relat ed t o t he Cell Updat e t hat was not t ransm it t ed as part of
t his SCCP class 2 connect ion d- RNTI is included again. I n addit ion som e inform at ion about t he new radio link t hat
SRNC st ill does not know is included in t he m essage: prim ary scram bling code of new cell and uplink and
downlink UTRA absolut e radio frequency channel num ber ( uARFCN) , which are bot h used t o ident ify t he cell
uniquely on Uu.
Anot her very int erest ing fact is t hat radio link set I D in RNSAP Radio Link Set up procedure m ay have a different
value t han in appropriat e NBAP m essage. This happens because NBAP rL- Set - I D ident ifies a radio link w it hin one
NodeB cont ext while RNSAP rL- Set - I D ident ifies a radio link w it hin an UE cont ext :
I ur: SCCP D T1 ( dest inat ion local referece= a , m ore dat a= 1)
I ur: SCCP D T1 ( dest inat ion local referece= a , m ore dat a= 0, RNSAP ( successfulOut com e procedureCode= idr a dioLin k Se t u p ( short TI D= c, d- RNTI = o, id- CN- PS- Dom ainI dent ifier, id- CN- CS Dom ainI dent ifier, rL- I D= p, RLSet - I D= r r , DCH- I D= g + bindingI D= r + Transport Layer Address= ss, DCH- I D= h + bindingI D= n + Transport
Layer Address = ss, PScrCd= u u , Neighbouring Cell I nform at ion: UMTS, GSM,) )

I ur: ALCAP DL ERQ ( Originat ing Signal. Ass. I D= l, AAL2 Pat h= m , AAL2 Channel id= n , served user gen
reference= r )
I ur: ALCAP UL ECF ( Originat ing Signal. Ass. I D= q, Dest inat ion Sign. Assoc. I D= l)
UMTS Signaling
I ur: ALCAP DL ERQ ( Originat ing Signal. Ass. I D= t , AAL2 Pat h= u , AAL2 Channel id= v, served user gen
reference= s)
I ur: ALCAP UL ECF ( Originat ing Signal. Ass. I D= w , Dest inat ion Sign. Assoc. I D= t )
I ur: SCCP D T1 ( dest inat ion local reference= b, m ore dat a= 0 , RNSAP init iat ingMessage ( procedureCode= idde dica t e dM e a sur e m e nt I nit ia t ion , short Transact ionI D= ii, id- Measurem ent I D= ff, m easurem ent Threshold)
I ub: N BAP init iat ingMessage procedureCode= idde dica t e dM e a su r e m e n t I n it ia t ion ( id- NodeBCom m unicat ionCont ext I D= k , id- Measurem ent I D= ff, m easurem ent Threshold)
I ub: ALCAP DL ERQ ( Originat ing Signal. Ass. I D= x , AAL2 Pat h= y, AAL2 Channel id= z, serv ed user gen
reference= m )
I ub: ALCAP UL ECF ( Originat ing Signal. Ass. I D= a a , Dest inat ion Sign. Assoc. I D= x )
I ub: ALCAP DL ERQ ( Originat ing Signal. Ass. I D= bb, AAL2 Pat h= cc, AAL2 Channel id= dd, served user gen
reference= n )
I ub: ALCAP UL ECF ( Originat ing Signal. Ass. I D= e e , Dest inat ion Sign. Assoc. I D= bb)
The Radio Link Rest oriat ion m essage indicat es t hat t he cell is now ready t o st art t ransm ission on radio ( Uu)
int erface.
I ub: N BAP init iat ingMessage procedureCode= id- r a dioLink Re st or a t ion, ( short Transact ionI D= gg , id- CRNCCom m unicat ionCont ext I D= j )
I ur: SCCP D T1 dest inat ionLocalReference= a , RNSAP ( init iat ingMessage, procedureCode= id- radioLinkRest orat ion,
short Transact ionI D= t t )
Aft er signaling and t raffic connect ion bet ween SRNC and UE are set up m easurem ent is init iat ed:
I ub: N BAP successfulOut com e procedureCode= idde dica t e dM e a su r e m e n t I n it ia t ion , short Transact ionI D= ii,
id- Measurem ent I D= ff)
I ur: SCCP D T1 ( dest inat ion local reference= a , m ore dat a= 0 , RNSAP ( init iat ingMessage procedureCode= idde dica t e dM e a sur e m e nt I nit ia t ion , id- Measurem ent I D= ff)
Fram ing Prot ocol Synchronizat ion for init ial alignm ent of DCCH and DTCH follows:
I ur: DCH FP Up and Downlink Sync for bot h I ur physical t ransport bearers ( DCCH + DTCH)
I ub: DCH FP Up and Downlink Sync for bot h I ub physical t ransport bearers
Finally SRNC sends Cell Updat e Confirm st ill using t he SCCP signaling t ransfer capabilit ies t o t he UE. This is
necessary because UE st ill has not received any inform at ion about t he provided dedicat ed resources.
I ur: SCCP D T1 dest inat ionLocalReference= b, RNSAP ( init iat ingMessage, procedureCode= iddow n lin k Sign a lin gTr a n sfe r , d- RNTI = o, Layer3- I nfo: RRC Ce llUpda t e Con fir m )
Since unt il now t here was no inform at ion exchanged t hat inform s t he UE t hat t he set up DCCH/ DTCH are relat ed
t o it s Cell Updat e t he Cell Updat e Confirm cont ains t he dedicat ed physical param et ers, especially uplink
scram bling code and downlink channelizat ion code, also t he t ransport form at set s of t he different DCHs and
prim ary scram bling code of t he new cell w e have already seen during radio link set up procedures. Cell Updat e
Confirm m essage on I ub is sent in downlink direct ion using t he Forward Access Channel ( FACH) of t he new cell.
Using RRC st at e indicat or t he UE is request ed t o sw it ch int o CELL_DCH aft er receiv ing t his m essage:
I ub: FACH RRC Ce llUpda t e Con fir m ( u- RNTI : SRNC- I D= h h + s- RNTI = e , rrcSt at eI D= CELL_ D CH ,
ULscram blingCode/ DLchannelizat ionCode= f/ , DCH- I D= g + UL/ DL Transport Form at Set , DCH- I D= g' + UL/ DL
Transport Form at Set , DCH- I D= g'' + UL/ DL Transport Form at Set , DCH- I D= h + UL/ DL Transport Form at Set ,
PScrCd= u u )
Aft er receiv ing t he Cell Updat e Confirm t he m obile sw it ches t o t he new est ablished DCCH/ DTCH of t he new cell
belonging t o new Node B. UE is now served by t he new cell. How it confirm s t he successful handover depends on
im plem ent ed v ersion of RRC prot ocol. I n case t hat earlier versions are used an UTRAN Mobilit y I nform at ion
Confirm m essage m ight be send on dedicat ed channel t o SRNC. RRC version 3.17 ( 2003- 12) cont ains a clear
st at em ent if Cell Updat e Confirm m essage does not include radio bearer inform at ion elem ent s, but does include
t ransport channel inform at ion elem ent s ( as in our call flow exam ple case) " t he UE shall t ransm it a Transport
Channel Reconfigurat ion Com plet e" in uplink direct ion using RLC acknow ledged m ode.
I n any case t here w ill be anot her confirm m essage t ransm it t ed t o SRNC using DCH/ DCCH. This m essage w ill be
t he indicat or t hat DCHs have been t ak en int o serv ice by UE and it w ill t rigger t he release of t he SCCP class 2
connect ion t hat carried RNSAP m essage for t his handover procedure.
UMTS Signaling
3 .2 0 SRN S RELOCATI ON ( UE N OT I N VOLVED )

The purpose of a SRNS Relocat ion t hat not involv es t he UE is t o m inim ize t raffic on I ur int erface. Thus, SRNC is
changed and I u connect ions are reorganized. The decision t o change t he SRNC ( t he RNC t hat cont rols t he
connect ions t o t he core net work dom ains) is t riggered by a previous m obilit y m anagem ent procedure like I nt er
RNC Hard or Soft Handover. The UE is not involved if it is already locat ed in t he new cell, which is t he case aft er
finished soft handover and forward hard handover procedures.
A SRNS Relocat ion ( UE not involved) can be perform ed in any st at e of t he call: if only RRC signaling is ex changed
bet ween UE and net work , but also if voice and/ or dat a calls are act ive.
The signaling exam ple in t his chapt er is not based on a real net work t race, but const ruct ed following different
descript ions in different 3GPP " specs" . One reason why t he aut hors have not m onit ored a SRNS Relocat ion ( UE
not involved) so far m ay be t hat it only appears in RNS border areas. I n addit ion long dist ance m oves during
act ive calls w it h long durat ion are required.
As t he reader w ill see t here is a quit e incredibly long list of param et ers em bedded in different RANAP and RRC
cont ainers. Most of t hese param et ers have been already discussed in I ub and I u signaling exam ples. Due t o huge
num ber of param et ers t he aut hors decided not t o assign variables t o indicat e param et er values for SRNS
relocat ion scenarios. Message exam ples w ill be shown as far as available.
3 .2 0 .1 Ove r vie w
Figure 3 131 - SRNS Relocat ion ( UE not involv ed) Procedure Overview
The follow ing exam ple shows relocat ion during an act ive PDP cont ext . I n case t hat a voice call would be act iv e in
addion t he sam e RANAP procedures need t o be perform ed on old and new I uCS int erface. I t is assum ed t hat t he
UE set up t he PDP cont ext in a cell t hat is cont rolled by RNC 1 ( not shown in t he pict ure) . Then it perform ed soft
handover in t wo st eps. First a radio link was added t hat belongs t o t he cell cont rolled by RNC 2 ( t he cell t hat is
shown in t he overv iew pict ure) . Lat er t he first radio link was released. Now t he UE has only radio cont act w it h t he
cell cont rolled by RNC 2 and t here are t ransport bearers for RRC signaling and I P payload est ablished on I ur.
I n t his sit uat ion RNC 1 decides on behalf of an algorit hm t hat is part of it s SRNC funct ion t hat it is necessary t o
perform a resource opt im izat ion, which m eans: block ed t ransport capacit ies of I ur bearers can be freed if core
net work connect ion t erm inat es direct ly at RNC 2. Since only a serv ing RNC ( SRNC) can t erm inat e t he core
net work connect ions it is also necessary t o hand over SRNC funct ionaliy from RNC 1 t o RNC 2.
This procedure in st eps:
St e p 1 :
RNC 1 is SRNC, but has no direct connect ion v ia it s RAN t o t he MS anym ore. All signaling and t raffic connect ions
are running on I ub cont rolled by RNC 2 t hat aft er successful soft handover m ay st ill act as Drift RNC ( DRNC) . I ur
t ransport bearers are necessary t o exchange t raffic and signaling bet w een SRNC and DRNC.
To opt im ize t he used net work resources SRNC ( RNC 1) m akes t he decision t o hand over it s funct ion t o t he DRNC
( RNC 2) . Since MS has direct cont act t o RNC 2 via I ub t he I ur connect ions w ill not be necessary any longer aft er
RNC2 becom es SRNC.
UMTS Signaling
St e p 2 :
RNC 2, t he old SRNC, sends a Relocat ion Required m essage t o SGSN which t hen execut es t he next necessary
st eps.
St e p 3 :
New I uPS signaling connect ion ( SCCP class 2) and new I u bearer as part of radio access bearer ( RAB) are set up
t owards RNC 2 and RNC 1 using RANAP Relocat ion Resource Allocat ion procedure. When t he new connect ion t o
core net work are ready t o be used RNC1 com m it s t o hand over SRNC funct ion t o RNC 2 sending a RNSAP
m essage v ia I ur.
St e p 4 :
Aft er RNC 2 ( form er DRNC) becam e SRNC I ur connect ion and old I uCS/ I uPS connect ions bet w een RNC 1 and
SGSN are released.
Figure 3 132 - SRNS Relocat ion ( UE not involv ed) Call Flow 1/ 3
The m essage flow shows in first st ep t he t ransport bearer sit uat ion before relocat ion t rigger is received. There
are t ransport bearers on I ur as well as on t wo I ub int erfaces t hat " feed" t wo radio links of t he act ive link set . UE
is in soft handover using one cell of Node B1 and one cell of Node B2. The RANAP signaling connect ion as well as
t he I u bearer for I P payload t erm inat e at RNC 1 t hat act s as SRNC.
Now UE sends RRC Measurem ent Report including event - I D " e1b" and prim ary scram bling code of cell of Node B1.
I t indicat es t hat radio links of t his cell becam e t o weak t o st ay in act ive set . Hence, Act ive Set Updat e including
Radio Link Delet ion is perform ed. Successiv ely t ransport bearers for DCHS on I ub 1 are delet ed as well.
Theoret ically t he m easurem ent report can be m onit ored on bot h I ub int erfaces depending on qualit y of received
RLC fram es ( see discussion of Qualit y Est im at e param et er and m acrodiversit y in t his book) . I n t he present ed call
flow exam ple it is assum ed t hat radio link on I ub 1 is already t oo bad, so we see RRC Measurem ent report only
on I ub 2 and I ur int erface.
Now SRNC ( RNC 1) decides t o perform t he relocat ion procedure. I t is st art ed sending a Relocat ion Required
m essage t o t he SGSN. " Relocat ion Required" is t he m essage nam e t hat is used in 3GPP docum ent s t o describe
t he m essage flow. However, t his m essage is em bedded in a procedure and t he procedure nam e/ code is
" Relocat ion Preparat ion" . The associat ion bet w een procedure code and m essage nam e is defined in ASN.1 RANAP
procedure descript ion:
UMTS Signaling
relocat ionPreparat ion RANAP- ELEMENTARY- PROCEDURE : : = {

I NI TI ATI NG MESSAGE Relocat ionRequired
SUCCESSFUL OUTCOME Relocat ionCom m and
UNSUCCESSFUL OUTCOME Relocat ionPreparat ionFailure
PROCEDURE CODE id- Relocat ionPreparat ion
CRI TI CALI TY rej ect
}
Follow ing t his specificat ion it em erges t hat RANAP Relocat ion Required m essage is defined as RANAP I nit ial
Message t hat cont ains procedure code = " id- Relocat ionPreparat ion" . I n t he follow ing m essage descript ions w e w ill
use t he procedure codes t o ident ifiy m essages, because t his is what is shown on a prot ocol t est er's m onit or.
The SourceRNC- t o- Target RNC- Transparent - Cont ainer cont ains inform at ion t hat need t o be forwarded by SGSN t o
RNC 2. I ncluded D- RNTI t hat was assigned by DRNC ( RNC 2) during radio link set up for soft handover shall lat er
be used in RNSAP m essages relat ed t o t his required relocat ion on I ur inface. I n RRC Cont ainer RNC 2 finds all
inform at ion t hat are necessary t o t ake over SRNC funct ion from RNC 1. The sum m ary of t hese inform at ion
elem ent s and param et ers is also known as RRC cont ext . Message exam ples t hat show RRC Signaling Radio Beaer
( SRB) I nfo List and Radio Bearer I nfo List as w ell as appropriat e t ransport channel m apping can be found in I ub
I MSI / GPRS At t ach and Mobile Originat ed Call ( MOC) scenarios described earlier in t his book.
I uPS1: RAN AP I nit ialMessage id- Re loca t ion Pr e pa r a t ion
Relocat ionType = " UE n ot in volve d"

cause = " r e sou r ce opt im isa t ion r e loca t ion
Source I D= RN C1
Target I D= RN C2
RAB t o be se t u p list ( I f act iv e PDP cont ext ) :
o AB- I D ( s) + RAB Param et ers
Sou r ce RN C- t o- Ta r ge t RN C- Tr a n spa r e n t - Con t a in e r :
o D - RN TI
o RAB- I D ( s) + Transport Channel Mapping, D CH - I D ( s) ,
o RRC Con t a in e r :
St at eofRRC = CELL_DCH
St at eofRRCConnect ion = " await no RRC m essage"
CipheringSt at us + Param et ers
I nt egrit y Prot .St at us + Param et ers
U- RN TI
UE RadioAccessCapabilit ies
RRC Measurem ent I nfo
SRB I n fo List + DCH- Mapping
Ra dio Be a r e r I n fo List + DCH- Mapping
N ot e : The RAB- t o- be- set uplist in t his m essage is an opt ional param et er t hat is only included if t here are act iv e
PDP cont ext s on I uPS. On I uCS Relocat ion Required m essage a voice call needs t o be act ive t o fullfil t he condit ion.
UMTS Signaling
When SGSN receives Relocat ion Required it can ident ify t he new I uPS int erface ( I uPS 2) on behalf of t he t arget
I D t hat cont ains t he global RNC ident it y of RNC 2 ( Figure 3.133) . Now SGSN sends RANAP Relocat ion Request
m essage t o RNC 2, which is also st art of Radio Access Bearer set up on new I uPS int erface. Encrypt ion and
int ergrit y specific inform at ion is added t o t he RAB- t o- be- set uplist by SGSN t o ensure t hat bot h securit y funct ions
w ill be cont inued wit hout problem s aft er RNC 2 becam e SRNC. The SourceRNC- t o- Traget RNC- Transparent Cont ainer including RRC cont ainer is t he sam e as in Relocat ion Required. RANAP Relocat ion Request m essage
belongs t o Relocat ion Resource Allocat ion procedure.
I uPS2: RAN AP I nit ialMessage id- Re loca t ion Re sou r ce Alloca t ion
Relocat ionType = " UE n ot in volve d"

cause = " r e sou r ce opt im isa t ion r e loca t ion
RAB t o be se t u p list ( I f act ive PDP cont ext ) :
o RAB- I D ( s) + RAB Param et ers
o I nt egrit y Prot ect ion I nfo
o Encrypt ion I nfo
o I u Signaling Connect ion I D
D - RN TI
RAB- I D ( s) + Transport Channel Mapping, D CH - I D ( s) ,
RRC Con t a in e r :
o St at eofRRC = CELL_DCH
o St at eofRRCConnect ion = " await no RRC m essage"
o CipheringSt at us + Param et ers
o I nt egrit y Prot .St at us + Param et ers
o U- RN TI
o UE RadioAccessCapabilit ies
o RRC Measurem ent I nfo
o SRB I n fo List + DCH- Mapping
o Ra dio Be a r e r I n fo List + DCH- Mapping
I n next st ep RNC 2 acknow ledges t he Relocat ion Resource Allocat ion w it h a Successful Out com e m essage. Also in
case t hat one or m ore RABs cannot be set up t he Successful Out com e w ill be sent , but including a RABs- failed- t oset uplist . I f all RABs can be set up successfully t he m essage has t he follow ing st ruct ure:
RAN AP SuccessfulOut com e id- Re loca t ion Re sou r ce Alloca t ion
RAB Se t u p List : RAB- I D ( s) + assigned RAB param et ers
UMTS Signaling
Target RNC- t o- SourceRNC- Transparent - Cont ainer:

o D - RN TI
o RRC Con t a in e r : e m pt y
The SGSN is inform ed about t he param et ers of successfully est ablished RABs on behalf t he enclosed RAB- set uplist and t he Target RNC- t o- SourceRNC- Transparent - Cont ainer cont ains t he D- RNTI and an em pt y RRC Cont ainer.
D- RNTI will be used as unique ident ifier w it hin t he follow ing Relocat ion Com m it procedure on I ur int erface. The
RRC cont ainer is em pt y in case of UE not involved in relocat ion, because t here is no handover t o be execut ed on
radio int erface. I n UE involved case t he RRC Cont ainer cont ains t he handover m essage const ruct ed by t arget RNC
( see nex t signaling scenario t o com pare bot h relocat ion t ypes) .
Aft er SGSN received Relocat ion Request Acknow ledge m essage it sends a Relocat ion Com m and t o RNC 1 t hat w ill
t rigger forwarding of SRNC funct ion. Relocat ion Com m and is t he Successful Out com e m essage of Relocat ion
Preparat ion procedure. I t cont ains a list of RABs t o be released including t heir RAB- I Ds t hat indicat es w hich RABs
have not been est ablished successfully on new I u int erface. Based on int ernal rules t he source RNC will decide if
Relocat ion procedure is cont inued or abort ed in case t hat not all RABs have been est ablished bet ween core
net work and t arget RNC. I n addion w e se our friend, t he Target RNC- t o- SourceRNC- Transparent - Cont ainer w it h
sam e cont ent s as in Relocat ion Request Acknow ledge before.
RAN AP SuccessfulOut com e id- Re loca t ionPr e pa r a t ion
RAB t o be Re le a se List : RAB- I D ( s)

Target RNC- t o- SourceRNC- Transparent - Cont ainer:
o D - RN TI
o RRC Con t a in e r : e m pt y
Now it is t im e t o involv e I ur int erface. I t is guessed t hat RNSAP Relocat ion Com m it is sent em bedded in DT1
m essage of a SCCP class 2 connect ion t hat was set up during I nt er- RNC soft handover procedure on I ur, because
3GPP 25.423 ( RNSAP) specifies t hat " connect ion- orient ed signaling t ransport serv ice funct ion" . Relocat ion
Com m it is signed wit h a " * " in t he m essage flow, because in a Rel. 99 environm ent t wo RNSAP m essages
( Relocat ion Det ect and Relocat ion Com m it ) are st andardized t o execut e t he SRNC forwarding via I ur. Rel. 4
st andards have delet ed Relocat ion Det ect from RNSAP and due t o short lifecycle t im e of prot ocol v ersions t he
aut hors preferred t o show Rel. 4 signaling flow version.
The RNSAP Relocat ion Com m it m essage cont ains t he D- RNTI t hat was exchanged in RANAP Relocat ion
Preparat ion and RANAP Resource Allocat ion procedures. I t is t he unique ident ifier t hat indicat es t o RNC 2 t hat
st art ing w it h recept ion of RNSAP Relocat ion Com m it it w ill be responsible t o handle SRNC funct ion for RRC
connect ion t hat was specified on behalf of RRC cont ext dat a in RRC cont ainer before.
Follow ing Relocat ion Com m it t he SCCP class 2 connect ion t hat carried RNSAP m essages as w ell as I ur t ransport
bearer for RRC signaling and I P payload exchange are delet ed. The sam e happens ot t he SCCP class 2 connect ion
and GTP user plane t unnel on old I uPS int erface.
UMTS Signaling
Aft er t he relocat ion ( UE not involved) is successfully finished a new RANAP signaling connect ion is act ive bet w een
RNC 2 and SGSN. I n parallel t here w as/ have been GTP user plane t unnel( s) ( I u bearer) for one/ or m ore PDP
cont ext s est ablished. AAL2 SVCs for RRC signaling and I P payload rem ained act ive on I ub int erface bet w een RNC
2 and Node B2.
UMTS Signaling
3 .2 1 SRN S RELOCATI ON ( UE I N VOLVED )
Figure 3 135 - SRNS Relocat ion ( UE involved) Principle
I f t he UE is involv ed in t he relocat ion procedure it always m eans t hat a ( backw ard) hard handover cont rolled by
old SRNC ( RNC 1) is perform ed. As shown in t he pict ure above t his relocat ion procedure m ay once again hav e
im pact on all ongoing signaling and user t raffice exchanged bet ween UE and CS/ PS core net w ork dom ains. When
RNC1 decides t o perform hard handover and change of SRNC in one st ep (
) a RANAP Relocat ion Required
m essage w ill be sent t o part icipat ing core net w ork elem ent s MSC and/ or SGSN (
) , which t hen w ill set up new I u
signaling connect ions and I u bearers t owareds RNC 2( ) . Aft er t he handover was perform ed successfully
signaling connect ions and user plane t ransport bearers on I u int erfaces bet ween core net work elem ent s and RNC
1 can be released (
).
The m aybe m ost significant difference t o UE- not - involved SRNS relocat ion in t he signaling flow is t hat neit her
signaling nor any ot her kind of dat a is exchanged via I ur int erface. The procedure is used t o perform SRNS
relocat ion if no I ur int erface is available bet w een RNCs of t he sam e UTRAN and t o support int er- frequency hard
handover bet ween UTRAN cells t hat use different UMTS frequency bands.
An UE involved relocat ion is also execut ed in case of int ersyst em handover, w hich m eans: a handover from an
UTRAN cell int o a neighbour cell t hat uses a different radio access t echnology ( RAT) like GSM, CDMA2000 et c.
These k inds of handovers are also nam ed int er- RAT handovers. Since in t oday's net works int er- RAT handovers
cannot be execut ed w it hout involving t he core net work elem ent s and t ransport funct ions t hese scenarios w ill be
discussed in part 3 of t his book: Core Net work Signaling Procedures. How ever, t he reader should k eep in m ind
t hat w it h especially int roduct ion of new int erfaces and prot ocols, st andard enhancem ent s of Release 5 int ersyst em handovers becom e possible t hat are direct ly execut ed bet ween radio access net works using different
radio t echnologies. An exam ple is t he I urg int erface bet w een GSM BSC and UTRAN RNC where a new set of
RNSAP m essage can be used t o perform int ersyst em handovers w it hout involving t he core net work.
UMTS Signaling
3 .2 1 .1 Ove r vie w
Figure 3 136 - SRNS Relocat ion ( UE involved) Procedure Ov erview
Also for t his signaling exam ple t he aut hors have not been able t o m onit or a com plet e scenario in any net work or
t est bed, but t hey have seen part s of t his m essage flow on som e int erfaces. On behalf of t his inform at ion a quit e
precise descript ion of t he overall procedure is possible despit e som e uncert aint ies rem ain. For inst ance it is
proved t hat event - I D " e2a" ( " change of best frequency" ) is used t o t rigger execut ion of t he UE involved
relocat ion, but it m ight not be t he only one. Follow ing t he underst anding of t he aut hors also event I D " e2b" could
be used t o define t he t rigger event . ( " The est im at ed qualit y of t he current ly used frequency is below a cert ain
t hreshold and t he est im at ed qualit y of a non- used frequency is above a cert ain t hreshold." ) Finally t he realnet work im plem ent at ion of t he procedure m ust be seen in all cases as a m anufact urer or operat or specific one
t hat also m ight be changed wit h ongoing deploym ent of net work st ruct ures driven by needs of net work
opt im izat ion.
The scenario of t he call flow exam ple shows an UE involved SRNS relocat ion during an act ive voice call. MSC is
part icipat ing, but SGSN is not involv ed, because t here is neit her a PDP cont ex t nor a present signaling connect ion
bet ween UE and PS dom ain act ive. The UE is st ill serv ed by cell w it h frequency f1 ( cell 1) t hat belongs t o Node
B1, but cell using frequency f2 ( cell 2) t hat belongs t o Node B2 is becom ing st ronger while received prim ary
CPI CH st rengt h of cell 1 is fading away due t o UE's m ove.
St e p 1 :
RNC 1 is SRNC and receives RRC Measurem ent Report from UE t hat cell 2 ( w it h frequency f2) offers bet t er
condit ions for t he connect ion com pared t o sit uat ion on radio int erface using frequency f1. Based on t his
m easurem ent report t he decision is m ade t o perform hard handover and SRNS relocat ion in one st ep.
St e p 2 :
RNC 1 sends RANAP Relocat ion Required m essage t o serv ing MSC.
St e p 3 :
Serv ing MSC sends RANAP Relocat ion Request t o RNC 2. This m essage includes all inform at ion necessary t o
est ablish RANAP signaling connect ion and I u bearer on new I u int erface bet ween MSC and RNC 2.
St e p 4 :
Aft er RNC 2 received Relocat ion Request m essage it builds t he handover com m and m essage, in t his case: RRC
Physical Channel Reconfigurat ion Request . Physical Channel Reconfigurat ion m essage is enclosed in RANAP
Relocat ion Request Acknow ledgem ent m essage sent from RNC 2 t o MSC t o confirm t hat necessary I u signaling
and user plane t ransport resources have been assigned.
St e p 5 :
MSC sends RANAP Relocat ion Com m and t o RNC 1, which is order t o execut e t he handover now. The m essage
cont ains t he handover m essage as const ruct ed and sent by RNC 2.
St e p 6 :
On I ub and radio int erface of cell 1 RRC Phy sical Channel Reconfigurat ion m essage is sent t o UE. This m essage
UMTS Signaling
cont ains all param et ers necessary t o find t he already provided dedicat ed physical channels of cell 2. Based ont
his inform at ion UE perform s int er- frequency hard handover.
St e p 7 :
Aft er UE synchronized w it h cell 2 Node B2 sends a NBAP Radio Link Rest ore Com m it m essage t o indicat e
successful handover on physical radio layer.
St e p 8 :
CRNC funct ion of RNC 2 t iggers sending of RANAP Relocat ion Det ect m essage t o " t ell" MSC t hat handover was
execut ed on physical lay er. Now MSC " knows" t hat UE is physically not connect ed anym ore t o cell 1. RNC 1 w ill
be inform ed about t his fact when it receives NBAP Radio Link Failure I ndicat ion from Node B1. This m essage is
not shown in ov erv iew pict ure and could be sent at any t im e aft er st ep 6. NBAP Radio Link Failure I ndicat on is
not a m andat ory m essage in all cases of hard handover. I t is not seen if RNC t riggered by I u Release from I uCS
delet es t he assigned dedicat ed radio resources fast er t han Node B is able t o report t hat UE lost cont act . How ever,
follow ing recept ion of
Radio Link Failure I ndicat ion, RNC 1 w ill release RRC cont ext dat a and dedicat ed physical resources for
connect ion w it h t his UE as well.
St e p 9 :
Aft er UE has full access t o dedicat ed physical channels in cell 2 it sends RRC Physical Channel Reconfigurat ion
Com plet e m essage using t he new radio link and hence, t he new I ub int erface bet ween Node B2 and RNC 2. Now
RNC 2 t akes ov er SRNC funct ion of t his connect ion and react ivat es connect ion t o t he core net work.
St e p 1 0 :
Since t he handover is now also com plet ed on RRC level RNC 2 ( new SRNC) sends RANAP Relocat ion Com plet e
m essage t o serving MSC.
Figure 3 137 - SRNS Relocat ion ( UE involved) Call Flow 1/ 4
The m essage flow part st art s w it h t riggering procedure. When RRC connect ion is est ablished wit h UE a num ber of
RRC m easurem ent t asks is defined. Measurem ent necessary for t his scenario is int er- frequency m easurem ent
and appropriat e event - I D group is " e2" .
Som ewhen aft er connect ion is est ablished and m easurem ent is act ivat ed UE st art s t o m ove and reaches an area
where radio condit ions of used UTRAN frequency f1 becom e w orse. This is indicat ed by sending one or several
RRC Measurem ent Report s w it h event - I D " e2d" t o SRNC. This shows " est im at ed qualit y of t he current ly used
frequency is below a cert ain t hreshold" and t he so- t o- say " value added" inform at ion of t hese m easurem ent
UMTS Signaling
report s for SRNC is t hat as a consequence UE st art s t o m onit or cells w it h ot her UMTS frequencies and/ or ot her
radio access t echnologies.
When UE found a cell t hat seem s t o offer required radio param et ers it sends anot her RRC Measurem ent Report
including ev ent - I D " e2a" ( change of best frequency) . I n addit ion prim ary scram bling code and downlink UMTS
Absolut e Radio Frequency Channel Num ber ( uARFCN DL) are report ed t o SRNC. Bot h addit ional param et ers allow
unique ident ificat ion of t he new cell on radio int erface.
The recept ion of t he last m ent ioned RRC Measurem ent Report t riggers st art of relocat ion procedure execut ed by
SRNC t hat st art s RANAP Relocat ion Preparat ion procedure. For relat ion of RANAP m essage nam es and procedure
codes see previous chapt er SRNS Relcoat ion ( UE not involved) . The RANAP m essage it self, but also t he
em bedded RRC cont ainer is slight ly different from sam e m essage in previous scenario. Target I D is deriv ed from
prim ary scram bling code in RRC Measurem ent Report .
RAN AP I nit ialMessage: ProcedureCode= id- Re loca t ion Pr e pa r a t ion
Relocat ionType = UE in volve d

Cause = t im e cr it ica l r e loca t ion
Source I D = RN C 1
Target I D = RN C 2
o Ta r ge t Ce ll- I D
o I nt egrit y Prot ect ion I nfo + Key for RRC Signaling
o I nt egrit y Prot ect ion I nfo + Key for user plane t raffic
o Encrypt ion I nfo + Key for RRC Signaling
o Encrypt ion I nfo + Key for user plane t raffic
RRC St at e= CELL_DCH
St at e of RRC Connect ion = aw ait no RRC m essage
Ciphering I nfo List
SRB specific I nt egrit yProt . I nfo for each SRB
U- RN TI [ SRNC- I D= RN C1 + S- RNTI ]
UE Radio Access Capabilit ies:
UE Mult i- RAT Cap.
Securit y Capabilit ies
Posit ioning Capabilit ies
Measurem ent Capabilit ies
SRB I nfo List
SRB- I D s+ UL/ DL D CH - I D
RB I nfo List
RB- I D s+ UL/ DL D CH - I
UMTS Signaling
UMTS Signaling
Message Exam ple 3 40: RANAP Relocat ion Required incl. SourceRNC- t o- Target RNC- Transparent - Cont ainer and
RRC Cont ainer
The RANAP Relocat ion Required m essage in t he m essage exam ple cont ains t he discussed param et ers, but RABI D values ( 1 and 5) in rb- I nform at ionSet upList indicat e t hat t he UE in t he exam ple has a voice call and PDP
cont ext s act ive sim ult aneously. Radio bearer m apping opt ions and DCH param et ers can be found m ore det ailed
in I ub scenarios " Mobile Originat ed Call ( MOC) " and " PDP Cont ext Act ivat ion/ Deact ivat ion" .
On behalf of included t arget I D serv ing MSC is able t o det ect t hat RNC 2 shall becom e new SRNC of t he
connect ion. So it st art s RANAP Relocat ion Resource Allocat ion procedure w it h RNC 2. I n I nit ial Message of t his
procedure MSC defines t he num ber of RABs and t heir param et ers.
RAN AP I nit ialMessage: ProcedureCode= id- Re loca t ion Re sou r ce Alloca t ion
Relocat ionType = UE involved

Cause = t im e cr it ica l r e loca t ion
RAB- t o- be - se t u p- list
o RAB- I D s + Pa r a m e t e r s
I nt egrit y Prot ect ion I nfo
Encrypt ion I nfo
I u Signaling Connect ion I D
o Ta r ge t Ce ll- I D
o I nt egrit y Prot ect ion I nfo + Key for RRC Signaling
o I nt egrit y Prot ect ion I nfo + Key for user plane t raffic
o Encrypt ion I nfo + Key for RRC Signaling
o Encrypt ion I nfo + Key for user plane t raffic
RRC St at e= CELL_DCH
St at e of RRC Connect ion = aw ait no RRC m essage
Ciphering I nfo List
SRB specific I nt egrit yProt . I nfo for each SRB
U- RN TI [ SRNC- I D= RN C1 + S- RNTI ]
UE Radio Access Capabilit ies:
UE Mult i- RAT Cap.
UMTS Signaling
Securit y Capabilit ies

Posit ioning Capabilit ies
Measurem ent Capabilit ies
SRB I nfo List
SRB- I D s+ UL/ DL D CH - I D
RB I nfo List
RB- I D s+ UL/ DL D CH - I D s
When RNC 2 receives RANAP Relocat ion Request m essage it provides necessary resources t o est ablish dedicat ed
physical channels on radio int erface of new cell, dedicat ed t ransport channels for signaling and voice packet s on
I ub and an AAL2 SVC t hat act s as physical t ransport bearer of I u bearer on new I uCS int erface.
When all t hese NBAP and ALCAP procedures are successfully finished RNC 2 acknow ledges RANAP Relocat ion
Request . The appropriat e signaling m essage cont ains t he RRC handover m essage t hat is m ost likely a RRC
Physical Channel Reconfigurat ion m essage. Depending on if changes on t ransport channel lev el or QoS are
necessary or required inst ead of Physical Channel Reconfigurat ion also a RRC Transport Channel Reconfigurat ion
or RRC Radio Bearer Reconfigurat ion m essage could be used as handover com m and t hat is always em bedded in
Target RNC- t o- SourceRNC- Transparent - Cont ainer. The RRC Physical Channel Reconfigurat ion m essage cont ains all
param et ers t hat allow UE t o find provided dedicat ed physical channels in new cell. The m eaning of RAB Set up List
is t he sam e as in UE not involv ed SRNS Relocat ion scenario.
RAN AP SuccessfulOut com e: ProcedureCode = id- Re loca t ion Re sou r ce Alloca t ion
RAB- se t u p- list
o RAB- I D s
Target RNC- t o- SourceRNC- Transparent - Cont ainer
o RRC Con t a in e r
RRC Ph ysica l Ch a n n e l Re con figu r a t ion
Pr im a r y Scr a m blin g Code ( PScr Cd) n e w ce ll
uARFCN Uplink
uARFCN Downlink
Downlink Scram bling Code = PScrCd of new cell
MSC sends now Relocat ion Com m and t o old SRNC. This m essage defines t he I Ds of radio access bearers t o be
released in old RNS and it also cont ains t he t ransparent ly forw arded RRC Physical Channel Reconfigurat ion
m essage:
RAN AP SuccessfulOut com e: ProcedureCode = id- Re loca t ion Pr e pa r a t ion
RAB- t o- be - r e le a se d- list
o RAB- I D s
Target RNC- t o- SourceRNC- Transparent - Cont ainer
RRC Ph ysica l Ch a n n e l Re con figu r a t ion
Pr im a r y Scr a m blin g Code ( PScr Cd) n e w ce ll
uARFCN Uplink
uARFCN Downlink
Downlink Scram bling Code = PScrCd of new cell
UMTS Signaling
RNC 1 ext ract s t he Physical Channel Reconfigurat ion m essages from t he cont ainer and sends it t o UE v ia I ub and
Uu int erface. Follow ing t he recepit on UE perform s handover int o t he new cell.
Node B1 det ect s t hat radio cont act w it h UE is lost and sends NBAP Radio Link Failure I ndicat ion. This t riggers
release of dedicat ed t ransport resources on old I ub execut ed by RNC 1.
Sim ult aneously Node B2 sends NBAP Radio Link Rest ore I ndicat ion t o RNC 2 t o inform t hat UE found provided
dedicat ed channels on radio int erface and synchronized w it h Node B. RNC 2 inform s MSC t hat relocat ion was
det ect ed on phy sical level by sending RANAP Relocat ion Det ect m essage.
Then UE sends RRC Physical Channel Reconfigurat ion Com plet e ( in ot her cases: Transport Channel
Reconfigurat ion Com plet e or Radio Bearer Reconfigurat ion Com plet e) t o RNC 2 t hat is from now on SRNC of t he
act ive connect ion.
RNC 2 inform s MSC t hat relocat ion is com plet ed by sending RANAP Relocat ion Com plet e m essage.
UMTS Signaling
Now MSC is sure t hat no furt her dat a or signaling regarding t his single UE connect ion need t o be exchanged wit h
RNC 1 anym ore. Hence, RANAP I u Release and SCCP Release procedure are t riggered and ex ecut ed by core
net work elem ent , which is last st ep of t he successful relocat ion.
UMTS Signaling
3 .2 2 SH ORT M ESSAGE SERVI CE ( SM S) I N UM TS N ETW ORKS

Also in UMTS t he Short Message Serv ice - already well- known from GSM - w ill be available and especially in t he
European region one of t he m ost im port ant services. The follow ing descript ion gives an overview of SMS net work
archit ect ure and signaling procedures in UTRAN.
3 .2 2 .1 SM S N e t w or k Ar ch it e ct u r e Ove r vie w
Figure 3 141 - SMS Net work Archit ect ure Overview
From t he Short Message Serv ice ( SMS) point of view t he net w ork consist s of t he follow ing net work elem ent s t hat
are involv ed in short m essage ( SM) exchange:
The Mobile St at ion ( MS) - m ay subm it short m essages t o t he net work or t he receive SM t hat are delivered by t he
net work .
Serv ing GPRS Support Node ( SGSN) and serv ing Mobile Sw it ching Cent er ( MSC) prov ide alt ernat ive ways t o
t ransm it a SM from or t o a MS. I t is possible t o perform a re- rout ing, e.g. in case t hat a paging from t he circuit
sw it ched core net work dom ain ( MSC) is not successful t he sam e paging w ill be execut e by t he SGSN once again.
The paging inform at ion is t hen forwarded using t he Gs int erface.
There is no general rule which core net work dom ain is preferred for SM subm ission and delivery. 3GPP TS 23.040
recom m ends t o use t he pack et sw it ched CN dom ain ( send/ receive SM via SGSN) due t o higher efficiency of
resource allocat ion, but net work operat ors as well as equipm ent m anufact urers in t he first st age of 3G
deploym ent seem t o prefer t he way via MSC m ost likely due t o already proven high reliabilit y of t he SMS pat hs in
t his part of t he net work.
The Visit or Locat ion Regist er ( VLR) is involv ed in case of paging a MS for SMS delivery and provides t he MSI SDN
of t he MS in case of m obile originat ed short m essage.
On E- int erface t he SM is sent from / t o a Gat eway MSC ( GMSC) t o a Short Message Serv ice Cent er ( SC or SM- SC) .
This is necessary t o provide rout ing info in case of m obile t erm inat ed SM ( SMS delivery) .
The SC is always connect ed t o a GMSC, but not all GMSCs are connect ed t o SCs. The int erface bet w een SC and
GMSC is out of scope of GSM and 3G specificat ions, but oft en realized on behalf of a SS# 7/ MAP prot ocol st ack.
Bet ween Short Message Ent it y ( SME) and SC as a rule I P- based prot ocol st ack s are running. Most SME belong t o
independent service prov iders and are not owned by GSM or 3G net work operat ors. A SME can for inst ance be
used t o send short m essages from t he int ernet .
UMTS Signaling
3 .2 2 .2 SM S Pr ot ocol Ar chit e ct u r e
Figure 3 142 - SMS Prot ocol Archit ect ure
A look int o t he SMS prot ocol archit ect ure of t he UTRAN shows t hat t he short m essage prot ocols are users of t he
RRC and RANAP prot ocol. This m eans: Short Messages are t ransport ed as low priorit y Non- Access St rat um ( NAS)
signalling m essages t ransparent ly bet w een t he MS and t he MSC ( or SGSN t hat is not shown in t his figure) .
The Short Message Cont rol Prot ocol ( SM- CP) provides short m essage t ransport funct ions bet w een MS and
MSC/ SGSN as well as bet w een follow ing core net work elem ent s, which are involved in SM t ransport and rout ing,
e.g. MSC/ SGSN and Gat eway MSC ( GMSC) . Messages belonging t o t he sam e SM- CP t ransact ion, e.g. a SM MO,
have t he sam e t ransact ion I d value.
Short Message Rout ing Prot ocol ( SM- RP) provides addressing funct ions from MS t o SMSC in case of short
m essage m obile originat ed ( SM MO) services and from SMSC t o MS in case of short m essage m obile t erm inat ed
( SM MT) serv ices.
Short Message Transfer Layer is responsible for direct com m unicat ion bet ween MS and ( SM- SC) and v ice v ersa
and cont ains t he cont ent of t he m essage it self, e.g. t he w rit t en t ext .
Short m essage t ransm ission is specified as low priorit y NAS signaling in 3GPP specificat ions. Hence, m any
m essages regarding set up and release of RRC and RANAP connect ion are t he sam e as in case of ot her already
discussed signaling procedures lik e locat ion updat e or GPRS at t ach. The focus in t he follow ing call flow diagram s
will be on t he m essages belonging t o new SM prot ocol layers and new param et er values in already known
m essages.
UMTS Signaling
3 .2 2 .3 M obile Or igin a t e d Sh or t M e ssa ge
Figure 3 143 - Short Message Mobile Originat ed ( SM MO) Procedure Overview
I f a MS sends a short m essage t o t he net work t he int ernat ional st andard docum ent s call t his t o subm it a short
m essage.
St e p 1 :
Before a SM can be subm it t ed a RRC connect ion need t o be est ablished. The SM w ill be sent in a DCCH ident ified
by t he highest available Signaling Radio Bearer ( SRB) value, m ost likely logical channel = 4 . This DCCH is only
used for low priorit y NAS signaling exchange and set up during RRC Connect ion Set up procedure ( for det ails see
descript ion of Locat ion Updat e procedure on I ub) .
St e p 2 :
Using t he RRC direct t ransfer serv ice a SMS- SUBMI T m essage is sent from t he m obile t o t he net work .
St e p 3 :
When RNC receives t his SMS- SUBMI T is st art s set t ing up a SCCP/ RANAP connect ion and forw ards t his SMSSUBMI T t o t he MSC ( or SGSN) using RANAP direct t ransfer feat ures.
St e p 4 :
The MS wait s unt il SM- SC acknowledged recept ion of t he m obile originat ed short m essage. Then t he
SCCP/ RANAP connect ion is released.
St e p 5 :
Triggered by SCCP Release on I uCS ( or I uPS) RRC Connect ion m ay be released as well or RNC request s t he MS t o
change int o CELL_FACH and lat er CELL_PCH or CELL_URA st at e.
UMTS Signaling
Figure 3 144 - SM MO Call Flow 1/ 5
M e ssa ge Flow :
The set up of RRC connect ion and a dedicat ed t ransport channel t hat carries t he dedicat ed cont rol channel ( DCCH)
for SM m essage exchange is already well- know n from ot her signaling procedures on I ub int erface. How ever, a
difference is found in t he rrcConnect ionRequest m essage since it s est ablishm ent cause in case of SM MO is
originat ingLowPriorit ySignalling . Since t he MS already needs t o be at t ached eit her t o CS or PS dom ain before it
is allow ed t o send a SM it uses eit her TMSI or P- TMSI for ident ificat ion:
RACH : UL RLC TMD r r cCon n e ct ion Re qu e st ( TMSI or P- TMSI ,
est ablishm ent Cause= originat ingLowPriorit ySignaling)
I t should be not ed t hat all NAS m essages including t he short m essage w ill be t ransport ed in t he DCH ident ified by
a unique VPI / VCI / CI D value on I ub int erface t hat allows easy filt ering of t he NAS call flow sequence.
UMTS Signaling
Aft er RRC connect ion is est ablished MM/ CC/ SM m essages can be exchanged em bedded in RRC Direct Transfer
m essages. A Connect ion Managem ent Serv ice Request ( CMSREQ) is sent by t he m obile. The CM Serv ice Type
inform at ion elem ent inside t his m essage indicat es t hat t he MS want s t o send a short m essage. I n addit ion t he
I MSI is included as unique user ident ifier.
D CH : UL RRC init ialDirect Transfer CM SREQ ( CM Se r vice Type = Sh or t M e ssa ge , I M SI )
When RNC receives t his NAS m essage it st art s set t ing up SCCP connect ion on I uCS int erface on behalf of SCCP
Connect ion Request m essage. This CR m essage includes a RANAP I nit ial_UE_Message t hat carries t he em bedded
CMSREQ m essage. The Source Local Reference Num ber in t he CR m essage ident ifies t he calling part y of t his
SCCP connect ion. I t w ill be used as dest inat ion local reference num ber in all m essages sent by t he ot her side
( called part y) of t he SCCP connect ion:
SCCP CR ( source local reference= a, RANAP I nit ial_UE_Message, NAS m essage = CM SREQ [ CM Se r vice Type =
Shor t M e ssa ge , I M SI ] )
When t he RNC receiv es t he SCCP Connect ion Confirm ( CC) m essage from t he MSC t he SCCP connect ion is
est ablished successfully:
Bot h values, source local reference and dest inat ion local reference, can be used as filt er crit eria for t he SM call
flow and t o ident ify uplink and downlink m essages on I uCS or I uPS int erface.
I n t he exam ple call flow an opt ional Locat ion Report is request ed by t he MSC. This RANAP procedure is used t o
get act ual locat ion info from t he Serv ing Mobile Locat ion Cent er ( SMLC) t hat w ill be forwarded by MSC or SGSN
t o t he Gat eway Mobile Locat ion Cent er ( GMLC) . The GMLC st ores all locat ion relevant dat a of users subscribed t o
Locat ion Serv ices ( LCS) . The SMLC is usually co- locat ed w it h t he SRNC.
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage [ procedureCode = Locat ionReport ing] )
SCCP D T1 ( dest inat ion local reference= b, RANAP init iat ingMessage [ procedure Code = Locat ionReport ] )
As anot her opt ion t he already well- known Aut hent icat ion procedure m ay follow:
Wit h t he RANAP Securit y Mode Cont rol procedure ciphering and/ or int egrit y prot ect ion bet w een RNC and UE are
act ivat ed:
SCCP D T1 ( dest inat ion local reference= a, RANAP init iat ingMessage [ procedureCode = Securit yModeCont rol ] )
I ub: D CH ( VPI / VCI / CI D) : RRC Se cu r it yM ode Com m a n d
I ub: D CH ( VPI / VCI / CI D) : RRC Se cu r it yM ode Com ple t e
SCCP D T1 ( dest inat ion local reference= b, RANAP successfulOut com e [ procedureCode = Securit yModeCont rol ] )
UMTS Signaling
I m m ediat ely aft er t he securit y funct ions hav e been successfully act ivat ed t he MS sends it s short m essage
em bedded in an RRC UplinkDirect Transfer m essage:
I ub: D CH ( VPI / VCI / CI D) : RRC Uplin k D ir ect Tr a n sfe r : CP- Dat a ( RP- Dat a_UL [ D e st in a t ion SM SC Addr e ss,
MessageReference= c, SM TP SM S- SUBM I T { Dest inat ion User Address, User Dat a = Te x t } ] )
The em bedded NAS m essage cont ains Short Message Cont rol Prot ocol ( CP) , Rout ing Prot ocol ( RP) and Short
Message Transport Prot ocol ( SMTP) inform at ion. The Cont rol Prot ocol is j ust a t ransport layer for SMS and
provides serv ices t o t he upper layer prot ocols t hat ensure end- t o- end short m essage exchange.
The Short Message Rout ing Prot ocol is responsible for t he m essage exchange bet ween MS ( or any ot her short
m essage ent it y [ SME] ) and SM- SC. The m ain param et er of t he RP in uplink direct ion is t he E.164 Address of t he
SM- SC. This address is st ored on t he USI M inside t he m obile and can be changed using rem ot e operat ion of t he
SI M Applicat ion Toolk it by t he net work operat or.
The Short Message Transport Prot ocol layer finally provides t he inform at ion ent ered by t he subscriber: t he BPart y Dest inat ion User Address for t his SMS t ransact ion and t he cont ent s of t he short m essage, e.g. t ext , but
also pict ures, predefined anim at ions or e- Mail are possible. There are also possibilit ies t o concat enat e sev eral SM
and perform SM com pression as described in 3GPP TS 23.040. SMS Alphabet encoding is specified in 3GPP TS
23.038. I n t he st andard alphabet let t ers and num bers are encoded in sept et s ( each let t er 7 bit ) .
While t he SM arrives at SRNC via I ub int erface on I uCS a RANAP I nit iat ing Message t hat cont ains t he Com m on I D
procedure code is received by RNC t o check t he t rue ident it y of t he subscriber ( I MSI ) :
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage [ procedureCode = Com m on I D { I MSI } ] )
Then t he SM is forwarded t ransparent ly on behalf of RANAP Direct Transfer from SRNC t o MSC.
SCCP D T1 ( dest inat ion local reference= b, RANAP init iat ingMessage Direct Transfer: CP- Dat a ( RP- Dat a_UL
[ D e st in a t ion SM SC Addr e ss, MessageReference= c, SM TP SM S- SUBM I T { Dest inat ion User Address, User Dat a
= Te x t } ] )

The short m essage cont rol prot ocol ( CP) is designed in a way t hat every CD- Dat a block is acknow ledged on each
point - t o- point - connect ion bet w een t he MS and t he SM- SC t o ensure t hat t he underlaying t ransport layer ( in t his
case: RANAP and RRC) works errorfree, because t here is no explicit acknow ledgem ent e.g. t o a RANAP
Direct Transfer m essage. This is t he reason why t he follow ing t wo m essages are sent :
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage Direct Transfer: CP- ACK)
I ub: D CH ( VPI / VCI / CI D) : RRC Downlink Direct Transfer ( CP- ACK)
Aft er t he SM- SC received t he subm it t ed SM it also sends an ack now ledgem ent t o t he MS. However, t his
acknowledgem ent is on short m essage rout ing prot ocol ( RP) level. The RP- ACK m essage in downlink direct ion
cont ains t he sam e m essage reference value as t he RP- Data block t hat carried t he SM cont ent in uplink direct ion
before:
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage Direct Transfer: CP- Dat a [ RP- ACK
{ MessageReference= c} ] )
I ub: D CH ( VPI / VCI / CI D) : RRC Downlink Direct Transfer ( CP- Dat a [ RP- ACK { MessageReference= c} ] )
UMTS Signaling
Now errorfree recept ion of t hese RP- ACK m essages is also acknow ledged on CP lev el on bot h int erfaces:
I ub: D CH ( VPI / VCI / CI D) : RRC UplinkDirect Transfer ( CP- ACK)
SCCP D T1 ( dest inat ion local reference= b, RANAP init iat ingMessage Direct Transfer: CP- ACK)
Now t he SM MO t ransact ion procedure is com plet e and t he SCCP/ RANAP connect ion on I uCS can be released. The
first I uRelease cont ains a release cause:
This RANAP init ial I uRelease m essage t riggers t he RRC Connect ion Release on I ub int erface.
Follow ing RRC Connect ion Release t he radio resources ( Scram bling Codes, Channelisat ion codes et c.) are delet ed
by CRNC, t hen t he AAL2 SVC of t he DCH t hat carried t he DCCHs is released as well.
On I uCS int erface aft er successful release procedures on I ub t he successfulOut com e of I uRelease is indicat ed by
SRNC:
SCCP D T1 ( dest inat ion local reference= b, RANAP successfulOut com e, I u Re le a se )
Finally t he SCCP connect ion is released:
SCCP RLSD ( source local reference= b, dest inat ion local reference= a , Re le a se Ca u se )
3 .2 2 .4 M obile Te r m in a t e d Sh or t M e ssa ge
Ove r vie w
UMTS Signaling
Figure 3 149 - Short Message Mobile Term inat ed ( SM MT) Procedure Overview
I f a MS receives a short m essage from t he net w ork t he int ernat ional st andard docum ent s nam e t his t o deliver a
short m essage.
St ep 0:
The MS t hat shall receiv e t he short m essage is paged in several cells belonging t o t he sam e LA, RA or URA or in
j ust one cell - depending from t he present RRC st at e of t he UE.
St e p 1 :
I f t here is no act ive RRC connect ion such a connect ion need t o be est ablished. Once again t he SM w ill be
t ransm it t ed using t he DCCH for low priorit y NAS signaling.
St e p 2 :
First t he MS sends a Paging Response m essage t o t he net work using t he RRC direct t ransfer service.
St e p 3 :
When RNC receives t his Paging Response is st art s set t ing up a SCCP/ RANAP connect ion t o forwards all NAS
m essages t ransparent ly t o t he MSC ( or SGSN) using RANAP direct t ransfer feat ures. Aft er recept ion of t he paging
response t he net work sends t he SM enclosed in an SMS- DELI VER m essage t o t he m obile and wait s for posit ive
acknow ledgem ent of t his t ransact ion.
St e p 4 :
Aft er SMS Rout ing Prot ocol Ack now ledgm ent t he SCCP/ RANAP connect ion is released.
St e p 5 :
Triggered by SCCP Release on I uCS ( or I uPS) RRC Connect ion m ay be released as well or RNC request s t he MS t o
change int o CELL_FACH and lat er CELL_PCH or CELL_URA st at e.
M e ssa ge Flow
UMTS Signaling
Figure 3 150 - SM MT Call Flow 1/ 6
I t is assum ed t hat t he Node B t hat is m onit ored on I ub int erface has 3 cells. Hence, t here are 3 Paging Channels
( PCH) t hat differ in t he CI D value of t heir AAL2 SVC. The ( S) RNC receives t he int ial pagaing m essage from t he
MSC. I t is a RANAP m essage em bedded in a SCCP UDT m essage, which m eans: connect ionless SCCP m essage
t ransfer. The Called and Calling Part y Address in t his UDT m essage t hat can be eit her signaling point codes ( SPC)
or E.164 ( Global Tit le) form at represent t he addresses of RNC ( called part y) and MSC ( calling part y) . The RANAP
paging m essage cont ains t he I MSI as unique ident ifier of t he MS t o be paged, t he paging area I D ( in exam ple
case: locat ion area represent ed by m obile count ry code [ PLMNident it y] + locat ion area code) and t he paging
cause, in case of SM MT: t erm inat ingLowPriorit ySignaling .
SCCP UD T ( Called_Part y_Address = e ( RN C) , Calling_Part y_Address = f ( M SC) [ RANAP I nit iat ingMessage idPa gin g { I MSI , id- PagingAreaI d = PLMNident it y + LAC, pagingCause= t erm inat ingLowPriorit ySignaling } ] )
The RNC processes t he received paging m essage and sends - depending on t he RRC st at of t he UE - a RRC
pagingType1 or pagingType2 m essage t o all cells of all NodeBs w it hin t he paging area ( in t his exam ple only one
NodeB is m onit ored) :
PCH ( VPI = g, VCI = h , CI D= i) : RRC_PCCH pa gingType 1 ( pagingCause = t erm inat ingLowPriorit ySignaling, I MSI )
PCH ( VPI = g, VCI = h , CI D= k ) : RRC_PCCH pa gingType 1 ( pagingCause = t erm inat ingLowPriorit ySignaling, I MSI )
PCH ( VPI = g, VCI = h , CI D= l) : RRC_PCCH pa gingType 1 ( pagingCause = t erm inat ingLowPriorit ySignaling, I MSI )
UMTS Signaling
The set up of RRC connect ion and dedicat ed t ransport channel is t he sam e as in case of SM MO. Only t he
est ablishm ent cause in rrcConnect ionRequest m essage is derived from t he paging cause in pagingType1 m essage
received by UE before. The UE is locat ed in cell 2 of t he m onit ored NodeB - hence it sends it s
rrcConnect ionRequest on RACH 2, which CI D value of AAL2 SVC is different from t he CI D values of RACH 1 and 3.
RACH 2 ( VPI = g, VCI = h , CI D = m ) : UL RLC TMD r r cCon n e ct ion Re qu e st ( TM SI or P- TM SI ,
est ablishm ent Cause = t e r m in a t in gLow Pr ior it ySign a lin g)
Aft er radio link and RRC connect ion are est ablished MM/ CC/ SM m essages can be exchanged em bedded in RRC
Direct Transfer m essages. This t im e a Paging Response ( PRES) inst ead of t he Connect ion Managem ent Service
Request ( CMSREQ) in case of SM MO is sent by t he m obile. The Paging Response m essage cont ains t he I MSI .
UMTS Signaling
I ub: D CH ( VPI = g / VCI = h / CI D= o) : UL RRC init ialDirect Transfer PRES ( I M SI )

PRES is forwarded t o t he MSC.
SCCP CR ( source local reference= a, RANAP I nit ial_UE_Message, NAS m essage = PRES [ I M SI ] )
When t he RNC receiv es t he SCCP Connect ion Confirm m essage from t he MSC t he SCCP connect ion is est ablished
successfully:
Bot h values, source local reference and dest inat ion local reference, can be used once again as filt er crit eria for
t he SM call flow and t o ident ify uplink and dow nlink m essages on I uCS or I uPS int erface.
Once again we also see t he opt ional Locat ion Report procedure request ed by t he MSC.
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage [ procedureCode = Loca t ion Re por t in g] )
SCCP D T1 ( dest inat ion local reference= b, RANAP init iat ingMessage [ procedure Code = Loca t ion Re por t ] )
Aut hent icat ion and Securit y Mode procedure are exact ly t he sam e as in case of SM MO:
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage [ procedureCode = Se cu r it yM ode Con t r ol ] )
I ub: D CH ( VPI = g / VCI = h / CI D= o) : RRC Se cu r it yM ode Com m a n d
I ub: D CH ( VPI = g / VCI = h / CI D= o) : RRC Se cu r it yM ode Com ple t e
SCCP D T1 ( dest inat ion local reference= b, RANAP successfulOut com e [ procedureCode =
Se cu r it yM ode Con t r ol ] )
Now t he Com m on I D is send on t he I uCS int erface in downlink direct ion:
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage [ procedureCode = Com m on I D ] )
I n difference t o t he SM MO scenario now t he short m essage cont ent is delivered in downlink direct ion, but m ore
or less w it h t he sam e m essages and sim ilar param et ers. Differences beside t he fact t hat t he SM is sent in
downlink direct ion:
Message Reference value is different and independent from t he value used for sam e param et er in SM MO
scenario.
The m essage t y pe in SMTP is SMS- DELI VER.
SMS- DELI VER cont ains t he A- Part y Originat ing User Address ( t his m eans: t he MSI SDN of t he SM sender) and t he
Serv ice Cent er Tim est am p. Bot h t oget her, Originat ing User Address and SC Tim est am p represent t he unique
ident ifier of each SM. Also if t w o SM from t he sam e originat ing user arrive at SM- SC w it h only a very short t im e
difference - t he SC t im est am p w ill always be different .
UMTS Signaling
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage D ir e ct Tr a nsfe r : CP- D a t a [ RP- D a t a _ D L
{ Originat ing SM- SC Address, MessageReference = n , SM TP SM S- D ELI VER { Originat ing User Address, Serv ice
Cent er Tim est am p, User Dat a = Te x t } ] )
The SM is forwarded t o t he MS via I ub int erface:
I ub: D CH ( VPI = g / VCI = h / CI D= o) : RRC Downlink Direct Transfer: CP- D a t a ( RP- D a t a _ D L [ Originat ing SMSC Address, MessageReference = n , SM TP SM S- D ELI VER { Originat ing User Address, Service Cent er Tim est am p,
User Dat a = Te x t } ] )
Now we w ill see CP- ACK on bot h I ub and I u int erface again as already com m ent ed in case of SM MO:
I ub: D CH ( VPI = g / VCI = h / CI D= o) : RRC UplinkDirect Transfer ( CP- ACK)
I n case of t his exam ple call t race it is v ery obv ious t hat CP- ACK and RP- ACK are com plet ely independent from
each ot her, because RP- ACK_UL on I ub is sent before CP- ACK on I uCS:
I ub: D CH ( VPI = g / VCI = h / CI D= o) : RRC UplinkDirect Transfer ( CP- D a t a [ RP- ACK
{ MessageReference= n } ] )
SCCP D T1 ( dest inat ion local reference= b, RANAP init iat ingMessage D ir e ct Tr a nsfe r : CP- ACK )
SCCP D T1 ( dest inat ion local reference= b, RANAP init iat ingMessage D ir e ct Tr a nsfe r : CP- D a t a [ RP- ACK
{ MessageReference= n } ] )
Now errorfree recept ion of t he RP- ACK m essages is also acknowledged on CP level, but in different m essage
order as in case of SM MO:
SCCP D T1 ( dest inat ion local reference= a , RANAP init iat ingMessage D ir e ct Tr a nsfe r : CP- ACK )
I ub: D CH ( VPI = g / VCI = h / CI D= o) : RRC UplinkDirect Transfer ( CP- ACK)
Now t he SM MO t ransact ion procedure is com plet e and t he SCCP/ RANAP connect ion on I uCS can be released. The
first I uRelease cont ains a release cause:
This RANAP init ial I uRelease m essage t riggers t he RRC Connect ion Release on I ub int erface ( Figure 3.155) .
UMTS Signaling
Follow ing RRC Connect ion Release t he radio resources ( Scram bling Codes, Channelisat ion codes et c.) are delet ed
by CRNC, t hen t he AAL2 SVC of t he DCH t hat carried t he DCCHs is released as well ( Figure 3.156) .
On I uCS int erface aft er successful release procedures on I ub t he successfulout com e of I uRelease is indicat ed by
SRNC:
SCCP D T1 ( dest inat ion local reference= b, RANAP successfulOut com e, I u Re le a se )
Finally t he SCCP connect ion is released:
UMTS Signaling
4 SI GN ALI N G PROCED URES I N TH E 3 G CORE N ETW ORK
4 .1 I SUP/ BI CC CALL SETUP

On E int erface bet ween different MSCs t he SS# 7 I SDN User Part ( I SUP) is used for set up and release of calls
t hrough t he circuit sw it ched core net work dom ain. The sam e funct ion has Bearer I ndependent Call Cont rol ( BI CC)
on Nc int erface bet ween different MSC Servers in a CS core net work dom ain follow ing 3GPP Rel. 4 specificat ions.
BI CC is an adapt at ion of I SUP, which m eans t hat in general m any signaling m essages in bot h prot ocols have t he
sam e nam e, but t hey are not peer- t o- peer com pat ible w it h each ot her. The m ain difference is t hat I SUP can only
assign t im e slot s of PCM- 30 or PCM- 24 syst em s w it h a fixed dat a t ransm ission rat e ( 64 or 56 kbps) for t raffic
channels, while BI CC is able t o provide and cont rol any necessary qualit y of serv ice for an end- t o- end- connect ion.
The possible services offered t o 3G subscribers w it h int roduct ion of Rel. 4 CS core net work archit ect ure range
from plain speech t o broadband real- t im e m ult im edia st ream ing.
4 .1 .1 Addr e ss Pa ra m e t e r s for I SUP/ BI CC M e ssa ge s

At least t wo prot ocols offer t ransport services for I SUP and BI CC m essages: SS# 7 Message Transfer Part ( MTP)
and MTP 3 User Adapt at ion Layer ( M3UA) . M3UA uses services of St ream Cont rol Transm ission Prot ocol ( SCTP)
and I nt ernet Prot ocol ( I P) .
The follow ing pict ure illust rat es t he addressing of MTP used for I SUP/ BI CC m essage rout ing.
Figure 4 1 - SS# 7 MTP Rout ing Label
The addresses are found in t he socalled Rout ing Label. Each SS# 7 exchange has it s own address, t he Signaling
Point Code ( SPC) . The rout ing label is eit her part of t he MTP Layer 2 Message Signal Unit ( MSU) in case t hat
physical lay er is based on a PCM- 30 or PCM- 24 syst em or it is part of MTP- 3b ( Message Transfer Part Level 3
Broadband) , which is used in case of ATM- based t ransport syst em .
The sender of a Message Signal Unit or MTP- 3b m essage is called t he Originat ing Point Code ( OPC) , t he receiver
is t he Dest inat ion Point Code ( DPC) . The Signaling Link Select ion ( SLS) param et er giv es inform at ion on which
SS# 7 signaling link t hat belongs t o a bundle of links ( Signaling Link Set ) t he m essage was sent .
The lengt h of t he SPC depends on t he geographical region: I n Europe 14- bit point codes are used, Japan uses 16
bit , Nort h Am erica and China 24 bit . For MTP- 3b t he European st andard applies.
I n case of MTP3 signaling, t he SLS lengt h is 4 bit in European net works and 8 bit in Nort h
Am erica. For MTP3- B a 14 bit SLS is used worldw ide.
UMTS Signaling
I n case of M3UA t here are no signaling point codes used for MSC addressing, but I P addresses of I P t ransport
layer t hat ident ify t he MSC servers.
4 .1 .2 I SUP Ca ll ( Su cce ssfu l)

The call flow diagram in t he exam ple shows I SUP m essages exchanged bet w een t wo MSCs t hat are
int erconnect ed using a Signaling Transfer Point ( STP) . The only t ask of t he STP is t o rout e t he SS# 7 signaling
m essages. I t does not set up or release any calls. However, due t o it s cent ral posit ion in t he net work t he STP is
an excellent connect ion point for dat abases t hat enable t he net work t o offer int elligent serv ices like num ber
port abilit y or prepaid calling card.
I n real life net w orks as a rule a pair of m at ed STPs ( som e operat ors call t his a Tandem STP) is inst alled for
redundancy reasons. This ensures a higher reliabilit y of t he net work, because it guarant ees m ore possibilit ies of
flex ible m essage re- rout ing in case of error on single SS# 7 signaling links.
Figure 4 2 - Successful Call Set up I SUP
Each I SUP call at t em pt st art s w it h an I nit ial Address Message ( I AM) cont aining t he Called Part y Num ber dialed by
t he originat ing user and Calling Part y Num ber ( MSI SDN of m obile subscriber in case of m obile originat ed call) . I n
case of a m obile t erm inat ed call t he Called Part y Num ber cont ains t he Mobile St at ion Roam ing Num ber ( MSRN) .
The Address Com plet e Message ( ACM) indicat es t hat t he SPC- B has received all dialing inform at ion t hat is
necessary t o reach t he t erm inat ing exchange for t his call. No addit ional dialing inform at ion can be sent by Apart y aft er receiving t his m essage.
Answer Message ( ANM) indicat es t hat B- part y ( called part y) is now connect ed and t he call is act ive unt il Release
( REL) m essage eit her from A- or B- part y of t he call is received. This m essage includes a cause value t hat
indicat es e.g. norm al call clearing .
The part y t hat receiv ed t he REL confirm s call release w it h a Release Com plet e ( RLC) m essage.
UMTS Signaling
4 .1 .3 I SUP Ca ll Unsu cce ssfu l
Figure 4 3 - Unsuccessful Call Set up I SUP
I n case of an unsuccessful call set up procedure t he call at t em pt is rej ect ed by SPC- B t hat send im m ediat ely an
Release ( REL) m essage including a cause value t hat indicat es t he reason why t he call cannot be com plet ed, e.g.
( B- part y) user busy .
When calls cannot com plet e t he cause value can provide useful hint s as t o t he cause of t he problem s.
Unfort unat ely t hese cause values do not alway s t ell t he whole st ory by t hem selv es. I n m any cases sev eral
different ev ent s can t rigger t he sam e cause value. To furt her com plicat e t hings different m anufact urers m ay
t rigger t he cause value but for different reasons. I t is known t hat som e SS# 7 sw it ches ex ist , which allow free
configurat ion of cause values t o be used in case of errors.
Figure 4 shows t wo I SUP call procedures bet w een t wo SS# 7 signaling point s relat ed t o t he sam e t raffic channel
t hat is m arked by t he sam e circuit ident ificat ion code ( CI C) . The first procedure is a successful call in which one
of t he B- part y is obviously an analog t elephone, because t he call is suspended ( SUS m essage) before it is
released. I n case of t he second call at t em pt t he call cannot be com plet ed for an unknown reason.
Figure 4 4 - Filt ered I SUP Call Procedures
Figure 5 shows release cause values for different calls. I t is oft en a hard discussion, which cause values can be
cat egorized as " good" or " bad" .
UMTS Signaling
Figure 4 5 - Cause Values of I SUP RELEASE Messages

Norm al call clearing, norm al - unspecified, user busy and user not responding do m ost ly indicat e a correct
behavior of t he net work. No circuit available com plains t hat t here is no t im eslot for t he t raffic channel available,
which is also a correct behav ior from t he t echnical point of v iew. I t is a quest ion of resource planning in t he
net work if a cert ain am ount is t reat ed as norm al, because it m ight be not very profit able for t he net work operat or
t o buy addit ional expensive SS# 7 exchanges j ust t o ensure t hat enough t raffic channels available during ext rem e
t raffic peaks t hat happen once or t w ice a year, for inst ance in t he early m orning hours of New Years Day.
I n a sim ilar different iat ed way no rout e t o dest inat ion m ust be discussed. This cause value m ight indicat e t he
m isrout ing of a call due t o logical error in one of t he net work s rout ing t ables or Global Tit le Translat ion
dat abases. On t he ot her hand t he sam e cause value is also ret urned if t he calling part y of t he call is black- list ed,
which m eans: t he A- part y subscriber is barred, e.g. because he or she did not paid an invoice.
Dest inat ion out of order indicat es a hardware or soft ware problem w it h one of t he SS# 7 sw it ches on t he way
from A t o B.
Finally, a t em porary failure is always a t ricky t hing. Typically it result s from an I AM m essage being sent t o t he
net work w it h no ACM or REL m essage t o answ er. The Tiam t im er t hat guides t he call at t em pt requires an answ er
t o t he sent I AM w it hin a t im e value of e.g. 10s. There is a w ide range of reasons why t he answ er m essage can be
m issed:
The I AM m essage was m isrout ed and sent t o t he wrong SS# 7 signaling point ; t hat signaling point w ill
discard t he I AM w it hout ret urning any error indicat ion
Sim ilarly t o m isrout ed I AMs t he answer m essages ( ACM or REL) can also be m isrout ed.
Glare m ay also cause t em porary failures. This happens when 2 signaling point s t ry t o grab t he sam e
t raffic channel ( = sam e CI C) at t he sam e t im e. A m et hod t o prevent such problem s is not t o allow t hat
bi- direct ional t runk groups are specified in t he rout ing t ables. A pret t y sym pt om t hat helps t o ident ify
glare is t hat t em porary failures appear if t he CI C value is eit her only odd or only even. ( as suggest ed) .
4 .1 .4 BI CC Ca ll Se t u p on E- I n t e r fa ce in clu din g I uCS Sign a lin g

The following exam ple is based on an version of BI CC using MTP t ransport serv ices for exchanging signaling
m essages over ATM link s. The bearer serv ice cont rolled by BI CC is voice ov er ATM using an AAL t ype 2 SVC on E
int erface. To giv e an overv iew of a com plet e end- t o- end scenario I uCS procedures are shown as well.
The prot ocol st acks in t he exam ple on bot h int erfaces look as follows:
UMTS Signaling
Figure 4 6 - Prot ocol St acks for Cont rol Plane and User Plane on I uCS and E I nt erface in case of BI CC Exam ple
The shown prot ocol st ack configurat ion on E int erface represent s only one of t hree possibilit ies. For voice
depending on qualit y requirem ent s a codec lik e AMR or G.711 can be used. BI CC can also run over I P or on a
PCM- 24/ 30 ( DS- 1/ E- 1) SS# 7 signaling link in case t hat I SUP is sim ply replaced by BI CC wit hout changing t he
t ransport net work.
4 .1 .4 .1 Ca ll Flow
I n t he call flow exam ple each net work node is ident ified by it s SS# 7 Signalling Point Code ( SPC) t hat is part of
t he MTP Rout ing Label.
The m essages on I uCS int erface can be filt ered using SCCP SLR/ DLR param et er. On E int erface all BI CC
m essages have t he sam e OPC = "b" or "c" and DPC = "c" or " b" in t he appropriat e MTP rout ing label plus t he
sam e BI CC CI C value if t hey belong t o t he sam e call.
First t he already discussed ex change of NAS m essages and RAB Assignm ent run on I uCS including aut hent icat ion
and securit y funct ions:
Figure 4 7 - BI CC Mobile Originat ed Call ( MOC) Call Flow 1/ 5
UMTS Signaling
Then - as show n in figure 4.9 - aft er successful RAB set up t he BI CC I AM is sent on E int erface t owards t he G- MSC.
However, it is also possible t hat BI CC sends a socalled " early I AM" using cont inuit y check procedure t o w it hhold
call com plet ion unt il est ablishm ent of t he RAB is com plet e. To check det ails in bot h cases read I TU- T Q.1901,
Annex E.4.1 Successful Call Set up.
The BI CC I AM m essage cont ains t he Call I nst ance Code ( CI C = l) t hat w ill be t he sam e for all ot her BI CC
m essage belonging t o t he sam e call. I n addit ion t he called part y num ber is included t hat m ight be slight ly
different from t he one included in DMTAP SETUP m essage, because leading escape digit s ( " 0" or " 00" ) m ay have
been delet ed while Nat ure of Address param et er is changed int o " nat ional ( significant ) num ber" or " int ernat ional
num ber" . This possible change is indicat ed by t he Cld_Pt y = g ( com pared t o SETUP Cld_Pt y = g) .I f Nat ure of
Address is " unknown" all digit s of t he called part y address signals are shown as t hey have been dialed by t he Apart y.
The included Locat ion Num ber is an E.164 address t hat delivers inform at ion t o ident ify t he geographical area ( e.g.
region, count ry , cit y, et c.) of t he origin of a call. The Applicat ion Cont ext I D addressed t he Bearer Associat ion
Transport ( BAT) applicat ion service elem ent ( ASE) of t he peer BI CC ent it y at G- MSC. The BAT ASE w ill assign t he
necessary resources for est ablishing t he backbone bearer, which is t he " t raffic channel" on E int erface.
The Originat ing Address is t he I P address ( m ost ly I P version 6) of t he MSC t hat sends t he I AM. I t is necessary t o
include t his address, because in difference t o SS# 7 based t ransport net works where it is clear for t he MSC which
( physical) line leads t o t he adj acent G- MSC in t he ATM or I P based t ransport net work all MSC/ G- MSC can be
connect ed t o t he sam e ATM- or I P- rout er and all logical signaling links can be running on t he sam e physical lines.
The Dest inat ion Address inform at ion elem ent ( in t he call flow exam ple I P address of G- MSC) can be included as
well.
UMTS Signaling
Aft er t he I AM is received G- MSC answers w it h sending a Applicat ion Transport Mechanism m essage ( APM) back
t o t he MSC. This m essage cont ains param et ers of t he backbone bearer t o be est ablished, especially a binding I D
( bind- I D) if t he bearer is represent ed by a AAL2 SVC.
Recept ion of BI CC APM t riggers ALCAP Est ablish procedures as discussed in I ub Signaling chapt er 3.1.2. Once
again t he binding I D from t he BI CC APM is found in ALCAP Est ablish Request ( ERQ) m essage as Served User
Generat ed Reference ( SUGR) value. Pat h- I D and Channel I D w ill lead t o VPI / VCI / CI D address com binat ion t hat
defines t he logical connect ion for t he backbone bearer.
The furt her m essages reflect t he behavior of A- and B- part y subscriber and have t he sam e nam e and sam e
funct ion as discussed before in I SUP call flow exam ple.
BI CC Release ( REL) t riggers t he release of bot h, t he Radio Access Bearer ( RAB) and t he backbone bearer
execut ed by RANAP ( I uCS) and ALCAP procedures ( Figures 4.10 and 4.11) .
UMTS Signaling
UMTS Signaling
4 .2 GN I N TERFACE SI GN ALI N G
The Gn int erface ident ifies t he connect ion bet ween different GPRS Support Nodes ( GSN) . They can be Serv ing
GPRS Support Nodes ( SGSN) if t hey have a connect ion t o UTRAN using I uPS int erface and/ or connect ion t o
GERAN using Gb. or Gat eway GPRS Support Nodes ( GGSN) if t hey have a connect ion t o a Packet Dat a Net w ork
( PDN - e.g. t he public int ernet ) using Gi int erface or t o ot her PLMN using Gp int erface. The Gn int erface is also
used t o connect all SGSN t o each ot her.
Figure 4 12 - GPRS Support Nodes and I nt erfaces in PS Dom ain
On bot h, Gp an Gn int erface t he GPRS Tunneling Prot ocol is used. The underlying t ransport net work for GTP
Cont rol Plane ( for GTP- C signaling m essages) and GTP User Plane ( for I P pay load) is based on I nt ernet Prot ocol
( I P) t hat eit her runs on Et hernet or ATM lines. To provide a fast t ransport serv ice bet w een peer GTP ent it ies User
Dat agram Prot ocol ( UDP) is used. TCP, which is m ore reliable t han UDP, is defined in t he st andard docum ent s as
an alt ernat iv e, but not used by net work operat ors and m anufact urers because it would decrease t he dat a
t hroughput in t he PS dom ain. To have an overview of Gn prot ocol st ack see chapt er 1.7.8.
As shown in t he next pict ure t he m ain purpose of t he Gn int erface is t o encapsulat e and t unnel I P packet s. To
t unnel dat a m eans t o rout e it t ransparent ly t hrough t he core net work. Bet w een t he GSNs a GTP- U ( GTP user
plane) t unnel is creat ed for each PDP cont ext of a GPRS subscriber. Through t his t unnel all I P packet s in uplink
and downlink direct ion are rout ed. A suit e of GPRS Tunneling Prot ocol ( GTP) signaling m essages are used t o
creat e, m odify and delet e t unnels. These GTP- C m essages are exchanged using a separat e t unnel bet ween t he
GSNs. Tunnel param et ers like t hroughput rat e et c. are direct ly derived from t he negot iat ed QoS of t he PDP
Cont ext .
Due t o t he fact t hat an I P t ransport layer carries GTP dat a packet s t hat include I P user plane dat a an I P- in- I P
encapsulat ion can be m onit ored on Gn int erface.
N ot e : Due t o I P- in- I P encapsulat ion in t he user plane 4 different I P addresses are m onit ored on Gn. The
addresses of t he lower ( t ransport ) I P layer are t hose of SGSN and GGSN and only relevant for t he Gn int erface.
The I P addresses in t he t unneled I P packet s ( t ransport ed by GTP T- PDUs) are t he I P addresses of GPRS
subscriber and I P Server and represent t he packet sw it ched end- t o- end- connect ion for exchange of payload.
These lat t er I P addresses can be m onit ored on all ot her int erfaces t hat carry PS dat a as well.
Figure 4 13 - Gn I nt erface I P Tunneling
UMTS Signaling
There are t hree part s of t he GTP:

1.
2.
3.
GTP- C - Cont rol Plane

GTP- U - User Plane
GTP - GTP for Charging
Fig. 8 shows bet ween which node of t he net work archit ect ure t hese funct ions can be found.
Figure 4 14 - Three Funct ions of GTP in Relat ion t o Net work Archit ect ure
GTP- C est ablishes m anagem ent and release of user- specific t unnels bet ween GSNs for exchange of GTP signalling
inform at ion. Secondly it is also used t o creat e, m odify and delet e user plane t unnels ( PDP cont ext s) bet w een
GSNs. The t hird t ask of GTP- C is t he support of m obilit y m anagem ent and opt ional locat ion m anagem ent .
The only t ask of GTP- U is t o t ransport I P pay load com ing from or sent t o packet dat a net works ( PDN) like t he
int ernet . I t is used on bot h, I uPS and Gn int erface. How ever, on I uPS t he t unnels are cont rolled by RANAP
signaling ( RAB m anagem ent ) .
GTP is used bet ween t he GSNs and t he Charging Gat eway Funct ion ( CGF) t o t ransm it PDP- cont ext - relat ed call
det ail records ( CDR) .
4 .2 .1 PD P Con t e x t Cr e a t ion on Gn ( GTP- C a nd GTP- U)

The following call flow shows t he act ivat ion ( GTP t erm : creat ion) of a PDP cont ext on Gn int erface including bot h,
cont rol plane and user plane.
UMTS Signaling
Figure 4 15 - PDP Cont ext Act ivat ion/ Deact ivat ion on Gn I nt erface
Since t his is an m obile originat ed PDP cont ext t he Creat e PDP Cont ext Request m essage is sent by SGSN. I t
cont ains a TEI D- C t hat ident ifies t he signalling t unnel t hat is associat ed t o t he user plane t unnel, w hich is
ident ified by a downlink t unnel endpoint ident ifier dat a ( DL- TEI D- D) and an uplink t unnel endpoint ident ifier dat a
( UL- TEI D- D) . DL- TEI D- D and UL- TEI D- D are negot iat ed bet w een peer GSNs during PDP cont ext creat ion. The
MSI SDN is used as user ident it y for charging, NSAPI indicat es t he num ber of t he PDP cont ext for t his specific
user and APN is t he server t hat assigns t he PDP address w hich is included in Creat e PDP Cont ext Response
m essage.
GTP T- PDUs ( packet dat a unit s) are used t o t ransport I P payload wit hin t he user plane t unnel.
The Release m essages for t he previous creat ed PDP cont ext cont ain t he signalling t unnel TEI D- C. The appropriat e
user plane TEI Ds have been st ored by t he GTP ent it ies in relat ion t o t he TEI D- C. Hence, t he user plane t unnel w ill
be delet ed as well.
The purpose of t he t eardown I ndicat or is t o indicat e if all PDP cont ext s t hat share t he sam e PDP address as t he
delet ed PDP cont ext shall be delet ed ( Teardown I nd. = " 1" ) or if only t he PDP cont ext w it h t he NSAPI shown in
Delet e PDP Cont ext Request shall be delet ed ( Teardown I nd. = " 0" ) .
A cause value gives inform at ion about reasons for PDP cont ext deact ivat ion as it was described in case of voice
calls before.
4 .2 .2 GTP- C Loca t ion M a n a ge m e n t

The opt ional GTP- C Locat ion Managem ent m essages are defined t o support t he case when Net work- Request ed
PDP Cont ext Act ivat ion procedures are used and a GGSN does not have a SS7 MAP int erface, i.e. Gc int erface.
GTP- C is t hen used t o t ransfer signalling m essages bet w een t he GGSN and a GTP- MAP prot ocol- convert ing GSN
in t he GPRS backbone net work. The funct ion and soft ware on t his GTP- MAP convert ing GSN is different from
t hose of ot her GSNs in t he net work.
To obt ain t he I P Address of t he MS t he GGSN m ay send a Send Rout ing I nform at ion for GPRS Request m essage
t o t he HLR. This m essage cont ains t he I MSI of t he MS.
The appropriat ed Send Rout ing I nform at ion Response cont ains a Cause inform at ion elem ent ( I E) t hat indicat es
whet her t he request was accept ed or not . I n addit ion t he m essage m ay also cont ain a MAP Cause I E, a MS Not
Reachable Reason I E a GSN Address I E and operat or specific inform at ion in t he Privat e Ext ension I E.
I f t he MS cannot be reached by t he GGSN it m ay send a Failure Report Request m essage t o t he HLR. I f t he HLR
receives t his m essage t he Mobile St at ion not Reachable for GPRS ( MNRG) flag for t his I MSI is set in t he HLR and
UMTS Signaling
a Failure Report Response m essage is sent t o t he peer ent it y. When MNRG flag is set t he MS need t o perform a
new at t ach t o t he PS dom ain.
I f an MS becom es reachable for GPRS again a Not e MS GPRS Present Request m essage is sent t o t he HLR and
t he MNRG flag shall be cleared. The HLR answers w it h a Not e MS GPRS Present Response m essage t hat indicat es
whet her t he request was accept ed or not .
4 .2 .3 GTP- C M obilit y M a n a ge m e n t
The GTP- C m obilit y m anagem ent m essages are t he signalling m essages t hat are exchanged bet ween SGSNs
during GPRS At t ach and I nt er SGSN Rout ing Area Updat e procedures. Generally, t he purpose of t his kind of
signalling is t o t ransfer dat a associat ed w it h t he MS from t he old SGSN t o t he new SGSN.
N ot e : The new SGSN deriv es t he address of t he old SGSN from t he old rout ing area ident it y!
I f t he MS, at GPRS At t ach, ident ifies it self w it h P- TMSI and it has changed SGSN since det ach, t he new SGSN
shall send an I dent ificat ion Request m essage t o t he old SGSN t o request t he I MSI . This I dent ificat ion Request
( inst ead of I DQ) m essage is answered w it h an I dent ificat ion Response. I f t he Cause value in t his I dent ificat ion
Response is request accept ed t he I MSI w ill be included in t he m essage, ot herw ise not .
An int erest ing signaling exam ple is t he call flow of a I nt er SGSN Rout ing Area Updat e ( RAU) . During an act ive
PDP cont ext t he MS changes it s locat ion and is now served by a new SGSN. However, t his new SGSN has st ill no
idea about t he special requirem ent s of t he ongoing PDP cont ex t . So it sends a SGSN Cont ext Request m essage t o
get all im port ant param et ers about act ive radio access bearers, m obilit y m anagem ent inform at ion ( e.g. ent ries
from SGSN regist er funct ion) and PDP cont ext s ( e.g. PDP address of act iv e connect ion) from t he old SGSN as
shown in nex t figure.
The SGSN Cont ext Request m essage cont ains t he follow ing m andat ory I Es:
Old( ! ) Rout ing Area I dent it y ( RAI )

TEI D- C for ident ificat ion of t he exist ing signalling t unnel relat ed t o t he user dat a
old SGSN Addr. { I Pv4} for Cont rol Plane t o est ablish a signaling connect ion bet ween old and new SGSN
P- TMSI as user ident it y
An opt ional MS Validat ed inform at ion elem ent indicat es t hat t he new SGSN has successfully aut hent icat ed t he MS.
The I MSI shall be included if MS Validat ed indicat es Yes. Anot her opt ional I E is t he P- TMSI signat ure, which is
also used for securit y reasons.
UMTS Signaling
Figure 4 16 - GPRS Rout ing Area Updat e wit h Forwarded PDP Cont ext
Wit h t he appropriat e SGSN Cont ext Response m essage t he new SGSN receiv es t he RAB Cont ext ( im port ant I uPS
param et ers) , MM cont ext ( im port ant param et ers regarding locat ion and subscribed serv ices of t he user) and PDP
cont ext ( inform at ion regarding t he current connect ion, especially t he PDP Address of t he user) if t he cause value
is Request Accept ed . For unique ident ificat ion t he I MSI of t he MS is included in t he m essage as well.
I f t he rout ing area updat e procedure was successful t he new SGSN com plet es t he procedure w it h a SGSN
Cont ext Acknow ledge m essage. This m essage cont ains a t unnel endpoint ident ifier I I for dat a ( TEI D- D I I ) , which
is used t o est ablish a t em porary unidirct ional t unnel bet ween old and new SGSN t o forward I P packet s t hat have
been queued w hile t he RAU procedure w as ex ecut ed. Toget her w it h t he TEI D- D I I t he SGSN dat a address of t he
new SGSN ( I P address, m ost likely I P version 4) is included in t he m essage.
Aft er t he SGSN Cont ext Acknow ledge is received t he old SGSN st art s t o forward user dat a packet s ( T- PDUs) t o
t he new SGSN. The T- PDUs are ident ified by t he prev ious negot iat ed TEI D- D I I .
4 .2 .4 SGSN Re loca t ion

Wit h int roduct ion of UTRAN t he m obilit y m anagem ent funct ions of t he GTP prot ocol known from Release 98 have
been enhanced w it h an addit ional one: t he SGSN Relocat ion.
SGSN relocat ion becom es necessary if t here is a SRNS relocat ion in UTRAN and t he new SRNC ( form er DRNC) is
connect ed t o a different SGSN. I n t his case not only t he SRNC is changed, but also t he SGSN as shown in t he
figure below:
Figure 4 17 - SGSN Relocat ion Overview
The m essages for t his operat ion on Gn int erface are easy t o underst and and self- explaining:
Forward Relocat ion Request

Forward Relocat ion Response
Forward Relocat ion Com plet e
On I ur int erface t he relocat ion procedure is execut ed as described in chapt ers 3.20 and 3.21 of t his book.
UMTS Signaling
4 .2 .5 Ex a m ple GTP
Figure 4 18 - GTP m essage flow and event s t hat t rigger CDR creat ion
Charging inform at ion in t he GPRS net work is collect ed for each UE by t he SGSNs and GGSNs, w hich are serv ing
t hat MS. The inform at ion t hat t he operat or uses t o generat e an invoice t o t he subscriber is operat or- specific.
The Charging Gat eway Funct ion ( CGF) provides t he m echanism t o t ransfer charging inform at ion from t he SGSN
and GGSN nodes t o t he net work operat or's chosen Billing Syst em ( s) ( BSs) . The m ain funct ions of t he CGF are:
Collect ion of GPRS CDRs from t he GPRS nodes generat ing CDRs
I nt erm ediat e CDR st orage buffering
Transfer of t he CDR dat a t o t he billing syst em s
The SGSN collect s charging inform at ion for each UE relat ed t o t he radio net w ork usage, w hile t he GGSN collect s
charging inform at ion for each UE relat ed w it h t he ext ernal dat a net work usage. Bot h GSNs also collect charging
inform at ion on usage of t he GPRS net work resources.
A Se r vin g GPRS Su ppor t N ode - Ca ll D e t a il Re cor d ( S- CD R) is used t o collect charging inform at ion relat ed
t o t he PDP cont ext dat a inform at ion for a GPRS m obile in t he SGSN.
A M obilit y M a n a ge m e n t - Ca ll D e t a il Re cor d ( M - CD R) is used t o collect charging inform at ion relat ed t o t he
m obilit y m anagem ent of a GPRS m obile in t he SGSN.
A Ga t e w a y GPRS Su ppor t N ode - Ca ll D e t a il Re cor d ( G- CD R) is used t o collect charging inform at ion relat ed
t o t he packet dat a inform at ion for a GPRS m obile in t he GGSN.
SMS t ransm ission ( MO or MT) can be prov ided over GPRS v ia t he SGSN. The SGSN should provide an SGSN
de live r e d Sh or t m e ssa ge M obile Or igin a t e d - Ca ll D e t a il Re cor d ( S- SM O- CD R) when short m essage is
m obile originat ed and an SGSN de live r e d Sh or t m e ssa ge M obile Te r m in a t e d - Ca ll D e t a il Re cor d ( S- SM TCD R) when it is m obile t erm inat ed. I n addit ion, also SMS- I WMSC ( MO- SMS) and SMS- GMSC ( MT- SMS) m ay
provide SMS- relat ed CDRs. No act ive PDP cont ext is required when sending or receiv ing short m essages. I f t he
subscriber has an act ive PDP cont ext , volum e count ers of S- CDR are not updat ed due t o short m essage delivery.
The CDRs w ill be t ransm it t ed t o t he CGF by using t he GTP prot ocol. The Dat a Record Transfer Request m essage
w ill t ransport t he CDR and w ill be acknow ledged by CGF.
When a PDP Cont ext is creat ed, it is necessary t o define a Cha r ging I D ( C- I D ) . This is because t wo inst ances
w ill now deliver charging inform at ion for one UE, and CGF w ill need t o com bine t he CDRs from t he different GSNs.
UMTS Signaling
4 .3 PROCED URES ON GS I N TERFACE

The opt ional Gs int erface is used t o exchange dat a bet w een VLR and SGSN regist er funct ion. Using t he Gs
int erface signaling it is for inst ance possible t o page a subscriber for a voice call v ia PS dom ain or t o page a
m obile t erm inat ed PDP cont ext via CS dom ain. Also com bined at t ach procedures and locat ion/ rout ing area
updat es are possible.
The prot ocol st ack on Gs is t he sam e as on GSM A int erface, but a set of enhanced BSSAP+ procedures is used.
All BSSAP+ m essages are t ransport ed on behalf of SCCP Unit dat a ( UDT) m essages using connect ionless SCCP
t ransport serv ices.
4 .3 .1 Loca t ion Upda t e via Gs

Wit h t his procedure t he SGSN inform s t he VLR about a CS locat ion area updat e t hat was com bined w it h RAU
procedure. I MSI is used in bot h m essages t o ident ify t he subscriber uniquely. The SCCP subsyst em num ber for
t his service is oft en defined by net work operat ors, but in som e cases SSN = 192 was seen as value in real
net work t races. So it is used in t his exam ple.
Figure 4 19 - Gs I nt erface: I MSI At t ach/ Locat ion Updat e Procedure Call Flow
4 .3 .2 D e t a ch I n dica t ion via Gs

Bot h, I MSI and GPRS det ach can be indicat ed using Gs signaling. I n t he exam ple call t race a GPRS det ach
procedure is shown. An addit ional ident ifier indicat es t hat t his det ach is for GPRS serv ices only and it is request ed
by t he net work.
UMTS Signaling
Figure 4 20 - Gs I nt erface: I MSI / GPRS Det ach Procedure Call Flow
4 .3 .3 Pa gin g via Gs
The last exam ple for Gs signaling shows a paging request m essage sent from VLR t o SGSN. So t his is a CS
paging sent v ia PS dom ain.
Figure 4 21 - Gs I nt erface: CS Paging Request Call Flow
The appropriat e paging response t o t his request is expect ed t o arrive em bedded in a RANAP m essage v ia I uCS.
UMTS Signaling
4 .4 SI GN ALI N G ON I N TERFACES TOW ARD S H LR

The Hom e Locat ion Regist ers ( HLR) is a m ain dat abase of t he public land m obile net work ( PLMN) t hat st ores
subscriber dat a. Here w e find inform at ion about user ident it y ( I MSI , current ly used TMSI / P- TMSI ) , locat ion of t he
subscriber ( present locat ion area, rout ing area et c.) , user right s and inform at ion about subscribed serv ices ( e.g.
t he subscribed Qualit y of Serv ice [ QoS] profile for PDP cont ext act ivat ion. The HLR also knows if t he user is
at t ached t o t he net work or t o defined serv ices of t he net work or not .
The HLR is especially im port ant in case of m obile t erm inat ed voice or dat a calls. The Gat eway MSC or GGSN
ret rieves t he necessary inform at ion for rout ing of m obile t erm inat ed calls from t he HLR. I f t he user is not
reachable t he HLR m ay have furt her inform at ion for alt ernat ive rout ing t arget s. For inst ance a voice call can be
rout ed t o a voice m ail syst em or a special announcem ent is played t hat inform s t he calling part y t hat t he
subscriber is t em porary not available. I n t his case int eract ion w it h ot her int elligent net work ( I N) or Nort h
Am erican advanced int elligent net work ( AI N) com ponent s is necessary as described in chapt er 4.7.
As a rule a HLR is co- locat ed w it h a GMSC, but not every GMSC has a co- locat ed HLR. I t depends on t he num ber
of subscribers if t here is m ore t han one HLR in t he net work . I n case of a socalled " greenfielder" t he HLR could be
t he only dat abase in t he net work. Greenfielders are service providers t hat build up a m inim al own net work
st ruct ure only, e.g. one HLR plus one GMSC and/ or one GGSN while t hey rent usage of net work resources ( lik e
whole RAN including MSC/ VLR and SGSN) from a full serv ice net work operat or. I t is im port ant t o know t hat one
general concept of 3G st andards is t o provide t ot al flexibilit y regarding ownership of net work part s or single
net work com ponent s.
Figure 10 show s som e MAP int erfaces in t he core net work t hat are m andat ory t o offer basic circuit and packet
sw it ched serv ices.
Figure 4 22 - Mobile Applicat ion Part ( MAP) I nt erfaces in Core Net work Environm ent
I n t oday's net works t he Aut hent icat ion Cent er ( AUC) is oft en int egrat ed in t he HLR device so t hat t he H int erface
runs on a device int ernal bus syst em . Most PLMN do also not have an Equipm ent I dent it y Regist er, but a num ber
of com panies or governm ent inst it ut ions t hat operat e m obile net works ( like GSM- R net works of railway
com panies) use EI R t o ensure t hat only regist ered phones can be used in t heir net works. Nevert heless 3GPP
Release 5 defines a dat abase t hat com bines EI R, HLR and AUC funct ions. This dat abase is t he socalled Hom e
Subscriber Server ( HSS) .
On D int erface bet ween VLR and HLR it can be m onit ored how t he locat ion updat e procedure is cont inued in t he
core net work aft er t he MS send Locat ion Updat e Request t o t he MSC/ VLR.
On C int erface bet ween GMSC and HLR it is observed how t he GMSC ret riev es rout ing inform at ion for m obile
t erm inat ed procedures.
The count erpart of t he D int erface in t he PS dom ain is t he Gr int erface bet ween SGSN and HLR and t he Gc
int erface ensures t he connect ions bet w een GGSN and HLR.
As it was described in chapt er 3.22.1 of t his book Mobile Applicat ion Part ( MAP) is also used for com m unicat ion
bet ween GMSC and ext ernal short m essage service cent er ( SMSC) , but t his int erface is out side t he scope of 3GPP
int ernat ional st andards.
UMTS Signaling
4 .4 .1 Addr e ssin g on M AP I n t e r fa ce s
A t ypical exam ple shall be given how signaling inform at ion using MAP is exchanged via Gr int erface. I n t he
com m unicat ion w it h t he HLR t he CS locat ion updat e and GPRS at t ach procedures are t he m ost com plex ones,
because a lot of inform at ion elem ent s are included and different kinds of addressing are used.
Figure 4.23 shows t he prot ocol st ack used on t he MAP int erface bet w een SGSN and HLR ( Gr int erface) . The
prot ocol layers are t he sam e as for all core net work int erfaces using m obile applicat ion part , but SCCP subservice num bers ( SSN) are different .
The SCCP SSN indicat es t he user of a SCCP connect ion. I n case of current MAP signalling only SCCP classes for
connect ionless dat a t ransfer are used.
The subsyst em num ber represent s eit her a higher layer prot ocol ( as it was shown for SSN= 192 t hat indicat es
BSSAP+ prot ocol on Gs int erface) or it also m ay st and for a net work elem ent like SGSN ( SSN= 149) , HLR
( SSN= 6) , VLR ( SSN= 7) et c. Table 1- 7 in chapt er 1.18 gives an overview about different subsy st em num bers as
defined e.g. in 3GPP 23.003.
I n addit ion t o t he SSN t he net w ork nodes have ot her addresses as well. As a rule each node in t he CS core
net work dom ain has it s own E.164 address, an address form at t hat is w ell known from int ernat ional t elephone
num bers. To be worldw ide t ruly unique it consist s of a count ry code, a nat ional dest inat ion code ( also known as
area code) and a subscriber num ber.
To give an exam ple:
Count r y Code ( CC) = 54
Argent ina
N a t ion a l D e st ina t ion Code ( N D C) = 11

Su bscr ibe r N u m be r = 43xxxxxx
Cap. Fed. Buenos Aires
Silv ina A.
A var ious num ber of escape digit s ( e.g. 0054) m ay have t o be dialled before t he count ry code t o reach a Bpart y in a foreign count ry. The charact er " + " replaces t he escape digit s and indicat es t hat dialled num ber is an
int ernat ional I SDN num ber. ( On prot ocol lev el in I SUP t his w ill be reflect ed by t he Num bering Plan inform at ion
elem ent of t he called part y num ber t hat w ill show " int ernat ional num ber" w hen t he " + " was dialled) .
However, in case of net work elem ent addressing t he address part called " subscriber num ber" does not ident ify a
t elephone, but a sw it ch or dat abase in t he net work. So t he E.164 num ber + 54- 11- 43001000 could be t he cent ral
office sw it ch t o which Silv ina's phone is connect ed t o ( but indeed, w e do not know t he det ailed num bering plan of
Telefnica de Argent ina) .
Figure 4 23 - Prot ocol St ack on Gr I nt erface
I n addit ion t o t heir E.164 num ber, which is necessary for SCCP addressing purposes t he packet sw it ches SGSN
and GGSN do also have I P addresses t hat are used by GTP ent it y on Gn int erface. By t he way t hey are also
ident ified by SS# 7 Signaling Point Codes ( SPCs) on t he MTP level ( Gc, Gr and I uPS int erface) .
4 .4 .2 M AP Ar ch it e ct u r e
Mobile Applicat ion Part ( MAP) uses t he funct ions provided by Transact ion Capabilit ies Applicat ion Part ( TCAP) .
Transact ion Capabilit ies are necessary t o exchange inform at ion t hat is not direct ly relat ed t o calls bet ween
net work nodes like exchanges and dat abases.
UMTS Signaling
To explain it in a popular way: it was necessary t o define a way how dat a records in e.g. VLR and HLR can be
cont inuously updat ed. One solut ion would have been t o inst all a separat e dat a net work bet w een t hese dat abases.
The ot her one would have been t o connect t he dat abases t o t he exist ing SS# 7 signaling net work and enable t he
SS# 7 net work t o perform t he necessary t ransact ions. This second and m ore efficient solut ion was t he reason why
TCAP was defined by CCI TT/ I TU- T.
The next pict ure explains how MAP and TCAP are relat ed t o each ot her.
Figure 4 24 - MAP Archit ect ure
A single MAP User Applicat ion Serv ice Elem ent ( ASE) represent s a com plet e MAP funct ion lik e Locat ion Updat e or
GRPS At t ach funct ion w it h all necessary operat ions, param et ers, result s and errors. Hence, for inst ance a VLR
com m unicat ion soft ware ent it y ( not t he dat abase it self! ) consist s of several ASE s t o offer t he necessary m obilit y
m anagem ent funct ionalit y. These operat ions, param et ers et c. are sent t o a peer ent it y or received from a peer
ent it y .
All MAP Operat ions are em bedded in TCAP m essages. The TACP ASE consist s of t wo sublayers, t he com ponent
sublayer and t he t ransact ion sublayer. A com ponent is a request t o execut e an operat ion or t he answer t o such a
request . I n TCAP language t he request s are called I NVOKE w hile t he answ ers are called RETURN. I n case of
successful I NVOKE a RETURN RESULT is sent by peer ent it y. Ot herw ise t he ent it y t hat sent t he I NVOKE w ill
receive RETURN ERROR. The peer ent it y is also able t o REJECT an invoked operat ion.
TCAP t ransact ion sublayer provides all necessary funct ions t o exchange com ponent s bet ween t wo different TCAP
users. Especially t he five generic TCAP m essage form at s are built by t ransact ion sublay er using ASN.1 Basic
Encoding Rules ( BER) . These m essages are nam ed BEGI N, CONTI NUE, END and ABORT for a st ruct ured dialog
( connect ion- orient ed) . For unst ruct ured dialog ( connect ionless) t he UNI DI RECTI ONAL TCAP m essage is used.
All MAP operat ions and result s are exchanged using st ruct ured TCAP dialogs only.
A very int erest ing inform at ion elem ent ( I E) is t he TCAP Applicat ion Cont ex t ( AC) . The applicat ion cont ex t reflect s
t he present soft ware evolut ion st age of t he MAP or any ot her user part on t op of TCAP. I f for inst ance a look at
t he HLR is t aken it em erges t hat t he st ruct ure of such a dat abase changes dram at ically if a new lev el of net work
evolut ion is int roduced. The m ost exit ing evolut ion st ep for HLR in t he past was t he st art of GPRS. There is a
large num ber of specific HLR ent ries like flags, subscribed QoS param et er for PDP cont ex t s, Rout ing Area
I nform at ion et c. t hat was not known in plain GSM net works. To " learn" about GPRS for t he HLR was like t o learn
a new language, and t he kind - or bet t er: version - of t his " language" is reflect ed by t he applicat ion cont ex t value.
I ndeed, not only t he dat abases have grown w it h int roduct ion of new services, but also t he MAP prot ocol it self is
grow ing from version t o v ersion by adding new operat ion codes and new param et ers.
The purpose of t he applicat ion cont ext is t o prevent com m unicat ion problem s if e.g. one HLR t hat already knows
GPRS- specific inform at ion elem ent s " t alks" w it h anot her HLR t hat st ill knows only GSM- relat ed dat a.
I n t he exam ple call flow in figure 12 it is an ext ernal Short Messages Serv ice Cent er ( SC) t hat want s t o ret riev e
rout ing inform at ion for a m obile t erm inat ed short m essage ( SM) from a HLR in t he t arget PLMN.
UMTS Signaling
Figure 4 25 - TCAP Applicat ion Cont ext Call Flow Exam ple
TCAP applicat ion cont ext negot iat ion rules require t hat t he proposed AC, if accept able, is reflect ed in t he first
backwards m essage. I f t he AC is not accept able, and t he TCAP user does not w ish t o cont inue t he dialogue, it
m ay provide an alt ernat e applicat ion cont ex t t o t he init iat or which can be used t o st art a new dialog.
The exam ple in t he pict ure shows t he case when first Send Rout ing I nfo for Short Message, which is a local MAP
operat ion, is sent em bedded in a TCAP BEGI N m essage using an applicat ion cont ext w it h version 3. Since t he
HLR does not support version 3 it rej ect s t he TCAP dialog w it h sending ABORT including an dialog serv ice user
error value Applicat ion cont ex t nam e not support ed and t he alt ernat e applicat ion cont ex t value = 2. Now t he
sending TCAP ent it y knows t hat t he receiv er only support s applicat ion cont ext version 2 and sends a new TCAP
BEGI N m essage including t he sam e local operat ion as before, but t his t im e w it h AC version 2, t hat m eans: t he
local operat ion is st ill t he sam e, but num ber and st ruct ure of included param et ers w ill be changed according t o
applicat ion cont ext version 2 st andards. The furt her TCAP dialog will be cont inued successfully w it h TCAP
CONTI NUE and/ or END m essage( s) .
The lesson a net work t roubleshoot er can learn from t his exam ple is t hat not every TCAP ABORT m essages
indicat es an error in t he net work.
4 .4 .3 M AP Sign a lin g Ex a m ple

An Updat e GPRS Locat ion procedure is shown as exam ple of MAP signaling. This call flow can be m onit ored on Gr
int erface. The procedure uses connect ionless SCCP dat a t ransfer w it h end- t o- end signaling.
UMTS Signaling
Figure 4 26 - MAP Updat e GPRS Locat ion/ I nsert Subscriber Dat a Call Flow
The first int erest ing fact in t his exam ple call flow is t hat t he HLR address in t he first m essage is derived from t he
I MSI . This is t he socalled Mobile Global Tit le ( Mobile_GT) follow ing I TU- T E.214 specificat ion. The Mobile GT
includes all I MSI digit s or at least t he MSI N digit s if MCC and MNC have been already t ranslat ed by SGSN Global
Tit le Translat ion Table int o count ry code + nat ional dest inat ion code.
Exam ple Global Tit le Translat ion Table:
As rule a foreign PLMN shall not t ranslat e m ore t han t he m obile count ry code ( MCC) int o a Count ry Code ( CC)
and - if necessary - t he m obile net work code ( MNC) int o a nat ion dest inat ion code ( NDC) . Then t he m essage is
rout ed based on t his m obile GT t o a gat eway of t he net work indicat ed by NDC. This gat eway ( m ost likely a GMSC)
is finally able t o t ranslat e t he first t wo digit s of t he MSI N, which is st ill an unchanged part of t he m obile GT w it h
it s hybrid E.214 address form at , int o t he SS# 7 signaling point code or t he E.164 num ber of t he HLR.
The Subsyst em Num bers ( SSN) indicat es t hat t he first SCCP UDT of t he exam ple call flow is sent by SGSN
( SSN= 149) and shall be received by HLR ( SSN= 6) .
The first SCCP UDT t ransport s a TCAP BEGI N m essage w it h Originat ing Transact ion I D ( OTI D) = a . There is an
Updat e GRPS Locat ion operat ion invoked ( using invoke- I D = c) by t he SGSN t hat is ident ified by bot h, it s E.164
and it s I P- Address. The I MSI t hat ident ifies t he subscriber who want s t o be at t ached t o t he PS dom ain is also
included. Such a Updat e GPRS Locat ion procedure is perform ed if SGSN received a GPRS At t ach or Rout ing Area
Updat e Request m essage on I uPS.
HLR answers w it h a TCAP CONTI NUE m essage cont aining Originat ing Transact ion I D ( OTI D) = b and Dest inat ion
Transact ion I D ( DTI D) = a . These t ransact ion I D values are t he sam e for in all m essages belonging t o t his
procedures. They can be used as filt er condit ions when m onit oring MAP int erfaces, because t hey link MAP
m essages belonging t o a single subscriber t oget her.
Before t he HLR can proceed t he GPRS Locat ion Updat e procedure it invokes t o I nsert Subscriber Dat a at t he
locat ion regist er funct ion of t he SGSN. To t his subscriber dat a belongs I MSI and MSI SDN of t he subscriber as well
as subscriber st at us and GPRS subscript ion dat a including t he QoS param et ers as described in t he cont ract
bet ween net work operat or and subscriber. There is a new I nvoke I D = d relat ed t o t his new operat ion code.
Aft er subscriber dat a was insert ed successfully SGSN answers w it h anot her TCAP CONTI NUE m essage t hat
cont ains a Ret urn Result Last sequence including t he I nvoke- I D = d t hat is relat ed t o t he I nsert Subscriber Dat a
operat ion.
UMTS Signaling
Now in t he last m essages, which is TCAP END, t he HLR approves t hat Updat e GPRS Locat ion was successful.
Once again a Ret urn Result Last sequence includes Operat ion Code and appropriat e I nvoke I D plus t he E.164 HLR
address t hat w ill be used for SCCP addressing in furt her MAP t ransact ions bet w een SGSN and HLR.
UMTS Signaling
4 .5 I N TER- 3 G_ M SC H AN D OVER PROCED URE

Mobile Applicat ion Part ( MAP) is not only used for com m unicat ion bet ween dat abases. There is also a num ber of
MAP operat ions for inform at ion exchange bet ween MSCs and last but not least MAP offers t ransport funct ions for
different layer 3 radio access net work prot ocols. For inst ance MAP can carry RANAP m essages t hat are exchanged
bet ween RNCs connect ed t o different MSCs. Since RANAP for it s part offers t ransport funct ions for RRC prot ocol
inform at ion it is also possible t hat on E int erface bet ween t wo 3G MSCs RRC I nform at ion t hat is carried by RANAP
m essages, which are em bedded in MAP operat ions can be m onit ored. Hence, t he prot ocol st acks used by prot ocol
m onit ors need t o look very different from what is described in t he int ernat ional st andards. I n t his and in t he
follow ing t wo chapt ers t he " real world" prot ocol st acks as necessary for com plet e decoding of capt ured signalling
m essages and t he com plet e m essages including t heir piggybacked part s w ill be described.
First it shall be explained why MAP carries RANAP and RRC inform at ion. For t his reason it is necessary t o ext end
t he v iew at t he UTRAN as given in chapt er 1.5
Usually net work overv iew pict ures show only one MSC/ SGSN t o which t he RNCs are connect ed t o. This exact ly
reflect s t he UTRAN definit ion: a UTRAN is a radio access net work connect ed t o one MSC of t he CS dom ain and
one SGSN of t he PS dom ain ( if CS and/ or PS dom ain are available in t he net w ork) . Thus, a 3G net work consist s
of m ore t han j ust one UTRAN and as a rule also of m ore t han j ust one MSC, SGSN et c.
RNCs of t he sam e UTRAN m ay be int erconnect ed v ia I ur int erface, but t here is no I ur bet ween RNCs of different
UTRANs. Figure 14 shows how t wo different UTRANS are linked via E int erface of t he CS dom ain and Gn int erface
of t he PS dom ain. I f t here is a UE in a handover sit uat ion bet ween cells belonging t o different UTRANs t he CRNCs
of t hese cells need t o com m unicat e w it h each ot her t o ensure a errorfree Hard Handover. Soft Handovers are
im possible in such a sit uat ion, also if t he cells have t he sam e frequency.
Figure 4 27 - UMTS I nt erfaces bet ween t wo UTRANs
As one m ay rem em ber from chapt er 3 of t his book all com m unicat ion bet ween UE and net work st art s w it h set up
of a RRC connect ion. The RNC t hat cont rols t his RRC connect ion and t erm inat es t he I u int erfaces of t he
connect ion is called t he serving RNC ( SRNC) . I n figure 15 t his init ial SRNC is RNC 1.
UMTS Signaling
Figure 4 28 - I nit ial RRC Connect ion Set up bet ween UE and SRNC ( RNC 1)
I f t he UE m oves it w ill get in cont act w it h a cell of Node B2 t hat is cont rolled by RNC 2. RNC 1 and RNC 2 belong
t o t he sam e UTRAN and are int erconnect ed via I ur int erface. I f t he t wo cells w ork on t he sam e frequency a soft
handover is possible w it h RNC 1 as SRNC and RNC 2 as drift RNC ( DRNC) . The RRC connect ion is st ill act iv e
bet ween UE and RNC 1, RNC 2 rout es all RRC m essages t ransparent ly in uplink and downlink direct ion.
Figure 4 29 - UE in Soft Handover Sit uat ion, RRC Connect ion Cont rolled by RNC 1
I f t he UE loses cont act w it h all cells direct ly cont rolled by RNC 1 and RNC 2 is t he only one t hat provides radio
resources for t he connect ion RNC 1 w ill m ake t he decision t o perform an SRNS relocat ion procedure as described
in part 2 of t his book. At t he end of t his SRNS relocat ion RNC 2 will be t he new SRNC.
However, t he UE m ay cont inue t o m ove while a call is st ill act iv e. A com plet ely new and m uch m ore difficult
sit uat ion is given in case t hat a cell of Node B3 becom es bet t er t han cells of Node B2 as shown in figure 17. This
event m ay t rigger t he decision t o perform a hard handover bet ween RNC 2 and RNC 3.
UMTS Signaling
Figure 4 30 - Hard Handover t o Cell of Node B3 Perform ed by RNC 2
Now in case of a hard handover t he param et ers of t he RRC connect ion hav e t o be forwarded t o t he new serv ing
RNC ( RNC 3) and t he only connect ion bet ween RNC 2 and RNC 3 goes t hrough E int erface of CS core net work
dom ain.
As a result a prot ocol t est er m ust be equipped w it h t he prot ocol st ack shown in Figure 4.31 t o be able t o decode
all higher lay er prot ocol inform at ion on E int erface.
Figure 4 31 - RANAP- over- MAP Prot ocol St ack on E I nt erface for I nt er- 3G_MSC Handover
UMTS Signaling
4 .5 .1 I n t e r - 3 G_ M SC H a n dove r Ove r vie w
Figure 4 32 - I nt er- 3G_MSC Handover/ Relocat ion Overview
St e p 1 :
The I nt er- 3G_MSC Handover is t riggered by a RRC Measurem ent Report t hat report s event - I D = e1a., because
t he new cell operat es at t he sam e frequency as t he old one.
St e p 2 :
Follow ing t he recept ion of t he RRC Measurem ent Report m essage t he serving RNC ( RNC 1) decides t o perform a
handover t o RNC 2. Since t here is no I ur int erface bet w een t hese t wo RNCs t he handover m ust be a hard
handover plus SRNS relocat ion at t he sam e t im e. I t is com plet ely cont rolled by old SRNC, which sends a RANAP
Relocat ion Required m essage t o it s serv ing MSC.
St e p 3 :
Based on a general rout ing t able t he serv ing MSC det ect s t hat RNC 2 is connect ed t o a different MSC as shown in
Figure 4.32. Hence, it is necessary t o send t he RANAP Relocat ion Request m essage t hrough t he ot her MSC t o
RNC 2. Because t he t raffic channel of t he call also needs t o be forwarded t o t he new MSC t he serving MSC sends
a MAP Prepare Handover invocat ion t o it s peer MSC; t he MAP m essage cont ains t he RANAP m essages sent t o
RNC 2.
St e p 4 :
The new MSC forwards t he RANAP Relocat ion Request m essage t o RNC 2.
St e p 5 :
RNC 2 allocat es all necessary radio resources t o t ake over t he UE connect ion. Especially adm ission cont rol and
packet scheduler funct ion are checking if t he connect ion w it h it s present QoS can be cont inued and if t he sam e
t ransport com binat ion form at set can be used as calculat ed by RNC 1. I t depends on t he result of t his calculat ion
which RRC m essage w ill be const ruct ed and sent by RNC 2 t o perform t he handover. I f QoS needs t o be changed
a Radio Bearer Reconfigurat ion m essage w ill be sent . I f changes in t he t ransport form at set are required a
Transport Channel Reconfigurat ion m essage is sent . I f only t ypical ident ifiers like Spreading Code, Scram bling
Code or u- RNTI are changed Physical Channel Reconfigurat ion w ill be sent . I n t his exam ple Physical Channel
Reconfigurat ion is assum ed.
St e p 6 :
RNC 2 sends a RANAP Relocat ion Acknow ledge m essage t o RNC 2 t hat piggybacks t he RRC Physical Channel
Reconfigurat ion m essage.
St e p 7 :
The answ er t o t he MAP Prepare Handover m essage is sent by new MSC t o old serving MSC. This m essages
cont ains bot h, t he RANAP Relocat ion Acknow ledge including t he em bedded RRC Physical Channel Reconfigurat ion.
St e p 8 :
Old MSC sends RANAP Relocat ion Com m and t o RNC 1. Once again t he RRC Physical Channel Reconfigurat ion
const ruct ed by RNC 2 is em bedded in t his m essage. The Relocat ion Com m and m essage orders t he RNC 1 t o giv e
up it s rule as SRNC of t he connect ion.
St e p 9 :
The Physical Channel Reconfigurat ion m essage is forwared by RNC 2 via old I ub and Uu ( radio) int erface t o t he
UMTS Signaling
UE. On behalf of t his m essage t he UE is inform ed int o which new cell t he handover shall be perform ed and w hich
param et ers lik e new u- RNTI becom e valid aft er handover.
St e p 1 0 :
Based on t he inform at ion found in RRC Physical Channel Reconfigurat ion Request m essage, t he handover is
perform ed and RRC Physical Channel Reconfigurat ion Com plet e m essage is sent on new I ub int erface t o RNC 2.
4 .5 .2 I n t e r - 3 G_ M SC H a n dove r Ca ll Flow
The handover call flow exam ples only show m essages on E int erface. I n difference t o ot her call flow exam ples t he
m ain param et ers are present ed in a real num ber form at t o allow a bet t er underst anding of t he procedures.
Figure 4 33 - I nt er- 3G_MSC Handover/ Relocat ion Call Flow 1/ 6
Wit h t his m essage t he left MSC orders t he right one t o prepare a handover w it h invoke I D = 1. Already t he MAP
m essage cont ains inform at ion, which RNC is t he t arget RNC for t his handover procedure. The unique t arget RNC
I D consist of Mobile Count ry Code ( MCC) , Mobile Net work Code ( MNC) - bot h param et ers known from E.212
num bering plan used for I MSI - plus a RNC- I D t he is unique w it hin t he operat or's net work .
I nside t he MAP m essage t here is a cont ainer, t he socalled an- APDU. " AN" st and for access net work and inside
t he an- APDU t here is som e m ore inform at ion about t he access net work prot ocol: 25.413 is t he 3GPP specificat ion
for RANAP. I MSI is em bedded as user ident it y and t he radio resource = " speech" indicat es t hat t his is a voice call.
Now t he com plet e RANAP I nit ial Message w it h Procedure Code = " Relocat ion Resource Allocat ion" follows. The
m essage is forwarded t ransparent ly by t he MSC. Once again I MSI can be found inside t his m essage and a cause
value t ells t hat t his procedure is part of a relocat ion due t o changing condit ions on air int erface.
Next em bedded it em in t he RANAP m essage is t he SourceRNC- t o- Target RNC- Transparent - Cont ainer including an
RRC cont ainer w it h all necessary inform at ion about t he exit ing RRC Connect ion bet ween t he source RNC and t he
UE. There w ill be inform at ion if ciphering and int egrit y prot ect ion is used, which algorit hm s are used, what was
t he last ciphered/ int egrit y prot ect ed RLC fram e on old radio int erface ( ident ified by t heir RLC sequence num ber) .
Cell- I D of t he t arget cell as ext ract ed from RRC Measurem ent Report and u- RNTI assigned during RRC connect ion
set up by old SRNC. A radio bearer inform at ion list and all set t ings of RRC m easurem ent com plet e t he m andat ory
part of t he RRC cont ainer. Opt ional inform at ion m ay be added as well.
The Relocat ion Type = " UE not involved" indicat es t hat t here is no change of t he current ly used frequency, so t his
a int rafrequency hard handover.
RAB param et ers including Ciphering and I nt egrit y Prot ect ion I nfo are repeat ed in RANAP part of t he m essage
again, because RRC and RANAP part s t erm inat e in different ent it ies. While t he RANAP m essage is read by t arget
MSC already t he RRC cont aint er can only be read by new RNC.
UMTS Signaling
I u Transport Associat ion binding I D will be used by BI CC ( or I SUP) as CI C value for t raffic channel set up bet ween
t he t wo MSCs. ( Not e: I n t he PS dom ain t his binding I D is used t o define t he t unnel endpoint ident ifiers for dat a
t ransport bet w een t wo SGSNs.)
The I u Signalling Connect ion I dent ifier is allocat ed by t he first MSC, and t arget RNC is required t o st ore and
rem em ber t his ident ifier as long as t he call is act ive on I uCS int erface bet w een second MSC and t arget RNC.

I n next st ep of t he exam ple call flow t he new MSC sends MAP Prepare Handover acknow ledge w it h a ret urn result
last for invoke- I D = " 1" . A handover num ber is allocat ed by second MSC t hat is used like a m obile st at ion
roam ing num ber ( MSRN) for rout ing of BI CC/ I SUP signaling from first t o second MSC. The recept ion of t his
handover num ber st art s call set up in BI CC/ I SUP as described in chapt er 3.1.
Once again an an- APDU is em bedded in t he MAP m essage t hat cont ains t he RANAP Successful Out com e m essage
for Relocat ion Resource Allocat ion ( in RANAP spec also nam ed Relocat ioin Request Ack now ledge m essage) .
I n t his m essage a Target RNC- t o- SourceRNC- Transparent - Cont ainer is found t hat cont ains t he RRC Physical
Channel Reconfigurat ion m essage including all new assigned radio resources, at least a new u- RNTI is assigned
when t he cell is changed.
The RAB set up list inform s t hat t he new user plane bearer is already inst alled and wait s t o be det ect ed by UE.
Choosen I nt egrit y Prot ect ion and Ciphering algorit hm s are confirm ed by t arget RNC.
Now t his RRC Physical Channel Reconfigurat ion m essage is sent t o UE via t he old radio link . Aft er recept ion of t he
m essage t he UE sw it ches int o t he new cell.
While t his procedure is ongoing t he RANAP ent it ies of bot h RNCs updat e t he st ored locat ion inform at ion for t his
UE. This procedure is m andat ory, also if t here is no locat ion dat abase co- locat ed w it h t he RNCs.
I t clearly em erges t hat TCAP cont inues t he dialog st art ed w it h Relocat ion Preparat ion and MAP uses Forward
Access Signaling operat ion t o send RANAP m essages t o t he t arget RNC while responses from t arget RNC sent
back source RNC using MAP Process Access Signaling.
UMTS Signaling
When t he UE found t he new radio link and synchronized w it h t he Node B t arget RNC receiv es NBAP Radio Link
Rest orat ion on t he appropriat e I ub int erface. This t riggers sending of RANAP Relocat ion Det ect m essage. The
det ect ion of t he t raffic channel on t arget MSC side leads t o sending BI CC Answ er m essge t o t he source MSC.
Recept ion of RCC Physical Channel Reconfigurat ion com plet e m essage on new radio link ( in new cell) is report ed
sending RANAP Relocat ion Com plet e t o t he source RNC. Since second MSC knows t hat t his m eans successful
finishing of t he handover procedure it includes t his m essage in a MAP Send End Signal. Now also MAP ent it y of
first MSC is inform ed about successful handov er procedure.
Wit h sending MAP End Signal t he handover is successful com plet ed and t he UE is now served in t he new cell.
Form er t arget RNC is now SRNC. However, t he first MSC is st ill what is called t he anchor MSC of a m obile call.
There is a t raffic channel act ive bet ween first and second MSC, but t he call is st ill cont rolled by anchor MSC ( first
MSC) while second MSC only lends it s t ransm ission resources, which are necessary t o reach t he UE. I n ot her
UMTS Signaling
words: t he lay er 3 signaling bet ween UE and MSC using DMTAP prot ocol is running bet ween UE and anchor MSC;
second MSC forwards DMTAP m essages t ransparent ly in uplink and downlink direct ion. To allow t his DMTAP
m essage forwarding t he TCAP dialog is not finished aft er successful handover. I t is cont inued when t he call is
released or anot her handov er ( called a subsequent handover) needs t o be perform ed.
I n t he exam ple t he call is released aft er approxim at ely 12 seconds w it h a norm al call clearing procedure.

A TCAP Cont inue m essage w it h MAP Process Access Signalling operat ion is sent from second MSC t o anchor MSC
when call release st art s. I t includes a RANAP Direct Transfer carry ing DMTAP Disconnect m essage. The
Transact ion I D ( TI O) link s all DMTAP m essages of t his call ( as discussed in chapt er 3.3.2) , a send sequence
num ber is used t o ensure flow cont rol of t he call. The release cause indicat es norm al call clearing.
Sim ult aneously w it h t his DMTAP Disconnect a BI CC/ I SUP Release m essage is sent on t he sam e E int erface t o
release t he t raffic channel on E int erface as w ell.
The answ er of t he anchor MSC DMTAP ent it y is also em bedded in TCAP/ MAP/ RANAP. UE confirm s recept ion of
DMTAP REL w it h DMTAP Release Com plet e. On BI CC/ I SUP lev el anot her RLC m essage is sent t o finish t he call
procedure ident ified by CI C = 0080000 ( hex) . Then t he call is cleared from point of view of UE and anchor MSC.
The last st ep is now t o release t he TCAP and MAP t ransport resources bet ween t he MSCs. This is done by sending
a final MAP Ret urn Result Last for all invokes direct ly follow ed t o t he one w it h invoke- I D= 130 ( t he successful
handover) . The Ret urn Result Last is em bedded in an End m essage t hat finishes t he st ruct ured TCAP dialog.
UMTS Signaling
UMTS Signaling
4 .6 I N TER- 3 G- 2 G- 3 G_ M SC H AN D OVER PROCED URE

Because UMTS cells w ill cover only urban areas, but here again t he coverage cannot be
guarant eed, it w ill be oft en necessary t o hand over especially voice calls t o cells w it h radio access t echnology
( RAT) different from UMTS. The exam ples in t his book will always refer t o GSM as alt ernat iv e RAT, but ot her
t echnologies possible as well, for inst ance CDMA 2000. These procedures are also oft en called int ersyst em
handovers.
The m ain difference t o t he I nt er- 3G_MSC Handover/ Relocat ion procedure is t hat t here is no t arget RNC for t he
handover, but a t arget BSC. And a BSC does not " speak" RANAP, it " underst ands" only BSSAP. This leads t o t he
changes in t he int erface overview as shown in next figure:
Figure 4 39 - I nt erfaces involved in I nt er- Syst em Handovers bet ween UMTS and GSM
However, as it w ill em erge in t he call flow exam ple t he BSC also needs t o deal w it h som e RRC param et ers. So it
is not t he BSC we used t o know from plain GSM net works.
Due t o t he special needs of int ersyst em handovers also t he MAP t ransport capabilit ies have been adapt ed and in
first st ep t he prot ocol st ack for full decoding of a handover procedure is int roduced in figure 20. Alt ernat ively t o
I SUP of course also BI CC can be used.
Figure 4 40 - BSSAP- over- MAP prot ocol st ack for 3G- 2G Handover on E I nt erface
Anot her im port ant point t o underst and t he int ersyst em handover procedure com plet e is t o know t hat t he BSC is
not able t o perform handover by it s own. All handover procedures in GSM are cont rolled by a MSC. This is t rue
also for I nt ra- MSC handovers - when t he new cell is cont rolled by a new BSC t hat is connect ed t o t he sam e MSC
as t he first one.
UMTS Signaling
Figure 4 41 - I nt ra- 2G_MSC Handover Procedure
As shown in Figure 4.4.1 t he GSM I nt er- MSC handover is t riggered by m easurem ent report s frequent ly ( =
periodically) sent by t he UE t o t he old BSC. On behalf of t hese m easurem ent report s t he BSC decides t o perform
a handover procedure and sends ( in case of I nt er- Cell I nt er- BSC handover) a BSSMAP Handover Required
m essage t o t he serv ing MSC. On behalf of ex ist ing SCCP Class 2 connect ion ( est ablished during call set up, unique
ident ifiers source local reference and dest inat ion local reference [ SLR/ DLR] ) it can be recognized by t he MSC t o
which user t his HO Required belongs. The Handover Required m essage cont ains t he ident ifier of t he new desired
cell ( new CI D) and a cause value, e.g. " bet t er cell" .
MSC st art s t o prepare handover t o t he new BSC sending Handover Request m essage including - beside ot her
param et ers relat ed t o radio resources - old and new Cell I dent ifier and I MSI .
New BSC answ ers w it h Handover Request Acknowledge including a DTAP Handover Com m and wit h a Handover
Reference Num ber. This DTAP Handover Com m and is sent from new BSC t o UE, but since t he only act iv e radio
link t o UE is cont rolled by old BSC t he Handover Com m and is sent t o old BSC first . The m essage can be ident ified
on t he old A int erface bet w een MSC and old BSC, on Abis int erface and on radio int erface on behalf of it s
Handover Reference Num ber ( HO Ref) .
Aft er sw it ching t o t he new cell t he new BSC sends HO Det ect and HO Com plet e m essage t riggered by m essages
com ing from t he UE on radio int erface and Abis. The HO Reference num ber is included in t he handover access
burst sent by MS via radio int erface t o t he new BTS and report ed t o BSC w it h a Handover Det ect m essage as
response t o successful channel act ivat ion procedure on Abis int erface ( t he com plet e Abis call flow procedure is
not shown in figure 21, but in 3G- 2G Handover call flow exam ple) ..
Aft er t he successful handover procedure t he frequent ly m easurem ent report s are sent t o t he new BSC.
UMTS Signaling
4 .6 .1 I n t e r - 3 G- 2 G_ M SC H a n dove r / Re loca t ion Ove r vie w
Figure 4 42 - I nt er- 3G- 2G_MSC Handover/ Relocat ion Overview
St e p 1 :
As in case of I nt er- 3G_MSC Handover t he procedure is t riggerd by RRC Measurem ent Report com ing from UE.
However, t his t im e an event from event - I D group e3 ( int er- RAT m easurem ent ) will be sent .
St e p 2 :
RANAP Relocat ion Required m essage is sent from SRNC t o it s 3G MSC including inform at ion about source and
t arget of t he handover.
St e p 3 :
From t he t arget inform at ion in t he RANAP Relocat ion Required m essage t he 3G MSC det ect s t hat t he new desired
cell is a GSM cell. Hence, it is necessary t o send a BSSMAP Handover Request m essage t o t he t arget BSC. This
BSSMAP Handover Request is part of a MAP Prepare Handover operat ion.
St e p 4 :
The BSSMAP Handover Request m essage is forwarded t ransparent ly by 2G MSC t o t arget BSC.
St e p 5 :
Target BSC allocat es radio resources ( especially a t im e slot for t he connect ion) in t arget cell. The signaling of t his
procedure can be m onit ored on Abis int erface.
St e p 6 :
Aft er successful resource allocat ion v ia Abis t he BSC const ruct s a DTAP Handov er Com m and t hat is sent t o UE via
E int erface and lat er UTRAN. 2G MSC receives a BSSMAP Handover Request Acknow ledge m essage t hat cont ains
t he DTAP Handover Com m and.
St e p 7 :
MAP Prepare Handover Acknow ledge m essage is used t o t ransfer DTAP Handover Com m and via E int erface.
St e p 8 :
3G MSC orders relocat ion of SRNC and forwards DTAP Handov er Com m and via I uCS.
St e p 9 :
RRC ent it y of SRNC sends RRC Handover Com m and including DTAP Handover Com m and t o UE.
St e p 1 0 :
Based on t he inform at ion found in DTAP Handover Com m and t he UE ent ers t he GSM cell.
UMTS Signaling
4 .6 .2 I n t e r - 3 G- 2 G_ M SC H a n dove r Ca ll Flow
First a com plet e end- t o- end call flow diagram of t he procedure is int roduced ( Figure 4.43 and follow ing) and t hen
im port ant m essages and param et ers as m onit ored on E int erface w ill be present ed as det ailed as possible.
Figure 4 43 - I nt er- 3G- 2G_MSC Handover/ Relocat ion Call Flow 1/ 4
The t rigger t o st art an I nt er- RAT Handover procedure is defined when RRC m easurem ent is set up as described in
part 2 of t his book. The appropriat e t rigger event is ident ified by I D " e3a" = "Th e e st im a t e d qu a lit y of t h e
cu r r e n t ly u se d UTRAN fr e que n cy is be low a ce r t a in t h r e sh old a n d t h e e st im a t e d qu a lit y of t h e ot he r
syst e m is a bove a ce r t a in t hr e shold" . I ncluding full param et erizat ion ( hyst eresis, t im e- t o- t rigger value et c.)
t he set up procedure of t his event t rigger is done by sending RRC Measurem ent Cont rol m essage from SRNC t o
UE.
Anyt im e during an act ive call t he UE m oves int o a posit ion where t he t rigger condit ions are fulfilled. This is when
UE sends RRC Measurem ent Report w it h ev ent - I D = " e3a" .
Now t he SRNC st art s t he handover procedure w it h sending RANAP I nit iat ing Message w it h procedure code =
" Relocat ion Resource Allocat ion" ( in 3GPP 25.413 t his com binat ion is nam ed RANAP Relocat ion Preparat ion
m essage) including a source I D and a t arget I D t o it s serv ing MSC. The relocat ion t ype = " UE involved" indicat es
t hat UE w ill perform handover and relocat ion sim ult aneously . The cause value = " Tim e crit ical relocat ion" shall
set a higher priorit y in com parision t o int ra- 3G relocat ion/ handover procedures. The source I D is encoded using
t he UMTS serv ice area ident ifier ( SAI ) . The t arget I D uses t he cell group ident ifier ( CGI ) t o ident ify t he t arget
radio net work subsyst em . Since CGI is t ypical for Base St at ion Subsyst em s ( BSS) it already em erges at t his point
of t he call t hat t he handover t arget w ill be a GSM cell.
I t is t ask of t he serving MSC t o t ake t he im port ant param et ers from t he RANAP m essage and const ruct a BSSMAP
Handover Request m essage. To highlight t his point : it is t he 3G MSC t hat const ruct s a BSSMAP m essage, w hich is
act ually used for com m unicat ion bet ween 2G MSC and BSC on GSM A int erface. I n TCAP t ransact ion port ion t he
applicat ion cont ext nam e version 3 is used in first st ep.
However, as it w ill happen oft en in early days of 3G net works and int ersyst em handovers t he t arget 2G MSC is
not able t o " underst and" t his version 3. Hence, it sends TCAP Abort m essage and request s a repet it ion of t he
dialog using applicat ion cont ex t nam e version 2.
Aft er successful recept ion of MAP Prepare Handover operat ion on 2G MSC side a SCCP class 2 connect ion is set
up bet ween 2G MSC and t arget BSC. I t st art s w it h a SCCP Connect ion Request ( CR) m essage t hat carries t he
BSSMAP Handover Request as const ruct ed by 3G MSC before.
The BSC t hat receives t he BSSMAP Handover Request proceeds as in case of norm al int ra- 2G handover: it
creat es a RSL ( Radio Signaling Link prot ocol) Channel Act ivat ion m essage ( CHNAV) t hat is sent t o t he GSM base
t ransceiver st at ion ( BTS) . I n t he Channel Act iv at ion m essage t he t im e slot num ber for t he call aft er handover t o
GSM and t he handover reference num ber value ( HO Ref) are found. I t should be not iced t hat especially t he
channel act ivat ion m essages of t he RSL prot ocol oft en cont ain propriet ary param et ers and/ or sequences so t hat
is m ost ly depends on t he equipm ent m anufact urer how t hese m essages look in det ail.
UMTS Signaling
I n next st ep t he BTS confirm s t he channel act ivat ion for t im e slot 4 w it h a RSL Channel Act ivat ion Acknow ledge
m essage ( CHNAK) .
The set up of SCCP connect ion on A int erface is confirm ed w it h a SCCP Call Confirm ( CC) sent by BSC. This CC
m essage includes a BSSMAP Handover Request Accept as inform at ion t o t he MSC t hat request ed t he handover
( t he 3G MSC! ) t hat radio resources have been allocat ed successfully. The BSSMAP m essage cont ains a DTAP
Handover Com m and ( HCOM) , which is t o order t he UE t o ent er t he GSM cell and use t im e slot 4 of t his cell t o
cont inue t he call. The absolut e radio frequency code num ber ( ARFCN) is used t o dist inguish t his cell from it s
neighbor GSM cells on radio int erface. I t indicat es t he unique frequency of t his cell's broadcast channel, because
in GSM each neighbor cell has it s own unique BCH frequency. So t he funct ion of t he ARFCN as ident ifier in GSM
can be com pared wit h t he ident ificat ion funct ion of prim ary scram bling code in UTRAN. The DTAP Handover
Com m and also cont ains t he handover reference num ber t hat w ill be used lat er by BSC t o det ect t he successful
handover.
Wit h MAP Prepare Handover acknow ledge t he 3G MSC receives t he handover num ber ( HO No.) for rout ing of
I SUP I AM relat ed t o t his call. Now t he t raffic channel on E int erface is set up using t he w ell- known I SUP
procedure while t he em bedded DTAP Handover Com plet e is forwarded on I uCS int erface t o SRNC using RANAP
Successful Out com e m essage for Relocat ion Resource Allocat ion.
Now t he SRNC sends a RRC Handover from UTRAN Com m and- GSM t o t he UE. This RRC m essage cont ains
inform at ion about t he new radio access t echnology ( frequency band = dcs1800) as well as inform at ion how t he
radio access bearer shall be defined in t he new cell. I n addit ion t he m essage t ransport s t he DTAP Handover
Com m and com ing from t arget BSC t o t he UE.
UMTS Signaling
Aft er t he UE sw it ched int o t he new cell t he UE sends a handover access burst on radio int erface cont aining t he
sam e handover reference no ( HO Ref) t hat has been assigned w it h RSL channel act ivat ion procedure t o t he BTS.
When t he handover access burst is received and t he HO Ref value is t he sam e as expect ed ( which is t he norm al
case) a RSL Handover Det ect ( HODET) m essage is sent by BTS t o BSC. The t im e slot num ber ( TS= 4) links t his
m essage t o t he channel act ivat ion procedure. So t he BSC is enabled t o send a BSSMAP Handover Det ect ( HODET)
m essage t o t he 3G MSC using t he act ive SCCP class 2 connect ion. This BSSMAP HODET cont ains t he HO Ref
assigned t o t he procedure before.
To forward t he BSSMAP HODET t o t he 3G MSC 2G MSC needs t o send t his m essage enclosed in a MAP Process
Access Signaling operat ion.
Sim ult aneously 2G MSC act ivat es t he forwarded voice t raffic channel on E int erface by sending I SUP Answer
m essage ( ANM) for t he defined CI C.
Meanwhile radio link est ablishm ent on Abis int erface is com plet e by RSL Est ablish I ndicat ion ( ESTI N) and a Dat a
I ndicat ion ( DATI N) is used t o t ransport t he first layer 3 DTAP m essage from UE t o t he BSC using GSM radio
channels. This m essage is DTAP Handover Com plet e ( HCOMP) wit h cause value = " norm al event " . So it is a
regular and successful handov er.
BSSMAP sends Handover Com plet e t o anchor MSC of t he call ( 3G MSC) em bedded in MAP Send End Signal, w hich
m eans t hat handover procedure from point of view of MAP is finished.
Recept ion of BSSMAP Handover Com plet e t riggers release of t he RANAP and SCCP connect ion on I uCS int erface
by 3G MSC. Wit h t his procedure also t he radio access bearer w ill be released as described in MOC/ MTC scenarios
in part 2 of t his book.
The furt her m essages in t he UTRAN are used t o release t he assigned UMTS radio resources ( RNTI [ s] , scram bling
codes, spreading codes et c.) w it h NBAP Radio Link Delet ion. Also t he AAL2 SVC est ablished for t ransport of
dedicat ed t raffic channels and dedicat ed cont rol channels are released on bot h, I ub and I uCs int erface.
UMTS Signaling
4 .6 .3 I n t e r - 3 G- 2 G_ M SC H a n dove r M e ssa ge s on E I n t e r fa ce
Now t he focus is on t he m essages of t he previously described handover procedure t hat can be m onit ored on E
int erface bet ween 3G MSC and 2G MSC. Addressing aspect s and param et er descript ion shall be highlight ed.
Figure 4 47- I nt er- 3G- 2G_MSC Handover/ Relocat ion on E- I nt erface Call Flow 1/ 3
The end- t o- end addressing bet ween bot h MSCs is a t ask of SCCP. Since t he applicat ion part is MAP SCCP UDT
m essages w ill be exchanged bet ween MSCs and each UDT cont ains a called part y address as well as a calling
UMTS Signaling
part y address, which are t rue E.164 addresses of t he sw it ches. There is no global t it le t ranslat ion in t his case of
MAP signaling.
TCAP Originat ing Transact ion I D ( OTI D) w ill change w it h direct ion of TCAP m essage. Hav ing a look at OTI D
t oget her w it h SCCP address w ill m ake clear which MSC is sender or receiver of a m essage.
The MAP Prepare Handover m essage already cont ains t he t arget I D in cell group ident ifier ( CGI ) form at as it is
used for GSM cells only . I n addit ion an access net work APDU ( an- APDU) is enclosed t hat cont ains a m essage
follow ing 3GPP 48.006. I ndeed, t his is not com plet ely t rue, because 3GPP 48.006 only describes basic procedures
on GERAN A int erface while t he encoding of m essages and param et ers used in t hese procedures is described in
3GPP 48.008.
The UE ident ifier t hat can be used as search param et ers t o find a single handover procedure is t he subscriber's
I MSI .
The m ain part of t he an- APDU is t he BSSMAP Handover Request ( HOREQ) t hat request s a full rat e t raffic channel
on GSM for speech ( GSM voice) . I n addit ion inform at ion about ciphering MS classm ark 2 and 3 ( UE soft ware
capabilit ies) is included. Source and Target I D ident ify source and t arget cells or areas of t he handover. As a rule
t he 3G source is ident ified by Serv ice Area I dent it y, for GSM cell CGI is used again. The cause of t he handover
request is t ypically " bet t er cell" and a Old BSS t o New BSS I nform at ion cont ainer carries I nt erRAT Handover I nfo:
t he st art value for ciphering aft er changing t he cell and UE radio access capabilit ies.
UMTS Signaling
UMTS Signaling
UMTS Signaling
Message Exam ple 4 1: OldBSS- t o- NewBSS I nform at ion
UMTS Signaling
The answ er t o t he handover request is sent by from 2G MSC w it h a MAP Ret urn Result Last for prepare handover
local operat ion. I t cont ains t he handover num ber t hat w ill be used as called part y address by I SUP/ BI CC I AM
m essage.
The an- APDU cont ains BSSMAP Handover Request Acknow ledge m essage w it h inform at ion about choosen
ciphering algorit hm , choosen codec for speech inform at ion on t raffic channel ( here: GSM codec) and a lay er 3
DTAP Handover Com m and t hat shall be forwarded t o t he UE.
The DTAP Handover Com m and ( HCOM) cont ains a det ailed descript ion how t o find t he t arget cell on radio
int erface. Base St at ion Color Code ( BCC) and Net work Color Code ( NCC) ensure t o find t he right BTS of t he right
net work . Absolut e Radio Frequency Code Num ber w ill ensure t o find t he correct t arget cell out of all ot her cells of
sam e BTS and neighbor BTSs.
Also a det ailed descript ion of t he t raffic channel and t im e slot num ber is given t oget her w it h t he handover
reference num ber and som e furt her inform at ion.
UMTS Signaling
The t wo follow ing m essages are BSSMAP Handover Det ect and Handover Com plet e w it hout any det ailed
inform at ion regarding t he UE or t he t arget cell. I f Handover Com plet e is sent it is clear t hat t he 3G- 2G Handover
was successful.
However, t he TCAP dialog is not finished yet , because it seem s t hat t he UE is m oving pret t y fast and so in t his
call flow w e w ill see as next st ep a subsequent handover from 2G back t o 3G.
4 .6 .4 I n t e r - 2 G- 3 G_ M SC H a n dove r / Re loca t ion Ove r vie w

I n case of t he call flow exam ple described in t his chapt er t he 3G MSC is st ill anchor MSC of t he act ive voice call
t hat was hand over t o a GSM cell. Since t he 3G MSC is anchor MSC t he follow ing 2G- 3G handover is a socalled
subsequent handover. That is t he reason why MAP operat ions are different from t he prev ious call flow .
Figure 4 50- I nt er- 2G- 3G_MSC Handover/ Relocat ion Overview
St e p 1 :
The handover procedure t his t im e is t riggered by frequent ly RSL m easurem ent report s received by BSC via Abis
int erface.
St e p 2 :
BSC decides t hat a handover is necessary and requires handov er ex ecut ion by 2G MSC.
St e p 3 + 4 :
2G MSC sends BSSMAP Handover Request t o t arget RNC via E and I uCS int erface.
St e p 5 + 6 + 7 :
Target RNC assigns radio and t ransport resources in UTRAN and sends RANAP Relocat ion Request Acknow ledge
wit h em bedded DTAP Handover Com m and t hat includes anot her m essage, t he RRC Handover To UTRAN
Com m and, which is forwarded t oget her wit h DTAP m essage t o UE v ia GSM and init iat es t he change back t o UMTS.
St e p 8 :
Wit h a RRC Handover t o UTRAN Com plet e m essage sent on UMTS radio and I ub int erface t he UE confirm s t he
successful handover t o UMTS, which is t he end of t he procedure. I t is expect ed t hat a m andat ory Radio Bearer
Reconfigurat ion procedure follows for reasons explained in m essage flow descript ion.
From t he prot ocol st ack point of view t he call flow exam ple w ill show t hat it m ust be expect ed t o find DTAP or
RANAP inform at ion on t op of BSSAP and em bedded in DTAP or RANAP RRC I nform at ion can be t ransport et .
UMTS Signaling
Figure 4 51 - I nt ra- 2G- 3G_MSC Handover Prot ocol St ack on E I nt erface
4 .6 .5 I n t e r - 2 G- 3 G_ M SC Subse que n t H a n dove r M e ssa ge s on E

I n t e r fa ce
The SCCP addresses and TCAP t ransact ion I Ds are st ill t he sam e when 2G MSC send it s MAP Prepare Subsequent
Handover request m essage t o 3G MSC including BSSMAP Handover Request .
The BSSMAP cause " t raffic load" indicat es t hat t he GSM cell is probably not able t o fulfill t he qualit y of service
requirem ent s for t he call. The RANAP SourceRNC- t o- Target RNC- Transparent - Cont ainer is creat ed by t he source
BSC. So t his BSC needs t o hav e a basic " know ledge" about RANAP and RRC param et ers and funct ions. A
com plet ely new soft ware is required t o ensure t his. Hence, a BSC in a GSM net work int erconnect ed w it h 3G radio
access t echnology cannot be com pared t o a BSC used for plain GSM. Wit h t his im pression it also becom es clear
why 3GPP does not only care about UTRAN specificat ion, but also about new GERAN st andards.
The recept ion of SoureRNC- t o- Target RNC- Transparent - Cont ainer t riggers NBAP Radio Link Set up on I ub int erface.
For t his radio link set up procedure t he sam e radio configurat ion ident it ies and param et ers w ill be used t hat can
be found in RRC Handover To UTRAN Com m and m essage.
UMTS Signaling
Figure 4 53 - I nt er- 3G- 2G_MSC Handover/ Relocat ion on E- I nt erface Call Flow 2/ 2
Once again t he MAP Ret urn Result Last for Prepare Subsequent Handover operat ion cont ains t he DTAP Handover
Com m and including RRC Handover t o UTRAN Com m and wit h a new u- RNTI and som e predefined radio
configurat ion ident it ies for physical and t ransport channels. Each RNC owns som e general reserved resources
( codes, ident ifiers) for I nt erRAT- Handover procedures from different t echnologies like GSM. The t wo m ost
out st anding of t hese reserved resources found in RRC Handov er To UTRAN Com m and are:
U- RNTI Short - This U- RNTI consist s of SRNC- I D plus S- RNTI - 2 t hat has a 10 bit lengt h. Aft er UE
receives S- RNTI - 2 is const ruct s a 20- bit st andard S- RNTI by adding 10 " 0" - bit s in t he m ost significant
posit ions of t he ident ifier.
Long uplink scram bling code ident ified by a reduced scram bling code num ber. This reduced scram bling
code num ber ident ifies as subset of uplink scram bling codes ( v alue = 08191) reserved for init ial use
upon handover t o UTRAN.
Aft er successful handover indicat ed by RRC Handover To UTRAN Com plet e m essage SRNC t riggers a NBAP
Synchronized Radio Link Reconfigurat ion procedure and ex ecut es successive RRC Radio Bearer Reconfigurat ion
procedure t o assign a new uplink scram bling code wit h norm al code num ber and - if necessary - t o adapt t he
qualit y of service param et ers t o current needs.
Aft er successful subsequent handover procedure t he TCAP dialog is finished by sending TCAP End m essage. The
ret urn result last for invoke- I D = 125 confirm s execut ed operat ion for all invokes sent aft er t his I D.
UMTS Signaling
4 .7 CUSTOM I ZED APPLI CATI ON FOR M OBI LE N ETW ORK

EN H AN CED LOGI C ( CAM EL)
I t is foreseeable t hat in t he fut ure m ore and m ore services w ill be int roduced in public land m obile net works t hat
require a higher level of net work int elligence. To m ake a t elephone net work int elligent basically m eans t o inst all
in t he net work dat abases t hat st ore and soft w are applicat ions t hat process cust om er relat ed service subscript ion
dat a. Typical serv ices are for inst ance int elligent call rout ing as in case of m obile num ber port abilit y and flex ible
charging serv ices for GPRS depending on durat ion of connect ion and/ or volum e of t ransm it t ed dat a.
I n t he early days of prepaid services in PLMN net work equipm ent m anufact urers offered propriet ary prot ocols
derived form fixed net work I nt elligent Net work Applicat ion Part ( I NAP) as defined in I TU- T st andards. Meanwhile
t he CAMEL Applicat ion Part ( CAP) is running in m ost m obile net works, which is especially necessary t o exchange
int elligent services inform at ion bet ween different net work operat ors. Wit hout CAMEL it would be quit e im possible
for a visit ed net work t o charge a roam ing prepaid subscriber in real- t im e while his or her prepaid account is
adm inist rat ed by t he subscriber's hom e net work only .
I n addit ion CAMEL is necessary t o guarant ee a virt ual hom e environm ent . I f a Germ an subscriber is roam ing in a
Chinese net work and an announcem ent shall be played follow ing t he ideas of VHE it m ust be ensured t hat t he
announcem ent is not only in Germ an language, but also has t he sam e inform at ion, t he sam e t ypical voice et c.
The easiest and m ost secure w ay for t he Chinese operat or t o play exact ly t he sam e announcem ent is t o play
exact ly t he sam e announcem ent : a voice channel is set up t o t he Germ an Hom e PLMN of t he subscriber and so
t he Germ an announcem ent t he cust om er hears while he or she is in China is really t he announcem ent from his or
her hom e net w ork. To ensure t hat t his serv ice is work ing it is necessary t o analyze inform at ion com ing from t he
subscriber, e.g. I MSI t hat cont ains inform at ion about hom e count ry and hom e net work of t he subscriber and t o
t rigger a call set up t o t he announcem ent m achine in t he Germ an net work. So it is necessary t o have soft ware
t hat excerpt s serv ice relevant dat a from t he signaling m essages exchanged bet ween subscriber and net work and
a dat abase t hat cont ains addit ional inform at ion like t he address of t he announcem ent m achine t o set up t he voice
channel.
Since it was difficult t o adapt t he previous inst alled propriet ary I NAP prot ocols t o t he new CAMEL st andard t his
adapt at ion process was divided int o different st eps. Each st ep is reflect ed by a CAMEL Phase. CAMEL Phase 1
included only seven m essages for int elligent call rout ing. CAMEL Phase 2 int roduced full cont rol of all circuit
sw it ched relat ed I N services and finally CAMEL Phase 3 ( which is current ly inst alled in 3G net w orks) includes all
CS services specified for fixed net works in I NAP Capabilit y Set 1 ( CS- 1) plus full support of I N services for SMS
and GPRS. A CAMEL Phase 4 is specified in 3GPP Release 5 st andards and it w ill include m any feat ures of I TU- T
I NAP CS- 2.
This chapt er w ill giv e a short ov erv iew about CAMEL concept and signaling. To discuss all aspect s and det ails it
would be necessary t o writ e anot her book.
4 .7 .1 I N / CAM EL N e t w or k Ar ch it e ct ur e
To t alk about int elligent net works it is necessary t o have a different look at t he net work archit ect ure. I ndeed, t he
net work elem ent s t hat are known like MSC, SGSN et c. are st ill t here, but t he I N archit ect ure point of v iew w ill
assign new nam es t o t hese elem ent s according t o t heir I N- specific funct ions. The CAMEL archit ect ure overview
shows where soft ware and st ored dat a can be found t hat are relat ed t o t he int elligent serv ices.
Figure 4 54 - Elem ent s of an I nt elligent CAMEL Net work
UMTS Signaling
The Service Sw it ching Funct ion ( SSF) det ect s incom ing I N calls and request s orders for call processing from t he
Serv ice Cont rol Funct ion. The serv ice sw it ching funct ion is inst alled on a serv ice sw it ching point , which can be
described in a popular way as an exchange w it h inst alled I N soft ware. Most ly t he SSP is t he sam e physical
equipm ent as t he MSC plus inst alled addit ional SSF.
The Service Cont rol Funct ion ( SCF) , which is anot her soft w are, t oget her w it h t he serv ice dat a funct ion ( SDF) ,
which is a dat abase, form s t he Serv ice Cont rol Point ( SCP) . I n t he CAMEL concept t his SCP is also called CAMEL
Service Ent it y ( CSE) .
I n addit ion especially for circuit sw it ched I N services t here is a Specialized Resource Funct ion ( SRF) running on
equipm ent t hat is called I nt elligent Peripheral ( I P - t his has not hing in com m on w it h t he I nt ernet Prot ocol! ) . SRF
is used t o det ect DTMF dialing t ones form voice circuit s and t ransfer t hese t ones int o signaling ( dialing)
inform at ion and it is t he above m ent ioned " announcem ent m achine" . This t he reason why - if t his is necessary I SUP signaling is exchanged bet ween SSP and I P t o set up and release voice channels.
4 .7 .2 CAM EL Ba sic Ca ll St a t e M ode l

To have full cont rol of call handling it m ust be defined when it is t im e for t he I N soft ware t o act . I t m ust be also
possible t o follow up what happens t o a call t o m ake a clear decision if e.g. t he cust om er can be im m ediat ely
charged or not .
To analyze and cont rol t he call t he Basic Call St at e Model ( BCSM) was int roduces. The earliest ideas about such a
m odel have been developed by Bell Laborat ories in t he 1960s when t hey did research for Advanced I nt elligent
Net work ( AI N) 0.1 st andards. AI N is t he Nort h Am erican count erpart of I TU- T I NAP.
I NAP specificat ions have adapt ed t he AI N BCSM. 3GPP CAMEL st andards are based on t he I NAP BCSM.
I n all st andards t here is a originat ing BCSM t hat looks at t he call from point of view of calling part y and a
t erm inat ing BCSM t hat represent s t he point of view of called part y.
Figure 4 55 - CAMEL Phase 3 Originat ing BCSM
I n t he BCSM t here are point s in call ( PI C) and det ect ion point s ( DP) . The DPs have num bers while PI Cs have only
nam es. The DPs 1 and 8 are m issed, because t hey have been specified for I NAP CS- 1, but not adapt ed for CAMEL
Phase 3. By t he way he overall num ber of DPs is seen as a crit eria how sophist icat ed an int elligent net work is.
Also in t he fixed net work not ev ery I N soft ware needs t o im plem ent all possible DPs. Many I N applicat ions are
t ailored cust om er specific solut ions and include only a subset of I NAP CS- 1 DPs.
When t he call ent ers a det ect ion point t he call proceeding of t he exchange ( e.g. MSC) is int errupt ed and SSF m ay
request SCF for orders how t o cont inue.
Best way t o explain is an exam ple:
UMTS Signaling
A m obile subscriber want s t o m ake a call and dials a num ber. As long as t here was no DMTAP SETUP m essage
received by MSC t he call is in st at e O_Null&Aut horizse_Originat ion At t em pt _Collect _I nfo.
When SETUP is received SSF det ect s t he Called Part y Num ber. This is t he ent ry event for DP 2: Collect ed
I nform at ion. Now t he SSF checks if t he called part y num ber is valid. I f not t he call is abort ed by net work, which
is indicat ed by O_Except ion PI C. I f t he num ber is okay t he call can be processed and t he next DP ( no. 3)
Analyzed I nform at ion is ent ered.
To reach DP 3 m eans t o st op t he call once again t o get rout ing inform at ion t hat can be prov ided by SCP.
Then t he Rout ing&Alt ert ing point in call is reached. The call can be answered ( DP 7 is ent ered) , m isrout ed ( DP 4) ,
called part y is busy ( DP 5) or called part y does not answer ( DP 6) .
I n addit ion during bot h PI Cs, Analyze I nfo and Rout ing&Alt ering, t he calling part y can decide t o st op t he call, for
inst ance because it recognizes t hat t he w rong num ber was dialed. This w ill t hen t rigger t he ent ry t o DP 10 ( O
Abandon) .
I f called part y accept s t he call DP 7 is ent ered and follow ing t his t he call becom es act ive ( O_Act ive PI C) .
4 .7 .3 Ch a r gin g Ope r a t ion usin g CAM EL

As already m ent ioned CAMEL is especially im port ant for charging serv ices. Lik e MAP CAMEL Applicat ion Part ( CAP)
is a user of SCCP and TCAP. Hence, all st at em ent s about SCCP addressing and TCAP signaling m ade in form er
chapt ers are valid for CAMEL as well. The whole com m unicat ion bet ween SSF and SCF is included in a st ruct ured
TCAP dialog, but m ore oft en as in MAP it is seen t hat sev eral TCAP operat ions are t ransm it t ed w it h j ust one TCAP
Begin or TCAP Cont inue m essage.
Figure 4 56 - CAMEL Charging Operat ions Overview
A t ypical exam ple of CAMEL charging is running in 6 st eps:

St e p 1 :
A SETUP or I AM m essage is sent from calling part y t o t he SSF and t riggers I nit ial Det ect ion Point ( DP 2) .
St e p 2 :
CAMEL Applicat ion Part ( CAP) I nit ial DP ( I DP) operat ion is sent from SSF t o SCF t o request inst ruct ions how t o
handle t he call.
St e p 3 :
SCF sends SEND CHARGI NG I NFORMATI ON t o indicat e all param et ers t hat w ill be relevant for charging as w ell as
t he advice of charging charact erist ic t hat describes, which act ions, e.g. t ones, are sent t o t he charged subscriber
t o indicat e t hat a specific charging event t ook place. An exam ple of t his is a t one t hat is sent if a prepaid account
value reached or passed a m inim um t hreshold. Most ly included in t he sam e TCAP m essage Apply Charging
operat ion is sent t o SSF t o inst ruct t he SSF t o send charging report s t o SCF if a charging ev ent was t riggered.
The Apply Charging operat ion cont ains a list of all charging event s, which are relevant for t his call, e.g. t im er
values for t im e dependent charging. A CONNECT operat ion is also sent by SCF t o inst ruct t he SSF how t o
com plet e t he call.
St e p 4 :
I AM or SETUP m essage is sent by SSF t o called part y. Called part y num ber w as deriv ed from CONNECT m essages
received from SCF.
St e p 5 :
The call is released, which could be one of t he event s t hat t riggers a charging report .
UMTS Signaling
St e p 6 :
Apply Charging Report is sent from SSF t o SCF t o indicat e t he occurence of a charging ev ent as defined by SCF
and sent wit h Apply Charging m essage. Apply Charging Report s m ay also be sent during an est ablished
connect ion, e.g. if a charging t im er in SSF expires. A t ypical exam ple for a scenario like t his is prepaid calling
card charging w here t he incom ing charging report s lead t o an im m ediat e decrease of t he subsriber's prepaid
am ount .
N ot e : I n case t hat SSF should writ e a call det ail record ( CDR) for t his call an addit ional FURNI SH CHARGI NG
I NFORMATI ON m essage would be sent from SCF t o SFF t oget her wit h Send Charging I nform at ion and Apply
Charging m essages.
4 .7 .4 CAM EL Signa lin g Ex a m ple for GPRS Ch a r gin g

There are different SSFs for GSM and GPRS defined in CAMEL st andards. The difference is t hat gsm SSF is locat ed
in MSC while gprsSSF is locat ed in SGSN. The gsm SCF is for bot h t he sam e and inst alled in a cent ral net work
locat ion.
Figure 4 57- CAMEL PS Call Cont rol and Charging Call Flow 1/ 3
The scenario begins w it h an I nit ial DP GPRS operat ion em bedded in a TCAP BEGI N m essage. The I nit ial DP ( DP 2)
is ent ered when SGSN receives an Act ivat e PDP Cont ext Request m essage v ia I uPS int erface. Wit h sending t his
I nit ial DP GPRS t he gprsSSF request s inst ruct ions from gsm SCF how t o handle t he PDP Cont ext request ed by t he
subscriber. I t should be not ed t hat Signaling Connect ion Cont rol Part ( SCCP) provides connect ionless class1
t ransport service for TCAP dialogs. I n SCCP header t he t wo E.164 addresses of gprsSSF and gsm SCF can be
found.
TCAP Originat ion Transact ion I D and Dest inat ion Transact ion I D link all TCAP m essages of a single dialog t oget her
an can be used as filt ering param et ers in case of t roubleshoot ing m onit oring.
The Dialog Port ion of t his first TCAP Message cont ains Applicat ion Cont ext inform at ion and a CAP GRPS Reference
Num ber, which w ill link all CAP m essages belonging t o t he request ed PDP Cont ext . The CAP m essages
TCAP BEGI N ( Originat ion Transact ion I D = a , Dialogue Port ion [ Applicat ion Cont ext = CAP- gprsSSF- gsm SCF,
GPRS Reference Num ber Originat ing Reference = c] , Com ponent Port ion [ I nvoke- I D= 1 - > LocalOperat ion =
I n it ia l D P GPRS, GPRS Event Type = PDP Cont ext Est ablishm ent , MSI SDN, I MSI , Tim e_and_Tim eZone, PDP
Type Num ber = I Pv4 Address, Access Point Nam e = gprsservice.server.gprs, Rout ingAreaI dent it y, SGSN Num ber,
PDP I nit iat ion Type = MS init iat ed] )
The BEGI N m essage is answ ered wit h TCAP CONTI NUE cont aining t wo m ore CAP operat ions. First t he gprsSSF is
request ed t o inform gsm SCF if t he PDP Cont ex t it est ablished and due t o m onit or m ode set t ings t his report w ill
UMTS Signaling
be sent as TDP- R t hat w ill t rigger a new CAMEL procedure for charging on gsm SCF side. Wit h Cont inue GPRS t he
gprsSSF is request ed t o proceed t he PDP cont ext est ablishm ent :
TCAP CON TI N UE ( Originat ion Transact ion I D = b, Dest inat ion Transact ion I D = a , Dialogue Port ion [ GPRS
Reference Num ber Originat ing Reference = d, GPRS Reference Num ber Dest inat ion Reference = c] , Com ponent
Port ion [ I nvoke- I D = 35 - > Local Operat ion = Request Report GPRS Event - > PDP- Cont ext Est ablishm ent
Acknow ledge, Disconnect , Monit or m ode = int errupt ed ( report event as TDP- R ) , I nvoke- I D = 36 - > Local
Operat ion = Con t in u e GPRS] )
Then gprsSSF sends an Event Report GPRS operat ion t hat indicat es t hat PDP Cont ext was est ablished. A
ChargingI D is provided t o link t his PDP cont ext w it h a charging process on SCF side. I n t he Locat ion I nform at ion
GPRS I nform at ion Elem ent t he Rout ing Area I dent it y ( RAI ) is included t hat consist s of Mobile Count ry Code
( MCC) , Mobile Net work Code ( MNC) , Locat ion Area Code ( LAC) and Rout ing Area Code ( RAC) .
TCAP CON TI N UE ( Originat ion Transact ion I D = a , Dest inat ion Transact ion I D = b, Dialogue Port ion [ GPRS
Reference Num ber Originat ing Reference = c, GPRS Reference Num ber Dest inat ion Reference = d] , Com ponent
Port ion [ I nvoke- I D = 2 - > Local Operat ion = Event Report GPRS, GPRSEvent Type =
PDPCont ext Est ablishm et nAcknow ledge, MessageType = Request , Access Point Nam e = gprsservice.serv er.gprs,
ChargingI D = e , Negot iat ed QoS { QoS Param et er} , Locat ion I nform at ion GPRS { RAI = M CC, M N C, LAC, RAC} ,
SGSN Num ber { E.164} , Tim e_and_Tim eZone)
Wit h t he next m essage gprsSSF receives charging param et ers and t he order t o proceed w it h t he PDP Cont ex t
processing.
TCAP CON TI N UE ( Originat ion Transact ion I D = b, Dest inat ion Transact ion I D = a , Dialogue Port ion [ GPRS
Port ion [ I nvoke- I D = 39 - > Local Operat ion = ApplyChargingGPRS{ m ax. t ransferred volum e} , I nvoke- I D = 40 > Local Operat ion= ApplyChargingGPRS{ m ax. elapsed t im e} , I nvoke- I D = 41 - > Local Operat ion =
Con t in u e GPRS] )
Figure 4 58 - CAMEL PS Call Cont rol and Charging Call Flow 2/ 3
Wit h TCAP END m essage t he first TCAP Dialog is finished.

TCAP EN D ( Dest inat ion Transact ion I D = b)
A new TCAP dialog is st art ed w it h TCAP BEGI N m essage cont aining ApplyChargingReport s and one
Event Report GPRS t hat indicat es t hat m obile st at ion ( MS) want s t o deact ivat e t he PDP cont ext .
TCAP BEGI N ( Originat ion Transact ion I D = f, Dialogue Port ion [ Applicat ion Cont ext = CAP- gprsSSF- gsm SCF,
GPRS Reference Num ber Originat ing Reference = c, GPRS Reference Num ber Dest inat ion Reference = d] ,
Com ponent Port ion [ I nvoke- I D = 1 - > LocalOperat ion = ApplyCha r gin gRe por t GPRS { Volum e if No Tariff
Sw it ch = h ) , I nvoke- I D = 2 - > LocalOperat ion = ApplyCh a r gin gRe por t GPRS { Tim e GPRS No Tariff Sw it ch = j ) ,
I nvoke- I D = 3 - > LocalOperat ion = Eve n t Re por t GPRS , GPRS Event Type = Disconnect , Disconnect Specific
I nform at ion - > I nit iat ing Ent it y = MS] )
The gsm SCF deliv ers t wo Ret urn Result Last t o gprsSSF t o indicat e t hat t he bot h Apply Charging Report GPRS
operat ions ( com pare I nvoke- I D values w it h t hose in previous m essage! ) have been received and t he invoke t o
execut e a charging operat ion w as successfully.
UMTS Signaling
TCAP CON TI N UE ( Originat ion Transact ion I D = g, Dest inat ion Transact ion I D = f, Dialogue Port ion [ GPRS
Port ion [ Ret urnResult Last - > I nvoke- I D = 1, Ret urnResult Last - > I nvoke- I D = 2] )
Figure 4 59 - CAMEL PS Call Cont rol and Charging Call Flow 3/ 3
Anot her TCAP CONTI NUE m essage is sent from gsm SCF t o gprsSSF. I t cont ains a Cont inueGPRS operat ion t o
order t he gprsSSF t o proceed wit h PDP cont ex t deact ivat ion.
TCAP CON TI N UE ( Originat ion Transact ion I D = g, Dest inat ion Transact ion I D = f, Dialogue Port ion [ GPRS
Port ion [ Con t in u e GPRS] )
TCAP END m essage finishs t his second TCAP dialog.
TCAP END ( Dest inat ion Transact ion I D = g)

Umts Signaling 111128180007 Phpapp02 Libre PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Umts Signaling 111128180007 Phpapp02 Libre PDF

Uploaded by

Copyright:

Available Formats

UMTS Signaling

Net work Elem ent I nst abilit y

Berlin, Germ any

ABOUT TH E AUTH ORS

Figure 1 1 - Com ponent Overview of a UMTS Net work

CW TS: China Wireless Telecom m unicat ion St andard group

Figure 1 2 - I MT- 2000

Figure 1 4 Possible m igrat ion pat hs from 2G t o 3G

1 .2 N ETW ORK ARCH I TECTURE

Circuit sw it ched t ype t raffic in t he CS Dom ain

Figure 1 5 - GSM Net work Archit ect ure

Hom e Locat ion Regist er

Serv ing GPRS Support Node wit h Locat ion Regist er

Gat eway GPRS Support Node

Aut hent icat ion Cent er

Serv ice Cont rol Point

Short Message Service Cent er

CAMEL Service Ent it y ( Cust om ized Applicat ion for Mobile

Figure 1 6 - UMTS Rel. 99 Net w ork Archit ect ure

Figure 1 7 - UMTS Rel. 4 Net work Archit ect ure

The new feat ures and Serv ices are :

Mult im edia Serv ices in t he CS Dom ain

I P t ransport of Core Net work ( CN) prot ocols

Radio I nt erface I m provem ent s

Figure 1 8 - UMTS Rel. 5 Basic Archit ect ure

All net work node int erfaces connect ed t o I P net work

Break ing hierarchical m apping of RNCs t o SGSNs ( MSCs)

Wideband AMR ( new 16 kHz codec)

Figure 1 9 - Overview of I MS archit ect ure

Figure 1 10 - HSDPA Prot ocol Archit ect ure

Figure 1 11 - Hierarchical RNC < - > SGSN relat ion

Figure 1 12 - I uFlex Basic Descript ion

Figure 1 13 3GPP UMTS Rel. 6 Net work Model

Figure 1 14 - WLAN/ UMTS Support Archit ect ure

Pu sh - t o- Ta lk ove r Ce llu la r ( PoC) se r vice

Pa ck e t Sw it che d St r e a m in g Se r vice s ( PSS)

Mult im edia Broadcast and Mult icast Serv ice ( MBMS)

Figure 1 15 - UMTS I nt erface Overview

I uPS ( Packet Sw it ched) , corresponding int erface t owards t he PS dom ain

Relocat ing serving

Changes t he serving RNC funct ionalit y as

Set s up, m odifies, and releases RAB

Allows placing som e request ed RABs int o

Request ing RAB

Request s t he release of RAB ( Overall RAB

Explicit ly releases all resources relat ed t o

Request s release of all I u connect ion

connect ion resources

resources from t he corresponding I u

Logical O&M of Node

I ub Link Managem ent

Radio Net work Configurat ion

I m plem ent at ionSpecific O&M

Syst em I nform at ion

Traffic Managem ent

Traffic Managem ent

Traffic Managem ent

Tim ing and

Adm ission Cont rol

Radio Link Managem ent , Radio

Channel Allocat ion / Deallocat ion

Table 1 1 I ub Funct ion Overview

Transport Net w ork Managem ent