LTE and GSM UMTS Interworking Award Solutions PDF

LTE and
GSM/UMTS
Interworking
Award Solutions, Inc. www.awardsolutions.com +1-972-664-0727
Award Solutions’ eBook is authorized for a single user only. Do not distribute.
2100 Lakeside Blvd., Suite 300
Richardson, TX 75082
Phone: +1.972.664.0727
Fax: +1.972.664.0729
If you have any questions, concerns or comments regarding this course please write to us at:
friends@awardsolutions.com
© 2012 Award Solutions, Inc.
All rights reserved. This course book and the material and information contained in it ("course material") are
owned by Award Solutions, Inc. ("Award"). The course material shall not be modified, reproduced,
disseminated, or transmitted by or in any medium, form, or means, electronic or mechanical, including
photocopying, recording, or any information retrieval system, in whole or in part, without the prior express
written consent of Award. The unauthorized use, modification, reproduction, dissemination or transmission of
the course material, in whole or in part, is strictly prohibited.
This course book is designed to be distributed as a student guide with the courses taught by Award’s
authorized employees and contractors. It is not designed to be a standalone text book. Award makes no
representations or warranties and disclaims all implied warranties with respect to the information contained
herein or products derived from use of such information and undertakes no obligation to update or otherwise
modify the information or to notify the purchaser or user of any update or obsolescence. Award’s total liability
in connection with the course material is the amount actually received by Award from the purchaser/user for
the purchase of the course material.
The 3GPP, LTE and LTE-Advanced logos are the property of Third Generation Partnership Project (3GPP). The
3GPP2 logo is property of Third Generation Partnership Project (3GPP2) and its organization partners. The
content of this document is based on 3GPP/LTE and 3GPP2 specifications which are available at
www.3gpp.org, and www.3gpp2.org.
Overview of Services
Award Solutions, Inc. has more than 15 years We offer a multitude of delivery methods and services:
of training excellence in advanced wireless and IP
technologies. Our products and services provide our clients On-site Training: Expert-led training held at your
with innovative, flexible, and cost-effective solutions that facility. This is a great option for teams with 12 or
help rapidly boost workforce productivity and competence more people.
to more quickly meet market demands.
Virtual Training: Expert-led training delivered
Our areas of expertise include: online in real-time. This is a great option for
teams geographically dispersed.
• 4G • Cloud Computing
• HSPA+ • M2M Public Training Events: Expert-led training
• LTE • UCC delivered at Award Solutions’ training facility or
• EPC • IP Convergence in conjunction with industry events. These events
• LTE-Advanced • IPv6 are best-suited for individuals or small groups of
• TD-LTE • MPLS professionals. Visit our website at
• VoLTE • IMS www.awardsolutions.com to view the latest
schedule.
The level of technical depth in our training programs gives
students unique benefits that they can apply immediately. Self-Paced eLearning: An engaging,, cost-
We offer a range of courses appropriate for audiences effective solution, allowing individuals to take
needing a high-level overview, as well as engineers looking training online at their own pace when their
for technical details. schedule permits.
Knowledge Services Consulting Services: Our goal is to help our

Our Subject Matter Experts (SMEs) and consultants clients maximize the use of their investment and
are best-in-class, having achieved substantial industry precious resources. We specialize in emerging
experience in areas such as product definition and technologies and technology transitions.
development, network deployment, and network and Knowledge transfer is an inherent part of every
systems engineering. We strive to help our students and engagement.
customers “become an expert”.
If you are interested in or have any questions regarding
Award Solutions constantly keeps a finger on the pulse of Award Solutions training or services, please visit Award’s
the industry, always researching new technologies, and website at www.awardsolutions.com or contact us at
updating our curriculums to stay on the cutting edge. +1-972-664-0727 ext. 306.
Whether you are a training manager responsible for a large Our Promise
organization, or a team lead responsible for enhancing your To continually demonstrate our core values: Integrity,
team’s skills, Award Solutions can meet your technology Expertise, Flexibility, Teamwork and Excellent Return on
training needs. Investment.
Award Solutions, Inc. www.awardsolutions.com +1.972.664.0727 v13.1

Instructor Led Training
Technology for Business IP Convergence & IMS

* Enterprise IP Network Connectivity...................................1 hour IP Convergence Essentials................................................. 1 day
* Compare and Contrast Cellular Technologies................2 hours Ethernet Backhaul Essentials............................................ 1 day
* The World of Enterprise...................................................4 hours Exploring IPv6...................................................................... 1 day
Cloud Computing Essentials for Business..................... 1/2 day Exploring MPLS..................................................................2 days
The M2M Ecosystem.......................................................... 1 day Exploring IMS (R8).............................................................3 days
Unified Communications (UC) and IMS for the Enterprise.... 1/2 day * Exploring SIP, VoIP and IP Convergence with IMS............4 days
IP Convergence for Sales and Marketing.......................... 1 day Exploring Ethernet Backhaul.............................................2 days
LTE Services for Enterprise Customers.............................. 1 day Voice and Video over IP Protocols and Technologies......................2 days
Technology Trends for Business........................................2 days Exploring IP Routing and Ethernet Bridging.....................2 days
* The World of App Development.......................................... 1 day Ethernet Backhaul Planning..............................................3 days
* The Mobile Enterprise......................................................... 1 day * SIP and Diameter for IMS/VoLTE......................................2 days
* Exploring Cloud Computing Service Models....................2 days
* Exploring Infrastructure as a Service (IaaS).....................2 days
* Exploring the Service Oriented Architecture (SOA)..........2 days
4G LTE
The Road to LTE................................................................... 1 day
LTE Essentials..................................................................... 1 day
LTE Technology Overview...................................................2 days UMTS/HSPA+
Exploring IPv6 for LTE Networks........................................2 days Exploring UMTS (WCDMA).................................................2 days
VoLTE and IMS in LTE-EPC Networks................................3 days Exploring HSPA+ (R7, R8 & R9)........................................2 days
Mastering LTE Air Interface...............................................2 days Multi-Carrier HSPA+ (R8 & R9)........................................... 1 day
LTE Protocols and Signaling..............................................3 days Mastering UMTS Core Networks (R99 to R7)...................3 days
Mastering TD-LTE Air Interface..........................................2 days Mastering UMTS Radio Protocols and Signaling..............4 days
LTE and GSM/UMTS Interworking.....................................2 days Mastering HSPA Protocols and Signaling.........................3 days
LTE-EPC Networks and Signaling......................................3 days HSPA+ Protocols and Signaling.........................................2 days
LTE-Advanced Technical Overview....................................2 days IMS in UMTS (R8) Networks..............................................3 days
LTE RF Planning and Design Certification Workshop......5 days 3GPP Packet Core Networks (R99 to R8).........................3 days
LTE RAN Signaling and Operations Certification..............5 days UMTS/HSPA/HSPA+ Air Interface.....................................3 days
* LTE-EPC Capacity Planning Certification Workshop.........4 days UMTS/HSPA (WCDMA) RF Design Mentoring...................5 days
* LTE RAN Capacity Planning Certification Workshop........3 days UMTS (WCDMA) RF Optimization Mentoring................. 10 days
UMTS/HSPA+ RF Optimization Workshop........................4 days
Emerging Trends
Wi-Fi Technical Overview...................................................2 days Wireless Landscape
Exploring Wireless Landscape, IP Convergence, and 4G......2 days
Exploring Wireless Technologies and Networks...............5 days
Fundamentals of RF Engineering......................................2 days
* New Course Exploring GSM/EGPRS/UMTS/HSPA/HSPA+...................5 days
GSM Performance Workshop............................................3 days
1x and 1xEV-DO Fundamentals........................................2 days
Wireless and 3G/4G Basics............................................... 1 day

Self-paced eLearning
4G LTE UMTS/HSPA+
Welcome to LTE (e).............................................................1 hour Welcome to UMTS (e).................................................. 1.5 hours
LTE Overview (e)...............................................................3 hours Overview of UMTS (e).......................................................2 hours
LTE SAE Evolved Packet Core (EPC) Overview (e)..........3 hours UMTS/WCDMA Air Interface Fundamentals (e).............3 hours
LTE Air Interface Signaling Overview (e).........................3 hours UMTS Signaling (e)...........................................................1 hours
VoLTE Overview................................................................3 hours UMTS Mobility (e).............................................................1 hours
* Overview of IPv6 for LTE Networks..................................3 hours HSDPA (R5) (e).................................................................3 hours
HSUPA (R6) (e)............................................................. 2.5 hours
HSPA+ Overview (R7) (e).................................................4 hours
Emerging Trends
Overview of OFDM (e)......................................................2 hours
Multiple Antenna Techniques (e)....................................3 hours Wireless Landscape
Wi-Fi Overview (e).............................................................3 hours Welcome to Wireless Networks (e)...................................1 hour
Welcome to GSM/GPRS (e)......................................... 1.5 hours
1xEV-DO Networks (Rev 0) (e).........................................3 hours
1xEV-DO Networks (Rev A) (e).........................................3 hours
IP Convergence & IMS Overview of 3G Wireless Networks (e)........................ 1.5 hours
Welcome to IP Networking (e).........................................3 hours Overview of WiMAX (e).....................................................3 hours
IP Convergence Overview (e)...........................................4 hours
Overview of MPLS (e)................................................... 3.5 hours
Overview of IMS (e)...................................................... 2.5 hours
Voice and Video over IP (VoIP) Overview (e)...................3 hours
IP Quality of Service (QoS) (e).........................................3 hours
Session Initiation Protocol (SIP) (e).................................2 hours
Ethernet Backhaul Overview (e)......................................3 hours
IP Basics (e)........................................................................1 hour
IP Routing (e)......................................................................1 hour
QoS in IP Networks (e).......................................................1 hour
TCP and Transport Layer Protocols (e)..............................1 hour
Ethernet Basics (e).............................................................1 hour
Ethernet VLANs (e).............................................................1 hour
Ethernet Bridging (e)..........................................................1 hour
Interconnecting IP Networks (e)........................................1 hour
Welcome to IPv6 (e)...........................................................1 hour
(e) eLearning Course

Table of Contents
Chapter 1
Interworking - Executive Summary ................................................................................................................ 1
Evolution ........................................................................................................................................................... 3
Interworking Architecture ................................................................................................................................ 7
Examples of Interworking Scenarios ............................................................................................................ 13
Chapter 2
Interworking Network Architecture ............................................................................................................. 19
Network Architectures and Interfaces .......................................................................................................... 21
UMTS and GSM/EDGE Architecture ............................................................................................................. 30
Interfaces and Protocols ............................................................................................................................... 35
Network Identities .......................................................................................................................................... 44
Chapter 3
Initial Session Setup ..................................................................................................................................... 49
LTE Attach and Default Bearer Setup........................................................................................................... 51
UMTS/EDGE PDP Context Establishment .................................................................................................... 65
Additional Material......................................................................................................................................... 78
Chapter 4
Connected-Mode Interworking ..................................................................................................................... 83
LTE Measurement Procedure ....................................................................................................................... 87
UMTS Measurement Procedure.................................................................................................................... 96
Handover Examples -- S4 SGSN ............................................................................................................... 104
LTE_304 Version 1.7 i

Table of Contents
LTE-to-UTRAN Handover (S4-SGSN) ........................................................................................................... 115
LTE-to-UTRAN Pre-R8 (Gn SGSN) ................................................................................................................ 122
UTRAN-to-LTE (Gn SGSN) ............................................................................................................................ 125
E-UTRAN-GERAN Handover ......................................................................................................................... 132
Additional Material ...................................................................................................................................... 137
GERAN <-> LTE IRAT Examples ................................................................................................................... 139
LTE-to-GERAN CCO + NACC ......................................................................................................................... 143
GERAN-to-LTE PS Handover ........................................................................................................................ 145
Chapter 5
Idle-Mode Interworking...............................................................................................................................151
Device States and IRAT Mobility Procedures ............................................................................................. 153
Idle-Mode Interworking ................................................................................................................................ 160
IRAT Cell (Re)selection ................................................................................................................................ 170
LA/TA Updates ............................................................................................................................................. 180
Idle-State Signaling Reduction (ISR) .......................................................................................................... 188
Combined LAU/TAU ..................................................................................................................................... 191
Additional Information: PLMN Selection .................................................................................................... 195
Chapter 6
Circuit-Switched Interworking....................................................................................................................201
Voice in LTE .................................................................................................................................................. 203
IMS Overview................................................................................................................................................ 205
CS Fallback................................................................................................................................................... 212
ii Award Solutions’ eBook is authorized for a single user only. Do not distribute.
Table of Contents
SR-VCC .......................................................................................................................................................... 222
IMS Service Centralization and Continuity ................................................................................................. 228
Support for SMS........................................................................................................................................... 233
Acronyms .....................................................................................................................................................239
References...................................................................................................................................................247
Award Solutions’ eBook is authorized for a single user only. Do not distribute. iii
1 | Interworking - Executive Summary
Chapter 1:
Interworking -
Executive Summary
Award Solutions Proprietary
1
Objectives
After completing this module, you will be able to:
• Illustrate the evolutionary steps of UMTS and
LTE
• Analyze the key differences between UMTS and
LTE architecture
• Explain the two architectural options for
interworking GSM/UMTS with LTE networks
• Describe the options for supporting voice and
SMS
Chapter References:
[1] 23.401 – General Packet Radio Service (GPRS)
enhancements for Evolved Universal Terrestrial Radio
Access Network (E-UTRAN) access
[2] 36.300 – E-UTRA and E-UTRAN Overall Description
(Stage 2)
[3] 36.331 - Evolved Universal Terrestrial Radio Access (E-
UTRA) Radio Resource Control (RRC)
[4] 36.211-36.214: Physical Layer related documents
2
Evolution, Goals and

Challenges
3
3GPP Evolution: Toward LTE-Advanced

Release 10 Release 11
Release 99 LTE-Advanced (3 Gbps DL CoMP
Voice, 2 Mbps (384 Release 6 and 1.5 Gbps UL)
kbps) data rate HSUPA (5.76 Mbps UL)
Release 8
LTE (300 and
R 11
Release 4 75 Mbps)
Bearer-independent R 10
CS architecture
R8 R9
R 99 R6
R7
R4
R5 Release 9
Emergency calls
using IMS
Release 5
HSDPA (14 Mbps DL) Release 7
HSPA+ (21/28 Mbps)
For LTE, the evolutionary process has been a while in the Broadcast/Multicast Services (MBMS).
making, and is not likely to end anytime soon. Each 3GPP
• R7 provided further enhancements to HSDPA and
standards release since the original UMTS specification
HSUPA, called HSPA+. Support for higher-order
has continued to add to and expand the capabilities of the
modulation and Multiple Input Multiple Output
network:
(MIMO)-antenna systems offered a significant
• Release 99 (R99) defined the original UMTS system, increase in data rates, potentially up to 42 Mbps.
supporting circuit voice services as well as theoretical
• R8 defined the Long Term Evolution (LTE) system,
peak data rates of up to 2 Mbps. Commercial
starting the transition to 4G technology, while R9
systems delivered packet data services of up to 384
adds further enhancements and capabilities,
kbps.
including support for MBMS, the definition of Home
• R4 defined a bearer-independent circuit-switched eNBs for improved residential and in-building
architecture, separating switches into gateways and coverage, and support for IMS-based emergency
controllers, and laying the groundwork for the IP calls.
Multimedia Subsystem (IMS).
• R10 defines LTE-Advanced, offering support for (8x8)
• R5 defined High-Speed Downlink Packet Access MIMO in the downlink, channel aggregation up to 100
(HSDPA), which boosted packet data rates to 14 MHz, and relays.
Mbps on the downlink. R5 also completed the design
• Enhancements to LTE-Advanced are being
of IMS.
incorporated in R11 and beyond. For example,
• R6 increased data rates to more than 5 Mbps on the Coordinated Multipoint (CoMP) transmission and
uplink with High-Speed Uplink Packet Access reception are part of R11.
(HSUPA), and introduced support for Multimedia
4
2G/3G Architecture Attributes

Voice over
CS Two core networks with
MSC different services and
requirements
CS
Wireless Core Network
ATM/IP
Backhaul
UTRAN/ Best effort
PS PS-CN
Air interface GERAN (SGSN and data
juggling CS GGSN)
and PS
Increasing data
rates over 10 year
evolution
2G and 3G networks have two types of core networks, a

Circuit Switched-Core Network (CS-CN) and a Packet
Switched-Core Network (PS-CN). Both core networks are
supported by a single radio network. Voice services are
supported using the circuit switched network and packet
services are supported using the packet switched core
network. The radio interfaces support bursty traffic for the
packet domain and traditional telephony traffic for the CS
domain. The UMTS Terrestrial Radio Access Network
(UTRAN) consists of Node Bs and Radio Network
Controllers (RNCs). The GSM EDGE Radio Access Network
(GERAN) is composed of BTS and Base Station Controllers
(BSC). The MSC/VLR (Mobile Switching Center/Visiting
Location Register) or the MSC-S (MSC- Server) and MGW
(Media Gateways) are the key elements in the circuit-
switched core network. The Serving GPRS Support Node
(SGSN) and the Gateway GPRS Support Node (GGSN) are
the two key elements in the packet-switched core
network. The Home Location Register (HLR) maintains a
common database for both domains.
5
LTE Architecture Attributes

Evolved Packet
Core (EPC) PCRF
MME
HSS IP
Multimedia
System
PDN Gateway
Serving Gateway
(P-GW)
(S-GW) Internet
E-UTRAN
• An ALL-IP Network
UE • A single core network
• Handles mixture of real-time and non-real-time services
via comprehensive QoS architecture
The new entities in the Evolved Packet Core (EPC) consist • S-GW (Serving Gateway): The serving gateway is
of the Mobility Management Entity (MME), the serving responsible for anchoring the user plane for inter-
gateway (S-GW), the PDN gateway (PDN-GW) and the eNB handover and inter-3GPP mobility. Its anchor
ePDG. EPS focuses on the enhancement of packet- functionality is like a GGSN in a pre-LTE architecture.
switched technology to cope with rapid growth in IP traffic, This is like an SGSN without the mobility/session
higher data rates, lower latency and a packet optimized functionality and with minimal data bearer
system. functionality. It will support lawful interception.
• MME (Mobility Management Entity): It is responsible • P-GW (Packet Data Network Gateway): This gateway
for managing and storing UE contexts, generating is responsible for anchoring the user plane for
temporary identifiers to the UEs, idle state mobility mobility between 3GPP access systems and non-
control, distributing paging messages to eNBs, 3GPP access systems. It is like an HA (Home Agent)
security control, and EPS bearer control. in MIP, and it will provide support for charging, lawful
interception and policy enforcement.
• Gateways: There are two gateways in LTE, one
terminating towards the E-UTRAN and one • PCRF (Policy Charging Rule Function): The
terminating towards the external packet data introduction of IMS has separated the SIP signaling
network. These two are called the serving gateway that negotiates the bearer capabilities for a session
and the PDN gateway, respectively. A UE has only one from the actual bearer establishment procedure in
serving gateway at any instance. However, it can have the EPC. PCRF is a means by which the IMS and EPC
multiple PDN Gateways if it is connected to multiple interact to create a bearer with the agreed upon QoS.
PDNs. These two gateways may co-exist. This interaction is also required to tie up the signaling
and bearer for billing purpose. This also is taken care
of by the PCRF.
6
Interworking
Architecture
7
Inter-RAT Requirements
R99 or later
USIM-based Maintain voice
authentication quality during and
after handover
Inter-PLMN Support for

handover minimal impact
support to 2G/3G
No loss of
data during
Optimized handover
active mode
Mobility
Online and
offline QoS backward
Idle mode
charging compatibility
mobility
The EPS architecture is required to meet the following • Support of optimized active mode mobility: The
requirements: mobile must be able to transition between networks
when in active mode such that the operation is
• Voice Quality: when handing over a voice call from
optimized with respect to delay and packet loss.
LTE to UMTS or GSM, the maximum delay should be
less than 300ms. Quality should be maintained • Authentication using R99 or later USIM must be
during and after the handover. This applies to all real- supported though new applications and parameters
time services. For non-real-time services the delay may be supported. After an IRAT handover there is
should not exceed 500ms. no requirement to re-authenticate.
• No loss of data during handover • Support for all existing 3GPP charging models must
be supported. Online and offline charging should be
• EPS should support QoS backward compatibility, i.e.,
supported.
EPS should provide QoS levels that are equivalent to
existing UMTS QoS levels. In addition, the system • In addition, mobile devices, if supporting LTE in
should support a change of QoS during handover addition to either UMTS or GSM, should support
when the new system does not support the same QoS measurements and handover to and from both UMTS
as the old. and GSM.
• Support of idle mode mobility. The mobile must be
able to transition between networks when in idle
mode.
8
Two Interworking Options

LTE – UTRAN/GERAN Interworking
Option 1 Option 2
S4-SGSN Gn- SGSN
• SGSN is upgraded with R8 • SGSN – No Change

I/W features – Less costly option
– More costly option – Lower performance
– Better performance
UTRAN/GSM Radio Network upgrade for LTE measurements
LTE supports interworking with other 3GPP access SGSN and GGSN. The interworking is achieved by having
systems. LTE provides service continuity in 3GPP and non- the EPC implement the protocols and procedures of the
3GPP, i.e., the UE communicates using the same IP existing GPRS core network. While less costly to deploy,
address independently of the access network it is this solution has performance drawbacks.
attached to.
The advantages of the S4 SGSN over the Gn SGSN
3GPP has defined two options for interworking between solution include:
LTE and 3GPP technologies.
• support for a signaling reduction feature which results
Option 1 requires enhancements to the SGSN to support in improved capacity and improved UE battery life
new interfaces to the EPC. These enhancements are
• with the S4 SGSN solution, direct tunneling of user
defined in Release 8, and this option is sometimes
data from the RNC will be possible for roaming users
referred to as the “Release 8 SGSN” option. Alternatively,
it is known as the S4-SGSN option due to the support for
the S4 interface between SGSN and SGW. This option is
more costly to deploy as the existing GPRS networks need
to be upgraded. However, the advantage is better
performance.
Option 2 provides a solution that allows minimal impact to
the existing network. In this option, the SGSN does not
change from R7 or earlier releases. It is known as the pre-
R8 option, or alternatively, the Gn-SGSN option. That is
due to the support for the traditional Gn interface between
9
Two Interworking Options (continued)

LTE – UTRAN/GERAN Interworking
Option 1 Option 2
S4-SGSN Gn- SGSN
• SGSN is upgraded with R8 • SGSN – No Change

I/W features – Less costly option
– More costly option – Lower performance
– Better performance
UTRAN/GSM Radio Network upgrade for LTE measurements
The SGSN plays a key role in both solutions, and the

GGSN plays no role at all. Both options require some
changes in the UTRAN and GSM radio networks if
handover performance is to meet the requirements. In
order to allow a mobile device to handover from 2G or 3G
to LTE, it needs to be informed about the LTE frequencies
operating in the area. So at a minimum, it is expected that
the UMTS RNC and the BSC will provide the necessary
Release 8 functionality.
A third option which could be deployed requires no
changes to the UMTS or GSM networks. The mobile device
can independently decide to move between the LTE
network and the 2G or 3G network. In this case, there will
be no service continuity, and therefore may not be
acceptable to many operators.
10
Option 1: S4-SGSN
Enhanced to support:
1. S-GW, P-GW selection
2. MME selection
SGSN selection
3. Interface to HSS
S4-SGSN
MME
UMTS/GPRS S3
HSS
RNC S4
S11 LTE Core
S12
“Direct Tunnel” S5
P-GW
3GPP mobility S-GW
anchor P-GW anchors
the IP address
The equivalent of LTE MME in 2G/3G systems is the During handovers from LTE to UMTS/GPRS, MME selects
mobility management function of the SGSN. The the SGSN based on the UE’s location.
equivalent of the LTE S-GW in 2G/3G systems is the data
Even during UMTS/GPRS access, P-GW will be anchoring
bearer functionality of the SGSN. Along with the other
the IP address of a UE. For bearers or session, S-GW is the
functions of SGSN, SGSN is enhanced to support S-GW
anchor point but for the IP address P-GW is still the anchor
and MME selection functions. The key point to notice is
point. Network mobility would still be based on GTP or
that when a UE is using UMTS/GPRS access, the sessions
PMIP over the S5/S8 interface.
are anchored at the S-GW. So, a PDP context in
UMTS/GPRS will have an S4 bearer and an S5 bearer Note that the deployed network may for some time still
portion. An SGSN acts like an MME during the PDP contain GGSNs, which can support existing non-LTE-
context activation process. It selects the S-GW/MME and capable mobiles.
P-GW, and establishes the S4 bearer and S5 bearer.
During handover scenarios from UMTS/GPRS to LTE,
SGSN also selects the MME to which the UE is handing
over.
The serving S-GW is the anchor for the interworking of LTE
and other 3GPP access systems. It relays traffic between
2G/3G systems and the P-GW.
11
Option 2: Gn-SGSN
HSS
S-GW EPC
S5 P-GW (~GGSN)
E-UTRAN
S11 MME
(~SGSN)
Gn or Gp
Gn
HLR
UTRAN/ Gn SGSN
GERAN GGSN
Pre- Rel 8 PS-CN
• EPC emulates the R7 GPRS core network

• HSS and HLR data must be consistent
• The MME and P-GW support GTPv1-C
LTE supports interworking of LTE with legacy or Pre-Rel8

UMTS and GPRS SGSNs. This requires no changes to the
SGSN. MME acts like a peer SGSN and P-GW acts like a
GGSN to support mobility across LTE and Pre-Release 8
3GPP access systems. Gn or Gp (GTPv1-C)-based mobility
is used.
Gn is the interface used between two SGSNs in pre-Rel 8
architecture. The same interface would be used between
the MME and the SGSN. Gp or Gn is the interface used
between the SGSN and the GGSN in pre-Rel 8
architecture. The same interface would be used between
the P-GW and the SGSN. The IP address would be
anchored at the P-GW, even for access through
UMTS/GPRS. Gn and Gp are based on GTPv1-C.
In this solution, a key consideration is to ensure
consistency between the HSS and HLR data for the user.
The two databases could use a single dataset, or
procedures could be put in place to communicate
changes and synchronize. The standard does not
prescribe a solution, and therefore vendors will devise
proprietary ways to solve the issue.
12
Examples of
Interworking Scenarios
13
IRAT Mobility Scenarios

Example Scenarios
• UE is powered on. Which network
QoS, Security (2G/3G/4G) will it choose?
Parameters, Service
Continuity, IP Addressing, • The UE has an ongoing data session. What
Delays in Service, happens when the Idle or Connected Mode
Throughput Changes… UE moves between 3G and 4G coverage
areas?
• The UE is in a voice call, what happens when

it moves between 3G and 4G coverage areas?
IRAT • The UE has both voice and data services.

Challenges What happens when it moves between
2G/3G and 4G coverage areas?
An Explosion of IRAT Mobility Scenarios

Inter Radio Access Technology scenarios can be divided legacy network.

into different categories depending on the capabilities of
• Changing of access technology while in real time
the mobile device, the state of the mobile device (Idle or
circuit switched services such as voice. Like the
connected), the available radio access network types
previous scenario, this usually involves handing over
(combination of GERAN, UTRAN and E-UTRAN), and the
the call to the “lower-G” technology. In LTE voice will
type of services that may be in use during the handover
be packetized and is always handled as a voice over
period, such as non-real time packet services or circuit
IP.
switched services. Some example scenarios are:
• Combined Packet and Circuit services while doing an
• The UE (User Equipment) is just powered on, possibly
IRAT-handover. The capabilities of the network and
in a new location after it was shut down and is now
the UE determine which bearers will be handed over
faced with possible choices of multiple networks
to the other access technology.
(PLMNs) and access technologies.
All these scenarios pose challenges for the interworking
• A device which has already camped on a suitable cell
between LTE and GERAN/UTRAN. For example, besides
in a permitted network may need to change cells to a
the obvious challenge of maintaining the continuity of the
different technology based on signal strengths
service during the handover, the IRAT procedure must
perceived by the UE on each available technology.
also address changes in QoS, Latency, Throughput, Bearer
• While in active mode, the UE may be transmitting and Characteristics, etc. that come as a result of changing the
receiving data to a Packet Data Network. Due to access technology. The number of possible network
mobility, the UE may be handed over to the network combinations and configurations has resulted in an
with the wider coverage area, usually this scenario is “explosion” of IRAT scenarios. Only a few will be
about leaving the “higher-G” network to a “lower-G” implemented in real operation.
14
Voice and SMS Interworking Options

Starting a
voice call SMS
Circuit-Switched via MSC and MME via IMS

Fallback (CSFB) Voice over IP
(control plane) (user plane)
Voice call
handover
Single-Radio
Voice Call Continuity IMS Service
(SR-VCC) Continuity (ISC)
Assume that there is a hybrid LTE/legacy device. There SR-VCC allows an ongoing voice call to continue when the
are several basic ways of supporting such a device: VoIP UE leaves the LTE coverage area and enters a non-LTE CS
(Voice over IP) using One Voice Profile, Circuit-Switched coverage area. The IMS is used as an anchor for such
Fallback (CSFB), SR-VCC (Single-Radio Voice Call calls. While on the LTE, the UE uses VoIP, and while on the
Continuity), and IMS Service Continuity (ISC). CS, the UE has a regular circuit-switched call. The initial
version SR-VCC supports a one-way transition from LTE to
Since LTE is an all-IP packet-data network, supporting
CS (and NOT from CS to LTE).
voice using LTE is achieved via VoIP. One Voice Profile
specifies IMS-related features to support VoIP, using the ISC allows for bi-directional transitions between LTE and
LTE E-UTRAN and EPC. CS for voice and non-voice services. In the case of a dual-
transceiver UE, some services can be obtained via LTE
CSFB does not require the use of the IMS. When a hybrid
and other services can be received via CS.
UE needs to use voice services in an area where both an
LTE and legacy CS network (e.g., UTRAN, GERAN, or 1x)
are available, the UE uses the legacy CS network for the
voice call instead of the LTE. This would be quite useful
when VoIP is not supported by the LTE UE and/or the LTE
network in initial deployments. Whether the call is UE-
originated or UE-terminated, CSFB can be used. For a
voice call, the UE leaves the LTE air interface and starts
using the CS air interface. Once the call is over, the UE
comes back to LTE.
15
Summary
• LTE has evolved from UMTS. R8 is the first LTE
release and R10 is known as “LTE-Advanced.”
• IRAT handovers must achieve a minimal
interruption in services.
• Idle-mode and active-mode mobility procedures
have been developed to support interoperability.
• The S4-SGSN interworking approach utilizes new
interfaces for interoperability, but the Gn-SGSN
approach uses the existing interfaces.
• Various voice and SMS interworking options are
available.
16
Review Questions
1. Name three key differences between 3G and 4G
networks.
2. What are the two I/W architecture options for
interoperability and which option is expected to be
common in initial deployments?
3. What are the options for voice deployment?
4. What are the options for SMS deployment?
5. Is it possible to guarantee no loss of data during
IRAT handovers for all services?
17
18
2 | Interworking Network Architecture
Chapter 2:
Interworking Network
Architecture
19
Objectives
• Outline the Pre-R8 and R8 UMTS and GERAN
architectures
• Illustrate the interworking architecture between
LTE and UMTS/GSM/GPRS
• Sketch the network interfaces and protocols used
for interworking
• Describe the difference between GTPv2 and
GTPv1
Chapter References:
[2] 23.060 – General Packet Radio Service (GPRS);
Service description (Stage 2)
[3] 29.274 – Tunnelling Protocol for Control plane
(GTPv2-C); (Stage 3)
[4] 29.272 – Mobility Management Entity (MME) and
Serving GPRS Support Node (SGSN) related
interfaces based on Diameter protocol
[5] 29.060 – GPRS Tunneling Protocol (GTP) across the
Gn and Gp interface
[6] 24.301 – Non-Access-Stratum (NAS) protocol for
Evolved Packet System (EPS); (Stage 3)
20
Network Architectures
and Interfaces
21
LTE: Long Term Evolution

EPC (Evolved Packet Core)
• Simplified architecture
E-UTRA • IP-based services
• Downlink: 300 Mbps
• Uplink: 75 Mbps
• OFDM and MIMO E-UTRAN
• Simplified architecture
• Evolved Node B
• Radio Resource
Management by eNodeB
eNodeB
E-UTRAN Core
eNodeB
E-UTRAN + EPC = EPS (Evolved Packet System)

The 3G Partnership Project (3GPP) is responsible for Node (GGSN)) core network components. In LTE, the
defining the Long Term Evolution program for UMTS network is moving to simplified IP-based networks,
networks, called LTE. 3GPP focuses on three key areas: replacing the current network components with
Mobility Management Entities and Serving Gateways
• Evolved UMTS Terrestrial Radio Access (E-UTRA): This
(MME/S-GW) and Packet Data Network Gateways (P-
air interface is based on an OFDM physical layer and
GW).
utilizes MIMO techniques to increase the data rates.
It supports over 300 Mbps in the downlink to the User
Equipment (UE) and over 50 Mbps in the uplink,
using a scalable channel bandwidth of up to 20 MHz.
• Evolved UMTS Terrestrial Radio Access Network (E-
UTRAN): Unlike the Node B and Radio Network
Controller (RNC) of the UTRAN, the E-UTRAN has only
one node: the Evolved NodeB, or eNodeB. The
eNodeB is responsible not only for the physical layer
operations of OFDM and MIMO, but is also
responsible for scheduling of downlink and uplink
resources, handovers, and Radio Resource
Management (RRM).
• Evolved Packet Core (EPC): UMTS used circuit (Mobile
Switching Center (MSC)) and packet (Serving GPRS
Support Node (SGSN) and Gateway GPRS Support
22
Evolved Packet Core (EPC)
S6a
HSS PCRF
MME
Core
S1 S11 Gx
Services
(Internet,
SGi IMS, etc.)
E-UTRAN S1 S5/S8
S-GW P-GW
New entities in the Evolved Packet Core (EPC) include the PDN Gateway allocates the user’s IP address, and
Mobility Management Entity (MME), the Serving Gateway forwards packets intended for the user to the
(S-GW), and the Packet Data Network (PDN) Gateway. appropriate Serving Gateway. It also provides support
for charging, lawful interception and policy
• MME: The MME is responsible for managing and
enforcement.
storing UE contexts, generating temporary identifiers
to the UEs, idle state mobility control, distributing • PCRF (Policy and Charging Rules Function): The PCRF
paging messages to eNodeBs, security control, and functionalities include policy control decision and
EPS (Evolved Packet System) bearer control. flow-based charging control. PCRF is the main QoS
control entity in the network. It is responsible for
• Gateways: There are two gateways in LTE, one facing
building the policy rules that will apply to a user’s
towards the E-UTRAN (the Serving Gateway) and one
services, and passing the rules to the P-GW via the Gx
facing towards the external packet data network (the
interface. The policy rules indicate whether the P-GW
PDN Gateway). A UE has only one Serving Gateway,
should grant resource reservation requests, and if it
but it may have multiple PDN Gateways.
is allowed to process packets for a given IP flow. The
• Serving Gateway (S-GW): The Serving Gateway is PCRF may use the subscription information as a basis
responsible for anchoring the user plane for inter- for the policy and charging control decisions.
eNodeB handover and inter-3GPP mobility, similar to
a GGSN in a pre-LTE network.
• PDN Gateway (P-GW): This gateway is responsible for
anchoring the user plane for mobility between 3GPP
access systems and non-3GPP access systems.
Similar in nature to a home agent in mobile IP, the
23
Evolved Packet Core (EPC) (continued)
S6a
HSS PCRF
MME
Core
S1 S11 Gx
Services
(Internet,
SGi IMS, etc.)
E-UTRAN S1 S5/S8
S-GW P-GW
The key network reference points defined in LTE include: • SGi: This reference point is between the P-GW and
external packet data networks. The packet data
• S1-MME: This is the reference point for the control
network may be an operator-external public or private
plane protocol between the E-UTRAN and the MME.
packet data network, or an intra-operator packet data
• S1-U: This reference point is based on the GTPv1-U network (e.g., for provision of IMS services).
protocol between the E-UTRAN and S-GW. This
• S11: This reference point is between the MME and
interface supports EPS bearer user plane tunneling
Serving Gateway.
and inter-eNodeB path-switching during handover.
• Gx: The Gx interface supports the provisioning of
• S5/S8: This reference point between the Serving
policy and charging rules.
Gateway and P-GW can be GTP protocol-based, or
IETF-based. It supports mobility when the mobile
moves out of the scope of the Serving Gateway. If the
P-GW is in a different network (for roaming scenarios),
S8 is used instead.
• S6a: This reference point is based on the Diameter
interface. It is between the evolved packet core and
the HSS.
24
Mobility Management Entity (MME)

HSS User Profile
Authentication
Authentication Retrieval
S6a MSC-S
MME SGs
• Idle Mobility Management
NAS Signaling − Paging
− UE Location Tracking S-GW
− Tracking Area Management S11
S1-MME • Default Bearer Setup
− P-GW, S-GW Selection
• Lawful Interception
eNB
Gn S3
IRAT
IRAT Mobility
Mobility S4 Signaling
Gn
Signaling SGSN
SGSN
GSM/UMTS Networks
The MME is a node defined in LTE to handle the signaling It also plays a vital role in user authentication, and for that
functionality. MME stands for Mobility Management Entity. it consults HSS on the S6a interface. This enables transfer
The MME tracks and maintains the current location of of subscription and authentication data to a MME for
UEs. This allows the MME to page a mobile. It is also authenticating user access to the network. Based on
involved in MME selection for inter-MME handovers. The subscription data, the MME selects a P-GW, and then a S-
S10 interface between MMEs provides MME relocation GW, and finally establishes a bearer between the UE and
and MME-to-MME information transfer. The MME selects the P-GW.
the SGSN and performs inter-CN node signalling for inter-
3GPP handovers, i.e., with GPRS and UMTS, a S3
interface between SGSN and MME enables a user and
bearer information exchange for inter-3GPP access
network mobility.
The MME manages the UE identities and security-related
parameters. It controls security between UE and eNB (AS
security) and security between UE and MME (NAS
security). It is also responsible for signalling between the
UE and the MME.
25
Serving Gateway (S-GW)

MME Paging
trigger
S11
S-GW
• Packet data routing
• Local mobility anchor S5/S8
− i.e., inter-eNB handover PDN
• lawful interception GTP
GW
• idle mode buffering
eNB • IRAT mobility anchor
IRAT S12 S4
IRAT mobility
user plane signaling
S4
RNC/BSC and user plane
SGSN
GSM/UMTS Networks
The S-GW in LTE terminates towards the E-UTRAN, and a

UE has only one Serving Gateway at any instance. S-GW is
basically defined to handle user data functionality, and is
involved in routing and forwarding of data packets to P-GW
via the S5 interface. The S5 interface can be GTP-based
or PMIP-based, and is also used for Serving Gateway
relocation due to UE mobility. The S-GW is connected to
the eNB via the S1-U interface, which provides user plane
tunneling and inter-eNB handovers. The S-GW also
performs mobility anchoring for inter-3GPP mobility on the
S4 interface, which connects S-GW and 2.5/3G SGSN,
and the S12 interface, which connects the S-GW with the
UTRAN or GERAN when the direct tunnelling feature has
been implemented. The S-GW is also responsible for
Lawful Interception accounting on the user.
26
PDN Gateway (P-GW)

Policy and
charging rules
P-GW (HA)
PCRF
• Packet filtering
Gx
• DSCP marking
• Lawful interception
S-GW GTP • Charging
IMS
• DL rate enforcement
S5/S8
• Default router for UE
• Inter S-GW handover
• GGSN emulation
IRAT mobility Gn Internet

signaling
and user plane Gn
SGSN
GSM/UMTS Networks
The PDN Gateway is the node that connects the UE to IP flow. The P-GW is connected to the S-GW via the S5
external PDNs (Packet Data Network), and acts as the interface, and supports the establishment of data bearers
UE’s default router. A UE may be connected to multiple between the S-GW and itself.
PDNs through one or more PDN Gateway. The P-GW is
The P-GW can also support the Gn interface to connect to
responsible for anchoring the user plane mobility within
a 2.5G/3G SGSN for interoperability.
the LTE/EPC network, as well as for inter-RAT handovers.
The PDN Gateway may be responsible for the allocation of
an IP address to the UE during default EPS bearer set up.
Packet filtering of user traffic may be implemented at the
P-GW in support of QoS differentiation between multiple IP
flows. The P-GW supports Lawful Interception of user
traffic in support of government intelligence services
combating criminal activity. It also supports service level
charging by collecting and forwarding Call Data Records
(CDRs). It supports DL data rate enforcement, ensuring
that a user does not exceed his traffic rate subscription
level.
The Gx interface provides transfer of (QoS) policy and
charging rules from the Policy and Charging Rules
Function (PCRF) to the P-GW. The policy rules indicate
whether the P-GW should grant resource reservation
requests, and if it is allowed to process packets for a given
27
Home Subscriber Server (HSS)

• Stores user subscription, identification, service
profile, and location information
• Generates security-related information
• May be combined with HLR (not standardized)
Authentication
S6a S6d
MME S4 SGSN
HSS/HLR
Gr
S-GW
Gn SGSN
The HSS (Home Subscriber Server) is a master-user

database that stores subscription-related information to
support other call control and session management
entities. It is a storehouse for user identification,
numbering and service profiles. It incorporates HLR and
AuC subscriber data, as well as IMS-specific user
subscription information. It is involved in user
authentication and authorization in LTE networks. During
registration, the MME talks to the HSS via the S6a
interface for user authentication and ciphering
information. The HSS generates security information for
mutual authentication, integrity checking, and ciphering.
The HSS can also provide information about the user's
physical location. We can have one or more than one HSS
in a home network depending on the number of mobile
subscribers and the equipment capacity.
The HSS also supports communication with UMTS/GPRS
S4 SGSNs with the S6d interface which is equivalent to
the S6a interface. Some implementations may also
integrate the legacy Gr interface, allowing the Gn SGSN to
access the same subscriber information database as is
used in LTE.
28
Exercise: Many-to-One Mapping

Function Node
1. Authentication of the UE A. eNB
2. IP address assignment for the UE
B. MME
3. (Idle mode) UE location tracking
4. S1-U packet forwarding to/from
eNodeB C. S-GW
5. Paging to the UE via eNodeBs

D. P-GW
6. Subscriber database
7. Radio resource management E. HSS
29
UMTS and GSM/EDGE

Architecture
30
GSM/GPRS Changes
Internet
PSTN
GGSN
Gn
MSC
(MSC-S/MGW) Iu Gb SGSN
or or
Required Changes:
A • Upgrade of BSC to support:
BSC Iu
― SI 2quater (Info about E-
UTRAN)
― SI 5/measurement info
Optional Changes:
• Support for S4/S3
• Support for S6d
• Support for S12
• Support of NACC/RIM
• Support of CS Fallback
When a GSM/GPRS operator deploys an LTE network, The other changes are optional and will be discussed over
there are a number of possible changes that could be the next few pages. They are adding support for S4, S3,
made in the GSM/GPRS network to support and S6d interfaces to the SGSN; adding support for the
interoperability. It is very important to note that none of S12 interface to the BSC; adding support for network-
these changes remove the need for a new handset by the assisted cell change and radio interface messages to the
subscriber. Most of the changes are optional to support network; and, lastly, adding the support for CS Fallback to
interoperability, but there are a minimum number of the MSC or MSC-S.
changes that are required to support any level of
interoperability.
The first change is the only update that is required by the
BSC. The BSC needs to be updated to support
communicating the LTE neighbor information to the
mobile, receiving measurements from the mobile, and
making a handover decision to send the mobile to an LTE
network. The biggest changes are the addition of an SI 2
quater message on the broadcast channel to send the E-
UTRAN information to a mobile that is idle, and an SI 5 or
measurement information message that will be used to
communicate between LTE neighbors and the mobile that
is on a call.
31
UMTS/HSPA Changes
Internet
PSTN
GGSN
Gn
MSC SGSN
Iu Required Changes:
RNC Iu • Upgrade of RNC to support:
― SIB19 (Info about E-UTRAN)
― Measurement control
Optional Changes:
• Support for S4/S3
• Support for S6d
• Support for S12
• Support for CS Fallback
When a UMTS operator deploys an LTE network, there are The other changes are optional and will be discussed over
a number of possible changes that can be made in the the next few pages. They are adding support for S4, S3,
UMTS network to support interoperability. It is very and S6d interfaces to the SGSN; adding support for the
important to note that none of these changes remove the S12 interface to the RNC; and, lastly, adding the support
need for a new handset by the subscriber. Most of the for CS Fallback to the MSC or MSC-S.
changes are optional to support interoperability, but there
are a minimum number of updates that are required to
support any level of interoperability.
The RNC needs to be upgraded to support communicating
the neighbor information to the mobile, receiving
measurements from the mobile, and making a handover
decision to send the mobile to an LTE network. The
biggest changes are the addition of SIB 19 on the
broadcast channel to send the E-UTRAN information to a
mobile that is idle, and a measurement control message
that will be used to communicate LTE neighbors to the
mobile that is on a call.
32
Gn SGSN Interworking
P-GW acts as a GGSN
P-GW MME acts as an SGSN
MME (GGSN)
(SGSN) Gn (or Gp)
(Example usage: PDP context related
Gn (or Gp) signaling, user traffic transfer)
(Usage: HLR
Inter-RAT SGSN
MAP/SS7
Handover
Signaling)
BSC or RNC
As mentioned above, the minimum number of changes

that need to be made are shown in this chart. In this case,
the BSC or RNC has been upgraded to support the
communication of LTE neighbors for the sake of
measurements. Beyond a new software load in the BSC or
RNC, there is no change to the network. This configuration
is referred to as the Gn SGSN configuration.
33
S4 SGSN Interworking
P-GW
S5
S11
S-GW MME
S4 S3 IRAT Handover
• Creation of EPS Bearers Signaling
• User Traffic
SGSN S6d
S12
HSS
• User Traffic BSC or RNC
(Direct tunnel:
Bypass SGSN)
The first significant change that may take place to the are a number of Attribute Value Pairs (AVP) that have
SGSN is referred to as the S4 SGSN configuration. In this been developed to support all of the data that was
case, the SGSN has been upgraded to support the S3 previously communicated with the Mobility Application
interface to a MME for the sake of establishing a data Protocol (MAP).
session. The SGSN will also be configured with the S4
interface for the sake of supporting the user data.
The next architectural change is based on the direct
tunneling feature. The direct tunneling feature was a
Release 7 feature that allowed the RNC or BSC to directly
connect to the GGSN for the delivery of packets. In this
architecture, the S12 interface has been added between
the S-GW and the BSC or RNC. This interface supports the
direct tunneling feature. For the BSC, the S12 interface is
only available as an option if the BSC has been enhanced
to support Iu.
Also shown on this slide is an optional interface called the
S6d interface. This is an update to the SS7-based Gr
interface that was used to communicate with the HLR. The
S6d interface is a Diameter-based interface where there
34
Interfaces and
Protocols
35
S3/S4 (Control Plane) Interface

• Creation of Sessions GTPv2-C
and Bearers
UDP
• Enable IRAT handovers
IP
Data link layer
Physical layer
IP S3
S4 SGSN MME
S4
S-GW
The S3 interface is responsible for delivering a signaling

protocol between the SGSN and the MME. The S4
interface is responsible for delivering a signaling protocol
between the SGSN and the S-GW. The protocol used is
GTPv2-C application signaling protocol. The S4 interface is
responsible for EPS bearer setup/release procedures
when a UE is in a GSM or UMTS network. The S3 interface
is responsible for the handover signaling procedure as a
mobile moves from the GERAN/UTRAN to the LTE
network.
36
S4/S12 (User Plane) Interface

User plane PDUs
GTPv1-U
UDP
IP
Data link layer
Physical layer
IP
GTP Tunnel
S4 SGSN S-GW
or • S4 connects to the SGSN
RNC/BSC • S12 connects to the RNC or BSC
The S4 and S12 interfaces are used to send user data to

a UE that is in a GERAN or a UTRAN. The S4 interface
connects the S-GW to a SGSN. The S12 interface connects
the S-GW to the RNC or BSC, and is used when the direct
forwarding feature is implemented.
37
S6d Interface
Diameter
SCTP
IP
Data link layer
Physical layer
IP
S4 SGSN HSS
• Uses the same Diameter messages and parameters as the S6a interface
Diameter is used to talk to HSS. The main function of

the HSS is to give the subscriber information to the
NAS servers in any access system. It also provides
the authentication information and stores the current
NAS server to which the UE is registered. The S6d is
used to support authentication and authorization
procedure for a UE using GERAN and UTRAN access.
The S6d interface is very similar to the S6a interface
that is used by the MME to communicate to the HSS.
They use the same set of messages and parameters.
38
Gn/Gp Interface
User Plane
User plane PDUs Control Plane
GTPv1-U GTPv1-C
UDP UDP
IP IP
Data link layer Data link layer
Physical layer Physical layer
IP
GTP Tunnel
Gn SGSN P-GW (~GGSN)
• Note that the Gn SGSN also interfaces to MME via Gn and GTPv1-C for mobility
It is not a requirement for the SGSN to support the new S3

and S4 interfaces. If the SGSN has not been upgraded, it
is referred to as a Pre-Release 8 SGSN or a Gn SGSN.
Therefore, the Gn and Gp interfaces that have been in
place since Release 99 of the standard are used. The Gn
SGSN connects to the P-GW as if it is a GGSN and uses
the same protocols as is used in UMTS or GPRS. And for
mobility across SGSNs, the Gn SGSN connects to the MME
as if it is an SGSN and uses the same protocols as is used
in UMTS or GPRS.
39
Gr Interface
MAP
TCAP
MTP3
MTP2
MTP1
IP
Gn SGSN, or, HLR

S4 SGSN
SGSN uses MAP to retrieve subscriber profiles and security parameters
The Gr interface is a SS7-based interface that is used by

the SGSN to retrieve the subscriber profile and security
parameters from the HLR. The Gr interface may still be
used even if the SGSN has been updated to support the
S4 interface.
40
GTPv1-C and GTPv2-C
GTPv1-C GTPv2-C
Bearers Primary, secondary, Default, dedicated, EPS
NSAPI bearer ID
QoS UMTS QoS LTE QoS
Single set of Create or modify Create or modify

messages bearers for one session bearers for multiple
sessions
CS Fallback and ISR Not supported Supported
interactions
GTPv2-C is enhanced to support the new bearer features When ISR is activated, the idle UE could be camped on
and LTE QoS. GTPv1-C supported messages to create either LTE or UTRAN. When the UE is CS-Attached via the
bearers for primary and secondary PDP contexts. GTPv2- MME and receives a CS Page GTPv2-C supports the
C supports messages to create default and dedicated forwarding of a CS Paging message to the SGSN so that
bearers. Every dedicated bearer is associated with a the UE can be paged simultaneously in both networks.
default bearers. So Linked Bearer ID parameter is added.
The EPS Bearer ID identifies the bearers instead of
NSAPIs (Network layer Service Access Point Identifier).
PDP contexts are identified by NSAPIs in UMTS/GPRS.
The LTE QoS definition is different from the UMTS/GPRS
QoS definition. Hence, a new QoS parameter is used. A
set of dedicated bearers can be added, deleted, etc. with
one set of signaling messages.
The messages related to 3GPP UMTS <-> GPRS
interworking are used for LTE <-> GPRS/UMTS
interworking. Some of the key messages are Identification
Request, Context Request/Response/Acknowledge,
Forwards Relocation Req/Res/Ack, Forward SRNS
Relocation Req/Res/Ack message.
41
SGs (Control Plane) Interface

SGsAP
SCTP
IP
Data link layer
Physical layer
IP
MME MSC or
MSC-S
Used for CS Fallback and SMS interworking
One additional option that may be implemented is the CS

Fallback option. It is an option where all voice calls will be
forced back to the 2G or 3G network and LTE will only be
used for packet data services. The CS Fallback option
needs a connection to the MSC or the MSC server. This
connection is referred to as the SGs interface and is
similar to the Gs interface that was designed for GPRS. It
has its own protocol called the SGsAP protocol.
42
True or False Exercise

1. In the case of S4-SGSN interworking, the S-GW acts as a
local mobility anchor and forwards the user traffic to the
eNodeB or a legacy network.
2. The P-GW allocates an IP address to the UE for both S4-
SGSN interworking and Gn-SGSN interworking.
3. The interfaces such as S3 and S4 use GTPV1-C, while the
interface Gn uses GTPV2-C for signaling.
4. MME participates in Inter-RAT signaling in cases of both
S4-SGSN interworking and Gn-SGSN interworking.
5. The S10 interface enables implementation of the direct
tunnel feature by bypassing the SGSN for user traffic.
43
Network Identities
44
Key Interworking Identifiers

3GPP
Core
Bearer Network
UE
Common Network IDs

Common UE Identities
•PLMN Identity
• IMEI and IMSI
LTE Network IDs
• TIN
•Global MME Identity (GUMMEI)
LTE Identities
•MME Code (MMEC)
• GUTI and S-TMSI
•Tracking Area identity (TAI)
UMTS/GPRS Identities
UMTS/GSM Network IDs
• TMSI & P-TMSI
•Routing Area Identity (RAI)
•Network Resource ID (NRI)
•Location Area identity (LAI)
The following are the UE identities that are most relevant • GUTI (Globally Unique Temporary Identity): The GUTI
to interworking: is allocated to a UE by the MME. The GUTI contains a
globally unique MME identifier and the UE ID within
• International Mobile Equipment Identity (IMEI): The
the MME. It is a concatenation of GUMMEI and M-
IMEI is a mobile equipment serial number.
TMSI. A shorter version of the GUTI, the S-TMSI is
• International Mobile Subscriber Identity (IMSI): The used for paging the mobile.
IMSI is a 15-digit identifier defined by the
• Packet-TMSI (P-TMSI): The P-TMSI is a temporary
International Telecommunication Union (ITU). IMSI
identifier that the SGSN assigns a mobile station in
contains Mobile Country Code (MCC), Mobile Network
UMTS or GPRS. The P-TMSI is four octets and is used
Code (MNC), and Mobile Identifier. An IMSI provides
for paging over the air.
unique identification of a mobile globally. This
provides international roaming capabilities. The IMSI – Note: The Temporary Logical Link Identifier, or
is used as the primary index to the users subscription TLLI, is an equivalent identity in GSM using Gb
information by both HLR and HSS. mode. It is used by LLC in the SGSN to uniquely
identify the MS. The TLLI is derived from the P-
• TMSI (Temporary Mobile Subscriber Identity): The
TMSI.
TMSI is a temporary identifier assigned to a mobile
station by the MSC. • TIN: “Temporary ID” used in next update: Used in
conjunction with the ISR (Idle-mode Signaling
Reduction) feature this is not a new ID but one that is
equal to either the GUTI or P-TMSI.
45
Key Interworking Identifiers

(continued)
3GPP
Core
Bearer Network
UE
Common Network IDs

Common UE Identities
•PLMN Identity
• IMEI and IMSI
LTE Network IDs
• TIN
•Global MME Identity (GUMMEI)
LTE Identities
•MME Code (MMEC)
• GUTI and S-TMSI
•Tracking Area identity (TAI)
UMTS/GPRS Identities
UMTS/GSM Network IDs
• TMSI & P-TMSI
•Routing Area Identity (RAI)
•Network Resource ID (NRI)
•Location Area identity (LAI)
All three identifiers, GUTI, TMSI, P-TMSI are temporary contiguous cells smaller than an SGSNs coverage
identifiers and provide anonymity for the mobile device in area and less than a location area. The RAI is
the their respective domains. The following are the composed of a LAI + a Routing Area Code (RAC).
network-related identities that are most relevant to
• Location Area Identity (LAI): A location area in either a
interworking:
WCDMA or GSM/GPRS network is a collection of
• Public Land Mobile Network (PLMN) ID: This identifies contiguous cells smaller than an MSC server’s
the operator’s network and is common to all three coverage area. The LAI is composed of the Mobile
3GPP technologies. It is composed of the Mobile Country Code (MCC) + the Mobile Network Code
Country Code (MCC) and the Mobile Network Code (MNC) + the Location Area Code (LAC).
(MNC).
ID Mapping: When a mobile moves between an LTE
• Globally Unique MME Identity (GUMMEI): This network and either a 2G or 3G network, the UE will
identity, composed of the MMEGI plus MMEC is used perform TAU or RAU. It may be necessary to map the IDs
in the E-UTRAN to uniquely identify a specific MME. of the two technologies in order to help recover the
The MME Group Identity (MMEGI) identifies a group mobile’s context from the old network. Also in the case of
of MME in a PLMN which cover a specific geographic a combined SGSN/MME it will be important to have the
region. The MME Code (MMEC) is a unique code IDs point to the same node. The MME’s globally unique ID
identifying the MME in its group. is the GUMMEI which is contained in the UE’s GUTI. The
MME’s unique ID in its geographic area is MME Code
• Tracking Area identity: This identifies a tracking area
which is contained in the UE’s S-TMSI. The corresponding
in an LTE network.
SGSN ID is the NRI (Network Resource Identifier) which is
• Routing Area Identity (RAI): A routing area in either a contained in the P-TMSI/TLLI. See 23.003 for more
WCDMA or GSM/GPRS network is a collection of details.
46
Summary
• 2G/3G radio networks need to be upgraded to
support interoperability with LTE.
• The S4-SGSN option provides a more integrated
solution and more functionality with:
– New interfaces S3, S4, S12 that use GTP; and
– New interface S6d that uses Diameter.
• S-TMSI and P-TMSI are UE identities can be used
to identify the serving MME and SGSN
respectively.
• CS Voice and/or SMS interworking may be
accomplished via MME and MCS communication.
– New interface SGs uses SGs Application Protocol
(SGsAP). Award Solutions Proprietary
47
Review Questions
1. What are the minimal changes that are needed
to enable a 2G/3G network to support
interoperability with LTE?
2. What is the difference between GTPv1-C and
GTPv2-C?
3. Mention one example function that can be
carried out for each of the S3, S4 S12, and Gn
interfaces.
48
3 | Initial Session Setup
Chapter 3:
Initial Session Setup
49
Objectives
• Describe the high-level flow of network
attachment and default bearer setup in LTE
• Sketch the UMTS Attach procedure
• Explain the options for UMTS PDP Context
Establishment Procedure
• Compare and contrast these procedures in LTE
and UMTS
• Explain the mapping for QoS
Chapter References:
[2] 23.060 – General Packet Radio Service (GPRS);
Service description (Stage 2)
[3] 29.274 – Tunneling Protocol for Control plane
(GTPv2-C); (Stage 3)
[4] 29.272 – Mobility Management Entity (MME) and
Serving GPRS Support Node (SGSN) related
interfaces based on Diameter protocol
[5] 29.060 – GPRS Tunneling Protocol (GTP) across the
Gn and Gp interface
[6] 24.301 – Non-Access-Stratum (NAS) protocol for
Evolved Packet System (EPS); (Stage 3)
50
LTE Attach and Default

Bearer Setup
51
Goal – Establish Default EPS Bearer

Evolved Packet
Core (EPC) PCRF
MME
HSS
Packet Data
Network
(e.g., IMS)
PDN Gateway
Serving Gateway
(P-GW)
(S-GW)
E-UTRAN Default EPS

Bearer
UE
Before looking at the details of intersystem mobility, it is

important to look at two basic goals of a mobile device.
The first is the establishment of a data session in LTE. It is
only when the data session is established that an
intersystem handover will occur. This slide shows the goal
of having a default bearer established. This is not to
preclude a dedicated bearer as well, but at a minimum,
there will be at least one default bearer.
52
Initial Attach to the Network

LTE-Uu S1 S11 S5/S8 HSS
UE MME S-GW P-GW
eNB
Network Discovery, Access System
Step 0
Selection and RRC connection established
Step 1 Initial Attach
MME Selection and S1

signaling bearer setup
Step 2 Mutual Authentication and Security Setup
S-GW and P-GW

selection
Step 3 Default EPS Bearer setup and Attach Completion
Step 4 IP Address Allocation

Network attachment is principally a registration procedure Step 3: The always-on IP connectivity for the user of the
where the UE needs to register with the network to receive EPS is enabled by establishing a Default EPS Bearer
services. during the Network Attach procedure.
Step 0: After acquiring the LTE signal, the UE monitors the Step 4: The IP address can be allocated during Default
system information to look for a desired PLMN (Public EPS Bearer setup or it can be allocated after default
Land Mobile Network) ID. The eNB may support one or bearer setup.
more PLMNs (one or more service provider may share the
same radio network of LTE), in which case, the eNB may
broadcast one or more PLMN IDs in the system
information messages. If one of the PLMN IDs is
acceptable to the UE, the UE establishes the signaling
radio bearer, SRB1, between the UE and the eNB.
Step 1: It performs the Initial Attach procedure where it
selects a MME and then establishes a S1 signaling bearer
between the eNB and the MME. The next step is
authentication.
Step 2: Authentication in LTE is two-way authentication
called Mutual Authentication, the UE and the network both
authenticate each other. Air interface security is turned on
after successful authentication. Then the S-GW and the P-
GW are selected.
53
Step 1: Initial Attach
UE eNB
RRC Connection Setup Complete Possible MME

selection by eNB
Selected PLMN ID
Registered MME (if known)
NAS: Attach Request
NAS key set identifier If valid security context
EPS and UMTS Old GUTI or IMSI May be based on SGSN

security UE Network capability assigned P-TMSI
capabilities
Last visited registered TAI
ESM: PDN Connectivity Request Trigger for default
NAS MAC bearer creation
The UE initiates the attach procedure by the transmission Additionally, if the UE possesses a valid GUTI, it will
of a NAS Attach Request message. The Attach Request include the GUTI in the “Additional GUTI” field (not shown
message is carried over an RRC message to the eNB. The in the diagram) in the Attach message. If the TIN equals
RRC parameters “Selected PLMN ID” and “Registered "GUTI" or "RAT-related TMSI" and the UE possesses a valid
MME,” if known, are used by the eNB to either select a GUTI, the UE includes the GUTI in “Old GUTI or IMSI” field.
new MME or communicate with the MME where the UE is If the UE’s TIN is deleted, then the first choice for identity
already registered. is GUTI. The second choice is to use the P-TMSI/RAI
mapping if there is no valid GUTI.
In the Attach Request message, the UE must identify
itself to the core network, and there are a number of NOTE: The mapping between P-TMSI/RAI and GUTI is
possibilities. The IMSI, the GUTI and/or the P-TMSI may be specified in 3GPP TS 23.003.
used depending on the circumstances. The UE may
possess a Globally Unique Temporary UE (GUTI) if it had
previously registered with an MME. The UE may possess a
P-TMSI if it had previously registered with an SGSN. If the
UE doesn’t have a GUTI or P-TMSI, then it will use the IMSI
to identify itself.
Use of the GUTI or P-TMSI for identification depends on a
UE variable known as the “Temporary ID Used in Next
Update,” or TIN. If the TIN equals "P-TMSI" and the P-TMSI
and Routing Area Identifier (RAI) that the UE possesses
are valid, the UE will map the P-TMSI/RAI into the “Old
GUTI or IMSI” field.
54
Step 1: Initial Attach (continued)
UE eNB
RRC Connection Setup Complete Possible MME

selection by eNB
Selected PLMN ID
Registered MME (if known)
NAS: Attach Request
NAS key set identifier If valid security context
EPS and UMTS Old GUTI or IMSI May be based on SGSN

security UE Network capability assigned P-TMSI
capabilities
Last visited registered TAI
ESM: PDN Connectivity Request Trigger for default
NAS MAC bearer creation
The UE may also include the Tracking Area Identity (TAI)

where it was last registered. The UE Network Capability
includes the encryption and integrity algorithms supported
by the UE for both EPS and UMTS. This information can be
useful when a UE does a handover from LTE to UMTS.
If the UE was attached to this or another MME earlier, and
it has a NAS security association with an MME, it will
integrity-protect the ATTACH REQUEST message and
include the key set identifier, KSIASME. If the UE does not
have a KSIASME , the NAS key set identifier value is set to
“111” and the message is not integrity-protected. If this is
a new MME, the new MME can use the “old” GUTI to
obtain the context information for the UE.
The Attach Request message (an EPS Mobility
Management message (EMM)) will include an EPS
Session Management (ESM) PDN Connectivity Request
message to trigger the setup of the default EPS bearer.
55
Step 2: Authentication and Security

MME HSS
UE
EPS AKA-based
EPS AKA-based Mutual Authentication
Mutual Authentication
NAS security mode command procedures
Initial Context Request
AS Security
Mode Command
procedure
Authentication and security setup are optional. However, It communicates the selected algorithms to the UE, using
if the MME cannot find a security context for the UE, or if the AS security mode command procedure.
the ATTACH request failed integrity checking or didn’t
At the end of the authentication and security procedure,
include an integrity check, then authentication and
the encryption and integrity protection are enabled on
security are mandatory.
NAS and RRC.
EPS AKA is the Authentication and Key Agreement
During the authentication, security keys are created in the
procedure used for the mutual authentication of the UE
USIM and in the MME. CK and IK are used by the UE as
and the network. In LTE, encryption is possible for NAS
input to the algorithm that creates the KASME, which is
and RRC signaling messages and user plane traffic over
stored in an EPS security context in the UE and MME. The
the radio network. Different encryption algorithm options
KASME key is the root key used to derive keys for EPS
are provided for each of these protocol layers. Integrity
integrity protection and ciphering. Subsequently, if the UE
protection is done on the NAS and the RRC signaling
changes RAT to UMTS or GSM/GPRS, the KASME key will
messages.
be used to derive the UMTS and GSM/GPRS security keys.
After successful completion of the authentication
procedure, the MME picks the NAS algorithms based on
the UE capability and the operator preference. It
communicates the selected algorithms to the UE using the
NAS security mode command procedure. The MME
triggers the AS security mode command procedure by
sending a Initial Context Request message to the eNB.
The eNB selects the AS security algorithms based on the
operator preference and the UE capability.
56
Subscription Information
Update Location Request

(IMSI, MMEI, PLMN ID, RAT type)
MME Update Location answer HSS
(Subscriber data)
PDN type, QoS (QCI,

Example AMBR), VPLMN
Subscriber data APN configurations Parameters dynamic address
allocation allowed,
static IP address
After successful authentication and security procedures,

the MME updates the HSS with the current location of the
UE with the Update Location message. In response to this,
the HSS sends the UE’s complete subscription information
to the MME. The subscription information provides
information about each of the services (APNs) for which
the UE is registered. The APN configuration indicates the
PDN type, QoS characteristics like QoS Class Indicator
(QCI), Allocation & Retention Priority (ARP) and Aggregate
Max Bit Rate (AMBR). It specifies the PDN type, whether
IPv4, IPv6, or (IPv4 or IPv6) connectivity may be used. It
indicates if a static or dynamic IP address is allocated to
the UE. It indicates if the UE is allowed to connect to a
Visited P-GW.
For the ATTACH procedure, the UE may send an APN. If
not, the MME will use a Default APN which is identified in
the UE’s subscription data.
57
PDN Connectivity during ATTACH
UE MME
PDN Connectivity Request
IPv4, IPv6
or IPv4v6 PDN Type Carried in
IP allocation option PCO Attach Request
message
Activate Default EPS Bearer Context Request

EPS Bearer ID
Carried in
EPS QoS, APN
Attach Accept
PDN Address, PCO message
EPS Bearer QoS Negotiated QoS
LLC SAPI, Radio Priority,
A/Gb mode parms
Packet Flow Identifier Carried in Attach
Complete message
Activate Default EPS Bearer Context Accept
EPS Bearer ID
During the Attach procedure, the PDN connectivity If interworking of LTE with GPRS/UMTS is supported by
procedure is utilized to establish a default EPS bearer for the UE and the MME, then GPRS/UMTS-related
the default APN identified in the UE’s subscription data in parameters will be included. “Negotiated QoS” is the
the HSS. The NAS ESM (EPS Session Management) corresponding R99 PDP context QoS and applies to either
messages are contained in the NAS messages related to UMTS or GPRS. If the UE only supports A/Gb mode, then
the Attach procedure. parameters “LLC SAPI”, “Radio Priority” and “Packet Flow
Indicator” are included for use in the GPRS radio
The key parameters included in the PDN Connectivity
environment in the event of and IRAT handover. The
Request message are the PDN type and the Protocol
Logical Link Control Service Access Point Identifier (LLC
Configuration Options (PCO). The PDN type indicates if the
SAPI) identifies the SAP used for GPRS data transfer at
UE supports IPv4, IPv6 or both. The PCO (optional)
the LLC layer. The Packet Flow ID is A BSS related ID for
indicates if the UE desires to obtain an IP address via the
the PDP context. Radio Priority is the priority level the UE
Attach procedure or later using DHCP or other options.
will use for UL traffic on the corresponding PDP context.
The successful creation of the default bearer is indicated During handover from LTE to UMTS/GPRS, these
to the UE using the Activate Default EPS Bearer Context parameters will be used to created the corresponding PDP
Request. This message includes key parameters like EPS contexts.
bearer identity, EPS QoS, and the APN. It will also carry the
The UE acknowledges the reception of the Activate
assigned IP address in case of IP address allocation with
Default EPS Bearer Context Request message with the
Default Bearer creation.
Activate Default EPS Bearer Context Accept message. This
message is carried in the Attach Complete message.
58
P-GW Selection by MME

MME
1
2
P-GW
S-GW
S-GW Selection Criteria P-GW Selection Criteria

• Topology  APN
• Load balancing  Static or dynamic IP address
• Selected P-GW  If roaming, P-GW may be
allowed in the visited network
After authentication, the HSS sends an Insert Subscriber S-GW selection also depends on selected P-GWs. If a
Data (IMSI, Subscription Data) message to the new MME. subscriber of a GTP-only network roams into a PMIP-only
The Subscription Data contains the list of all APNs that the network, and he has a mixture of both home P-GW and
UE is permitted to access, an indication about which of visited P-GW in his selected P-GW list, then the MME
those APNs are the Default APNs. Subscription data also should select a S-GW that supports both GTP and PMIP-
includes for each APN, if it is allowed to connect to the based mobility.
visited network P-GW. The MME chooses the P-GW based
on the APN/PDN and on whether the IP address to be
allocated is static or dynamic. Please note that P-GWs in a
network may either support PMIP or GTP. The mobility
mechanism supported by the P-GWs selected play a role
in the selection of the S-GW.
The S-GW is selected on the bases of network topology. S-
GW selection can be done such that it reduce the
probability of changing the S-GW. Another selection
criteria could be the load balancing concept. Load
balancing between S-GWs enables the network to ensure
equally loaded S-GWs within an S-GW service areas.
59
Default EPS Bearer Setup - I
MME S-GW
P-GW
EPS bearer ID Create session Request
UL and DL TFT IMSI, MSISDN, RAT type
QoS APN, PDN type, PCO, APN-AMBR
Charging MME GTP-C TEID
characteristics
Default bearer context
PDN GW address Create session
Req/Res
EPS bearer ID
Create session Response
S-GW S1-U TEID
Charging ID Default bearer context
IP address
S-GW GTP-C TEID
After the selection of the S-GW, the next important step is 3. Default Radio Bearer.
to create the default EPS bearer. The EPS Bearer has
4. S1-U Bearer completion.
three portions associated with it, one is the radio bearer
between the UE and the eNB, the second is the S1-U MME keeps track of all the bearers created for an UE by
tunnel between the eNB and the S-GW, and the third is bearer identity. MME sends a Create Session to the S-GW.
the S5/S8 tunnel between the S-GW and the P-GW. In this request, MME sends the GTP-C MME tunnel ID,
During the Attach procedure, a default bearer to a default APN, APN-AMBR, PDN type, PCO, default bearer context
APN is created for sure. Other default and dedicated information and optionally other bearer contexts. Each
bearers can also be created. Bearer context information includes the TFTs, Bearer ID,
TFTs, QoS and Charging characteristics. Next the S-GW
The MME initiates the bearer creation procedure based
and P-GW create the S5/S8 Default bearer and also S5
on the subscription information from the HSS. During the
control bearer.
Attach procedure, the GTP-C control tunnels to transfer
signaling messages are also created between the S-GW
and P-GW, and also between the MME and S-GW. One
control tunnel exists per PDN per UE.
The order in which the three portion of the bearers are
created is:
1. S5/S8 Default bearer, S5 Control bearer.
2. S11 Control Bearer, S1-U bearer S-GW end point
creation.
60
Default EPS Bearer Setup - II

Allocates IP Address
S-GW P-GW
Create Session request
EPS bearer ID IMSI, MSISDN, RAT Type
UL and DL TFT APN, APN-AMBR, PDN Type, PC0
S-GW GTP-C TEID
QoS
Default bearer context
Charging characteristics
P-GW address
S-GW S5/S8 GTP-U TEID
Create Session response
IP Address
Bearer context created Allocation With
PDN Address (IP ADDRESS) Default Bearer
P-GW GTP-C TEID Set Up
P-GW S5/S8 GTP-U TEID EPS bearer identity
Charging ID
Default S5/S8 EPS Access Bearer

The S-GW creates end points for the default bearer and
sends them to the P-GW using the Create Session
Request message. It also sends the UE’s PCO parameter.
This is used by the P-GW to decide if it should allocate the
IP address to the UE during the default bearer creation
and if it should allocate IPv4, IPv6 or both IPv4 and IPv6
addresses. In the example covered here, the P-GW is
allocating an IP address to the UE during the default
bearer creation. The P-GW returns a Create Default Bearer
Response message to the S-GW. This message contains
the P-GW tunnel IDs for the default bearer and also the IP
address.
The S-GW replies to MME with the Create Default Bearer
Response. In this response, the S-GW sends the default
bearer tunnel IDs for the default bearer that needs to be
established between the S-GW and the eNodeB. Please
note that the creation of the default bearers between the
S-GW and the eNodeB is co-ordinated by the MME.
A GTP-C tunnel for transferring the signaling messages
between the S-GW and P-GW, is also created here.
61
Default EPS Bearer Setup - III
UE eNB MME
Initial Context Setup Request
RRC Connection Reconfiguration
AS security context info for UE
EPS Bearer Context List (BearerID, E-
EPS radio bearer identity RAB QoS parms, S-GW address and S1-
U GTP tunnel ID)
ATTACH ACCEPT
Address of S-GW and TEID of S-GW
GUTI and TAI List
ATTACH ACCEPT
Default BC Req (Bearer Contexts, APN,
PDN address) GUTI and TAI List
Default BC Req (Bearer Contexts, APN,
RRC Connection Reconfiguration PDN address)
Complete
Attach complete (Default BC Accept)
Default EPS Radio Bearer
The MME sends an Attach Accept message which

contains the GUTI and TAI list. This also contains the
Default BC Req, which in turn carries all the bearer
context information and the IP address given by the P-GW.
Attach Accept is embedded in the Initial Context Setup
Request S1-AP message. In this message, the MME
indicated to the eNB the radio bearers that need to be
created. Default radio bearer is always created. Along with
it other bearers may also be created. The Bearer context
information in the Initial Context Setup Request message
carries the S1-U S-GW tunnel ID end point for the S1-U
bearer between the S-GW and eNB. eNodeB makes a note
of the S-GW tunnel IDs and forwards the Attach Accept
message to the UE using the RRC connection
reconfiguration message. The eNodeB sends the default
radio bearer-related parameters in the RRC connection
reconfiguration message. The UE now sends the Attach
complete message embedded in the RRC Connection
reconfiguration Complete message to the eNB. This
completes the establishment of the default radio bearer.
62
Default EPS Bearer Setup - IV
eNB MME S-GW P-GW

UE
Initial Context Setup Res
EPS Bearer Context Modify Bearer Request
List (Bearer ID, E-RAB
QoS parms, eNB EPS Bearer Context
address and S1-U GTP (EPS Bearer ID, S1
tunnel ID) eNB address, eNodeB
TEID)
Attach complete Modify Bearer Response
EPS Bearer Context
(EPS Bearer ID)
IP Address Allocation with Default EPS Bearer Setup

With the Attach Complete message, the UE starts using

the NAS security algorithm indicated by the MME, i.e., the
Attach Complete message shall be protected by the NAS
security algorithm indicated by the MME. The eNB
forwards the Attach Complete message to the new MME
in an Initial Context Response S1-AP message. This
message includes the TEID of the eNB and the address of
the eNB used for downlink traffic on the S1-U reference
point. After the Attach Accept message and once the UE
has obtained a PDN Address Information, the UE can then
send uplink packets towards the eNB which will then be
tunneled to the S-GW and P-GW. The MME sends a Modify
Bearer Request message with eNodeB address, eNodeB
TEIDs, and EPS bearer IDs to the S-GW. The S-GW
acknowledges by sending a Modify Bearer Response (EPS
Bearer Identity) message to the MME. This completes the
establishment of the default S1-U EPS access bearer.
Thus, now an end-to-end default EPS bearer can be
realized.
63
Fill-in-the-Blanks Exercise
1. The ___________ selects an MME to achieve load
balancing. {UE, eNodeB, S-GW, P-GW, HSS}
2. The ________ selects the S-GW based on factors such
as UE location and load balancing. {eNodeB, MME, P-
GW, HSS, PCRF}
3. The P-GW is selected based on _________. {APN, QoS,
RAT Type}
4. The combination of Data Radio Bearer, S1-U Bearer,
and S5/S8 Bearer is called the___________. {SRB,
GTP Tunnel, EPS Bearer, PDP Context}
5. The ________ works with the HSS and the UE to
authenticate the UE. {eNodeB, MME, PCRF}
64
UMTS/EDGE PDP
Context Establishment
65
PDP Context Bearer Paths in EPC

PDP Context
MME HSS/HLR
(S4 SGSN)
S-GW
Packet Data
Network
(e.g., IMS)
P-GW
SGSN
GGSN
UTRAN/GERAN
UE PDP Context
Legacy UE
PDP Context
(Gn SGSN)
The second operation that a mobile will need to be able to

perform is a PDP context establishment when it is in
GSM/GPRS or UMTS coverage. There are two options
here. First, either the SGSN supports the S4 interface and
the connection will go from the SGSN to the S-GW to the P-
GW. Though not shown in the slide, the connection could
bypass the SGSN and connect from the UTRAN or GERAN
to the S-GW to the P-GW.
Secondly, the SGSN only supports the Gn interface. In that
case, the SGSN connects directly to the P-GW via the Gn
interface.
66
PDP Context Establishment

HSS/
MME/S-GW HLR
UE Node B/BTS RNC/BSC SGSN
or P-GW
Network Discovery, Access System
Selection AND Connection Established
Step 1 Initial Attach
Step 2 Authentication
S-GW or P-GW
Selection
Step 3 PDP Context Establishment
Step 4 IP Address Allocation
Network attachment is basically a registration procedure

where the UE needs to register with the network to receive
services. After the UE has acquired the network and has
established a signaling radio bearer, it performs an initial
attach procedure with the SGSN. The next step is
authentication. Authentication in UMTS is a two-way
authentication. The UE and network both authenticate
each other, but it is only one-way in GSM/GPRS. After the
attach procedure is complete, the UE will perform an
Activate PDP Context procedure. The GGSN or P-GW is
selected. The IP address can be allocated during PDP
Context set up or it can be allocated after a default bearer
set up.
67
Authentication and Security

UE eNB
RNC or BSC SGSN HLR or HSS
Retrieve UMTS
UMTS AKA-Based Mutual Authentication Authentication Vector
or Retrieve GERAN
GERAN AKA-Based Authentication of MS Authentication Triplet
Authentication basically ensures that the user is

authorized to use the particular network services. UMTS
AKA is the authentication and key agreement procedure
used for the mutual authentication of the UMTS UE and
the UMTS network. GSM also has its own AKA, but it is
much simpler.
In GSM and UMTS, encryption is possible for NAS, Radio
Resource signalling, and user plane traffic over the radio
network. Integrity protection is done on the NAS and the
radio signalling messages. At the end of the
authentication and security procedure, the encryption and
integrity protection would be enabled on NAS and radio
related signalling.
68
PDP Context Setup
UE Activate PDP Context Request SGSN
APN
PDN type
PCO
Activate PDP Context Accept
IP Address
PCO
The PDP context procedure is used by the UE to trigger the

creation of data bearer to a service network. The key
parameters included in the PDP context activation
procedure are PDN type, APN and Protocol Configuration
Options (PCO). PDN type indicates if the PDP context is
initiated during the handover procedure. In such cases,
the P-GWs’ selection procedure won’t be triggered.
Instead, the P-GW that were used for the UE earlier, would
continued to be used. APN indicates the APN for which the
UE wants a default bearer to be established. PCO
indicates if the UE is requesting for a IPv4 or IPv6.
The SGSN takes care of the signaling to establish Gn
bearer, Gb bearer and Radio bearer for the end-to-end
PDP context creation. The successful creation of the PDP
context is indicated to the UE using the Activate PDP
Context Accept message. This message includes a few key
parameters like IP Address, Negotiated QoS and APN.
69
IP Anchor Selection by SGSN

Select a P-GW
based on APN
Option 1 Step 1 P-GW
S4 SGSN
S4 SGSN Step 2
S-GW
Select an S-GW
based on topology
Select a GGSN
based on APN
Option 2 One Step only

Gn SGSN
Gn SGSN P-GW/GGSN
Upon receipt of the Activation PDP Context Request

message, the SGSN will need to select the appropriate
GGSN , P-GW, or MME/S-GW. Subscription data also
includes for each APN if it is allowed to connect to the
visited network P-GW. Based on the mobile capabilities,
the APN selected by the mobile and the network
configuration the SGSN will select the appropriate
destination node.
The MME/S-GW is selected on the basis of network
topology, i.e., is this an S4 SGSN or a Gn SGSN. MME/S-
GW selection can be done such that it reduce the
probability of changing the S-GW. Another selection
criteria could be load balancing concept. Load balancing
between S-GWs’ enables the network to ensure equally
loaded S-GWs within an S-GW’s service area.
In the case of a Gn SGSN, the selection of P-GWs is
performed.
70
Establish PDP Context: S4 SGSN - I

2. S-GW and
PDN
P-GW selection.
Maps NSAPI to
EPS Bearer1.
P-GW 4. Create Session
3G PS-CN Request (IMSI,
MME LTE Core
bearer context,
PDN GW address)
SGSN
1. PDP Context S-GW
Activation
(NSAPI, QOS,
APN)
E-UTRAN
3G UTRAN
eNodeB
Node B
Calls are anchored at the S-GW for LTE interworking with 4. The S-GW in turn forwards the message to the P-GW
Release 8 UMTS and GPRS. and establishes a GTP tunnel for the default EPS
bearer.
1. In UMTS or GPRS, the mobile performs PDP Context
activation to create an IP session and obtain an IP
address. PDP Context activation is handled differently
in a Release 8 UMTS/GPRS network. The changes
are transparent to the mobile.
2. SGSN functionality includes choosing the Serving
Gateway (S-GW) and P-GW. It selects an S-GW and P-
GW just like an MME. It maps the NSAPI IDs to the
EPS bearer ID.
3. After selecting the GWs, it initiates a GTPv2-C Create
Session Request to the S-GW. This creates the
default bearer towards the APN. SGSN uses the GTP-
C protocol over the S4 interface to talk to the S-GW.
In this request, the SGSN sends the GTP-C tunnel ID,
APN, APN-AMBR, PDN type, PCO, default bearer
context information and optionally other bearer
contexts. All bearer context information includes the
TFTs, EPS Bearer ID, QoS and charging
characteristics.
71
PDP Context Establish: S4 SGSN - II

PDN
P-GW
5. Create Session
Response (bearer
3G PS-CN MME context
IP address)
LTE
SGSN Core
7. PDP
Context S-GW
Activation RNC
Accept (IP
address)
3G
UTRAN E-UTRAN
Direct
Node B tunnel eNodeB
5. The P-GW establishes a context for the UE and The SGSN decides when to establish a direct tunnel and
assigns an IP address and replies to the S-GW. sets up the tunnel between SRNC and GGSN. SGSN
provides the RAN, the tunnel ID and the address of the
6. The S-GW forwards the IP address to the SGSN. At
GGSN. The SGSN provides the GGSN, the tunnel ID and
this point GTP-U tunnels have been set up between S-
the address of the RAN.
GW and both the P-GW and SGSN.
The direct tunnel feature is supported in UMTS release 8
7. The SGSN forwards the IP addresses to the mobile in
as well. The only difference is that the direct tunnel is
the PDP Context Activation Accept message.
created between the RNC in the UTRAN and the S-GW.
The S-GW acts like a proxy GGSN here. The MME is not The SGSN coordinates and sets up the tunnel between
involved during anchoring of calls at the LTE core, for the UTRAN and the S-GW.
GPRS and UMTS access. However, the MME would be
involved during handovers between UMTS/GPRS and LTE.
Calls are anchored at the S-GW for LTE interworking with
Release 8 UMTS and GPRS.
Direct Tunnel: First, let’s understand the one tunnel
solution in the UMTS pre-release 8 architecture. The one
tunnel solution enables a direct user plane tunnel
between SRNC (in the UTRAN) and the GGSN within the
PS domain. The direct GTP tunnel between the SRNC and
GGSN further reduces the latency in the user plane to
enable services like VoIP, thereby providing a very cost-
effective alternative to voice calls over the PS domain.
72
PDP Context – Gn SGSN Option
SGSN P-GW
Create PDP Context Request
Create PDP Context Response
In the case of the Gn SGSN option, the SGSN will use the
Create PDP Context Request message to connect directly
to the P-GW.
73
Mapping of Bearer Contexts
LTE: EPS Bearer 1 -1 GPRS: PDP Context

EPS Bearer ID NSAPI
Default Bearer Primary PDP Context
Dedicated Bearer Secondary PDP Context
Linked EPS Bearer Identity NSAPI of Default
Default EPS Bearer’s PDN Default PDP Context’s PDP
Addr, APN, TFT Addr, APN, TFT
EPS QoS UMTS QoS
Mapping done by P-GW, S4-SGSN, MME and UE

From a core network perspective, there is only a key issue

when moving between LTE and UMTS/GPRS. In LTE, the
term for a data connection is an EPS Bearer. There are
two types of bearers, a Default EPS Bearer or a Dedicated
Bearer. In UMTS and GPRS, the term for a data session
that is used is a PDP Context. There is one-to-one mapping
of the EPS bearers to PDP Contexts.
As a part of the subscription information, the SGSN
receives a default bearer QoS for a Packet Data Network
(PDN) connectivity. The SGSN uses this information and
forces the default bearer QoS on the first PDP Context
activated towards that PDN. This primary PDP Context will
be mapped to the default EPS bearer during the handover
procedure to LTE.
If the SGSN doesn’t have information about the default
bearer QoS, it will allow the first PDP Context QoS to be of
the type requested by the network or the UE. It will not
enforce a default type of QoS on it. If the subscriber has
established a Secondary PDP Context, that will be mapped
to a dedicated EPS bearer.
74
Mapping of QoS Profiles

LTE QoS Profile Pre-rel 8 QoS Profile
QCI 1 Conversation class
QCI 2,3 Conversation class/transfer delay
QCI 4 Streaming class
QCI 5, 6, 7, 8 Interactive class (Pri=1,1,2,3)
QCI 9 Background
ARP value 1 to 15 ARP 1,2 or 3
(split into 3 ranges)
Bottom of range ARP 1,2 or 3
APN-AMBR MBR (interactive, background)
GBR, MBR GBR, MBR
(conversational or streaming class)
Packet delay budget Transfer delay
Packet loss rate SDU error ratio
Guidelines on how to map UMTS QoS and LTE QoS are

shown in this table. LTE QCI values 1, 2 and 3 are mapped
to the UMTS conversational class. LTE QCI value 4 is
mapped to the UMTS streaming class. LTE QCI values 5,
6, 7 and 8 are mapped to the UMTS interactive class. LTE
QCI value 9 is mapped to the UMTS background class. A
range of LTE ARPs are mapped to a pre-rel-8 ARP value.
GBR and MBR of LTE EPS bearers are directly mapped to
GBR and MBR of pre-release8 QoS. The interactive
bearers that are mapped to non-GBR EPS bearers, the
pre-rel-8 GBR and MBR can be saved in the MME. This
saved values could be used while handing over again to
UMTS/GPRS. Pre-release 8 transfer delay and SDU error
ratios are derived from the LTE packet delay budget and
packet loss rate.
Note: One way arrows in the slide mean the mapping is in
that direction only.
Source: 23.401, 24.301 and 23.060
75
Summary
• The LTE attach procedure includes three major
steps: Initial Attach/Default Bearer Setup,
Authentication and IP Address Allocation.
• The GPRS and UMTS attach procedure includes
two major steps: Initial Attach and PDP Context
Activation.
• PDP Context Activation for GPRS and UMTS
includes the establishment of network resources
and IP address allocation.
• The connection path for GPRS and UMTS will vary
based on the SGSN options implemented.
76
Review Questions
1. The SGSN always chooses an S-GW to anchor the
session. (T/F)
2. The UMTS Attach procedure is equivalent to the
LTE PDP Context Activation Procedure. (T/F)
3. How does the UE identify itself in the LTE Attach
message?
4. What is the LTE equivalent of the UMTS
Secondary PDP Context?
5. Which LTE QCI is mapped to the UMTS
background class?
77
Additional Material
78
RAB QoS in UMTS/GERAN

Traffic class Conversational Streaming class Interactive Background
class class class
Maximum bit rate (kbps) ≤16 000 (2) (7) ≤16 000 (2) (7) ≤16000 - ≤16000 –
overhead overhead
Delivery order Yes/No Yes/No Yes/No Yes/No
Maximum SDU size (octets) <=1 500 or 1 <=1 500 or 1 502 <=1 500 or 1 <=1 500 or 1
502 502 502
SDU format information (5) (5)
Delivery of erroneous SDUs Yes/No/- Yes/No/- Yes/No/- Yes/No/-
Residual BER 5*10-2, 10-2, 5*10-2, 10-2, 4*10-3, 10-5, 4*10-3, 10-5,
5*10-3, 10-3, 5*10-3, 10-3, 10-4, 6*10-8 6*10-8
10-4, 10-5, 10-6 10-5, 10-6
SDU error ratio 10-2, 7*10-3, 10- 10-1, 10-2, 7*10-3, 10-3, 10-4, 10-6 10-3, 10-4, 10-6
3, 10-4, 10-5 10-3, 10-4, 10-5
Transfer delay (ms) 80 – max value 250 – max value
Guaranteed bit rate (kbps) <= 16 000 <= 16 000
Traffic handling priority 1,2,3
Allocation/Retention 1,2, ..., 15 1,2, ..., 15 1,2, ..., 15 1,2, ..., 15
priority (1)
Source statistic descriptor Speech/unknown Speech/unknown
Signaling Indication Yes/No

REF: 3GPP TS 23.203
The QoS attributes associated with a radio access bearer

in UMTS/GERAN are shown in this table from TS 23.203.
79
EPS QoS Parameters

• QCI
• ARP
GBR Bearers Non-GBR
• GBR • AMBR
• MBR
S-GW P-GW
EPS Bearer
QCI: QoS Class Indicator
ARP: Allocation and Retention Priority
GBR: Guaranteed Bit Rate
MBR: Maximum Bit Rate
AMBR: Aggregate Max Bit Rate
The key QoS parameters associated with a service data 3. Allocation and Retention Priority (ARP): This
flow are shown in this figure. parameter will be used in congestion situations when
not all users and their services can be
1. A QoS Class Identifier (QCI): Defines the general
accommodated. The ARP will be used by the
class of the service. There are currently nine defined.
admission control function in the eNB.
A QCI is associated with a priority, specific delay and
packet loss values and whether the service has a For example, a user may subscribe to a service such as
guaranteed bit rate. These characteristics will be Real Time Gaming. In EPS, Real Time Gaming is defined
used by the EPS nodes (eNB, S-GW, P-GW) to guide as a specific class of service with a defined QCI value and
them in deciding how a particular service data flow is associated parameter values for packet delay etc. Real
to be processed. QCI determines such things as Time Gaming is a GBR service and will therefore be
resource scheduling, rate shaping, and queue assigned a guaranteed and maximum bit rate when the
management and also maps to a specific DSCP for IP user subscribes. These bit rates may depend on the type
forwarding through the GTP tunnels. At the eNB, QCI of game in question.
will also be be used to determine RLC configuration.
2. Bearer Type: For GBR bearers, both guaranteed bit
rate (GBR) and maximum bit rate (MBR) are
specified. GBR indicates the data rate that is always
supported on the bearer while MBR puts a limit on
the higher side. For Non-GBR bearers, the aggregate
maximum bit rate (AMBR) parameter will be
specified. AMBR indicates the maximum bit rate that
can be shared across multiple bearers.
80
QoS Classes in EPS

Bearer Packet Packet
QCI Application Example Priority
Type Delay Loss
1 Conversational VoIP 100 ms 10-2 2
2 Conversational Video 150 ms 10-3 4

GBR (Live Streaming)
3 Non-Conversational Video 300 ms 10-6 5
(Buffered Streaming)
4 Real Time Gaming 50 ms 10-3 3
5 IMS Signaling 100 ms 10-6 1
6 Voice, Video, Interactive 100 ms 10-3 7
Games
NON-GBR
7 Video (Buffered Streaming) 300 ms 10-6 6
8 TCP apps (Web, email, ftp) 8
9 Platinum vs. gold user 9

REF: 3GPP TS 23.203
The QoS attributes associated with the QoS Class Indices SDF. The PDB values given in the table are a measure
are shown in the slide. of the maximum time allowed for packet delivery from
P-GW to UE. The eNB can assume that on average,
• Service data flows with QCIs of GBR bearer type will
the delay from P-GW to eNB is 20ms and from this
be associated with a Guaranteed Bit Rate parameter,
calculate the maximum over the air delay budget.
and a Maximum Bit Rate parameter. The GBR
parameter in particular will used in the admission
control function in the eNB.
• Each QCI value has a priority which will be used by
EPS traffic nodes during congestion. If packet queues
are close to overflow then SDFs with lower priority
that others (Priority 9 is the lowest) will have their
packets discarded first. Note that IMS Signaling
packets have the highest priority while QCI 9 is
equivalent to best effort service. Prioritization of SDF
aggregates of the same user will use this value and it
should also be used in the prioritization across users
though the PDB will play a greater role in the
scheduling of one user’s traffic over another.
• The packet delay budget (PDB) associated with an
SDF will be one of the inputs used by the scheduler in
the eNB in determining when to deliver packets of the
81
QoS Classes in EPS (continued)

Bearer Packet Packet
QCI Application Example Priority
Type Delay Loss
1 Conversational VoIP 100 ms 10-2 2
2 Conversational Video 150 ms 10-3 4

GBR (Live Streaming)
3 Non-Conversational Video 300 ms 10-6 5
(Buffered Streaming)
4 Real Time Gaming 50 ms 10-3 3
5 IMS Signaling 100 ms 10-6 1
6 Voice, Video, Interactive 100 ms 10-3 7
Games
NON-GBR
7 Video (Buffered Streaming) 300 ms 10-6 6
8 TCP apps (Web, email, ftp) 8
9 Platinum vs. gold user 9

REF: 3GPP TS 23.203
• The packet loss rate (PLR) from the P-GW to eNB is system. For example QCI #1 maps to the IETF DSCP for
assumed to be zero in non-congestion situations. The Telephony media (EF), and QCI #5 maps to IETF DSCP for
PLR in the table refers to non-congestion related IP Telephony Signaling (CS5).
packet losses over-the-air. eNB uses this information
to decide upon radio bearer setup for a particular
SDF; e.g., RLC AM or UM, modulation and coding
parameters.
• QCIs 7, 8 and 9 may be used for differentiation on
service or subscriber basis. For example QCI 7 and 8
could map to premium and gold users while QCI 9 is
used for all other best effort services
• Note that the QoS parameter AMBR may be used to
distinguish between two users or groups of users that
are both assigned QCI=9 for their services.
The QCI values are somewhat akin to IETF Differentiated
Services Code Point (DSCP) values. There is a
recommended mapping between them which can be used
by the EPS nodes to determine what DSCP values to use
in forwarding traffic through the GTP tunnels in the
82
4 | Connected-Mode Interworking
Chapter 4:
Connected-Mode
Interworking
83
Objectives
• Describe the different phases in a connected-mode inter-
RAT handover
• Explain the measurement procedure as it applies to inter-
RAT handover
• List the measurement events for E-UTRAN, UTRAN and
GERAN
• Examine detailed call flows for the inter-RAT procedures
between LTE  UMTS/GPRS
• Indicate the QoS mapping principles for inter-RAT
scenarios across 3GPP-based networks
Chapter References:
[1] 3GPP TS 44.018 V8.6.0 (RRC)
[2] 3GPP TS 23.003 V8.4.0 (Numbering, Addressing and
Identification)
[3] 3GPP TS 23.401 V8.4.1 (GPRS Enhancements for E-
UTRAN Access)
[4] 3GPP TS 25.331 V8.6.0 (RRC)
[5] 3GPP TS 36.133 V8.5.0 (Requirements for RRM)
[7] 3GPP TS 45.008 V8.2.0 (RAN Radio Link Control)
[8] 3GPP TS 24.301 V8.0.0 (UE-NAS Signaling)
[9] 3GPP TS 36.413 V8.4.0 (S1-AP)
[10] 3GPP TS 23.060 V8.4.0 (GPRS Service Description)
[11] 3GPP TS 36.300 V8.8.0 (E-UTRAN Overall
Description)
84
IRAT Handover Phases

Intra Technology Monitoring
Trigger for IRAT Monitoring
IRAT Measurement and

Event Evaluation
IRAT Event Reporting
IRAT Handover
Decision
• HO Preparation
• HO Execution
• HO Completion
Handover is used in cellular mobile systems to maintain tune to the frequencies of the alternative radio
connections as MSs move between the coverage areas of technology, perform measurements and then retune to
different base stations. To facilitate the handover process, the serving cell’s frequency.
the mobile and network monitor the transmission
The mobile continues to measure the current serving
conditions in the current cell as well as surrounding cells
technology cells but in addition is now measuring a
in order to keep the mobile connected to the most
second technology and perhaps even a third. It may also
suitable cell. The monitoring process typically begins in the
be measuring other frequencies in the current technology.
current radio technology only. In this description, we
The mobile evaluates the measurements of all
assume that the initial radio technology is the preferred
technologies to determine if certain network configured
technology. The mobile will always measure the signal
events have transpired, and if required to report its
strength of the current cell and may be instructed to
findings on a regular basis. The mobile’s reports are used
measure intra-technology neighbors if the signal strength
by the current serving cell to facilitate its decision making
of the current serving cell(s) falls below a threshold.
responsibilities regarding the supervision of the mobile’s
If the serving cell(s) signal strength continues to fall, it may connections.
be necessary to consider moving the mobile to an
When the IRAT HO decision is made by the current serving
alternative radio technology where better service can be
cell, the actual handover process is begun. As with intra-
found. In order to facilitate an inter radio access
technology handovers the process can be divided into
technology handover, measurements on different
three phases, namely, preparation, execution and
frequencies will need to be performed. The mobile will
completion. Note that depending on the capabilities of the
typically need to be allocated time periods, sometimes
devices, the network components and the radio
called gaps, during which the communication with the
technologies involved, the complexity of these three
serving cell is suspended in order to allow the mobile to
phases may vary.
85
Generic Measurement Process

1. Ongoing assessment of
mobile’s measurement
3. Perform measurements IRAT1 Neighbor requirements
on serving system,
IRATs if needed
Serving
RAN
Mobile
Handover decisions
Device are based on reports
IRAT2 Neighbor
When the UE/MS has a connection established, the

serving system continually assesses the need to measure
neighbors in the serving system as well as other IRATs the
UE may be capable of accessing.
The serving system sends measurement control
messages to the mobile, informing it of the sets of cells,
frequencies and technologies to be monitored, and the
criteria to be used for measuring and reporting channel
strength and quality. The mobile then monitors the
designated cells as it moves through the network. When
any of the specified reporting criteria is met, the mobile
sends the results to the network in a measurement report
message. Reports may be periodic or event based. If the
measurement report indicates, for example, that a
neighboring cell is better than the current serving cell, the
serving system may request that the mobile hand over to
the new cell.
86
LTE Measurement
Procedure
87
Measurement Configuration in LTE

RRC Connection Reconfiguration eNB
Measurement Configuration
UE
Measurement Objects: UTRA: set of cells on one carrier Which neighbors
GERAN: set of frequencies to measure
Reporting Configurations: Event, periods definition
Defines reporting
Measurement identities: Reference number
criteria
Quantity Configurations: How to measure including
L3 filtering definition e.g., Use filtered
Measurement Gaps: When to use silent gaps Ec/N0 for UTRA
s-Measure: Threshold to control all measurements Time periods to

measure other
speedStatePars: Used to scale TTT parameter frequencies
• Multiple Objects may be configured in a single RRC message

• Objects can be added, modified or removed from the UE’s configuration
• Up to 32 Measurements Objects may be configured
The RRC Connection Reconfiguration message in LTE event triggered then the event will be identified, in the
plays many roles. The parameters in this message case of IRAT, as either B1 or B2. The triggering
determine its purpose. In this case, it is used to set up quantity (e.g., RSRP, RSRQ, EcN0, etc) is defined. The
measurement parameters in the UE and is equivalent to report quantity is only defined here in the case of LTE
the UMTS message RRC Measurement Control. The same neighbors and may be the same as the triggering
message is used to configure measurement of LTE and/or quantity, or both RSRP and RSRQ.
IRAT neighbors as well as measurement gaps.
• Measurement Identity: A reference number that links
• Measurement Objects: This is a list of objects that the a specific Measurement Object to a specific Reporting
UE should measure. Each object has a unique ID. For Configuration.
UTRA, an object is a specified set of cells on a specific
• Quantity Configuration: For IRAT, this specifies the
W-CDMA carrier. The cells are identified by their
quantity to be measured and reported (e.g., either
scrambling codes. Cells not in this list are “detected”
Ec/N0 or RSCP for UTRA) and the Layer 3 filtering
cells and the UE may also be asked to measure for
parameter. For LTE measurements, it specifies only
the purposes of SON. For GERAN, an object is a
the L3 filtering parameter.
specified set of carrier (BCCH) frequencies.
• Reporting Configurations: This is also a list with each
item defining how a measurement report message
from the UE is triggered. Each configuration has a
unique ID. A specific report configuration is either
event triggered or periodical. If the trigger is periodical
then the reporting interval and number of reports
(“reportAmount”) are also specified. If the report is
88
Measurement Configuration in LTE

(continued)
RRC Connection Reconfiguration eNB
Measurement Configuration
UE
Measurement Objects: UTRA: set of cells on one carrier Which neighbors
GERAN: set of frequencies to measure
Reporting Configurations: Event, periods definition
Defines reporting
Measurement identities: Reference number
criteria
Quantity Configurations: How to measure including
L3 filtering definition e.g., Use filtered
Measurement Gaps: When to use silent gaps Ec/N0 for UTRA
s-Measure: Threshold to control all measurements Time periods to

measure other
speedStatePars: Used to scale TTT parameter frequencies
• Multiple Objects may be configured in a single RRC message

• Objects can be added, modified or removed from the UE’s configuration
• Up to 32 Measurements Objects may be configured
• Measurement Gaps: Information about the periods

during which the UE does not transmit or receive data
and instead measures the other radio access
technology environment. The duration of the gap and
interval between successive gaps is defined.
• s-Measure: If the serving cell quality is better than
this threshold, the UE is not required to perform
measurements on any type of neighbor.
• speedStatePars: The UE may be configured to
estimate its speed by taking a measuring handover
frequency. The time-to-trigger parameter may be
scaled according to medium or high speed.
89
Measurement Reports in LTE

Measurement Report
Measurement Results
UE eNB
Measurement ID
Results for Serving Cell (RSRP and RSRQ)
Result for UTRA (Frequency X, list of cells)
For each cell:
Report
• Scrambling Code, Global Cell ID What either
contains to
• RSCP or Ec/N0 Measure
UTRA or GERAN
cells
Results for GERA (set of frequencies)
For each cell:
• Carrier Frequency, BSIC, Global Cell ID
• RSSI
The inter-RAT-related measurement results are carried • Measurement Results in GERA: GSM/GPRS
from the UE to E-UTRAN in the RRC message measurement results are reported for cells with
Measurement Report. The main content of this message carrier frequency (C0, or BCCH carrier) and the BSIC
relevant to 3GPP interworking are: (Base Station Identity Code) which together, uniquely
identify the cell in GSM.
• Measurement ID: UE will identify the measurement
with a measurement ID, which is simply a linking • Global Cell ID: For GERAN this is the Cell Global ID,
between a measurement object and a reporting CGI= PLMN-Id + Location area code + cell-id (16 bits).
configuration. The purpose of this ID is to avoid
• The signal strength is given as RSSI (Rxlev, coded
ambiguities about what is measured and reported.
using 64 levels).
• Measurement Results for Serving Cell: The UE will
include the signal strength (RSRP) and signal quality
(RSRQ) of its serving cell in LTE.
• Measurement Result for UTRA cell(s): If this report is
for a UMTS frequency, the UE will report the
scrambling codes of the UMTS cells as well as the
Global Cell ID for the UMTS cell which uniquely
identifies the cell with PLMN-ID and Location/Routing
area code. For each cell, the UE will append the
CPICH_RSCP value (96 values corresponding to dBm)
and the signal to noise ratio Ec/I0 (50 values in dB).
90
Types of Measurements in LTE

Measurements
Gap-Assisted Non-Gap-Assisted
(inter-frequency cells (for intra-
and IRAT) frequency cells)
Measurement is Gap Assisted or Non-Gap

Assisted, depending on:
• Inter-RAT
• UE Capability
• LTE and IRAT band configurations (e.g.
adjacent UL LTE and DL UMTS channels)
Measurements may be either gap-assisted or non-gap- “inter_RAT_Need_For_Gaps“ which indicates the need for
assisted. During a gap-assisted measurement, the measurement gaps for each pair of E-UTRA and IRAT
network ensures that the UE will not send or receive any bands. This will be used by eNB in determining whether to
information during the measurement (a “gap” in the configure measurements gaps for a UE.
transmission). This is especially useful for inter-frequency
and inter-RAT measurements, where the UE must tune
briefly to another channel to take the measurement. For
intra-frequency measurements, the UE may continue to
send and receive information while taking the
measurement, since no retuning is required (non-gap-
assisted).
The need for gap-assisted measurements depends on the
physical capabilities of the UE. In particular, if the UE has
a GSM receiver, a UMTS receiver and an LTE receiver,
then it may be able to measure other RATs and yet
continue to send and receive data on the current LTE
frequency. However if the current LTE UL frequency and
the measured RAT frequency are adjacent, the
interference produced may invalidate the measurements.
Hence there may still be a need for a measurement gap
even if the UE has multiple receivers. The UE
capabilities information includes a parameter
91
Measurement Gaps
Start Subframe Gap Repetition Transmission
Number Period Gap
• Gaps used by UE to measure other frequencies/IRATs

• Measurement Gap Repetition Period (MGRP) = 40 or 80 ms
• Measurement Gap Length (MGL) = 6 ms
• Gap Offset = 0..MGRP-1
• RRC configuration:
“Gap Offset” determines starting Frame and SF
“Gap Pattern” determines the repetition period.
Two patterns defined in R8
If the UE has been configured to use gap-assisted

measurements, the eNodeB will inform the UE when to
start the transmission gaps, how often they occur, and
how long they last (the gap pattern). During each gap, the
UE will not receive any information on the downlink, and
will not send anything on the uplink. A gap will last at least
one subframe (1 ms), and overrides any other
transmission requirement, such as HARQ retransmissions.
The UE is assigned one gap pattern, and will continue the
pattern until the connection is reconfigured or the UE goes
idle.
92
LTE Measurement Events

Event A1 Serving becomes better than absolute threshold
Event A2 Serving becomes worse than absolute threshold
Event A3 Neighbor becomes amount of offset better than serving
Event A4 Neighbor becomes better than absolute threshold
Event A5 Serving becomes worse than absolute threshold1 AND

Neighbor becomes better than absolute threshold2
Event B1 Inter-RAT neighbor becomes better than threshold

Event B2 Serving becomes worse than threshold1 and inter-RAT
neighbor becomes better than threshold2
Several events have been defined in LTE for sending a

measurement report.
The events which are relevant to Inter-RAT handover are:
• Intra-Frequency events:
― Event A1: Serving becomes better than absolute
threshold. May be used to stop IRAT
measurements.
― Event A2: Serving becomes worse than absolute
threshold. May be used to start IRAT
measurements.
• Inter-Frequency/IRAT events:
― Event B1: Inter-RAT neighbor becomes better
than threshold.
― Event B2: Serving becomes worse than
threshold1 and inter-RAT neighbor becomes
better than threshold2.
Events B1 or B2, if reported to the eNB, may result in a
handover to another RAT.
93
Trigger for IRAT Monitoring

Event A2
Signal
RSRP or RSRQ
LTE
Serving cell Used to start looking for IRAT,
or other frequency neighbors
(similar to event 2d in UMTS)
A2 threshold
hyst
Time-to-Trigger
Measurement Report Time

for event A2 is sent
Reporting events A2 and A1 may be used as triggers to

start and stop measurements of IRAT or IF (Inter-
Frequency) neighbors. Event A2 is shown in the diagram.
The threshold, hysteresis and time-to-trigger parameters
are delivered to the UE in an RRC Connection
Reconfiguration message containing Measurement
Control IEs. The actual measurements may be based on
RSRP or RSRQ.
If the signal measurement drops below the (Threshold –
Hysteresis) level for a time-to-trigger period, the UE will
send a Measurement Report indicating that an event A2
has occurred. At this point the eNB will normally configure
measurement gaps and an IRAT neighbor list for the UE to
measure.
If the signal measurement becomes equal to or better
than the event A1 (Threshold + Hysteresis) for a time-to-
trigger period, an event A1 Measurement Report will be
sent to the eNB.
94
LTE IRAT Measurement B Events

Signal Ms Mn+Ofn
[dB],[dBm] LTE IRAT
Serving cell Neighbor cell Mn
∆ Thresh 2
∆=Hysteresis
Thresh 1
∆
Time-to-Trigger
(“speed” dependent)
Time
UE sends MR
Event B2: (Ms+Hys < Thresh1) AND (Mn+Ofn-Hys > Thresh 2)

(Shown Above)
Event B1: (Mn+Ofn-Hys > Thresh 2)

There are two events defined for inter-RAT measurement Mn+Ofn>Thresh2+Hys for all measurements taken during
reporting in LTE, events B1 and B2. a TTT (time-to-trigger) period. Note that a common
Hysteresis value is used for both thresholds, but the offset
Event B1 is the simpler of the two and is satisfied when an
value Ofn, for neighbor n, is specific to the frequency used
inter-RAT neighbor becomes better than an absolute
by the IRAT neighbor.
threshold after taking offset and hysteresis values into
account. This can be seen in the diagram if we ignore the The availability of B1 and B2 events, in addition to A event
Ms (Serving cell measurement) line and only look at the give flexibility for optimizing IRAT procedures for different
Mn (Neighbor cell measurement) and Mn+Ofn (Offset for environments.
neighbor-dashed) lines. The second inequality, Mn+Ofn-
For example, the simpler event B1 may be more often
Hys>Thresh, defines the condition for satisfying B1. Event
used at the periphery of the LTE coverage where we
B1 is simply a comparison of the neighbor IRAT cell with
expect the LTE cells to deteriorate rapidly as the UE moves
the absolute threshold which can be adjusted by a
outside their coverage area into another RAT such as
constant hysteresis (∆), and a frequency dependent offset
GSM. As in the idle-mode case, the value of Time-to-
value for the neighbor, Ofn. The threshold is given in dBm
Trigger parameter can be scaled according to the “speed”
or dB values depending on the quantity measured Mn.
(in reality, rate of cell change) of the UE.
The reporting event is triggered when the condition,
Mn+Ofn-Hys > Thresh, is satisfied for all measurements
taken during a TTT (time-to-trigger) period.
Event B2 is an extension of event B1, where the UE also
takes the signal strength/quality of the serving LTE cell
into account. In this case, the reporting condition is
satisfied when Ms+Hys<Thresh1 AND
95
UMTS Measurement
Procedure
96
IRAT Measurement in UMTS

UE SRNC
Measurement Control
• Measurement ID
• Measurement Command
• Reporting Mode
• Measurement Type
– Inter-RAT
• IRAT Reporting Criteria: Event, Time-to-Trigger, Thresholds
• E-UTRA frequency list: Carrier freq, Bandwidth, Cell-IDs
• IRAT measurement quantity: RSRP, RSRQ or Both
Measurement Report
• Measurement ID • E-UTRA Measured Results
• Event results − Phys Cell-ID, Frequencies,
−Event ID, Phys Cell-ID RSRP, RSRQ
In UMTS, the Measurement procedure is triggered by an should do measurements, physical cell identities (0 to
RRC Measurement Control message. Here the UE 503) and optionally a Blacklisted cells list which will
understands that it either has to start or modify the not be used.
measurement procedure, how to report, and the fact that
• IRAT Measurement quantity, which for E-UTRA is
it is an Intra Frequency (most common case), inter-
RSRP (98 levels) and RSRQ (34 levels) and filtering
Frequency or Inter-RAT measurement. The other
information about how the averaging of
measurement types are: UE Positioning, Traffic Volume,
measurements should be done. E-UTRA can request
Quality and UE Internal Measurements. An identity
RSRP, RSRQ or both.
number (1 to 16) is picked to link the reports from the UE
to this message. The SRNC (Serving RNC) can also • Information about the periodicity and Events (IDs and
command the UE to Set, Modify or Release a thresholds).
Measurement using the Measurement Command Then the UE, based on the command from the RNC,
information element. The Reporting Mode indicates measures and reports using an RRC Measurement Report
whether the measurement is to be reported periodically or message. The Measurement ID and result together with
based on event triggers. Reporting Criteria will give more the Event results are sent in the message. Upon receiving
details for a specific measurement type , such as number the Measurement report from the UE, the SRNC may
of repetitions, Event ID, thresholds, time-to-trigger, etc. decide to initiate an inter-RAT handover procedure to from
For the Inter-RAT measurement type, the RNC specifies a UTRA to E-UTRA.
group of parameters, including the following:
• E-UTRA frequency list, is complete list of
measurement objects for E-UTRA. The list contains
the frequencies, the bandwidths over which the UE
97
Compressed Mode Overview

Why is it
needed?
• Full dual receiver terminals for all mobile stations may not be available
• Keeps cost of the mobile station to a minimum by not requiring full dual
receiver
UMTS LTE
Requirements for Compressed Mode
• Obtaining good indication of quality of other carriers in adequate time

• Performing with minimal degradation of link or overall system capacity
The need for inter-frequency measurements necessitates • Also, note that the use of the compressed method is
the need for some mechanism to allow the mobile to detrimental to link performance in cell edges. Since a
continue with the current operation and still measure the soft handover is not possible, the mobile is probably
new system or frequency. This can be done in two ways: using maximum power and there is no power
headroom.
• With a dual receiver terminal, the mobile has two
receivers typically used for antenna diversity The motivation for introducing the compressed mode
techniques. When the need for measurement arises, procedure is listed in the slide. The reasons given are
one of the antennas continues with the current some of the fundamental UMTS requirements such as low
connection, while the second antenna is tuned to the cost and backward compatibility.
other frequency for obtaining measurement
In the compressed mode format, the mobiles must be
information. Since the antenna diversity is non-
given adequate time to look at the other system or
existent at this point, the power is ramped up on the
frequency and perform measurements. For example, for
original connection to maintain quality. One of the
LTE system the mobile has to synchronize to the slot and
drawbacks of this approach is that all mobiles do not
frame structure of LTE cell. Then derive the physical cell id
contain dual receivers, as it is cost prohibitive. Thus,
of the cell and measure the RSRP and/or RSRQ which are
a cheaper mechanism is needed for mobiles in UMTS
indicators of signal strength and quality respectively. The
systems to perform inter-frequency measurements.
UE will be provided with the carrier frequency and
This approach is the Compressed Mode Procedure
required measurement bandwidth before the
• The Compressed Mode Procedure allows the UE, with measurements take place. The must know when and how
only one receiver, to obtain measurements and still the measurement opportunities for compressed mode
continue with the original connection. occur and this information is given to the UE through L3
signaling.
98
Compressed Mode Procedures

How is
it done?
• Forced “break” in transmission and reception (few ms) for performing measurements,
etc.
Increased Transmission gap (a few slots)
Power
Downlink
10 ms frame
• Increased transmit power during this period to keep quality (FER, BLER, BER…)
unaffected due to reduced processing gain.
More Power!
Increased Transmission gap (a few slots)
Power
Uplink
10 ms frame Award Solutions Proprietary
Some of the requirements of the UE in compressed mode measurement is done in a compressed frame.
can be summarized as follows:
The general principle of the Compressed Mode Procedure
• A UE, on higher layers commands, monitors cells on is to allow a “break” or a recess in the mobile’s current
other frequencies (FDD, TDD, GSM, LTE). To allow the processing of frames to allow for other activities such as
UE to perform measurements, higher layers (RRC) measurements. This break in the transmission is done
command that the UE enters in compressed mode, with increased power so that the quality targets such as
depending on the UE capabilities. BER, BLER, etc. are still maintained at the same level.
• In case of a compressed mode decision, the UTRAN
communicates the parameters of the compressed
mode to the UE. A UE with a single receiver supports
downlink compressed mode.
• Every UE supports uplink compressed mode when
monitoring frequencies that are close to the uplink
transmission frequency (i.e., frequencies in the TDD
or GSM 1800/1900 bands).
• All fixed-duplex UEs support both downlink and uplink
compressed mode to allow inter-frequency handover
within FDD and inter-RAT handovers
• Dual receivers do not need to support the
compressed mode. Also, only one type of
99
Compressed Mode Type for LTE

Transmission
Gap Length
(TGL)
Slot 0 Slot 14
10ms Frame
Transmission Gap Pattern Length (TGPL)
10ms Frame
1. Several parameters together define the gaps and the pattern of gap occurrences
2. For E-UTRA measurements, TGL ≥10 slots and TGPL ≤ 12 frames
Several parameters are signaled to for the compressed

mode operation which uses gaps in operation for
measuring the other RAT cells.
• TGL is the Transmission Gap Length which indicates
the slot values where the gaps occur. The number of
gap slots is referred to as Transmission Gap Length
(TGL) and this is indicated by an RRC message with
the “E-UTRAN Measurement” information element.
• TGPL or the Transmission Gap Pattern Length is the
number of frames for which the gap pattern defined
by TGL occurs. For measurements on LTE cells, the
requirement is not to have more than 12 consecutive
frames with a gap pattern, the thirteenth frame must
not have any gaps.
So in practice, a UE may be active in UMTS for as low as
14 percent of the time during compressed mode
operation for LTE. In order to minimize the effects of lost
slots, we can use data compression at higher layers
and/or the use of lower Spreading Factor. Unfortunately,
the use of a lower spreading factor requires more power
on the transmit side by a rough factor of 2 (3dB).
100
UMTS: IRAT Event 3a

IF (UMTS quality falls below a threshold)
AND
(E-UTRA quality rises above a threshold)
THEN
Send measurement report to RNC
Measurement LTE Threshold UMTS Threshold

Quantity
UMTS
E-UTRA
Time-to-Trigger
Event 3A Time
UE sends MR
Four measurement report events have been defined to

support Inter-RAT measurements. The first event, 3a, is
the most sophisticated of the four and is shown in the
slide. The 3a event is defined so the mobile reports when
the total UMTS signal strength drops below a threshold
and the best E-UTRA signal quality/strength goes above a
threshold. These thresholds are independent. Similar to
LTE case, there are Hysteresis, Time-to-Trigger and Offset
parameters associated with this event.
Typically, the UE needs to be in the compress mode to
carry out these measurements, unless it is a UE with dual
radio front end capability. It is normal to use other events
such as inter-frequency event 2d (currently used
frequency drops below a threshold) to force the UE into
compressed mode operation and then carry out the inter-
RAT measurements which need the compressed mode in
any case. If such a strategy is not used, the UE will need to
be in compressed mode during extended periods of time
which can severely affect the performance of the network
and the UE.
101
Other Inter-RAT Reporting Events
• The E-UTRA quality has moved

Event 3b below a threshold
• The E-UTRA quality has moved

Event 3c above a threshold
• There was a change in the order

Event 3d of the best E-UTRA cell list
Besides the commonly used and important Event 3a,

three more events are defined in UMTS for additional
flexibility in network optimization. These events can be
seen as simpler subsets of Event 3a which is a
comparison of the serving UMTS cell and the neighboring
LTE cell.
The other events are:
• Event 3b: The E-UTRA RSRP/RSRQ has moved below
a fixed threshold.
• Event 3c: The E-UTRA RSRP/RSRQ has moved above
a fixed threshold.
• Event 3d: There was a change of the best cell among
the E-UTRA cells.
102
Exercise: LTE and UMTS Measurements
1. UMTS measurement quantities include ________ and

________, while LTE measurement quantities include
________ and ________. {RSRP, RSCP, (Ec/N0), RSRQ}
2. On the air interface, UMTS cells are identified by ________,
while LTE cells are identified by ________. {PN Offsets,
PCIs, PSCs, IP Addresses}
3. Event ________ facilitates UMTS-to-LTE handover, while
Event ________ facilitates LTE-to-UMTS handover. {1D, 3A,
B2, C5}
RSRP: Reference Signal Received Power, RSCP: Received Signal Code

Power, RSRQ: Reference Signal Received Quality, PCI: Physical Cell ID,
PSC: Primary Scrambling Code
103
Handover Examples –
S4 SGSN
104
Handover Examples - S4 SGSN
 1. UMTS Access
Anchoring of Calls
at S-GW
Release 8 UMTS
3. LTE-to-UMTS
handover
2. UMTS-to-LTE
handover
In the following pages, we will study the signaling flows for

handover from UMTS to LTE and then LTE to UMTS. In
both cases the SGSN has been upgraded to interwork with
the MME and other components in the LTE network.
105
Initial Data Path

PDN
P-GW
S4 SGSN
3G PS- MME
CN
SGSN LTE Core
S-GW
RNC
Mobility
3G
UTRAN E-UTRAN Anchor
Node B Direct eNode B
Tunnel
The slide shows the data path for user traffic after a
session has been established from a UTRAN-connected
mobile.
With the S4 SGSN option, calls are anchored at the S-GW
for LTE interworking whether the UE is UTRAN or E-UTRAN
connected.
The optional direct tunnel feature is shown in the slide.
The direct tunnel is created between the RNC in the
UTRAN and the S-GW. The SGSN co-ordinates and sets up
the tunnel between the UTRAN and the S-GW.
In the first handover example, direct forwarding is
employed during the handover from UTRAN to E-UTRAN
and no change of S-GW is needed.
106
Handover Signaling Overview

Source RAN Measurements Target RAN
CORE Network Prepare

Start
Resources
Source-to-Target
Container
CORE Network
QoS, Keys, Bearers
UE Capabilities Target-to-Source
Container
HO Command Access and Completion of HO
The basic principles of inter-RAT handover signaling are Meanwhile, necessary connections are established
reviewed here at a high level. The inter-RAT HO is between the core nodes to carry the users traffic. The
essentially controlled by the source access RAN which overall signaling scheme shown here is generic and
decides to initiate the handover, perhaps based on applies also to situation were the Source and Target
measurements received by the mobile. However, networks are using the same RAT.
measurements are not necessary for doing an inter-RAT
handover (handovers that are not triggered by the UE
measurement are sometimes referred to as “blind
handovers”).
The source and target radio access networks
communicate through containers which are transparent to
the Core network elements. The source will indicate the
need for HO to the Core network, which will pass the
container to the target RAN as designated by the source.
The target RAN will prepare Radio Resources (RR) for the
incoming mobile. The target is responsible for guiding the
mobile on how to make access there and to do this it will
use a container that will convey the necessary RAN
parameters when the mobile attempts access on the
target RAT.
107
UTRAN-to-LTE Handover
(S4-SGSN)
The following scenario includes the options:

• Direct tunnel while UTRAN connected,
• Direct forwarding (RNC to eNB) during the handover,
and
• No change of S-GW during the handover.
108
S4 SGSN-to-LTE HO – Preparation 1
Source
UE RNC SGSN S-GW P-GW eNB MME
1. Measurement Report
(e3a or e3c)
2. Relocation Required 3. MME
eNB ID selection
RNC to eNB
transparent
container
4. Forward Relocation Request
RNC to eNB transparent
IMSI eNB ID
container
MM context PDN connection
(LTE Auth APN, IPv4/IPv6 address,
Vector) bearer context
1-2. To start with, the UE is using UMTS access and the bearers at the S-GW. The next step is to prepare the
user plane packets are getting transmitted over the LTE network for the handover before the actual
UMTS bearers. Based on the measurement report execution of the handover process. SGSN triggers the
sent by the UE, the RNC initiates a handover to LTE. handover preparation in the target MME.
RNC sends the target eNode B ID to the SGSN. A
transparent container carrying radio-related
information is sent. This information is meant for the
eNode B. The rest of the nodes carry it transparently.
3. Based on the eNode B ID, the SGSN selects the MME
serving that target eNode B.
4. The SGSN sends all the PDP context information and
the security information. MME does one-to-one
mapping of the PDP contexts with the EPS Bearers
and also does mapping QoS profiles from UMTS to
LTE. Mapping of the security information eliminates
the requirement to do LTE AKA. PDN Connection
contains information about the IP addresses
allocated to the UE, APN to which UE is connected to,
P-GW and S-GW addresses, TEIDs for all the EPS
109
S4 SGSN-to-LTE HO – Preparation 2
Source
5. Handover Request
RNC to eNB Transparent Container

EPS Bearers to be set up (EPS
Bearer ID, S-GW GTP TEID, QOS)
Security Info
Reserves
Resources
6. Handover Request Ack
eNB to RNC Transparent Container

EPS Bearers admitted list
(eNB Addr & S1-U TEID)
7. Forward Relocation Response

eNB Addr & S1-U TEID
5-6. MME initiates the RAB setup procedure towards the

target eNB. It sends the security information and the
QoS information for the RABs. The eNB reserves
resources, if necessary, for these RABs and replies to
the MME. RABs have been created at this point. The
eNB communicates its IP address and TEID(s) for
downlink data and has received the S-GW’s IP
address and TEID(s) for uplink data. eNB also sends
radio related information to the RNC transparently
through SGSN and MME. This contains an RRC
message, “RRC Connection Reconfiguration” for the
UE.
7. MME indicates the successful handover preparation
process to the SGSN. In this message it sends the
transparent container that contains radio-related
information. In the example shown, direct forwarding
applies so the message also contains the target
eNB’s IP address and TEID(s).
110
S4 SGSN-to-LTE HO - Execution
Source
8. Relocation Command

eNB Addr & S1-U TEID
9. Handover Direct
From UTRAN Forwarding
Command (DL Data)
E- UTRAN Access
10. Handover to E-UTRAN Complete 11. Handover Notify
12. Forward Relocation Complete

SGSN may
maintain UE 13. Forward Relocation Complete Ack
context
8. The SGSN now requests the RNC to initiate the forwarded from the eNB to the UE.
handover process. In this message, it sends the
11. The eNB indicates that target cell acquisition is
transparent container from the eNB, and, if direct
achieved by sending the Handover Notify message
forwarding applies (shown in slide), the target eNB
to the MME.
address and TEID. Otherwise if indirect forwarding
applies and direct tunnel applies then it contains the 12,13. The MME informs the SGSN of the success. If the
target S-GW forwarding TEIDs. Idle State Signaling Reduction (ISR) features is in
effect, the SGSN will maintain the UE's contexts.
9. The RNC in turn sends the handover command to the
The Forward Relocation Complete Notification
UE. The exact name of this RRC message is
message contains a parameter indicating if ISR is
HANDOVER FROM UTRAN COMMAND. This message
activated (only possible if no change of S-GW).
will carry the E-UTRAN RRC Connection
Reconfiguration which was received during the
preparation phase from the target eNB. This is sent
as a transparent container to the UE and will include
radio access-related information on the E-UTRAN for
the UE. This includes information such as the Physical
Cell ID of the target cell.
10. The UE acquires the target cell. During this time, the
downlink packets go from the P-GW to the source S-
GW, then from the source S-GW to the RNC and
finally from RNC to the target eNodeB. Now that the
UE has acquired the eNB, the packets can be
111
S4 SGSN-to-LTE HO - Completion
Source
14. Modify Bearer Req/Rsp
15. Iu Release Procedure
14. Now that all the bearers are ready in E-UTRAN, MME
updates the source S-GW with the eNode B Address
and TEID. This gets the RNC out of the forwarding
loop. Downlink and uplink packets are now traveling
from P-GW to the S-GW to target eNode B.
15. SGSN cleans up the resources that were allocated to
the UE in the UTRAN and Iu interface.
112
Exercise: UMTS-to-LTE Handover

Draw the user data path BEFORE and AFTER the UMTS-to-LTE
handover for S4-SGSN interworking. Assume the absence of a
Direct Tunnel.
PDN
P-GW
3G PS-CN MME
S4 SGSN LTE Core
S-GW
RNC
3G
E-UTRAN
UTRAN
Node B Award Solutions Proprietary eNode B
Exercise: Draw the user data path before and after the
handover from UMTS to LTE.
113
Handover Examples - S4 SGSN
 1. UMTS Access
Anchoring of Calls
at S-GW 
Release 8 UMTS
3. LTE-to-UMTS
handover
 2. UMTS-to-LTE
handover
Now we look at the signaling flows for handover from LTE

to UMTS.
The SGSN has been upgraded to interwork with the MME
and other components in the LTE network.
In the following handover example, indirect forwarding is
employed during the handover from E-UTRAN to UTRAN
and no change of S-GW is needed.
After the handover, the optional direct tunnel feature is
NOT in operation and the SGSN is in the data path.
114
LTE-to-UTRAN Handover
(S4-SGSN)
The following scenario includes the options:

• Indirect forwarding during the handover,
• No change of S-GW during the handover, and
• After the handover, direct tunnel is NOT in operation.
115
LTE-to-S4 SGSN HO – Prep 1
eNB MME Source S-GW P-GW RNC Target SGSN

UE
(eB1 or eB2)
2. HO Decision
3. Handover Required SGSN

selection
eNB ID 4. Forward Relocation Request
Target RNC
IMSI, RNC ID
eNB to RNC
transparent eNB to RNC Transparent container
Container MM context (UMTS Auth vector)
(visited PDN connection (APN, TEID,IP
Maps EPS bearers
Cell list) address, EPS bearer context)
to PDP contexts
1. The mobile is in LTE coverage with an active bearers at the S-GW. The target SGSN does one to
connection. However the LTE signal level may be low one mapping of the EPS bearers with the PDP
and therefore the eNB has asked the UE to measure contexts and also does mapping QoS profiles from
UMTS cells also. The UE subsequently sends a LTE to UMTS.
measurement report to the eNB indicating event B1
The next step is to prepare the UMTS network for the
or B2 has occurred.
handover before the actual execution of the handover
2-3. Based on the measurement report sent by the UE, process. If the S-GW needs to be relocated (option
the eNB initiates a handover to UTRAN. The eNB not shown on slide), the SGSN will choose one and
sends the target RNC ID to the MME in order that the create a session in the new target S-GW for the UE.
MME may choose an appropriate SGSN for the
handover. A transparent container carrying radio-
related information is sent. This information is meant
for the RNC. The rest of the nodes carry it
transparently. In this case, the content is UE history
giving a list of the most recently visited cells.
4. Based on the RNC ID, MME selects the SGSN serving
that target RNC. MME sends the security context
information to the SGSN including supported
ciphering algorithms and keys. The PDN Connection
contains information about the IP addresses
allocated to the UE, APN to which UE is connected to,
P-GW and S-GW addresses, TEIDs for all the EPS
116
LTE-to-S4 SGSN HO–Prep 2

Source
UE eNB MME S-GW P-GW RNC SGSN
5. Relocation Request

RAB Info (QOS)
Security Info
Reserve Resources
6. Relocation Req. Ack
S4-U Target S-GW Forwarding TEID

8. Handover Command

S1-U source S-GW Forwarding TEID
E-RAB to Release List Award Solutions Proprietary
5. The SGSN initiates the RAB setup procedure towards 7. The target SGSN sends the Forward Relocation
the target RNC. It sends security information, Response message to the MME. Key parameters
including IK, CK and related algorithms. This allows include:
data transfer to continue in the UMTS network
• Control Plane TEIDs and IP addresses
without having to perform a new authentication
procedure. SGSN also includes parameters for all the • Serving GW change indication if the SGSN
RABs that are requested to be established. This will choose a new S-GW (not shown on slide)
include QoS information per RAB. • Target to Source Transparent Container
6. RNC performs admission control and reserves • Accepted and failed RAB Setup Information
resources for some or all RABs. It sends the message
Relocation Request Acknowledge containing a list of • IP address/TEID for user plane data forwarding:
RABs setup and a list of RABs that failed. The failed there are three possibilities.
RABs will be deactivated after the handover is
complete. The RNC is now ready to receive downlink
traffic from either the S-GW or the target SGSN if
direct tunnel is not used. The RNC also sends the
“Target to Source Transparent Container” which flows
transparently through SGSN and MME to the eNB. In
this case it contains the RRC message from the target
RNC to the UE.
117
LTE-to-S4 SGSN HO–Prep 2 (continued)
Source
5. Relocation Request

RAB Info (QOS)
Security Info
Reserve Resources
6. Relocation Req. Ack
S4-U Target S-GW Forwarding TEID

8. Handover Command

S1-U source S-GW Forwarding TEID
E-RAB to Release List Award Solutions Proprietary
The IP address/TEID for user traffic data forwarding target S-GW forwarding TEIDs and the transparent
may indicate the RNC, the SGSN or a new S-GW. container that contains radio related information
• If 'Direct Forwarding' applies, or if 'Indirect Forwarding' 8. MME now requests the eNB to initiates the Handover
and no relocation of Serving GW apply and Direct process. In this message it forwards the source S-GW
Tunnel is used, then the IE 'Address(es) and TEID(s) forwarding TEIDs.
for User Traffic Data Forwarding' contains the
addresses and GTP-U tunnel endpoint parameters to
the Target RNC received in step 5a.
• If 'Indirect Forwarding' and relocation of Serving GW
apply, then the IE 'Address(es) and TEID(s) for User
Traffic Data Forwarding' contains the address and DL
GTP-U tunnel endpoint parameters to the Serving GW
received in step 6a. This is independent from using
Direct Tunnel or not.
• If 'Indirect Forwarding' applies and Direct Tunnel is
not used and relocation of Serving GW does not
apply, then the IE 'Address(es) and TEID(s) for User
Traffic Data Forwarding' contains the DL GTP-U tunnel
endpoint parameters to the Target SGSN.
SGSN indicates the successful handover preparation
process to the MME. In this message it sends the
118
LTE-to-S4 SGSN HO–Execution

Source
9. Mobility from E-UTRAN Cmd
Indirect
Forwarding
(DL Data)
UTRAN Access
10. Handover to UTRAN Complete 11. Relocation Complete
13. Forward Relocation Complete Ack
14. Modify Bearer Req

SGSN IP Address and TEID(s)
9. The eNB in turn sends the Handover command to the 14. Now that all the bearers are ready in UMTS, the SGSN
UE. The exact name of this RRC message in Rel8 is completes the Handover execution by informing the
MobilityFromEUTRACommand, and in case of S-GW that the SGSN is now responsible for all the EPS
handover it will carry information about radio Bearers of the UE. The message Modify Bearer
resources that have been allocated in the target cell Request is sent. Key parameters are NSAPI(s), SGSN
for this UE. This information about target RAN is sent IP Address and TEID(s) for User Traffic for the
as a transparent container in this message. (The accepted EPS bearers (assuming Direct Tunnel is not
other possibility for the MobilityFromEUTRACommand used), ISR Activated or not. Note if the message does
is a Cell Change Order (CCO) command which does not indicate ISR Activated and S-GW is not changed,
not have a container and must carry explicit the S-GW deletes any ISR resources by sending a
information about the target cell and RAT such as Delete Bearer Request to the MME.
Physical Cell Ids and carrier frequencies).
UE tries to acquire the target cell. During this time the
downlink packets go from P-GW to the source S-GW, then
from source S-GW to the eNB, from eNB back to the
Source S-GW and from Source S-GW to the SGSN and
from the SGSN to the RNC.
10-13. UE acquires the target cell. UE indicates the
UTRAN target cell acquisition by sending the
Handover Complete message to the RNC. RNC
indicates it to the SGSN. SGSN passes this
information to the MME.
119
LTE-to-S4 SGSN HO – Completion

Source
15. Modify Bearer Res
16. Routing Area Update (if needed)
17. Delete Indirect Data Forwarding Tunnel

Request / Response
18. Release Resources
15. The S-GW acknowledges the user plane switch to

the SGSN by sending Modify Bearer Response. At
this stage, the user plane path is established for
all EPS Bearers. The path is from UE to RNC to
SGSN to S-GW to P-GW. The Serving GW will send
"end marker" packets on the old path to the eNB
immediately after switching the path.
16. If the UE discovers that the current RA is not
registered with the SGSN, or if the TIN is set to
"GUTI", then it will initiate a Routing Area Update
procedure.
17–18. MME cleans up the resources that were allocated
to the UE in the eNode B and the indirect
forwarding tunnels that were used temporarily
during the handover.
120
Exercise: LTE-to-UMTS Handover

Draw the user data path BEFORE and AFTER the LTE-to-UMTS
handover for S4-SGSN interworking. Assume the absence of a
Direct Tunnel.
PDN
P-GW
3G PS-CN MME
LTE Core
S4 SGSN
S-GW
RNC
3G
UTRAN E-UTRAN
Node B
eNode B
Exercise: We have described an example handover from

LTE to UMTS. Draw the old and new user data paths
before and after the handover from LTE to UMTS.
121
LTE-to-UTRAN Pre-R8
(Gn SGSN)
122
LTE-to-Gn SGSN Handover Prep

Yahoo PDN
server
P-GW
3. and 7. Forward
MME relocation Gn SGSN
EPC request/Response
5
S-GW
5. Admission
2. Handover 4. or 6. control and radio
8. Handover required Relocation access bearer
command Request/Ack establishment
E-UTRAN RNC
5
eNode B 1. Handover Node B

decision
To start with UE, is using LTE IP-CAN for all his active the RNC.
sessions. All the required bearers have been setup in LTE
6. An acknowledgement of this would be sent to the
for the UE.
MME through the SGSN. This Relocation Request
1. Now based on the measurement report sent by the ACK message would contain information about the
mobile, the eNodeB initiates a handover to the UMTS tunnel between the eNodeB and the RNC for data
cell. forwarding and also the radio-related information that
the UE needs to handover to UMTS.
2. The source eNode B sends the “Handover Required”
message to the MME. In this message target RNC 7. The SGSN forwards this information to the MME.
identifier, bearers that require data forwarding
8. The reception of the acknowledgement message at
between the eNodeB and the target RNC would be
the eNodeB, completes the data forwarding path
sent.
between the eNode B and the target RNC.
3. Now the MME indicates to the SGSN in the Forward
Relocation Request message. This message includes
all the information sent by the eNode B and also the
information about the PDP sessions, Tunnel Endpoint
ID for the P-GW, etc.
4. Based on the information sent by the MME, the SGSN
and the target RNC do admission control.
5. The SGSN and the RNC establish the bearer between
the RNC and NodeB and also between the SGSN and
123
LTE-to-Gn SGSN Handover:

Execution and Completion
Yahoo PDN
server
18. Update PDP context

P-GW Gn SGSN
X EPC MME
19
S-GW
10. Forward
19. Release SRNS Context
Resources
X E-UTRAN
RNC
19
eNode B 15. UTRAN
access
9. Mobility from procedure Node B
19 19 E-UTRAN
X Command
9. The eNodeB sends a Mobility from E-UTRAN 19. Now the MME directs eNode B and S-GW to release
Command to the UE with the radio related all the resources used for that UE in LTE.
parameters sent by the target RNC.
10. It also forwards context information like PDCP
sequence number, GTP sequence number, etc. to the
MME using the SRNS forward context message.
11. This message is forwarded to the SGSN.
12. This message is then forwarded to the RNC.
13. The RNC responds with a Forward SRNS Context ACK.
14. The SGSN forwards this message to the MME.
15. The UE completes the UTRAN access procedure.
16. The RNC sends the Relocation Complete Message to
the SGSN
17. The SGSN in turn sends it to the MME.
18. At the reception of the Relocation Complete message
from RNC, the SGSN establishes a bearer with the P-
GW using the Update PDP context procedure. This
completes the establishment of all the required
bearers in UMTS for that UE.
124
UTRAN-to-LTE
(Gn SGSN)
125
UTRAN-to-LTE Handover - I
Source Target Old Gn/Gp New

MS RNC eNB SGSN MME P-GW HSS
S-GW
1. Decision to Handover
2. Relocation Required 3. Forward Relocation Request
4. Create Session Request
5. Create Session Response
6. Handover Request
Establishment of Radio Access Bearers

7. Handover Request Acknowledge
8. Create Indirect Data
Forwarding Tunnel Request
Forwarding Tunnel Response
C1
11. Relocation Command Award Solutions Proprietary
1. The UE has been communicating the UMTS RNC. convey to the eNodeB information about the S-GW
Based on UE measurements of UMTS and LTE, the side of the S1-U tunnels.
RNC makes a handover to E-UTRAN decision.
6. The MME sends a Handover Request message to the
2. The SRNC requests the SGSN to relocate the UE by eNodeB to set up E-RABs. The MME translates the
sending a Relocation Required message. This security parameters received from the SGSN into the
message includes identity of the target eNodeB. LTE security parameters. The MME also converts the
Gn/Gp SGSNs may be configured to use RNC IDs RNC address received from the Gn SGSN into an
instead of eNodeB IDs to identify a target eNodeB. eNodeB address. The MME determines if packet
forwarding from UMTS to LTE is to be done or not.
3. The SGSN sends a Forward Relocation Request to the
MME based on the identity of the target eNodeB. This 7. The eNodeB replies with Handover Request
message also contains existing MM and PDP Acknowledge message after executing admission
contexts. The PDP context contains the IP address of control.
the P-GW for User Plane and Uplink TEID for Data so
that UE’s uplink packets can be sent to the P-GW. The
MME needs to perform mapping maps the PDP
context parameters to EPS bearers.
4. The MME sends a Create Session Request message
to the selected S-GW. The S-GW now knows the
information about the uplink tunnel toward the P-GW.
5. The S-GW sends a Create Session Response
message back to the MME so that the MME can
126
UTRAN-to-LTE Handover – I (cont.)

MS RNC eNB SGSN MME S-GW P-GW HSS
1. Decision to Handover
2. Relocation Required 3. Forward Relocation Request
4. Create Session Request
5. Create Session Response
6. Handover Request
Establishment of Radio Access Bearers

7. Handover Request Acknowledge
Forwarding Tunnel Response
C1
11. Relocation Command Award Solutions Proprietary
8, 9. In case of indirect forwarding from UTRAN to the

eNodeB via the S-GW, the MME sends a Create
Indirect Data Forwarding Tunnel Request
message to the S-GW, which contains
information about the eNodeB side of the
downlink forwarding tunnel between the eNodeB
and the S-GW. The S-GW responds with a Create
Indirect Data Forwarding Tunnel Response that
includes the tunnel information about the S-GW’s
side of the tunnel (which is between the S-GW
and the UMTS network (i.e., SGSN or RNC).
10, 11. Since the LTE network is ready for the UE, the
MME sends a Forward Relocation Response to
the SGSN, which, in turn, sends a Relocation
Command message to the RNC. The RNC/SGSN
is aware of the packet forwarding tunnel at this
time.
127
UTRAN-to-LTE Handover - II

S-GW
12. Forwarding of Data
13. RRC Message
14. Forward SRNS Context

14. Forward SRNS Context
14. Forward SRNS
Context Acknowledges
MS Detected by Target RNC
15. HO to EUTRAN Complete

15. Handover Notify
16. Forward Relocation

Complete Acknowledge
12. User packets can now be forwarded from the RNC to

the target eNodeB directly or via S-GW.
13. The RNC instructs the UE to go to a cell in the target
eNodeB by sending an RRC message (e.g., Handover
from UTRAN Command).
14. This step is not applicable to inter RAT handovers
between UTRAN and E-UTRAN.
15. The UE sends a Handover to EUTRAN Complete
message to the eNodeB acknowledge reception of
the RRC message from the RNC. The eNodeB, in turn,
sends a Handover Notify message to the MME.
16. The MME informs the SGSN that relocation from
UMTS to LTE has been completed.
128
UTRAN-to-LTE Handover - III

S-GW
20. Iu Release Command
17. Modify Bearer Request
20. Iu Release Complete
18. Modify Bearer
Request/Response
19. Modify Bearer Response
21. Tracking Area Update Procedure
22. Procedure in TS 23.401 (Steps 2 to 7 of Figure 5.4.2.2-1)
23. Delete Indirect Data

23. Delete Indirect Data

Forwarding Tunnel
Response
17. Since the UE is well-established in the LTE network about the subscriber from the HSS such as the
due to completion of handover with E-UTRAN, the subscribed UE-AMBR and APN-AMBR values.
MME sends a Modify Bearer Request message to the
22. The MME calculates UE-AMBR and (if needed)
S-GW with the eNodeB side of the S1-U tunnel
initiates Subscribed QoS Modification procedure to
information.
convey the derived UE-AMBR to the eNodeB and the
18 and 19. The S-GW sends a Modify Bearer Request to subscribed APN-AMBR to both S-GW and P-GW.
the P-GW so that the P-GW can switch the downlink
23. Upon expiration of the timer, the MME asks the S-GW
tunnel from the SGSN to the S-GW. After switching the
to release the resources allocated for indirect packet
tunnel, the P-GW replies with a Modify Bearer
forwarding.
Response.
19. The S-GW informs the MME about the user plane
switch by sending a Modify Bearer Response
message.
20. The resources in the source UMTS network need to
be released now. Iu Release Command and Iu
Release complete messages help accomplish this
cleaning-up task.
21. Since the MME is aware of the handover from UMTS
to LTE, it carries out part of the TA update procedure.
For example, the MME excludes the context transfer
procedure with the SGSN but obtains the information
129
Redirection from LTE to UMTS
eNB MME Source S-GW P-GW RNC Target SGSN

UE
Measurement Report (optional)
2. HO Decision
RRC Connection Release

- Redirected Carrier Info
- Frequency priority
Cell Reselection
A very basic method of doing handover from LTE to UMTS

is for the eNB to release the RRC connection with an
indication that the UE should do cell reselection into the
UTRAN environment.
The parameters that support this are:
• redirectedCarrierInfo: This indicates a UMTS carrier
frequency for the UE to tune to.
• cellReselectionPriority: This specifies the priority of the
UMTS carrier frequency for cell reselection.
130
Exercise: S4-SGSN and Gn-SGSN

Handover
Identify each statement as True or False.
1. In case of S4-SGSN handover to and from E-UTRAN,
S-GW continues to serve as a local mobility anchor for
the user traffic.
2. For LTE-to-UMTS S4-SGSN handover, MME makes the
handover decision.
3. For UMTS-to-LTE Gn-SGSN, RNC makes the handover
decision.
4. S4-SGSN supports packet forwarding between LTE and
UMTS but Gn-SGSN does not support such packet
forwarding.
5. Both S4-SGSN and Gn-SGSN allow preservation of an IP
address for the UE during handover.
131
E-UTRAN-GERAN
Handover
132
LTEGPRS Handover Options

• Cell Change Order
SGSN
• CCO + NACC
MME
• PS Handover EGPRS
LTE
eNB BSS
UE/MS
RRC- Packet Transfer

PS Handover
Connected Mode
Cell Change + Cell Change or

optional NACC Reselection
Reselection
RRC-Idle Packet Idle
Cell Change or Reselection

There are three main options for inter-RAT handover The necessary signaling for cell change is done through
between the LTE and GERAN (EDGE-GPRS) networks for a Radio Information Management signaling (RIM signaling),
mobile. The PS handover is the most complex procedure which is the transparent exchange of RAN related
and pertains to mobile in E-UTRA RRC connected to/from information through core network nodes.
a state in GPRS Packet Transfer mode. This method is
When the mobile is going from E-UTRA RRC_Idle to GPRS
best suited for real-time packet services were delays need
Packet_idle, the most commonly occurring procedure is
to be kept at a minimum. The delay requirement goals for
naturally a cell-reselection, with the following Tracking
real-time packet services (e.g. VoIP )should be ideally as
Area/Routing Area Update procedure. However, for the
low as CS delay requirements, however when inter-RAT
case of GPRS to LTE, the network controlled cell change
handover is involved the delays can be as long as 300-
procedure can be applied using Cell Change Order
500ms. The signaling procedure for packet-switched
messaging (CCO) as an option.
handover is very similar to the case between LTE and
UMTS. PS-handover may not be supported in a GPRS
network.
When PS handover is not supported, it is possible to
handover the mobile from RRC-Connected mode in E-
UTRA to GPRS_Packet_Idle mode using the
CELL_Change_Order message with optional Network
Assisted Cell Change procedure (NACC). NACC can reduce
the latency that is normally involved in cell reselection by
providing air-interface related information about the cell
that mobile is going to.
133
CCO+NACC
S3/Gn
EGPRS
LTE SGSN
MME
RIM Signaling
Gb/Iu
S1
BSS
eNB
UE RRC Connected
RIM Signaling Target

Source RAN RAN
Purpose set to: MobilityFromEUTRA

CellChangeOrder Command Connection Estabmnt
+NACC Sys info to GERAN BSS using
System Information
Network Assisted Cell Change is a mechanism for LTE to

GPRS inter-RAT ‘handovers’. It enables better
performance when a cell change has to occur in the
packet-switched domain and the PS-handover option does
not exist. NACC may be used optionally with Cell Change
Order procedure when a handover is initiated from the E-
UTRAN to GERAN. The exchange of RAN related
information is achieved through RIM signaling between
the Source and the Target radio networks. The RAN
information is relayed transparently between the source
and target using S1AP, BSSGP (in Gb mode), RANAP (in Iu
mode) and GTP between MME and SGSN. All nodes and
interfaces shown are impacted in order to support NACC
(Network Assisted Cell Change).
134
Summary
• IRAT handover signaling uses a transparent exchange of
target RAN-related information.
• IRAT handover has three phases: preparation, execution
and completion.
• Measurements in LTE and UMTS require gaps during
connected-mode communication.
• There is one-to-one mapping between the PDP context
and the EPS bearers.
• During HO, either direct or indirect forwarding may be
used.
• CCO with NACC is an option for connected-mode HO from
LTE-to-GPRS.
135
Review Questions
1. What LTE RRC message configures measurement
parameters for the connected UE?
2. (CCO+NACC) is an option when going from E-UTRAN to
GERAN. True or False?
3. In UMTS-to-LTE handover, which node is responsible to
make the handover decision?
4. List all of the measured quantities used for cell
evaluation in LTE, UMTS and GSM/GPRS. Include
units.
136
Additional Material
137
Data Forwarding Options

(During LTE-to-UMTS HO)
Direct or Indirect S-GW Direct DL Forwarding

Scenario Forwarding Applies Relocation Tunnel Address & TEID
1 Indirect NO YES RNC
2 Indirect YES n/a Target S-GW
3 Indirect NO NO SGSN
4 Direct n/a n/a RNC
In order to fully support real-time applications in a multi- the call.

technology network it is necessary to minimize or
3. The forwarding path for DL data may be affected by
eliminate any loss or delay of data during IRAT handovers.
the relocation of the S-GW. If indirect forwarding is
Consequently, during the handover user data needs to be
used then the traffic will flow thru both the source
forwarded between the two networks. There are a number
and target S-GWs.
of options for forwarding downlink data during handover.
The option used will depend on the following : 4. If direct tunnel is to be used in the target network
between the RNC and S-GW, this will also affect the
1. Direct forwarding from the eNB to the RNC may be
path of the DL forwarded traffic.
possible. Even though there isn’t a standard signaling
interface between the eNB and RNC, the user data The example in the previous few slides maps to the third
travels through a GTP tunnel which both support. In row of the table above where the forwarding address is
this case the eNB will forward DL data directly to the that of the SGSN. As an exercise, draw the data
RNC. forwarding data paths during handover for the other three
cases.
2. If direct forwarding is not possible then indirect
forwarding may be used. Both the MME and target
SGSN will need to be configured with one of three
options for indirect forwarding -- does not apply,
always applies, or, applies only for inter PLMN inter
RAT handovers. If indirect forwarding applies then the
MME and optionally, the SGSN will configure
forwarding paths on an S-GW. Note that the MME
may choose a different S-GW from the one serving
138
GERAN <-> LTE IRAT

Examples
139
Active Mode Measurements in GSM

0 1 2 3 4 5 6 7
Idle slots BSC
BTS HO
Active
Decision
LTE-capable MS
MEASUREMENT INFO
E-UTRAN_MULTIRAT_REPORTING # of cells in the report, 0-3
E-UTRAN_REP_QUANTITY RSRP or RSRQ
E-UTRAN Neighbor Cell list, EARFCN Cell and carrier freq info
Not-allowed cells Blacklisted LTE cells
REPORT_TYPE, Measurement Bandwidth Enhanced, Normal
REPORTING_GRANULARITY Granularity (Step size)
Qsearch_C_E-UTRAN Search threshold
E-UTRAN_MEAS_REPORT_OFFSET Offset values for reporting
When the LTE-capable mobile is in active mode on a will use the idle slots (and frames) for measuring cells on
GSM/GPRS network (technically referred to as MS in that other RATs. The measurement information elements guide
mode), it has to do Radio Link Measurements which are the MS about priorities and thresholds so that intra-RAT
used for handover and power control procedures. For measurement are not ignored, and inter-RAT
inter-RAT, it will receive information about inter-RAT measurements are made when necessary.
related measurement parameters on the Slow Associated
Control Channel (SACCH); which carries full system
information every 480ms. This Measurement Information
complements and (in certain cases) overrides the inter-
RAT information that the MS may have had in the idle
mode through BCCH. However, for the LTE cell list, the
information in SACCH can be used to derive a neighbor list
from SI2quater information that is on BCCH.
Some of the more important parameters for inter-RAT
measurement are shown in the table. For E-UTRAN, valid
cells to measure are identified cells on frequencies
included in the E-UTRAN Neighbour Cell list. The UE can
measure and report on these cells as long as they are not
members of the “not allowed” list.
Note that in GERAN there is no need for measurement
gaps or compressed mode for inter-RAT measurements.
The nature of TDMA is such that the multi-RAT capable MS
140
Enhanced Measurement Report
(Packet) (Enhanced) Measurement Reports

BSC
SACCH (SDCCH)
MS BTS
Enhanced Meas. Report
REPORTING_QUANTITY RSRP or RSRQ

E-UTRA Measurements Measurement values
E-UTRA_FREQUENCY_INDEX Frequency list for EARFCN
CELL_IDENTITY Physical E-UTRAN Cell id
• EGPRS can operate with no HO  MS does cell

reselection also in Packet Transfer Mode
• IF PS Handover is supported in EGPRS, then similar
procedures are defined in the packet domain
The E-UTRA-related measurement quantities are shown in time packet services. This scenario is even more plausible
the table. The measurement report can be of type if EDGE2 is deployed. In this case, PS Handovers must be
‘Enhanced’ or ‘Normal’. The MS is informed in the based on similar measurement procedures as described
downlink SACCH Measurement Information message in here, e.g., there is PACKET MEASUREMENT ORDER and
which type it shall use. The SACCH channel is normally PACKET ENHANCED MEASUREMENT REPORT messages
used, although SDCCH can also be used for measurement defined in EGPRS and Network Controlled (NC)
reporting. Both report types can carry inter-RAT cell measurement reporting can be used optionally.
measurements. The difference between the two methods
of reporting is primarily in the number of measurement
results that can be reported. Normal Measurement Report
can carry information about the six strongest cells. Intra-
and inter-RAT results share the same limited resource
within the message. Enhanced Measurement Reports on
the other hand can carry a much larger number of results
(32) in addition to new measurement quantities such as
FER (Frame Error Rate) and a better granularity in
reporting results (controlled mapping of binary values to
the measured quantities).
Note that in GPRS, we normally operate with no handover
and the MS can do cell reselections in both packet-idle
and packet transfer modes. However, it is possible to
implement PS Handovers in EGPRS for support of real-
141
RSRP, RSRQ Reporting in GERAN

Measurement Report
UL SACCH/PACCH BSC
eNB
MS BTS
RSRP 6bits dBm RSRQ 3bits* dB

0 Offset to Offset + Step
0 < - 140
1 Off+Step to Off + 2*Step
1 - 140 to - 138
2 Off+2*Step to Off+3*Step
2 - 138 to - 136
3 .
. .
4 .
. .
5 .
62 - 46 to - 44
6 Offset+6*Step to Off+7*Step
63 ≥ - 44
7 ≥ Off +7*Step
Step=1,2 dB, Off= -19.5 to -3.5 dB
* also 6 bit option
The reporting of RSRP and RSRQ in the GERAN domain is standards. However, this comes at the cost of modifying
limited by the format of the pre-existing SACCH. Thus the the format of SACCH channel. For a mobile that is using
reporting follows similar format that is used for reporting the EDGE channels, it will send the measurement report
of RxLEV and RxQUAL in GSM when a measurement on the Packet Associated Control Channel (PACCH).
report is sent on SACCH in the Uplink. For the signal
strength the reporting for RSRP uses 6 bit coding with
values in dBm corresponding to less than -140 dBm for
the weakest cells to the strongest value of greater than or
equal to -44dBm.
For the RSRQ, reporting, the network will set the beginning
of the quality value and a granularity level for reporting.
The reason is that the quality reports have used 3 bit
coding for the purpose of measurement reporting.
The parameter E-UTRAN_FDD_MEASUREMENT_
REPORT_OFFSET and REPORTING_GRANULARITY define
the offset value and the ‘Step’ size respectively. These
parameters are conveyed to the MS in the Downlink
SACCH. Step size can be 1dB or 2dB for RSRQ and the
Offset
In order to overcome the 3-bit limitation for RSRQ, a 6-bit
coding version of RSRQ reporting is also defined in the
142
LTE-to-GERAN
CCO + NACC
143
E-UTRAN  GERAN, CCO+NACC

S3/Gn
EGPRS
LTE SGSN
MME
RIM Signaling
Gb/Iu
S1
BSS
eNB
UE RRC Connected
RIM Signaling Target

Source RAN RAN
Purpose set to: MobilityFromEUTRA

CellChangeOrder Command Connection Estabmnt
+NACC Sys info to GERAN BSS using
System Information
Network Assisted Cell Change is a mechanism for LTE to

GPRS inter-RAT ‘handovers’. It enables better
performance when a cell change has to occur in the
packet-switched domain and the PS-handover option does
not exist. NACC may be used optionally with Cell Change
Order procedure when a handover is initiated from the E-
UTRAN to GERAN. The exchange of RAN related
information is achieved through RIM signaling between
the Source and the Target radio networks. The RAN
information is relayed transparently between the source
and target using S1AP, BSSGP (in Gb mode), RANAP (in Iu
mode) and GTP between MME and SGSN. All nodes and
interfaces shown are impacted in order to support NACC
(Network Assisted Cell Change).
144
GERAN-to-LTE PS
Handover
145
GPRS-to-LTE Handover – Preparation
UE BSS SGSN S-GW P-GW eNB MME
Measurement Report
1.Handover Decision 4.Bearer
2. PS HO Required
priority
3. Forward Relocation Request and QoS
mapping
Cause, IMSI, MM Context (incl. security info),
Source Cell ID, PDN Connections, TEID for C-Plane,
Target eNB, SGSN Address, Source to
Source to Target Target Transparent Container
RAN Transparent 5. Handover Request/Ack
Container
UE id, Cause, Security info
EPS Bearer list, Source-to
-target transparent
Container
Indication
Award Solutionsof possible S-GW change
Proprietary
If PS handover is supported, it can be used instead of cell requirement to do LTE AKA. PDN Connection contains
reselection which is not suitable for real-time packet information about the IP addresses allocated to the
services. The following is a generic PS handover inter-RAT UE, APN to which UE is connected to, P-GW and S-GW
scenario from GERAN (A/Gb mode) to E-UTRAN, assuming addresses, TEIDs for all the EPS bearers at the S-GW.
no change of S-GW/P-GW. The next step is to prepare the LTE network for the
handover before the actual execution of the handover
1-2. To start with, the UE is using GPRS access and the
process. SGSN triggers the handover preparation in
user plane packets are getting transmitted over the
the target MME.
GPRS. Based on the measurement report sent by the
UE, the BSS initiates a handover to the LTE. BSS 5. The MME sends a Handover Request to the identified
sends the target eNodeB ID to the SGSN. A eNB. This is a request to establish the Bearers, and
transparent container carrying radio related to do so the MME provides UE ID, Cause (inter-RAT
information is sent. This information is meant for the HO), Integrity Key (IK), Ciphering Key (CK) and
eNodeB. The rest of the nodes carry it transparently. allowed algorithms for both. The eNB will also receive
bearer information (e.g. number of bearers ) in the S-
3-4. Based on the eNodeB ID SGSN selects the MME
to-T container, but the EPS bearer list from the MME
serving that target eNodeB and sends the S3
overrides this information.
message Forward Relocation Required. SGSN sends
all the PDP context information and the security 6. If a new S-GW was involved (e.g., due to change in the
information. MME does one to one mapping of the PLMN), the MME must indicate this to the SGSN for
PDP contexts with the EPS Bearers and also does establishment of new S4 GTP connections. The
mapping of QoS profiles from GPRS to LTE. Forward Relocation Response signals the end of
preparation phase for this scenario.
Mapping of the security information eliminates the
146
GPRS-to-LTE Handover – Execution

7. PS HO Required Ack
Empty
buffers Target to Source
Transparent
Container
8. PS HO Command Carries the RRC Connection
RAN parameters Reconfiguration message
for LTE access from the target container
9. E-UTRAN Access Procedure

10. HO to E-UTRAN Complete
11. HO Notification
12. Forward Relocation Complete ( Ack)
SGSN may 13. Update Bearer Req/Resp

maintain UE
EPS Bearer IDs, MME Address,
context
eNB address, TEIDs, PDN GW(s)
At this point, the inter-RAT HO has been prepared through speedier handover to E-UTRAN
the exchange of Transparent Containers between the
9. In this step, the UE performs the usual access
source (BSS) and target (eNB) radio networks. In the
procedure for accessing the LTE cells. (We can expect
Execution phase the UE is commanded to change RAT and
that accessibility to be made via a contention-free
the in the Completion phase the old connections are
procedure which is possible due to the eNB-to-BSS
released and a Tracking Area Update will be eventually.
container information )
7. The SGSN will now send the PS HO Required
Acknowledge message to the BSS in response to step
2. This information carries UE and logical link IDs, list
of setup packet flow connections and a Target-to-
Source Container with RAN related info. Before
sending this acknowledgment message the SGSN
may opt to suspend any downlink data for any bearer.
Likewise the BSS may empty any buffer info after
receiving the acknowledgment.
8. Now the BSS can command the UE to handover to
the target eNB using the message PS Handover
Command. This message is the Mobility from EUTRA
Command message which carries the PS-Handover
information element. This message is based on the
transparent container information that was received
from the target eNB and help the UE in making a
147
GPRS-to-LTE Handover – Execution

(continued)

7. PS HO Required Ack
Empty
buffers Target to Source
Transparent
Container
8. PS HO Command Carries the RRC Connection
RAN parameters Reconfiguration message
for LTE access from the target container
9. E-UTRAN Access Procedure

10. HO to E-UTRAN Complete
11. HO Notification
12. Forward Relocation Complete ( Ack)
SGSN may 13. Update Bearer Req/Resp

maintain UE
EPS Bearer IDs, MME Address,
context
eNB address, TEIDs, P-GW(s)
10-11. After successful access on LTE, the first uplink

message will be a signaling message, HO-to-E-UTRAN
Complete, which is received by the eNB, which in turn
informs the MME about the successful outcome of
the procedure using the HO notify message (S1AP).
This message includes the TAI and E-UTRAN Cell
Global ID.
12. Now the MME knows that the UE has successfully
made the HO and informs the SGSN. The Forward
Relocation Complete Notification message may
indicate that ISR (Idle State Signaling Reduction) is
activated, in which case the SGSN will maintain the
UE context for future use. The SGSN will acknowledge
this message.
13. The Handover Execution Phase ends when the MME
updates the new bearer information at the S-GW with
the GTP-C message Update Bearer Request, which
includes all the necessary information about the
established bearers, tunnel-end-point IDs, and P-
GW(s) among others.
148
GPRS-to-LTE Handover – Completion

13. BSS Packet Flow Deletion Timer
based
Radio Bearer
S1 Bearer
S5 Bearer
14. TAU (when triggered)
In step 12, a timer was started in the SGSN to monitor

when the resources in the radio network should be
released. After Forward Relocation Complete message is
received by the SGSN, the timer is activated and when it
eventually expires, the SGSN will start the procedure to
delete resources in the BSS.
The EPS bearer in LTE is now comprised of a EPS Radio
Bearer, an S1 Bearer between the eNB and the S-GW and
the S5 bearer between the S-GW and the P-GW.
If bearer configuration modifications were performed on
GERAN/UTRANAfter the PS handover is complete the UE
does a Tracking Area Update (TAU) if this is triggered by
conditions that require this procedure to be carried out.
Examples of this include entering a new tracking area, or
if reselection is done from GPRS READY state to E-UTRAN,
or due to a change of UE Core Network Capability.
149
150
5 | Idle-Mode Interworking
Chapter 5:
Idle-Mode
Interworking
151
Objectives
• Describe the idle-mode activities in LTE, UMTS and
GSM/GPRS
• Illustrate the details of the inter-RAT cell reselection
procedure
• Sketch a diagram showing state transitions between E-
UTRAN, UTRAN and GERAN
• List key broadcast information parameters needed for
idle-mode cell reselection in all three RATs
• Step through the multi-RAT PLMN selection procedure
• Explain the features for reducing idle-mode signaling
• Walk through the “paging-area” update signaling
procedure
Chapter References:
[1] 3GPP TS 36.304 V8.5.0 (UE Procedures in Idle
Mode)
[2] 3GPP TS 25.304 V8.5.0 (UE Procedures in Idle
Mode)
[3] 3GPP TS 43.022 V8.1.0 (MS in Idle Mode and Group
Receive Mode)
[4] 3GPP TS 44.018 V8.6.0 (RRC)
[5] 3GPP TS 23.003 V8.4.0 (Numbering, Addressing and
Identification)
[6] 3GPP TS 23.401 V8.4.1 (GPRS Enhancements for E-
UTRAN Access)
[7] 3GPP TS 25.331 V8.6.0 (RRC)
[10] 3GPP TS 45.008 V8.2.0 (RAN Radio Link Control)
152
Device States and IRAT

Mobility Procedures
153
Idle-Mode Activities
Idle-Mode
Activities
Paging Operation
Enter IDLE Mode Exit IDLE Mode

Tracking Area Updates
Cell Reselection and

PLMN Selection
Activities During Paging Occasion
Activities During DRX Interval
• Idle Mode Entry: The idle mode is entered when the • Activities during the DRX Interval: Examples of
NAS signaling connection between UE and ME is activities that may occur during this stage are re-
released. selection of a preferred BS, scan neighbors, power
down or any other activities where the UE is not
• Cell Selection and Reselection: When in idle mode
required to be available for DL traffic.
the selection of a suitable cell is performed by the UE
through measurements and the guidance of cell
selection criteria parameters. To speed up the
process, the UE may contain stored information for
several RATs. It initially camps on the best cell it can
and then periodically look for better cells. If a better
cell is found, that cell is selected. This is known as
cell reselection and the criteria may be different from
the initial choice of cell. The criteria for these
activities are sent to the UE in SIBs. One such
parameter is the ‘RAT/Frequency Selection Priority'
(RFSP). The RFSP is a per UE parameter that is used
by the eNB to derive UE specific cell reselection
priorities to control idle mode camping.
• Tracking Area Update: Numerous conditions lead to
UE TA update such as camping on a new cell, timer
expiration, and power-down.
154
Idle-Mode Activities (continued)
Idle-Mode
Activities
Paging Operation
Enter IDLE Mode Exit IDLE Mode

Tracking Area Updates
Cell Reselection and

PLMN Selection
Activities During Paging Occasion
Activities During DRX Interval
• Activities during the Paging Occasion: Prior to this

stage, the UE must read the system information
messages to prepare for reception of the PCH
channel during the paging occasion. Note that the
paging occasion occurs for just one subframe during
the DRX cycle. The eNB broadcasts a page message
to indicate the presence of DL traffic on an existing
EPS bearer or to send high level signaling messages
to the UE perhaps to setup a new bearer. The paging
message is identified by a Paging RNTI. A single
paging message may contain pages for multiple UEs
so each UE must decode the message and look for a
paging record with its unique identifier. UE is
identified by the S-TMSI in the paging record. Possible
actions by the UE in response to the page are service
request or tracking area update.
• Idle Mode Exit: Conditions leading to the termination
of the idle mode include answering a page or the
independent establishment of a NAS signaling
connection in order to reactivate current bearers.
155
EGPRS Radio Resource States

• Packet Idle Mode:
– MS does not occupy a
radio resource PACKET IDLE
– Temporary Block Flow MODE
(TBF) does NOT exist
– MS monitors the BCCH
and CCCH
LLC Frames to send No LLC frames
Establish TBF to send
• Packet Transfer Mode:
– TBF established
– MS monitors a PDCH PACKET TRANSFER
– MS occupies radio MODE
resources
When the mobile station is activated for data services, it sub-channels on the Common Control CHannel (CCCH).
will be in one of two states at the Radio Resource layer:
The transition from packet idle to packet transfer mode
• Packet Transfer Mode can be triggered implicitly whenever a higher layer needs
to transfer a frame. This accommodates the packet data,
• Packet Idle Mode
which is typically characterized by discontinuous traffic
In the packet transfer mode, the mobile station is with short bursts of high activity interleaved with periods
allocated a radio resource providing a Temporary Block of idle time.
Flow (TBF) for a physical Point-to-Point (PTP) connection on
one or more physical channels. This allows for the
unidirectional transfer of the Logical Link Control (LLC)
frames between the network and the mobile station.
Concurrent TBFs may exist in order to support
simultaneous transfer of data in both the uplink and the
downlink. Note that this does not mean that the MS is
constantly sending or receiving while in this state. Much
of the time it is either waiting to send or waiting to receive.
When there is no more data queued up to be transferred,
the TBF(s) are released and the MS transitions to packet
idle mode.
In the packet idle mode, no radio resources are allocated,
and no TBF exists. The mobile station is not actively
transferring data. Instead, it monitors the relevant paging
156
UTRA RRC States
URA-specific Paging Cell-specific Paging

using PCH using PCH
RRC Connected Mode
URA_PCH Cell_PCH
Downlink and
Uplink Data Cell_DCH Cell_FACH Transition State;
Transfer Cell-specific Paging
using FACH
RRC IDLE Mode
Four RRC states are defined for a UE in the RRC- session, with Cell_DCH more commonly used. The UE
Connected mode. The first word in the state name needs to do a cell update as it crosses from one cell to
indicates the geographic area resolution at which the UE another cell in Cell_PCH state, while The UE needs to do a
location is known. The second word in the state name URA (UTRAN Registration Area) update as it crosses from
specifies which transport channel is used for one URA to another URA in URA_PCH state. Form the
communications with the UE. For example, CELL_DCH uplink signaling perspective, URA_PCH is preferred to
implies that the UE’s location is known at the cell level Cell_PCH.
and a DCH (Dedicated Channel) is used for
communicating with the UE. The main state used for
uplink and downlink data transfer is CELL_DCH.
Cell_FACH is typically used as a temporary state where the
UE is continuously monitoring the downlink for an RRC
message, and, the UTRAN uses the Forward Access
Channel (FACH) to communicate with the UE. The UE is
typically moved from the CELL_FACH to CELL_DCH for
dedicated mode data transfer. URA_PCH and Cell_PCH
states involve the UE monitoring the PCH (paging Channel)
periodically for a potential page message. For the “sleep
mode” states, URA_PCH and Cell_PCH, the user must
move onto either common channels or dedicated
channels to transfer data in the uplink direction. The RNC
assigns the UE to either the Cell_FACH or Cell_DCH state,
depending on the quality of service required for the data
157
Radio Network Mobility in LTE

Radio Network Mobility
RRC Idle RRC Connected
Cell Reselection Handovers
• UE-controlled • Network-controlled, UE -
• No measurement reports assisted handovers
• Measurement reports are
sent from UE to eNB
Mobility is the key differentiator between mobile wireless • RRC Connected: After the UE registers with the
systems and other forms of wireless communication (such network and establishes an RRC connection, the
as Wireless LANs). Mobility tracks the location of the user, mobility process changes. The UE is provided with an
so that new service requests can be established quickly, active set (a group of cells to monitor and measure),
and active applications can continue to operate as the and the network determines when and where the UE
user moves. In LTE, the specific functions of mobility hands over, based on measurement reports from the
differ, depending on the state of the UE: UE. This allows the network to more closely track the
UE’s location and ensure that the UE is always using
• RRC Idle: Whenever a UE first powers up, it must
the optimum cell for its services.
locate a suitable cell, synchronize itself, and monitor
the network before it can initiate or receive service. If
the UE moves away out of the coverage area of the
cell, it must select another cell that is capable of
supporting its needs. Cell selection and reselection
are entirely under the control of the UE.
158
State Transitions and Interworking

UMTS LTE GSM/GPRS
GSM Active
Cell_DCH RRC_Connected HO
HO GPRS Packet
CCO Transfer Mode
Cell_FACH +NACC
Connection
URA_PCH Establishment
Release Connection
Cell_PCH
Establishment
CCO Release
Connection
Establishment Reselection
Reselection
Release
Reselection
GSM Idle
Idle RRC_Idle GPRS Packet Idle
CCO
Reselection
Reselection
The interworking between the three access technologies, UE will do a Location/Routing area update and may
E-UTRA, UTRA and GERAN involves transitions between eventually enter one of the “sleeping” modes
different UE/MS states. These transitions take place CELL/URA_PCH.
depending on the current state of the mobile and the
Between LTE and GSM, only handovers occur when the UE
mobility context for the device on the network side.
is not idle. However, state transitions between GERAN and
As an example, when the UE is in RRC-CONNECTED mode LTE may involve CELL_CHANGE_ORDER (CCO) messages
in LTE, the process that takes the mobile to CELL_DCH with optional Network Assisted Cell Change (NACC) or just
state in UMTS is network based handover. In both of these cell reselection in the case of GPRS Packet transfer mode
states, the UE is actively using radio resources and has to E-UTRA RRC_IDLE mode. In case of GSM_Idle or GPRS
established radio bearers. A handover is also the process Packet Idle to E-UTRA RRC_IDLE, Cell Reselection and/or
that takes a UE in RRC_CONNECTED mode in LTE to Cell Change Order processes may be used.
GSM_Connected mode and/or GPRS_Packet_transfer
mode.
On the other hand, a “sleeping” UE in UMTS mode such as
CELL_PCH or URA_PCH may prefer to jump on a nearby
LTE cell (perhaps triggered by variation in cell signal
strength). In that case, the process is initiated by the
handset and is called Cell Reselection. Note that the same
state transition does not occur for an idle UE in LTE. For
an RRC_IDLE UE in LTE, the mobile will go to UTRA_Idle
(same as UTRA RRC_Idle) mode if it prefers to do cell
reselection to UMTS. After reselecting the UMTS cell the
159
Idle-Mode Interworking
160
Idle Mode in LTE

EPS P-GW
UE States
MME S5
• RRC IDLE S11
• EMM- • Signaling Bearer PDN
REGISTERED • One or more
• ECM-IDLE
S-GW Bearers to one or
more PGWs
What is IDLE Mode?

• No NAS Signaling connection exists
• At least one PDN Connection exists
• UE is registered with MME and EMM context exists
• eNB has no context information
Benefits of IDLE Mode:

• Conserves resources in E-UTRAN
• Conserves battery power in the UE
A UE is in idle mode when no NAS signaling connection

exists between the UE and the network. There exists no
UE context in E-UTRAN and there is no S1 connection
either to the MME or S-GW.
The E-UTRAN state LTE_DETACHED corresponds to the
NAS Spec EMM-DEREGISTERED. The state E-UTRAN
LTE_IDLE and LTE_ACTIVE correspond to the
combinations EMM-REGISTERED/EMM-IDLE mode and
EMM-REGISTERED/EMM-CONNECTED mode, respectively.
When the UE is in EMM-REGISTERED state, an EMM
context has been established in the UE. When the UE is in
EMM-IDLE mode, the UE location is known to the MME
with an accuracy of a list of tracking areas. Idle mode
enables the UE to periodically become available for
downlink broadcast paging without the need for
connection to a specific BS and without handover
operations. The Idle mode allows the UE to save power
because the UE only scans the downlink at discrete
intervals. Furthermore, the network can send a page
message to the UE in a timely manner.
161
Idle Mode Entry in LTE

EPC
UE MME S-GW
UE inactivity eNB
timer
expires
1. UE Context 2. Update Bearer Request
Release
3. Update Bearer Response

4. UE Context
Release Command
S-GW
5. RRC Connection Release 6. UE Context releases just
Release Complete the S1-U
bearers.
eNB deletes
complete UE
context
Entering idle mode is normally caused by inactivity of the unaffected by this procedure and the P-GW is not
UE’s service data flows. If no traffic is flowing for the UE aware that this procedure has taken place. If traffic
then it will benefit the E-UTRAN if it can delete all the arrives for the UE on the S5 interface after the S1-U
connections the UE has both signaling and traffic. bearers are released the S-GW will buffer packets
and trigger a re-establishment of the S1-U
1. When an inactivity timer expires in the eNB for this
connections.
user it sends an S1 UE Context Release Request
(Cause=inactivity) message to the MME. Other
reasons for release this connection include O&M
intervention, radio connection failure, security
reasons, etc.
• NOTE: If the release is initiated by the MME, then
Step 1 is not performed but all subsequent steps
are the same.
2. The MME sends an Update Bearer Request message
to the S-GW so that the S1-U bearers associated with
the UE’s EPS bearers are released.
3. The S-GW responds with an Update Bearer Response
message to the MME. Note that though the S1 bearer
is released in the S-GW, it retains the associated S1-
U configuration, allowing for more efficient re-connect
at a later time. In addition, the S5-U configuration is
162
Idle Mode Entry in LTE (continued)

EPC
UE MME S-GW
UE inactivity eNB
timer
expires
1. UE Context 2. Update Bearer Request
Release
3. Update Bearer Response

4. UE Context
Release Command
S-GW
5. RRC Connection Release 6. UE Context releases just
Release Complete the S1-U
bearers.
eNB deletes
complete UE
context
4. The MME now commands the eNB to release its

corresponding S1-U context.
5. The eNB sends RRC Connection Release message to
the UE to tear down all traffic and signaling bearers
on the air interface. The eNB deletes the UE’s
context.
6. This step occurs in parallel with Step 5. The eNB
sends a confirmation to the MME. At this point, the
S1-AP signaling connection between the MME and
the eNB for the UE is released. The MME retains the
part of the UE’s MME context not related to the E-
UTRAN including the S-GW’s S1-U configuration
information.
163
System Information for IRAT Procedures
SIB 1, 3, 6, 7 (PLMNs, Offsets, Timers, Priority,…)

SIB 6: UTRAN Neighbors
E-UTRAN SIB7: GERAN Neighbors
SIB 3, 4, 6, 18, 19 (PLMNs, Offsets, Timers, RAT Priority,…)

SIB19: E-UTRAN Neighbors
UTRAN
SI 2 quarter (E-UTRAN neighbor cell list, Forbidden E-UTRAN Cell

GERAN list…)
After a UE has found a suitable cell, regardless of the In UTRAN, the corresponding information is broadcast on
radio access technology type, it will start to read the SIBs 6, 18 and 19 as well as SIBs 3 and 4 which convey
system information elements which are broadcasted from cell reselection parameters for Inter-RAT.
that cell and also monitor specific signaling channels such
In GSM/GERAN, system information from second quarter
as paging. In the UTRAN and the E-UTRAN, the broadcast
is modified in release 8 to include LTE-related cell-
information are extensive and are designated in various
reselection parameters such as E-UTRAN Neighbor Cell
system information blocks, or SIBs. The SIBs are
List and Forbidden (Blacklisted) Neighbor Cell List.
scheduled according to the information that is carried on a
Master Information Block (MIB) and SIB 1. In GSM and
pre-release 99 3GPP technologies, the broadcast channel
structure is simpler, and the MIB is not used. Different
types of system information are broadcast and identified
by a System Information (SI) number, such as SI 2
quarter.
In E-UTRAN, SIBs 1, 3, 6 and 7 carry relevant information
for Inter-RAT cell change. These include information about
offsets between the serving and neighboring cells,
hysteresis values for avoiding the ping-pong effect,
network ID and access technology priorities and other
parameters that control the UE’s idle mode behavior for
IRAT cell (re)selection.
164
Key IRAT SIB Parameters in LTE

SIBs: 1,3,6,7
• Cell Reselection Priority and
Characteristics
• Q-offset(s\n)
• Q-hyst
• Q-rxlevmin
• Thresh (freq, high)
• Thresh (freq, low)
• Thresh (serving, low)
• T-reselection (EUTRA)
• T-reselection (UTRA)
• T-reselection (GERA)
• S(nonintrasearch)
eNodeB • Speed dependent reselection
parameters
• ….
The cell reselection parameters which are relevant to IRAT • Thresh (freq, high, low): This is the threshold used by
are as follows: the UE when reselecting a higher/lower priority
frequency (freq) than the one used in the current
• Cell Reselection Priority: This specifies the absolute
serving cell. There may be different thresholds
priority for E-UTRAN frequency or UTRAN frequency or
defined for each IRAT frequency.
group of GERAN frequencies. This information
element contains more detailed cell-specific • Thresh (serving, low): This is the threshold for serving
information for cells in each type of RAT. This would frequency and is used in reselection evaluation
include scrambling codes for UTRAN cells for example towards lower priority RAT
and the ARFCN and BSIC (Base Station Identity Code)
• S(nonintrasearch): This is the threshold in dB for E-
for GSM/GERAN cells respectively.
UTRAN inter-frequency and inter-RAT measurements
• Q-offset(s,n): This specifies the offset between two
In addition to the above parameters, LTE defines speed
cells (Serving and Neighboring).
dependent reselection parameters corresponding to each
• Q-hyst: This specifies the hysteresis value for ranking of the parameters in above. These parameters are used to
criteria. avoid excessive cell reselections for a mobile that is in
high-mobility state.
• Q-rxlevmin: This specifies the minimum required Rx
level in the cell in dBm.
• T-reselection (RAT-type): This specifies the cell
reselection timer value for the RAT type. i.e., EUTRA,
UTRA or GERAN.
165
Key IRAT SIB Parameters in UTRAN

• PLMN List  Up to 6 IDs (in SIBs: 6,18,19
MIB)
• Idle/Connected mode PLMN
IDs of neighbor cells
• Frequency band Indicator
• S (limit,SearchRATm)
• S (search,RAT)
• RAT List
• Q-hyst, offset,
• T (reselection)
• Priority List information for
― GSM, E-UTRA and UTRA
― ARFCN info for GSM cells
― UTRAN FDD frequencies
Node B • Blacklisted cells for E-UTRA
and, Physical Cell IDs Priorities
….. between
different
RATs
The list in the diagram shows some of the most relevant defined will be considered for reselection. As an
Cell Search parameters which are broadcasted in a example of Priority information for GSM, we find the
UTRAN cell for the purpose of Cell/PLMN selection. ARFCN (Absolute Radio Frequency Channel Number),
the band indicator and the starting and ending
• PLMN lists indicates the available PLMNs in case of
ARFCNs. A priority value is associated with the cells
RAN-sharing. Up to six PLMN IDs may be broadcast
with 0 indicating the lowest priority and maxPrio-1 as
from the same cell. There is an option for not
the highest. For UTRAN we have the normal cell-
broadcasting the MCC (Mobile Country Code).
reselection parameters as well as the priority value,
• It is possible to influence the choice of PLMN by the and for E-UTRAN we find E-ARFCN, Measurement
UE based on the mode of the UE. Thus there are two bandwidth and the priority value for the RAT.
different PLMN IDs for neighboring cells for (RRC) idle
The network should ensure that priorities for different
and (RRC) connected cases.
RATs are always different.
• Frequency bands are indicated in SIB 6.
• S parameter values for cell reselection on different
radio access technologies, as well as hysteresis,
offsets and timers are indicated in the SIBs.
• An important option in controlling the inter-RAT cell
reselection is the broadcast of Absolute Priority
criteria. SIB 19 in UMTS will provide these reselection
parameters for inter-RAT. Only cells for which a
priority and thresholds (hysteresis, timers, etc.) are
166
Key Information in SI 2-quater

3G Neighbor cells description, • The list of UMTS frequencies and the scrambling
measurement criteria and cell codes of the neighbor cells
search criteria • The required information on the measurement
technique, thresholds, and cell reselection
parameters
• Threshold for when the mobile starts taking 3G
measurements
E-UTRAN Cell Info • The E-UTRAN Reselection/Neighbor list may contain
and Measurement Report up to 8 frequencies.
Parameters • List of “Not Allowed Cells” may be included
• Priority value for E-UTRAN
• Cell Search Parameter (Qsearch_I)
• Measurement Parameters Description for Enhanced
Reporting
Cell Change Notification If Cell Change Notification procedure is used for cell
Parameters reselection, then the MS is informed about that in here.
SI 2-quater is the system information message in network about the proposed target cell by sending a
GSM/GERAN which will carry IRAT related information. For PACKET CELL CHANGE NOTIFICATION message. The
LTE, this comprises the E-UTRAN cell reselection list which network will then respond with information about the
may contain up to eight frequencies. This system info also neighbors of the serving cell. The purpose of this
broadcasts the Measurement Parameters Description procedure is to enhance the reliability of cell reselections.
Information Elements which inform the MS about There is also a new procedure defined in Release 8 for
thresholds and use of measurement reporting faster acquisition of System Information. The use of this
mechanisms (e.g., enhanced measurement reporting). procedure is signaled in SI 2-quater as well.
RAT priorities can be assigned and the network shall
ensure that the GERAN priority value is different from all
E-UTRAN priority values and UTRAN priority parameters.
The parameter Qsearch_I informs the mobile station
about the thresholds that must be met before the MS
does Inter-Rat measurements towards a E-UTRAN cell.
This parameter therefore can control the reporting of E-
UTRAN cells.
If the the target cell is an E-UTRAN cell and if Cell Change
Notification is activated towards E-UTRAN cells, then
instead of performing the cell change, the MS will start a
timer and enter the CCN mode. In this mode, the MS will
delay its cell-reselection procedure and inform the
167
UE Idle Mode Procedures

User indication
Automatic Manual
PLMN Selection
GSM/UTRAN
PLMN PLMN Selected
LA, RA, TA Update available
response
Cell (Re) Selection
GERAN/UTRAN NW control
Registration Area (LA,

RA, TA) Change
LTE Registration
In all the three radio access technologies, the UE/MS has procedure. The process of cell (re)selection is strictly
to follow defined procedures which result in the selection controlled by network parameters of a given RAT which
of a PLMN and eventually camping on suitable cell. are broadcast in System Information messages or by
measurement control procedures in each radio access
Once a mobile has synchronized with a cell (cell
technology.
acquisition, not selection!) it can the read the broadcast
information from that cell, which may broadcast multiple After the initial cell selection or after re-selecting a cell in a
PLMN IDs if network sharing is used as an example. At new registration area, (which is a Location Area (LA) in
this early point in the procedure, the UE does not know GSM, and a Routing Area (RA) in EGPRS, or both in UMTS,
whether it is in the right PLMN. Thus the first step in the and a Tracking Area (TA) in LTE) the device must do a
process is PLMN selection. registration area update. The purpose of this registration
is to be paged correctly in the right RAT and area. The
PLMN selection can be set to automatic or manual mode,
registration process is a NAS procedure. After the
typically this is done through the mobile device’s user
necessary security procedures such as authentication, the
interface. In the Manual mode the subscriber can see the
network will respond with a registration area update which
available network IDs on the display (User Indication in the
can then result in a new cell reselection procedure or
display) and choose from the list. In automatic mode the
PLMN selection. The latter can occur for example as a
device may use parameter settings in the SIM card to
result of an authentication rejection message or a
choose a permissible network.
redirection message.
After PLMN selection, the device must camp on a suitable
cell with enough signal strength to guarantee a good
chance of success during service establishment. If the cell
is not suitable, this will result in a cell re-selection
168
Exercise: Match the Columns

System Specifics
Information A. Conveys information
about GERAN neighbors
1. SIB 6 B. Conveys information
about E-UTRAN
2. SIB 7 neighbors for the UEs
observing UTRAN
C. Conveys information
3. SIB 19 about E-UTRAN
neighbors for the UEs
4. SI2 quarter observing GERAN
D. Conveys information
about UTRAN neighbors
169
IRAT Cell (Re)selection
170
Searching for a Suitable Cell

Suitable Cell Reserved Cell
Barred Cell
Acceptable Cell
Normal service Operator service

(public use) (Operators use)
Restricted Access
Limited services
(emergency calls)
Which is my Suitable Cell?
i.e., cell which is:
• Part of a selected PLMN,
• Not barred, and
? • Satisfies my cell selection criteria
The UE will divide the surrounding cells into four

categories, depending on their suitability for providing
service to the UE:
• A suitable cell is the type the UE is actively searching
for. It satisfies the cell selection criteria, is not barred
or reserved for operator use, and is part of the
selected PLMN. A suitable cell is (potentially) capable
of supporting all of the UE’s services.
• An acceptable cell also satisfies the selection criteria,
and is not barred or reserved; however, it may not be
part of the desired PLMN. An acceptable cell may
limit the UE to emergency calls only, but can be used
as a starting point for locating a suitable cell later on.
• A barred cell does not allow any access from the UE,
due to traffic overload or other conditions. The UE will
not attempt to select any barred cell.
• A reserved cell is part of a registration area that the
UE is not allowed to enter. In general, reserved cells
are only for the operator’s use (for initial testing, etc.);
the UE will not attempt to select any restricted cell.
171
Suitable Cell Selection
UE
eNB
Checks:
• Yes, PLMN ID matches
• Cell not barred/restricted
• Cell selection criteria satisfied
OK! I have found a suitable cell
If any of the checks fail, select another cell

and repeat the process
Once the UE finds a cell which is strong enough, it checks

the cell’s PLMN identity and barring status in SIB 1. If the
PLMN is in the UE’s prioritized PLMN list and if the cell is
not barred, then the cell is suitable and the UE can select
it. Otherwise, the UE moves on to the next cell and repeats
the process.
172
Cell Selection Criteria (LTE)

2. Measures
RSRP / RSRQ
UE 3. Calculates: Srxlev, Squal
eNB
Cell Selection Criteria (Release 8) Srxlev > 0
Cell Selection Criteria (Release 9) Srxlev > 0 and Squal > 0
• Srxlev = (Qrxlevmeas) – (Qrxlevmin + Qrxlevminoffset) – Pcompensation

• Squal = Qqualmeas – (Qqualmin + Qqualminoffset)
Similar Criteria in UTRAN and GERAN
In order for a cell to be selected in Release 8 of LTE, it • Qqualmeas is the measured cell quality value (RSRQ)
must provide at least a minimum level of signal strength
• Qqualmin is the minimum required quality level in the
to the UE. The UE will measure the downlink reference
cell (dB)
signals from the cell, and calculate the Cell Selection
Receive Level (Srxlev) for that cell. If Srxlev > 0, then the • Qqualminoffset is the offset to Qqualmin which is only
cell is good enough to serve the UE. In Release 9 of LTE, used when the UE is in a visited PLMN and is
the cell selection criterion adds a second measure, Squal, searching periodically for a higher priority PLMN.
the Cell selection quality value, that must also be • Pcompensation = max(PEMAX –PPowerClass, 0),
satisfied. i.e., Srxlev > 0 AND Squal > 0. where PEMAX is the maximum TX power level a UE
These values are defined as follows: may use when transmitting on the uplink in the cell
defined as PEMAX in 36101 and PPowerClass is the
• Srxlev = (Qrxlevmeas) – (Qrxlevmin +
maximum RF output power of the UE according to the
Qrxlevminoffset) – Pcompensation
UE power class.
• Squal = Qqualmeas – (Qqualmin + Qqualminoffset)
The parameters in the above equations are found in SIB
Where: Type 1.
• Qrxlevmeas is the measured reference signal
received power (RSRP)
• Qrxlevmin is the minimum level for selecting this cell
• Qrxlevminoffset is an offset to Qrxlevmin which is only
used when the UE is in a visited PLMN and is
searching periodically for a higher priority PLMN.
173
Measurement of IRAT cells

BCCH-carrier Signal
If the serving cell is good enough, I will Strength
not search for equal or lower priority RATs,
but I will search for higher priority RATs
occasionally in any case.
RSRP - GERAN Neighbor

RSRP - Serving cell
Neighboring CPICH_RSCP and
LTE cell CPICH Ec/I0
Neighboring cell
UMTS Neighbor
Serving Cell
UE will measure for reselection:

• Periodically for higher-priority RAT
• Higher, lower and equal priority RAT when SservingCell < Snonintrasearch)
The aim of the cell reselection procedure is to assure that priority rules for cell reselection for the UTRAN and GERAN
the mobile device is always camped on the best cell when are similar to those in the E-UTRAN as far as reselection to
in idle mode. The decision for cell change is made by the LTE is involved.
mobile based on the network settings for cell reselection.
When a request for service is initiated (in either direction)
the probability of a successful outcome increases if the
most favorable cell is used. The criteria for cell reselection
must be chosen carefully to avoid too frequent cell
changes (ping-pong effect) or too slow reaction to changes
in radio condition. This criteria generally depends on the
signal strength of a “pilot”-like channel from the
neighboring and serving cell as well as the ability of the
mobile to close the uplink connection (e.g. maximum
power of the UE). Typically, it is expected that most of the
cell reselection procedures involve intra-frequency cell
changes. However a cell reselection can sometimes imply
also change in the RAT.
For LTE, as long as the UE remains in RRC-Idle state, it
continues to search for the strongest cell within its
preferred PLMN. The UE will move to a different cell (cell
reselection) if the current serving cell is no longer strong
enough (Srxlev < 0), or if a neighboring cell is better. The
174
Cell Reselection LTE  UMTS/GSM

UE does not need to search for a lower
priority RAT if SServingCell > Snonintrasearch
Higher priority RATs are searched at least
every 60 seconds in any case
BTS
Serving
NB eNB
In here a lower • Eight priorities 0-7

priority is assumed • 0 highest, 7 lowest
• SIB 6 for UTRAN
for UTRAN/GERAN
RRC_Idle UE • SIB 7 for GERAN
• RATs have non-equal
Treselection,RAT priorities
SServingCell
SnonServingCell,x
Threshx,low
Snonintrasearch
Threshserv,low
At least 1 sec on
serving cell > 1sec Reselection
time
SearchAward
IRAT Solutions Proprietary
The RSRP of the serving cell is measured and evaluated The reselection criteria for lower priority RAT reselection
every DRX cycle (320ms-2560ms) for an idle UE and will depend on parameters SServingCell, SnonServingCell,x ,
be used for evaluation of inter-RAT cell reselection criteria. Treselection,RAT , and Threshx,low and Threshserving,low. A cell
When camping on serving eNodeB the RRC Idle UE will reselection occurs when the serving cell signal level
search for higher priority RATs at least every 60*N SServingCell is below Threshserv,low and the lower priority RAT
seconds, where N is the total number of higher priority cell has SnonServingCell,x on frequency x greater than
RAT layers for UTRA and GERAN (generally a layer can be Threshx,low for frequency x for a duration of Treselection,RAT
an inter-frequency or Inter-RAT). The absolute priorities and more than one second has passed since the UE
are numbers between 0 and 7, with 0 being the highest camped on the current E-UTRAN cell (to avoid rapid ping-
priority. Each RAT type can be given a certain priority value ponging). The S values in general are the evaluated as in
for the purpose of cell reselection. This information can be the case for Srxlev for cell selection criteria.
conveyed to the UE through SIBs 6 and 7 or dedicated
It is worth mentioning that cell reselection parameters
signaling (e.g. RRC Release) in E-UTRA. Equal priorities
such as the ones described in the above can be scaled
between RATs are avoided.
(change in value) depending on the ground speed of the
In this scenario, we assume the other available RAT(s) UE.
have lower priority than E-UTRA. In this case, it is generally
desirable for the idle UE to ignore lower priority RATs when
the signal quality of its serving E-UTRA cell is above a
certain threshold. This strategy reduces the probability of
unnecessary cell reselections and keeps the LTE-capable
UE in the LTE domain. The UE may choose not to measure
lower priority RATs if SservingCell > Snonintrasearch.
175
Cell Reselection UMTS  LTE

UE will measure LTE cells of higher priority
at least every 60 seconds or faster
depending on the values of Srxlev and
Squal
eNB Serving
NB
In here, a higher
priority RAT is When no priorities
assumed exist, normal cell
UE states selection criteria
Idle/PCH/FACH apply (Srxlev>0 and
Squal>0 )
Srxlev Treselection, state
Thresh x, high
At least 1 sec on
serving cell Cell Reselection occurs
> 1sec
time
In Inter-RAT reselection from UTRA to E-UTRA, the UE will Threshx,high and a state dependent reselection timer,
receive RAT priority information on SIB 19 (or on Treselection,state. Cell reselection occurs when the S value of
dedicated signaling messages) with relevant frequency the non-Serving Cell (Srxlev) is greater than Threshx,high
band information for each RAT type. No explicit neighbor for a duration of Treselection,state which depends on the
list with cell IDs is required in this case and the LTE- RRC state of the UE. For good measure the UE must have
capable UE is required to have the ability to decode the been camping on the current serving UMTS cell for at least
cell IDs in any case. If no absolute priorities are given to 1 second before attempting cell reselection to LTE.
the UE, then ‘normal’ cell reselection criteria apply similar
to inter-frequency criteria that exist in UMTS.
For reselection to E-UTRA, the UE can be in UTRA-Idle
mode or in the ‘sleeping’ RRC Connected modes in UTRA,
namely the CELL_PCH and URA_PCH modes. Inter-RAT cell
resection is also supported for UE in the RRC Connected
mode called Cell_FACH, which is considered a low data-
rate/signaling mode in UMTS. (Cell reselection does not
occur in Cell_DCH mode, where handovers are the main
cause of inter-RAT procedures.)
In this example, we assume that E-UTRA is the higher
priority RAT. This is a likely scenario for an LTE-capable
device which should by default strive to be in the LTE
domain. The parameters required for cell reselection are
Srxlev of the non-serving LTE cell, the threshold
176
Cell Reselection GPRS  LTE

MS will measure IRAT cells of higher
priority at least every 60 sec.
UE reselects if reselection criteria is ok
eNB Serving
BTS
In here a higher
priority RAT is
assumed
MS states
Packet_Idle/transfer
Snon-serving Treselection
ThreshE-UTRAN ,high
Reselection
> 5 sec time
Cell reselection from EDGE/GPRS (EGPRS) to LTE is For reselection purposes, the MS will evaluate the Srxlev
similar to the procedure for UMTS to LTE. Note that it is (RSRP – Qrxlevmin) for the neighboring LTE cells.
possible to do a reselection from the Packet Transfer Information about the LTE cells and frequency priorities is
mode of GPRS to E-UTRA RRC_IDLE mode directly without given to the MS on System Information 2 quater.
the need for ‘handover’ which in EGPRS is done through a Reselection occurs from EGPRS to LTE when the S value
Cell_Change_Order procedure. For a Packet_idle MS, cell of the non-serving LTE cell is above a preset threshold
reselection is the procedure that can ‘push’ the MS into ThreshEUTRA,high for at least Treselction time period. The MS
LTE domain. In general, an LTE-capable MS will search for must have been on the EGPRS cell for at least 5 seconds
LTE cells at least every minute regardless of the serving before attempting measurements for cell reselection to
cell’s Rxlev and path loss criteria (C1/C2) if LTE is other RATs.
designated as the higher priority RAT. It is expected to
designate LTE as the higher priority RAT in areas where
LTE coverage exists as an overlay on 2G.
177
Cell Reselection – Speed Dependent

UE Mobility State = Medium
Strength QHyst Treselection,RAT x 0.75 (shorter time!)
Signal
Neighbor
Cell
Serving
Cell
time
Treselection,RAT UE reselects earlier
• Three mobility states: normal, medium, and high speed

• State determined by frequency of reselections
• Normal Mobility is the default, other Award
states will scale reselection parameters by a factor
Solutions Proprietary
In general, the UE reselects a new cell if the signal defined, the relevant reselection timer is reduced by a
strength of the new cell is better than the serving cell by a configurable factor, and the positive bias to the serving
certain amount for a certain length of time. This high level cell signal strength, QHyst, is reduced by a configurable
understanding applies equally well to intra-frequency, factor.
inter-frequency and inter-RAT cell reselections. In all
How does the UE know how fast it is moving? LTE is
cases, it is possible to apply a +ve bias to the serving cell,
optimized for pedestrian to low vehicular speeds so
QHyst in the diagram. QHyst is a common parameter sent in
‘normal’ mobility corresponds to speeds of up to about 15
SIB3. The timer, Treselection that the UE uses depends on
km/h. The UE calculates its “speed” in terms of the
the type of RAT the UE is reselecting to and varies from 0
number of cell reselections it does during a configurable
to 7 seconds.
time period. There are three possible “speeds” or mobility
How long should the timer be? It should be long enough states: normal, medium and high mobility states. The UE
so that the neighbor cell is well established as the better will be configured with two thresholds enabling it to
cell. But the time should not be too long lest the serving calculate its mobility state. For example, in one minute if
cell cannot provide adequate service during the evaluation the UE does 6 or more reselections it enters high mobility
period. Based on these criteria, it is clear that the speed state and if it does more than 3 but less than 6
at which the user is moving should have an impact on the reselections it enters medium mobility state. Otherwise it
reselection timer. For example, if the user is traveling remains in normal mobility state. The counting of the cell
away from the serving cell at 120 km/h it would need to reselections includes intra, inter-frequency and inter-RAT
reselect a neighbor cell earlier compared to when the user cell selections. Also, the UE discounts consecutive
is walking that same route. To accommodate this, LTE reselections between the same two cells when calculating
provides additional parameters for speed dependent cell its mobility state. Note that SIB3 contains the parameters
reselection. To keep it simple just three speed ranges are necessary for calculating mobility state.
178
Cell Reselection – Speed Dependent

(continued)
UE Mobility State = Medium
QHyst Treselection,RAT x 0.75 (shorter time!)
Strength
Signal
Neighbor
Cell
Serving
Cell
time
Treselection,RAT UE reselects earlier
• Three mobility states: normal, medium, and high speed

• State determined by frequency of reselections
• Normal Mobility is the default, other Award
states will scale reselection parameters by a factor
Solutions Proprietary
Let’s look at a simple example: The UE has been tracking

its mobility state and has determined that it is moving fast
enough to be in medium mobility state, e.g., it has done
four unique reselections in the past minute. From SIB3, it
sees that QHyst is 3 dB and that the QHyst scaling factor is 0
dB. So the overall positive bias for the serving cell signal
strength is still 3 dB. The UE is moving away from LTE
coverage and is measuring UMTS cells. From SIB6 it sees
that Treselection,UTRA is 4 seconds and that that the scaling
factor for this timer, Treselection,UTRA-SF associated with
medium mobility is 0.75. So the UE calculates the
effective reselection timer = (4 * 0.75) = 3 seconds.
So in this example, the UE will reselect 1 second earlier
compared to normal mobility state. Note that only the
reselection timers and QHyst are affected by this feature.
All other reselection parameters are unaffected and hence
are not discussed here.
179
LA/TA Updates
180
Illustration of Mobility Areas

3G-MSC 1 3G-MSC 2
LA1 LA2 LA3
URA URA URA URA URA URA URA URA

RA1 RA2 RA3 RA4 RA5
3G-SGSN 1 3G-SGSN 2 3G-SGSN

3
RA(s) handled by one 3G-SGSN

LA(s) handled by one 3G-MSC/VLR
For mobility management, four different mobility areas are The Routing Area is identified by an Routing Area Identifier
defined. Location Areas and Routing Areas are used in the (RAI). The Location Area is identified by an Location Area
core network (CN). UTRAN Registration Areas and Cell Identifier (LAI). The following rules apply for the Routing
Areas are used in the UTRAN. Location Areas are related Area Identity:
to CS services. Routing Areas are related to PS services.
The Routing Area Code (RAC) is only unique when
One Location Area is handled by one CN node. This means presented together with an LAI.
that all UEs registered in a specific Location Area are
LAI = MCC + MNC + LACode.
registered in the associated CN node handling this
specific Location Area. One Routing Area is handled by RAI = MCC + MNC + LAC + RAC.
one CN node. Again, this means that all UEs registered in In UMTS, the RAI is broadcast to UEs in RRC Idle mode,
a specific Routing Area are registered in the associated and is notified to UEs in RRC Connected mode on
CN node handling this specific Routing Area. Location established RRC connections as MM system information.
Areas are used by 3G MSC/VLRs for paging UEs. Routing
Areas are used by the 3G SGSNs for paging UEs. UTRAN The UTRAN Registration Area Identity (URA ID) identifies a
Registration Areas (URA) and Cell Areas are only known in UTRAN Registration Area (URA). The URA ID can be used
the UTRAN and are used by UEs in RRC-Connected mode. to indicate to the UE which URA it shall use in case of
Please note that, despite what shown in figure, there is no overlapping URAs. In UMTS, the Cell Identifier (C-ID)
relationship between a (UTRAN) URA and a (CN) RA uniquely identifies a cell within an RNS.
A Routing Area is a subset of one, and only one, Location

Area (LA), meaning that an RA cannot span more than one
LA. An RA is served by one and only one SGSN.
181
Tracking Area
Paging Control
Context Storage
Serving S10 Interface MME2

MME
TAI = 4 TAI = 4
TAI = 1 TAI = 1 TAI = 2 TAI = 4 TAI = 4
TAI = 1 TAI = 1 TAI = 2 TAI =3 TAI= 4 TAI = 4
TAI= 1 TAI = 1 TAI = 2
Idle mode UE
• Idle mode context is stored in serving MME

• Serving MME may change as UE moves; Context transferred on S10
• UE can be registered in multiple TAs (Registration Area)
• TAI = MCC + MNC + TAC = PLMN-ID + Tracking Area Code
To implement idle mode in support of efficient paging, a

geographical region is divided into tracking areas. A
Tracking Area (TA) is a logical grouping of eNBs in a
contiguous region for purposes of paging an UE. A page
message to be sent to a UE is sent to one or more TAs.
Multiple TAs are usually defined in an operator’s network
to optimize the paging performance. If the TA is too big,
backbone messages may flood the network. If the TA is
too small, UE location updates occur very frequently. In
LTE, a cell can be a member of one and only one TA.
However a UE can be registered in one or more TAs. The
set of TAs that a UE is registered in is known as a
registration area. This provides more flexibility in network
design. A TA may be a Closed Subscriber Group (CSG). For
example, a university campus can be set up as a CSG and
only those users who are part of the CSG will be allowed
access there. An additional parameter is broadcast from
the eNB to indicate that the cell is a part of a CSG. A UE, if
a member of the CSG, will be provisioned with appropriate
information in the form of a white list.
182
Tracking Area Update Triggers

EPS
MME
PDN
S-GW EPS Bearers

P-GW
Triggers for TAU

• UE enters new TA
• The periodic TAU timer expires (T3412)
• UE reselects from UTRAN (e.g., URA_PCH) to E-UTRAN
• UE reselects from GERAN (READY) to E-UTRAN
• Change of UE CN capabilities (e.g., due to SIM card change)
• If the RRC was released with cause value load rebalancing
TAU required
When a UE is in idle mode, it is not sending any user data Other situations when the UE sends TAU include:
to the network. In the absence of this procedure, the
• UE reselects from UTRAN (e.g. URA_PCH) to E-UTRAN
network won’t know if the UE has moved to a different
area and it won’t know if the UE is still operating. The • UE reselects from GERAN (READY) to E-UTRAN
tracking area update procedure keeps the network in the • Change of UE CN capabilities (e.g., due to SIM card
loop. change)
TA updates are always initiated by the UE. There are two • If the RRC connection was released with cause value,
types: load rebalancing TAU required
• Normal tracking area updating is to let the network • If the TIN indicates P-TMSI when the UE reselects to
know that the UE has moved to a new TA. E-UTRAN (e.g. due to bearer configuration
Registration information is updated in the MME. modifications performed on GERAN/UTRAN)
• Periodic tracking area updating periodically notifies
the network that the UE is still available. This is
controlled in the UE by timer T3412. The timer is sent
by the network to the UE in the ATTACH ACCEPT
message and the TRACKING AREA UPDATE ACCEPT
message.
Normally, a TAU is performed and the UE goes right back
to being idle. However the procedure can be used by the
UE to activate (setup radio and S1 bearers) all EPS
bearers that are active in the UE.
183
Tracking Area Update - I

E-UTRAN EPC
UE
eNB MME S-GW
TAU Trigger (e.g., IRAT)
1. TRACKING AREA UPDATE REQUEST
old GUTI
“active” flag For IRAT idle mode
Last visited TAI HO, retrieve context
UE Network Capability from SGSN
KSI(SGSN)
EPS bearer context status IE
NAS-MAC
….
Start T3430
A TA update is triggered in the UE either by the expiry of NAS-MAC: Signaling messages, even in idle mode, must
the periodic timer or by the UE’s entry into a new TA. be protected by integrity. With this parameter the MME
will be able to check the validity of the message.
The UE initiates the TAU procedure by sending a TAU
Request. The key parameters on the message are: KASME and KSISGSN: These keys are necessary for
generating the required authentication, integrity and
Old GUTI: The Globally Unique Temporary Identity was
ciphering keys. The Key Set Identifier points to possible
assigned to the UE when it attached to the network. This
existing keys which can be reused without the need to
identifies the UE for the network.
generate new keys.
Last Visited TAI: With this the MME knows the current and
To ensure that its message is processed the UE starts
previous TAs and may use this info in its deciding which
timer T3430. If the timer expires before a response from
TAs will be in the registration area for this UE.
the MME the UE will resend.
UE Network Capability: This optional information element
indicates the Core Network capabilities like integrity and
encryption algorithms and support for SRVCC. Support for
ISR is indicated here also, but this is for test purposes
only as the ISR capability is mandatory for the UE.
Active Flag: If set the UE is requesting that the network
activate all its dormant EPS bearers. i.e. it has data to
send
EPS Bearer Status: This is the complete list of all dormant
EPS bearers, at least from the UE’s perspective.
184
Tracking Area Update - II

EPC
UE E-UTRAN
eNB New or Old S-GW HSS
MME
2. Authentication 2b. [S6a Signaling]
4. TRACKING AREA UPDATE ACCEPT

3. Deactivate
Old or New GUTI Start T3450 if bearers not
new GUTI active in UE
TAI List
NAS-MAC
5. TRACKING AREA UPDATE COMPLETE

Stop T3450
1. When the MME receives a tracking area update from

a UE it will first check the integrity of the message. It
uses the message authentication code, NAS-MAC, for
this purpose. If the UE has a valid security association
with the network, the check should pass.
2. The MME may decide to authenticate the UE at this
time. This step is optional and will depend on
operator policy.
2b. If authentication is needed (e.g., initial TA-update, or
integrity check of TAU request fails) the MME must
contact the HSS for necessary authentication/
security vectors.
3. The EPS bearer status in the received request
indicates each EPS bearer that is active in the UE. If
there is a mismatch with the MME context and the UE
has deactivated bearers that the MME has active
then the MME will proceed to synchronize the context
and command the S-GW to also synchronize by
tearing down corresponding S1-U and S5-U bearers.
The Create Bearer Request/Response messages
between MME and S-GW are used for this purpose.
185
Tracking Area Update – II (continued)

EPC
UE E-UTRAN
eNB New or Old S-GW HSS
MME
2. Authentication 2b. [S6a Signaling]
4. TRACKING AREA UPDATE ACCEPT

3. Deactivate
Old or New GUTI Start T3450 if bearers not
new GUTI active in UE
TAI List
NAS-MAC
5. TRACKING AREA UPDATE COMPLETE

Stop T3450
4. The MME responds to the UE with a TAU Update synchronize its context to that of the network.
Response.
If UE set the “active” flag in the request, the MME will
The key parameters on this message are: reestablish all the active EPS bearers.
GUTI: This may be the same GUTI that the UE sent in the UE stops T3430 on receipt of the TAU response. If a new
request. However if the MME executed the GUTI GUTI is received the UE must confirm by sending
reallocation procedure then a new GUTI is being returned TRACKING AREA UPDATE COMPLETE. On receipt of this
to the UE. This is done for added security and anonymity message the MME stops time T3450.
purposes. Alternatively if this is a new MME then the GUTI
must be different as it contains the ID of the MME. In any
case if this is a new GUTI being sent the MME starts timer
T3450, expecting a response from the UE to confirm
receipt. If a new MME has processed the TAU request, it
will send a location update to the HSS (not shown). The
HSS will delete the context in the old MME and send
subscriber data to new MME.
TAI List: This is the list of TAs in which the UE is now
registered. Normally this would include the current and
last visited TAs.
EPS Bearer Status: This is the complete list of all dormant
EPS bearers from the MME’s perspective. If there is a
mismatch with the UE context then the UE will proceed to
186
Exercise: Cell Reselection and TAU

True or False?
1. For a UE in the idle mode, the UE and not the network
decides which RAT should be given a high priority for cell
reselection.
2. When an Idle mode UE is observing the downlink of a low
priority RAT, it will search for a high priority RAT such as LTE
at least once every 60 seconds.
3. To facilitate implementation of speed-dependent cell
reselection, the UE estimates its speed in the units such as
miles per hour or meters per second.
4. An idle mode LTE UE must do a Tracking Area Update after
it has performed cell reselection from one LTE cell to
another.
187
Idle-State Signaling
Reduction (ISR)
188
Idle-State Signaling Reduction

TIN-ID and MM
S4
SGSN UTARN/ info stored for
GERAN both domains
P-GW
S-GW P-TMSI/RA
HSS
Paging
S11 GUTI/TA
The HSS MME TA
considers both E-UTRAN
nodes as
serving the UE
simultaneously. UE can freely reselect
When DL data arrives at P-GW, S-GW between UTRAN/GERAN and
will notify both the SGSN and the E-UTRAN cells without doing
MME and they both page the UE. RA or TA updates.
Data is transferred only through the TIN is set to “RAT-related”
UE selected RAT after connection when ISR is active.
setup.
ISR or Idle-state Signaling Reduction is a mechanism for ISR deactivation by the network can be done by setting
reducing the amount of Tracking Area and Routing Area the TIN to either GUTI or P-TMSI after a TAU or RAU
updates in a network which is caused by the UE respectively. There are a number of situations that can
reselecting between GERAN/UTRAN and E-UTRAN. ISR will arise whereby the UE, MME and SGSN are no longer in
not only reduce the air-interface signaling due to area sync. For example: (a) Missing periodic TA or RA updates,
updates, but also the required intra-network node and (b) Serving GW change. In order to minimize the
signaling. Support for ISR is mandatory for the UE but its complexity of this feature, there are no ISR specific
use is an option on the network side. ISR impacts several procedures to handle such situations. Rather the solution
network nodes including SGSN, MME, S-GW and the HSS. is to deactivate ISR. Later the network can re-activate
The Gn-SGSN does not support ISR. during normal RAU/TAU procedures and hence re-
synchronize contexts in MME and SGSN.
The first time a UE reselects from E-UTRAN to GERAN or
UTRAN, the network may activate ISR and inform the UE
via the RAU Accept message. Once activated the UE will
use an ISR specific ID known as TIN: “Temporary ID used
in next update”.
If TIN is set to “RAT-related TMSI” then this is simply an
indication that the UE is free to choose either one of the
Core Network IDs depending on which RAT it happens to
prefer (GUTI or P-TMSI). After the ISR is activated, the
SGSN/MME will not know which RAT is preferred by this
Idle-UE. In that case DL transfer of data requires paging by
both SGSN and the MME.
189
ISR Activation During RAU

MME SGSN HSS
TIN set to Attach Procedure in LTE Domain

GUTI
ISR
IRAT Reselection deactivation
RAU Request
Context Exchange
(ISR Capability)
HSS-SGSN
RAU Accept
signaling
ISR Activated
Both MME
and SGSN
TIN set to
registered
RAT-Related TMSI
During the Attach procedure no special ISR-related will not do any updates due to cell reselection as long as it
functionality is required. An Attach can by default remains in the TA/RA. When it does change area, it will
deactivate any pre-existing active ISRs. The ISR capable use the appropriate “RAT-related Temporary ID” to do the
UE will then set its Temporary ID Used in Next Update signaling.
(TIN) to the GUTI allocated to it by the MME.
A while later when the UE reselects to GERAN or UTRAN
for the first time, it will initiate a Routing Area Update
(RAU). During this RAU, ISR may be activated. Since the
TIN was set to GUTI during Attach and the UE is updating
in GERAN/UTRAN, it will indicate a P-TMSI mapped from
GUTI and send it in the RAU Request to the SGSN. The
SGSN will contact the MME and request a Context
Exchange in which they also “decide” to activate ISR from
the network’s point of view. At this point, both the MME
and SGSN are registered as “serving” at the HSS and S-
GW (not shown). Without the ISR activation, the MME
would be erased from the HSS memory as a serving node
for this UE (IMSI) after signaling with the SGSN.
RAU Accept message will indicate to the UE that ISR is in
use and the UE will set the TIN value to “RAT-related
TMSI” value. The MM (Mobility Management) entity at the
UE will now regard P-TMSI and GUTI as valid identities and
190
Combined LAU/TAU
191
Combined TA/LA Update

New LAI, IMSI,
MME address
and LU type LA Update
TA Update
3. LAU Request
MME 4. LAU Accept MSC/VLR
2. Security
Procedures
HSS
Combined TA/LA can be used for CS Fallback
Already in 2G 3GPP networks, a combined Location In the final step, the UE will get a VLR-based TMSI in the
Area/Routing Area procedure was defined. Location areas TAU Accept message. As a result, the UE is now IMSI
are paging areas for MSC/VLR and Routing areas (RA) are attached and ready to receive calls in the CS domain.
paging areas for SGSN. The purpose of this combined
procedure was to reduce the signaling burden between
the mobile and the core network. A mobile that changes
Location Area (and therefore Routing Area) could, in
principle, request a combined location area update. The
network requirement for this procedure is the existence of
the Gs interface.
In a similar manner, the interface used between the MME
and the MSC/VLR in CS Fallback, namely SGs, can be
used for combined LA/TA update.
In step 3, the MME will send the new LA ID, IMSI, its own
address, and the Location Type (normal).
How does the MME know which MSC/VLR should be
contacted?
In step 1, the UE sends its temporary EPC CN ID, namely
GUTI. MME will use the GUTI to derive the LAI (because
the MME-Group-ID maps to LAC) and from this LAI, the
MME can determine the VLR address in a look-up table.
192
Summary
• Idle-mode activities between LTE, UMTS and GSM/GPRS
are similar.
• The network can assist and direct cell reselection by using
cell reselection parameters in broadcast channels.
• Carrier frequencies and RATs can be assigned different
priorities by the network for control of cell reselection.
• Cell reselection can be a function of the mobile’s speed.
• Tracking/Location/Routing Area Update procedures are
done after IRAT cell reselection.
• Idle-state Signaling Reduction is a new feature that
reduces the need for frequent paging-area updates for the
UEs frequently encountering boundaries of technologies.
193
Review Questions
1. Name the two E-UTRA UE states, and list the UE activities
for each.
2. Reselection between LTE/UMTS/GSM/GPRS can only
occur for the UE in the idle state. (T/F)
3. Which SIB carries IRAT cell information in 2G?
4. When ISR is activated, paging may be done through the
SGSN and the MME. (T/F)
5. Explain how the speed of the UE is measured in speed
dependent cell reselection.
194
Additional Information:
PLMN Selection
195
PLMN Selection Procedure (Automatic)

Optionally use pre-
stored info for For each carrier,
Scan (all) RF channels search for the
optimization of
scanning frequencies strongest cell and
and cell acquisition read the PLMN ID
Forward “high-quality” UMTS CPICH_RSCP > -95 dBm

PLMN-IDs to the next step;
ELSE pass the value of
measured quality as Is the PLMN LTE
RSRP > -110 dBm
well “high-quality?”
GSM Rxlev > -85 dBm
NAS layer (at UE) selects a PLMN using the

measurements and SIM card info if available PLMN
The diagram illustrates PLMN selection procedure in each initial choice for the PLMN and access technology is
RAT. In the PLMN selection procedure, the mobile must decided by the NAS layer (at the UE) and depends on such
first scan RF channels within the supported device band. things as SIM card settings and network cell reselection
This process is usually accelerated by using pre-stored parameters. The priority between multiple RATs within
information such as the last carrier frequency used or each PLMN could also be decided as part of the
“home” RF carriers as remembered by the device. When a implementation by the service provider.
mobile is powered on, it is a fairly good assumption that
nothing has changed (although this need not be the case
as in the case of a frequent flyer businessman). In any
event, the SIM card can also play a crucial role in the
initial choice of PLMN and RAT type.
In the next step, the UE selects the strongest cell and
reads the System Information messages broadcasted
from the cell. This may indicate one or more PLMN IDs.
The mobile will eventually choose one PLMN ID and use
that for registration with the network. (This could be simply
the PLMN ID derived from the IMSI on the SIM, but not
necessarily so). For each technology, the threshold for
what is considered a high quality cell is indicated.
Please note that this does not imply that LTE cells are
preferred to UMTS and GSM cells because they are
considered low quality at a lower threshold. Ultimately the
196
The SIM and PLMN Selection

UICC
Phonebook Elementary Files
SMS • IMSI
U/I SIM • HPLMN selector with Access
…
Technology
• Operator Controlled PLMN selector
with Access Technology
EHPLMN List • User controlled PLMN selector with
MCC1 MNC1 Access Technology
MCC1 MNC2 • Operator PLMN List
MCC2 MNC1 • Forbidden PLMNs
…. …. • Equivalent Home PLMN list
• Network Parameters
PLMN - Cell Frequencies for reduction of
selection search time by the UE/MS
algorithm
prioritizes in
this order:
HPLMN/EHPLMN  User Controlled  Operator Controlled 
Randomly from ‘High Quality’  Decreasing Signal Quality
In LTE, the Universal IC Card (hardware of “smart card”) RAT in priority order.
can support multiple profiles as described in the
• The Operator PLMN list contains a prioritized list of
standards, such as USIM and ISIM. USIM is derived from
Location Area and Tracking Area identities.
the legacy UMTS specifications and includes all the
enhancements made to the SIM for 3G (more memory,
better over the air control, new elementary files, new
security algorithms, etc.) An ISIM profile on the other hand
is useful when the IP Multimedia Subsystem (IMS) is used
as the central network for provision of services.
The SIM has different directories and file structures for
storing private information such as the phonebook and
SMS as well as network-related directory which assist the
UE in PLMN and RAT selection.
• The IMSI on the SIM can be used to derive the Home
PLMN ID.
• If the HPLMN has more than one access technology,
that can be listed with priority order of each RAT.
• The elementary files PLMNwAcT and OPLMNwAcT can
be used to list PLMNs with their available RAT in
priority order. Different configurations allow the user
or the operator to choose the preferred PLMN and
197
The SIM and PLMN Selection (continued)

UICC
Phonebook Elementary Files
SMS • IMSI
U/I SIM • HPLMN selector with Access
…
Technology
• Operator Controlled PLMN selector
with Access Technology
EHPLMN List • User controlled PLMN selector with
MCC1 MNC1 Access Technology
MCC1 MNC2 • Operator PLMN List
MCC2 MNC1 • Forbidden PLMNs
…. …. • Equivalent Home PLMN list
• Network Parameters
PLMN - Cell Frequencies for reduction of
selection search time by the UE/MS
algorithm
prioritizes in
this order:
HPLMN/EHPLMN  User Controlled  Operator Controlled 
Randomly from ‘High Quality’  Decreasing Signal Quality
• Forbidden PLMNs IDs are stored in the SIM either by on the signal strengths for “high quality” cells (GSM > -
over the air (OTA) procedures or as a result of 85dBm, UMTS > -95dBm, LTE > -110dBm) and finally if
registration area rejections. there are no high quality cells in the MS will choose the
strongest available cell.
• To allow provision of multiple Home PLMNs, the
Equivalent Home PLMN (EHPLMN) is introduced. The
PLMN IDs that are in this list are considered Home
PLMNs and are treated as such during PLMN
selection. This allows operators great freedom in
determining the PLMN selection process in areas
where the HPLMN is not available or when you want
the Home PLMN to be treated as a visited PLMN
during cell reselection.
• The Network Parameters file contains the list of cell
frequencies for reduction of search time by the
mobile.
The order of PLMN selection priority is shown. First the
mobile tries to select a HPLMN or EHPLMN, if that is not
available it will follow the User controlled PLMN selector
with Access Technology list, and if that is not available,
then the operator controlled list with RAT is used, and if
that is not available, the UE will randomly choose based
198
PLMN Selection and Roaming

VPLMN
[C] OK, I will
HPLMN
remember this
and not request MSC/SGSN
MME
services in the
VPLMN in this
Loc. Area [B] Location Update Reject
[D] EMM Procedure Cause value:
Tracking Area Forbidden Location Area for
Update Accept Roaming
[A] Entering
a new LA
Overlapping
coverage
After PLMN and cell re-selection, the mobile will register

with the selected network, which could be a VPLMN with a
similar or different radio access technology than the home
PLMNs. For PLMN selection in automatic mode, the UE
will select PLMN in priority order.
In order to prevent the MS from repeating attempts to
access roaming services, it is possible to reject a service
request or location area update message by designating
specific location/tracking areas as forbidden. When the
mobile is informed that an area is forbidden it will store
that information until the SIM is removed or the device is
powered off. This procedure is handled by the EPS
Mobility Management protocol in the LTE network and by
the corresponding MM and GMM for GSM and EGPRS
respectively.
It is also possible to receive an MM message with cause
value “PLMN not allowed”. In this case, the PLMN ID is
added to the list of Forbidden PLMNs in the SIM and that
network will not be accessed. In contrast to Location
Area/Tracking area procedure, this information is retained
after SIM card removal or power cycling.
199
200
6 | Circuit-Switched Interworking
Chapter 6:
Circuit-Switched
Interworking
201
Objectives
• Explain CS interworking challenges and propose
standardized solutions
• Describe the CS Fallback mechanism and sketch the
signaling involved in mobile-originated and mobile-
terminated voice calls
• Walk through the combined Attach procedure for CS
Fallback
• Explain Single-Radio Voice Call Continuity
• Illustrate SR-VCC signaling call flows
• Describe IMS-based interworking principles
• Sketch a high-level IMS-based handover for PS-to-CS
• Summarize how SMS can be supported using control and
user plane solutions
Chapter References:
[1] 3GPP TS 23.002 V8.3.0 (Network Architecture)
[2] 3GPP TS 23.272 V8.3.0 (Circuit Switched Fallback in
EPS)
[3] 3GPP TS 23.216 V8.3.0 (Single Radio Voice Call
Continuity)
[4] 3GPP TS 29.280 V8.1.0 (Sv Interface)
[5] 3GPP TS 29.118 V8.1.0 (SGs Interface)
[6] 3GPP TS 23.292 V8.3.0 (IMS Centralized Services)
[7] 3GPP TS 23.279 V8.1.0 (CS and IMS Services)
[8] 3GPP TS 23.228 V8.6.0 (IMS)
[9] 3GPP TS 23.206 V7.5.0 (VCC)
202
Voice in LTE
203
Voice Solutions in LTE

Redirects voice calls to
Simultaneous Voice and the underlying 2G/3G
LTE using Dual-Radio network using Circuit
solution (SV-LTE) Switch Fallback (CSFB)
Supports packet voice

(VoIP) using IMS (VoLTE)
Transfers active voice calls to

2G/3G outside the LTE
coverage area using Single-
Radio Voice Call Continuity ‘Application-level’ handover; UE
(SR-VCC) may select the ‘best’ RAN:
IMS Service Continuity (ISC)
Although data services are expanding rapidly, voice As Voice over IP (VoIP) solutions are deployed in the LTE
remains the most commonly used wireless service, and is network, the need to move to 2G/3G is eliminated within
likely to remain that way for some time. LTE defines a the LTE coverage area. Only when the user leaves LTE
number of alternative approaches to serving voice users, entirely will it be necessary to transition the call from the
depending on the coverage and capabilities of the LTE LTE packet network to the 2G/3G circuit network, through
network relative to existing 2G or 3G systems. a process called Voice Call Continuity.
The simplest approach, at least initially, is to continue to Ultimately, the goal is to offer all voice and data services
serve voice subscribers on the current 2G/3G network, entirely on the LTE network. IMS is the preferred solution
and use LTE only for high-speed data services. While this for interworking VoIP with the legacy wireless telephony
simplifies the LTE deployment, it requires the user to have network.
two separate devices, one for voice and one for data or a
Finally, handovers can be enabled by the IMS. In this type
dual-radio solution where one radio tunes to LTE for data
of handover, the mobile may play a central role in initiating
services and the other radio tunes to 2G/3G for voice
and selecting the most appropriate RAT to be used at any
services.
given time. The basic concept of IMS Centralized Services
The availability of hybrid devices, capable of supporting with service continuity is to provide the user with a CS
both LTE and 2G/3G technologies, allows the user to Service access, independent of the RAT type being used,
remain on the LTE network while using data applications, thus providing seamless voice service across radio access
moving to the 2G/3G network only when voice services networks.
are needed. This process is known as Circuit Switch
Fallback (CSFB).
204
IMS Overview
205
Characteristics of IMS
Rapid introduction
Wireless access network
of new services
independence and
from conception
seamless mobility
to deployment
Consolidated Possibility of fixed

provisioning, billing and mobile
and management
IMS convergence
IP Multimedia Subsystem
Uniform QoS
Management Convergence to
open platform
protocols
• Cost-effective deployment
of multimedia services
• Open yet integrated environments
To some extent, IMS can be seen as a reinvention of the Other advantages that IMS brings are consolidated
Wireless Intelligent Network (WIN), an old wheel that did operations such as billing, provisioning and service
not work very well. WIN and its counterpart in the wireline management. For operators, these integrated networks
world, the Advanced Intelligent Network (AIN), suffered offer savings in operating costs. In addition, many aspects
from a number of disadvantages. It was expensive to of service configuration can be accomplished directly by
implement and maintain, and its service creation the subscriber through a Web interface and/or the
environment was complex. Also, it was a “closed” subscriber’s device.
application development environment; it was not easy for
Lastly, although originally started for mobile networks, IMS
third parties to develop applications. In addition, IN was
is now also extending its reach into next-generation
not a uniform standard. There were a number of call
wireline networks for fixed-mobile convergence.
models and no application programming interface (API)
standards. In effect, it turned out to be more of the same
old ‘slow as molasses’ environment with no new players
and no revolutionary technologies.
So what’s new? IMS fixes a lot of the mistakes made by
IN. It is truly an open architecture built upon the already
burgeoning success of the most disruptive technology to
invade the telecom world in decades, namely SIP-based
VoIP. A broad selection of services can be made available
to service providers, and these services can be brought to
market much faster due to the adoption of standard and
open development environments.
206
IMS Architecture
IMS
AS Applications
AS
IMS Control SGW
AS ISUP
CSCF
HSS MGW PSTN
MGCF
UE
IP CAN
RAN PS
Core IP Network
IMS Transport
The diagram shows a simplified view of the IMS The Call Session Control Function (CSCF) plays various
architecture as defined by 3GPP. IMS offers both general roles in an IMS network. It provides the user with a secure
packet data support and multimedia session capabilities. entry point to the IMS network. It is the primary call
The multimedia session capabilities are built on top of the processing server and SIP registrar. It processes all the
general packet data support capabilities. The general IMS requests from the UE and, as appropriate, provides
packet data capabilities may be deployed without the access to requested application services.
multimedia session capabilities.
The other IMS network elements displayed opposite jointly
The underlying IP connectivity is provided by the IP CAN (IP define a “gateway” function, enabling the interconnection
Connectivity Access Network). Seen from IMS’s point of between IMS and various external networks. As an
view, the IP packets will be delivered to and from the user example a voice call initiated as packet-based Voice over
device through an IP transport mechanism. The generic IP (VoIP) in IMS, may connect to a circuit switched phone
term for this type of network which connects the IMS user in the Public Switched Telephone Network (PSTN). IMS
to the IMS services is IP-CAN. An example of IP-CAN gateway will facilitate the call setup and the real-time
network is the UMTS/GPRS packet core network and the translation of the media between packet switched and
UTRAN/GERAN. circuit switched.
Some network entities (e.g., the HSS) may be common to
the Packet Switched Core Network (PS-CN) and the IMS
network. Note also that the IMS Control network provides
access to a separate services network where Application
Servers (AS) reside. This provides a platform for the
introduction of creative new services without the need to
integrate these services into the transport network.
207
IMS Session: Mobile Termination
Originator
UE
P-CSCF S-CSCF I-CSCF
INVITE
SDP Negotiation
Resource Reservation
Ringing
Answer
<--------------- Media Flow --------------->

Mobile termination functions are somewhat similar to Ringing: Once all Quality of Service (QoS) preconditions
mobile origination functions. The I-CSCF is located at the have been satisfied, the called party may be alerted to the
edge of the administrative domain and is listed in the DNS incoming call.
and is the first entity to receive inbound requests. The I-
Answer: Once the called party accepts the call, the two
CSCF interrogates the HSS (not shown) to retrieve the
endpoints begin exchanging media packets.
name (or address) of the S-CSCF where the terminator is
registered. If the terminating network operator wants to Media Flow: The two endpoints exchange voice, video, or
keep the network configuration private, then the I-CSCF application data packets. While not shown explicitly on the
will remain in the call to perform topology hiding. slide, the media packets may be sent directly between the
endpoints. They do not traverse the same path as the call
The diagram shows an overview of the mobile termination
signaling.
procedure. The sequence is explained below:
Session Setup Confirmation: Once resource reservation is
INVITE: The originating party sends a SIP INVITE message
completed successfully, the terminating UE sends a SIP
through the network to the destination UE.
200 OK final response and the originating point replies
SDP Negotiation: The two end parties negotiate the media with a SIP ACK message to confirm the session setup.
characteristics (e.g., number of media flows, codecs) for
Session in Progress: Once the P-CSCF approves that the
this session and make a decision on the media streams
reserved resources can be used, the UE starts the media
they will support for this session.
flow. After the session setup is confirmed, the session is
Resource Reservation: The wireless network reserves the in progress.
necessary resources for supporting this session after the
media characteristics for this session have been agreed
upon.
208
Role of IMS in E911 Support

Retrieves location and
PSAP routing
UE information
Le
PSAP
LCS Client
MME GMLC LRF Routes emergency
session to correct PSAP
E-SMLC
Serving Mobile
Location
Center
Gm
To PSAP
E-CSCF via IP or PSTN
Handles emergency P-CSCF
registration request IMS
and selects E-CSCF Network
Processes emergency
registration request
S-CSCF
and determines
duration of registration Award Solutions Proprietary
The Public Safety Answering Point (PSAP) is where entities such as a Location Server (i.e., GMLC) to
emergency calls from the public are received. The obtain location information and an RDF to obtain
functions of the nodes that participate in E-911 support routing information. The LRF function may be
are summarized below: incorporated into the GMLC. The Location Server is
responsible for actually obtaining the location of the
• P-CSCF: The P-CSCF is the first IMS component that
UE. The RDF gives the correct PSAP destination
receives an emergency registration request from the
address to the E-CSCF for routing the emergency call.
UE via the E-UTRAN and EPC (specifically, the S-GW
and P-GW). The P-CSCF also chooses a suitable E- In general, establishing an emergency call in EPS/IMS
CSCF. follows one of the following two scenarios.
• S-CSCF: The S-CSCF receives the emergency The normal case entails following steps:
registration request from the P-CSCF and determines
1. The UE establishes an emergency PDN connection.
how long the registration should be valid.
2. The UE performs an IMS emergency registration.
• E-CSCF: It is a new entity added to the IMS network
specifically to support emergency sessions. It 3. The UE makes an emergency VoIP call .
processes emergency registrations and is responsible
for routing the emergency request to the correct
emergency center or PSAP. This component is located
in the “local” network, i.e., in the visited network if the
UE is roaming.
• Location Retrieval Function (LRF): It helps obtain the
location information for the UE by interacting with
209
Role of IMS in E911 Support (continued)

Retrieves location and
PSAP routing
UE information
Le
PSAP
LCS Client
MME GMLC LRF Routes emergency
session to correct PSAP
E-SMLC
Serving Mobile
Location
Center
Gm
To PSAP
E-CSCF via IP or PSTN
Handles emergency P-CSCF
registration request IMS
and selects E-CSCF Network
Processes emergency
registration request
S-CSCF
and determines
duration of registration Award Solutions Proprietary
The exceptional case is when the UE has, for various

reasons, not been authenticated in the EPC:
• The UE establishes an emergency Attachment and an
emergency PDN connection (no authentication
possible).
• The UE shall initiate an IMS emergency VoIP call
without IMS registration. In the SIP INVITE message,
the UE shall include both the "anonymous user" and
"emergency service" indications.
In both cases, the UE will include its location, in the form
of the Global Cell ID of the serving cell, in the emergency
SIP INVITE message. This view of the UE’s location may be
refined by further messaging and using the services of
LCS.
210
IMS Origination: Emergency Call

MGCF/ Emerg.
IP-CAN LRF IMS core
UE MGW center
1. Init Emerg.Call
2. Acquire location
3. Invite (emergency)
4. Retrieve PSAP routing information
5. Procedure to obtain the UE’s location

6. Return UE location &
PSAP routing information
7a1. Invite (emergency)
7a2. IAM
7b. Invite (emergency)
8. Complete emergency call establishment: SDP Negotiation, Resource Reservation

Ringing, Answer
9. Retrieve location
10. Procedure to obtain the initial or
updated location 11. Return location
Award Solutions Proprietary Ref: TS 23167 IMS emergency sessions
A high level view of the process involved in making an 5. The LRF may request the UE's location information.
E911 call using IMS and providing location information This step involves the GMLC, MME, E-SMLC, the eNB
based on the EPS control plane is described below. and the UE. When the UE location result is returned,
the LRF may now query the RDF to specify the PSAP
1. The UE sets up an emergency registration with IMS.
routing information corresponding to the UE’s
2. The UE may have access to its location independent location.
of the PLMN. Alternatively the UE, acting as an LCS
6. The LRF forwards the info to the E-CSCF.
client, may request its location information from the
network which, after employing one or more 7. The E-CSCF uses the routing information to forward
positioning methods deliver the result to the UE. the call to the PSAP. It includes the recent UE location
information. Depending on whether the PSAP
3. The UE sends an INVITE with an emergency indication
supports VoIP or not the INVITE message is forwarded
to the P-CSCF in the local IMS network. The INVITE
either to 7a. an MGCF/MGW, or, 7b. the SIP server
should contain any location information that the
in the PSAP.
terminal has even if only Global Cell ID. The P-CSCF
forwards the INVITE to the S-CSCF in the home IMS 8. The emergency call establishment is completed.
network and to the E-CSCF in the local network. The
9. The PSAP may now request updated location
E-CSCF is responsible for routing the call to the PSAP.
information on the UE. The PSAP may determine the
4. If the location information provided by the UE in the LRF based on the location or via correlation
INVITE is sufficient to determine the correct PSAP, the parameters received in the INVITE message.
E-CSCF will route the INVITE message directly.
10. and 11. The LRF again requests the GMLC for the
Otherwise the E-CSCF will send a location request to
target UE's location and returns it to the PSAP. This
the LRF.
step may be carried out a number of times.
211
CS Fallback
212
What is CS Fallback?
EPC PSTN
CS-CN
E-UTRAN
UTRAN/
GERAN
PS Services CS and PS Services
CS Fallback capable UE
• Depends on the existence of UMTS/GPRS umbrella
• CS services are provided by the UTRAN/GERAN access
technology
• Inter-RAT handoff to UMTS/GPRS when the UE needs
to be using the voice services
LTE doesn’t have a circuit-switched core network.

Different options are looked at to support voice services in
LTE. One solution is to go for VoIP calls over PS-CN using
IMS. Another solution is the Circuit Switched (CS) Fallback
feature. CS Fallback feature allows the UE to switch over
to the UMTS/GERAN and reuse CS-CN for CS-domain
services.
The CS Fallback feature depends of the existence of an
umbrella technology that has CS core and possibly the PS
core. Initially when LTE is deployed, it is very likely that it
would be deployed in pockets. It is also correct to assume
that a 2G/3G wireless network would be giving good
coverage for both CS and PS services. So the CS Fallback
option to support voice services will be a feasible option.
The advantage of CS Fallback is that it doesn’t need a
supporting IMS network.
The UE can be actively using LTE access. When a voice
service like a mobile-originated call or mobile-terminated
call is required, the UE would be handed over to a
neighboring UTRAN/GPRS cell.
213
EPS Architecture for CS Fallback

Other CS Services
UTRAN LCS SMS SS
Uu Iu-CS
GERAN
A MSC
Server
Um
E-UTRAN SGs
UE LTE-Uu S1-MME
MME
The UE, MME, SGSN, E-UTRAN and MSC-Server must be UMTS/GSM networks. LCS services in particular can play
enhanced to support the CS Fallback feature. The UE will an important role in the initial phase of LTE deployment,
be capable of accessing the E-UTRAN/EPC and the because it can provide E911 services. In LTE, SMS is
GERAN(UTRAN)/CS Domain. It should be capable for supported over IP and can also interwork with Instant
performing a combined EPS/IMSI Attach procedure. MME Messaging (IM) services. It is possible for the LTE-UE
and MSC support the new SGs interface. Paging for the CS (subscriber) and/or the network to choose the mechanism
services are sent from MSC server to the MME over the for SMS delivery to be the CS domain when CS fallback is
SGs interface. The MME derives the MSC server number supported.
based on GUTI and LAI. The E-UTRAN should be able to
direct the UE towards the CS capable target cell during CS
fallback.
The SGs reference point is based on the Gs interface. The
SGs interface is used to trigger the paging procedure for
mobile terminated calls. It is used by the UE to perform
location update procedure. It is also used to support SMS
services. The SGsAP over SCTP is defined to support these
functionalities.
Voice is not the only CS service, although it may be the
most important one to utilize CS fallback. Other CS
services such as Location Service (LCS), Short Message
Service (SMS) and Supplementary Service (SS) can also
be used for a mobile that is attached to both EPS and
214
CS Fallback End-to-End View

PAGING Response
GERAN PSTN
MSC
UTRAN
with CSFB D
SGSN Combined
SGs Mobility
HO to 2G/3G at S3 Mgmt
HSS
the beginning of S4
voice call
MME
E-UTRAN S-GW S5 P-GW PDN

S1-U
SGi
PS-path on S1-U may be “pulled over” to

S4 (or dropped) as a result of the CS
fallback
This chart shows the principal nodes/interfaces and the

impacts to the nodes that are involved for CS Fallback. An
important requirement is that the MSC (or MSC-Server) is
upgraded with CS Fallback (CSFB) related software. The
SGs interface is used for signaling between the MME and
the enhanced MSC. Mobility Management is shared
across the two nodes over SGs interface using the SGs
Application Part protocol. Paging for MT (Mobile
Terminated) calls is done through the E-UTRAN, but the
PAGING RESPONSE and the continued signaling for call
setup is done through UTRAN/GERAN.
If the UE is already engaged in a PS session on the LTE
domain, CSFB allows continuation of the session
concurrently with the CS voice (UMTS supports that from
Release 99). For this to happen, the PS path is switched
over to 2G/3G domain with MME signaling. This is an
option and it may happen that an incoming call will result
in dropped PS service if the operator wishes to do so.
215
CS Fallback Procedures - Overview

Combined Attach
MO CSFB MT CSFB
CS Fallback Request EPC Paging
PS Handover CCO
CS Call Establishment
UMTS/GSM LTE
Active or Idle
The basic call flow procedure for CSFB (CS Fallback) is

similar to any normal handover procedure. For CSFB to
operate correctly, the UE must have registered with the
EPC and the 2G/3G CS core networks. This step is
referred to as combined Attach.
The next step depends on whether the UE is originating
the call (MO) or receiving it (MT). For the MO case, the UE
will send a service request and indicates the need for
CSFB. The fallback request from the UE is triggered, for
example, by the lack of IMS voice services on the LTE
side. In the MT case, a Paging message is sent towards
the UE and the UE responds with a service request that
indicates CS Fallback to 2G/3G CS capable network
(paging response comes later after the HO is executed).
There are now two main handover options based on what
is supported on the network side. If PS handover is
supported then the handover procedure follows the
normal procedure for an active mode UE. If PS handover is
not supported, then the Cell Change Order (CCO)
procedure takes place. The entire procedure ends with a
CS call establishment procedure according to the type of
network that the UE is falling back on (i.e. GSM or UMTS).
216
Combined Attach for CS Fallback

MSC HSS
UE MME
server
1. Attach Request
(Attach_Type=Combined
EPS/IMSI, CS
Fallback capable)
2. EPS, AKA, Bearer Setup
Derive the
MSC Server ID
3. Location Update Request
(IMSI, MME address) Location update
procedure in CS
4. Location Update Accept domain
5. Attach Accept TMSI
LAI, TMSI
To successfully use the CS Fallback feature, the UE should 4. The MSC-Server also assigns a TMSI to the UE and
be registered with the MSC Server when it is using the LTE sends it to the MME using the Location Area Update
access. Accept messages.
1. Network registration of the UE with the MSC-Server is 5. The MME passes the LAI and the TMSI of the UE, to
done during the EPC Attach procedure. The UE will the UE in the Attach Accept message.
indicate the Attach Type to be EPS/IMSI type and
indicated that it is a CS Fallback capable UE.
2. The MME first takes care of the LTE EPS registration
process. Before sending an Attach accept message, it
initiates the Registration of the UE with the MSC
server. The first task of MME is to find out the MSC
server. It needs to know the Location Area of the UE.
An LAI can be statically configured on the MME.
Based on the LAI and the IMSI value, the MME
selects the MSC Server.
3. The MME sends a Location Area Update message
over the SGsAP with the parameters LAI, IMSI and
MME address. The MSC Server updates the HSS
about the new LAI of the UE. The MSC Server makes
a note of the MME serving the UE, so that it can
contact the MME for the incoming voice calls.
217
Mobile-Originated CS Fallback
MSC Server
eNB RNS MME CSFB-Capable SGSN
UE
1. Service Request
(CS Fallback indicator)
2. Handover with CS fallback
2. Solicit Measurement
report on neighboring
UMTS cell 3. PS Handover Preparation Phase & start of execution phase
4. CM Service Request
4. Iu-CS Msg with CM service Req
5. CS Call Establishment Procedure
6. PS Handover Continuation of execution phase
In this scenario, the UE is currently using the LTE access

network. The UE is capable of CS Fallback and is
registered with the MSC server. Now the UE needs to
make a voice call.
1. It sends a Service Request with the CS Fallback
indicator to the MME. MME in turn initiates the CS
Fallback by sending an S1-AP message with the CS
Fallback Indicator.
2. The eNB can request the UE to measure the
neighboring UMTS cells.
3. Next, Inter-RAT PS Handover procedure takes place.
4. After the handover preparation phase, the UE sends
the CM Service Request to the MSC Server.
5. Then the UE and the MSC Server perform the legacy
CS call establishment procedure.
6. Once the call is on, the rest of the PS handover
execution and completion procedure are taken care
of.
218
Mobile-Terminated CS Fallback
UTRAN
GERAN MSC/Server
eNB MME SGSN
UE with CSFB
Pre-Existing PS Path 1. CS Paging over SGs
S/P-GW
2. Paging (with Caller Line Identification)
3. Extended Service Request (CSFB Accept/Reject)

[3b. Paging Reject]
4. S1AP: CSFB indicator
6. PS inter-RAT HANDOVER Procedure

7. Paging Response A/Iu-cs message: Paging Response
8. CS Call Establishment Proc. CS Call Establishment Procedure
CS CS
IP IP IP
S/P-GW
Mobile Terminated (MT) call in CS Fallback clearly mail server/application for example. This important
illustrates the role of the SGs interface and the combined feature prevents unnecessary inter-RAT handovers for
mobility management (MM) between the MME and the calls that do not go through.
MSC Server with CSFB functionality.
4. The MME will now send an S1AP request message
1. The incoming call will eventually trigger a Paging with CS fallback indicator to inform the eNodeB that
message from the MSC Server towards the UE. the UE must be moved over to GERAN/UTRAN.
Because of the combined MM functionality, the MSC
Server and MME know that the UE is on the LTE side
and Paging message will be forwarded to MME over
SGs.
2. The MME will Page the mobile using E-UTRAN (eNode
B). Interestingly for CSFB paging, this message will
carry Caller Line Identification information (see next
step for reason).
3-3b. The UE will send an Extended Service Request
(piggybacked on RRC and S1AP messages) through E-
UTRAN to the MME, effectively requesting fallback to
CS. If the user wishes not to answer the call, this will
be indicated by CSFB indicator set to Reject and the
MME will send a CS PAGING REJECT to the MSC
Server over SGs. The call will be forwarded to voice
219
Mobile-Terminated CS Fallback
(continued)
UTRAN
GERAN MSC/Server
eNB MME SGSN
UE with CSFB
Pre-Existing PS Path 1. CS Paging over SGs
S/P-GW
2. Paging (with Caller Line Identification)
3. Extended Service Request (CSFB Accept/Reject)

[3b. Paging Reject]
4. S1AP: CSFB indicator
6. PS inter-RAT HANDOVER Procedure
7. Paging Response A/Iu-cs message: Paging Response
8. CS Call Establishment Proc. CS Call Establishment Procedure
CS CS
IP IP IP
Award Solutions Proprietary S/P-GW
5. At this point the eNB may optionally request a

measurement report on 2G/3G neighbors to
determine the most appropriate target. This is not
mandatory and “blind” handover to the same cell-site
for example, is an option.
6. A normal PS handover is done in this step. The
HO_From_E-UTRAN is the message that carries
information about the 2G/3G cell designated for the
UE.
7. After the UE has acquired the 2G/3G RAN, it will use
this new radio connection to respond to the paging
message on the CS domain.
8. CS call establishment signaling ensues according to
whether the RAT is GERAN or UTRAN.
The fallback has been completed at this stage. The voice
path to the PSTN is now through the MSC/MGW and the
PS session is through GERAN/UTRAN – SGSN – S-GW – P-
GW. (This is possible in GERAN if Dual Transfer Mode,
DTM, is supported). A RAU (Routing Area Update) may
occur after the handover is completed if there is a change
in Routing Area.
220
Exercise: VoLTE and CSFB

True or False?
1. Both VoLTE and CSFB need IMS.
2. IMS is capable of supporting an IP-based E-911 call.
3. For a CSFB call to work in a given geographic area, both
LTE and a legacy CS technology must be available in such
area.
4. A mobile-originated CSFB call is supported but a mobile-
terminated CSFB call is not supported due to the
implementation difficulties.
221
SR-VCC
222
SR-VCC Motivation and Requirements

Initially
unidirectional
PS  CS Requirement for
Limited LTE
simplified device
Coverage
RF
Single-Radio
Voice Call
No CS Continuity
R7 VCC
domain in solution is
LTE, need for complicated
PS to CS HO
Need for ‘in

Expands use
the call’ HO
of IMS
SR-VCC is one of the few possible solutions for

interworking across 3GPP networks. Already in release 7,
an elaborate and complete solution had been defined for
Voice Call Continuity (VCC, TS 23.206). The purpose of
VCC is to allow call continuity between the CS and IMS
domains. It is therefore possible to do VoIP support using
the IMS and still handover the ongoing call to the CS
domain and visa-versa. Unfortunately the VCC solution has
some stringent requirements, among them is the
requirement for a dual mode handset with RF front-end
which has to be on two different RAT types/frequencies
simultaneously. This ability allows the UE to make decision
about domain change when the signal strength of one
technology is below a given threshold. Single-Radio VCC,
as the name suggests, simplifies the mobile device by
removing this requirement. In its initial standardized form,
SR-VCC supports only unidirectional IMS to CS domain
handovers.
223
SR-VCC Architecture and Functions

Handles relocation
procedure for voice part Holds the session
transfer number
GERAN MSC-S/MGW PSTN
Iu-cs/A + SR-VCC
UTRAN D
Sv HSS
SGSN
S3
SR-VCC- S4
Capable Splits voice IMS
UE MME and non-voice
bearers
S1-MME
S11
E-UTRAN S-GW S5 P-GW SGi

S1-U
Voice
SR-VCC Impacted Nodes Anchor
The slide shows the logical architecture for SR-VCC, with since no simultaneous dual radio function is required. The
interfaces and reference points. The SR-VCC-specific UE must support the T-ADS functionality (Terminating
interface is the Sv interface between the SR-VCC- Access Domain Selection). This allows the UE to select the
enhanced MSC (logically, the MSC/MSC Server or VLR) CS domain (e.g., GERAN or UTRAN) for voice calls.
and the MME. Naturally both of these nodes are impacted
by the SR-VCC feature. Normally an SGSN is not impacted
by SR-VCC unless it supports interworking with CS domain
(has Gs-like functionality). In that case it must be able to
tell the difference between PS bearers that carry voice
(VoIP) and those which do not. For the MME this function
is a must. The SR-VCC-capable MME will perform ‘PS
bearer splitting’ which implies the separation of voice-PS-
bearers from the non-voice-PS-bearers. This is needed so
that the correct PS bearer is handed over to 2G/3G
domain. The MME is also the node that initiates the SR-
VCC handover for the voice component. Each UE is
allocated a static Session Transfer Number for SR-VCC
(STN-SR) which is used during the handover procedure.
The STN-SR format is E.164, similar to ordinary telephone
numbers.
The UE is impacted by SR-VCC as well, although the
impact is far less than when the VCC feature is used,
224
SR-VCC End-to-End View

GERAN MSC/MGW PSTN
+ SR-VCC
UTRAN
SGSN Sv HSS
IMS
MME
E-UTRAN S-GW P-GW
PSTN
Voice Non-voice
Voice after HO Non-Voice after HO
The basic mechanism in SR-VCC allows a PS-to-CS

handover for both the non-voice carrying and voice
carrying bearers. Handover for the non-voice bearer
portion is optional. Unlike CS Fallback, SR-VCC can be
done for an ongoing voice call anchored at IMS. As can be
seen in this end-to-end view, the non-voice bearer will
necessarily follow the voice path to UTRAN or GERAN (if
GERAN can support concurrent CS+PS). This is due to the
single radio nature of this handover mechanism. The voice
path goes from the 2G/3G RAN to the enhanced MSC
after the handover but the IMS remains the anchor for
voice.
Note: The SR-VCC solution does not require that all MSCs
be upgraded with the SR-VCC feature. If the UE happens
to be handed over to a cell which does not belong to an
SR-VCC-enhanced MSC, then the enhanced MSC must
find and establish a circuit to this ‘serving’ MSC.
225
SR-VCC Call Flow

UTRAN
GERAN IMS
MME MSC Server SGSN
UE 1 eNB
with SR-VCC
Measurement Reports
2 HO DECISION
3 (SR-VCC) HO Required 4
5
Request Resources for CS
Splits between voice and
non-voice PS bearers Request Resources for PS
7
6 ‘RR Ok’ Begin Session Transfer [STN-SR id]
8
Handover Command (target RAN info)
9 IMS Session Transfer
HO Execution
10
UE changes RAT New Voice path
11
Voice
Our initial assumption is that there is an ongoing VoIP- 7. A key message in SR-VCC is the request for a ‘new’
based call anchored at the IMS. voice call from the MSC-Server to the IMS domain.
This message is essentially an ISUP IAM, and carries
1. E-UTRAN is aware of UE capabilities (SR-VCC
an important identifier known as STN-SR or Session
supported or not) and also whether there is an active
Transfer Number for SR-VCC. This identifier which is
voice call.
like an ordinary telephone number (E.164) was given
2. The eNB makes the handover decision based on to the MME from HSS during the initial Attach
measurement reports. procedure and is passed over to the MSC Server over
3. Once the handover decision is made, the eNB sends Sv during the Request for Resource in step (5). The
a SR-VCC HO request to the MME. STN-SR is static and is given to the UE during service
provisioning. Within the IMS, an application (SCC:
4. The MME can distinguish between the voice and non- Service Centralization and Continuity) maps the STN-
voice bearers and signals to the enhanced MSC SR to an ongoing IMS voice session.
Server to reserve CS resources. This signaling is over
the Sv interface.
5. If there is an ongoing non-voice session, it can be
optionally handed over through the SGSN.
6. The MSC-Server and the SGSN will contact the target
RAN (e.g., Dual Transfer Mode GERAN) to make
resource reservations and confirm the successful
outcome to the MME.
226
SR-VCC Call Flow (continued)

UTRAN
GERAN IMS
MME MSC Server SGSN
UE 1 eNB
with SR-VCC
Measurement Reports
2 HO DECISION
3 (SR-VCC) HO Required 4
5
Request Resources for CS
Splits between voice and
non-voice PS bearers Request Resources for PS
7
6 ‘RR Ok’ Begin Session Transfer [STN-SR id]
8
Handover Command (target RAN info)
9 IMS Session Transfer
HO Execution
10
UE changes RAT New Voice path
11
Voice
8. After step 6, the MME sends the Handover Command How long does this process take and can it satisfy the low
to the UE. This message carries target cell specific delay requirements for a real time service such as voice?
information for speedier access. Analysis of messaging delays together with simulation
results indicate that from the moment when the Session
9. The IMS network will know which session needs to be
Transfer is requested in step (7) to the moment (11) when
transferred to the MSC (more accurately MGW) based
the voice path is actually switched, can take around a
on the STN-SR.
100ms. This is an acceptable delay for voice applications.
10. Handover execution procedures are carried out in the
usual manner (10). The new voice path is now
through the MGW associated with the SR-VCC
enhanced MSC-server and the target RAN.
11. The handover is complete.
Please note that the message names shown here are
generic. Refer to the 3GPP technical specification for
exact message name and contents.
227
IMS Service
Centralization and
Continuity
228
IMS Service Centralization and

Continuity
IMS
Centralized Services
ICS Enhanced Legacy MSC

MSC (or enhanced)
EGPRS EGPRS WLAN LTE

GSM UMTS/ 1x
Legacy UE ICS UE ICS UE ICS UE

CS Voice CS Voice PS VoIP PS VoIP
+QoS
Service Continuity
An important goal of IMS is to provide continuity in service

across different access networks. This is achieved in
principle by IMS Centralized Services (ICS). One goal of
ICS is to enable IMS services when using CS access for
media bearer. For consistency in services, IMS must
therefore provide service continuity between the PS and
CS domains as well as multiple access technologies. This
implies that the subscriber services can be maintained
seamlessly when the user moves between different
access technologies and uses CS and/or PS domains.
There are two fundamentally different approaches for
realizing the goals of service continuity. One approach is
based on new functionalities in the UE and the second
approach is compatible with legacy UEs and uses new
functional elements in the MSC Servers. Our focus will be
on the latter approach which minimizes impact on the
handset side. Because voice is a key service for operators,
the first service continuity efforts were put on VCC.
Recently, the IMS Service Continuity standardization effort
has expanded to include any type of service such as
multimedia services and Rich IP services.
229
ICS/ISC Architecture
Acting 3PCC
PSTN
GSM SCC AS CS
MGC MGC
UMTS
CSCF
LTE HSS PS
P-CSCF
WiFi
IMS with Service

Access leg Remote leg
Centralization and Continuity
An important goal of ICS (IMS Centralized Services) is to remote leg, or when the initial access leg is remove. In
enable IMS services when using CS access as well as the other words, the SCC AS appears as a Third Party Call
normal PS access. In order to do that, ICS defines a Control Entity (3PCC) between the UE and the remote leg
signaling mechanism between the UE and IMS for the service.
transport of all of the necessary information for service
continuity (ISC = IMS Service Continuity) across different
network types and domains (CS or PS).
The central functionality which provides service
centralization and continuity is the SCC AS (Service
Centralization and Continuity Application Server). This
application node is defined for ICS/ISC as part of the IMS
domain. When a session is established, whether from a
CS access or PS access domain, the session will be
anchored at the SCC AS. This allows the SCC AS to
correlate different call legs before and after mobility.
Besides anchoring the session, the SCC AS is responsible
for session transfers between different access networks
(hence the notion of ‘Application Level Handover’). Since
the SCC AS is the anchor for the session, it will associate
the Access Leg with the Remote Leg.
A session transfer can occur when user mobility causes
change in the access leg, or when the UE adds a new
230
IMS-Based HO Mechanism
IMS
2 Do MSC+ICS
HO
4
CSCF
GERAN
6
3
UE 5
1 AL
RL
EPC
E-UTRAN
MGW SCC AS
MGCF
Voice Signaling
Before
PSTN
After
Remote ISDN Phone

1. The mechanism for IMS-based voice call transfer is

depicted in this diagram. During the initial session
setup, a PS path has been created through the E-
UTRAN, EPC, IMS and from there to the PSTN (the
path after MGW is obviously not PS-based). The
signaling (SIP based) path on the other hand is
anchored at SCC AS, where the path is split to an
Access Leg (AL) and a Remote Leg (RL).
2. Unlike the other inter-RAT handover mechanisms (like
SR-VCC), it is the UE that makes the handover
decision. This decision can be based on radio
conditions, as well operator defined policies. For
example, the operator can set the GSM-GERAN CS
priority as higher for voice calls compared to LTE-E-
UTRAN and for LTE PS to be higher than WLAN. In this
scenario, the mobile device is assumed to be capable
of transmitting and receiving simultaneously in
multiple access networks. This will clearly provide an
advantage in reducing delays during the handover
procedure, however the IMS Service Continuity
specifications do not require this as a mandatory
capability for the UE.
231
IMS-Based HO Mechanism (continued)

IMS
2 Do MSC+ICS
HO
4
CSCF
GERAN
6
3
UE 5
1 AL
RL
EPC
E-UTRAN
MGW SCC AS
MGCF
Voice Signaling
Before
PSTN
After
Remote ISDN Phone

3. After the handover decision is made, the UE will send If there are other media present besides the voice on the
a CS call setup message to the enhanced MSC original path over PS (E-UTRAN), they would have been
Server. This message carries a Session Transfer either released after the voice portion is transferred to
Number (STN) which will be used in the ensuing GERAN CS or they would have continued over the E-
signaling to the SCC AS for identifying the session UTRAN path. This is possible if (as we assumed) the UE is
which is going to be transferred from the PS domain capable to maintain simultaneous multi-RAT connections.
to the CS domain. STN is statically configured in the
UE (e.g., at provisioning time).
4.,5. Since the MSC is enhanced with IMS Service
Continuity function, upon receiving the Setup
message with the STN, it will create a SIP INVITE
message to the SCC AS (via CSCF) and the SCC AS
will send a REINVITE message to the MGCF.
6. The MGCF will command the MGW to update and
transfer the media to the MSC (with ICS). Note that
the voice media path has changed on the access leg
and remains the same on the remote leg.
232
Support for SMS
233
SMS Interworking via MSC and MME

Control Plane SMS Solution
Example: UE-originated SMS in idle mode
EPC UMTS/GSM
SGs CS Core
UE 1. Service Request Interface
E-UTRAN
3. Forwarding
2. SMS via NAS Signaling
MME of SMS
MSC
Supported SMS Scenarios Server
• UE-originated and UE-terminated SMS in idle mode
• UE-originated and UE-terminated SMS in connected mode
(direct use of existing NAS signaling: no service
request/paging)
It is possible to use the LTE E-UTRAN and LTE EPC along

with the legacy CS core network to take care of SMS. In
such cases, the MME needs to support the SGs interface
with an MSC server. The UE includes the SMS inside a
NAS signaling message. UE-originated and UE-terminated
SMSs are both possible. SMS is supported in both the idle
and connected modes. Of course, if the UE is in the idle
mode, we need to first establish connectivity between the
UE and the E-UTRAN and between the UE and the MME.
The UE needs to send a service request message to the
MME. For a UE-terminated SMS, a page message would
be sent to the UE to get the UE out of the idle mode. If the
UE is in the dedicated mode, the UE already has all the
links established. This will remove any extra service
request/paging type signaling exchanges. The UE can
directly place an SMS in a NAS signaling message.
234
SMS using IMS

User Plane SMS Solution
Example: UE-originated SMS
Prerequisite: Registration by IP-SM-GW (ex: AS) with HSS
3. Processing of SMS
UE IMS
1. SMS in a 2. SMS
CSCF IP-SM-GW
SIP message
Protocol interworking
vnd.3GPP.sms payload
between SC and SM-over-IP
contains SMS and
sender/receiver
routing information for
IP-SM-GW
The IMS is a service delivery platform that facilitates the

offering of a variety of IP-based services. While VoIP is
expected to be a popular IMS application, SMS can be
another attractive application that can be handled using
the IMS. In the case of applications such as VoIP calls, the
CSCF does not get involved in any “user traffic” like
speech. The UE needs to implement the functions of an
SM-over-IP sender and an SM-over-IP receiver. Features
such as status reports, delivery reports, and notification of
memory availability are also supported. The IMS core
network performs functions of an IP-SM-GW. Both UE-
originated and UE-terminated SMSs are supported. The
actual SMS is carried as a "vnd.3gpp.sms" payload in a
SIP MESSAGE request. An Application Server (AS) can act
as an IP-SM-GW (IP Short Message Gateway). For a
receiver to get the SMS, the receiver needs to do IMS
registration and indicate its capability to receive traditional
short messages over the IMS network by providing a
"+g.3gpp.smsip" parameter into the Contact header of the
registration request message.
235
Summary
• LTE supports voice only on PS bearers, and will have a
relatively small footprint initially.
• Three likely scenarios for CS interworking are proposed:
CS Fallback, SR-VCC and IMS application-based.
• IMS is a service enabler in 3GPP, and in R8 it can support
Service Centralization and Service Continuity for PS and
CS networks.
• CSFB does not use the IMS; SR-VCC and ICS/ISC require
the IMS.
• Dual radio capability can improve CS handover
performance but it is not a device requirement.
• The C-plane SMS solution uses MME, MSC, and SGs
interface, while the U-plane SMS solution uses IMS.
236
Review Questions
1. Name two solutions for voice interworking
between LTE and other 3GPP-based networks.
2. IMS supports access to PS services only. (T/F)
3. In SR-VCC HO, all PS connections must be
handed over or dropped altogether. (T/F)
4. CS Fallback can be used to handoff an ongoing
voice call. (T/F)
5. What is the role of the SCC AS in ICS?
237
238
Acronyms
1xEV-DO 1x Evolution for Data Optimized

1xRTT 1x Radio Transmission Technology
2G Second Generation Wireless Systems
3G Third Generation Wireless Systems
3GPP Third Generation Partnership Project
3GPP2 Third Generation Partnership Project 2
3PCC Third Party Call Control Entity
4G Fourth Generation Wireless Systems
AAA Authentication, Authorization and Accounting
ACK Acknowledge or Acknowledgement
ACM Address Complete Message
AF Application Function
AGCH Access Grant Channel
AI Acquisition Indication
AIN Advanced Intelligent Network
AKA Authentication and Key Agreement
AL Access Leg
AM Acknowledged Mode
AMBR Aggregate Maximum Bit Rate
ANM Answer Message
AP Access Point
API Application Programming Interface
APN Access Point Name
ARFCN Absolute Radio Frequency Channel Number
ARP Allocation and Retention Priority
AS Application Server
ASME Access Security Management Entity
ASN Access Service Network
ASN-GW Access Service Network Gateway
ATM Asynchronous Transfer Mode
AuC Authentication Center
AVP Attribute Value Pair
BC Bearer Context
BCCH Broadcast Control Channel
BER Bit Error Rate
BGCF Breakout Gateway Control Function
BLER Block Error Rate
BS Base Station
BSC Base Station Controller
BSIC Base Station Identification Code
BSS Base Station Subsystem
239
Acronyms
BSSGP BSS GPRS Protocol

BTS Base Transceiver Station
CAMEL Customized Applications for Mobile Enhanced Logic
CCCH Common Control Channel
CCN Cell Change Notification
CCO Cell Change Order
CDMA Code Division Multiple Access
CDR Call Data Record
CID Cell Identifier
CK Ciphering Key
CM Connection Management
CN Core Network
CoMP Coordinated Multipoint
CPICH Common Pilot Channel
CS Circuit-Switched
CSCF Call Session Control Function
CS-CN Circuit Switched Core Network
CSFB Circuit-Switched Fallback
CSG Closed Subscriber Group
dB Decibel
dBm Decibel per Milliwatt
DHCP Dynamic Host Configuration Protocol
DL Downlink
DNS Domain Name System
DRX Discontinuous Reception
DSCP Differentiated Services Code Point
DTM Dual Transfer Mode
E911 Enhanced 911
Ec/Io Energy per Chip over Interface
EDGE Enhanced Data Rates for Global Evolution
EF Expedited Forwarding
EGPRS Enhanced GPRS
EHPLMN Equivalent Home PLMN
EMM EPS Mobility Management
eNB Evolved NodeB or E-UTRAN NodeB
EPC Evolved Packet Core
ePDG Evolved Packet Data Gateway
EPS Evolved Packet System
E-RAB Evolved Radio Access Bearer
ESM EPS Session Management
E-UTRA Evolved Universal Terrestrial Radio Access or Evolved UMTS Terrestrial Radio Access
240
Acronyms
E-UTRAN Evolved Universal Terrestrial Radio Access Network or Evolved UMTS Terrestrial Radio
Access Network
EV-DO Evolution for Data Optimized
FDD Frequency Division Duplex
FER Frame Error Rate
FMC Fixed Mobile Convergence
GBR Guaranteed Bit Rate
GERAN GSM/EDGE Radio Access Network
GGSN Gateway GPRS Support Node
GMLC Gateway Mobile Location Center
GMM GPRS Mobility Management
GMSC Gateway Mobile Switching Center
GPRS General Packet Radio Service
GSM Global System for Mobile Communications
GSN GPRS Support Node
GTP GPRS Tunneling Protocol
GTP-C GPRS Tunneling Protocol Control Plane
GTP-U GPRS Tunneling Protocol User Plane
GUMMEI Globally Unique MME Identifier
GUTI Globally Unique Temporary Identity
GW Gateway
HA Home Agent
HARQ Hybrid ARQ
HLR Home Location Register
HO Handover
HPLMN Home PLMN
HSDPA High Speed Downlink Packet Access
HSPA High Speed Packet Access
HSPA+ High Speed Packet Access Evolved
HSS Home Subscriber Server
HSUPA High Speed Uplink Packet Access
IAM Initial Address Message
ICS IMS Centralized Services
I-CSCF Interrogating CSCF
IE Information Element
IETF Internet Engineering Task Force
IF Inter-Frequency
IK Integrity Key
IM Instant Messaging
IMEI International Mobile Equipment Identity
IMS IP Multimedia Subsystem
241
Acronyms
IMSI International Mobile Subscriber Identity

IN Intelligent Networks
IP Internet Protocol
IPsec Internet Protocol Security
IPv4 Internet Protocol version 4
IPv6 Internet Protocol version 6
IRAT Inter Radio Access Technology
IS Interim Standard
ISC IMS Service Continuity
ISDN Integrated Services Digital Network
ISIM IP Multimedia Services Identity Module
ISR Idle-State Signaling Reduction
ISUP ISDN Signaling User Part
ITU International Telecommunication Union
Iu-CS Iu Circuit Switched
km/h Kilometers per Hour
KSI Key Set Identifier
L3 Layer 3 (network layer)
LA Location Area
LAC Location Area Code
LAI Location Area Identity
LAN Local Area Network
LCS Location Services
LLC Logical Link Control
LRF Location Retrieval Function
LTE Long Term Evolution
LU Location Update
MAC Message Authentication Code
MAP Mobile Application Protocol
MBMS Multimedia Broadcast Multicast Service
MBR Maximum Bit Rate
MCC Mobile Country Code
MCS Modulation and Coding Scheme
ME Mobile Equipment
MGC Media Gateway Controller
MGCF Media Gateway Control Function
MGL Measurement Gap Length
MGRP Measurement Gap Repetition Period
MGW Media Gateway
MHz Megahertz
MIB Master Information Block
242
Acronyms
MIMO Multiple Input Multiple Output

MIP Mobile IP
MM Mobility Management
MME Mobility Management Entity
MMEC Mobility Management Entity Code
MMEGI Mobility Management Entity Group Identity
MMEI Mobility Management Entity Identifier
MNC Mobile Network Code
MO Mobile Originated
MS Mobile Station
MSC Mobile Switching Center
MSC-S Mobile Switching Center Server
MSISDN Mobile Station International ISDN Number
MT Mobile Terminal
NACC Network Assisted Cell Change
NAS Non-Access Stratum
NC Network Controlled
NRI Routing Area Identity (RAI) Network Resource ID
NSAPI Network layer Service Access Point Identifier
OEP Other End Party
OFDM Orthogonal Frequency Division Multiplexing
OTA Over-the-Air
P Provider node
PACCH Packet Associated Control Channel
PCC Policy and Charging Control
PCEF Policy and Charging Enforcement Function
PCH Paging Channel
PCM Pulse Code Modulation
PCO Protocol Configuration Option
PCRF Policy and Charging Rules Function
P-CSCF Proxy-CSCF
PDB Packet Delay Budget
PDCH Packet Data Channel
PDCP Packet Data Convergence Protocol
PDG Packet Data Gateway
PDN Packet Data Network
PDN-GW PDN Gateway
PDP Packet Data Protocol
PDSN Packet Data Serving Node
PDU Protocol Data Unit
P-GW Packet Data Network Gateway
243
Acronyms
PLMN Public Land Mobile Network

PLR Packet Loss Rate
PMIP Proxy MIP
PS Packet-Switched
PSAP Public Safety Answering Point
PS-CN Packet Switched Core Network
PSTN Public Switched Telephone Network
P-TMSI Packet TMSI (Temporary Mobile Subscriber Identity)
PTP Point to Point
QCI QoS Class Identifier
QoS Quality of Service
R99 Release 99
RA Routing Area
RAB Radio Access Bearer
RAC Routing Area Code
RACH Random Access Channel
RAI Routing Area Identity
RAN Radio Access Network
RANAP Radio Access Network Application Part
RAT Radio Access Technology
RAU Routing Area Update
RF Radio Frequency
RFSP RAT/Frequency Selection Priority'
RIM Radio Information Management
RL Remote Leg
RLC Radio Link Control
RNC Radio Network Controller
RNS Radio Network Subsystem
RNTI Radio Network Temporary Identity
RR Radio Resources
RRC Radio Resource Control
RRM Radio Resource Management
RSCP Received Signal Code Power
RSRP Reference Signal Received Power
RSRQ Reference Signal Received Quality
RSSI Received Signal Strength Indicator
S1-U S1 - User Plane
SACCH Slow Associated Control Channel
SAP Service Access Point
SAPI Service Access Point Identifier
SCC Service Centralization and Continuity
244
Acronyms
SCS Service Capability Server

S-CSCF Serving CSCF
SCTP Stream Control Transmission Protocol
SDCCH Standalone Dedicated Control Channel
SDF Service Data Flow
SDP Session Description Protocol
SDU Service Data Unit
SF Subframe
SGsAP SGs Application Protocol
SGSN Serving GPRS Support Node
S-GW Serving Gateway
SI System Information
SIB System Information Block
SIM Subscriber Identity Module
SIP Session Initiation Protocol
SMLC Serving Mobile Location Center
SMS Short Message Service
SPR Subscription Profile Repository
SR Scheduling Request
SR Sender Report
SRNC Serving Radio Network Controller
SRNS Serving RNS
SR-VCC Single Radio Voice Call Continuity
SS Supplementary Service
SS7 Signaling System 7
STN Session Transfer Number
TA Tracking Area
TAC Tracking Area Code
TAI Tracking Area Identifier
TAU Tracking Area Update
TBF Temporary Block Flow
TCAP Transaction Capabilities Application Part
TCP Transmission Control Protocol
TDD Time Division Duplex
TDM Time Division Multiplex(ing)
TDMA Time Division Multiple Access
TEID Tunnel Endpoint Identifier
TFT Traffic Flow Template
TGL Transmission Gap Length
TGPL Transmission Gap Pattern Length
TIN ID Used in Next Update
245
Acronyms
TLDN Temporary Local Directory Number

TLLI Temporary Logical Link Identifier
TMSI Temporary Mobile Subscriber Identity
TS Technical Specification
TTT Time to Trigger
UDP User Datagram Protocol
UE User Equipment
UICC Universal Integrated Circuit Card
UL Uplink
UM Unacknowledged Mode
UMA Unlicensed Mobile Access
UMTS Universal Mobile Telecommunications System
URA UTRAN Registration Area
URI Uniform Resource Identifier
USIM UMTS Subscriber Identity Module
UTRA Universal Terrestrial Radio Access or UMTS Terrestrial Radio Access
UTRAN Universal Terrestrial Radio Access Network or UMTS Terrestrial Radio Access Network
VCC Voice Call Continuity
VLR Visitor Location Register
VoIP Voice over Internet Protocol
VoLTE Voice over LTE
WAG WLAN Access Gateway
WCDMA Wideband Code Division Multiple Access
Wi-Fi Wireless Fidelity
WiMAX Worldwide Interoperability for Microwave Access
WIN Wireless Intelligent Network
WLAN Wireless Local Area Networks
246
References
Standards
1. 23.401 – General Packet Radio Service (GPRS) enhancements for Evolved Universal Terrestrial Radio Access
Network (E-UTRAN) access
2. 36.300 – E-UTRA and E-UTRAN Overall Description (Stage 2)
3. 36.331 - Evolved Universal Terrestrial Radio Access (E-UTRA) Radio Resource Control (RRC)
4. 36.211-36.214: Physical Layer related documents
5. 23.060 – General Packet Radio Service (GPRS); Service description (Stage 2)
6. 29.274 – Tunnelling Protocol for Control plane (GTPv2-C); (Stage 3)
7. 29.272 – Mobility Management Entity (MME) and Serving GPRS Support Node (SGSN) related interfaces based
on Diameter protocol
8. 29.060 – GPRS Tunneling Protocol (GTP) across the Gn and Gp interface
9. 24.301 – Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); (Stage 3)
10. 3GPP TS 44.018 V8.6.0 (RRC)
11. 3GPP TS 23.003 V8.4.0 (Numbering, Addressing and Identification)
12. 3GPP TS 23.401 V8.4.1 (GPRS Enhancements for E-UTRAN Access)
13. 3GPP TS 25.331 V8.6.0 (RRC)
14. 3GPP TS 36.133 V8.5.0 (Requirements for RRM)
16. 3GPP TS 45.008 V8.2.0 (RAN Radio Link Control)
17. 3GPP TS 24.301 V8.0.0 (UE-NAS Signaling)
18. 3GPP TS 36.413 V8.4.0 (S1-AP)
19. 3GPP TS 23.060 V8.4.0 (GPRS Service Description)
20. 3GPP TS 36.300 V8.8.0 (E-UTRAN Overall Description)
21. 3GPP TS 36.304 V8.5.0 (UE Procedures in Idle Mode)
22. 3GPP TS 25.304 V8.5.0 (UE Procedures in Idle Mode)
23. 3GPP TS 43.022 V8.1.0 (MS in Idle Mode and Group Receive Mode)
24. 3GPP TS 23.003 V8.4.0 (Numbering, Addressing and Identification)
27. 3GPP TS 45.008 V8.2.0 (RAN Radio Link Control)
28. 3GPP TS 23.002 V8.3.0 (Network Architecture)
29. 3GPP TS 23.272 V8.3.0 (Circuit Switched Fallback in EPS)
30. 3GPP TS 23.216 V8.3.0 (Single Radio Voice Call Continuity)
31. 3GPP TS 29.280 V8.1.0 (Sv Interface)
32. 3GPP TS 29.118 V8.1.0 (SGs Interface)
33. 3GPP TS 23.292 V8.3.0 (IMS Centralized Services)
34. 3GPP TS 23.279 V8.1.0 (CS and IMS Services)
35. 3GPP TS 23.228 V8.6.0 (IMS)
36. 3GPP TS 23.206 V7.5.0 (VCC)
247

LTE and GSM UMTS Interworking Award Solutions PDF

Загружено:

Сведения о документе

Оригинальное название

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

LTE and GSM UMTS Interworking Award Solutions PDF

Загружено:

Авторское право:

Доступные форматы

LTE and

Award Solutions, Inc. www.awardsolutions.com +1-972-664-0727

© 2012 Award Solutions, Inc.

Knowledge Services Consulting Services: Our goal is to help our

Award Solutions, Inc. www.awardsolutions.com +1.972.664.0727 v13.1

Technology for Business IP Convergence & IMS

Award Solutions, Inc. www.awardsolutions.com +1.972.664.0727 v13.1

(e) eLearning Course

Award Solutions, Inc. www.awardsolutions.com +1.972.664.0727 v13.1

Interworking - Executive Summary ................................................................................................................ 1

Interworking Architecture ................................................................................................................................ 7

Examples of Interworking Scenarios ............................................................................................................ 13

Interworking Network Architecture ............................................................................................................. 19

Network Architectures and Interfaces .......................................................................................................... 21

UMTS and GSM/EDGE Architecture ............................................................................................................. 30

Interfaces and Protocols ............................................................................................................................... 35

Network Identities .......................................................................................................................................... 44

Initial Session Setup ..................................................................................................................................... 49

LTE Attach and Default Bearer Setup........................................................................................................... 51

UMTS/EDGE PDP Context Establishment .................................................................................................... 65

Connected-Mode Interworking ..................................................................................................................... 83

LTE Measurement Procedure ....................................................................................................................... 87

UMTS Measurement Procedure.................................................................................................................... 96

Handover Examples -- S4 SGSN ............................................................................................................... 104

LTE_304 Version 1.7 i

LTE-to-UTRAN Handover (S4-SGSN) ........................................................................................................... 115

LTE-to-UTRAN Pre-R8 (Gn SGSN) ................................................................................................................ 122

UTRAN-to-LTE (Gn SGSN) ............................................................................................................................ 125

E-UTRAN-GERAN Handover ......................................................................................................................... 132

Additional Material ...................................................................................................................................... 137

GERAN <-> LTE IRAT Examples ................................................................................................................... 139

LTE-to-GERAN CCO + NACC ......................................................................................................................... 143

GERAN-to-LTE PS Handover ........................................................................................................................ 145

Device States and IRAT Mobility Procedures ............................................................................................. 153

Idle-Mode Interworking ................................................................................................................................ 160

IRAT Cell (Re)selection ................................................................................................................................ 170

LA/TA Updates ............................................................................................................................................. 180

Idle-State Signaling Reduction (ISR) .......................................................................................................... 188

Combined LAU/TAU ..................................................................................................................................... 191

Additional Information: PLMN Selection .................................................................................................... 195

Voice in LTE .................................................................................................................................................. 203

IMS Overview................................................................................................................................................ 205

SR-VCC .......................................................................................................................................................... 222

IMS Service Centralization and Continuity ................................................................................................. 228

Support for SMS........................................................................................................................................... 233

Award Solutions Proprietary

Award Solutions Proprietary

Evolution, Goals and

Award Solutions Proprietary

3GPP Evolution: Toward LTE-Advanced

2G/3G Architecture Attributes

2G and 3G networks have two types of core networks, a

LTE Architecture Attributes

Award Solutions Proprietary

Inter-PLMN Support for

Two Interworking Options

• SGSN is upgraded with R8 • SGSN – No Change

UTRAN/GSM Radio Network upgrade for LTE measurements

Award Solutions Proprietary

Two Interworking Options (continued)

• SGSN is upgraded with R8 • SGSN – No Change

UTRAN/GSM Radio Network upgrade for LTE measurements

Award Solutions Proprietary