Content

Layer3 Message Analysis

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

AMR CS Call Phases

BTS

UE

DRNC

SRNC

1. Cell search, BCCH decoding &

RACH access
2. RRC Connection Setup
3. UE <-> CS-CN signalling
4. RAB Set-up
5. UE <-> CS-CN signalling
6. Service Established
7. Branch addition/deletion & active set update
8. Service Released

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

CN

RRC Connection Set-up Signalling Flow

UE

WBTS

RNC

RRC: RRC CONNECTION REQUEST (RACH)

Admission
Control
NBAP: RADIO LINK SETUP
REQUEST
NBAP: RADIO LINK SETUP
RESPONSE
ALCAP:
ERQ
ALCAP:
ECF
FP Downlink
Sync
FP Uplink
Sync
RRC: RRC CONNECTION SETUP (FACH)
L1 Sync
NBAP: SYNCH INDICATION
RRC: CONNECTION SETUP COMPLETE (DCH)

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

UE<> CS_CN signalling

Location Update
Authentication
Security Mode Setup
Paging
Call Setup

Re
pdate

t
ques

etup
S
e
d
U
o
ation
rity M
c
u
o
c
L
e
S
1.
n and
o
i
t
a
c
henti
t
u
A
pt
2.
Acce
e
t
a
pd
on U
i
t
a
c
3. Lo
aging
P
.
4
5.

MSC / VLR

et up
S
l
l
a
C

U
E

RNC

MGW

WBTS
Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

PS Call Phase
BTS

UE

DRNC

CN

SRNC

1. Cell search, BCCH

decoding & RACH access
2. RRC Connection Setup
3. GPRS Attach
4. RAB Set-up
5. UE <-> PS-CN signalling (PDP context activation Accept)
6. Radio Bearer Reconfiguration
7. PS Data Session Established
8. State Transitions
9. Branch addition/deletion & active set update
10. PS Data Session Released

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

GPRS Attach

UE performs cell search and RRC Connection Establishment in the same way as for an
AMR call
The UE registers with the PS-CN through the GPRS Attach procedure

UE

Node B

RNC

SGSN

RRC Connection
Initial Direct Transfer: GPRS Attach Request (DCH)

SCCP: Connection Request

Initial UE message : GPRS Attach Request
SCCP: Connection Confirm

Downlink Direct Transfer: Authentication and Ciphering Request

Direct
(DCH)
Transfer: Authentication and Ciphering Request
Uplink Direct Transfer: Authenication and Ciphering Response (DCH)

Direct Transfer: Authentication and Ciphering Response

Security Mode Command (DCH)

Security Mode Command

Secuirty Mode Complete (DCH)

Downlink Direct Transfer: Common ID (DCH)
Uplink Direct Transfer: Identity Response (DCH)

Direct Transfer: Identity Response

Downlink Direct Transfer: Location Attach Accept (DCH)

Uplink Direct Transfer: Attach Complete (DCH)

Copyright All rights reserved

Common ID
Direct Transfer: Identity Request

Direct Transfer: Attach Accept

Direct Transfer: Attach Complete

TECHCOM Consulting

TA -TC 6250 E01

PDP Context

UE

Node B

SGSN

RNC
GPRS Attach

Uplink Direct Transfer : Activate PDP context request (DCH)

Direct Transfer : Activate PDP context request

RANAP: RAB Assignment Request
RRC: Radio Bearer Setup

Radio Bearer Setup Complete

RAB Assignment Response
Measurement Control
Measurement Control
Downlink Direct Transfer : Activate PDP Context Accept (DCH)
Direct Transfer: Activate PDP Context Accept
Call Established

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

Radio Bearer Setup/Complete & RAB Assignment Response

Once the RANAP: RAB Assignment Request message has been received from PS CN
and RNC has resources to setup the 0/0 kbps RB the RNC sends a RRC: Radio Bearer
Setup message to the UE
The UE acknowledges the RRC: Radio Bearer Setup message with a RRC: Radio Bearer
Setup Complete message
Once the radio bearer establishment has been acknowledged, the RNC indicates to the
PS core that the RAB has been established using the RANAP: RAB Assignment
Response message

UE

Node B

SGSN

RNC
GPRS Attach

Uplink Direct Transfer : Activate PDP context request (DCH)

Direct Transfer : Activate PDP context request

RANAP: RAB Assignment Request
RRC: Radio Bearer Setup

Radio Bearer Setup Complete

RAB Assignment Response

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

Radio Bearer Reconfiguration

UE

Node B

SGSN

RNC
GPRS Attach

Uplink Direct Transfer : Activate PDP context request (DCH)

Direct Transfer : Activate PDP context request

RANAP: RAB Assignment Request
RRC: Radio Bearer Setup

Radio Bearer Setup Complete

RAB Assignment Response
Measurement Control
Measurement Control
Downlink Direct Transfer : Activate PDP Context Accept (DCH)
Direct Transfer: Activate PDP Context Accept
Call Established
Measurement Report : e4a
NBAP: Radio Link Reconfigure Prepare

Admission
Control

Radio Link Reconfigure Ready

AAL2SIG:ERQ
AAL2SIG:ECF
FP: Downlink Sync
FP: Uplink Sync
Radio Link Reconfiguration Commit
RRC: Radio Bearer Reconfiguration (DCH)
RRC: Radio Bearer Reconfiguration Complete (DCH)
Measurement Control

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

HSPA Setup

HSUPA cannot be established without HSDPA, HSDPA UL return channel is HSUPA

instead of R99
High level procedure is the same as that for an NRT DCH
RNC starts by allocation a 0/0kbps connection
Selection between DCH and E-DCH is then completed when RNC receives the uplink or
downlink capacity request

UE

Node B

RNC

SGSN

RRC Establishment
GPRS Attach
0/0 kbps
DCH
allocated

PDP Context Activation

Measurement Report : e4a
Uplink capacity request

RNC completes
channel type selection
procedure

HSUPA connection can be established

RRC Idle mode

directly from CELL_PCH (Cell Update with reason Uplink Capacity Request)

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

RRC Services
Broadcast services
Paging and Notification services
Dedicated Control services
Encapsulation of NAS signaling (CC, SM, MM, GMM, SMS)

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

RRC States

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

RRC Procedure

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

System Information
Within UTRAN system information is broadcasted with the help of the RRC messages
System Information,
Paging Type I, and
System Information Change Indication.
Most system information parameters are determined by the RNC. The Node B is informed about the parameters via
the NBAP message BCCH Information. Some system parameters can be made available by the Node B, such as
interference values, which change fast.
Given the system information, the UE is capable to decide, whether or how to access the PLMN via the existing cell.
System information is organised in System Information Blocks (SIBs).
System information is grouped into SIB 1 to SIB 18.
Each SIB is responsible to carry a specific content. For instance, SIB 12 holds measurement control
information and parameters.
Depending on the UEs RRC state, is reads specific SIBs, and uses the transmitted parameters.
There is a huge amount of SIBs, which have to be read by the UE. This requires a lot of battery power. Therefore, a
Master Information Block (MIB) was introduced, which gives references and scheduling information about the SIBs.
The MIB is transmitted in every 8th radio frame on the P-CCPCH (on position SFN mod 8 = 0, and with a TTI of 20
ms). For most of the SIBs used within the system, the MIB may carry a value tag. The only exceptions are SIB 15.2,
SIB 15.3 and SIB 16. If a value tag is unchanged, the corresponding system information has not been modified.
Thus, there is no need for the UE to read the SIB. SIB 7 has no value tag. It changes with each occurrence.
Scheduling information is used to inform the UE, where and when a specific system information is transmitted.

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

System Information
UTRAN

System Information ( )

NBAP: BCCH Information

RNC

UE

Node B

TS
TS25.433:
25.433:NBAP
NBAP

8.2.16
8.2.16System
SystemInformation
InformationUpdate
Update

MIB
value tag M
MIB: Master Information Block
SIB: System Information Block
SFN: System Frame Number

SIB 1
value tag 1

Copyright All rights reserved

position on P-CCPCH: SFN mod 8* = 0

TTI: 20 ms
value tag M: range 1..8

SB
value tag N

SIB 2
value tag 2

SIB 3
value tag 3

TECHCOM Consulting

SIB 18
value tag 18

TA -TC 6250 E01

System Information Blocks

For each SIB, following characteristics were specified:
Area scope: Where is the value tag valid: within one cell or within a PLMN/ equivalent PLMN?
UE RRC state: When the SIB is valid?
UE RRC state: When the SIB is read?
Scheduling information: At which position is the SIB transmitted and what is its repetition period?
Modification of system information: Is it indicated by a value tag, or is it timer based?
The UE receives all SIBs via the BCCH. There is only one exception: SIB 10. If a UE is capable to receive
simultaneously on one S-CCPCH and on one DPCH, then it receives SIB 10 on a FACH.
Master Information Block (MIB):
The MIB informs the UE about the supported PLMN types and the PLMN identity.
The UE finds in the MIB also references to up to maxSIB (=32) SIBs, including their scheduling information
and type.
A MIB is valid in one cell. If a UE changes the cell, is must read the new cells MIB.
The MIB is read in the RRC modes/states RRC idle, CELL_FACH, CELL_PCH and URA PCH.
Its parameter are valid in the same states.
A change of the MIB information is indicated by a value tag.
In this course documentation, we only describe the System Information Blocks (SIBs), which are used in NSNs
RAN, and SIB 4 and SIB16.

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

System Information Blocks

System Information Block 1 (SIB 1)
This SIB is used to inform the UE about NAS system information.
The NAS system information characterises the NAS domains.
SIB 1 also delivers UE timers and counters, which have to be used by the UE in the RRC idle and RRC
connected mode.
For instance, a UE in the RRC connected mode uses the timer T305 for periodic cell and URA updates.
SIB 1 is valid in one PLMN.
The MIB is read in the RRC modes/states RRC idle, CELL_FACH, CELL_PCH and URA PCH. Its parameter
are valid in the same states, and the the RRC sub-state CELL_DCH.
If the UE selects a new cell, and the SIB 1 value tag has the same number as in the preceding cell, the same
content is transmitted in this SIB. There is then no necessity for the UE to read this SIB after cell re-selection.
System Information Block 2 (SIB 2)
This SIB contains an URA identity list.
SIB 2 is read and valid in the RRC sub-state URA_PCH. A change of the SIB 2 information is indicated by a
value tag.
System Information Block 3 (SIB 3)
This SIB contains relevant parameters for cell selection and re-selection.
It also holds the cell identity and cell restriction data, such as cell barred IEs.
SIB 3 must be read and is valid in the RRC idle mode. It is read and valid in the RRC connected mode substates CELL_FACH, CELL_PCH and URA_PCH, if SIB 4 is not broadcasted.
A change of the SIB 3 information is indicated by a value tag.

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

System Information Blocks

System Information Block 4 (SIB 4)
This SIB holds mostly the same data fields as SIB 3*, but it is read and valid only, when the UE is in the RRC
connected mode. I.e, this optional SIB is read and valid in the CELL_FACH, CELL_PACH and URA_PCH substate.
A change of the SIB 4 information is indicated by a value tag.
System Information Block 5 (SIB 5)
The parameters for the configuration of physical channels are broadcasted in this SIB.
The parameters cover the PICH power offset, the AICH power offset, P-CCPCH, S-CCPCH and PRACH
system information lists.
SIB 5 must be read and is valid in the RRC idle mode.
It is read and valid in the RRC connected mode sub-states CELL_FACH, CELL_PCH and URA_PCH, if SIB 6
is not available.
A change of the SIB 5 information is indicated by a value tag.
System Information Block 7 (SIB 7)
This SIB holds fast changing parameters. Therefore no value tag is used for it.
The UE has to read its parameters periodically.
For that, an expiration timer (Expiration Time Factor) is broadcasted with this message.
SIB 7 expires at max(32, 8 * Expiration Time Factor).
Expiration Time Factor can have the values 2times, 4 times, 8 times ... 256 times. Its default value is 1.
The fast changing parameters transmitted with SIB 7 include the UL interference and dynamic persistence
level.
It is read and valid in all states except for the CELL_DCH sub-state.

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

System Information
SIB

broadcasted information

read

valid

scope/
modification

MIB

PLMN types & identities#

SIB Scheduling information
SIB references

RRC idle mode,

CELL_FACH, CELL_PCH,
URA_PCH

RRC idle mode,

CELL_FACH, CELL_PCH,
URA_PCH

cell/
value tag

SIB 1

NAS information
UE timers & counters

RRC idle mode,

CELL_FACH, CELL_PCH,
URA_PCH

RRC idle mode,

CELL_DCH, CELL_FACH,
CELL_PCH, URA_PCH

PLMN/
value tag

URA_PCH

URA_PCH

cell/
value tag

e.g. T305: Periodic Cell/URA Update

T301, 302, 304, 307-317

SIB 2

SIB 3*

URA identity list

Cell selection
and re-selection parameters
e.g. CPICH Ec/N0 or CPICH RSCP; Sintrasearch,
Sintersearch, Ssearch,RAT, Qqualmin, Qrxlevmin,..

SIB 4*

SIB 5*

Cell selection & reselection parameters for

UEs in the connected mode
Parameters for common
physical channel
configuration

RRC idle mode,

RRC idle mode,
(CELL_FACH, CELL_PCH, (CELL_FACH, CELL_PCH,
URA_PCH)
URA_PCH)

cell/
value tag

CELL_FACH, CELL_PCH,
URA_PCH

CELL_FACH, CELL_PCH,
URA_PCH

cell/
value tag

RRC idle mode,

(CELL_FACH,
CELL_PCH, URA_PCH)

RRC idle mode,

(CELL_FACH,
CELL_PCH, URA_PCH)

cell/
value tag

# GSM-MAP/ANSI41; MCC+MNC;
Copyright All rights reserved

+ Cell Access Restrictions

* Read SIB 3 / 5 in Connected Mode if SIB4 / 6 (Connected Mode) not available

TECHCOM Consulting
TA -TC 6250 E01

System Information Blocks

System Information Block 11 (SIB 11)
This SIB holds measurement control information.
The UE gets here the relevant date for traffic measurement, intra-frequency measurements, etc.
SIB 11 must be read and is valid in the RRC idle mode. It is read and valid in the RRC connected mode substates CELL_FACH, CELL_PCH and URA_PCH, if SIB 12 is not broadcasted.
It is also valid in the RRC sub-state CELL_DCH, as long as the UE did not get a Measurement Control
message from UTRAN and SIB 12 is not broadcasted.
A change of the SIB 11 information is indicated by a value tag.
System Information Block 12 (SIB 12)
SIB 12 transmits measurement control information for UEs in the RRC connected mode.
If not transmitted, the UEs take the parameters broadcasted with SIB 11.
If available, SIB 12 is read and valid in the RRC connected mode sub-states CELL_FACH, CELL_PCH and
URA_PCH.
It is also valid in the RRC sub-state CELL_DCH, as long as the UE did not get a Measurement Control
message from UTRAN. A change of the SIB 12 information is indicated by a value tag.
System Information Block 16 (SIB 16)
RB, TrCH, and PhyCH parameters are broadcasted, which are stored by the UE both in the RRC idle and RRC
connected mode.
The parameters are used during a handover to UTRAN. Consequently, these parameters stay valid, when the
UE is connected to GSM and GPRS.
This SIB is valid in all RRC states, and read in all RRC states except for the CELL_DCH. The UE reads and
stores the parameters. A change of the SIB 16 information is indicated by a value tag.

Copyright All rights reserved

TECHCOM Consulting

TA -TC 6250 E01

System Information Blocks

SIB

broadcasted information

read

valid

scope/
modification

SIB 7

Fast changing parameters:

UL interference level
Dynamic persistence level

RRC idle mode,

CELL_FACH, CELL_PCH,
URA_PCH

RRC idle mode,

CELL_FACH, CELL_PCH,
URA_PCH

cell/

SIB 11

Measurement control
information*

max(32, 8 * Expir-
ation Time Factor)

RRC idle mode,

RRC idle mode,
(CELL_FACH, CELL_PCH, (CELL_DCH, CELL_FACH,
URA_PCH)
CELL_PCH, URA_PCH)

cell/
value tag

SIB 12

Measurement control
information* for UEs in the
RRC connected mode

CELL_FACH, CELL_PCH,
URA_PCH

CELL_DCH, CELL_FACH,
CELL_PCH, URA_PCH

cell/
value tag

SIB 16

RB, TrCH, and PhyCH

parameters for a
GSM/GPRS-UMTS HO

RRC idle mode,

CELL_FACH, CELL_PCH,
URA_PCH

RRC idle mode,

CELL_FACH, CELL_PCH,
URA_PCH)

cell/
value tag

* e.g. FMCx & HOPx par.; Use of HCS; Ec/N0

orRSCP; Intra-, Inter-Frequency, Inter-RAT meas.
info; Traffic volume meas. Info (e.g. RLC buffer
payload)

Copyright All rights reserved

Examples of other SIBs:

SIB 13: ANSI-41 system information
SIB 14: Only for 3.84 Mcps TDD
SIB 15: useful for UE-based or UE-assisted positioning methods
SIB 17: only for TDD
SIB 18: contains PLMN identities of neighbouring cells to be
considered
in idle mode as well as in connected mode.
(adopted from TS 25.331 RRC)
TECHCOM Consulting

TA -TC 6250 E01