LTE Signaling & Protocol Focus On E-UTRAN and UE

LTE
Signaling & Protocol

Analysis
Focus: E-UTRAN and UE
INACON GmbH
Kriegsstrasse 154
76133 Karlsruhe
Germany
www.inacon.com
e-mail: inacon@inacon.de
Cover design by Stefan Kohler

1999 - 2010 INACON GmbH
Kriegsstrasse 154
76133 Karlsruhe
All rights reserved. No part of this publication may be reproduced, stored in a
retrieval system, or transmitted by any means, electronic, mechanical, photocopying,
recording, or otherwise, without written permission from the publisher. No patent
liability is assumed with respect to the use of the information contained herein.
Although every precaution has been taken in the preparation of this publication, the
publisher and authors assume no responsibility for errors or omissions. Neither is any
liability assumed for damages resulting from the use of the information contained
herein. For more information, contact INACON GmbH at www.inacon.com.
Legend:
All INACON publications use the same color codes to distinguish mandatory from
optional or conditional parts in frame formats or optional from mandatory data blocks
or signaling messages in scenarios. The different color codes are explained
underneath:
Color Codes in Frame Formats:
Color Codes in Scenarios:
Foreword of the Publisher:

Dear Reader:
Note that this book is primarily a training document because the primary business of
INACON GmbH is the training and consulting market for mobile communications. As
such, we are proud to providing high-end training courses to many clients worldwide,
among them operators like AT&T, Mobilkom Austria, SWISSCOM, T-MOBILE or
VSNL (India) and equipment suppliers like ALCATEL-LUCENT, ERICSSON and
SONY-ERICSSON, MOTOROLA, NOKIA-SIEMENS and RIM.
INACON GmbH is not one of the old-fashioned publishers. With respect to time-tomarket, form-factor, homogeneous quality over all books and most importantly with
respect to after-sales support, INACON GmbH is moving into a new direction.
Therefore, INACON GmbH does not leave you alone with your issues and this book
but we offer you to contact the author directly through e-mail (inacon@inacon.de), if
you have any questions. All our authors are employees of INACON GmbH and all of
them are proven experts in their area with usually many years of practical
experience.
The most important assets and features of the book in front of you are:
Extreme degree of detailed information about a certain technology.
Extensive and detailed index to allow instant access to information

about virtually every parameter, timer and detail of this technology.
Incorporation of several practical exercises.
If applicable, incorporation of examples from our practical field

experiences and real life recordings.
References to the respective standards and recommendations on

virtually every page.
Finally, we again like to congratulate you to the purchase of this book and we like to
wish you success in using it during your daily work.
Sincerely,
Gunnar Heine / President & CEO of INACON GmbH
Table of Content
Table of Content
Revisiting important Details of the EPS.................................1
1.1 Architecture Overview..............................................................2
1.1.1 Evolved Packet Core in Context..................................................2
1.1.1.1 EPC vs. EPS...................................................................................2
1.1.1.2 Non-3GPP Access Networks (trusted / non-trusted).......................3
1.1.2 Zoom into the EPS......................................................................4

1.1.2.1 Functional Overview of Core Network Elements within the EPC....5
1.1.3 Network Elements and their Functions within the EPC...............6

1.1.3.1 Mobility Management Entity (MME).................................................6
1.1.3.1.1 Characteristics........................................................................6
1.1.3.1.2 Identification............................................................................6
1.1.3.1.3 Interfaces & Protocols.............................................................8
1.1.3.1.4 Tasks & Functions of the MME.............................................10
1.1.3.1.4.1 NAS-Signaling towards the UE..................................................10
1.1.3.1.4.2 S1-Signaling towards the eNodeB.............................................10
1.1.3.1.4.3 S-GW and P-GW Selection........................................................12
1.1.3.1.4.4 Other Selection Functions..........................................................13
1.1.3.1.4.5 Local Breakout...........................................................................14
1.1.3.1.4.5 IMS and Local Breakout.............................................................14
1.1.3.2 Serving Gateway (S-GW)..............................................................16

1.1.3.2.1 Characteristics......................................................................16
1.1.3.2.2 Identification..........................................................................16
1.1.3.2.3 Interfaces & Protocols...........................................................18
1.1.3.2.4 Tasks & Functions of the S-GW............................................20
1.1.3.2.4.1 Packet Routing / Relaying..........................................................20
1.1.3.2.4.2 Legal Interception.......................................................................20
1.1.3.2.4.3 QCI-based Packet Tagging........................................................20
1.1.3.2.4.4 Accounting..................................................................................20
1.1.3.3 PDN Gateway (P-GW or PDN-GW)..............................................22

1.1.3.3.2 Identification..........................................................................22
1.1.3.3.4 Tasks & Functions of the P-GW............................................26
1.1.3.3.4.1 UE IP Address Allocation...........................................................26
1.1.3.3.4.2 QCI-based Packet Tagging........................................................26
1.1.3.3.4.3 Policy Enforcement....................................................................26
1.1.3.3.4.5 Home Agent Function.................................................................27
1.1.3.4 enhanced Packet Data Gateway (ePDG)......................................28

1.1.3.4.2 Identification..........................................................................28
1.1.3.4.4 Tasks & Functions of the ePDG............................................32
1.1.3.4.4.1 ESP-Tunnel Mgmt towards UE's................................................32
1.1.3.4.4.2 QoS-specific Packet Tagging in UL-Direction............................32
1.1.3.4.4.4 MAG-Function for PMIPv6.........................................................32
1.2 Protocol Stacks......................................................................34

1.2.1 Control Plane / E-UTRAN - EPC...............................................34
INACON GmbH 1999 - 2010. All rights reserved. Reproduction and/or unauthorized use of this material is prohibited
and will be prosecuted to the full extent of German and international laws. Version Number 1.200
-i-
LTE Signaling & Protocol Analysis (E-UTRAN and UE)

1.2.2 User Plane E-UTRAN EPC (S5/S8 GTP-based)....................36
1.2.3 User Plane E-UTRAN EPC (S5/S8 PMIPv6/GRE-based)......38
1.3 Security Architecture..............................................................40

1.3.1 Overview & Introduction............................................................40
1.3.1.1 Essentials......................................................................................41
1.3.1.2 EPS-AKA.......................................................................................41
1.3.1.3 Security is performed independently in two protocol layers..........41
1.3.1.4 Algorithms......................................................................................41
1.3.2 Operation of UMTS-AKA...........................................................42

1.3.3 Key Derivation Function (KDF)..................................................44
1.3.3.1 Comprehension Check & Practical Exercise:
The KDF S(10) for K(ASME).....................................................................46
1.3.3.1.1 Input Parameters..................................................................48
1.3.4 EPS-AKA in Operation during Initial Attach Procedure.............50

1.3.5 Use of the different Security Algorithms....................................52
The Non-Access-Stratum: EMM & ESM................................55

2.1.1 Important EMM-Procedures......................................................56
2.1.1.1 Common Procedures.....................................................................57
2.1.1.2 Specific Procedures.......................................................................57
2.1.1.3 Connection Management Procedures...........................................57
2.1.2 State Machine...........................................................................58

2.1.2.1 Relationship between EMM and ECM...........................................58
2.1.3 Network Operation Modes.........................................................60

2.1.4 Message Format.......................................................................62
2.1.4.1 Security Header.............................................................................62
2.1.5 Important EMM-Scenarios.........................................................64

2.1.5.1 Attachment through E-UTRAN / new MME...................................64
2.1.5.2 Comprehension Check & Practical Exercise: Building your own
EMM: ATT_REQ-Message........................................................................72
2.1.5.3 Tracking Area Update (Inter-MME / with new S-GW)....................76
2.1.5.3.1 Initial Conditions....................................................................76
2.1.5.3.2 Detailed Description..............................................................78
2.1.5.4 Comprehension Check & Practical Exercise: EMM-Message
Decode......................................................................................................84
2.2.1 Important ESM-Procedures.......................................................86

2.2.1.1 MME-initiated.................................................................................87
2.2.1.2 UE-initiated....................................................................................87
2.2.2 State Machine...........................................................................88

2.2.4 Message Format.......................................................................90
2.2.4.1 Security Header.............................................................................92
2.2.4.2 Procedure Transaction Identity......................................................92
2.3.5 Dedicated EPS Bearer Establishment.......................................94

2.3.5.1 Network Initiated (IMS triggered during Call Establishment) ........94
2.3.5.1.1 Initial Conditions....................................................................94
- ii -
Table of Content
Radio Resource Control.......................................................101
3.1 Overview..............................................................................102
3.1.1 Transmission of broadcast information...................................103
3.1.2 Establish and maintain services..............................................103
3.1.3 QoS control.............................................................................103
3.1.4 Transfer of dedicated control information................................103
3.2 State Characteristics of RRC...............................................104

3.2.1 RRC_IDLE..............................................................................104
3.2.2 RRC_CONNECTED................................................................104
3.3 Signaling Radio Bearers (SRB)............................................106

3.3.1 Overview.................................................................................106
3.3.1.1 SRB0...........................................................................................106
3.3.1.2 SRB1...........................................................................................106
3.3.1.3 SRB2...........................................................................................106
3.3.2 Mapping of RRC-Messages to SRB's and to Channels..........108

3.3.2.1 Messages on BCCH (MIB and SIB)............................................108
3.3.2.2 Messages on PCCH and DL-CCCH............................................110
3.3.2.3 Messages on DL-DCCH and DL-DTCH......................................112
3.3.2.4 Messages on UL-CCCH, UL-DCCH and UL-DTCH....................114
3.4 Message Encoding through ASN.1 PER-unaligned..............116

3.4.1 Example: The ASN.1-Code of RRC_CONN_REQ .................116
3.4.2 and the compiled Message Structure (Tree View)..............118
3.4.3 Important Encoding Rules of ASN.1 PER-unaligned...............120
3.4.3.1 Handling of optional IE's..............................................................120
3.4.3.2 Selection among Options (CHOICE / ENUMERATED)...............122
3.4.3.3 Handling of IE's with variable Length..........................................124
3.4.4 Comprehension Check & Practical Exercise:

Encoding an RRC_CONN_REQ-Message......................................126
3.5 RRC Procedures..................................................................128

3.5.1 System Information Broadcast................................................128
3.5.1.1 Overview......................................................................................128
3.5.1.2 Overview of Functions of the System Information Blocks...........130
3.5.1.3 Example of an MIB......................................................................132
3.5.1.4 Example of an SIB1.....................................................................134
3.5.1.5 Example of an SIB2.....................................................................136
3.5.1.6 Example of an SIB3.....................................................................138
3.5.2 Connection Management Related Procedures........................140

3.5.2.1 Paging Procedure........................................................................140
3.5.2.2 RRC Connection Establishment Procedure................................142
3.5.2.2.1 SRB1 Default Configuration................................................144
3.5.2.2.2 Physical Layer Default Configuration..................................146
3.5.2.3 UE Capability Transfer Procedure...............................................148
3.5.2.4 RRC Initial Security Activation Procedure...................................150
3.5.2.5 RRC Connection Reconfiguration Procedure..............................152
- iii -

3.5.2.5.1 SRB2 Default Configuration................................................154
3.5.2.6 Counter Check Procedure...........................................................156
3.5.2.7 RRC Connection Reestablishment Procedure............................158
3.5.2.8 RRC Connection Release Procedure..........................................160
3.5.3 Inter RAT RRC Procedures.....................................................162

3.5.4 E-UTRAN Measurements........................................................164
3.5.4.1 Overview......................................................................................164
3.5.4.2 Definition of Measurements in E-UTRAN....................................166
3.5.4.3 Measurement Events in E-UTRAN..............................................168
3.5.4.4 Measurement Definition in the Standard Measurement Object170
3.5.4.5 Measurement Definition in the Standard Report Configuration
and Measurement ID...............................................................................172
3.5.4.6 Structure Measurement Report...................................................174
3.5.5 Other RRC Procedures...........................................................176

3.5.6 RRC Procedure Delay.............................................................178
3.5.6.1 Introduction..................................................................................178
3.5.6.1 Values..........................................................................................180
3.5.7 Idle Mode Procedures Neighbor Cell Monitoring & Cell

Reselection......................................................................................182
3.5.7.1 Priority-Based Cell Reselection of Multi-RAT UE's.....................182
3.5.7.1.1 SPID - Subscriber Profile ID for RAT/Frequency priority....183
3.5.7.1.2 E-UTRAN priority-based Cell Reselection Details..............184
3.5.7.1.3 UTRAN priority-based Cell Reselection Details..................184
3.5.7.1.4 GERAN priority-based Cell Reselection Details.................185
3.5.7.2 Cell Selection in E-UTRAN..........................................................186
3.5.7.2.1 PLMN selection in E-UTRAN..............................................188
3.5.7.2.2 Cell Selection and Reselection...........................................188
3.5.7.2.3 Cell Selection Process........................................................188
3.5.7.2.4 Cell Selection Criterion.......................................................189
3.5.7.3 Cell Reselection Evaluation Process in E-UTRAN......................190
3.5.7.3.1 Reselection Priorities Handling...........................................190
3.5.7.3.2 Measurement Rules for Cell Re-Selection..........................192
3.5.7.3.3 Mobility States in E-UTRAN................................................194
3.5.7.3.4 Scaling Rules based on Mobility State...............................196
3.5.7.4 E-UTRAN Inter-Freq and IRAT Cell Reselection Criteria............198
3.5.7.5 Intra-Freq and equal Priority Inter-Freq Reselection Criteria......200
3.5.7.5.1 Cell Ranking Criterion in E-UTRAN for equal Priority interFreq and intra-Freq............................................................................202
3.5.7.6 Cell Reselection towards lower Priority E-UTRAN Freq or IRAT
Freq than Serving Freq............................................................................204
3.6 GERAN to E-UTRAN Cell Reselection.................................206

3.6.1 IRAT Measurements when camping in GSM or GPRS...........206
3.6.2 IRAT Cell Reselection based on Priority 2G to 3G / LTE.....208
3.6.2.1 Cell Reselection Criteria's...........................................................208
3.6.2.2 Cell Reselection from GERAN towards higher prioritized IRAT
Frequency................................................................................................212
3.6.2.3 Cell Reselection from GERAN towards lower prioritized IRAT
Frequency................................................................................................214
Lower Layers of the Uu-Interface: MAC, RLC & PDCP.....217

- iv -
Table of Content
4.1 Features of MAC..................................................................218
4.1.1 Overview.................................................................................218
4.1.1.1 Data transfer logical channels transport channels..............218
4.1.1.2 Radio resource allocation............................................................218
4.1.1.3 Special procedures......................................................................219
4.1.2 Radio Network Temporary Identifiers (RNTI's) in E-UTRAN...220

4.1.2.1 Usage of RNTI's..........................................................................220
4.1.2.1 RNTI Values................................................................................222
4.1.3 MAC Random Access Procedure............................................224

4.1.3.1 Contention Based Random Access Procedure...........................224
4.1.3.2 Non-contention based random access procedure.......................228
4.1.4 Structure of MAC-PDU............................................................230

4.1.4.1 MAC control element...................................................................231
4.1.4.2 Normal (non-transparent) MAC SDU...........................................231
4.1.4.3 Transparent MAC SDU................................................................231
4.1.5 MAC Control Elements............................................................232

4.1.5.1 Contention resolution ID..............................................................233
4.1.5.2 Timing Advance...........................................................................233
4.1.5.3 DRX.............................................................................................233
4.1.5.4 Padding.......................................................................................233
4.1.5.5 Power headroom report...............................................................233
4.1.5.6 C-RNTI........................................................................................233
4.1.5.7 Short, long and truncated buffer status reports...........................233
4.1.6 Practical Exercise: MAC Operation.........................................234

4.1.7 Practical Exercise: DL MAC PDU Construction.......................236
4.1.8 MAC Configuration..................................................................238
4.1.8.1 MAC Configuration in the Standard ............................................238
4.2 Features of RLC...................................................................240

4.2.1 Overview.................................................................................240
4.2.1.1 Data transfer................................................................................240
4.2.1.2 Error detection and recovery.......................................................240
4.2.1.3 Reset...........................................................................................241
4.2.2 Structure of RLC PDU.............................................................242

4.2.3 Structure of RLC AM with PDCP PDU Segments...................244
4.2.4 RLC Configuration...................................................................246
4.2.4.1 RLC Configuration in the Standard..............................................246
4.3 Features of PDCP................................................................248

4.3.1 Overview.................................................................................248
4.3.1.1 RoHC...........................................................................................248
4.3.1.2 Numbering of PDCP PDUs.........................................................248
4.3.1.3 In-sequence delivery of PDUs....................................................248
4.3.1.4 Duplicate deletion........................................................................248
4.3.1.5 Encryption....................................................................................249
4.3.1.6 Integrity Protection.......................................................................249
4.3.2 Structure of PDCP PDU..........................................................250

4.3.3 PDCP Configuration................................................................252
4.3.3.1 PDCP Configuration in the Standard...........................................252
-v-

4.4 How a TCP/IP MTU is reaching the UE / the Internet...........254
4.4.1 TCP/IP layer............................................................................254
4.4.2 PDCP layer.............................................................................254
4.4.3 RLC layer................................................................................254
4.4.4 MAC layer...............................................................................255
4.4.5 PHY layer................................................................................255
X2- and S1-Interfaces: X2AP- and S1-AP-Protocols.........257

5.1 The X2AP Protocol...............................................................258
5.1.1 Protocol Stack on the X2-interface..........................................258
5.1.2 Tasks & Functions...................................................................260
5.1.2.1 Mobility Management..................................................................260
5.1.2.2 Load Management.......................................................................260
5.1.2.3 X2-Interface Management...........................................................260
5.1.3 X2-based Handover Scenario.................................................262

5.1.3.1 Initial Conditions..........................................................................262
5.1.3.2 Detailed Description....................................................................264
5.2 The S1-AP Protocol.............................................................266

5.2.1 Overview & Introduction..........................................................266
5.2.2 S1-based Handover Scenario.................................................268
5.2.2.1 Initial Conditions..........................................................................268
5.2.2.2 Detailed Description....................................................................270
- vi -
Revisiting important Details of the EPS
Chapter 1:
Objectives
Some of your questions that will be answered during this session
How does the architecture of the LTE-network look like?
What are the tasks and functions of the new network elements?
How does security operate in LTE?
-1-
1.1 Architecture Overview

1.1.1 Evolved Packet Core in Context
The objective of this section is to depict the EPC as new network cloud in
context to the legacy and new network clouds.
Image Description
The image is split into two parts: in the upper part, the image illustrates the legacy
network parts and clouds which already exist with 3GPP Rel. 6 and 7.
These network parts and clouds are illustrated in gray color.
In the lower part, the new network clouds with Rel. 8 are depicted. They have
been colorized to provide for a better distinction from the legacy network clouds.
I-WLAN IP access from non-3GPP non-trusted access network may be achieved

either directly (lower option) or through the packet-switched core network domain
(upper option).
1.1.1.1 EPC vs. EPS

The two terms EPC and EPS can be distinguished as illustrated:
The EPC represents the core component of the EPS.
The EPS contains the EPC and the E-UTRAN (LTE) access network. However, it
does not contain the other access networks.
[3GTS 23.401, 3GTS 23.402]
-2-
1.1.1.2 Non-3GPP Access Networks (trusted / non-trusted)
In the legacy part (gray) the image illustrates the so called non-3GPP non trusted
access networks which have been supported by 3GPP-recommendations since
Rel. 6.
New with Rel. 8 and SAE are the so called trusted non-3GPP access networks.
Those trusted non-3GPP access networks comply to an EPC-operator's security
requirements [3GTS 33.402 (4.2)] and are therefore granted direct access to the
EPC.
Whether a non-3GPP access network is trusted or untrusted is ...
1. either pre-configured in the UE or ...
2. the UE learns the trust relationship during EAP-AKA authentication through

that access network from its home-PLMN.
3. Yet another option is that the selected access network does not at all support
EAP-AKA authentication in which case the UE determines that it camps on
an untrusted non-3GPP access network.
The major difference for the UE with respect to the trust relationship of the selected
non-3GPP access network is that in "untrusted case" the UE must establish an
IPsec-tunnel through IKEv2 with an ePDG in the EPC [3GTS 33.402 (8)].
The illustrated IPsec-tunnel through the non-3GPP trusted access network is only
necessary in case the S2c-interface is used and it comes without interface name.
Abbreviations of this Section:
AKA
Authentication and key agreement

(3GTS 33.102)
IKEv2
Internet Key Exchange protocol /

version 2 (RFC 4306)
E-UTRAN Evolved UMTS (Universal Mobile

Telecommunication System)
Terrestrial Radio Access Network
IPsec
Internet Protocol / secure (RFC

4301)
EAP
Extensible Authentication Protocol

(RFC 3748)
LTE
Long Term Evolution (of UMTS)
EAP-AKA

method for 3rd generation
Authentication and Key Agreement
(RFC 4187)
PLMN
Public Land Mobile Network
EPC
Evolved Packet Core (3GTS 23.401)

(Rel. 8 onwards)
SAE
System Architecture Evolution
EPS
Evolved Packet System
UE
User Equipment
I-WLAN
Interworking WLAN (Wireless Local

Area Network) (3GTS 23.234)
UTRAN
UMTS (Universal Mobile

-3-
1.1.2 Zoom into the EPS
The objectives of this section are to:

1.Illustrate the inner structure of the EPC and the E-UTRAN.
2. Point out the "one-to-many" nature of the interconnections within the EPS.
Key point of this section is that there is no more RNC or BSC within the
access network.
Image Description
The image depicts another time the two network clouds EPC and E-UTRAN and
illustrates the physical interconnections (black lines) of the various network
elements to the two IP-backbone networks.
[3GTS 23.401 (5.3.2)]
-4-
1.1.2.1 Functional Overview of Core Network Elements within the EPC
The MME or Mobility Management Entity takes care of various control plane
functions like mobility management and session management.
The S-GW or Serving Gateway is the peer of the MME within the user plane and
its functions evolve around packet data routing and forwarding.
The PDN-Gateway has similar functions as the Serving Gateway but it remains
the anchor during a packet data connection even if MME and S-GW are
swapped. It is feasible to assume that GGSN's will typically be upgraded into
PDN-GW's.
S-GW and PDN-GW may easily be integrated into a single box in order to save
hardware and latency. A combination of MME and S-GW is probably less appealing
because the MME is a very slim hardware box.
The ePDG is required to interconnect non-trusted non-3GPP networks to the

EPC. Its functions evolve around tunnel termination towards the UE and the nontrusted non-3GPP access network.
BSC
Base Station Controller
MME
Mobility Management Entity (3GTS

23.401) (Rel. 8 onwards)

PDN-GW
Packet Data Network Gateway (part

of EPC)
eNB
Enhanced Node B
PLMN
EPC

(Rel. 8 onwards)
RNC
Radio Network Controller
ePDG
evolved Packet Data Gateway (3GTS

23.402)
S-GW
Serving Gateway (3GTS 23.401)
EPS
UE
User Equipment
GGSN
Gateway GPRS Support Node
UTRAN

IP
Internet Protocol (RFC 791)
-5-
1.1.3 Network Elements and their Functions within the EPC

1.1.3.1 Mobility Management Entity (MME)
1.1.3.1.1 Characteristics
The objective of this section is to illustrate the most important characteristics

of the MME.
Image Description
The MME is a network element that takes care of control plane tasks.
The MME may physically be part of an SGSN or S-GW or it may be setup as a

stand-alone network element.
MME's are typically organized in pool areas (S1Flex) to provide for load balancing
among the MME's which belong to the same pool. All eNodeB's which belong to
the related E-UTRAN pool areas shall have access to the MME's belonging to this
MME-pool area(s).
[3GTS 23.002 (4.1.4.1), 3GTS 23.401 (4.4.2)]
1.1.3.1.2 Identification
-6-
Each MME is identified by using an MME Group ID (MMEGI), and an MME Code
(MMEC). Both parameters together form the MMEI [3GTS 23003 (19.4.2.4)].
Room for your Notes:
3GTS
3rd Generation Technical

Specification
MMEC
MME Code

MMEGI
MME Group Identity
EPC

(Rel. 8 onwards)
MMEI
MME Identity
GW
Gateway
SGSN
Serving GPRS Support Node
ID
Identity
UTRAN

MME

-7-
1.1.3.1.3 Interfaces & Protocols
The objectives of this section are to illustrate the MME, its interfaces towards
other network elements and the protocol stacks used on these interfaces.
Image Description
The green color used for the interfaces indicates the control plane relationship of
a protocol or an interface.
The interface towards the UE is depicted to illustrate the NAS-protocol

involvement of the MME. Obviously, this interface is realized over S1-AP and Uu.
The S102-interface towards the cdma2000 access network is only necessary in

case of circuit-switched fallback for cdma2000-networks and it is also required to
support SRVCC.
The Sv-interface is required to support the SRVCC-feature. The Sv-interface is

described in more detail in 3GTS 29.280.
[3GTS 23.401 (5.1)]
-8-
1xCSIWS
1x Circuit Switched Interworking

Solution Function (3GTS 29.277)
HSS
Home Subscriber Server [3GTS

23.002]. HSS replaces the HLR with
3GPP Rel. 5
DIAMETER
Successor of the RADIUS protocol
MME

E-UTRAN
Evolved UMTS (Universal Mobile

MSC
Mobile Services Switching Center
EIR
Equipment Identity Register
MSC-S
MSC-Server
EMM
EPS Mobility Management (3GTS

24.301)
NAS
Non-Access-Stratum
eNB
Enhanced Node B
S1-AP
S1 Application Part
EPC
Evolved Packet Core (3GTS

SCTP
Stream Control Transmission

Protocol (RFC 2960)
ESM
EPS Session Management (3GTS

24.301)
SGSN
GTP
GPRS Tunneling Protocol (3GTS

29.060)
TCP
Transmission Control Protocol
GTP-C
GTP Control Plane
UDP
User Datagram Protocol (RFC 768)
GW
Gateway
UTRAN

-9-
1.1.3.1.4 Tasks & Functions of the MME

1.1.3.1.4.1 NAS-Signaling towards the UE
The objective of this section is to illustrate the MME as peer of the eNodeB
and the UE for different signaling tasks.
The MME and the UE use the physical resources of the LTE-Uu-interface and the
S1-interface to exchange NAS-signaling [3GTS 24.301] which relates to EMM and
ESM.
1.1.3.1.4.2 S1-Signaling towards the eNodeB
MME and eNodeB use the S1-AP-protocol for various tasks as stated in the
image.
[3GTS 36.413]
- 10 -
3GTS

Specification
MME

EMM

24.301)
NAS
Non-Access-Stratum
ESM

24.301)
S1-AP
S1 Application Part
LTE
UE
User Equipment
- 11 -
1.1.3.1.4.3 S-GW and P-GW Selection
The objective of this section is to illustrate the responsibility of the different

network elements to select specific entities inside their pools to become
responsible for a certain UE.
Image Description
It is the eNodeB that selects the MME out of an MME-pool.
The selection of the S-GW is done based on O&M-constraints.

Nevertheless, if the possibility is there to select an S-GW which is integrated with
the selected P-GW, the MME shall prefer this choice.
The selection of the P-GW is either predefined through a decision of the HSS of
the registering UE or the MME may apply route optimizing decisions, e.g. by
selecting a local P-GW in the V-PLMN in case of roaming.
The aforementioned route optimization is frequently called local breakout.
[3GTS 23.882 (7.2)]
[3GTS 23.401 (4.3.8)]
- 12 -
1.1.3.1.4.4 Other Selection Functions
In addition to the aforementioned selection functions the MME is also responsible

to select the new MME in case of a handover with MME-change.
Besides, the MME will select the SGSN in case of inter-RAT handovers to GSM
or UMTS, if the packet-switched core network in the 2G/3G-domain supports the
IuFlex-feature.
3GTS

Specification
RAT
Radio Access Technology (e.g.

GERAN, UTRAN, ...)
GSM
Global System for Mobile

Communication
SGSN
HSS

3GPP Rel. 5
UE
User Equipment
MME

UMTS
Universal Mobile Telecommunication

System
O&M
Operation and Maintenance
V-PLMN
Visited PLMN
PLMN
- 13 -
1.1.3.1.4.5 Local Breakout
The objective of this section is to explain the term "local breakout".

Key point of this section is to bear in mind that local breakout basically
relates to "route optimization" in case of roaming.
Local breakout requires the UE to using two IP-addresses because traffic from
outside needs an unambiguous route to the UE and previously to two separate
PDN-gateways.
It is obvious that local breakout will save latency and bandwidth, because the blue
link to the server is essentially shorter than the red link.
1.1.3.1.4.5 IMS and Local Breakout
Local breakout is particularly interesting in case of roaming and IMS-access.
In that case, it may be desirable to allow the user data traffic to "breakout" locally
in the V-PLMN whereas the SIP-signaling must in any case be routed to the IMS
in the H-PLMN (according to the IMS-rules).
[3GTR 23.882 (7.2)]
- 14 -
3GTR
3rd Generation Technical Report
IMS
Internet Protocol Multimedia Core

Network Subsystem (Rel. 5 onwards)

IP
EPC

(Rel. 8 onwards)
PLMN
H-PLMN
Home PLMN
SIP
Session Initiation Protocol (RFC

3261)
HSS

3GPP Rel. 5
UTRAN

V-PLMN
Visited PLMN
- 15 -
1.1.3.2 Serving Gateway (S-GW)


of the S-GW.
[23.002 (4.1.4.2.1), 23.401 (4.4.3.3)]
Image Description
The S-GW represents the user plane side of the MME
Although the S-GW is logically a separate network element from the PDN-GW ,
the two network elements may physically be integrated into a single network
element (e.g. to save on latency).
S-GW's are typically organized into S-GW pools to provide for load balancing
among the S-GW's which belong to the same service area.
All eNodeB's which belong the related E-UTRAN pool areas shall have access to
the S-GW's belonging to this S-GW service area.
- 16 -
An S-GW has no EPS-specific identifiers and is identified by means of IPaddresses and URL's.

S-GW
EPS
SGSN
MME

URL
Uniform Resource Locator (RFC

1738)
PDN
Packet Data Network
UTRAN

- 17 -
The objectives of this section are to illustrate the S-GW, its interfaces
towards other network elements and the protocol stacks used on these
interfaces.
Image Description
The green color of an interface indicates the control plane relationship of a

protocol or an interface. Likewise, orange color indicates user plane relationship.
Note that on S5 and S8 interface it is an operator choice to implement either GTP
or PMIPv6 together with GRE. Irrespective of this choice, the S-GW must support
GTP on various other interfaces like for example towards MME, eNodeB or RNC.
[3GTS 23.401 (5.1), 23.402 (5.1)]
- 18 -
DIAMETER Successor of the RADIUS protocol
MME

E-UTRAN

PCRF
Policy and Charging Rules Function

(3GTS 23.203)
eNB
Enhanced Node B
PDN
Packet Data Network
EPC

PLMN
GRE
Generic Routing Encapsulation

(RFC 2784)
PMIPv6
Proxy Mobile IPv6
GTP

29.060)
RNC
GTP-C
GTP Control Plane
S-GW
GTP-U
GTP User Plane
SCTP

Protocol (RFC 2960)
H-PLMN
Home PLMN
SGSN
HSGW
HRPD Serving Gateway (cdma2000 TCP

term)
IP
UDP
UTRAN

- 19 -
1.1.3.2.4 Tasks & Functions of the S-GW
The objective of this section is to illustrate the tasks and functions of the SGW.
1.1.3.2.4.1 Packet Routing / Relaying

1.1.3.2.4.2 Legal Interception
1.1.3.2.4.3 QCI-based Packet Tagging
When the S-GW receives IP-packets in uplink or downlink direction it will check the
related QCI-value based on the relationship of the packet to a certain service data
flow and handle the packet accordingly, e.g. relay it to the responsible GTP-tunnel or
GRE-tunnel.
1.1.3.2.4.4 Accounting
[3GTS 23.401 (4.4.3.2), 23.402 (4.3.3.2)]
- 20 -
3GTS

Specification
IP
GRE
Generic Routing Encapsulation (RFC

2784)
QCI
QoS Class Identifier
GTP

29.060)
S-GW
- 21 -
1.1.3.3 PDN Gateway (P-GW or PDN-GW)


of the P-GW.
Image Description
The home agent function is only applicable if the UE accesses the P-GW through
one of the interfaces S2a, S2b or S2c.
It may make sense to build only combined S-GW / P-GW nodes in order to save
latency. However, this requires interconnection points to the external PDN at the
location of every S-GW.
A P-GW is identified by means of IP-addresses and URL's.
In addition and by means of specific DNS-resolution, a P-GW is logically identified

through APN's which refer to a specific service (PDN-access) that a given P-GW
can provide (see section 2.1.2.1.1).
[23.002 (4.1.4.2.2), 23.401 (4.3.3.3), 23402 (4.4.3.3)]
- 22 -
APN
Access Point Name (Reference to a

GGSN)
P-GW

of EPC)
DNS
Domain Name System
PDN
Packet Data Network
EPC

(Rel. 8 onwards)
PDN-GW

of EPC)
GGSN
PMIPv6
Proxy Mobile IPv6 (RFC 5213)
HoA
Home Address
S-GW
LMA
Local Mobility Anchor (RFC 5213)
URL

1738)
MIPv4
Mobile IP Version 4
- 23 -
The objectives of this section are to illustrate the P-GW, its interfaces
interfaces.
Image Description
The green color indicates the control plane relationship of a protocol or an

interface. Likewise, orange color indicates user plane relationship.
The ESP-tunnel over S2c has been established using EAP-AKA over IKEv2.
The protocol layer Application comprises among others http, SIP, RTP (with
voice or video).
[3GTS 23.401 (5.1), 23.402 (5.1)]
DSMIPv6
- 24 -
AAA
Authentication, Authorization and

Accounting
MIPv4
Mobile IP Version 4
NAT
Network Address Translation (RFC

1631)
DSMIPv6
Dual Stack Mobile IPv6
P-GW

of EPC)
EAP-AKA

(RFC 4187)
PCRF

(3GTS 23.203)
EPC
Evolved Packet Core (3GTS 23.401) PLMN

(Rel. 8 onwards)
ESP
Encapsulating Security Payload

(RFC 4303)
GRE
Generic Routing Encapsulation (RFC RTP

2784)
Real-time Transport Protocol (RFC

3550, RFC 3551)
GTP

29.060)
SCTP

Protocol (RFC 2960)
GTP-C
GTP Control Plane
SGi
Reference Point in LTE
GTP-U
GTP User Plane
SIP

3261)
IKEv2

TCP
IMS

Network Subsystem (Rel. 5
onwards)
UDP
IPv4
Internet Protocol (version 4)
V-PLMN
Visited PLMN
PMIPv6
- 25 -
1.1.3.3.4 Tasks & Functions of the P-GW
The objective of this section is to present the tasks and functions of the PGW.
1.1.3.3.4.1 UE IP Address Allocation

1.1.3.3.4.2 QCI-based Packet Tagging
The P-GW performs this task as part of the classification and according to the
installed QoS-policy.
Based on the installed DL-TFT, the QCI is determined and traffic handling rules
are determined.
1.1.3.3.4.3 Policy Enforcement
- 26 -
Traffic shaping: Delay data packet transmission until resources become available.
Traffic policing: Discard packet if no resources to transmit them are available.
Question No 1: Why does the P-GW perform legal interception and the S-GW and,
as you will see, the ePDG, too?
1.1.3.3.4.5 Home Agent Function

[3GTS 23.401 (4.4.3.3), 23.402 (4.3.3.3)]
3GTS

Specification
PMIPv6
DL
Downlink
QCI
QoS Class Identifier
DSMIPv6 Dual Stack Mobile IPv6
QoS
Quality of Service
GW
Gateway
S-GW
IP
TFT
Traffic Flow Template
LMA
UE
User Equipment
P-GW

of EPC)
- 27 -
1.1.3.4 enhanced Packet Data Gateway (ePDG)


of the ePDG.
Image Description
The ePDG is an enhanced PDG as defined in Release 6. Please recall that a

PDG usually was physically broken down into two parts: one inside the GGSN
and one inside the TTG [3GTS 23.234].
The selection of an ePDG through the UE occurs either through static

configuration or dynamically [3GTS 23.402 (4.5.4)].
An ePDG has no EPS-specific identifiers and is identified by means of IPaddresses and URL's.
[3GTS 23.402 (4.3.4)]
- 28 -
3GTS

Specification
PDG
Packet Data Gateway
EPS
TTG
Tunnel Termination Gateway
GGSN
UE
User Equipment
IP
URL

1738)
MAG
Mobile Access Gateway (RFC 5213)
- 29 -
The objectives of this section are to illustrate the ePDG, its interfaces
interfaces.
Image Description
The green color indicates the control plane relationship of a protocol or an

interface. Likewise, orange color indicates user plane relationship. The black lines
represent physical links which are used to piggyback the SWu-interface.
The ESP-tunnel over S2c has been established using EAP-AKA over IKEv2.
The Gxb-interface as depicted in the image is currently not specified.

[3GTS 23.401 (5.1), 23.402 (5.1)]
- 30 -
AAA
Authentication, Authorization and

Accounting
GRE

2784)
AKA

(3GTS 33.102)
IKEv2

DIAMETER
IP
EAP

(RFC 3748)
PCRF

(3GTS 23.203)
EAP-AKA

(RFC 4187)
PMIPv6
EPC

SCTP

Protocol (RFC 2960)
ePDG
evolved Packet Data Gateway

(3GTS 23.402)
TCP
ESP
Encapsulating Security Payload

(RFC 4303)
UDP
- 31 -
1.1.3.4.4 Tasks & Functions of the ePDG
The objective of this section is to present the tasks and functions of the
ePDG.
1.1.3.4.4.1 ESP-Tunnel Mgmt towards UE's

The allocated IP-address is just relayed by the ePDG. It stems from the P-GW.
1.1.3.4.4.2 QoS-specific Packet Tagging in UL-Direction
1.1.3.4.4.4 MAG-Function for PMIPv6
[3GTS 23.402 (4.3.4)]
- 32 -
3GTS

Specification
P-GW

of EPC)
ePDG
evolved Packet Data Gateway (3GTS

23.402)
PMIPv6
ESP
Encapsulating Security Payload (RFC

4303)
QoS
Quality of Service
GW
Gateway
UE
User Equipment
IP
UL
Uplink
MAG
- 33 -
1.2 Protocol Stacks

1.2.1 Control Plane / E-UTRAN - EPC
The objectives of this section are to depict the protocols which are related to
the control plane between UE, MME and HSS and to highlight whether these
protocols are E-UTRAN-specific, EPC-specific or generic.
Image Description
- 34 -
The ESM- and EMM-protocols are referred to as NAS-protocols.
Since ESM-messages may be piggybacked inside EMM-messages, the ESMprotocol has been depicted as illustrated above.
PDCP
Packet Data Convergence Protocol
E-UTRAN

PHY
Physical Layer
EMM

24.301)
RLC
Radio Link Control
EPC
Evolved Packet Core (3GTS 23.401) RRC

(Rel. 8 onwards)
Radio Resource Control
ESM

24.301)
S1 Application Part
HSS

SCTP
3GPP Rel. 5

Protocol (RFC 2960)
IP
TCP
MAC
Medium Access Control
UE
User Equipment
MME

UTRAN

NAS
Non-Access-Stratum
S1-AP
- 35 -
1.2.2 User Plane E-UTRAN EPC (S5/S8 GTP-based)
the user plane between UE and PDN-GW in case that GTP is applied on S5/
S8 and to highlight whether these protocols are E-UTRAN-specific, EPCspecific of generic.
- 36 -
DIAMETER
PDCP
E-UTRAN

PDN-GW

of EPC)
EPC

PHY
Physical Layer
GTP

29.060)
RLC
Radio Link Control
GTP-C
GTP Control Plane
S-GW
GTP-U
GTP User Plane
S1-AP
S1 Application Part
HSS

23.002]. HSS replaces the HLR
with 3GPP Rel. 5
SCTP

Protocol (RFC 2960)
IP
TCP
MAC
UDP
MME
Mobility Management Entity (3GTS UE

User Equipment
NAT

1631)

UTRAN
- 37 -
1.2.3 User Plane E-UTRAN EPC (S5/S8 PMIPv6/GRE-based)
the user plane between UE and PDN-GW in case that GRE is applied on S5/
S8 and to highlight whether these protocols are E-UTRAN-specific, EPCspecific of generic.
- 38 -

PDN
Packet Data Network
EPC

(Rel. 8 onwards)
PDN-GW

of EPC)
GRE

2784)
PHY
Physical Layer
GTP

29.060)
PMIPv6
GTP-U
GTP User Plane
RLC
Radio Link Control
HSS

3GPP Rel. 5
S-GW
IP
SCTP

Protocol (RFC 2960)
MAC
TCP
MME

UDP
NAT

1631)
UE
User Equipment
PDCP
UTRAN

- 39 -
1.3 Security Architecture

1.3.1 Overview & Introduction
The objective of this section is to introduce the most important

characteristics of the EPS security architecture.
- 40 -
1.3.1.1 Essentials
Please note that eNodeB also includes home eNodeB's.
1.3.1.2 EPS-AKA
1.3.1.3 Security is performed independently in two protocol layers
Question No 2: What are the reasons from your perspective to introduce security
on two different layers?
1.3.1.4 Algorithms
AES
Advanced Encryption Standard /

Cipher Key Lengths: 128 bit, 192 bit
or 256 bit
HSS

3GPP Rel. 5
ASME
Access Security Management Entity
IK
Integrity Key (3GTS 33.102)
AUTN
Authentication Token (3GTS 33.102)
MME

CK
Ciphering Key (3GTS 33.102)
NAS
Non-Access-Stratum
DRB
Data Radio Bearer
PDCP
EEA
EPS Encryption Algorithm (3GTS

33.401)
RAND
Random Number
EIA
EPS Integrity Protection Algorithm

(3GTS 33.401)
RES
Response
EMM

24.301)
RRC
EPS-AKA
Evolved Packet SystemAuthentication and Key Agreement

(3GTS 33.401)
SHA
Secure Hash Algorithm
ESM

24.301)
SRB
Signaling Radio Bearer
HLR
Home Location Register
UE
User Equipment
HMAC
Keyed Hashing for Message

Authentication (RFC 2104)
UMTS

System
USIM
Universal Subscriber Identity Module
- 41 -
1.3.2 Operation of UMTS-AKA
The objective of this section is to depict the operation of the UMTS-AKA.

Key point of this section is that the illustrated algorithms f1 f5 are operator
specific.
[3GTS 33.102]
- 42 -
3GTS

Specification
IK
AK
Anonymity Key (3GTS 33.102)
MAC
Message Authentication Code
AKA

(3GTS 33.102)
RAND
Random Number
AMF
Authentication management field

(3GTS 33.102)
SQN
Sequence number (used in UMTSsecurity architecture / 3GTS 33.102)
AUTN
UMTS

System
CK
XRES
Expected Response (3GTS 33.102)
- 43 -
1.3.3 Key Derivation Function (KDF)
The objective of this section is to illustrate the principles of the key derivation
function used within the EPS-environment.
[3GTS 33.401 (A.1.1)]
- 44 -
3GTS

Specification
KDF
Key Derivation Function (3GTS

33.401)
EPS
SHA
HMAC

- 45 -
1.3.3.1 Comprehension Check & Practical Exercise:

The KDF S(10) for K(ASME)
The objective of this section is to illustrate to the student how the key
K(ASME) is derived from concatenated information elements and the CK
and IK derived from the UMTS-AKA.
Question No 3: Fill in the input parameters to derive K(ASME) applying the S(10)
key derivation function.
to be continued on the next page
- 46 -
ASME
KDF
Key Derivation Function (3GTS

33.401)
CK
SHA
HMAC

UMTSAKA

System - Authentication and Key
Agreement (3GTS 33.102)
IK
- 47 -
1.3.3.1.1 Input Parameters
The secret input parameters are IK and CK with a length of 16 octets each. They
stem from a previous run of UMTS-AKA [3GTS 33.102].
Other input parameters are the serving network identity (MCC + MNC) and SQN
(xor) AK which also stems from the previous run of UMTS-AKA.
Although CK and IK together provide a key length of 256 bits and although the
length of K(ASME) is 256 bit, the efficient key length is ultimately restricted by the
subscriber key Ki with a length of only 128 bit.
[3GTS 33.401 (A.2)]
- 48 -
3GTS

Specification
IK
AK
MCC
Mobile Country Code [ITU-T E.212]
ASME
MNC
Mobile Network Code
CK
SQN
Sequence number (used in UMTSsecurity architecture / 3GTS 33.102)
UMTSAKA

- 49 -
1.3.4 EPS-AKA in Operation during Initial Attach Procedure
The objective of this section is to illustrate how the MME, the eNodeB and
the UE determine the different security keys which are required within the
EPS.
- 50 -
Question No 4: Fill in the missing keys (<=> K(xyz)) into the image.
ASME
NAS
Non-Access-Stratum
AUTN
PLMN
CK
PS
Packet Switched
CRC
Cyclic Redundancy Check
RAND
Random Number
DIA
Diameter Protocol (RFC 3588, RFC

3589)
RES
Response
EMM

24.301)
RRC
eNB
Enhanced Node B
S1-AP
S1 Application Part
EPS
UE
User Equipment
HSS

3GPP Rel. 5
UL
Uplink
IK
UMTSAKA

IMSI
International Mobile Subscriber

Identity
USIM
MME

XRES
- 51 -
1.3.5 Use of the different Security Algorithms
The objective of this section is to illustrate where which security algorithms

are applied within the EPS.
Key point of this section is that there is no integrity protection done for user
plane data.
- 52 -
CRC
ESM

24.301)
DL
Downlink
MME

EEA
EPS Encryption Algorithm (3GTS

33.401)
NAS
Non-Access-Stratum
EMM

24.301)
PDCP
eNB
Enhanced Node B
RRC
EPS
UL
Uplink
- 53 -
- 54 -
Lessons Learned / Conclusions
The Non-Access-Stratum: EMM & ESM
Chapter 2:
2
Objectives
What are important EMM- and ESM-specific procedures?
What is the format of EMM- and ESM-messages?
How are important scenarios like attachment and tracking area updating
performed?
- 55 -
2.1 EPS Mobility Management (EMM)

2.1.1 Important EMM-Procedures
2
The objective of this section is to illustrate the different EMM-procedures.

Procedures can be combined with each other. Example: The authentication
procedure is typically part of the attachment procedure.
[3GTS 24.301 (5.1.2)]
- 56 -
2.1.1.1 Common Procedures

Common procedures are typically embedded into a given specific procedure.
2.1.1.2 Specific Procedures
2.1.1.3 Connection Management Procedures
E-UTRA
Evolved UMTS Terrestrial Radio

Access
GUTI
Global Unique Terminal Identity

(3GTS 23.003)
EMM

24.301)
NAS
Non-Access-Stratum
EPS
Evolved Packet Switched
UE
User Equipment
- 57 -
2.1.2 State Machine
The objective of this section is to illustrate the different EMM-states and their
relationship.
[3GTS 24.301 (5)]

EMM and ESM are linked with each other [3GTS 24.301 (4.2)]. This relates
particularly to the piggybacked default EPS-bearer establishment when the UE
attaches to the EPC.
2.1.2.1 Relationship between EMM and ECM
In general, ECM relates to the presence of an S1-bearer plus RRC-connection. As
long as both are present, the UE is in ECM-CONNECTED mode. Upon release, the
UE switches to ECM-IDLE mode.
Therefore, the UE may well be EMM-registered but still be ECM-idle.
While the UE is in ECM-CONNECTED state, the network is in charge to

control the UE-mobility. While the UE is in ECM-CONNECTED mode, the
location of the UE is known with the granularity of a cell inside an eNodeB.
While the UE is in ECM-IDLE mode, the location of the UE is known with the
granularity of a tracking area. Within ECM-IDLE mode, the UE shall perform
autonomous cell reselection and tracking area update procedures.
[3GTS 36.300 (A.2), 3GTS 24.301 (5.1.3.2.2.4)]
- 58 -
3GTS

Specification
ESM

24.301)
ECM
EPS Connection Management (3GTS

24.301)
RRC
EMM

24.301)
UE
User Equipment
- 59 -
2.1.3 Network Operation Modes
The objective of this section is to illustrate the different network operation

modes of the UE.
[3GTS 24.301 (4.3)]
- 60 -
3GTS

Specification
EPS
CS
Circuit Switched
PS
Packet Switched
EMM

24.301)
UE
User Equipment
EPS
- 61 -
2.1.4 Message Format
The objective of this section is to illustrate the message format that is used
for EMM-messages.
Key points of this section are:
1. The security header is not necessarily present.
2. The protocol discriminator as part of the first octet repeats inside the plain
EMM-message if a security header is present.
2.1.4.1 Security Header
The presence of the security header is conditional as indicated through the yellow
color. It shall be present as soon as security in the form of integrity protection and
possibly encryption have been negotiated.
The security header is put upfront the plain NAS message and uses the same
protocol discriminator value 7.
The related security header type partially acts as a message type as there are
specific settings for certain messages. Primarily, the security header type
identifies whether a message is a plain NAS message (security header type = 0),
whether it is just integrity protected or integrity protected and ciphered.
[3GTS 24.301 (9.3.1)]
- 62 -
3GTS

Specification
Octet
8 bit
EMM

24.301)
PD
Protocol Discriminator
NAS
Non-Access-Stratum
PD
Packet Data
- 63 -
2.1.5 Important EMM-Scenarios

2.1.5.1 Attachment through E-UTRAN / new MME
2
The objective of this section is to illustrate the first part of an attach scenario
[3GTS 23.401 (5.3.2), 24.301 (5.5.1)] through E-UTRAN end-to-end and with
all related messages.
Key point of this section is that the indicated procedure illustrates one
possible straight forward case but does not depict all possible options.
Question No 5: Please fill in the missing interface names.
The eNodeB selects the MME at this time, if necessary. Possibly, the MMEI which is
included in the ATT_REQ-message relates to an MME which is available to the
eNodeB in which case no MME-selection is necessary.
Note that the EMM: ATT_REQ-message also contains the ESM: PDN_CONN_REQmessage.
To be continued on the next page
- 64 -
DIA

3589)
IMSI

Identity

MME

EMM

24.301)
MMEI
Mobility Management Entity Identity

(3GTS 23.003)
eNB
Enhanced Node B
RRC
GTP

29.060)
S1-AP
S1 Application Part
HSS

3GPP Rel. 5
UE
User Equipment
- 65 -
The S1-AP: INITIAL_UE_MSG includes the parameter eNB UE S1AP ID which

shall serve as unique identifier for S1-AP-messages sent by this eNodeB to that
MME for that particular UE. This parameter has been assigned by the eNodeB.
We assume in this case that the MME is unable to determine or connect to the
previous MME and therefore requests the UE to convey its IMSI. Otherwise, at this
time we would see GTP-messages to retrieve the UE-context from the previous
MME.
The S1-AP: DL_NAS_TRANSPORT message includes the parameter MME UE
S1AP ID which shall serve as unique identifier for S1-AP-messages sent by the
MME to that eNodeB for that particular UE. This parameter has been assigned by the
MME.
The EMM: SEC_MODE_CMD-message is integrity protected but not ciphered. This
message initiated NAS-based security which means that EMM- and ESM-messages
shall be integrity protected and possibly encrypted after this message has been
transmitted.
The subscription data contain, among others, relationships to specific PDN's,
information about PDN-GW to be selected (if applicable) and APN-restrictions.
RRC-connection establishment: [3GTS 36.331 (5.3.3)]
RRC downlink information transfer: [3GTS 36.331 (5.6.1)]
RRC uplink information transfer: [3GTS 36.331 (5.6.2)]
RRC connection reconfiguration [3GTS 36.331 (5.3.5)]
S1-AP initial UE-message: [3GTS 36.413 (8.6.2.1)]
S1-AP initial context setup: [3GTS 36.413 (8.3.1)]
S1-AP downlink NAS transport: [3GTS 36.413 (8.6.2.2)]
S1-AP uplink NAS transport: [3GTS 36.413 (8.6.2.3)]
DIAMETER: AIR, AIA, ULR, ULA [3GTS 29.272]
- 66 -
3GTS

Specification
PDN-GW

of EPC)
APN

GGSN)
RRC
MME

S1-AP
S1 Application Part
NAS
Non-Access-Stratum
UE
User Equipment
PDN
Packet Data Network
- 67 -
2.1.5.1 Attachment through E-UTRAN / new MME (continued)
The objective of this section is to continue and conclude the attach scenario
from the previous section.
Key point of this section is to appreciate the embedding of ESM- into EMMmessages which in turn are embedded into RRC-messages. This is new with
SAE.

Not depicted is a possible interaction between the PDN-GW and the PCRF.
The UE may be equipped with both, an IPv4 and an IPv6 address. Please recall that
an IPv6-address is typically generated from the H-PLMN's IPv6 network prefix (64
bit) and the UE's MAC-address (EUI-64).
- 68 -
APN

GGSN)
MAC
DRB
Data Radio Bearer
MME


P-GW

of EPC)
EMM

24.301)
PCRF

(3GTS 23.203)
EPS
PDN
Packet Data Network
ESM

24.301)
PDN-GW

of EPC)
EUI-64
Extended Unique Identifier - 64 bit

long (IEEE / the "other 64 bit" of an
IPv6-address, following the IPv6network prefix and generated from
the MAC-address of a device)
PLMN
F-TEID
Fully Qualified Tunnel Endpoint

Identifier (3GTS 29.274)
RRC
GTP

29.060)
S-GW
GTP-U
GTP User Plane
S1-AP
S1 Application Part
GUTI

(3GTS 23.003)
SAE
H-PLMN
Home PLMN
SRB
IE
Information Element
TAI
Tracking Area Identity (3GTS

24.301)
IPv4
TEID
Tunnel Endpoint Identifier (GTP /

3GTS 29.060)
IPv6
UE
User Equipment
- 69 -

Note the final IE F-TEID of S-GW user plane. This information must be relayed to
the eNodeB to enable a communication between S-GW and eNodeB.
Please note that the S1-AP: INITIAL_CX_SETUP_REQ-message contains the

security key K(eNB) which is used by the eNodeB to derive the keys needed for
integrity protection and encryption on PDCP-layer. Having received this information,
the eNodeB can trigger the security procedures on PDCP-layer by sending an RRC:
SEC_MODE_CMD-message to the UE.
GTP Create Session Request: [3GTS 29.274 (7.2.1)]
GTP Create Session Response: [3GTS 29.274 (7.2.2)]
S1-AP: Initial Context Setup: [3GTS 36.213 (8.3.1)]
GTP Modify Bearer Request: [3GTS 29.274 (7.2.7)]
GTP Modify Bearer Response: [3GTS 29.274 (7.2.8)]
EMM Attach Accept message: [3GTS 24.301 (8.2.1)]
ESM Activate Default EPS Bearer Context Request message: [3GTS 24.301 (8.3.6)]
- 70 -
3GTS

Specification
IE
Information Element
EMM

24.301)
PDCP
EPS
RRC
ESM

24.301)
S-GW
F-TEID

S1-AP
S1 Application Part
GTP

29.060)
TEID

3GTS 29.060)
- 71 -
2.1.5.2 Comprehension Check & Practical Exercise: Building your

own EMM: ATT_REQ-Message
2
The objectives of this section are to:

1. learn using the EMM-specification 3GTS 24.301
2. understand which contents are inside an EMM: ATT_REQ-message.
Question No 7: Fill in the missing octets (in hex) into the ATT_REQ-message.
Consider the following constraints:
Constraints are stated on the next page
- 72 -
- 73 -
Constraints:
- 74 -
Use enclosure 1 to resolve this exercise.
Apply the section in which the EMM-message format has been presented.
The protocol discriminator of EMM equals "7(hex)".
The message shall be sent neither integrity protected nor encrypted (<=> security
header type).
The UE shall perform an "EPS only" attachment.
The UE has a cached security context and the NAS-KSI(ASME) = "3(dec)".
The UE shall use a GUTI to identity itself to the network.
The UE comes from Germany (MCC = 262(hex)) and the operator's MNC =
01(hex). The third digit of the MNC is not used by that operator.
The digit numbering of MCC and MNC is straightforward: MCC = 2 (<= digit 1) 6
(<=> digit 2) 2 (<=> digit 3) / MNC = 0 (<=> digit 1) 1 (<=> digit 2).
The MMEI = "08 15 00(hex)" with the MME-code being the "00".
The UE still has an M-TMSI = "C0 12 34 56(hex)" and therefore does not use its
IMSI to identity itself to the network.
The UE supports all mandatory required integrity protection and ciphering

algorithms.
For the ESM-message format (ESM: PDN_CONN_REQ) please use section

2.2.4.
The protocol discriminator of ESM = "2(hex)" but there has no EPS-bearer identity
been assigned yet.
The UE assigns a procedure transaction identity of "01".
The UE shall perform an "initial attach" as request type.
The UE asks for both; an IPv4 and an IPv6 address.
The UE shall request an APN = "www.inacon.com" (you may write the APN in
plain text, without translation into ASCII-code).
- 75 -
2.1.5.3 Tracking Area Update (Inter-MME / with new S-GW)
The objective of this section is to illustrate a tracking area update procedure

which involves two MME's.
2.1.5.3.1 Initial Conditions
The UE is in RRC-idle mode and has just reselected its serving eNodeB.
The stored list of tracking area identities does not contain the TAI as broadcast by
the new serving cell.
Accordingly, the UE initiates a tracking area update procedure.
- 76 -
ASME
MME

AUTN
NAS
Non-Access-Stratum
EMM

24.301)
RAND
Random Number
eNB
Enhanced Node B
RES
Response
EPS
RRC
GTP

29.060)
S-GW
GUTI

(3GTS 23.003)
S1-AP
S1 Application Part
IMSI

Identity
TA
Tracking Area
KSI
KEy Set Identifier (3GTS 33.401)
TAI

24.301)
- 77 -
2.1.5.3.2 Detailed Description

The EMM: TA_UPD_REQ-message contains and indicates (among others):
whether the UE wants to perform a combined TA/LA-update procedure with or w/

o IMSI-attachment (for circuit-switched fallback).
the UE-identity in the form of an already assigned GUTI. Note that the GUTI also
contains the identification of the MME which assigned it.
Note that the EMM: TA_UPD_REQ-message is typically integrity protected because

the UE will already possess valid security information when it performs a tracking
area update procedure.
At this time, the eNodeB selects the new MME to serve the UE from within an MMEpool and relays the EMM: TA_UPD_REQ-message to the new MME embedded in an
S1-AP: INITIAL_UE_MSG.
After the reception of the TA_UPD_REQ-message, the receiving MME recognizes
that another MME allocated the GUTI. Accordingly, the new MME must identify that
MME based on MME-code and MME-group Id and it must determine the IP-address
of that former MME, possibly by means of some DNS-resolution process or through
internal mapping tables. Finally, the new MME will send a GTP-C: Context-Requestmessage to the former MME.
If the former MME can identify the UE it shall relay all necessary information to the
new MME by transmitting a GTP-C: Context-Response message.
The indicated EMM-context contains information such as authentication vectors,
DRX-parameters and UE-network capabilities. The EPS bearer context(s) contain(s)
information about the bearer contexts themselves (e.g. QoS-related information) as
well as such important information as the P-GW's IP-address and TEID for the
control plane on the S5-interface as well as the formerly assigned S-GW's IP-address
and TEID for the control plane on the S11-interface.
Authentication is only conducted if deemed necessary by the MME. Authentication is
mandatory if the integrity check on the initial EMM: TA_UPD_REQ-message failed.
Note that the MME did receive the security information from the former MME and is
therefore able to conduct authentication.
NAS-KSI(ASME) is a simple integer that is used as pointer to the active security suite
(AUTN, K(ASME), etc.). The UE will include it in future initial NAS-messages (e.g.
TA_UPD_REQ and the network may skip authentication and immediately enable
integrity protection (and encryption) if NAS-KSI(ASME) received from the UE
matches the value stored in the MME.
After authentication, the MME will probably activate NAS-related security procedures
by sending an EMM: SEC_MODE_CMD-message to the UE. The UE will reply an
EMM: SEC_MODE_CMP-message which shall be integrity protected and, if ordered,
also be encrypted on NAS-layer (not by the PDCP-layer).
RRC-connection establishment: [3GTS 36.331 (5.3.3)]
RRC downlink information transfer: [3GTS 36.331 (5.6.1)]
RRC uplink information transfer: [3GTS 36.331 (5.6.2)]
S1-AP initial UE-message: [3GTS 36.413 (8.6.2.1)]
- 78 -

GTP-C Context-Request: [3GTS 29.274 (7.3.5)]
GTP-C Context-Response: [3GTS 29.274 (7.3.6)]
GTP-C Context-Acknowledge: [3GTS 29.274 (7.3.7)]
S1-AP downlink NAS transport: [3GTS 36.413 (8.6.2.2)]
S1-AP uplink NAS transport: [3GTS 36.413 (8.6.2.3)]
EMM: SEC_MODE_CMD: [3GTS 24.301 (8.2.20)]
DNS
Domain Name System
NAS
Non-Access-Stratum
DRX
Discontinuous Reception
P-GW

of EPC)
EMM

24.301)
PDCP
EPS
QoS
Quality of Service
GTP

29.060)
RRC
GTP-C
GTP Control Plane
S-GW
GUTI

(3GTS 23.003)
S1-AP
S1 Application Part
IMSI

Identity
TA
Tracking Area
MME

TEID

3GTS 29.060)
- 79 -

(continued)
2
The objective of this section is to continue and conclude the presentation of

the tracking area update procedure between two MME's and involving the
allocation of a new S-GW.

This is the time when the new MME has to decide whether the indicated S-GW may
continue to serving the UE or whether the S-GW needs to be changed. This decision
is based on constraints such as accessibility of the former S-GW from the new
eNodeB and from the new MME. It may also take into account routing optimization
issues.
The new MME continues the procedure by sending a GTP: Create-SessionRequest message to the new selected S-GW. The IE bearer context contains,
among others, the uplink and downlink TFT's but it does not contain the eNodeB's FTEID for the user plane because the new eNodeB did not yet assign such an F-TEID.
Then the new S-GW informs the already assigned P-GW about the bearer
modification and both nodes exchange their F-TEID's for the user plane.
- 80 -

Finally, the new MME must update the HSS with respect to the tracking area update
procedure. It uses the DIA: ULR-message to do so.
The HSS will then cancel the location towards the former MME, using the DIA:
CLR- / CLA-message exchange.
DIAMETER: ULR, ULA, CLR, CLA [3GTS 29.272]
DIA

3589)
MME

F-TEID

P-GW

of EPC)
GTP

29.060)
S-GW
GW
Gateway
TEID

3GTS 29.060)
HSS

3GPP Rel. 5
TFT
IE
Information Element
UE
User Equipment
- 81 -

(continued)
2

the tracking area update procedure between two MME's and involving the
allocation of a new S-GW.

Finally, the MME sends the EMM: TA_UPD_ACC-message through the eNodeB to
the UE.
Note that in this case, there is no establishment of additional radio bearers as was
shown during the attachment scenario.
GTP-C Delete-Session-Request: [3GTS 29.274 (7.2.9.1)]
GTP-C Delete-Session-Response: [3GTS 29.274 (7.2.10.1)]
EMM: TA_UPD_ACC: [3GTS 24.301 (8.2.26)]
EMM: TA_UPD_COM: [3GTS 24.301 (8.2.27)]
- 82 -
DRB
Data Radio Bearer
GUTI

(3GTS 23.003)

IE
Information Element
EMM

24.301)
MME

eNB
Enhanced Node B
RRC
EPS
S-GW
F-TEID

S1-AP
S1 Application Part
GTP

29.060)
TEID

3GTS 29.060)
GTP-U
GTP User Plane
UE
User Equipment
- 83 -
2.1.5.4 Comprehension Check & Practical Exercise: EMM-Message

Decode
2
The objective of this section is to decode an EMM: ATT_REQ-message.
Question No 11: Please decode the embedded hexadecimal ATT_REQ-message,

using enclosure 1. Which problems do you encounter?
- 84 -
- 85 -
2.2 EPS Session Management (ESM)

2.2.1 Important ESM-Procedures
2
The objective of this section is to present the important ESM-procedures.

Key point of this section is that the actual activation, deactivation or
modification of an EPS-bearer must be initiated and conducted by the
network. This is a major difference to previous releases where PDP-context
activation had to be triggered by the UE.
- 86 -
2.2.1.1 MME-initiated
2.2.1.2 UE-initiated
[3GTS 24.301 (6.4), (6.5)]
3GTS

Specification
MME

EPS
PDP
Packet Data Protocol
ESM

24.301)
UE
User Equipment
- 87 -
2.2.2 State Machine
The objectives of this section are to illustrate the state machine of ESM and
the different ways to migrate between the two states.
[3GTS 24.301 (6)]
- 88 -
EPS
PDN
Packet Data Network
ESM

24.301)
UE
User Equipment
MME

- 89 -
2.2.4 Message Format
The objective of this section is to illustrate the message format that is used
for ESM-messages.
Key points of this section are:
1. The security header is not necessarily present.
2. The protocol discriminator as part of the first octet repeats inside the plain
ESM-message if a security header is present.
[3GTS 24.301 (9.1)]
If an ESM-message is embedded into an EMM-message it is represented as plain
NAS-message w/o individual security header.
- 90 -
EMM

24.301)
PD
EPS
PTI
Procedure Transaction Identity
ESM

24.301)
SM
Session Management (3GTS 23.060,

3GTS 24.008)
NAS
Non-Access-Stratum
UE
User Equipment
Octet
8 bit
- 91 -
2.2.4.1 Security Header
The presence of the security header is conditional as indicated through the yellow
color. It shall be present as soon as security in the form of integrity protection and
possibly encryption have been negotiated.
The security header is put upfront the plain NAS message and uses the same
protocol discriminator value 2.
The related security header type partially acts as a message type as there are
specific settings for certain messages. Primarily, the security header type
identifies whether a message is a plain NAS message (security header type = 0),
whether it is just integrity protected or integrity protected and ciphered.
[3GTS 24.301 (9.3.1)]

2.2.4.2 Procedure Transaction Identity
The PTI is used to distinguish network initiated and UE-originated transactions.
If the network reacts upon a UE-initiated transaction request (e.g. ESM:

PDN_CONN_REQ), it shall use the UE-assigned PTI-value also within network
originating ESM-messages.
[3GTS 24.007 (11.2.3.1a)]
- 92 -
ESM

24.301)
PTI
NAS
Non-Access-Stratum
UE
User Equipment
- 93 -
2.3.5 Dedicated EPS Bearer Establishment

2.3.5.1 Network Initiated (IMS triggered during Call Establishment)
2
The objective of this section is to illustrate the dedicated EPS bearer

establishment.
2.3.5.1.1 Initial Conditions
The UE changed into ECM-CONNECTED state some time before to be able to

exchange the SIP-messages with the IMS, supposedly over the already
established default EPS-bearer.
We can see the SIP-signaling inside the different pipes EPS-bearer and S5bearer.
When the SDP-descriptors within the SIP-messages indicate that a real-time

bearer is required, the P-CSCF inside the IMS will communicate with the PCRF to
authorize the QoS-request and to trigger the establishment of that real-time
bearer (DIA: AAR-message).
Having received the DIA: AAR-message, the PCRF will trigger the PDN-GW to
initiate the dedicated EPS-bearer activation procedure by sending a DIA: RARmessage to it.
DIAMETER: AAR, AAA: [3GTS 29.214]

DIAMETER: RAR: [3GTS 29.212 (5.6.4)]
- 94 -
DIA

3589)
PCRF

(3GTS 23.203)
PDN-GW

of EPC)
ECM
EPS Connection Management

(3GTS 24.301)
QoS
Quality of Service
eNB
Enhanced Node B
SDP
Session Description Protocol (RFC

2327, RFC 3266, RFC 3264)
EPS
SIP

3261)
IMS

onwards)
UE
User Equipment
P-CSCF
Proxy Call Session Control Function

(SIP)
VoIP
Voice over IP
- 95 -
2.3.5.1 Network Initiated (IMS triggered during Call Establishment)

network initiated dedicated EPS bearer setup.
Question No 14: Please fill In the two bearer types of EPS-bearer context
establishment.

GTP Create-Bearer-Request / Response: [3GTS 29.274 (7.2.3), (7.2.4)]
S1-AP E-RAB Setup: [3GTS 36.413 (8.2)]
ESM Dedicated EPS Bearer Context Request [3GTS 24.301 (6.4.3)
RRC Connection Reconfiguration [3GTS 36.331 (2.3.5.5)]
ESM Dedicated EPS Bearer Context Accept [3GTS 24.301 (6.4.1)
DIAMETER: RAA: [3GTS 29.212 (5.6.5)]
- 96 -
DIA

3589)
P-GW

of EPC)
DIAMETER
PCRF

(3GTS 23.203)
eNB
Enhanced Node B
QoS
Quality of Service
ESM

24.301)
RAB
Radio Access Bearer
F-TEID

RRC
GTP

29.060)
S-GW
GTP-U
GTP User Plane
S1-AP
S1 Application Part
IMS

onwards)
TEID

3GTS 29.060)
MME

TFT
- 97 -
The PDN-GW will send a GTP: Create-Bearer-Request-message to the S-GW.

This message contains, among others, the linked bearer Id which relates to the
related default EPS-bearer Id. The message also conveys the GTP TEID of the
new bearer from the P-GW to the S-GW.
The S-GW will relay the also included bearer description to the MME. Of course,
the S-GW has to include the GTP TEID of its user plane to allow the MME to
relay this information to the eNodeB.The MME will build two messages: An ESM:
DED_EPS_BEARER_CX_REQ-message and an S1-AP: E-RAB_SETUP_REQmessage. The ESM-message contains the NAS-description of the new bearer
while the S1-AP-message serves as carrier for the ESM-message and it contains
the radio resource description of the new bearer for the eNodeB.
The eNodeB will take the ESM-message and will embed it into an
RRC_CONN_RECONF-message that is also used to convey the radio resource
related information of the new bearer to the UE.
The UE shall setup the new bearer and shall confirm this to the eNodeB by
sending RRC_CONN_RECONF_CMP.
Similarly, the ESM-layer shall build an ESM: DED_EPS_BEARER_CX_ACCmessage which will be transparently sent to the eNodeB which in turn will
transparently relay it to the MME.
Only after having received this ESM-message, the MME shall confirm EPSbearer establishment to the S-GW and this message also includes the GTP-U
TEID of the eNodeB for the new bearer.
Finally, the S-GW confirms bearer establishment to the P-GW.
The P-GW must still respond to the PCRF's DIA: RAR-message by sending DIA:
RAA with a successful result code.
In turn, the PCRF shall confirm bearer setup to the IMS (precisely to the PCSCF).
What we did not include is the continuing SIP-signaling for call setup for which the
voice data will be sent on the newly established bearer.
GTP Create-Bearer-Request / Response: [3GTS 29.274 (7.2.3), (7.2.4)]

S1-AP E-RAB Setup: [3GTS 36.413 (8.2)]
ESM Dedicated EPS Bearer Context Request [3GTS 24.301 (6.4.3)
RRC Connection Reconfiguration [3GTS 36.331 (2.3.5.5)]
ESM Dedicated EPS Bearer Context Accept [3GTS 24.301 (6.4.1)
DIAMETER: RAA: [3GTS 29.212 (5.6.5)]
- 98 -
DIA

3589)
P-GW

of EPC)
DIAMETE Successor of the RADIUS protocol

R
PCRF

(3GTS 23.203)
EPS
PDN
Packet Data Network
ESM

24.301)
PDN-GW

of EPC)
GTP

29.060)
RAA
RE-Auth-Answer command
(Diameter BASE, RFC 3588)
GTP-U
GTP User Plane
RAB
Radio Access Bearer
RRC
IMS

S-GW
MME

S1-AP
S1 Application Part
NAS
Non-Access-Stratum
SIP

3261)
P-CSCF
Proxy Call Session Control Function

(SIP)
TEID

3GTS 29.060)
UE
User Equipment
- 99 -
- 100 -
Chapter 3:
Objectives
How are RRC-messages encoded using ASN.1 PER?
How can I determine the message types that RRC uses for the different
RRC-messages?
How are the different RRC-messages mapped to logical channels, transport

channels and physical channels?
How System Information Blocks are organized?
How an RRC connection is managed with RRC messages?
How measurements are defined and how a measurements report looks like?
Why there are fixed time setting for the RRC procedures?
How cell selection and cell reselection are performed in the idle mode?
- 101 -
3.1 Overview
The objective of this section is to introduce the key features of the radio
resource control layer.
Key point of this section is that the tasks of the RRC stay mostly the same as
UMTS and HSPA, but since the air interface is different there are significant
changes in the implementation.
- 102 -
3.1.1 Transmission of broadcast information

Here is it very important to know that only the MIB is transmitted on the BCH. All the
other SIBs are grouped in SUs according to their transmission periodicity and are
transmitted on the DL-SCH.
3.1.2 Establish and maintain services
Here the basic concepts are very different. The RRC connection setup procedure has
been extended to the initial context setup procedure. RRC and NAS link are
established in parallel. Moreover since there is a new air interface technology
(OFDMA and SC-FDMA) used the message contents are different. Another very
significant change is the drastic reduction of RRC states mentioned earlier.
3.1.3 QoS control

Nothing to add to what is stated in the picture.
3.1.4 Transfer of dedicated control information
Nothing to add to what is stated in the picture.
[3GTR 25.813 (5.4), 3GTS 36.300 (7), 3GTS 36.331 (4.4)]
3GTR
NAS
Non-Access-Stratum
3GTS

Specification
OFDMA
Orthogonal Frequency Division

Multiple Access
BCH
Broadcast Channel
QoS
Quality of Service
DL
Downlink
RRC
DL-SCH
Downlink Shared Channel
SC-FDMA Single Carrier Frequency Division

Multiple Access
EPC

(Rel. 8 onwards)
SIB
System Information Block
FDMA
Frequency Division Multiple Access
SU
Scheduling Unit
HSPA
High Speed Packet Access (operation UE

of HSDPA and HSUPA)
User Equipment
MIB
Master Information Block

System
UMTS
- 103 -
3.2 State Characteristics of RRC
The objective of this section is to introduce the key features of the radio
resource control states.
Key point of this section is that there are only 2 RRC states in LTE.
Image description
The picture shows the RRC states in LTE and their main characteristics. It
focuses on the processes of the E-UTRAN.
3.2.1 RRC_IDLE
During RRC_IDLE the UE can be paged and will listen to the PCH and the BCH, but
it is not known by the eNB it will perform cell reselections. In order to do the cell
reselections it will perform neighbor cell measurements according to the system
information in the BCCH but will not report these measurements to the infrastructure.
Keep also in mind that this state will also assumed once the UE is switched on during
initial cell search. Once the UE has found a cell it will go RRC_CONNECTED to
register with the core network and to establish a radio bearer and will then go
RRC_IDLE again.
3.2.2 RRC_CONNECTED
Here the UE is fully connected to the eNB. That means it has a C-RNTI and it is
known on cell level. It will do neighbor cell measurements and handover. This state is
also assumed to be used for MBMS services.
[3GTR 25.813 (5.4.2), 3GTS 36.300 (7.2)]
- 104 -
Room for your Note

3GTR
RACH
Random Access Channel
3GTS

Specification
RNTI
Radio Network Temporary Identifier
BCCH
Broadcast Control Channel
RRC
BCH
Broadcast Channel
RRC_CO RRC state in E-UTRA

NNECTED
C-RNTI
Cell Radio Network Temporary

Identifier
RRC_IDL
E
RRC state
LTE
RRC_MB
MS_CON
NECTED
RRC state in E-UTRA for UEs with

MBMS service only
MBMS
Multimedia Broadcast / Multicast

Service
UE
User Equipment
NAS
Non-Access-Stratum
UTRAN

PCH
Paging Channel
eNB
Enhanced Node B
- 105 -
3.3 Signaling Radio Bearers (SRB)

3.3.1 Overview
The objective of this section is to illustrate the characteristics and differences

of the different SRB's.
3.3.1.1 SRB0
3.3.1.2 SRB1
3.3.1.3 SRB2
[3GTS 36.331 (4.2.2)]
- 106 -
3GTS

Specification
RLC
Radio Link Control
AM
Acknowledged Mode operation
RRC
DCCH
Dedicated Control Channel
SRB
NAS
Non-Access-Stratum
TM
Transparent Mode operation
- 107 -
3.3.1.1 Review of eNB DL Channels
The objective of this section is to provide a summary review of the channels

used in LTE in downlink direction from the view of the eNodeB.
- 108 -
- 109 -
3.3.1.2 Review of eNB UL Channels
The objective of this section is to provide a summary review of the channels

used in LTE in uplink direction from the view of the eNodeB.
- 110 -
- 111 -
3.3.2 Mapping of RRC-Messages to SRB's and to Channels

3.3.2.1 Messages on BCCH (MIB and SIB)
The objective of this section is to illustrate how MIB and SIB's are mapped to
logical channels, transport channels and physical channels.
Question No 15: Please fill I n the SRB-number (if applicable) as well as the
RLC-operation mode (e.g. RLC-UM), logical channel type (e.g. DCCH), transport
channel type and physical channel type.
The UE shall not only listen to the BCCH in RRC_IDLE also in RRC_CONNECTED
the UE needs to listen the system information of the own cell (SIB1 will indicate a
change) and to the system information on the neighbor cells in oder to verify the
neighbor cell ID during neighbor cell measurements.
- 112 -
BCCH
RRC_IDL
E
RRC state
DCCH

NNECTED
MIB
SIB
RLC
Radio Link Control
SRB
RRC
UM
Unacknowledged Mode operation
- 113 -
3.3.2.2 Messages on PCCH and DL-CCCH
The objective of this section is to illustrate how PCCH- and DL-CCCHmessages are mapped to logical channels, transport channels and physical
channels.
Question No 16: Please fill in the SRB-number (if applicable) as well as the RLCoperation mode (e.g. RLC-UM), logical channel type (e.g. DCCH), transport
channel type and physical channel type.
Question No 17: Is the PCCH in need to be listened to in the RRC_CONNECTED

mode?.
- 114 -
CCCH
Common Control Channel
PHY
Physical Layer
DCCH
RLC
Radio Link Control
DL
Downlink
RRC
MAC

NNECTED
PCCH
Paging Control Channel
SRB
PDCP
UM
- 115 -
3.3.2.3 Messages on DL-DCCH and DL-DTCH
The objective of this section is to illustrate how DL-DCCH-messages and IPpackets are mapped to logical channels, transport channels and physical
channels.
Question No 18: Please fill in the SRB-number (if applicable), radio bearer number
as well as the RLC-operation mode (e.g. RLC-UM), logical channel type (e.g.
DCCH), transport channel type and physical channel type.
- 116 -
DCCH
PDCP
DL
Downlink
PHY
Physical Layer
DRB
Data Radio Bearer
RLC
Radio Link Control
DTCH
Dedicated Traffic Channel
RRC
IP
SRB
MAC
UM
NAS
Non-Access-Stratum
- 117 -
3.3.2.4 Messages on UL-CCCH, UL-DCCH and UL-DTCH
The objective of this section is to illustrate how UL-DCCH-messages and IPpackets are mapped to logical channels, transport channels and physical
channels.
Question No 19: Please fill in the SRB-number (if applicable), radio bearer number
as well as the RLC-operation mode (e.g. RLC-UM), logical channel type (e.g.
DCCH), transport channel type and physical channel type.
- 118 -
CCCH
PDCP
DCCH
PHY
Physical Layer
DRB
Data Radio Bearer
RLC
Radio Link Control
DTCH
RRC
IP
SRB
MAC
UL
Uplink
NAS
Non-Access-Stratum
UM
- 119 -
3.4 Message Encoding through ASN.1 PER-unaligned

3.4.1 Example: The ASN.1-Code of RRC_CONN_REQ ...
The objective of this section is to present the ASN.1-code of the

RRC_CONN_REQ-message.
[3GTS 36.331 (6.2.2)]
- 120 -
3GTS

Specification
ASN.1
Abstract Syntax Notation 1 (ITU-T

X.680 / X.681)
PER
Packed Encoding Rules (ITU-T X.691)
- 121 -
3.4.2 and the compiled Message Structure (Tree View)
The objective of this section is to confront the student or reader with the fact
that ASN.1 PER will add binary marks into the message sequence to
distinguish among different options.
[http://www.inacon.de/protocolhelp/index.php/]
- 122 -
ASN.1

X.680 / X.681)
PER
- 123 -
3.4.3 Important Encoding Rules of ASN.1 PER-unaligned

3.4.3.1 Handling of optional IE's
The objective of this section is to illustrate how the ASN.1-object type

sequence is binary encoded using the unaligned PER.
Image Description
If an IE consists of the object type sequence and contains one or more optional IEs
and IEs with default values, then a bitmap at the beginning of the packed ASN.1output for the sequence type IE shall indicate whether or not an optional IE is
present.
In our example, the bitmap consists of only 2 bit which indicate whether or not the
optional parameters DEF and/or JKL are present.
[ITU-T X.680, X.681, X691]
- 124 -
ASN.1

X.680 / X.681)
ITU-T
International Telecommunication
Union - Telecommunication Sector
IE
Information Element
PER
- 125 -
3.4.3.2 Selection among Options (CHOICE / ENUMERATED)
The objective of this section is to illustrate how the ASN.1-object types

choice / enumerated are binary encoded using the unaligned PER.
Image Description
If there are only 8 different values defined for a given IE, why waste 8 bit as the
minimum length of the value field? PER will evaluate how many values are defined
for any given IE. If possible, the reserved number of bits will be reduced to the
absolute minimum.
The graphics illustrates the unaligned PER-encoding of the IE Initial UE Identity.
Since there are only 8 different possibilities defined, 3 bit are sufficient to identify
which of the different UE-IDs is used.
If IMSI is used, the encoding will be {000 IMSI}
If TMSI + LAI is used, the encoding will be {001 TMSI LAI}
and so on.
[ITU-T X.691]
- 126 -
ASN.1

X.680 / X.681)
ITU-T
Union - Telecommunication Sector
ID
Identity
LAI
Location Area Identification (LAI =

MCC + MNC + LAC) [3GTS 23.003]
IE
Information Element
PER
IMSI

Identity
TMSI
Temporary Mobile Subscriber

Identity
- 127 -
3.4.3.3 Handling of IE's with variable Length
The objective of this section is to illustrate how the ASN.1 PER treats
information elements with variable lengths.
Image Description
If an information element comes with a variable length, PER need to provide for a
possibility to identify the current length of this IE. A simple example is illustrated
above:
The MNC may be 2 or 3 digits long. Each digit consists of 4 bit. The flexible length of
2 or 3 digits is translated into a choice which consequently needs two options and
therefore adds another bit in front of the 2 or 3 digits of the MNC.
[ITU-T X.691]
Question No 20: Considering the aforementioned: How many prefix bits are
necessary if the number of digits can vary between 5 and 68?
- 128 -
ASN.1

X.680 / X.681)
MNC
Mobile Network Code
IE
Information Element
PER
ITU
Union
- 129 -
3.4.4 Comprehension Check & Practical Exercise:

Encoding an RRC_CONN_REQ-Message
The objective of this section is to practice the ASN.1 / PER-based encoding

which is used by the RRC-protocol.
Question No 21: Please encode the RRC_CONN_REQ-message that the UE was

sending to the eNodeB when performing the initial attach scenario from the
previous section. Please assume that the smallest RACH container which has a
MAC PDU of just 56 bit inside is used. 8 bit of MAC header have to be anticipated.
All necessary information can be obtained from there and from the tree view in the previous section.
Please note that there is a difference in between the EMM and the RRC protocol
the EMM is organized in a way that the IE's chain up one after the other in the
correct order once the octets are written from right to left and the RRC protocol,
which is working with unaligned PER, is bit oriented such that the IE's chain up in
the correct order once the bits are written from left to right.
- 130 -
ASN.1

X.680 / X.681)
PER
EMM

24.301)
RRC
IE
Information Element
UE
User Equipment
- 131 -
3.5 RRC Procedures

3.5.1 System Information Broadcast
3.5.1.1 Overview
3
The objective of this section is to present the most important information

about the system information blocks in LTE.
SIB2 is automatically included in the first scheduled system information message

in SIB1 and thus needs not to be scheduled explicitly.
- 132 -
LTE
PHICH
Physical HARQ Acknowledgement

Indicator Channel
MIB
PLMN
PBCH
Physical Broadcast Channel
SFN
System Frame Number
PDSCH
Physical Downlink Shared Channel
SIB
- 133 -
3.5.1.2 Overview of Functions of the System Information Blocks
The objective of this section is to give an overview about the function of the
SIB's.
Key point of this section is that most of the SIB's are dealing with neighbor
cell description.
SIB2 is automatically included in the first scheduled system information message

in SIB1 and thus needs not to be scheduled explicitly.
- 134 -
BCCH
ID
Identity
BCH
Broadcast Channel
MIB
CDMA
Code Division Multiple Access
OP
Optional
CSG
Closed Subscriber Group
PLMN
DL
Downlink
SIB
DL-SCH
UE
User Equipment
ETWS
Earthquake and Tsunami Warning

System
UL
Uplink
GERAN
GSM EDGE Radio Access Network
UTRAN

HNB
Home Node B
- 135 -
3.5.1.3 Example of an MIB
The objective of this section is to illustrate the format and content of a master
information block (MIB).
- 136 -

MIB
PHICH

Indicator Channel
- 137 -
3.5.1.4 Example of an SIB1
The objective of this section is to illustrate the format and content of a

system information block 1 (SIB1).
- 138 -

SIB
- 139 -

system information block 2 (SIB2).
- 140 -

BCCH
PUCCH
Physical Uplink Control Channel
MO
Mobile Originated
PUSCH
Physical Uplink Shared Channel
PCCH
RACH
PDSCH
RS
Reference Signal
PRACH
Physical Random Access Channel
SIB
PRACH
Packet Random Access Channel
- 141 -

system information block3 (SIB3).
- 142 -

EUTRA

Access
SF
Speed dependent Scaling Factor
SIB
- 143 -
3.5.2 Connection Management Related Procedures

3.5.2.1 Paging Procedure
The objective of this section is to give an overview about the use, the
messages involved and the follow up resulting from the Paging Procedure.
Key point of this section is that paging is not only used for mobile terminated
service establishment / data arrival but also for notification of system
information change and disaster control.
- 144 -

Once there is a mobile terminated service establishment / data arrival and the UE
does not react there will be a retry. Once there are system information changed
this cannot be retried for a particular UE. In order to cover the error scenario these
indications need to be repeated several times to make sure all the UE's concerned
got them.

3

eNB
Enhanced Node B
RRC_IDL
E
RRC state
ETWS
Earthquake and Tsunami Warning

System
SIB
RRC
SRB
UE
User Equipment

NNECTED
- 145 -
3.5.2.2 RRC Connection Establishment Procedure
messages involved and the follow up resulting from the RRC Connection
Establishment Procedure.
Key points of this section are that the RRC Connection Setup Procedure is
only establishing SRB1 but that it is - in contrast to UMTS - allowing already
the transmission of a NAS message.
- 146 -

Note that the transmission of an IMSI is not foreseen here any more.

eNB
Enhanced Node B

NNECTED
EPC

(Rel. 8 onwards)
RRC_IDL
E
RRC state
ID
Identity
S-TMSI
SAE Temporary Mobile Subscriber

Identity
IMSI

Identity
SRB
MMEI
MME Identity
TMSI
Temporary Mobile Subscriber

Identity
NAS
Non-Access-Stratum
UE
User Equipment
PLMN
UMTS

System
RRC
- 147 -
3.5.2.2.1 SRB1 Default Configuration
The objective of this section is to give the default configuration for SRB1.
Key point of this section is that the SRB1 default configuration allows for very
short RRC Connection Setup messages.
All times are in ms.
- 148 -

IE
Information Element
RLC
Radio Link Control
PDU
Protocol Data Unit or Packet Data

Unit
SRB
- 149 -
3.5.2.2.2 Physical Layer Default Configuration
The objective of this section is to give the physical layer default configuration
for all RB's.
Key point of this section is that the physical layer default configuration allows
for very short RRC Connection Setup messages.
- 150 -

ACK
Acknowledgement
RI
Rank Indicator
CQI
Channel Quality Indicator
RRC
PDSCH
RS
Reference Signal
PUCCH
SRS
Sounding Reference Signal
RB
Radio Bearer
UE
User Equipment
- 151 -
3.5.2.3 UE Capability Transfer Procedure
messages involved and the follow up resulting from the UE Capability
Exchange Procedure.
Key point of this section is that this procedure will only be used once the
QoS settings for a service exceed the capabilities of UE Category 1.
- 152 -

CDMA
RRC


NNECTED
eNB
Enhanced Node B
SRB
GERAN
UE
User Equipment
QoS
Quality of Service
UTRAN

- 153 -
3.5.2.4 RRC Initial Security Activation Procedure
messages involved and the follow up resulting from the RRC Initial Security
Activation Procedure.
Key point of this section is that without this procedure no services can be
established.
- 154 -
AS
Access Stratum (UMTS)
RRC
eNB
Enhanced Node B

NNECTED
NAS
Non-Access-Stratum
SRB
- 155 -
3.5.2.5 RRC Connection Reconfiguration Procedure
Reconfiguration Procedure.
Key point of this section is that this is the most mighty procedure in EUTRAN. Without this procedure no orderly mobile radio operation is
possible.
- 156 -

ACK
Acknowledgement
NAS
Non-Access-Stratum
C-RNTI

Identifier
RLC
Radio Link Control
DRB
Data Radio Bearer
RNTI

RRC
eNB
Enhanced Node B
SRB
ID
Identity
UE
User Equipment
MAC-I
Message Authentication Code, MSB's

of extended PDCP Sequence Number
UTRAN

- 157 -
3.5.2.5.1 SRB2 Default Configuration
The objective of this section is to give the default configuration for SRB2.
Key point of this section is that the SRB2 default configuration allows for very
short RRC Connection Reconfiguration messages.
All times are in ms.
- 158 -

IE
Information Element
RRC
PDU

Unit
SRB
RLC
Radio Link Control
- 159 -
3.5.2.6 Counter Check Procedure
messages involved and the follow up resulting from the Counter Check
Procedure.
Key point of this section is that this procedure needs not to be done once the
operator has enough confidence in its encryption mechanisms.
- 160 -

COUNT
Extended Sequence Number in PDCP
RRC
DL
Downlink

NNECTED
DRB
Data Radio Bearer
SRB
eNB
Enhanced Node B
UL
Uplink
MSB
Most Significant Bit
- 161 -
3.5.2.7 RRC Connection Reestablishment Procedure
Reestablishment Procedure.
Key point of this section is that this procedure recovers SRB1 only.
This procedure shall not be performed once the UE has no AS security context.
- 162 -

AS
PLMN
C-RNTI

Identifier
RNTI
E-UTRA

Access
RRC
eNB
Enhanced Node B

NNECTED
ID
Identity
RRC_IDL
E
RRC state
MAC-I
Message Authentication Code, MSB's

of extended PDCP Sequence Number
SRB
MMEI
MME Identity
UE
User Equipment
NAS
Non-Access-Stratum
UTRA

Terrestrial Radio Access
- 163 -
3.5.2.8 RRC Connection Release Procedure
Release Procedure.
Key point of this section is that there is no response from the UE required.
- 164 -

eNB
Enhanced Node B
RRC_IDL
E
RRC state
RAT

GERAN, UTRAN, ...)
SRB
RRC
UE
User Equipment

NNECTED
- 165 -
3.5.3 Inter RAT RRC Procedures
The objective of this section is to give an overview about the messages

relating to inter RAT mobility.
Key point of this section is that the CDMA2000 system is that different from
3GPP's RAT such that the handover to CDMA2000 needs to be tailored with
many extra messages.
- 166 -

3GPP
Third Generation Partnership Project

(Collaboration between different
standardization organizations (e.g.
ARIB, ETSI) to define advanced
mobile communications standards,
responsible for UMTS)
NACC
Network Assisted Cell Change (3GTS

44.060)
CDMA20
00
The 3G Standard 3GPP2
RAT

GERAN, UTRAN, ...)
CSFB
Circuit Switched Fall Back
RRC
E-UTRA

Access
UE
User Equipment

UL
Uplink
GERAN
UTRA

GPRS
General Packet Radio Service
UTRAN

- 167 -

HO
Handover
3.5.4 E-UTRAN Measurements

3.5.4.1 Overview
The objective of this section is to give an overview about the messages

performed by the UE in E-UTRAN.
Key point of this section is that measurements are not only communicated in
measurement reports.
- 168 -
ACK
Acknowledgement
RAT

GERAN, UTRAN, ...)
CGI
Cell Global Identification
RI
Rank Indicator
DCCH
RRC
DL
Downlink
RSRP
Reference Signal Received Power
E-UTRA

Access
RSRQ
Reference Signal Received Quality

UE
User Equipment
MAC
UL
Uplink
NACK
Negative Acknowledgement
UL-SCH
Uplink Shared Channel
PMI
Precoding Matrix Indicator
UTRA

PUCCH
UTRAN

PUSCH
- 169 -
3.5.4.2 Definition of Measurements in E-UTRAN
The objective of this section is to give an overview of the measurement

definition strategy in E-UTRAN.
Key point of this section is Measurement Objects and Report Configurations
can be combined in Measurement ID's.
- 170 -
CDMA
RAT

GERAN, UTRAN, ...)

RSRP
GERAN
UTRAN

ID
Identity
- 171 -
3.5.4.3 Measurement Events in E-UTRAN
The objective of this section is to give an overview of the measurement

event definition strategy in E-UTRAN.
Key point of this section is that in E-UTRAN there are only 2 kinds of events.
- 172 -

AND
Both conditions need to be fulfilled.

Logical Function.
RAT

GERAN, UTRAN, ...)
E-UTRAN

UTRAN

OR
One condition need to be fulfilled.

Logical Function.
- 173 -
3.5.4.4 Measurement Definition in the Standard Measurement

Object
The objective of this section is to give an overview about the IE's relating to
the Measurement Objects.
Key point of this section is that each RAT has its own Measurement Objects.
- 174 -


CGI
IE
Information Element
EUTRA

Access
RAT

GERAN, UTRAN, ...)
- 175 -
3.5.4.5 Measurement Definition in the Standard Report

Configuration and Measurement ID
the Measurement Report configuration and the Measurement ID.
Key point of this section is that regardless whether periodical measurements
or events are reported the RSRP and/or RSRQ needs to be reported.
- 176 -

EUTRA

Access
RSRP
ID
Identity
RSRQ
IE
Information Element
- 177 -
3.5.4.6 Structure Measurement Report
Measurement Reports.
Key point of this section is that in a Measurement Report there are no events
visible even though an event might be reported.
- 178 -


CDMA20
00
IE
Information Element
CGI
PLMN
EUTRA

Access
RSRP
GERAN
RSRQ
ID
Identity
UTRA

- 179 -
3.5.5 Other RRC Procedures
The objective of this section is to give an overview on the UL and DL

Information Transfer procedures.
Key point of this section is that these procedures do not change with respect
to UTRAN.
Please keep in mind that the initial NAS message is sent with the RRC Connection
Setup Complete message.
- 180 -

DL
Downlink
RRC
eNB
Enhanced Node B
UE
User Equipment
EPC

(Rel. 8 onwards)
UL
Uplink
NAS
Non-Access-Stratum
UTRAN

- 181 -
3.5.6 RRC Procedure Delay

3.5.6.1 Introduction
The objective of this section is to show the timing constraints of RRC

Procedures.
Key point of this section is that since the UL is using a shared channel the
UL resources have to be scheduled at a well defined time in order to ensure
an efficient operation.
- 182 -

DL
Downlink
RRC
eNB
Enhanced Node B
UL
Uplink
- 183 -
3.5.6.1 Values
The objective of this section is to give an overview on the RRC procedure

delays.
Key point of this section is that some RRC procedures cannot have a timing
defined because the reaction from the UE side is either linked with a random
access procedure or is running across RAT's or it is depending on events.
- 184 -

CDMA20
00
RRC
E-UTRA

Access
UE
User Equipment
RAT

GERAN, UTRAN, ...)
UTRA

RB
Radio Bearer
- 185 -
3.5.7 Idle Mode Procedures Neighbor Cell Monitoring & Cell

Reselection
3.5.7.1 Priority-Based Cell Reselection of Multi-RAT UE's
The objective of this section is to show that priority-based cell reselection is

a novel principle adopted/possible in Rel. 8 in order to improve the
performance of cell reslection in the presence of of multiple RAT's which
may co-exist in the same geographical location.
Key point of this section are that
1. Priority-based reselection reduces the need for a UE to monitor all the
available intra-system frequency layers and inter-RAT carriers by monitoring
them according to a set of priority rules provided to the UE.
2. Common (through SIB's resp. Sys_Info) and/or dedicated priority's (via
dedicated RRC or RR messages) for the indvidual frequency layers can be
signaled to the UE, however, dedicated priorities always take precedence
over common priorities.
Image Descrition
The RRM in the respective RAN (E-UTRAN, GERAN, UTRAN) maps SPID
parameters received via the S1-interface or A/Gb-interface or Iu-interface to a locallydefined configuration in order to apply specific RRM strategies (e.g., to define
RRC_IDLE mode priorities and control inter-RAT/inter-frequency handover in
RRC_CONNECTED mode). SPID is an index referring to user information such as
mobility profile and service usage profile. The SPID information is UE-specific and
applies to all of its radio bearers.
- 186 -
For simplicity reason the CDMA2000 is not explicitly mentioned nor shown in
above picture, but allows also for priority-based reselection.
The SIB's or Sys_Infos broadcast common priorities of the various neighbor

frequencies resp. IRAT frequency layer's.
Beside common priorities for cell reselection the UE can be provided with
dedicated (= individual) priorities based on vendor-specific RRM (radio resource
management algorithms for the serving RAT and inter-RAT frequency layer's.
The various different RAN's have their specific dedicated RR resp. RRC
message's and broadcast information in order to convey dedicated (= individual)
and/or common priorities governing UE's reselection behavior.
At inter-RAT cell reselection, the MS shall inherit valid individual priority information
from the source RAT. The MS shall also inherit valid individual priority information
from the source RAT upon cell selection that results in a change of RAT. In this case
the mobile station shall start a guard timer T (depending on the source RAT) with the
timeout value set to the remaining validity time of the corresponding timer from the
source RAT (i.e. T320 in E-UTRA, T322 in UTRA or T3230 in GERA).
NOTE: The network may provide individual priorities information for inter-RAT
frequencies not configured by system information. Importantly, riorities between
different frequencies or RAT's provided to the UE by system information or dedicated
signalling are not used in the cell selection process but these dedicated priorities are
kept in UE's memory and used lateron in the cell reselection process!
3.5.7.1.1 SPID - Subscriber Profile ID for RAT/Frequency priority

The Subscriber Profile ID IE for RAT/Frequency Selection Priority is used to define
camp priorities in Idle mode and to control inter-RAT/inter-frequency handover in
Active mode.
The core network like MME (EPS/SAE) or MSC/SGSN(2G/3G-core) sends to the
respective RAN the optional SPID parameter in order to control e.g. service based
handover and IRAT-HO as well UE's idle mode cell reselection based on prioritizing
certain RAT's against other RAT's. The RAT prioritization may be a result of the
service type(s) the user requests and/or load/overload conditions in the RAN's and/or
core network.
In the simplest case it could be like this: a UE/user which is just doing voice calls only
might be best served by GSM radio access network (RAN). Or a UE/user which just
does some simple web-browsing from time to time or just receives push-emails is
best served by UMTS/HSPA (precondition is that the UE supports several different
RAT's). [3GTS 48.008 (3.2.2.108), 48.018 (11.3.105), 25.413 (9.2.1.86), 36.413
(9.2.1.39)]

CSG
RAT

GERAN, UTRAN, ...)
E-UTRA

Access
RRC
GERA
GSM/EGPRS Radio Access
TA
Tracking Area
- 187 -
3.5.7.1.2 E-UTRAN priority-based Cell Reselection Details

First of all upon reception of RRC Connection Setup message (going into dedicated
mode), the UE shall discard the cell reselection priority information provided by the IE
idleModeMobilityControlInfo or inherited from another RAT. [3GTS 36.331 (5.3.3.4)]
The
RRC
Connection
Release
message
can
include
the
IE
idleModeMobilityControlInfo which forces the UE to go for priority-based cell
reselection governed by the details of IE idleModeMobilityControlInfo; and if the
t320 is included, UE shall set and start timer T320, with the value provided.
In case of missing IE idleModeMobilityControlInfo the UE shall apply the cell
reselection priority information broadcast in the system information.
If T320 expires, the UE shall discard the cell reselection priority information provided
by IE idleModeMobilityControlInfo or inherited from another RAT (if stored); and
apply the cell reselection priority information broadcast in the system information.
[3GTS 36.331 (5.3.8.3, 5.3.8.4)]
RRC Connection Release message parameters/IE's encoding
RedirectedCarrierInfo
OPTIONAL,
-- Need ON
IdleModeMobilityControlInfo
OPTIONAL,
-- Need OP
RedirectedCarrierInfo ::=
CHOICE {
eutra
ARFCN-ValueEUTRA,
geran
CarrierFreqsGERAN,
utra-FDD
ARFCN-ValueUTRA,
<snip>}
IdleModeMobilityControlInfo ::= SEQUENCE {

FreqPriorityListEUTRA
OPTIONAL,
-- Need ON
FreqsPriorityListGERAN
OPTIONAL,
-- Need ON
FreqPriorityListUTRA-FDD
OPTIONAL,
-- Need ON
<snip>
t320
{5, 10, 20, 30, 60, 120, 180} min OPTIONAL,
-- Need OR
FreqPriorityListEUTRA ::= SEQUENCE (SIZE (1..maxFreq)) OF FreqPriorityEUTRA

SEQUENCE {ARFCN-ValueEUTRA, CellReselectionPriority }
FreqsPriorityListGERAN ::= SEQUENCE (SIZE (1..maxGNFG)) OF
FreqsPriorityGERAN
{CarrierFreqsGERAN, CellReselectionPriority }
FreqPriorityListUTRA-FDD ::= SEQUENCE (SIZE (1..maxUTRA-FDD-Carrier)) OF
FreqPriorityUTRA-FDD
{, ARFCN-ValueUTRA, CellReselectionPriority }
CellReselectionPriority (Range: 0 7)
The IE CellReselectionPriority concerns the absolute priority of the concerned carrier
frequency / set of frequencies (in case of GERAN), as used by the cell reselection
procedure. It corresponds with parameter "priority" in 3GTS 36.304. Value 0 means:
lowest priority and 7 means highest. The UE behavior for the case the priority field is
absent, if applicable, is specified in chapter Reselection Priorities Handling.
3.5.7.1.3 UTRAN priority-based Cell Reselection Details
System Information Block type 19 Common Priority Information
If the "Priority status" equals "dedicated_priority", the UE shall ignore SIB-19 settings
for common priority-based reselection and follow dedicated priority-based
reselection. Otherwise the UE follows the common priority's for cell reselection
broadcast in SIB-19 if no dedicated priority's are present. The UE shall then follow
- 188 -

the parameters in SIB-19: "UTRA priority info list"; or "GSM priority info list" or "EUTRA frequency and priority info list" if present. [3GTS 25.331 (8.1.1.6.19)]
UTRAN Mobility Information (UMI) - Dedicated Priority Information
The UMI message allows with the IE "Dedicated Priority Information" to configure UE
for dedicated priority handling for cell reselection which overrules SIB-19 settings.
The UE is then commanded among other things to set the priority per "Radio
Access Technology" e.g. {UTRA FDD, E-UTRA or GSM} etc. If the "T322" is
configured via UMI, the UE shall start timer T322 using the value signaled. T322
Range: {5, 10, 20, 30, 60, 120, 180} minutes. When the timer T322 expires the UE
should revert to using the priorities signaled in system information SIB-19. Note that
the absence of this T322 means that the configured dedicated priorities are valid until
the next update. [3GTS 25.331 (8.6.7.23), (10.3.2.7)]
3.5.7.1.4 GERAN priority-based Cell Reselection Details

Inter-RAT cell re-selection based on priority information
The network may provide priority information to enable priority-based cell reselection
(see 3GTS 45.008). Inter-RAT cell reselection based on priority information applies
only in case of autonomous cell reselection.
Two sets of priorities are defined for inter-RAT cell re-selection based on priority
information: common priorities and individual (= dedicated) priorities. A mobile station
shall consider the latest received common priorities as valid if the mobile does not
have any valid individual (= dedicated) priorities.
Provision of individual (= dedicated) priorities information
A mobile station may receive individual priorities information via the RR CHANNEL
RELEASE message. The mobile station shall use these parameters for inter-RAT cell
reselection. If the T3230 timeout value is provided the mobile station shall set timer
T3230 to the value received and start timer T3230 (or restart timer T3230 with the
timeout value provided if already running).
Individual priorities shall be considered valid by the mobile station until either:
- a PLMN selection is performed and results in a change of PLMN which is not an
equivalent PLMN, see 3GTS 23.122; or
- the mobile station is switched off; or
- a RR CHANNEL RELEASE message is received with an indication that the
individual priorities shall be deleted; or
- new individual priorities are received in which case the MS shall delete all
previously assigned individual priorities and consider the new ones as valid; or
- timer T3230 expires. [3GTS 44.018 (3.2.3)]
RR
Radio Resource in GSM [3GTS

44.018]
T320
E-UTRAN guard timer for dedicated

priority-based reselection in UE received
by eNB
RRC
Radio Resource Control in UTRAN or

E-UTRAN [3GTS 25.331 resp.
36.331]
T322
UTRAN guard timer for dedicated

by SRNC
T3230
GERAN guard timer for dedicated

by BSC.
- 189 -
3.5.7.2 Cell Selection in E-UTRAN
The objective of this section is to illustrate the PLMN and cell selection
criteria and therefore being separated into three parts.
Key point of this section are that for cell selection procedure
1. Only the RSRP is of relevance.
2. This process allows the UE to select a suitable cell where to camp on in
order to access available services. In this process the UE can use stored
information (Stored information cell selection) or not (Initial cell selection).
The Q-RxlevMinOffset has to be used only once the UE is in a V-PLMN. This

ensures that H-PLMN's enjoy an advantage once it comes to cell selection at the
country boundary.
- 190 -

Reference Signal Received Power (RSRP)
RSRP is defined as the linear average over the power contributions (in [W]) of the
resource elements that carry cell-specific reference signals within the considered
measurement frequency bandwidth.
For RSRP determination the cell-specific reference signals R0 according 3GTS
36.211 shall be used. If the UE can reliably detect that R1 is available it may use R1
in addition to R0 to determine RSRP.
Example: Cell-Bandwidth = 50 Resource Blocks (10 MHz), no TX-Diversity
2 Pilot-RE's x 50 RB's x 2 Pilot-Symbols per RB = 2 x 100 Pilot-SC's as there are
4 Pilot Resource Elements per Resource Block and 2 RE's per Symbol in a RB.
RSRP = average power per Pilot subcarrier: e.g. 20 W att / 100 SC's = 0.2 Watt /SC
In comparison, RSRQ is the power per RB RSRQ = RSRP / RSSI
Example: for 50 RB's and no inter-cell interference and an idle cell:
100 SC-Power / 200 SC-Power = - 3 dB RSRQ
Note that the power of Pilot RE's per Symbol per RB must be added up and then
averaged over the total amount of RB's in order to obtain RSRP.
[3GTS 36.214 (5.1.1)]
A UE which is not equipped with a valid USIM (i.e. no UICC or SIM only), or which
shall consider the USIM as invalid for EPS services as defined in [3GTS 24.301]
and [3GTS 24.008] (e.g. due to a Location Registration reject cause #3, #6, #7,
#8) shall disable all its E-UTRAN capabilities until switching off or the UICC
containing the USIM is removed.
Note: This is because Rel-8 E-UTRAN/EPC does not support USIM-less
emergency calls according to [3GTS 36.304 (4.1)].

RB
Resource Block typically comprises of

12 Subcarrier with 15 kHz frequency
spacing 180 kHz
H-PLMN
Home PLMN
RE
Resource Element considers 1 x

Subcarrier per OFDM-Symbol
PLMN
SIB
RSRP
VPLMN
Visited PLMN
- 191 -
3.5.7.2.1 PLMN selection in E-UTRAN

On request of the NAS the Access Stratum shall perform a search for available
PLMN's and report them to NAS (non access stratum) ~ higher layer in UE.
The UE shall scan all RF channels in the E-UTRA bands according to its capabilities
to find available PLMN's. On each carrier, the UE shall search for the strongest cell
and read its system information, in order to find out which PLMN(s) the cell belongs
to. If the UE can read one or several PLMN identities in the strongest cell, each found
PLMN (see the PLMN reading in [3GTS 36.331]) shall be reported to the NAS as a
high quality PLMN (but without the RSRP value), provided that the following high
quality criterion is fulfilled:
For an E-UTRAN cell, the measured RSRP value shall be greater than or equal
to -110 dBm.
Found PLMN's that do not satisfy the high quality criterion, but for which the UE has
been able to read the PLMN identities are reported to the NAS together with the
RSRP value. The quality measure reported by the UE to NAS shall be the same for
each PLMN found in one cell.
3.5.7.2.2 Cell Selection and Reselection
UE shall perform measurements of found/scanned cell's for cell selection and serving
& neighbor cells for reselection purposes as specified in System Info's and defined by
3GTS 36.133.
The NAS can control the RAT(s) in which the cell selection should be performed, for
instance by indicating RAT(s) associated with the selected PLMN, and by
maintaining a list of forbidden registration area(s) and a list of equivalent PLMNs. The
UE shall select a suitable cell based on idle mode measurements and cell selection
criteria.
In order to speed up the cell selection process, stored information for several RATs
may be available in the UE.
When camped on a cell, the UE shall regularly search for a better cell according to
the cell reselection criteria. If a better cell is found, that cell is selected. The change
of cell may imply a change of RAT. Details on performance requirements for cell
reselection can be found in [36.133].
The NAS is informed if the cell selection and reselection results in changes in the
received system information relevant for NAS.
For normal service, the UE shall camp on a suitable cell, tune to that cell's control
channel(s) so that the UE can:
Receive system information from the PLMN; and
receive registration area information from the PLMN, e.g., tracking
area information; and
receive other AS and NAS Information; and
-if registered:
receive paging and notification messages from the PLMN; and
initiate transfer to connected mode.
3.5.7.2.3 Cell Selection Process
The UE shall use one of the following two cell selection procedures:
a)
Initial Cell Selection
This procedure requires no prior knowledge of which RF channels are E-UTRA
carriers. The UE shall scan all RF channels in the E-UTRA bands according to its
capabilities to find a suitable cell. On each carrier frequency, the UE need only
search for the strongest cell. Once a suitable cell is found this cell shall be selected.
b)
Stored Information Cell Selection
- 192 -

This procedure requires stored information of carrier frequencies and optionally also
information on cell parameters, from previously received measurement control
information elements or from previously detected cells. Once the UE has found a
suitable cell the UE shall select it. If no suitable cell is found the Initial Cell Selection
procedure shall be started.
Note:
Priorities between different frequencies or RAT's provided to the UE by
system information or dedicated signaling are not used in the cell selection process.
[3GTS 36.304 (5.2.3)]
3.5.7.2.4 Cell Selection Criterion
The cell selection criterion S is fulfilled when:
S(rxlev) > 0
S(rxlev) = Q(rxlevmeas) [Q(rxlevmin) Q(rxlevminoffset)] Pcompensation
Where:
the signaled value QrxlevminOffset is only applied when a cell is evaluated for cell
selection as a result of a periodic search for a higher priority PLMN while camped
normally in a VPLMN [3GTS 23.122]. During this periodic search for higher priority
PLMN the UE may check the S criteria of a cell using parameter values stored from a
different cell of this higher priority PLMN.
S(rxlev)
Cell Selection RX level value (dB)
Q(rxlevmeas)
Measured cell RX level value (RSRP)
Q(rxlevmin)
Minimum required RX level in the cell (dBm)
Q(rxlevminoffset)
Offset to the signalled Qrxlevmin taken into account in the

Srxlev evaluation as a result of a periodic search for a higher
priority PLMN while camped normally in a VPLMN
Pcompensation
max(PEMAX_H P(PowerClass), 0) [dB]
P(EMAX_H)
Maximum TX power level an UE may use when transmitting on

the uplink in the cell (dBm) defined as PEMAX_H in [3GTS
36.101]
P(PowerClass)
Maximum RF output power of the UE (dBm) according to the

UE power class as defined in [3GTS 36.101]
The CSG (closed subscriber group) Cell Selection is disregarded here in this chapter.
Nevertheless here some details:
Allowed CSG list: A list stored in the USIM containing all the CSG identities of the
CSGs to which the subscriber belongs.
Closed Subscriber Group (CSG): A Closed Subscriber Group identifies subscribers
of an operator who are permitted to access one or more cells of the PLMN but which
have restricted access (CSG cells).
CSG cell: A cell, part of the PLMN, broadcasting a CSG indication that is set to
TRUE and a specific CSG identity. A CSG cell is accessible by the members of the
closed subscriber group for that CSG identity.
CSG identity: An identifier broadcast by a CSG cell or cells and used by the UE to
facilitate access for authorised members of the associated Closed Subscriber Group.
PEMAX_H
Max uplink TX Power of UE
- 193 -
3.5.7.3 Cell Reselection Evaluation Process in E-UTRAN

3.5.7.3.1 Reselection Priorities Handling
Absolute priorities of different E-UTRAN Freq's or IRAT Freq's may be
provided to the UE through
3
- System Infos (SIB type 3, 4, 5, 6, 7, 8) and/or

- RRC Connection Release message or by
- inheriting from another RAT at IRAT Cell (re)Selection
- The UE shall only perform Cell Reselection evaluation for EUTRAN Freq's & IRAT Freq's listed in System Information for
which the UE were provided with a priority (either through
dedicated signaling or via System Info broadcast)
- If priorities are provided in dedicated signaling, the UE shall
ignore all the priorities provided in System Information
The objective of this section is to point out that in an overlaid multi-RAT
environment the cell reselection based on priorities is of importance for
efficient network operation and crucial for UE's battery life.
Key point of this section is that particular cell re-selection could be used to
determine which RAT should be used for which service-purpose of the UE
so that the utility of the network resources is balanced and optimum while
providing high quality of service (QoS) to the UE and especially avoiding
IRAT-handover as much as possible.
Image description
The UE can be informed about absolute priorities for cell reselection through
System Information broadcast and/or RRC Connection Release message (=
dedicated signaling). Moreover the UE can inherit priorities from other RAT's at
Inter-RAT cell (re-)selection.
Depending on Radio Resource Management algorithms in RAN and/or Core, the

dedicated priorities for Inter-Freq and IRAT reselection can be optimized to suit
the subscribers traffic pattern resp. behavior. However, the algorithm for setting
dedicated priorities and also command the UE in Inter-Feq and/or IRAT-Freq redirections depend on RAN/Core vendor.
[3GTS 36.304 (5.2.4.1)]
Absolute priorities of different E-UTRAN frequencies or inter-RAT frequencies may

be provided to the UE in the system information, in the RRC Connection Release
message, or by inheriting from another RAT at inter-RAT cell (re)selection.
- 194 -

In the case of system information, an E-UTRAN frequency or inter-RAT frequency
may be listed without providing a priority (i.e. the field cellReselectionPriority is
absent for that frequency). If priorities are provided in dedicated signalling, the UE
shall ignore all the priorities provided in system information. If UE is in camped on
any cell state, UE shall only apply the priorities provided by system information from
current cell, and the UE preserves priorities provided by dedicated signalling unless
specified otherwise. When the UE in camped normally state, has only dedicated
priorities other than for the current frequency, the UE shall consider the current
frequency to be the lowest priority frequency (i.e. lower than the eight network
configured values). While the UE is camped on a suitable CSG cell, the UE shall
always consider the current frequency to be the highest priority frequency (i.e. higher
than the eight network configured values), irrespective of any other priority value
allocated to this frequency.
The UE shall delete priorities provided by dedicated signalling when:
the UE enters RRC_CONNECTED state; or
the optional validity time of dedicated priorities (T320) expires; or
a PLMN selection is performed on request by NAS [3GTS 23.122].
Note: Equal priorities between RATs are not supported.

The UE shall only perform cell reselection evaluation for E-UTRAN frequencies and
inter-RAT frequencies that are given in system information and for which the UE has
a priority provided.
The UE shall not consider any black listed cells as candidate for cell reselection.
The UE shall inherit the priorities provided by dedicated signalling and the remaining
validity time (i.e., T320 in E-UTRA, T322 in UTRA and T3230 in GERAN), if
configured, at inter-RAT cell (re)selection.
Note: The network may assign dedicated (also known as individual) cell
reselection priorities for frequencies not configured by system information.
Room for your Notes

BCH
Broadcast Channel
SIB
PLMN
SIM
Subscriber Identity Module
RAN
Radio Access Network (e.g.

UTRAN, GERAN or E-UTRAN)
UTRAN

- 195 -
3.5.7.3.2 Measurement Rules for Cell Re-Selection
The objective of this section is to explain that the UE in LTE needs to

evaluate up to 5 conditions (see color coding in above picture) when
collecting measurements on any neighbor resp. frequency-layer.
The key points of this section are that
1. The serving cell's S-criterion needs to be evaluated by the UE in order to
determine measurements on the same frequency and other frequencies.
2. Beside the S-criterion, the serving cell's absolute priority and the priority of
Inter-Freq and IRAT Freq's needs to be taken into account when to start
measurement collection considering the reception level in the servingCell.
Image Description
- 196 -
Q(rxlevmin): This specifies the minimum required Rx level in the serving cell in
dBm; e.g.: -110 dBm.
S(intraSearch): This specifies the threshold (in dB) for intra-frequency

measurements relative to Q(rxlevmin); e.g. 40 dB RSRP = -110 dBm + 40 dB
= - 70 dBm. This means, as long as the RSRP > -70 dBm the UE does not have
to perform intra-frequency measurements. This saves battery power in UE. Note
that the priority for Intra-Freq neighbor cells should be same as the serving cell.
S(non-IntraSearch): This specifies the threshold (in dB) for E-UTRAN interfrequency and inter-RAT measurements relative to Q(rxlevmin); e.g. 20 dB
RSRP = -110 dBm + 20 dB = - 90 dBm. This means, as long as the
RSCP > -90 dBm the UE does not have to perform measurements on equal or
lower prioritized E-UTRAN inter-Freq's or IRAT Freq's.
S(servingCell) [dB] = RSRP [dBm] Q(rxlevmin) [dBm]

Example: RSRP = -80 dBm S(servingCell) = -80 - (-110) = + 30 dB
S(non-ServingCell,x) is the S(rxlev)-value of other cells, either inter-Freq or IRATneighbor cells or intra-Freq neighbor cell's. Again following calcuation needs to be
done: RSCP(non-ServingCell,x) Q(rxlevmin,x) = S(nonservingCell,x) in [dB]
Detailed Description
When evaluating for reselection purposes cell selection criterion or S(nonServingCell,x), the UE shall use parameters provided by the serving cell in SIB
type 3. Following rules are used by the UE to limit needed measurements:
- If S(intraSearch) is sent in the serving cell and S(servingCell) > S(intraSearch), UE
may choose to not perform intra-frequency measurements.
- If S(servingCell) <= S(intraSearch), or S(intraSearch) is not sent in the serving cell
UE shall perform intra-frequency measurements.
- The UE shall apply the following rules for E-UTRAN inter-frequencies and inter-RAT
frequencies which are indicated in system information and for which the UE has
priority provided as defined in previous section Reselection Priorities Handling:
For an E-UTRAN inter-frequency or inter-RAT frequency with a reselection

priority higher than the reselection priority of the current E-UTRA frequency
the UE shall perform measurements of higher priority E-UTRAN interfrequency or inter-RAT frequencies.
For an E-UTRAN inter-frequency with an equal or lower reselection priority

than the reselection priority of the current E-UTRA frequency and for interRAT frequency with lower reselection priority than the reselection priority of
the current E-UTRAN frequency:
If S(non-Intrasearch) is sent in the serving cell and S(servingCell) >

S(non-IntraSearch) UE may choose not to perform measurements
of E-UTRAN inter-frequencies or inter-RAT frequency cells of equal
or lower priority.
If S(servingCell) <= S(non-IntraSearch) or S(non-IntraSearch is not
sent in the serving cell the UE shall perform measurements of EUTRAN inter-frequencies or inter-RAT frequency cells of equal or
lower priority.
Where S(servingCell) is the S(rxlev)-value of the serving cell.

[3GTS 36.304 (5.2.4.2)]
Lessons learned from UMTS Rel. 99 Hierarchical Cell Structure:
The HCS-feature effects UE's battery life.
Note: Without HCS, the UE will not search for any neighbors until
S(intraSearch_UTRAN) is reached. So if the Ec/N0 of the serving cell is good, power
consumption in UE is very low. But With HCS, the UE will constantly search for
neighbors with a higher HCS priority regardless of the Ec/N0 of the serving cell. What
Operator have noticed is that these searches (every DRX cycle) consume quite a bit
of power especially if the neighbors are on another FDD frequency. Moreover, due to
peculiar Femto cell deployment every UMTS macro cell has by default Femto
neighbor relations even if no Femtos exist in that area. This process has to be this
way, as the Operator does not know where Femtos will be powered on by the
subscriber's. So the UE will constantly scan for these neighbors every DRX cycle
trying to detect and measure them.
- 197 -
3.5.7.3.3 Mobility States in E-UTRAN
The objective of this section is to explain that LTE uses similar UE speed
detection method like UMTS defined in Rel. 5 (note that in UMTS of Rel. 99
the speed detection was only possible with Hierarchical Cell Structure
activated and then the UE reselected based on mobility/speed certain
Frequency Layer).
The key points of this section are:
1. The mobility detection of either Normal, Medium or High just influences
the scaling of the timer for Reselection (Treselection) but does not favor a
particular reselection behavior towards certain Frequency Layers (having
certain priorities). One could have specified that the UE in High Mobility
State preferably reselects Macro-cells which then the operator needs to
prioritize in order to reduce the amount of cell changes/reselections, but this
was not standardized in LTE but rather the case in UMTS of Rel. 99.
2. The UE needs to have a mechanism in place to track the number of
reselections in a certain period, e.g. sliding window mechanism or a ringbuffer where the UE logs the time-stamp when a reselection happens as well
counts the occurred reselections within T(CR_max) and T(CR_maxHyst)
time.
Note that the eNB is not aware about UE's mobility state when UE is in Idle state. In
connected state the eNB can determine UE's speed by counting the # of HO's in a
period of time and may decide on different RRM resp. Handover algorithms.
- 198 -
Image Description
1. The UE is considered in High Mobility State as it changes within 60 s more
than 12 cells.
2. The UE has to consider itself in Medium Mobility as it changes within 60 s
more 8 cells but less than 12 cells.
3. During a time of 120 s the UE has less than 8 cell reselections performed
and must therefore itself consider as slow moving Normal Mobility.
Besides Normal-mobility state a High-mobility and a Medium-mobility state are
applicable if the parameters (T(CR_max), N(CR_H), N(CR_M) and T(CR_maxHyst)
are sent in the SIB type 3 (and also contained in IE 'MeasConfig' of RRC Connection
Reconfiguration message) in broadcast of the serving cell.
3GTS 36.304 (5.2.4.3)]
State detection criteria:
Medium-mobility state criteria:

- If number of cell reselections during time period T(CR_max) exceeds
N(CR_M) and not exceeds N(CR_H)
High-mobility state criteria:

- If number of cell reselections during time period T(CR_max) exceeds
N(CR_H)
The UE shall not count consecutive reselections between same two cells into
mobility state detection criteria if same cell is reselected just after one other
reselection.
State transitions:
The UE shall:
- if the criteria for High-mobility state is detected:
- enter High-mobility state.
- else if the criteria for Medium-mobility state is detected:
- enter Medium-mobility state.
- else if criteria for either Medium- or High-mobility state is not detected during time
period T(CR_maxHyst):
- enter Normal-mobility state.
If the UE is in High- or Medium-mobility state, the UE shall apply the speed
dependent scaling rules as defined in next section Scaling Rules.
Abbreviation of this Section:
N(CR_H)
Number of cell reselections

High
T(CR_max)
Timer for guarding cell reselections
N(CR_M)
Number of cell reselections

Medium
T(CR_max
Hyst)
Hysteresis timer for guarding cell

reselections
- 199 -
3.5.7.3.4 Scaling Rules based on Mobility State
The objective of this section is to highlight that additional to Medium- and

High mobility detection the UE can be optional configured to apply a
reduction of the Treselection timer and/or an increase of the hysteresis for
the LTE serving cell in order to lift up serving cell's ranking value R(s).
1. The scaling resp. reduction of the Treselection timer can be configured
RAT-specific (e.g. individual for E-UTRAN-, UTRAN- or GERAN- Freqlayer's)
2. In order to reduce the fading effects of moving UE's having a high velocity
in E-UTRAN, the LTE serving cell can be promoted by different hysteresis
values depending on Medium- and High- Mobility state. An increased
hysteresis reduces Ping-Pong reselections in fast changing radio
environment.
Image Description
The scaling resp. reduction of Treselection timer (~ RAT-specific scaling) is done
independently of the neighbors RAT and priority. On the other side the hysteresis
is only used in the cell ranking for serving cell and for neighbor cells of intra-Freq and
- 200 -

equal priority inter-Freq neighbors. Thus the increase of hysteresis has no effect in
reselection conditions e.g. between LTE and GERAN or LTE and UTRAN as ranking
is not used between RAT's! For IRAT reselections (and reselections between
different prioritized LTE Freq-layers) thresholds and priority of IRAT and Inter-Freq
neigbhors are only considered. This is explained in the next sections.
UE shall apply the following scaling rules:
If neither Medium- nor High-mobility state is detected:

- no scaling is applied.
If High-mobility state is detected:

- Add the sf-High of "Speed dependent ScalingFactor for Qhyst to Qhyst if
sent via SI (= System Info)
- For E-UTRAN cells multiply Treselection_EUTRA by the sf-High of "Speed
dependent ScalingFactor for Treselection_EUTRA if sent via SI
- For UTRAN cells multiply Treselection_UTRA by the sf-High of "Speed
dependent ScalingFactor for Treselection_UTRA if sent via SI
- For GERAN cells multiply Treselection_GERA by the sf-High of "Speed
dependent ScalingFactor for Treselection_GERA state if sent via SI
<snip>
If Medium-mobility state is detected:

- Add the sf-Medium of "Speed dependent ScalingFactor for Q(hyst) for
medium mobility state" to Q(hyst) if sent on system information
- For E-UTRAN cells multiply Treselection_EUTRA by the sf-Medium of
"Speed dependent ScalingFactor for Treselection_EUTRA" if sent on SI
- For UTRAN cells multiply Treselection_UTRA by the sf-Medium of "Speed
dependent ScalingFactor for Treselection_UTRA" if sent via SI
- For GERAN cells multiply Treselection_GERA by the sf-Medium of "Speed
dependent ScalingFactor for Treselection_GERA" if sent via SI
<snip>
Note that the scaling of Treselection for CDMA_HRPD and CDMA_1XRTT is skipped
on purpose for simplicity reasons and not shown in the picture.
Note: In case scaling is applied to any Treselection_'RAT' parameter the UE shall
round up the result after all scalings to the nearest second.
[3GTS 36.304 (5.2.4.3.1), 3GTS 36.331 (6.3.1)]

1XRTT
1 times Radio Transmission

Technology, with same RF
bandwidth as IS-95: a duplex
pair of 1.25 MHz
Hyst
Hysteresis
E-UTRA
Enhanced UMTS Terrestrial

Radio Access
RAT
Radio Access Technology
GERA
GERAN Radio Access
SI
Here: System Information
HRPD
High rate packet data
SF
Scaling Factor
- 201 -
3.5.7.4 E-UTRAN Inter-Freq and IRAT Cell Reselection Criteria
The objective of this section is to highlight that LTE's Inter-Freq and IRAT
cell reselection is not based, compared to UMTS, on cumbersome ranking
among different neighbors of various RAT's and Frequencies but just on the
simple RX-level threshold's individual set for Inter-Freq and IRAT neighbor's.
1. Inter-Freq & IRAT-neighbors of higher priority are reselected by UE if their
RSCP (UTRAN neighbor) or RXLEV (GSM/EGPRS neighbor) or RSRP (LTE
neighbor) exceed an absolute value of Q(rxlevmin,x) + Thresh(x,high).
2. The UE gets informed when camping in LTE about minimum required RXlevel's [in case of UMTS-FDD also Q(qualmin)] of other RAT's or other LTE
Frequencies via the relevant SIB's: SIB-type 5, SIB-type 6, SIB-type 7 and
SIB-type 8 broadcast the respective Q(rxlevmin) per RAT/Frequency.
3. The UE gets through the same E-UTRAN SIB's informed about the
required threshold's(x,high) per RAT and LTE-Freq which must be exceeded
by the RAT or LTE-Freq specific Q(rxlev,x) for time-period of
Treselection_RAT ; only then reselection towards RAT/Freq-x is allowed.
- 202 -

Details on Inter-Freq and IRAT Cell Reselection
For GERAN, UTRAN, and E-UTRAN, S(non-ServingCell,x) is the S(rxlev)-value of an
evaluated cell; Q(rxlevmeas) is the measured reception level in RAT- or Freq-x.
S(non-ServingCell,x) = Q(rxlevmeas,x) Q(rxlevmin,x)
For UTRAN FDD, there is an additional condition to be fulfilled for cell reselection.
The measured Ec/No must be above an minimum value:
3
UMTS-FDD: S(qual) > 0 S(qual) = Q(qualmin) Q(qualmeas).
Note that Q(qualmeas) is the measured Ec/No-value in UTRA. The parameter
Q(qualmin) is broadcast in SIB-3 on BCCH to the UE's.
In all the above criteria the value of T(reselection_RAT) [range 0...7 s] is scaled when
the UE is in the medium or high mobility state as explained in previous section.
If more than one cell meets the above criteria, the UE shall reselect a cell ranked as
the best cell among the cells meeting the criteria on the highest priority frequencies
or the highest priority RAT; and if the highest priority RAT is E-UTRA according to
criteria defined in section Intra-Frequency and equal Priority Inter-Freq Reselection
Criteria. [3GTS 36.304 (5.2.4.5)]
The IE ReselectionThreshold [= Thresh(x,high)] is broadcast per Frequency Layer
to enforce an RSRP or RSCP or RXLEV-threshold defined by the operator.
With such level-thresholds it is easier to control the idle-traffic and have the UE
pushed already on the preferred Freq-layer avoiding handover later-on in connectedmode. Note that in urban dense area's the UE receives signals of up to 3 RAT's and
via more than 3 Frequencies as UMTS may use 2 FDD-Freq's.
Reselection Condition for higher prioritized RAT's or Freq's:
Criteria 1: the S(non-ServingCell,x) of a cell on evaluated frequency is

greater than Thresh(x, high) during a time interval T(reselection_RAT).
Cell reselection to a cell on a higher priority E-UTRAN frequency or interRAT frequency than serving frequency shall be performed if:
A cell of a higher priority E-UTRAN frequency or inter-RAT frequency

fulfills criteria 1; and
more than 1 second has elapsed since the UE camped on the current
serving cell.

S(nonServing,x)
RAT- or Freq-x specific value

above Q(rxlevmin,x)
Q(rxlevmin
,x)
RAT- or Freq-x-specific min

required RX-level
S(qual)
UMTS-FDD specific quality

value based on Ec/No
S(rxlev,x)
RAT- or Freq-x specific value in dB

above minimum required value
Q(qualmin)
Min required Ec/No-value in

UMTS-FDD broadcast by LTE
Thresh(x,
RAT- or Freq-x specific threshold to

be exceeded for priority reselection
RAT- or Freq-x specific

measured reception level
Q(rxlevmeas,
x)
high)
Inter-RAT Neighbor or LTE-Inter

Frequency Neighbor
- 203 -
3.5.7.5 Intra-Freq and equal Priority Inter-Freq Reselection Criteria
The objective of this section is firstly to state that there is a specific ranking
for LTE's intra- and inter-frequency neighbors having the same priority and
secondly to demonstrate how cell ranking criterion R(s) for serving cell and
R(n) for neighboring cells is defined.
Key point of this section are:
1. Neighbor cells belonging to different RAT's or Frequencies are not ranked
against each other as they must have different priority's!
2. Neighbor cells of equal Priority like serving cell are only allowed within the
same RAT, e.g. all E-UTRAN neighbors , even on different frequencies can
be set by the operator to same Priority or all UMTS-FDD neighbor's can
have the same Priority or all GERAN neighbor cells can be configured with
the same Priority.
3. If several higher prioritized neighbor cells fulfilling criteria 1 (see previous
section), there will be also a ranking done among these higher prioritized
cells only according to their S(rxlev).
Image Description
Intra LTE cell reselection (reselection among cells on the same frequency or different
- 204 -

frequency but same priority like serving cell) is based on calculating an so called
Ranking value. The UE adds to measured RSRP-value Q(meas,s) of the LTE-serving
cell a hysteresis value Q(hyst) broadcast in SIB type 3.
36.331 (6.3.1): q-Hyst range = {dB0, dB1, dB2, dB3, dB4, , dB20, dB22, dB24}
The hysteresis promotes the serving cell against all other LTE intra-frequency and
inter-frequency neighbor's having the same priority as the serving cell. The hysteresis
thus helps to reduce Ping-Pong reselections which are particular not desire-able if
they occur on Tracking Area boundaries. Another advantage of the hysteresis is that
just the serving cell needs to be optimized with a certain high dB-value compared to
the alternative which is to specify for every LTE-neighbor cell an Offset-value.
However, the Q(Offset,n) allows an optimized or guided reselection from serving cell
to certain LTE-neighbor cell's as the Offset_s,n is per neighbor relationship
configurable in SIB type 4. Q(offset,n) is also possible per inter-frequency!
36.331 (6.3.1):IntraFreqNeighCellList ::= 1..maxCellIntra)) OF IntraFreqNeighCellInfo
IntraFreqNeighCellInfo ::= { physCellId (= PCI ~ scrambling code),q-OffsetCell}
q-OffsetCell = Q-OffsetRange
Q-OffsetRange is used to indicate a cell or frequency specific offset to be applied
when evaluating candidates for cell re-selection or when evaluating triggering
conditions for measurement reporting. Value range {-24dB, -20dB-6dB, -5dB...
+4dB, +5dB, +6dB, +8dB... + 24dB}
Further Details:
i) Q(offset(s,n)) refers to the offset between serving and neighbor cell
a) for intra-freq: Q(offset) = Q(offset_s,n)
b) for inter-freq: Q(offset) = Q(offset_s,n) + Q(offset_freq)
ii) Q(offset(freq)) refers to freq-specific offset for equal priority E-UTRAN freqs
LTE-Frequency specific Q(offset_freq) in SIB type 5
36.331 (6.3.1): q-OffsetFreq = Q-OffsetRange
DEFAULT= dB0,
This means that for equal prioritized LTE inter-frequency neighbor cells the operator
has the option firstly to promote or discourage reselections by a negative or positive
Q(offset_freq) value. In simple words idle traffic can be shuffled from serving freq to
another LTE-freq. Secondly the operator can again define by Q(offset_s,n) per interfrequency neighbor cell a specific offset to promote or discourage certain
reselections. Note that the frequency specific offset Q(offset_freq) and neighbor ship
specific offset Q(offset_s,n) refer to the same ASN.1 parameter: Q-OffsetRange.
Q(hyst)
hysteresis value for ranking of

the serving cell [dB]
q-OffsetFreq
q-Hyst
Same as Q(hyst), ASN.1 name
Q(offset_freq) Frequency specific offset [dB]
Q(meas)
RSRP-value resp. Q(rxlevmeas)
QOffsetRange
[dBm]
Same as Q(offset_freq),
ASN.1 name in 36.331
ASN.1 parameter name for

neighbor or frequency offset
Q(meas,s)
RSRP-value of serving cell [dBm] Q(offset_s,n)
Offset per neighbor ship
q-OffsetCell
Neighbor cell specific offset [dB]
Receive Signal Ref Power
Q(offset,n)
Neighbor or frequency offset
RSRP
- 205 -
3.5.7.5.1 Cell Ranking Criterion in E-UTRAN for equal Priority

inter-Freq and intra-Freq
The objective of this section is to illustrate the ranking formula for serving cell
and neighbor cells having the same priority. The ranking of the neighbor
cells can be distinguished by intra-frequency and inter-frequency.
Key point of this section are:
1. Intra-frequency and inter-frequency neighbor's have same priority as the
serving cell. Only then the above depicted ranking criterion applies.
2. Equal priorities between different RAT's is not supported resp. allowed.
3. The Q(offset) of inter-frequency = Q(offset_s,n) + Q(offset_freq) whereas
the Q(offset) for intra-frequency = Q(offset_s,n).
Image Description
The cell-ranking criterion R(s) for serving cell and R(n) for neighbouring cells is
defined by:
I) R(s) = Q(meas,s) + Q(Hyst)
II) R(n) = Q(meas,n) + Q(offset)
where:
- 206 -

Q(meas):
Q(offset):
RSRP measurement quantity used in cell reselections.

For intra-frequency: Equals to Q(offset_s,n, if Q(offset_s,n) is valid,
otherwise this equals to zero.
For inter-frequency: Equals to Q(offset_s,n) plus Q(offset_freq), if
Q(offset_s,n) is valid, otherwise this equals to Q(offset_freq).
The UE shall perform ranking of all cells that fulfill the cell selection criterion S, which
is defined in earlier sections of this chapter, but may exclude all CSG cells that are
known by the UE to be not allowed.
The cells shall be ranked according to the R criteria specified above, deriving
Q(meas,n) and Q(meas,s) and calculating the R values using averaged RSRP
results.
If a cell is ranked as the best cell the UE shall perform cell reselection to that cell. If
this cell is found to be not-suitable, the UE shall behave according to Highest ranked
cells with cell reservations, access restrictions or unsuitable for normal camping
being described in 3GTS 36.304 (5.2.4.4). This subject is skipped here for simplicity
reasons!
In all cases, the UE shall reselect the new cell, only if the following conditions
are met:
the new cell is better ranked than the serving cell during a time interval
Treselection_RAT;
serving cell.
[3GTS 36.304 (5.2.4.6)]

SIB
RSRP
UTRAN

- 207 -
3.5.7.6 Cell Reselection towards lower Priority E-UTRAN Freq or

IRAT Freq than Serving Freq
The objective of this section is to give the characteristics of the cell

reselection procedure with special emphasis on lower prioritized E-UTRAN
Freq or IRAT Freq neighbors than serving frequency/cell.
Key points of this section are
1. Four conditions need to be fulfilled in order to let an UE camping on an
LTE frequency/cell reselect towards lower prioritized IRAT frequency or
lower prioritized other E-UTRAN frequency.
2. The ReselectionThresholds for serving cell and neighbor cell are based on
the S-criteria and therefore based on Q(rxlevmin) values of serving cell and
neighbor cell.
3. The S(ServingCell) corresponds to the S(rxlev)-value of the serving cell
and the S(non-servingCell,x)-value corresponds to the S(rxlev)-value of
neighbor cell 'x'.
- 208 -

Image Description
Cell reselection to a cell on a lower priority E-UTRAN frequency or inter-RAT

frequency than serving frequency shall be performed if:
No neighbor cell on a higher priority E-UTRAN frequency or inter-RAT

frequency than serving frequency fulfills the criteria 1 (mentioned in
previous section); and
No neighbor cell on serving frequency or on an equal priority E-UTRAN
frequency fulfills the ranking criteria R(n) > R(s) for Treselection_RAT;
and
S(ServingCell) < Thresh(serving, low) and the S(non-ServingCell,x) of a
cell of a lower priority E-UTRAN frequency or inter-RAT frequency is
greater than Thresh(x, low) during a time interval Treselection_RAT;
and
serving cell.
For GERAN, UTRAN, and E-UTRAN, S(non-ServingCell,x) is the S(rxlev)-value of an

evaluated cell. For UTRAN FDD, S(qual) is higher than 0, as defined in [3GTS
25.304]. For cdma2000 RAT's, S(non-ServingCell,x) is equal to -FLOOR(-2 x 10 x
log10 Ec/Io) in units of 0.5 dB, with Ec/Io referring to the value measured from the
evaluated cell.
For cdma2000 RAT's, Thresh(x, high) and Thresh(x, low) are equal to -1 times the
values signaled for the corresponding parameters in the system information.
In all the above criteria the value of Treselection_RAT is scaled when the UE is in the
medium or high mobility state (explained before in earlier section).
If more than one cell meets the above criteria, the UE shall reselect a cell ranked as
the best cell among the cells meeting the criteria on the highest priority frequencies
or the highest priority RAT.
[3GTS 36.304 (5.2.4.5)]
Room for your Notes

R(n)
Ranking value of neighbor cell
S(rxlev)
R(s)
Ranking value of serving cell
Q(rxlev
min,s)
S-criterion of a cell:
Q(rxlevmeas) - Q(rxlevmin)
S(nonS-criterion of neighbor cell 'x' in Q(rxlev

ServingCell,x) other RAT or different frequency min,n)
Min required reception level in serving

cell for camping and cell selection
Min required reception level in
neighbor cell for cell reselection
S(ServingCell) S-criterion of serving cell
- 209 -
3.6 GERAN to E-UTRAN Cell Reselection

3.6.1 IRAT Measurements when camping in GSM or GPRS
The objective of this section is to highlight that priority-based IRAT neighbor

search also exist in GERAN. The BSS/PCU broadcast IRAT neighbor lists
(UTRAN and/or E-UTRAN) in SI-2quater.
The
key
points
of
this
section
are:
1. The UE can inherit priorities from other RAT when reselecting to GSM.
These priorities are so called dedicated (also known as individual) priorities).
Theses dedicated priorities take precedence over common priorities
broadcast
via
SI-2quater.
2. The network takes care either through dedicated signaling or through
broadcast that UE's in GERAN have received their priorities for every
supported RAT in the network.
For a multi-RAT MS supporting E-UTRA, E-UTRAN frequencies may be included in
the E-UTRAN Neighbor Cell list (SI-2quater). The network controls the
measurements for reselection of E-UTRA cells by the parameter
THRESH_priority_search broadcast on BCCH via System Info 2quater.
The parameter THRESH_priority_search also controls measurement of inter-RAT
cells or frequencies included in the 3G Cell Reselection list when the inter-RAT
cell reselection algorithm based on priority information is used.
- 210 -
When RLA_C of the serving cell is below THRESH_priority_search, the

mobile station shall monitor cells of inter-RAT frequencies of lower priority
than the serving cell.
When RLA_C of the serving cell is above the threshold, the mobile station is
allowed not to monitor cells of inter-RAT frequencies of lower priority than the
serving cell.
The MS shall perform the measurement processes for E-UTRAN and other
access technologies in parallel when applicable.
The mobile station shall monitor cells of inter-RAT frequencies of higher priority than
the serving cell at least once every (60*Nhpf) seconds, where Nhpf is the number of
inter-RAT frequencies of higher priority.
Definition of RLC_C
Note: For the purposes of cell selection and reselection, the MS is required to
maintain an average of received signal levels for all monitored frequencies. These
quantities termed the "received level averages" (RLA_C), shall be unweighted
averages of the received signal levels measured in dBm. The accuracy of the
received signal level measurements for idle mode tasks shall be the same as for
radio link measurements.
[3GTS 45.008 (6.1)]
Maximum number of UTRAN and E-UTRAN neighbors to be monitored when in
GSM
A multi-RAT MS shall be able to monitor cells from other radio access technologies,
divided into (depending on the MS capability):
UTRAN FDD cells on up to 3 FDD frequencies, with a maximum of 32 cells

per frequency; and/or
UTRAN TDD cells on up to 3 TDD frequencies with a maximum of 32 cells

per frequency; and/or
E-UTRAN FDD cells on up to 3 FDD frequencies; and/or
E-UTRAN TDD cells on up to 3 TDD frequencies.

The total number of monitored UTRAN cells shall not exceed 64.
[3GTS 45.008 (6.6.4)]
At inter-RAT cell reselection from UTRAN or E-UTRAN to GERAN, the MS shall
inherit valid individual priority information from the source RAT. In this case the
mobile station shall start timer T3230 with the timeout value set to the remaining
validity time of the corresponding timer from the source RAT (i.e. T320 in E-UTRA,
T322 in UTRA). If more than one valid individual priority applied for GERAN
frequencies while in the source RAT then, following inter-RAT reselection to GERAN,
the mobile station shall apply, as GERAN individual priority, only the one applicable
to the BCCH carrier of the GERAN cell that was reselected, for as long as it is valid
and the mobile station remains in GERAN. In this case the mobile station shall not
apply the other GERAN individual priority(ies) until a further inter-RAT reselection
from GERAN occurs.
NOTE: The network may provide individual priorities information for inter-RAT
frequencies not configured by system information.
- 211 -
3.6.2 IRAT Cell Reselection based on Priority 2G to 3G / LTE

3.6.2.1 Cell Reselection Criteria's
The objective of this section is to describe the three possible cases for IRAT
reselection from GERAN to UTRAN/E-UTRAN based on priority.
1. A MS involved in a CS-voice call will never be handed over towards EUTRAN even the UE is DTM with simultaneous Voice and PS bearer: So
IRAT changes from GSM towards LTE can only take place in Idle mode.
2. Of course once the MS has just a PS-connection (TBF) the MS can either
reselect autonomously ( network control order 0) or controlled through
PCU (NC-2) known as network controlled cell reselection (NCCR) or through
NACC (network assisted cell change from (E)GPRS to UTRAN or E-UTRAN.
A MS supporting E-UTRAN shall support priority based IRAT cell reselection

towards all RATs. The Network shall provide Priority Info if E-UTRAN Freqs are
included in the neighbor cell list!
- 212 -

The algorithm for cell reselection in this section shall be used for inter-RAT cell
reselection if priority information is available to the MS and threshold information is
provided by the network, and if the MS supports priority based inter-RAT cell reselection. A mobile station supporting E-UTRAN shall support priority based interRAT cell re-selection towards all the supported RAT's. A MS not supporting EUTRAN and supporting UTRAN and supporting priority based reselection from
UTRAN to GERAN shall support priority based inter-RAT cell re-selection towards
UTRAN.
The network shall provide priority information if E-UTRAN frequencies are included in
the neighbor cell list; the network may provide priority information if only UTRAN
frequencies are included in the neighbor cell list. If priority information is available to
the mobile station, the algorithm in this section shall be used for inter-RAT
reselection towards all RAT's. The rules regarding which set of priorities is valid at
any given time are defined in 3TS 44.018 (3.2.3) Inter-RAT cell re-selection based
on priority information.
NOTE 1:Priority information means information related to each UTRAN or EUTRAN frequency (e.g. THRESH_UTRAN_high, THRESH_E-UTRAN_high) and
information related to the serving cell (e.g. GERAN_PRIORITY).
NOTE 2:Throughout the specification, the phrase neighbor cell list will include also
the E-UTRAN Neighbor Cell list where appropriate.
The MS shall then reselect a suitable (see 3GPP TS 25.304 for UTRAN and 3GPP
TS 36.304 for E-UTRAN) cell of another radio access technology if the criteria below
are satisfied. S_non-serving_XXX is the measurement quantity of a non-serving
inter-RAT cell and XXX indicates the other radio access technology/mode and is
defined as follows:
for a UTRAN cell, is the measured RSCP value for the cell minus
UTRAN_QRXLEVMIN for the cells frequency;
for a E-UTRAN cell, is the measured RSRP value for the cell minus EUTRAN_QRXLEVMIN for the cells frequency.
For a GSM cell, S_GSM is defined as the C1 value for the cell.
To be continued on next page

to be defined.
- 213 -
Cell Reselection Criteria in details

Cell reselection to a cell of another inter-RAT frequency shall be performed if any of
the conditions below (to be evaluated in the order shown) is satisfied:
1) The S_non-serving_XXX of one or more cells of a higher priority inter-RAT

frequency is greater than THRESH_XXX_high during a time interval
T_reselection; in that case, the mobile station shall consider the cells for
reselection in decreasing order of priority and, for cells of the same inter-RAT
frequency, in decreasing order of S_non-serving_XXX, and reselect the first
cell that satisfies the conditions above;
2) The value of S_GSM is lower than THRESH_GSM_low for the serving cell
and all measured GSM cells during a time interval T_reselection; in this case,
the mobile station shall consider for reselection the inter-RAT cells in the
following order, and reselect the first one that satisfies the following criteria:
2a) cells of a lower priority inter-RAT frequency whose S_non-serving_XXX

is greater than THRESH_XXX_low during a time interval T_reselection;
these cells shall be considered in decreasing order of priority and, for cells of
the same RAT, in decreasing order of S_non-serving_XXX;
2b) if no cells satisfy the criterion above, inter-RAT cells for which, during a
time interval T_reselection, S_non-serving_XXX is higher than S_GSM for
the serving cell by at least a specific hysteresis H_PRIO; these cells shall be
considered in decreasing order of S_non-serving_XXX.
A UTRAN FDD cell shall only be reselected if, in addition to the criteria above, its
measured Ec/No value is equal to or greater than FDD_Qmin FDD_Qmin_Offset.
[3GTS 45.008 (6.6.6)]
Cell reselection to a cell of another radio access technology (e.g. UTRAN or EUTRAN) shall not occur within 5 seconds after the MS has reselected a GSM cell
from an inter-RAT cell if a suitable GSM cell can be found.
If the mobile station applies common priorities and priority information for the serving
cell is missing, the mobile station shall consider any GSM cell (including the serving
cell) to have lowest priority (i.e. lower than the eight network configured values).
If the mobile station applies individual priorities received through dedicated signaling
and priority information is available only for some inter-RAT frequencies, cells
belonging to frequencies for which no individual priority is available or no threshold is
provided by the serving cell shall not be considered for measurement and for cell reselection.
Note that in the next two sections the case 1) and then case 2a) and case 2b) are
shown in greater detail!
- 214 -
Room for your Notes

to be defined.
- 215 -
3.6.2.2 Cell Reselection from GERAN towards higher prioritized

IRAT Frequency
The objective of this section is to describe how the various parameters

broadcast in SI-2quater influence the reselection from GSM/GRPS towards
E-UTRAN and UTRAN cells of higher priority than 2G's priority's. Here we
show the IRAT reselection case 1) stated in previous section!
1. The parameter 'THRESH_priority_search' is the threshold for the GSM
serving cell that controls measurement on inter-RAT cells or frequencies of
lower priority and is based on absolute RXLEV values in dBm. Once the
RXELV of the serving cell falls below this threshold the UE is forced to
search and measure lower prioritized IRAT neighbors.
2. The UE must always search and measure higher prioritized IRAT
neighbors if configured via SI-2quater.
Image Description
Event-1: The signal strength of a higher prioritized IRAT neighbor (e.g. UTRAN or EUTRAN) exceeds the THRESH_XXX_high. From this moment on the UE starts the
Treselection timer. Treselection timer delays the reselection for minimum of 5sec this
adds some hysteresis and avoids ping-pong reselections.
- 216 -

Event-2: The signal strength of the higher prioritized IRAT neighbor is above
threshold TRESH_XXX_high for at least Treselection time. This means the
condition for reselection towards that higher prioritized IRAT neighbor is fulfilled and
the UE shall re-select that IRAT neighbor now.
Event-3: The signal strength of the higher prioritized IRAT neighbor drops below
THRESH_XXX_low. This means that the IRAT neighbor is not longer a preferred
candidate for reselection. The MS would only reselect towards such a weak IRATneighbor in case the C1-value of GSM falls additional below TRESH_GSM_low
which means that GSM-overage is pretty bad.
RXLEV_ACCESS_MIN: Minimum received signal level at the MS, required for
access to the GSM system; range: 0 63 (relative applied to -110 dBm)
THRESH_GSM_low: A threshold below which the MS is allowed to reselect to lower
priority layers; range: 0 = 0 dB, 1 = 2 dB, 2 = 4 dB, , 13 = 26 dB, 14 = 28 dB,
15 = 'infinite' (always).
THRESH_priority_search: A threshold for the serving cell that controls
measurement of inter-RAT cells or frequencies of lower priority when the prioritybased cell reselection algorithm is used; range: 0 = -98 dBm, 1 = -95 dBm,
2 = -92 dBm, , 13 = -59 dBm, 14 = -56 dBm, 15 = 'infinite' (always).
GERAN_PRIORITY: Priority of GSM cells, range: 0 = lowest priority, ,
7 = highest priority.
UTRAN_QRXLEVMIN: Minimum required RX level for cells on the target UTRAN
frequency (dBm), range: 0 = -119 dBm, 1 = -117 dBm, 2 = -115 dBm, ,
30 = -59 dBm, 31 = -57 dBm.
Default value = -119 dBm.
THRESH_UTRAN_FDD_high, THRESH_UTRAN_FDD_low: Reselection thresholds
towards UTRAN FDD cells, range: 0 = 0 dB, 1 = 2 dB, 2 = 4 dB, 3 = 6 dB, ,
30 = 60 dB, 31 = 62 dB.
Default of THRESH_UTRAN_FDD_low = value of THRESH_UTRAN_FDD_high.
UTRAN_PRIORITY: Priority of a UTRAN frequency layer, 0 = lowest priority, ,
E-UTRAN_QRXLEVMIN: Minimum required RX level for cells on the target EUTRAN frequency (dBm), range: 0 = -140 dBm, 1 = -138 dBm, 2 = -136 dBm, ,
30 = -80 dBm, 31 = -78 dBm.
Default value = -140 dBm.
THRESH_E-UTRAN_high, THRESH_E-UTRAN_low: Reselection thresholds
towards E-UTRAN FDD or TDD cells, range: 0 = 0 dB, 1 = 2 dB, 2 = 4 dB, 3 = 6 dB,
, 30 = 60 dB, 31 = 62 dB.
Default value of THRESH_E-UTRAN_low = value of THRESH_E UTRAN_high.
E-UTRAN_PRIORITY: Priority of a E-UTRAN frequency layer, 0 = lowest priority, ,
[3GTS 45.008 (9)]

to be defined.
- 217 -
3.6.2.3 Cell Reselection from GERAN towards lower prioritized

IRAT Frequency
The objective of this section is to show the IRAT reselection case 2a) and
case 2b) towards lower prioritized neighbors of e.g. UTRAN or E-UTRAN.
1. The MS must follow an order in its IRAT reselection based on signal
strength of the IRAT-neighbor's when the coverage resp. C1 value of GSM
serving and neighbor cells is below the threshold THRESH_GSM_low. At
first the IRAT-neighbors whose S-criteria S(non-serving_XXX) is above
threshold THRESH_XXX_low will be considered for reselection case 2a).
2. If no suitable IRAT-neighbor is available (as their S(rxlev)-value is below
THRESH_XXX_low and the coverage of GSM is still below threshold
THRESH_GSM_Low, then the MS should reselect the better cell when the
neighbor cell is stronger by a hysteresis value of H_PRIO for Treselection
time. case 2b)
Image Description
Event-1: The GSM coverage drops below critical threshold defined
THRESH_GSM_Low but no suitable strong IRAT neighbor is available.
- 218 -
by

Event-4: IRAT Reselection case 2b) is shown here. The GSM coverage is bad and
below threshold THRESH_GSM_Low and at the same time no IRAT-neighbor has a
signal strength which is above threshold THRES_XXX_high. But for a period of time
Treselection the IRAT-neighbor's S(non-ServingCell,x) exceeds S(GSM,serv) by
hysteresis value H_PRIO.
Event-2: Here the signal of the lower prioritized IRAT neighbor cell 'x' takes a
different trend. The S(rxlev) of the lower prioritized IRAT neighbor exceeds threshold
TRESH_XXX_low.
Event-3: IRAT Reselection case 2a) is shown. The GSM coverage expressed by
S_GSM (= C1-value) is below threshold THRESH_GSM_low but the S(rxlev) of an
IRAT neighbor cell is above minimum required signal strength expressed by
threshold THRESH_XXX_low for Treselection time.
The UE shall reselect in either case 2a) or in case 2b) the IRAT neighbor 'x'.
H_PRIO: Hysteresis used in the priority reselection algorithm, range:
0 = infinite (rule disabled), 1 = 5 dB, 2 = 4 dB, 3 = 3 dB.
T_reselection: Time hysteresis in the reselection algorithm, range:
0 = 5 sec, 1 = 10 sec, 2 = 15 sec, 3 = 20 sec.
Qsearch_C_E-UTRAN_Initial: Indicates the Qsearch value to be used in dedicated /
dual transfer mode before Qsearch_C_E-UTRAN is received,
Search for E-UTRAN cells if signal level below threshold (0-7):
- 98, - 94, , - 74 dBm, infinite (always)
or above threshold (8-15): - 78, - 74, , - 54 dBm, infinite (never)
[3GTS 45.008 (9)]
to be defined.
- 219 -
- 220 -
Lower Layers of the Uu-Interface: MAC, RLC & PDCP
Chapter 4:
Objectives
What are tasks and functions of MAC, RLC and PDCP?
Which format do MAC- RLC- and PDCP-PDU's use?
How does random access procedure look like in LTE MAC?
How are MAC, RLC, and PCDP configured?
How is a TCP/IP frame traveling trough the L2 protocol stacks?
- 221 -
4.1 Features of MAC

4.1.1 Overview
The objective of this section is to introduce the key features of the medium
access control layer.
Key point of this section is that for the MAC the chance has been taken to
tune many concepts such that they fit to PS services from the start.
4.1.1.1 Data transfer logical channels transport channels

This function is similar to HSPA. The big difference it that two TBs per UE can be
transferred at the same time.
4.1.1.2 Radio resource allocation
For the radio resource allocation there is a very significant change for the RACH.
Here there is not the possibility to map user plane data on the RACH.
For HARQ the basic concepts of HSPA are retained however the HARQ is a lot
faster then in HSPA. Also the parameters and implementation details will differ.
For the priority concept a quite similar approach than in HSPA will be taken. However
detains are not specified yet.
- 222 -
4.1.1.3 Special procedures

Special procedures like timing advance and DRX are also handled by. The DRX
procedure works with two DRX cycles. Once the UE does not get any scheduling for
a certain time the short DRX cycle is applied and once it is not getting any scheduling
for another certain time a long DRX cycle is applied. MAC is able force the UE into
DRX at any time (once configured).
[3GTR 25.813 (5.3.1), 3GTS 36.300 (6.1), 3GTS 36.321 (4.4)]
Room for your Notes

4

3GTR
MAC
3GTS

Specification
PS
Packet Switched
DRX
QoS
Quality of Service
HARQ
Hybrid ARQ
RACH
HSPA
High Speed Packet Access (operation TB

of HSDPA and HSUPA)
Transport Block
- 223 -
4.1.2 Radio Network Temporary Identifiers (RNTI's) in E-UTRAN

4.1.2.1 Usage of RNTI's
The objective of this section is to illustrate the usage of the different RNTI's
in E-UTRAN.
Key point of this section is that besides the normal scheduling the RNTI's
also facilitate MAC and physical layer control procedures.
- 224 -

C-RNTI

Identifier
PUCCH
CCCH
PUSCH
DCCH
RA-RNTI
Random Access Radio Network

Temporary Identifier
DL
Downlink
RNTI
DL-SCH
SI-RNTI
System Information Radio Network

DTCH
TPC
Transmit Power Command

TPCPUCCHRNTI
Transmit Power Control Physical

Upling Control CHannel Radio
Network Temporary Identifier
MAC
TPCPUSCHRNTI

Upling Shared CHannel Radio
P-RNTI
Paging Radio Network Temporary

Identifier
TX
Transmit
PCCH
UL
Uplink
PCH
Paging Channel
UL-SCH
PDCCH
Physical Downlink Control Channel
UTRAN

- 225 -
4.1.2.1 RNTI Values
The objective of this section is to show what RNTI can assume what values.
Key point of this section is that some RNTI's are preconfigured by the
standard and some others are configured by SIB2.
- 226 -

C-RNTI

Identifier
SI-RNTI
System Information Radio Network

P-RNTI
Paging Radio Network Temporary

Identifier
SIB
RA-RNTI

TPCPUCCHRNTI

Upling Control CHannel Radio
RNTI
TPCPUSCHRNTI

Upling Shared CHannel Radio
- 227 -
4.1.3 MAC Random Access Procedure

4.1.3.1 Contention Based Random Access Procedure
The objective of this section is to show the contention based random access
procedure from the MAC perspective.
Key point of this section is that the contention based random access
procedure can be used for all purposes: Initial access, handover, RRC
connection reestablishment and initiation of transmission of data in
RRC_CONNECTED .
- 228 -
Image description
This picture is visualizing the contention based random access procedure. In

case the treatment is different in the different access cases the colors are
different from black.
Room for your Notes

AS
RRC
C-RNTI

Identifier

NNECTED
DL
Downlink
TA
Timing Advance
DL-SCH
TX
Transmit
eNB
Enhanced Node B
UE
User Equipment
ID
Identity
UL
Uplink
MAC
UL-SCH
RA-RNTI

- 229 -
Here collisions are possible because the UE decides when and how exactly a
random access is initiated. Then it is possible that two UEs transmit the same
preamble at the same time. The chosen preamble is 1 out of 64 preambles and is
thus encoding 6 bits. The cluster of the chosen preamble signals the length of the
following scheduled transmission in the UL. As well the UE might chose from
different RACH resources on different RB's and different subframes within a radio
frame.
3 ms after the final subframe of a PRACH preamble (keep in mind that a PRACH
preamble might take more than 1 ms!) the Random Access Response Window
begins. In this window the eNB might transmit its random access response. It is 2,
3, ..., 8, 10 ms long. The RA-RNTI gives information about the referred subframe for
the PRACH preamble, and the used RB's of the PRACH preamble. Inside the
random access response there is an identifier for the referred PRACH preamble, the
adjusted TA, an UL-grant and a temporary C-RNTI. This C-RNTI becomes
permanent once the procedure is succeeding for the case of initial access.
As for all UL scheduling the scheduled TX has to happen 4 ms after the scheduling
indication (here random access response) has started. In case of the initial access
the UE will include its NAS-UE ID in the RRC connection establishment request
message. This can be only an S-TIMSI or an 4 bit random number - an IMSI cannot
be transmitted here. Other scenarios include a C-RNTI either in the MAC-PDU or in
the RRC messages. Once a C-RNTI is given by the UE this will replace the
temporary C-RNTI issued in the random access response.
After the scheduled TX the UE will wait for a some time (8, 16, , 64 ms) for the
contention resolution response. Once two UE's have sent their scheduled TX it has to
be decided which one if any is prevailing. Contention resolution is performed
regardless whether connectivity to the core has been achieved before or not.
Contention resolution can be achieved in two ways: Either the C-RNTI (coming from
the UE) is used to schedule the DL transmission or the MAC-PDU is containing the
NAS-UE ID.
Once the UE has not received a contention resolution in the given time it will
reattempt another random access procedure.
Once the UE is RRC connected and assumed not to be synchronized any more
(e.g. timer expires) a random access procedure has to be performed before data
is transmitted. This is as well the case once the scheduling request procedure is
failing or not configured.
[3GTS 36.300 (10.1.5), 3GTS 36.321 (5.1)]
- 230 -
Room for your Notes

3GTS

Specification
RA-RNTI

AS
RB
Resource Block
C-RNTI

Identifier
RRC
DL
Downlink

NNECTED
DL-SCH
S-TMSI
SAE Temporary Mobile Subscriber

Identity
eNB
Enhanced Node B
TA
Timing Advance
ID
Identity
TX
Transmit
IMSI

Identity
UE
User Equipment
MAC
UL
Uplink
NAS
Non-Access-Stratum
UL-SCH
- 231 -
4.1.3.2 Non-contention based random access procedure
The objective of this section is to show the contention free random access
procedure from the MAC perspective.
Key point of this section is that the contention free random access procedure
can be used only for network trigged purposes: handover and initiation of
transmission of DL data in RRC_CONNECTED.
Image description
- 232 -
This picture is visualizing the contention free random access procedure. In case
the treatment is different in the different access cases the colors are different from
black.

The difference to the contention based random access procedure is that the UE gets
assigned a specific random access preamble and a random access resource (RB's
and subframes in a radio frame) (e.g. during handover, etc.). Then the UE will use
the preamble assigned and will get an UL grant related to its service directly together
with its TA. Here, of course, a contention resolution is not necessary. The UE will
have a C-RNTI already.
The difference in timing in-between PDCCH orders and RRC connection
reconfigurations is that a reconfiguration has a the timer T304 giving the
procedure 50,100, 150, 200, 500, 1000, 2000 ms time to succeed with with
possible multiple tries. The PDCCH order allocates only one attempt and has no
timer attached.
4
[3GTS 36.300 (10.1.5), 3GTS 36.321 (5.1)]
Room for your Notes

3GTS

Specification
RB
Resource Block
C-RNTI

Identifier
RRC
DL
Downlink

NNECTED
DL-SCH
TA
Timing Advance
eNB
Enhanced Node B
TX
Transmit
MAC
UE
User Equipment
PDCCH
UL
Uplink
RA-RNTI

UL-SCH
- 233 -
4.1.4 Structure of MAC-PDU
The objective of this section is to provide the structure of the MAC PDU.
Key point of this section is that the LTE MAC PDU does usually only contain
1 SDU per logical channel.
Image description
This picture is visualizing the structure of the header and the sequence of SDUs
in the MAC PDU.
The non-transparent MAC PDU is transmitting with its SDUs one or several RLCPDUs at a time. Unlike in UMTS standards (prior to R7) the size of the RLC PDU is
flexible such that it can fit the size of the MAC PDU it is mapped to. Since both MAC
and RLC are located in the eNB,
- 234 -

the MAC knows the size of the TB it can transmit (transmission opportunity). In case
there are more than one logical channel active for the corresponding user, the MAC
has to multiplex the different logical channels on the TB. Most likely it could e.g. map
the highest priority logical channels SDU on the TB. For this it will ask for an SDU
with fitting size such that no or only minimum padding is necessary. In case the RLC
cannot fill the TB fully the MAC will add the next lower priority logical channel on the
TB and so forth until the TB is full.
The structure of the MAC PDU and its header are accomplishing this function. First
the MAC header is structured in sub headers in order to indicate several MAC SDUs.
Since MAC in LTE is also fulfilling control functions there are two sub-header formats
and SDU structures:
4.1.4.1 MAC control element
Some LCIDs are reserved for control elements and 1 LCID is indicating padding.
The MAC control elements are explained in the next section. None and more then 1
MAC Control field are also possible.
4.1.4.2 Normal (non-transparent) MAC SDU

In order to do transport normal MAC PDUs the MAC sub header has triplets of
information elements:
1. There are two reserved bits.
2. The E (End) field which is indicating the end of the MAC header (1) or more
triplets following (0).
3. The LCID (Logical Channel ID) which is indicating the logical channel used in a
similar fashion than the C/T field in UMTS (4 bits).
Once there is no padding the last normal MAC SDU will not generate the
following two header fields:
4. The F field is indicating the length of the following length field (7 or 15 bit)
5. The L (Length) field indicating the length of the corresponding SDU. F and L
field are very close to RLC PDU in UMTS.
Padding will only be used if no further SDU can be filled in or if no more RLC data is
ready to be transmitted and there is still space in the TB. In order to avoid
unnecessary extensive padding MAC may reduce the TB size in order to reduce
interference in the network.
4.1.4.3 Transparent MAC SDU
For the BCCH and the PCCH there is also a transparent MAC PDU defined.
[3GTS 36.321 (6)]
3GTS

Specification
RLC
Radio Link Control
LCID
Logical Channel ID
SDU
Service Data Unit (the payload of a

PDU)
LTE
TB
Transport Block
MAC
UMTS

System
PDU

Unit
eNB
Enhanced Node B
- 235 -
4.1.5 MAC Control Elements
The objective of this section is to provide different kinds of MAC control

elements.
Key point of this section is functions like RACH response, buffer status
report and timing advance are dealt with in MAC control elements.
Image description
These two tables are showing the MAC control elements in UL and DL.
Part of the LCIDs are reserved for MAC control elements which are serving physical
layer or MAC functions. The length of some MAC control elements is still under
discussion but the purpose is quite clear. Please keep in mid that some LCIDs are to
be reserved for yet unknown MAC control elements.
- 236 -
4.1.5.1 Contention resolution ID

This is the response of the Random Access Burst sent by the UE. It contains the
NAS ID of the UE.
4.1.5.2 Timing Advance
This MAC control element is used for timing advance updates.
4.1.5.3 DRX
With this MAC control element the DRX is configured similar like in the HS-DSCH
orders in UMTS R7. Since only DRX is to be commanded here this MAC control
element contains no data. Just a header field is used here. Once the DRX field is
present the UE goes to DRX unconditionally (DRX needs to be configured).
4.1.5.4 Padding
Padding is no MAC control element but is also indicated with a special LCID value.
4.1.5.5 Power headroom report

This is the margin the transmission power can still be increased until the maximum
transmission power of the UE is reached.
4.1.5.6 C-RNTI
This is the temporary CRNTI during the contention based random access procedure.
4.1.5.7 Short, long and truncated buffer status reports
Here the UE can report the occupancy of its UL buffer. There are two formats long
and short buffer reports. With the long buffer report multiple logical channel groups
buffer status is reported.
[3GTS 36.321 (6)]
3GTS

Specification
MAC
DL
Downlink
RACH
DRX
UE
User Equipment
HS-DSCH High Speed Downlink Shared

Transport Channel (3GTS 25.211,
25.212, 25.308)
UL
Uplink
ID
Identity
UL-SCH
LCID
Logical Channel ID
UMTS

System
- 237 -
4.1.6 Practical Exercise: MAC Operation
The objective of this section is to repeat the MAC operation in detail using
the RRC Connection Establishment Procedure.
- 238 -

Question No 22: The picture shows the RRC Connection Establishment Procedure
on MAC level. Please fill out the blanks.
The first line of an arrow contains the name of the Logical (Transport or Physical)
channel. Then in case of a logical channel the RB. Then in brackets the message
or indication.
The second line contains the time in ms. In case there is a time span possible take
the shortest possible time. Assume that a L3 reaction cannot be faster than a L1
reaction (4 ms).
4
The third and fourth line contain the content of the message or MAC PDU.
Abbreviations of this Section: SRB

ACK
Acknowledgement
PDCCH
C-RNTI

Identifier
PDU

Unit
CCCH
PHICH

Indicator Channel
DCCH
PLMN
DL-SCH
PRACH
eNB
Enhanced Node B
RA-RNTI

ID
Identity
RB
Radio Bearer
L1
Layer 1 (physical layer)
RRC
L3
Layer 3 (network layer)
SRB
MAC
TA
Timing Advance
MMEI
MME Identity
UE
User Equipment
NAS
Non-Access-Stratum
UL-SCH
- 239 -
4.1.7 Practical Exercise: DL MAC PDU Construction
The objective of this section is to repeat the structure of the MAC PDU.
Question No 23: In the above picture a DL MAC PDU needs to be constructed.

Please fill in the bits of the MAC header, count the bytes used and name the
logical channel being transmitted. Do not forget the MAC control elements. In the
payload section please enter the number of bytes for what logical channel being
transmitted. Below you find how the RB's that are configured and what data /
information is waiting for transmission. Mark which fields are not used (header and
payload).
LCH
LCID
Bit to TX
Use
DCCH 1
1
200
SRB1
DCCH 2
2
0
SRB2
DTCH 1
3
0
Default EPS Bearer for IMS
DTCH 2
4
320
Dedicated EPS Bearer for VoIMS
DTCH 3
5
0
Default EPS Bearer for Internet
DTCH 4
6
416
Dedicated EPS Bearer for Internet
DTCH 5
7
10000
Default EPS Bearer for email
The eNB would like to transmit a TA update to the UE.
The eNB is congested and has decided to put the UE in DRX.
The eNB has a transmission opportunity of for a 1000 bit TB.
- 240 -
Abbreviations of this Section: SRB

DCCH
MAC
DL
Downlink
PDU

Unit
DRX
RB
Radio Bearer
DTCH
SRB
eNB
Enhanced Node B
TA
Timing Advance
EPS
TX
Transmit
IMS

UE
User Equipment
LCH
Logical CHannel
Voice over IMS
LCID
Logical Channel ID
VoIMS
- 241 -
4.1.8 MAC Configuration

4.1.8.1 MAC Configuration in the Standard
the MAC configuration.
Key point of this section is that the default config. saves message space.
- 242 -


BSR
Buffer Status Report
MAC
DL
Downlink
PHR
Power Headroom Report
DRX
TTI
Transmission Time Interval
HARQ
Hybrid ARQ
TX
Transmit
IE
Information Element
UL-SCH
- 243 -
4.2 Features of RLC

4.2.1 Overview
The objective of this section is to introduce the key features of the radio link
control layer.
Key point of this section is the RLC stays intact to the most part once it is
compared to HSPA operation.
4.2.1.1 Data transfer
At the first glance the RLC is only not altered very significantly. However that the
second glace it could be noticed that for RLC the ciphering is missing and that
compared the HSPA LTE can provide TM data transmission again. Another special
point is the duplicate deletion in case of a handover. During the handover the
received buffer is exchanged in-between source and target eNB (AM only). In HSPA
duplicates for the UL are deleted in MAC-es whereas the duplicates are deleted as
well in the RLC for the legacy UMTS traffic. The variable RLC PDU size has to be
mentioned here again.
4.2.1.2 Error detection and recovery
There is nothing to be added to what is stated in the picture.
- 244 -
4.2.1.3 Reset
There is nothing to be added to what is stated in the picture.
[3GTR 25.813 (5.3.2), 3GTS 36.300 (6.2), 3GTS 36.322 (4.4)]
Room for your Notes

3GTR
PDCP
3GTS

Specification
RLC
Radio Link Control
AM
TM
ARQ
Automatic Repeat Request
UL
Uplink
HSPA
High Speed Packet Access (operation UM

of HSDPA and HSUPA)
LTE
UMTS

System
MAC
eNB
Enhanced Node B
MAC-es
MAC-E-DCH SRNC (3GTS 25.321)
- 245 -
4.2.2 Structure of RLC PDU
The objective of this section is to provide the structure of the RLC PDU.
Key points of this section are that the LTE RLC PDU can contain segmented
PDCP PDUs and that the RLC PDU size fits to the individual TB size to be
transmitted.
Image description
in the RLC PDU.
Like in UMTS there are 3 transmission modes for the RLC: TM, UM, and AM. For the
TM the structure of the RLC PDU is simple: It is transparent for the PDCP data.
For the UM and AM mode there is a header and one or more PDCP PDUs being the
RLC SDUs. Note here that the PDCP PDUs can be segmented in the RLC.
Optionally, like in UMTS for AM only, a Status PDU cannot be at the end of the RLC
PDU.
- 246 -

The header comprises the following information elements:
1. The D/C field is a reserved bit in UM. In AM it is indicating the presence of a
RLC control PDU (status report). A status report must not be piggy backed
at the end of the RLC PDU.
2. The RF field is a reserved bit in UM. In AM it is indicating the presence of
re-segmentation. This occurs once an already segmented PDCP PDU is in
need to be retransmitted and further segmented.
3. The polling flag is a reserved bit in UM. In AM it is encouraging the RLC of
the receiver side to sent status PDUs.
4. In case of a 5 bit SN version UM PDU the first 3 fields are missing.
5. The FI filed exists in both AM and UM. It is indicating the presence of PDCP
PDU segment in the RLC PDU. In case of the presence of segments and
AM the header is extended by two bytes as described in the next section.
6. The SN (Sequence Number) which is indicating the RLC sequence number
of the RLC PDU. The length of this field can be the same in AM and UM.
However there is also an UM mode with 1 byte header and 5 bit SN filed
and no reserved bits.
7. An E field (Extension) which is indicating with (0) that data is following and
with (1) that an extension of LI (Length Indicator) and another E filed is
following.
8. The LI field (Length Indicator) of yet unknown length is indicating the length
of the PDCP PDU. Please note since there is also a length indication in the
MAC PDU one LI field in the RLC PDU is redundant.
9. Padding in the header is necessary since the E and LI field to not fill two
bytes. In case of an even number of RLC SDUs 4 bit padding is needed to
fill up the RLC header to the byte boundary.
[3GTS 36.322 (6)]

3GTS

Specification
RF
Radio Frequency
AM
RLC
Radio Link Control
FI
Framing Info
SDU

PDU)
LI
Length Indicator
SN
Sequence Number
LTE
TB
Transport Block
MAC
TM
PDCP
UM
- 247 -
4.2.3 Structure of RLC AM with PDCP PDU Segments
4
The objective of this section is to provide the structure of the RLC AM PDU
with a segment header.
Key point of this section is that only in case of PDU segments in the first
RLC SDU the header is extended for carrying the additional information
about RLC PDU segments.
Image description
This picture is visualizing the structure of the header and SDU in the RLC AM
PDU segment PDU.
In case the first RLC SDU is a segment the RLC AM PDU is containing two additional
header information elements:
1. The LSF (Last Segment Flag) is set once the PDCP PDU segment is the
last segment of the PDCP PDU.
2. The SO (Segment Offset) is determining the offset in the PDCP PDU
segment inside the PDCP PDU.
[3GTS 36.322 (6)]
Room for your Notes
- 248 -
Room for your Notes

3GTS

Specification
PDU

Unit
AM
RLC
Radio Link Control
ARQ
SN
Sequence Number
LSF
Last Segment Flag
SDU

PDU)
LTE
SO
Segment Offset
PDCP
- 249 -
4.2.4 RLC Configuration

4.2.4.1 RLC Configuration in the Standard
the RLC configuration.
Key point of this section is that the default config. saves message space.
- 250 -


AM
SN
Sequence Number
DL
Downlink
SRB
IE
Information Element
UL
Uplink
PDU

Unit
UM
RLC
Radio Link Control
- 251 -
4.3 Features of PDCP

4.3.1 Overview
The objective of this section is to introduce the key features of the packet
data convergence protocol.
Key point of this section is that encryption and PDCP for the control plane
are the functions which have been added to the PDCP compared to UMTS.
4.3.1.1 RoHC
Dependent on the used packet data protocol different schemes will be deployed.
4.3.1.2 Numbering of PDCP PDUs
The numbering of the PDCP PDUs is very important because during the handover it
is the PDCP which will forward the data in the buffer to the target eNB.
4.3.1.3 In-sequence delivery of PDUs
Once the data is forwarded during handover it can happen that data is coming in
already in the target eNB and there might still come some data in form the source
eNB. The data is then not in sequence and there might be some duplicates in the
buffer of the PDCP.
4.3.1.4 Duplicate deletion
See above.
- 252 -
4.3.1.5 Encryption
The encryption algorithms have been located in the MAC and in the RLC for UMTS
and HSPA operation. In LTE they are transferred to the PDCP. This is due to the fact
that every eNB is equipped with its own keys and that the PDCP has to combine the
packets coming in from the other eNBs during handover.
4.3.1.6 Integrity Protection
This is a feature only valid for the control plane in UTRA this was in the RRC layer.
This involves to calculate the MAC according the same principle but possibly with a
different algorithm.
[3GTR 25.813 (5.3.3), 3GTS 36.300 (6.3), 3GTS 36.323 (4.4)]
Room for your Notes

3GTR
RLC
Radio Link Control
3GTS

Specification
RRC
HSPA
High Speed Packet Access (operation RoHC

of HSDPA and HSUPA)
Robust Header Compression
LTE
UMTS

System
MAC
UTRA

PDCP
eNB
Enhanced Node B
PDU

Unit
- 253 -
4.3.2 Structure of PDCP PDU
The objective of this section is to provide the structure of the PDCP PDU.
Key point of this section is that the LTE PDCP PDU can also carry control
plane information.
Image description
in the PDCP PDU.
In contrast to UMTS the PDCP is also existing in the control plane. Consequently
also for control plane the PDCP PDU has to be defined.
For both control plane and user plane the PDCP PDU is exhibiting a SN (Sequence
Number) and an SDU field.
For the user plane there can be optionally a RoHC (Robust Header Compression)
which is compressing the e.g. 40 byte header to a 2-3 byte compressed header.
In order to control RoHC in the user plane, user plane PDCP PDU contain a D/C field
indicating control or data.
For the control plane for integrity protection purposes the MAC field might be added
at the end. The MAC field is calculated according to similar guidelines as the MAC in
UMTS.
- 254 -

[3GTS 36.323 (6)]
Room for your Notes

3GTS

Specification
RoHC
LTE
SDU

PDU)
MAC
SN
Sequence Number
PDCP
UMTS

System
PDU

Unit
- 255 -
4.3.3 PDCP Configuration

4.3.3.1 PDCP Configuration in the Standard
the PDCP configuration.
Key point of this section is there is no default configuration for PDCP.
- 256 -

AM
RoHC
IE
Information Element
SN
Sequence Number
PDCP
UM
RLC
Radio Link Control
- 257 -
4.4 How a TCP/IP MTU is reaching the UE / the Internet
The objective of this section is to show the stations and the transformations
of a TCP/IP MTU in the LTE network until it reaches the UE.
Key point of this section is that with respect to the very high data rate for LTE
and the protocol development from the scratch there are a few differences to
HSPA.
Image description
The picture is showing the CDD case: two transmission antennas are received by
one receive antenna. It is shown how the UE can resolve the two signals.
4.4.1 TCP/IP layer

A TCP/IP MTU can have up to 1500 byte including 40 byte header.
4.4.2 PDCP layer
In the PDCP first RoHC can be applied this would reduce 40 byte TCP/IP header to
typically 3 byte header. In the user plane PDCP needs 2 byte own header.
4.4.3 RLC layer
According to the transport block size the RLC can assume variable RLC PDU size.
Either the TB is so small that the PDCP PDU needs to be segmented or it is that big
that multiple PDCP PDUs fir in. For the RLC header it can be configured to have 1 or
2 byte in UM.
- 258 -

For AM and 1 RLC SDU the header size is 2 byte in case of no segmentation and 4
byte in case of segmentation. For RLC AM each additional RLC SDU will add 1.5
byte header. In case a byte header is not filled completely 4 bit header padding has
to be added. Flexible RLC PDUs and multiple RLC SDUs are new to LTE and are
not used in UMTS RLC until. R7
4.4.4 MAC layer
In case the MAC is transporting only 1 MAC SDU the header length will be 1 byte
only in case more MAC SDUs are transmitted the header will increase by 2-3 byte.
Please also take into account that padding and MAC Control Elements will be
unavoidable. The use of MAC control elements is new in LTE.
4.4.5 PHY layer
The physical layer has to deal with very huge TBs. TBs of 150000 bit cannot be
protected with a single CRC check any more. This is why there is a own 3 byte CRC
foreseen for every of the up to 6144 bit long Code Block Segments.
Room for your Notes

AM
PHY
Physical Layer
CDD
Cyclic Delay Diversity
RLC
Radio Link Control
CRC
RoHC
HSPA
High Speed Packet Access (operation SDU

of HSDPA and HSUPA)

PDU)
LTE
TB
Transport Block
MAC
TCP/IP
Transmission Control Protocol over IP
MTU
Maximum Transmit Unit (IP)
UE
User Equipment
PDCP
UM
PDU
Protocol Data Unit or Packet Data Unit UMTS

System
- 259 -
- 260 -
X2- and S1-Interfaces: X2AP- and S1-AP-Protocols
Chapter 5:
Objectives
What are the tasks and functions of S1-AP and X2AP?
How are handover procedures performed over the X2- and the S1-interface?
- 261 -
5.1 The X2AP Protocol

5.1.1 Protocol Stack on the X2-interface
The objective of this section is to illustrate the protocol stack of the control
and user plane on the X2-interface.
The X2-interface is an open interface which is not vendor-specific, because
otherwise only S1-based handover is possible.
The illustrated X2AP-protocol is specific to the X2-interface and has been specified in
the recommendation 3GTS 36.423.
[3GTS 36.422, 3GTS 36.424]
- 262 -

L2
Layer 2 (data link layer)
eNB
Enhanced Node B
SCTP

Protocol (RFC 2960)
GTP

29.060)
UDP
GTP-U
GTP User Plane
UTRAN

IP
X2-AP
X2-interface Application Part protocol

(3GTS 36.423)
L1
X2AP

(3GTS 36.423)
- 263 -
5.1.2 Tasks & Functions
The objective of this section is to depict the tasks and functions of the X2APprotocol.
[3GTS 36.423]
5.1.2.1 Mobility Management
5.1.2.2 Load Management
5.1.2.3 X2-Interface Management
- 264 -
3GTS

Specification
SN
Symbol Number or SNDCP
eNB
Enhanced Node B
UE
User Equipment
SN
Sequence Number
X2AP

(3GTS 36.423)
- 265 -
5.1.3 X2-based Handover Scenario
The objective of this section is to illustrate the operation of an X2-based

handover scenario [3GTS 23.401 (5.5.1.1.2)].
5.1.3.1 Initial Conditions
The UE has setup an RRC-connection with the eNodeB and the eNodeB has
setup an S1-connection towards an MME.
E-RAB's may be setup and are relayed by the eNodeB towards the S-GW.
The "former" eNodeB determines at this time (e.g. after receiving a measurement
report from the UE) that a handover to the "new" eNodeB is necessary. The "new"
eNodeB has an X2-connection to the former eNodeB and therefore, an X2-based
handover becomes possible.
Question No 24: Please fill In the missing interface names.
- 266 -
GW
Gateway
RRC
MME

S-GW
RAB
Radio Access Bearer
UE
User Equipment
- 267 -
5.1.3.2 Detailed Description
- 268 -
To initiate the X2-based handover, the former eNodeB will send an X2AP:
HND_REQ-message towards the new eNodeB.
The new eNodeB will build the related handover command message (which is
actually an RRC: RRC_CONN_RECONF-message) and will relay it to the former
eNodeB embedded in an X2AP: HND_REQ_ACK-message. This message also
contains the GTP-U TEID that the new eNodeB opened so that the former
eNodeB can relay still incoming DL-data to the new eNodeB.
The former eNodeB will extract the RRC: RRC_CONN_RECONF-message and

will transmit it to the UE.
The UE will react upon the received reconfiguration information and switch to the
new serving cell. The UE shall perform a random access procedure in the new
cell. Finally, the UE shall transmit a handover confirmation message to the new
eNodeB which is actually an RRC: RRC_CONN_RECONF_CMP-message.
All UL-data is now received by the new eNodeB but must be buffered because
the new eNodeB does not yet possess the GTP-U TEID for uplink data of the SGW.
Having received this confirmation from the UE, the new eNodeB will ask the MME
for a switch of the downlink GTP-U tunnel from the S-GW to the new eNodeB.
Accordingly, the new eNodeB will send an S1-AP: PATH_SWITCH_REQmessage to the MME.
The MME will send a GTP: UPD_UP_REQ-message to the S-GW which most
importantly contains the new eNodeB's GTP-U downlink TEID.
The S-GW will update its downlink GTP-U tunnel accordingly and will stop
transmitting data to the former eNodeB. It will confirm the switch by sending a
GTP: UPD_UP_RSP-message to the MME. The MME will confirm the path switch
by sending S1-AP: PATH_SWITCH_REQ_ACK-message to the new eNodeB.
Finally, the data link has been entirely switched to the new eNodeB and therefore,
the new eNodeB can instruct the former eNodeB to release the existing resources
by sending an X2AP: UE_RES_REL-message. This procedure is a class 2procedure and is not responded by the former eNodeB.
DL
Downlink
S-GW
GTP

29.060)
S1-AP
S1 Application Part
GTP-U
GTP User Plane
TEID

3GTS 29.060)
MME

UL
Uplink
RRC
X2AP

(3GTS 36.423)
- 269 -
5.2 The S1-AP Protocol

5.2.1 Overview & Introduction
The objective of this section is to introduce the students into the most
important aspects of the S1-AP protocol which is used between the MME
and the eNodeB.
[3GTS 36.413]
- 270 -
ASN.1

X.680 / X.681)
RNSAP
Radio Network Subsystem

Application Part (3GTS 25.423)
MME

S1-AP
S1 Application Part
NBAP
NodeB Application Part (3GTS

25.433)
UE
User Equipment
PER
Packed Encoding Rules (ITU-T X.691) UMTS

System
- 271 -
5.2.2 S1-based Handover Scenario
The objective of this section is to illustrate the operation of an S1-based

handover scenario [3GTS 23.401 (5.5.1.2)].
5.2.2.1 Initial Conditions
The UE has setup an RRC-connection with the eNodeB and the eNodeB has
setup an S1-connection towards an MME.
E-RAB's may be setup and are relayed by the eNodeB towards the former S-GW.
The "former" eNodeB determines at this time (e.g. after receiving a measurement
report from the UE) that a handover to another" eNodeB is necessary to which an
X2-based handover is impossible.
Question No 25: Please fill In the missing interface names.
- 272 -
3GTS

Specification
RAB
Random Access uplink Burst
GW
Gateway
RRC
MME

S-GW
RAB
Radio Access Bearer
UE
User Equipment
- 273 -
Having received the S1-AP: HND_RQD-message, the former MME needs to

determine and select the target MME.
The S1-AP: HND_REQ-message [3GTS 36.413 (9.1.5.4)] contains also the GTPU TEID that the target S-GW allocated to receive uplink data from the target
eNodeB.
The GTP: Create-Indirect-Data-Forwarding-Tunnel-Request-message [3GTS

29.274 (7.2.18)] does not only convey all necessary information to setup a tunnel
between target and source S-GW. This message also contains the TEID that the
target eNodeB allocated before and this is needed by the target S-GW to forward
DL-data to the target eNodeB.
The availability of the related TEID's at the target S-GW and at the target eNodeB
enables the new data link in uplink and downlink direction.
The indirect data forwarding tunnel is necessary to relay PDCP-PDU's between

the two S-GW's during the transient time when data is received and transmitted
over both eNodeB's.
[3GTS 23.401 (5.5.1.2)]
- 274 -
DL
Downlink
PDU

Unit
GTP

29.060)
S-GW
GTP-U
GTP User Plane
S1-AP
S1 Application Part
MME

TEID

3GTS 29.060)
PDCP
- 275 -
5.2.2 S1-based Handover Scenario (continued)
The objective of this section is to continue and conclude the operation of an

S1-based handover scenario [3GTS 23.401 (5.5.1.2)].
The former MME (source) will finally relay the RRC: RRC_CONN_RECONFmessage to the former eNodeB which will send it to the UE.
The UE connects to the new cell and the new eNodeB notifies the new MME
about the successful handover (S1-AP: HND_NOTIFY [3GTS 36.413 (9.1.5.7)].
Note that at this time, there is new e2e data path through both S-GW's.
Finally, the new S-GW updates the P-GW about the S-GW relocation and the PGW will update its data tunnels accordingly.
After the handover, the UE must trigger a tracking area update procedure, if the
new eNodeB belongs to a new tracking area for which the UE holds no TAI.
[3GTS 23.401 (5.5.1.2)]
- 276 -
3GTS

Specification
S-GW
e2e
End-to-End
S1-AP
S1 Application Part
MME

TAI

24.301)
P-GW

of EPC)
UE
User Equipment
RRC
- 277 -
- 278 -
Solutions
Solutions
Q&A-Sessions:
Answer for Question No 1:

In case of roaming and particularly when using local breakout the different types
of traffic may use different ways. Therefore, it is desirable to be able to perform
legal interception at the access router (e.g. S-GW) and at the edge router (PDNGW).

Security is introduced on two different layers (<=> PDCP and NAS) to make sure
that NAS-messages are already integrity protected and possibly ciphered, if
security has not yet been enabled on PDCP-layer. This condition applies in
particular when the UE transmits EMM: ATT_REQ- or TA_UPD_REQ-messages.
Another reason is to protect at least the NAS-messaging even if home base
stations with or w/o security capabilities are used.

The complete sequence of input parameters is depicted underneath.
- 279 -
- 280 -
Solutions

The missing interface names are (from left to right): LTE-Uu, S1-MME, S6a

The missing interface names are (from left to right): LTE-Uu, S1-MME, S11, S5 or
S8 (depending on whether the PDN-GW is part of the current PLMN or not).

The complete EMM: ATT_REQ-message is illustrated underneath:

The missing interface names are (from left to right): LTE-Uu, S1-MME, S10

The missing interface names are (from left to right): S11, S5 or S8 (depending on
whether the PDN-GW is part of the current PLMN or not), S6a, S6a.

The missing interface names are (from left to right): LTE-Uu, S1-MME, S11, S11

The ATT_REQ-message starts within the hex string and consists of the sequence
07: plain NAS-message (no security header type) / protocol discriminator 7 =
EMM
41: message type of ATT_REQ
41: NAS key set identifier (4) / EPS attach type (1) => EPS only attach
0C: length of mobile identity => 12(dec) not including the length indicator itself
23: ??? / no correct decoding possible, type of identity should be 001(bin) or
110(bin) but not 011(bin).
- 281 -

F0 27 20 01 C1 05 F0 00 00 00 02: remaining identity digits (according to length
indication).
03 20 23 F0 27 20 01 C1 42 02 00 00 2B 06 00: further content octets

The missing interface names are (from left to right): S5, SGi, Rx (between IMS
and PCRF), Gx (between PCRF and P-GW)

The missing interface names are (from left to right): S11, S5, Rx (between IMS
and PCRF), Gx (between PCRF and P-GW), S5 (between S-GW and P-GW) and
S1-U (between eNodeB and S-GW).

The bearers are the already existing EPS-bearer and the new real-time EPSbearer for the voice call data.
- 282 -
Solutions

The figure underneath illustrates the complete mapping:
- 283 -


No because there are only PS services no paging type 1 or paging type 2
messages are received during RRC_RONNECTED mode. Still the paging
channel has to be listened to.
- 284 -
Solutions


- 285 -

The number of prefix bits depends on the number of options. In the described
case, the number of options is 68 5 +1 = 64 options.
Accordingly, a number of 6 bits is required in front of the information to indicate
the number of digits.
Examples:
000000 digit-1 digit-2 digit-3 digit-5 <=> in case of a length of 5 digits
...
...

The complete RRC Connection Establishment Request-Message is illustrated
underneath:
- 286 -
Solutions

The complete RRC Connection Establishment Procedure on MAC level is
illustrated underneath:
- 287 -
- 288 -

The complete RRC Connection Establishment Request-Message is illustrated
underneath:

The missing interface names are (from left to right): X2, S1-MME, S11

The missing interface names are (from left to right) Top-line: S1-MME, S11,
S5/S8; Middle line: S1-MME, S11, S5/S8; Bottom-line: S10
Solutions
Intentionally left blank
- 289 -
- 290 -
Solutions
- 291 -
- 292 -
List of Acronyms
List of Acronyms
Term
Explanation
(V)ASSI
Visited Alias Short Subscriber Identity
16-APK
16 symbols Amplitude Phase Keying
16-PPM
16 position Pulse Position Modulation
16-QAM
16 symbols Quadrature Amplitude Modulation
16VSB
16-level vestigial sideband modulation
1xCS IWS
Circuit Switched Fallback Interworking solution Function for

3GPP2 1xCS (3GTS 23.272)
1xCSIWS
1x Circuit-Switched Interworking Solution Function (3GTS

29.277)
1xEV-DO
One Carrier (1.25 MHz) Evolution - Data Only (cdma2000)
1xEV-DV
One Carrier (1.25 MHz) Evolution - Data and Voice
2-GFSK
2 symbols Gaussian Frequency Shift Key or Keying
2B1Q
Two Binary One Quaternary (Line Coding used on the ISDN UInterface)
3G
3rd Generation ...
3GPP
Third Generation Partnership Project (Collaboration between

different standardization organizations (e.g. ARIB, ETSI) to
define advanced mobile communications standards,
responsible for UMTS)
3GPP2
Third Generation Partnership Project 2 (similar to 3GPP, but

consisting of ANSI, TIA and EIA-41, responsible for cdma2000,
EvDO and EVDV)
3GTR
3GTS
3rd Generation Technical Specification
4-GFSK
4 symbols Gaussian Frequency Shift Key or Keying
4-PAM
4 symbols Pulse Amplitude Modulation
4-PPM
4 position Pulse Position Modulation
4G
4th Generation ...
64-QAM
64 symbols Quadrature Amplitude Modulation
8-PSK
8 Symbol Phase Shift Keying
8VSB
8-level Vestigial Sideband Modulation (ATSC)
A-Bit
Acknowledgement Request Bit (used in LLC-protocol Logical

Link Control)
A/V
Audio / Video
A&S
Applications & Services domain or server
AA
Anonymous Access
- 293 -
- 294 -
AAA
Authorize Authenticate Answer (DIAMETER message type)
AAA
Authentication, Authorization and Accounting
AACH
Access Assignment CHannel
AACH-Q
Access Assignment CHannel, QAM
AAD
Additional Authentication Data
AAL
ATM-Adaption Layer
AAL-2
ATM Adaptation Layer 2 (for real-time services) (ITU-T

I.363.2)
AAL-5
ATM-Adaptation Layer 5 (non-real time) (ITU-T I.363.5)
AAR
Authorize Authenticate Request (DIAMETER message type)
AAS
Adaptive Antenna Systems
ABM
Asynchronous Balanced Mode
ABNF
Augmented Backus Naur Form (RFC 2234)
AC
Alternate Current
AC
Access Class
ACC
Access Control Class (3GTS 22.011)
ACCH
Associated Control Channel (GSM / can be an SACCH or an

FACCH)
ACELP
Algebraic Codebook Excited Linear Prediction
ACK
Acknowledgement
ACM
Address Complete Message (ISUP-message type)
ACS
Active Codec Set
ADCH
Associated Dedicated Channel (3GTS 45.902)
ADDBA
Add Block Acknowledgment
ADDTS
Add Traffic Stream
ADM
Asynchronous Disconnected Mode
ADPCM
Adaptive Differential Pulse Code Modulation
ADSL2
Asynchronous Digital Subscriber Line 2 (ITU-T G.992.3)
AES
Advanced Encryption Standard / Cipher Key Lengths: 128 bit,

192 bit or 256 bit
AESA
ATM End System Address
AF
Assured Forwarding (DiffServ Term)
AFC
Automatic Frequency Control
AFH
Adaptive Frequency Hopping
AG
Absolute Grant (3GTS 25.309)
AGA
Air - Ground - Air service
AGC
Automatic Frequency Control
List of Acronyms
AGCH
Access Grant Channel (GSM)
AGS
Absolute Grant Scope ('All' or 'Single' HARQ process)
AGV
Absolute Grant Value (INACTIVE or Zero_Grant or EDPDCH/DPCCH power ratio)
AH
Authentication Header (RFC 4302)
AI
Air Interface
AI
Acquisition Indicator
AICH
Acquisition Indicator Channel (UMTS Physical Channel)
AID
Association Identifier
AIFS
Arbitration InterFrame Space
AIFSN
Arbitration InterFrame Space Number
AIPN
All IP Network
AJAX
Asynchronous Javascript and XML
AK
Authentication Key (IEEE 802.16)
AK
AKA
Authentication and key agreement (3GTS 33.102)
AKD
Authentication Key Distribution
AL
Ambience Listening
AL
Advanced Link
ALC
Asynchronous Layered Coding
ALCAP
Access Link Control Application Part (ITU-T Q.2630.1 /

Q.2630.2)
ALG
Application Layer Gateway
AM
Amplitude Modulation
AM
AMBR
Aggregated Maximum Bit Rate
AMC
Adaptive Modulation and Coding
AMD
Acknowledged Mode Data (UMTS RLC PDU-type)
AMF
Authentication management field (3GTS 33.102)
AMI
Alternate Mark Inversion (Line Coding)
AMPS
Advanced Mobile Phone System
AMR
Adaptive Multirate Encoding (3GTS 26.090)
AMR_HR
Adaptive Multi Rate with Half-Rate Codec
AMR-WB
Adaptive Multi-Rate - WideBand speech codec (3GTS 26.273,

ITU-T G.722.2)
AMR-WB+
Extended Adaptive Multi-Rate - WideBand speech codec (3GTS

26.304, 26.410, ITU-T G.722.1)
ANDSF
Access Network Discovery and Selection Function (3GTS
- 295 -

24.302)
- 296 -
ANSI
American National Standards Institute
AoD
Audio on Demand
AP
Access Preamble
AP
Access Point (IEEE 802.11, 802.16)
AP-AICH
CPCH Access Preamble Acquisition Indicator Channel (UMTS

Physical Channel)
APCO
Association of Police Communications Officers
API
Application Programming Interface
API
Access Preamble Acquisition Indicator
APK
Amplitude Phase Keying
APN
Access Point Name (Reference to a GGSN)
APP
A Posteriori Probability (Turbo Decoding)
AR
Assured Rate PDB (DiffServ Term)
ARFCN
Absolute Radio Frequency Channel Number
ARIB
Association of Radio Industries and Businesses (Japanese)
ARP
Allocation and Retention Priority
ARP
Address Resolution Protocol (RFC 826)
ARPU
Average Revenue Per User
ARQ
AS
application specific (within SDP-bandwidth specification / bline)
AS
Application Server
AS
AS-ILCM
Application Server - Incoming Leg Control Model
AS-OLCM
Application Server - Outgoing Leg Control Model
ASC
Access Service Class
ASCA
Adjacent Subcarrier Allocation
ASCI
Advanced Speech Call Items (GSM-R)
ASCII
American Standard Code for Information Interchange (ANSI

X3.4-1986)
ASIC
Application Specific Integrated Circuit
ASME
ASN
Access Service Network
ASN-GW
Access Service Network-Gateway
ASN.1
Abstract Syntax Notation 1 (ITU-T X.680 / X.681)
ASP
Application Server Process
List of Acronyms
ASSI
Alias Short Subscriber Identity
AT_MAC
AT-Command
Attention-Command
ATCA
Advanced Telecommunications Computing Architecture
ATID
Address Type Identifier in Demand
ATIM
Announcement Traffic Indication Message
ATIS
Alliance of Telecommunications Industry Solutions
ATM
Asynchronous Transfer Mode (ITU-T I.361)
ATSC
Advanced Television System Committee
ATSI
Alias TETRA Subscriber Identity
AuC
Authentication Center
AUTN
AV
Authentication Vector (3GTS 33.102)
AVC
Advanced Video Coding
AVL
Automatic Vehicle Location
AVP
Attribute Value Pair (DIAMETER-term / RFC 3588)
AWGN
Additive White Gaussian Noise
B2BUA
Back-to-Back User Agent (SIP term / RFC 3261, RFC 3725)
B2DA
Back-to-Back Dynamic Allocation
B8ZS
Bipolar with Eight-Zero Substitution (Line Code used at the

T1-Rate (1.544 Mbit/s))
BA
Block Ack
BAR
Block Ack Request
BAS
Basic rate access ISDN-user interface for single lines (2 Bchannels plus one D-Channel with 16 kbit/s)
BAT
Bouquet Association Table (MPEG, DVB-SI)
BB
Base Band module
BBERF
Bearer Binding and Event Reporting Function (3GTS 23.203)
BBK
Broadcast BlocK
BC
Broadcast
BCAST
Broadcast
BCC
Broadcast Call Control (3GTS 44.069)
BCC
Binary Convolutional Coding
BCC
Base Station Color Code
BCCH
BCCH-Q
Broadcast Control CHannel, QAM
BCD
Binary Coded Decimal
- 297 -
- 298 -
BCH
Broadcast Channel
BCMCS
Broadcast and Multicast Services (CDMA-2000 Rev. D)
BCTP
Bearer Control Tunneling Protocol (ITU-T Q.1990)
BE
Best Effort
BEC
Backward Error Correction
BEG
BEGin Message (TCAP)
BER
Bit Error Rate
BFCP
Binary Floor Control Protocol (draft-ietf-xcon-bfcp-05)
BFI
Bad Frame Indication
BG
Border Gateway
BGCF
Breakout Gateway Control Function
BGP
Border Gateway Protocol
BIB
Backward Indicator Bit
BIC
Blind Interference Cancellation
BICC
Bearer Independent Call Control (ITU-T Q.1902.1 - Q.1902.6)
BK
Background
BKN1
Block Number 1
BKN2
Block Number 2
BL
Basic Link
BLCH
Base station Linearization CHannel
BLER
Block Error Rate
BM-IWF
Broadcast Multicast Interworking Function
BM-SC
Broadcast Multicast Service Center (3GTS 23.346)
BMC
Broadcast / Multicast Control (3GTS 25.324)
BN
Bit Number
BNCH
Broadcast Network CHannel
BNCH-Q
Broadcast Network CHannel, QAM
BNF
Backus Naur Form (RFC 2234)
BPSC
Bits per Sub Carrier
BPSK
Binary or Bipolar Phase Shift Keying
BQA
Bluetooth Qualification Administer
BQB
Bluetooth Qualification Body
BQRB
Bluetooth Qualification Review Board
BQTF
Bluetooth Qualification Test Facility
BR
Bandwidth Request (WiMAX Term)
BRA
Bit Rate Adaptation
List of Acronyms
BRAN
Broadband Radio Access Network
BS
Base Station (IEEE 802.16)
BS_CV_MAX
Maximum Countdown Value to be used by the mobile station

(Countdown Procedure)
BS_EIRP
Base Station Effective Isotropic Radiated Power
BSC
Base Station Controller
BSCH
Broadcast Synchronization CHannel
BSD
Berkeley Software Distribution
BSIC
Base Station Identity Code
BSN
Block Sequence Number (RLC) / Backward Sequence Number

(SS7)
BSS
Basic Service Set
BSS
Base Station Subsystem
BSSAP
Base Station Subsystem Application Part
BSSAP-LE
Base Station System Application Part - Location Based

Services Extension
BSSGP
Base Station System GPRS Protocol
BSSID
Basic Service Set Identification
BSSMAP
Base Station Subsystem Mobile Application Part (3GTS

48.008)
BTAB
Bluetooth Technical Advisory Board
BTC
Block Turbo Coding
BTS
Base Transceiver Station
BTTI
Basic Transmission Time Interval
BU
Bad Urban
BVCI
BSSGP Virtual Connection Identifier
BW
Bandwidth
C-RNTI
Cell Radio Network Temporary Identifier
C-SAP
Control Service Access Point
C/I
Carrier-to-Interference Ratio (like SNR)
C/N
Carrier/Noise power ratio
C/R-Bit
Command / Response Bit
C/T-Field
logical Channel / Transport channel identification Field
CAI
Channel Assignment Indicator
CAMEL
Customized Applications for Mobile network Enhanced Logic
CAN
Connectivity Access Network
CAP
Controlled Access Phase
CAP
CAMEL Application Part (CCS7)
- 299 -
- 300 -
CAPEX
Capital Expenditure
CAT
Conditional Access Table (MPEG2-TS PSI)
CATV
Cable TV
CAZAC
Constant Amplitude Zero Autocorrelation Code
CB
Control uplink Burst
CBC
Committed Burst Size
CBC
Cipher Block Chaining (DES-Operation Mode)
CBC
Cell Broadcast Center
CBCH
Cell Broadcast Channel (GSM)
CBMS
Convergence of Broadcast and Mobile Services
CBPS
Coded Bits per OFDM Symbol
CC
Convolutional Coding
CC
Call Control
CCC
CPCH Control Command
CCCH
CCF
Charging Collection Function
CCH
Control Channel
CCH-Q
Control CHannel, QAM
CCIR601
Comit consultatif international pour la radio, a forerunner of

the ITU-R, specification 601
CCITT
Comitonsultatif International Tgraphique et Tphonique

(International Telegraph and Telephone Consultative
Committee)
CCK
Complementary Code Keying
CCK
Common Cipher Key
CCM
Common Channel Management (Protocol Part on the GSM

Abis-Interface / 3GTS 48.058)
CCM
CTR with CBC-MAC
CCM-Mode
Counter with CBC-MAC (RFC 3610) Combined Authentication

and Encryption with AES-Algorithm
CCMP
CTR with CBC-MAC Protocol
CCN
Cell Change Notification (related to Network Assisted Cell

Change / 3GTS 44.060)
CCoA
Collocated Care-of-Address
CCPCH
Common Control Physical Channel (see also P-CCPCH and SCCPCH)
CCS7
Common Channel Signaling System No. 7 (ITU-T Q-series of

specifications, in particular Q.700 - Q.703)
CCTrCH
Coded Composite Transport Channel (UMTS)
List of Acronyms
CCU
Channel Codec Unit
CD
Compact Disc
CD/CA-ICH
Collision Detection / Channel Assignment Indicator Channel

(UMTS Physical Channel)
CDCH
Control-plane Dedicated Channel (3GTS 45.902)
CDD
Cyclic Delay Diversity
CDI
Collision Detection Indicator
CDMA
CDMA2000
CDR
Call Detail Record
CELL_DCH
RRC Dedicated State
CELL_FACH
RRC FACH State in UTRA
CELL_PCH
RRC PCH State in UTRA
CEO
Chief Executive Officer
CEPT
Confrence Europne des Postes et Tcommunications
CESoP
Circuit Emulation Services over Packet
CF
Contention Free
CFI
Control Format Indicator
CFN
Connection Frame Number
CFP
Contention Free Period
CG
Charging Gateway
CGF
Charging Gateway Function
CGI
CHAP
Challenge Handshake Authentication Protocol (RFC 1334)
CI
Cell Identity
CIC
Circuit Identity Code (ISUP)
CIC
Call Instance Code (BICC)
CID
Connection Identifier (WiMAX)
CID
Channel Identity (ATM)
CIDR
Classless Inter-Domain Routing (RFC 1519)
CIF
Common Intermediate Format (352 x 240 pixels / ITU-T

H261 / H263)
CINR
Carrier to Interference and Noise Ratio
CIO
Cell Individual Offset (3GTS 25.331)
CIP
Common Indexing Protocol
CIR
Committed Information Rate
CIR
Channel Impulse Response
- 301 -
- 302 -
CIR
Carrier-to-Interference Ratio
CK
CKSN
Ciphering Key Sequence Number
CL
Controlled Load
CLCH
Common Linearization CHannel
CLCH-Q
Common Linearization CHannel, QAM
CMC
Connection Mobility Control
CMC
Codec Mode Command
CMCE
Circuit Mode Control Entity
CmCH-PI
Common Channel Priority Indicator
CMD
Circuit Mode Data
CMI
Codec Mode Indication
CMIP
Client Mobile IP
CMIS/P
Common Management Information System/Protocol
CMR
Codec Mode Request
CMTS
Cable Modem Termination System
CN
Core Network
CNM
Central Network Management
CNMI
Central Network Management Interface
CNR
Carrier to Noise Ratio
CoA
Care of Address (MIP)
COA
Change Over Acknowledge message (CCS7)
CODEC
Coder-decoder
COFDM
Coded Orthogonal Frequency Division Multiplexing
COMSEC
Communications Security
CON
CONtinue Message (TCAP)
CONS
Connection Orientated Network Service
COO
Change Over Order message (CCS7)
COPS
Common Open Policy Service Protocol (RFC 2748)
CORBA
Common Object Request Broker
CoU
Class of Usage
CP
Cyclic Prefix
CP
Control Physical channel
CP
Contention Period
CPC
Continuous Packet Connectivity
CPCH
Common Packet Channel (UMTS Transport Channel) FDD only
List of Acronyms
CPCS
Common Part Convergence Sublayer
CPE
Customer Premises Equipment
CPICH
Common Pilot Channel (UMTS Physical Channel / see also PCPICH and S-CPICH)
CPICH_Ec/No
Common Pilot Channel Energy per Chip to Noise Radio
CPIM
Common Presence and Instant Messaging (RFC 3862)
CPS
Common Part Sublayer
CPS
Coding and Puncturing Scheme
CPTI
Calling Party Type Identifier
CPU
Central Processing Unit
CQI
Channel Quality Indicator
CQICH
Channel Quality Indicator Channel
CRC
CRC_HS
CRC of High Speed Channel (HS-DSCH)
CRF
Charging Rules Function
CRNC
Controlling RNC
CRSC
Contributing Source
CS
Convergence Sublayer
CS
Coding Scheme
CS
Class Selector (DiffServ Term / RFC 2474)
CS
Circuit Switched
CS-X
Coding Scheme (1 - 4)
CSCF
Call Session Control Function (SIP)
CSD
Circuit Switched Data
CSG
CSI
Channel State Information
CSICH
CPCH Status Indicator Channel (UMTS Physical Channel)
CSMA-CA
Carrier-Sense Multiple Access - Collision Avoidance
CSN
Connectivity Service Network
CSN.1
Code Syntax Notation 1 (3GTS 24.007)
CSPDN
Circuit Switched Public Data Network
CSRC
Synchronisation Source (RTP)
CSS
Carrier Specific Signalling
CT
Core Network and Terminal (Technical Specification Group

within 3GPP)
CTC
Convolutional Turbo Coding
CTCH
Common Traffic Channel (Logical) PTM
- 303 -
- 304 -
CTFC
Calculated Transport Format Combination (3GTS 25.331)
CTIA
Cellular Telephone Industries Association
CTR
Counter Mode
CTS
Clear To Send
CUB
Control Uplink Burst
CV
Countdown Value
CV
Constellation Version
CVO
Clear Voice Override
CW
Contention Window
CW
Code Word
cwnd
Congestion window
D-CT
Downlink-Continuous Transmission
D-CTT
Downlink-Carrier Timesharing Transmission
D-MCCTT
Downlink - Main Control Channel Timesharing Transmission
D-TxAA
Double Transmit Antenna Array
DA
Destination Address
DAB
Digital Audio Broadcasting
DARP
Downlink Advanced Receiver Performance (3GTS 45.015,

3GTS 24.008)
DAS-X
egprs2 Downlink level A modulation and coding Scheme (x =

5..12)
DASS
Digital Access Signaling System
DBC
Dynamic Bearer Control
dBm
The unit dBm measures a power. The conversion of a power

value from Watt [W] to dBm is done in the following way:X
[dBm] = 10 x log10(X [W] / 0.001 [W])
DBP
Diameter Base Protocol (RFC 3588)
DBPS
Data Bits per OFDM Symbol
DBPSCH
Dedicated Basic Physical SubCHannel
DBPSK
Differential Binary or Bipolar Phase Shift Keying
DBS-X
egprs2 Downlink level B modulation and coding Scheme (x =

5..12)
DC
Direct Current
DCA
Distributed Channel Access
DCCH
DCD
Downlink Channel Descriptor (WiMAX Message)
DCF
Distributed Coordination Function
DCF
DRM Content Format
List of Acronyms
DCH
Dedicated Channel (Transport)
DCI
Downlink Control Indicator
DCK
Derived Cipher Key
DCLA
DC Level Adjustment
DCM
Dedicated Channel Management (Protocol Part on the GSM

Abis-Interface / 3GTS 48.058)
DCOMP
Data COMpression Protocol
DCS
Digital Communication System
DDDS
Dynamic Delegation Discovery System (RFC 3401 - RFC 3404)
DDI
Data Description Indicator (3GTS 25.309, 25.331, 25.321)
DEC
Decision (COPS message type)
DELBA
Delete Block Acknowledgment
DELTS
Delete Traffic Stream
DEMUX
De-Multiplexer
DES
Data Encryption Standard
DF
Do not Fragment (bit in IPv4 header)
DF
Default Forwarding (DiffServ Term / RFC 2474)
DFS
Dynamic Frequency Selection
DFT
Discrete Fourier Transformation
DGNA
Dynamic Group Number Assignment
DHCP
Dynamic Host Configuration Protocol (RFC 2131)
DHCPv4
Dynamic Host Configuration Protocol Version 4 (RFC 2131)
DHCPv6
Dynamic Host Configuration Protocol Version 6 (RFC 3315)
DIA
Diameter Protocol (RFC 3588, RFC 3589)
DIAMETER
DIFS
Distributed (coordination function) InterFrame Space
Digit
4 bit
DIUC
Downlink Interval Usage Code (WiMAX Term)
DL
Downlink
DL-MAP
Downlink-Medium Access Protocol (MAC-Message in WiMAX /

IEEE 802.16)
DL-SCH
DLCI
Data Link Connection Identifier
DLFP
Downlink Frame Prefix
DLL
Data Link Layer
DLR
Destination Local Reference (SCCP term)
DLS
Downloadable Sounds
- 305 -
- 306 -
DLS
Direct Link Setup
DMA
Division Multiple Access
DMB
Digital Multimedia Broadcasting
DMO
Direct Mode Operation
DMR
Digital Mobile Radio
DNS
Domain Name System
DOCSIS
Data Over Cable Service Interface Specification (defined by

CableLabs)
DoS
Denial of Service attack
DPC
Destination Point Code
DPCCH
Dedicated Physical Control Channel (UMTS Physical Channel)
DPCH
Dedicated Physical Channel (UMTS / Term to combine DPDCH

and DPCCH)
DPDCH
Dedicated Physical Data Channel (UMTS Physical Channel)
DPDCH_P
DPDCH_Power or DPDCH_Pwr: Transmit power of DPDCH
DPNSS
Digital Private Network Signaling System
DPSK
Differential Phase Shift Keying
DQPSK
Differential Quadrature Phase Shift Keying
DQPSK
Differential Quadrature Phase Shift Keying
DR
Data Rate
DRA
Dynamic Resource Allocation
DRB
Data Radio Bearer
DRM
Digital Rights Management
DRNC
Drift Radio Network Controller
DRX
DS
Distribution System
DS-CDMA
Direct Sequence Code Division Multiple Access
DSCA
Diversity / Distributed Subcarrier Allocation
DSCH
Downlink Shared Channel (UMTS Transport Channel)
DSCP
Differentiated Services Code Pointer
DSL
Digital Subscriber Line
DSLAM
Digital Subscriber Line Access Multiplexer
DSM-CC
Digital Storage Media Call Control
DSMIP
Dual-Stack (IPv4/v6) Mobile IP
DSMIPv6
Dual Stack Mobile IPv6
DSN
Digital Switching Network
DSP
Digital Signal Processor
List of Acronyms
DSR
Dual Symbol Rate
DSS
Downlink sync Sequence Set
DSS
Distribution System Set
DSS1
Digital Subscriber Signaling System No.1 (also referred to as

LAPD-signaling / ITU-T Q.931)
DSSS
Direct Sequence Spread Spectrum
DT1
Data Form 1 (SCCP message type)
DTAP
Direct Transfer Application Part
DTCH
DTIM
Delivery Traffic Indication Map
DTM
Dual Transfer Mode [3GTS 43.055]
DTMB
Digital Terrestrial Multimedia Broadcast
DTMF
Dual Tone Multiple Frequency
DTS
Decode Time Stamp
DTX
Discontinuous Transmission
DUA
DPNSS 1 / DASS 2 User Adaptation Layer (RFC 4129)
DVB
Digital Video Broadcasting
DVB-C
Digital Video Broadcasting - Cable TV
DVB-H
Digital Video Broadcasting - Handheld
DVB-S
Digital Video Broadcasting - Satellite
DVB-T
Digital Video Broadcasting - Terrestrial
E_UTRA
Evolved UMTS Terrestrial Access
E-AGCH
E-DCH Absolute Grant Channel
E-DCH
Enhanced Uplink Dedicated Transport Channel (3GTS 25.211,

25.309)
E-DCH-FP
E-DCH Frame Protocol (Enhanced Dedicated Channel)
E-DPCCH
Enhanced Uplink Dedicated Physical Control Channel (3GTS

25.211)
E-DPDCH
Enhanced Uplink Dedicated Physical Data Channel (3GTS

25.211)
E-GSM
Extended GSM (GSM 900 in the Extended Band)
E-HICH
E-DCH HARQ Acknowledgement Indicator Channel (3GTS

25.211)
E-OTD
Enhanced Observed Time Difference
E-RGCH
E-DCH Relative Grant Channel (3GTS 25.211)
E-RNTI
E-DCH Radio Network Temporary Identifier (3GTS 25.401)
E-TFC
E-DCH Transport Format Combination (3GTS 25.309)
E-TFCI
E-DCH Transport Format Combination Identifier (Enhanced

Dedicated Channel)
- 307 -
- 308 -
E-UTRA
Evolved UMTS Terrestrial Radio Access
E-UTRAN
Evolved UMTS (Universal Mobile Telecommunication System)

e2e
End-to-End
EAP
Extensible Authentication Protocol (RFC 3748)
EAP-AKA
Extensible Authentication Protocol method for 3rd generation

Authentication and Key Agreement (RFC 4187)
EAP-FAST
Extensible Authentication Protocol - Flexible Authentication via

Secure Tunneling
EAP-SIM
Extensible Authentication Protocol method for gsm Subscriber

Identity Module (RFC 4186)
EAP-TLS
Extensible Authentication Protocol - Transport Layer Security

(RFC 2716)
EAP-TTLS
Extensible Authentication Protocol - Transport Layer Security
EAPOL
EAP encapsulation Over Lan or wlan (IEEE 802.1X)
eBM-SC
Enhanced Broadcast and Multicast Service Center
Ec/No
Received energy per chip / power density in the band
ECC
Electronic Communications Committee
ECCH
Extended Control CHannel
ECM
EPS Connection Management (3GTS 24.301)
ECN
Explicit Congestion Notification
ECSD
Enhanced Circuit Switched Data (HSCSD + EDGE)
EDCA
Enhanced Distributed Channel Access
EDCAF
Enhanced Distributed Channel Access Function
EDGE
Enhanced Data Rates for Global Evolution
EDR
Enhanced Data Rate (more speed with Bluetooth 2.0 (2.0 - 3.0
Mbit/s)
EE
Excellent Effort
EEA
EPS Encryption Algorithm (3GTS 33.401)
EF
Expedite Forwarding (DiffServ Term)
EFR
Enhanced Full Rate speech codec
EGAN
Evolved Generic Access Network
EGPRS
Enhanced General Packet Radio Service
EGPRS2
Enhanced GPRS phase 2 [3GTS 43.064]
EGPRS2-A
Enhanced GPRS Phase 2 Level A [3GTS 43.064, 3GTS 44.060]
EGPRS2-B
Enhanced GPRS Phase 2 Level B [3GTS 43.064, 3GTS 44.060]
eHSPA
Evolved HSPA
EIA
Electronic Industries Alliance (US-organization to support US

industry)
List of Acronyms
EIA
EPS Integrity Protection Algorithm (3GTS 33.401)
EIFS
Extended InterFrame Space
EIR
Equipment Identity Register
EIRENE
European Integrated Railway Radio Enhanced Network (GSMR)
EIRP
Equivalent Isotropic Radiated Power
EIT
Event Information Table (MPEG, DVB-SI)
eMLPP
enhanced Multi-Level Precedence and Pre-emption (3GTS

23.067)
EMM
EPS Mobility Management (3GTS 24.301)
EMSK
Extended Master Session Key
EN
European Norm
eNB
Enhanced Node B
END
END Message (TCAP)
ENUM
E.164-telephone number to URI (Uniform Resource Identifier)

translation (RFC 3761)
EOSP
End Of Service Period
EPC
Evolved Packet Core (3GTS 23.401) (Rel. 8 onwards)
ePDG
evolved Packet Data Gateway (3GTS 23.402)
EPS
EPS-AKA
Evolved Packet System -Authentication and Key Agreement

(3GTS 33.401)
EPT
ETSI Project TETRA
EQ200
Equalizer Test 200 km/h
ERO
European Radiocommunications Office
ERP
Extended Rate Physical Layer
ert-PS
Extended Real-Time Polling Service (WiMAX Traffic Class)
ertPS
Extended Real-Time Polling Service (IEEE 802.16 Traffic Class)
ES
Elementary Stream
ES-Id
Encoding Symbol-Id
Es/No
Energy per symbol / Noise power spectral density
ESCR
Elementary Stream Clock Reference
ESG
Electronic Service Guide
ESM
EPS Session Management (3GTS 24.301)
ESN
Electronic Serial Number (North American Market)
ESP
Encapsulating Security Payload (RFC 4303)
ESS
Extended Service Set
Ethernet
Layer 2 Protocol for IP (IEEE 802.3)
- 309 -
- 310 -
ETS
European Telecommunication Standard
ETSI
European Telecommunications Standard Institute
EUI-64
Extended Unique Identifier - 64 bit long (IEEE / the
EUL
Enhanced Uplink
EV-DO
Evolution Data Only or Evolution Data Optimized (cdma2000)
EV-DV
Evolution Data/Voice (cdma2000)
EVM
Error Vector Magnitude
F-DPCH
Fractional Dedicated Physical Channel (3GTS 25.211)
F-TEID
Fully Qualified Tunnel Endpoint Identifier (3GTS 29.274)
FA
Foreign Agent (Mobile IP / RFC 3344)
FACCH
Fast Associated Control Channel (GSM)
FACH
Forward Access Channel (UMTS Transport Channel)
FANR
Fast Ack/Nack Reporting
FBI
Final Block Indicator
FBI
Feedback Information (UMTS)
FBSS
Fast Base Station Switching
FCB
Frequency Correction downlink burst
FCC
Federal Communications Commission
FCCH
Frequency Correction Channel (GSM)
FCH
Frame Control Header
FCS
Frame Check Sequence (CRC-Check)
FDD
Frequency Division Duplex
FDDI
Fiber Distributed Data Interconnect (optical Layer 2)
FDM
Frequency Division Multiplexing
FDMA
Frequency Division Multiple Access
FDPS
Full-slot Downlink Pilots Set
FDT
File Delivery Table
FEC
Forward Error Correction
FER
Frame Error Rate
FFH
Fast Frequency Hopping
FFRS
Fractional Frequency Reuse Scheme
FFS
For Further Study
FFT
Fast Fourier Transformation
FH
Frequency Hopping
FH-CDMA
Frequency Hopping Code Division Multiple Access
FHSS
Frequency Hopping Spread Spectrum
List of Acronyms
FIB
Forward Indicator Bit
FIPS
Federal Information Processing Standard
FiSA
Filler Set A
FiSB
Filler Set B
FISU
Fill In Signal Unit
FLO
Flexible Layer 1 (3GTS 45.902)
FLUTE
File Delivery over Unidirectional Transport (RFC 3926)
FM
Frequency Modulation
FMC
Fixed Mobile Convergence
FN
Frame Number
FP
Frame Protocol
FPB
First Partial Bitmap
FQDN
Fully Qualified Domain Name. Fully qualified domain names

consist of a host and a domain name whereas the domain
name needs to include a top-level domain (e.g. 'de' or 'org').
Examples: 'www.inacon.de' and 'PC10.inacon.com' are fully
qualified domain names. 'www' and 'PC10' represent the host,
'inacon' is the second-level domain, 'de' and 'com' are the top
level domain.
FR
Fullrate or Frame Relay
FrCS
Frequency Correction Set
FRMR
Frame Reject
FRS
Frequency Reuse Scheme
FSK
Frequency Shift Key or Keying
FSN
Forward Sequence Number
FTP
File Transfer Protocol (RFC 959)
FUPS
Full-slot Uplink Pilots Set
FUSC
Full Usage of Subchannels
FWA
Fixed Wireless Access
G-MSC
Gateway MSC
G-PDU
T-PDU + GTP-Header
G-RNTI
GERAN Radio Network Temporary Identifier
GA
Generic Access (3GTS 43.318)
GA-CSR
Generic Access - Circuit-Switched Resources (3GTS 43.318)
GA-PSR
Generic Access - Packet-Switched Resources (3GTS 43.318)
GA-RC
Generic Access - Resource Control (3GTS 43.318)
GAA
Generic Authentication Architecture (3GTS 33.220)
GAN
Generic Access Network
- 311 -
- 312 -
GANC
Generic Access Network Controller (3GTS 43.318)
GBA
Generic Bootstraping Architecture (3GTS 33.220)
GBR
Guaranteed Bit Rate
GCC
Generic Call Control
GCF
General Certification Forum
GCK
Group Cipher Key
GEA
GPRS Encryption Algorithm
GERAN
GFSK
Gaussian Frequency Shift Key or Keying
GGSN
GHz
Giga Hertz (109 Hertz)
GI
Guard Interval
GIAT
Group Identity Address Type
GIF
Graphics Interchange Format
GITI
Group Identify Type Identifier
GK
Gatekeeper
GMK
Group Master Key
GMLC
Gateway Mobile Location Center
GMM
GPRS Mobility Management
GMSC
Gateway MSC
GMSC-S
Gateway MSC Server
GMSK
Gaussian Minimum Shift Keying
GNU
recursive acronym for GNU is Not Unix. Today a synonym for

free Sourcecode Software.
GOP
Group of Pictures
GoS
Grade of Service
GPCS
Generic Packet Convergence Sublayer (IEEE 802.16)
GPRS
General Packet Radio Service
GPRS-CSI
GPRS CAMEL Subscription Information
GPRS-SSF
GPRS Service Switching Function (CAMEL)
GPS
Global Positioning System
GRA
GERAN Registration Area
GRE
Generic Routing Encapsulation (RFC 2784)
GRX
GPRS Roaming Exchange (GSM-Association IR.34)
GSM
Global System for Mobile Communication
GSM-R
GSM for Railways
GSMS
GPRS Short Message Service
List of Acronyms
GSN
GPRS Support Node
GSSI
Group Short Subscriber Identity
GTK
Group Temporal Key
GTKSA
Group Temporal Key Security Association
GTP
GPRS Tunneling Protocol (3GTS 29.060)
GTP-C
GTP Control Plane
GTP-U
GTP User Plane
GTSI
Group TETRA Subscriber Identity
GTT
Global Title Translation (ITU-T Q.714 (2.4))
GTTP
GPRS Transparent Transport Protocol (3GTS 44.018)
GUMMEI
Global Unique MME Identity (3GTS 23.003)
GUP
Generic User Profile
GUTI
Global Unique Terminal Identity (3GTS 23.003)
GW
Gateway
GWCN
GateWay Core Network configuration
GZIP
GNU ZIP (compression format)
H-PLMN
Home PLMN
H-RNTI
HS-DSCH Radio Network Transaction Identifier (3GTS 25.331,

25.433)
HA
Home Agent (Mobile IP / RFC 3344)
HARQ
Hybrid ARQ
HB
Heartbeat
HBDC
Happy Bit Delay Condition (3GTS 25.309)
HBM
Host Based Mobility
HC
Hybrid Coordinator
HC-SDMA
High Capacity - Spatial Division Multiple Access
HCCA
HCF Controlled Channel Access
HCF
Hybrid Coordination Function
HCS
Hierarchical Cell Structure
HDB3
High Density Bipolar Three (Line Coding used for E1 (PCM 30)
HDLC
High level Data Link Control
HDTV
High Definition Television
HE
Header Extension Field
HFC
Hxbrid Fiber Cable (relates to the layer 1 of CableTVoperators)
HFC-Network
Hybrid Fiber- / Coaxial-cable
HI
HARQ Indicator
- 313 -
- 314 -
HIPERLAN/2
High Performance Radio Local Area Network type 2
HiperMAN
High Performance Radio Metropolitan Area Network
HLR
Home Location Register
HMAC
Keyed Hashing for Message Authentication (RFC 2104)
HMIP
Hierarchical Mobile IPv6 (RFC 5380)
HO
Handover
HoA
Home Address
HOM
Higher Order Modulation
HOMTC
Higher Order Modulation and Turbo Coding
HOT
Higher Order modulation and Turbo coding for downlink
HP
High Priority Path (MPEG, DVB)
HPLMN
Home Public Land Mobile radio Network
HR
High Rate
HR
Halfrate
HRPD
High Rate Packet Data (cdma2000 term)
HS
High Speed
HS-DPCCH
High Speed Dedicated Physical Control Channel (3GTS 25.211)
HS-DSCH
High Speed Downlink Shared Transport Channel (3GTS

25.211, 25.212, 25.308)
HS-HARQ
High Speed Hybrid Automatic Repeat Request
HS-PDSCH
High Speed Physical Downlink Shared Channel (3GTS 25.211)
HS-SCCH
High Speed Shared Control Channel (3GTS 25.211, 25.214)
HSCSD
High Speed Circuit Switched Data
HSDPA
High Speed Downlink Packet Access (3GTS 25.301, 25.308,

25.401, 3GTR 25.848)
HSGW
HRPD Serving Gateway (cdma2000 term)
HSPA
High Speed Packet Access (operation of HSDPA and HSUPA)
HSPA+
Enhanced High Speed Packet Access (operation of enhanced

HSDPA and enhanced HSUPA)
HSR
Higher Symbol Rate
HSS
Home Subscriber Server [3GTS 23.002]. HSS replaces the HLR

with 3GPP Rel. 5
HSUPA
High Speed Uplink Packet Access (3GTS 25.301, 25.309,

25.401, 3GTR 25.896)
HT
High Throughput
HT200
Hilly Terrain 200 km/h
HTML
Hypertext Markup Language
HTTP
HyperText Transfer Protocol (RFC 2616)
List of Acronyms
HTTPS
Hypertext Transfer Protocol Secure
HUGE
Higher Uplink performance for Geran Evolution
HUMAN
High-speed Unlicensed Metropolitan Area Network
HUPS
Half-slot Uplink Pilots Set
HW
Hardware
I-CSCF
Interrogating Call Session Control Function (SIP)
I-WLAN
Interworking WLAN (Wireless Local Area Network) (3GTS

23.234)
I+S
Information + Supervisory
IAM
Initial Address Message (ISUP ISDN User Part)
IANA
Internet Assigned Numbers Authority
IBS
Integrated Base Station
IBSS
Independent Basic Service Set
iBurst
Data Communication Standards
IC
Interference Cancellation
ICANN
Internet Corporation for Assigned Names and Numbers
ICH
Indicator Channel (UMTS Physical Channel / see also PICH,

AICH, CD/CA-ICH)
ICIC
Inter-Cell Interference Coordination
ICM
Initial Codec Mode
ICMP
Internet Control Message Protocol (RFC 792)
ICMPv4
Internet Control Message Protocol for IPv4 (RFC 792)
ICMPv6
Internet Control Message Protocol for IPv6 (RFC 4443)
ICS
Implementation Conformance Statement
ICS
IMS Centralized Services (3GTR 22.892)
ICV
Integrity Check Value
ID
Identity
IDEA
International Data Encryption Algorithm
IDFT
Inverse Discrete Fourier Transformation
IDNNS
Intra-Domain NAS Node Selector
IE
Information Element
IEC
International Electrotechnical Commission
IEEE
Institute of Electrical and Electronics Engineers
IETF
Internet Engineering Task Force (www.ietf.org)
IF
Intermediate Frequency
IFFT
Inverse Fast Fourier Transformation
IFS
InterFrame Space
- 315 -
- 316 -
IGMP
Internet Group Multicast Protocol (RFC 1112, RFC 2236)
IHOSS
Internet Hosted Octet Stream Service
IIR-Filter
Infinite Impulse Response Filter
IK
IKE
Internet Key Exchange (RFC 2409)
IKEv2
Internet Key Exchange protocol / version 2 (RFC 4306)
IKMP
Internet Key Management Protocol
iLBC
Internet Low Bitrate Codec (RFC 3951 / RFC 3952)
ILCM
Incoming Leg Control Model
IM
Instant Messaging
IMEI
International Mobile Equipment Identity
IMEISV
International Mobile Equipment Identity - amended by

Software Version number
IMM
IMMediate access parameter
IMPI
IP Multimedia Private Identity; the private user identity of an

IMS-subscriber, formatted as an NAI (3GTS 33.203)
IMPU
IP Multimedia Public Identity; the public user identity of an

IMS-subscriber, formatted as SIP-URI or TEL-URI (3GTS
33.203)
IMS
Internet Protocol Multimedia Core Network Subsystem (Rel. 5

onwards)
IMS-AG
IMS-Access Gateway
IMS-SSF
IP Multimedia Subsystem - Service Switching Function
IMSI
International Mobile Subscriber Identity
IMT
International Mobile Telecommunications
IMT-2000
International Mobile Telecommunications for the year 2000
IN
Intelligent Networking
INAP
Intelligent Network Application Part (CCS7)
INT
IP-MAC Notification Table (DVB-H SI)
IOP
Interoperability (of TETRA equipment)
IoT
Interference over Thermal noise
IOV
Input / Offset Variable [3GTS 44.064]
IOV-I / IOV-UI
Input Offset Variable for I+S and UI-Frames (for ciphering in

GPRS)
IP
IP-CAN
Internet Protocol - Connectivity Access Network (e.g. DSL, TVCable, WiMAX, UMTS)
IP-CS
IP-Convergence Sublayer
IPBCP
IP Bearer Control Protocol (ITU-T Q.1970)
List of Acronyms
IPCP
Internet Protocol Control Protocol (RFC 1332)
IPDC
IP Datacast
IPDV
IP-packet delay variation (ITU-T Y.1540)
IPER
IP-packet error ratio (ITU-T Y.1540)
IPLR
IP-packet loss ratio (ITU-T Y.1540)
IPR
Intellectual Property Rights
IPsec
Internet Protocol / secure (RFC 4301)
IPTD
IP-packet transfer delay (ITU-T Y.1540)
IPTV
Internet Protocol Television
IPv4
IPv6
IQ
Inphase and Quadrature
IR
Infra Red
IR
Incremental Redundancy (ARQ II)
IS
Interim Standard (ANSI Standard)
IS-95
Interim Standard - 95 (Qualcomm CDMA)
ISAKMP
Internet Security Association and Key Management Protocol

(RFC 2408)
ISBN
International Standard Book Number
ISC
IP multimedia subsystem Service Control-Interface
ISCP
Interference Signal Code Power (3GTS 25.215 / 3GTS 25.102)
ISCTI
Istituto Superiore delle Comunicazioni e delle Tecnologie

dell'Informazione
ISDB
Integrated Services Digital Broadcasting
ISDN
Integrated Services Digital Network
ISI
Inter-System Interface
ISI
Inter-Symbol Interference
ISIM
IMS capable Subscriber Identity Module
ISM
Industrial, Scientific and Medical (term for license-free

frequencies)
ISO
International Standardization Organization
ISP
Internet Service Provider
ISPC
International Signaling Point Code (ITU-T Q.708)
ISSI
Individual Short Subscriber Identity
ISUA
ISDN User Adaptation Layer
ISUP
ISDN User Part (ITU-T Q.761 - Q.765)
IT
Information Technology
- 317 -
- 318 -
ITSI
Individual TETRA Subscriber Identity
ITU
International Telecommunication Union
ITU-R
International Telecommunication Union Radiocommunications
ITU-T
International Telecommunication Union - Telecommunication

Sector
Iu-FP
Iu-Frame Protocol (3GTS 25.415)
IUA
ISDN Q.921 User Adaptation Layer (RFC 4233)
Iub_HS
Iub Interface with High Speed connection
Iub-FP
Iub-Frame Protocol (3GTS 25.427 / 25.435)
Iur-FP
Iur-Frame Protocol (3GTS 25.424, 3GTS 25.425, 25.426,

25.435)
IUT
Implementation under Test
IV
Initialization Vector
JD
Joint Detection
JPEG
Joint Picture Expert Group
K(ASME)
Key (Access Security Management Entity) (3GTS 33.401)
kbps
kilo-bits per second
KCK
EAPOL Key Confirmation Key
KDF
Key Derivation Function (3GTS 33.401)
KEK
Key Encryption Key (IEEE 802.16)
KEK
EAPOL Key Encryption Key
kHz
Kilo Hertz (103 Hertz)
KMC
Key Management Centres
KSG
Key Stream Generator
KSI
Key Set Identifier (3GTS 33.401)
L1
L2
Layer 2 (data link layer)
L2TP
Layer 2 Tunneling Protocol (RFC 2661)
L3
Layer 3 (network layer)
LA
Location Area
LA
Link Adaptation
LAC
Location Area Code
LACC
Location Area Country Code
LAI
Location Area Identification (LAI = MCC + MNC + LAC) [3GTS

23.003]
LAN
Local Area Network
LANC
Location Area Network Code
List of Acronyms
LAPB
Link Access Procedure Balanced
LAPD
Link Access Protocol for the ISDN D-Channel
LAPDm
Link Access Protocol for the D-Channel / modified for the GSM
air interface (3GTS 44.006)
LAPV5
Link Access Protocol for V5-interface
LATRED
Latency Reduction (Work item within GERAN-Evolution)
LB
Load Balancing
LB
Linearization Burst
LBS
Location Based Service
LCH
Logical Channel (3GTS 25.321 MAC-ehs)
LCH-Q
Linearization CHannel, QAM
LCID
Logical Channel ID
LCMC-SAP
Link entity Circuit Mode Control entity - Service Access Point
LCP
Link Control Protocol (PPP)
LCR
Low Chip Rate TDD
LCS
LoCation Service
LCT
Layered Coding Transport
LDAP
Lightweight Directory Access Protocol (RFC 3928)
LDB
Linearization Downlink Burst
LDPC
Low Density Parity Check
LE
Lower Effort PDB (DiffServ Term)
LEAP
Lightweight Extensible Authentication Protocol
LED
Light Emitting Diode
LER
Label Edge Router (MPLS)
LEX
Local Exchange Carrier
LI
Length Indicator
LIP
Location Information Protocol
LIP-SAP
Location Information Protocol - Service Access Point
LLC
Logical Link Control-Protocol
LLME
Lower Layer Management Entity
LMA
LMDS
Local Multipoint Distribution Services
LMM-SAP
Link entity Mobility Management - Service Access Point
LMMSE
Linear Minimum Mean Square Error receiver
LMU
Location Measurement Unit
LNET
ORF ATM Network
LNM
Local Network Management
- 319 -
- 320 -
LOG10
Logarithm of basis 10
LOS
Line Of Sight
LP
Low Priority Path (MPEG, DVB)
LPC
Linear Predictive Coding
LPD
Link Protocol Discriminator
LR
Location Register
LS
Line Station
LSB
Least Significant Bit
LSF
Last Segment Flag
LSI
Line Station Interface
LSP
Label Switched Path (MPLS)
LSR
Label Switch Router (MPLS)
LSSU
Link Status Signal Unit
LTE
LTE_ACTIVE
LTE State for active packet transmission
LTE_DETACHED
LTE State for UE not being registered in the network
LTE_IDLE
LTE State for non active packet transmission
LTF
Long Training Field
LTPD-SAP
Link entity TETRA Packet Data - Service Access Point
LUPR
Last User Power Ratio
LZS
Linearisation downlink Zeroed Set
M-bit
More bit
M-TMSI
MME - Temporary Mobile Subscriber Identity
M2PA
MTP-2 user Peer-to-Peer Adaptation Layer (RFC 4165)
M2UA
MTP-2 User Adaptation Layer (RFC 3331)
M3UA
MTP-3 User Adaptation Layer (RFC 4666)
MAC
MAC
MAC-d
Medium Access Control for the Dedicated Transport Channel

(3GTS 25.321)
MAC-e
MAC-E-DCH (3GTS 25.321)
MAC-ehs
MAC-Evolved High Speed
MAC-es
MAC-E-DCH SRNC (3GTS 25.321)
MAC-hs
MAC-High Speed (3GTS 25.321)
MAG
MAN
Metropolitan Area Network
MAP
Mobile Application Part (3GTS 29.002)
List of Acronyms
MAP-B
Mobile Application Part - B-interface protocol between MSC

and VLR
MAP-X
Mobile Application Part - various interface protocols like B-, C-,

D-, E-, F- or G-interface
MAR
Minimum to Average power Ratio
MASF
Minimum Available Spreading Factor
Max [X, Y]
The value shall be the maximum of X or Y, which ever is

bigger
MBit
Mega Bit
MBMS
Multimedia Broadcast / Multicast Service (3GTS 23.246, 3GTS

43.846)
MBMS_RRC_CONN RRC state for E-MBMS in LTE

ECTED
MBR
Maximum Bit Rate
MBS
Multicast Broadcast Services
MBSAT
Mobile Broadcast Satellite
MBSFN
MBMS Single Frequency Network
MBWA
Mobile Broadband Wireless Access [IEEE 802.20]
MBZ
Must Be Zero
MCC
Mobile Country Code [ITU-T E.212]
MCCH
Main Control CHannel
MCCH
MBMS point-to-multipoint Control Channel
MCH
Multicast Channel
MCM
Minimum Control Mode
Mcps
Mega Chip Per Second
MCS
Modulation and Coding Scheme
MCS-X
Modulation and Coding Scheme (1 - 9) and for HSDPA /

HSUPA
MCU
Multipoint Control Unit (H.323 equipment)
MD
Message Digest algorithm (e.g. MD-5)
MD-X
Message Digest Algorithm (MD-2, 4, 5 are defined) (MD-5 RFC

1321)
MDHO
Macro-Diversity Handover
MDSR
Modified Dual Symbol Rate
ME
Mobile Equipment (ME + SIM = MS)
MEGACO
Media Gateway Control Protocol (ITU-T H.248 incl. Annex F - H

and IETF RFC 3015)
MELPe
Mixed Excitation Linear Predictive
MER
Message Erasure Rate
- 321 -
- 322 -
MEX
Multimedia Exchange Layer
MExE
Mobile Station Application Execution Environment
MGC
Media Gateway Controller
MGCF
Media Gateway Control Function
MGCK
Modified Group Cipher key
MGCP
Media Gateway Control Protocol (RFC 2705)
MGT
MPEG PSI tables for ARIB
MGW
Media Gateway
MHP
Multimedia Home Platform
MHz
Mega Hertz (106 Hertz)
MIB
MIB
Management Information Base
MIC
Message Integrity Code
MICH
MBMS Notification Indicator Channel
MIDI
Musical Instrument Digital Interface
MIH
Media Independent Handover (IEEE 802.21)
MII
Ministry of Information Industry
MIKEY
Multimedia Internet KEYing (RFC 3830)
MIME
Multipurpose Internet Mail Extensions
MIMO
Multiple In / Multiple Out (antenna system)
MIN
Mobile Identity Number (North American Market)
Min [X, Y]
The value shall be the minimum of X or Y, which ever is

smaller
MINA
Mobile Internet Network Architecture
MIP
Mobile IP (RFC 2002, 3344, 3775)
MIPv4
Mobile IP Version 4
MISO
Multiple In / Single Out (antenna system)
MitM
Man in the Middle (attack)
MLD
Multicast Listener Discovery (RFC 2710)
MLE
Mobile Link Entity
MLME
MAC Sublayer Management Entity
MLP
MAC Logical Channel Priority
MLPP
Multi-Level Precedence and Pre-emption (ITU-T Q.85 / Clause

3)
MM
Mobility Management
MMCC
Multimedia Call Control
MMD
IP Multimedia Domain (name of the IMS in 3GPP2)
List of Acronyms
MMDS
Multipoint Microwave Distribution System or Multi-channel

Multi-point Distribution System
MME
Mobility Management Entity (3GTS 23.401) (Rel. 8 onwards)
MMEC
MME Code
MMEGI
MME Group Identity
MMEI
Mobility Management Entity Identity (3GTS 23.003)
MMI
Man-Machine-Interface
MMS
Multimedia Messaging Service (3GTS 22.140, 3GTS 23.140)
MN
Multiframe Number
MNC
Mobile Network Code
MNI
Mobile Network Identity
MNP
Mobile Number Portability
MNRG
Mobile Not Reachable for GPRS flag
MO
Mobile station Originating
MOBIKE
IKEv2 Mobility and Multihoming Protocol (RFC 4555)
MOC
Mobile Originating Call
MOCN
Multi-Operator Core Network
mod
modulo (base for counting)
MOPS
Million Operations Per second
MORE
Modulation Order and symbol Rate Enhancement
MOS
Mean Opinion Score
MP3
MPEG-1 Audio Layer 3
MPCC
Multiparty Call Control
MPDU
MAC Protocol Data Unit
MPE
Multi Protocol Encapsulation (DVB-H)
MPEG
Motion Picture Expert Group
MPEG2-TS
MPEG-2 Transport Stream (DVB)
MPLS
Multi Protocol Label Switching
MPN
Monitoring Pattern Number
MPRACH
MBMS Packet Random Access Channel ((E)GPRS)
MRC
Maximum Ratio Combining
MRF
Multimedia Resource Function
MRFC
Multimedia Resource Function Controller
MRFP
Multimedia Resource Function Processor
MRU
Maximum Receive Unit (PPP)
MRW
Move Receiving Window
MS
Mobile Subscriber Station [IEEE 802.16]
- 323 -
- 324 -
MS
Mobile Station
MS-ISDN
Mobile Subscriber - International Service Directory Number
MS-PD
Multislot Packet Data
MSB
Most Significant Bit
MSC
Mobile Services Switching Center
MSC-S
MSC-Server
MSCH
MBMS point-to-multipoint Scheduling Channel
MSDU
MAC Service Data Unit
MSK
Master Session Key
MSRD
Mobile Station Receive Diversity
MSRN
Mobile Station Roaming Number
MSRP
Message Session Relay Protocol (draft-ietf-simple-messagesessions-XX)
MSS
Maximum Segment Size (TCP)
MST
Multiple Slot Transmission
MSU
Message Signal Unit
MT
Mobile Terminal or Mobile Terminating
MT0
Mobile station Termination type 0
MT2
Mobile station Termination type 2
MTBF
Mean Time Between Failure
MTC
Mobile Terminating Call
MTCH
MBMS point-to-multipoint Traffic Channel
MTK
MBMS Traffic Key
MTP
Message Transfer Part (ITU-T Q.701 - Q.709)
MTP-3b
Message Transfer Part level 3 / broadband (ITU-T Q.2210)
MTTR
Mean Time To Repair
MTU
Maximum Transmit Unit (IP)
MUD
Multi-User-Detection unit
MUX
Multiplex
MVNO
Mobile Virtual Network Operator
N-PDU
Network-Protocol Data Unit (IP-Packet, X.25-Frame)
N-SAW
N-Channel Stop and Wait (3GTS 25.309, 3GTR 25.848)
N(R)
Received SDU (TL-SDU) Number
N(S)
Sent SDU (TL-SDU) Number
NACC
Network Assisted Cell Change (3GTS 44.060)
NACK
Negative Acknowledgement
NAF
Network Application Function (part of the Generic
List of Acronyms
Authentication Architecture (GAA))
NAI
Network Access Identifier (RFC 2486)
NAP
Network Access Provider
NAPT
Network Address Port Translation (RFC 3022)
NAPTR
Naming Authority Pointer (RFC 2915)
NAS
Non-Access-Stratum
NASS
Network Attachment SubSystem (part of the TISPAN NGNarchitecture)
NAT
Network Address Translation (RFC 1631)
NATO
North Atlantic Treaty Organisation
NAV
Network Allocation Vector
NBAP
NodeB Application Part (3GTS 25.433)
NBM
Network Based Mobility
NBNS
NetBios Name Service
NC
Network Control
NC
Network Connection
NC
Neighbor Cell
NCC
Network Color Code
NCM
Normal Control Mode
NCP
Network Control Protocol (PPP)
NDB
Normal Downlink Burst
NDI
New Data Indicator
NEMO
Network Mobility (RFC 3963)
NGMN
Next Generation Mobile Networks
NGN
Next Generation Networks
NI
Network Indicator
NIC
Network Interface Card
NIT
Network Information Table (MPEG2-TS PSI, DVB-SI)
NLOS
Non Line Of Sight
NMS
Network Management Subsystem
NMT
Nordic Mobile Telephone (analog cellular standard, mainly

used in Scandinavia)
NNI
Network-to-Network Interface
NOM
Network Operation Mode [3GTS 23.060]
NPB
Next Partial Bitmap
NPM
Non-Persistent Mode
NRA
National Regulatory Administration
- 325 -
- 326 -
NRI
Network Resource Identifier
NS
Network Service
NS-VC
Network Service - Virtual Connection
NS-VCG
Network Service - Virtual Connection Group
NS-VL
Network Service - Virtual Link
NSAP
Network Service Access Point
NSAPI
Network Service Access Point Identifier
NSE
Network Service Entity
NSF
NAS Node Selection function
NSIS
Next Steps in Signaling (RFC 4080)
NSLP
NSIS Signaling Layer Protocol (e.g. for resource reservation)
NSP
Network Service Provider
NSPC
National Signaling Point Code
NSR
Normal Symbol Rate
NSS
Network Switching Subsystem
NT
Network Termination
NTSC
National Television System Committee (video standard for

North America)
NUB
Normal Uplink Burst
NWG
Network Working Group (WiMAX Forum)
O-bit
Optional bit
O&M
Operation and Maintenance
OCNS
Orthogonal Channel Noise Simulator
OCS
Online Charging System (3GTS 23.203)
Octet
8 bit
OFCS
Offline Charging System (3GTS 23.203)
OFDM
Orthogonal Frequency Division Multiplexing
OFDMA
Orthogonal Frequency Division Multiple Access
OFUSC
Optional FUSC (Full Usage of Subchannels)
OLCM
Outgoing Leg Control Model
OMA
Open Mobile Alliance (http://www.openmobilealliance.org/)
OMAC
One-Key CBC-MAC (NIST standard: SP 800-38B and

http://csrc.nist.gov/CryptoToolkit/modes/proposedmodes/)
OMAP
Operation & Maintenance Application Part
OMC
Operation and Maintenance Center
OoBTC
Out of Band Transcoder Control (3GTS 23.153)
OOK
On OFF Keying
List of Acronyms
OP
Optional
OPC
Originating Point Code
OPEX
Operational Expenditure
OPUSC
Optional PUSC (Partial Usage of Subchannels)
OPWA
One Pass With Advertising (Term in RSVP)
ORF
Oesterreichischer Rundfunk
OSA
Open Service Access
OSA-SCS
Open Service Access - Service Capability Server
OSCP
Online Certificate Status Protocol (RFC 2560)
OSI
Open System Interconnection
OSP
Octet Stream Protocol
OSPF
Open Shortest Path First
OTAR
Over The Air Re-keying
OTDOA
Observed Time Difference Of Arrival
OVSF
Orthogonal Variable Spreading Factor
P-CCPCH
Primary Common Control Physical Channel (UMTS / used as

bearer for the BCH TrCH)
P-CPICH
Primary Common Pilot Channel (UMTS Physical Channel)
P-CSCF
Proxy Call Session Control Function (SIP)
P-GW
Packet Data Network Gateway (part of EPC)
P-SCH
Primary Synchronization Channel
P-TMSI
Packet TMSI
p/4-DQPSK
p/4-shifted Differential Quaternary Phase Shift Keying
p/8-D8PSK
p/8-shifted Differential 8 Phase Shift Keying
P/F-Bit
Polling/Final - Bit
P/S
Parallel to Serial
PA
Presence Agent (RFC 3856)
PA
Power Amplifier
PA
Pedestrian A mobile radio channel
PABX
Private Automatic Branch Exchange
PAC
Protected Access Credential
PACCH
Packet Associated Control Channel ((E)GPRS)
PACQ
Probability of synchronization burst ACQuisition
PACS
Personal Access Communication System
PAD
Packet Assembly Disassembly
PAGCH
Packet Access Grant Channel ((E)GPRS)
PAL
Phase Alternating Line (TV Norm)
- 327 -
- 328 -
PAMR
Public Access Mobile Radio
PAN
Piggybacked Ack/Nack
PAP
Password Authentication Protocol (RFC 1334)
PAPR
Peak-to-Average Power Ratio
PAR
Peak to Average power Ratio
PAT
Program Assocation Table (MPEG2-TS)
PB
Pedestrian B mobile radio channel
PBCC
Packet Binary Convolutional Code
PBCCH
Packet Broadcast Control Channel ((E)GPRS)
PBCH
Physical Broadcast Channel
PBS
Peak Burst Size
PC
Protocol Control
PC
Protocol Class (SCCP)
PC
Power Control
PC
Point Coordinator
PC
Personal Computer
PC
Paging Controller
PCC
Policy and Charging Control (3GTS 23.203)
PCCC
Parallel Concatenated Convolutional Code (possible Turbo

Coding Scheme)
PCCCH
Packet Common Control Channel ((E)GPRS)
PCCH
PCEF
Policy and Charging Enforcement Function (3GTS 23.203)
PCF
Point Coordination Function
PCFICH
Physical Control Format Indicator Channel
PCH
Paging Channel
PCI
Precoding Control Indication
PCI
Peripheral Component Interconnect (computer bus standard to

interconnect peripherals to the CPU)
PCM
Pulse Code Modulation
PCN
Personal Communication Network
PCOMP
Protocol COMpression Protocol
PCPCH
Physical Common Packet Channel (UMTS Physical Channel)
PCR
Program Clock Reference (MPEG)
PCRF
Policy and Charging Rules Function (3GTS 23.203)
PCS
Personal Communication System
PCU
Packet Control Unit
List of Acronyms
PD
PD
Packet Data
PDA
Personal Digital Assistant
PDB
Per Domain Behavior (DiffServ Term)
PDB
Packet Delay Budget
PDBF
Profile DataBase Function (TISPAN term / ETSI ES 282 004)
PDC
Personal Digital Communication (ARIB-Standard)
PDCCH
PDCH
Packet Data Channel
PDCP
PDF
Probability Density Function
PDF
Policy Decision Function (Part of the IP Multimedia Subsystem)
PDG
Packet Data Gateway
PDH
Plesiochronous Digital Hierarchy
PDN
Packet Data Network
PDN-GW
Packet Data Network Gateway (part of EPC)
PDO
Packet Data Optimised
PDP
Packet Data Protocol
PDS
Power Density Spectrum
PDS
Packet Data Subsystem (3GPP2)
PDSCH
PDSN
Packet Data Support Node (the SGSN in 3GPP2)
PDTCH
Packet Data Traffic Channel ((E)GPRS)
PDU
Protocol Data Unit or Packet Data Unit
PEAP
Protected Extensible Authentication Protocol
PEI
Peripheral Equipment Interface
PEP
Policy Enforcement Point (3GTS 23.209)
PER
PES
Packetised Elementary Stream (DVB)
PES
PSTN/ISDN Emulation Subsystem (part of the TISPAN NGNarchitecture)
PFC
Packet Flow Context
PFI
Packet Flow Identifier
PG
Processing Gain: 10 * LOG10 (3.84 Mcps / user_data_rate)
PHB
Per Hop Behavior (DiffServ Term)
PhCH
Physical Channel
PHICH
Physical HARQ Acknowledgement Indicator Channel
- 329 -
- 330 -
PHS
Personal Handy phone System
PHS
Payload Header Suppression (IEEE 802.16)
PHY
Physical Layer
PHz
Peta Hertz (1015 Hertz)
PI
Priority Indicator
PI
Paging Indicator
PICH
Page Indicator Channel (UMTS Physical Channel)
PICMG
PCI (Peripheral Component Interconnect) Industrial Computer

Manufacturers Group (http://www.picmg.org/)
PICS
Protocol Implementation Conformance Statement
PID
Packet Identifier (MPEG2-TS)
PIDF
Presence Information Data Format (RFC 3863)
PIFS
Point (coordination function) InterFrame Space
PIN
Personal Identification Number
PIR
Peak Information Rate
PIXIT
Protocol Implementation Extra Information for Testing
PKCS
Public Key Cryptography Standard
PKI
Public Key Infrastructure
PKMv2
Privacy Key Management Version 2
PL
Puncturing Limit (3GTS 25.212)
PL
Physical Layer
PL-SAP
Packet link Layer Service Access Point
PLC
Power Line Communications
PLCP
Physical Layer Convergence Procedure
PLmax
E-DCH maximum Puncturing Limit (3GTS 25.212)
PLME
Physical Layer Management Entity
PLMN
PLnon-max
Puncturing Limit not requiring maximum physical channels

(3GTS 25.212)
PLR
Packet Loss Rate
PLW
PDSU Length Word
PMCH
Physical Multicast Channel
PMD
Physical Medium Dependent
PMI
Precoding Matrix Indicator
PMIP
Proxy Mobile IP
PMIPv6
PMK
Pairwise Master Key
List of Acronyms
PMKID
Pairwise Master Key Identity
PMKSA
Pairwise Master Key Security Association
PMM
Packet Mobility Management
PMR
Professional Mobile Radio
PMR
Private Mobile Radio
PMT
Program Map Table (MPEG2-TS)
PMTU
Path MTU
PN
Pseudo Noise
PN
Packet Number
PNCH
Packet Notification Channel ((E)GPRS)
PNG
Portable Network Graphics
PO
Power Offset
PoC
Push to talk over Cellular (3GTR 29.979 and various OMAspecifications)
PoE
Power over Ethernet
POP
Post Office Protocol (RFC 1939)
POP3
Post Office Protocol version 3
POTS
Plain Old Telephone Service
PPCH
Packet Paging Channel ((E)GPRS)
PPDU
PLCP Protocol Data Unit
PPM
Pulse Position Modulation
PPP
Point-to-Point Protocol (RFC 1661)
PRA
PCPCH Resource Availability
PRACH
PRACH
Packet Random Access Channel
PRACK
Provisional Response Acknowledgement (SIP-method type)
PRD
Bluetooth Qualification Program Reference Document
PRF
Pseudo Random Function
PRI
Primary rate access ISDN-user interface for PABX's (23 or 30

B-channels plus one D-Channel)
PRNG
Pseudo Random Number Generator
PS
Puncturing Scheme
PS
Program Stream
PS
Power Save
PS
Physical Slot (IEEE 802.16)
PS
Packet Switched
PSC
Primary Synchronization Code or Primary Scrambling Code
- 331 -

(both used in UMTS)
- 332 -
PSD
Power Spectral Density (3GTS 25.215 / 3GTS 25.102)
PSDU
PLCP Service Data Unit
PSF
PLCP Signaling Field
PSI
Program Specific Information (MPEG2-TS)
PSIP
MPEG PSI tables for ARIB, similar to DVB-PSI
PSK
Preshared Key
PSK
Phase Shift Keying
PSPDN
Packet Switched Public Data Network
PSS 1
Private integrated Signalling System No. 1
PSTN
Public Switched Telephone Network
PT
Protocol Type (GTP or GTP')
PTCCH
Packet Timing Advance Control Channel ((E)GPRS)
PTCCH/D
Packet Timing Advance Control Channel / Downlink Direction

((E)GPRS)
PTCCH/U
Packet Timing Advance Control Channel / Uplink Direction

((E)GPRS)
PTI
PTK
Pairwise Transient Key
PTKSA
Pairwise Transient Key Security Association
PTM
Point to Multipoint
PTP
Point to Point
PTS
Presentation Time Stamp
PTT
Post, Telephone & Telegraph (abbreviation for the former

government owned organizations that were responsible for all
three services)
PUA
Presence User Agent (RFC 3856)
PUCCH
PUEM
Probability of Undetected Erroneous Message
PUSC
Partial Usage of Subchannels
PUSCH
PVC
Permanent Virtual Circuit
QAM
n symbols Quadrature Amplitude Modulation (n = 16, 32,

64, ...)
QAP
QoS Assess Point
QBSS
Quality of Service Basic Service Set
QCI
QoS Class Identifier (3GTS 23.203)
QCIF
Quarter Common Intermediate Format (176 x 144 pixels ITU-T
List of Acronyms
H261 / H263)
QE
Quality Estimate
QoS
Quality of Service
QPSK
Quadrature Phase Shift Keying
QSIG
Q-interface signaling protocol
QSTA
Quality of Service Station
R-GSM
Railways-GSM
RA
Routing Area
RA
Registered Area
RA
Receive Address
RA-RNTI
Random Access Radio Network Temporary Identifier
RAA
RE-Auth-Answer command (Diameter BASE, RFC 3588)
RAB
Random Access uplink Burst
RAB
Radio Access Bearer
RAC
Routing Area Code
RAC
Radio Admission Control
RACC
Routing Area Color Code [3GTS 44.018 (10.5.2.34)]
RACH
RACS
Resource and Admission Control Subsystem (part of the

TISPAN NGN-architecture)
RADIUS
Remote Authentication Dial In User Service (RFC 2865)
RAI
Routing Area Identification
RAM
Random Access Memory
RAN
Radio Access Network
RANAP
Radio Access Network Application Part (3GTS 25.413)
RAND
Random Number
RAR
RE-Auth-Request command (Diameter BASE, RFC 3588)
RAT
Radio Access Technology (e.g. GERAN, UTRAN, ...)
RATSCCH
Robust AMR Traffic Synchronized Control CHannel
RB
Resource Block
RB
Receive Block Bitmap (EGPRS)
RB
Radio Bearer
RBB
Receive Block Bitmap (GPRS)
RBC
Radio Bearer Control
RBPSCH
Shared Basic Physical SubCHannel
RC4
Rivest Cipher 4
RCPC
Rate Compatible Punctured Convolutional
- 333 -
- 334 -
RDC
Radio Downlink Counter
RDC-NC
Radio Downlink Counter - Non Conforming channel
RDC-Q
Radio Downlink Counter, QAM
RED
Random Early Detection
RED
REduced symbol Duration
REJ
Reject
REQ
Request (COPS message type)
RES
Response
RF
Radio Frequency
RFC
Request for Comments (Internet Standards)
RFID
Radio Frequency Identification
RG
Relative Grant (3GTS 25.309)
RIP
Routing Information Protocol
RL
Radio Link (3GTS 25.433)
RL-TBF
Reduced Latency Temporary Block Flow [3GTS 43.064]
RLC
Radio Link Control
RLM
Radio Link Management (Protocol Part on the GSM AbisInterface / 3GTS 48.058)
RLP
Radio Link Protocol (3GTS 24.022)
RLS
Radio Link Set (3GTS 25.309, 25.433)
RM
Reed-Muller
RM
Rate Matching
RMS
Root Mean Square
RNC
RNL
Radio Network Layer
RNR
Receive Not Ready
RNS
Radio Network Subsystem
RNSAP
Radio Network Subsystem Application Part (3GTS 25.423)
RNSN
Radio Network Serving Node
RNTI
RoHC
ROHC
ROI
Return On Invest
Roope53vISO
International Organization for Standardization
RoT
Rise over Thermal (interference rise relative to zero load)
RPE/LTP
Regular Pulse Excitation / Long Term Prediction (Speech

Codec)
List of Acronyms
RPID
Rich Presence Information Data
RPLMN
Registered PLMN
RPR
Resilient Packet Ring (IEEE 802.17)
RR
Receive Ready (LAPD/LLC/RLP-Frame Type)
RR
Radio Resource Management
RRA
Radio Resource Agent
RRBP
Relative Reserved Block Period
RRC
RRC_CONNECTED RRC state in E-UTRA

RRC_IDLE
RRC state
RRC_MBMS_CONN RRC state in E-UTRA for UEs with MBMS service only
ECTED
RRC-Filter
Root Raised Cosine Filter
RRLP
Radio Resource LCS Protocol
RRM
Radio Resource Management
RS
Reference Signal
RSA
Ron Rivest, Adi Shamir and Leonard Adleman-algorithm

(Public Key Encryption / PKCS #1)
RSADP
RSA-Decryption Primitive (RFC 3447 (5.1.2) or PKCS #1

(5.1.2); PKCS = Public Key Cryptography Standard)
RSAEP
RSA-Encryption Primitive (RFC 3447 (5.1.1) or PKCS #1

(5.1.1); PKCS = Public Key Cryptography Standard)
RSAES-OAEP
RSA Encryption Scheme - Optimal Asymmetric Encryption

Padding (PKCS #1 / RFC 3447)
RSC
Recursive Systematic Convolutional Coder (Turbo Coding,

25.212)
RSCP
Received Signal Code Power (3GTS 25.215)
RSN
Retransmission Sequence Number (3GTS 25.309, 25.212)
RSNA
Robust Security Network Association
RSRP
RSRQ
RSSI
Received Signal Strength Indicator
RST
Running Status Table (DVB-SI)
RSTD
Reference Signal Time Difference
RSVP
Resource Reservation Protocol (RFC 2205)
RT
Real Time
RTCM
Radio Technical Commission for Maritime Services
RTCP
Real-time Transport Control Protocol
RTG
Receive transmit Transition Gap (IEEE 802.16 (3.45)) the time

- 335 -

between an uplink subframe and the subsequent downlink
subframe in a TDD-system
- 336 -
RTO
Retransmission Time Out
RTP
Real-time Transport Protocol (RFC 3550, RFC 3551)
RTP/AVP
Real-time Transport Protocol / Audio Video Profile (RFC 3551)

(used in SDP-descriptions)
RTP/AVPF
Real-time Transport Protocol / extended Audio Video Profile for

rtcp Feedback (used in SDP-descriptions)(draft-ietf-avt-rtcpfeedback-11.txt)
RTP/SAVP
Real-time Transport Protocol / Secure Audio Video Profile (RFC

3711) (used in SDP-descriptions)
RTS
Request To Send
RTSP
Real Time Streaming Protocol (RFC 2326)
RTT
Round Trip Time
RTTI
Reduced Transmission Time Interval
RTTVAR
Round Trip Time Variation
RTWP
Received Total Wideband Power
RUIM
Removable User Identity Module
RV
Redundancy and Constellation Version (3GTS 25.212)
Rx
Receive(r)
RX
Receive
S-CCPCH
Secondary Common Control Physical Channel (used as bearer

for the FACH and PCH TrCH's / UMTS Physical Channel)
S-CPICH
Secondary Common Pilot Channel (UMTS Physical Channel)
S-CSCF
Serving Call Session Control Function (SIP)
S-GW
S-SCH
Secondary Synchronization Channel (physical)
S-TMSI
SAE Temporary Mobile Subscriber Identity
S(R)
Received segment Sequence number
S(S)
Sent segment Sequence number
S/P
Serial to Parallel
S1-AP
S1-interface Application Part protocol (3GTS 36.413)
SA
System Architecture
SA
Source Address
SA
Service Area
SA
Security Association
SAAL-NNI
Signaling ATM Adaptation Layer - Network Node Interface
SAB
Service Area Broadcast
SABM(E)
Set Asynchronous Balanced Mode (Extended for Modulo 128
List of Acronyms
operation) (LAPD/LLC/RLP-Frame Type)
SABP
Service Area Broadcast Protocol (3GTS 25.419)
SACCH
Slow Associated Control Channel (GSM)
SACCH/MD
SACCH Multislot Downlink (related control channel of TCH/FD/

GSM)
SACK
Selective Acknowledgement
SAE
SAI
Service Area Identifier
SAIC
Single Antenna Interference Cancellation
SANC
Signaling Area Network Code (ITU-T Q.708)
SAP
Service Access Point
SAPI
Service Access Point Identifier
SAR
Specific Absorption Rate
SAR
Segmentation And Reassembly (ATM-sublayer)
SAT
Satellite
SAW
Stop and Wait Machine
SB
Synchronization downlink Burst
SB
Scheduling Block
SBC
Session Border Controller (SIP term, usually a B2BUA with

NAT-function and media gateway)
SBLP
Service Based Local Policy
SBN
Source Block Number
SBPSCH
Shared Basic Physical SubCHannel
SC
Subcarrier
SC
Serving Cell
SC-FDMA
Single Carrier Frequency Division Multiple Access
SCCH
Secondary Control CHannel
SCCP
Signaling Connection Control Part (ITU-T Q.711 - Q.714)
SCF
Service Control Function (CAMEL)
SCH
Synchronization Channel
SCH
Signalling CHannel
SCH-P8/F
Signalling CHannel, pi/8-D8PSK, Full size
SCH-P8/HD
Signalling CHannel, pi/8-D8PSK, Half size Downlink
SCH-P8/HU
Signalling CHannel, pi/8-D8PSK, Half size Uplink
SCH-Q
Signalling CHannel, QAM
SCH-Q/D
Signalling CHannel, QAM Full size Downlink
SCH-Q/HU
Signalling CHannel, QAM Half size Uplink
- 337 -
- 338 -
SCH-Q/RA
Signalling CHannel, QAM Random Access Uplink
SCH-Q/U
Signalling CHannel, QAM Full size Uplink
SCH/F
Signalling CHannel, Full size
SCH/HD
Signalling CHannel, Half size Downlink
SCH/HU
Signalling CHannel, Half size Uplink
SCK
Static Cipher Key
SCLNS
Specific ConnectionLess Network Service
SCN
Switching Control Node
SCP
Service Control Point (IN)
SCR
Source Controlled Rate
SCTP
Stream Control Transmission Protocol (RFC 2960)
SD
Sample Duration
SDCCH
Stand Alone Dedicated Control Channel
SDH
Synchronous Digital Hierarchy
SDK
Software Development Kit
SDMA
Space Division Multiple Access
SDP
Session Description Protocol (RFC 2327, RFC 3266, RFC 3264)
SDS
Short Data Service
SDT
Service Description Table (DVB-SI)
SDTI
Short Date Type Identifier
SDTV
Standard Definition TV
SDU
Service Data Unit (the payload of a PDU)
SEG
Security Gateway
SEP
Signaling End Point (CCS7)
SF
Spreading Factor
SF
Slot Flag
SFBC
Space Frequency Block Codes
SFD
Start Frame Delimiter
SFH
Slow Frequency Hopping
SFID
Service Flow Identity
SFN
System Frame Number
SFN
Single Frequency Network
SFPG
Security and Fraud Prevention Group
SG
Serving Grant respectively Power Grant (3GTS 25.213,

25.309, 25.321)
SG
Security Gateway (IPsec / RFC 2401)
SGCP
Simple Gateway Control Protocol
List of Acronyms
SGi
Reference Point in LTE
SGLUPR
Last Used Power Ratio according to SG table index (3GTS

25.321)
SGsAP
SGs-interface Application Part protocol (3GTS 29.118)
SGSN
SGW
Signaling Gateway
SHA
SHCCH
Shared Channel Control Channel (UMTS Logical Channel / TDD

only)
SHO
Soft Handover (UE is having more than one radio link at the
same time and combines them)
SI
Service Information
SI
Service Indicator
SI
Segment Indicator
SI
Scheduling Info
SIB
SIB
LSSU with status indication busy
SIC
Serial Interference Cancellation
SICH-Q
Slot Information CHannel, QAM
SICH-Q/D
Slot Information CHannel, QAM Downlink
SICH-Q/U
Slot Information CHannel, QAM Uplink
SID
Size InDex (3GPP 25.321)
SID
Silence Insertion Descriptor
SIE
LSSU with status indication emergency alignment
SIF
Signaling Information Field
SIFS
Short InterFrame Space
SIG
Special Interest Group (e.g. Bluetooth)
SIGQ
Signaling Queue
SIGTRAN
Signaling Transport (RFC 2719)
SIM
Subscriber Identity Module
SIMO
Single In / Multiple Out (antenna system)
SIN
LSSU with status indication normal alignment
SIO
Service Information Octet
SIO
LSSU with status indication out of alignment
SIOS
LSSU with status indication out of service
SIP
Session Initiation Protocol (RFC 3261)
SIP-AS
SIP-Application Server
- 339 -
- 340 -
SIP-B
SIP for Businesses (abbreviation for a set of PABX-specific SIPextensions)
SIP-I
SIP with encapsulated ISUP (ITU-T Q.1912.5)
SIP-T
SIP for Telephones (RFC 3372, RFC 3398)
SIPO
LSSU with status indication processor outage
SIQ
Service Information Query
SIR
Signal to Interference Ratio
SISO
Single In / Single Out (antenna system)
SLA
Service Level Agreement
SLC
Signaling Link Code
SLF
Subscriber Locator Function
SLR
Source Local Reference
SLS
Signaling Link Selection
SLTA
Signaling Link Test Acknowledge
SLTM
Signaling Link Test Message
SM
Session Management (3GTS 23.060, 3GTS 24.008)
SM-SC
Short Message Service Center
SME
Station Management Entity
SME
Small and Medium size Enterprises (Type of Business)
SMG
Special Mobile Group
SMI
Short Management Identity
SMIL
Synchronized Multimedia Integration Language
SMKSA
Station to Station link Master key Security Association
SMLC
Gateway Mobile Location Center
SMS
Short Message Service (3GTS 24.011, 3GTS 23.040)
SMS-G-MSC
SMS Gateway MSC (for Short Messages destined to Mobile

Station)
SMS-IW-MSC
SMS Interworking MSC (for Short Messages coming from

Mobile Station)
SMSCB
Short Message Services Cell Broadcast
SMTP
Simple Mail Transfer Protocol (RFC 2821)
SN
Symbol Number or SNDCP
SN
Sequence Number
SN-PDU
Segmented N-PDU (SN-PDU is the payload of SNDCP)
SN-Q
Symbol Number in QAM
SN-SAP
SNDCP-Service Access Point
SNA
Short Number Address
List of Acronyms
SND
Sequence Number Downlink (GTP)
SNDCP
Subnetwork Dependent Convergence Protocol
SNEI
SNDCP Network Endpoint Identifier
SNIR
Signal to Noise and Interference Ratio
SNM
Signaling Network Management Protocol (ITU-T Q.704 (3))
SNN
SNDCP N-PDU Number Flag
SNR
Signal to Noise Ratio
SNTM
Signaling Network Test & Maintenance (ITU-T Q.707)
SNTP
Simple Network Time Protocol (RFC 2030)
SNU
Sequence Number Uplink (GTP)
SO
Segment Offset
SOAP
Simple Object Access Protocol

(http://www.w3.org/TR/2000/NOTE-SOAP-20000508)
SOHO
Small Office Home Office (Type of Business)
SP
Signaling Point
SPC
Signaling Point Code
SPI
Security Parameter Index (RFC 2401)
SPR
Subscription Profile Repository (3GTS 23.203)
SQCIF
Semi Quarter Common Intermediate Format (128 x 96 pixels

ITU-T H261 / H263)
SQN
Sequence number (used in UMTS-security architecture / 3GTS

33.102)
SRB
SRES
Signed Response
SRF
Service Resource Function (CAMEL)
SRNC
Serving Radio Network Controller
SRNS
Serving Radio Network Subsystem
SRS
Sounding Reference Symbol
SRTP
Secure RTP (RFC 3711)
SRTT
Smoothed RoundTrip Time
SRV
Service Location (DNS-related / RFC 2782)
SRVCC
Single Radio Voice Call Continuity (3GTS 23.216)
SS
Supplementary Service
SS
Subscriber Station (IEEE 802.16)
SS
Spatial Stream
SS7
Signaling System No 7
SSC
Secondary Synchronization Code
- 341 -
- 342 -
SSCF
Service Specific Co-ordination Function
SSCF/NNI
Service Specific Coordination Function - Network Node

Interface Protocol (ITU-T Q.2140)
SSCF/UNI
Service Specific Coordination Function - User Network

Interface Protocol (ITU-T Q.2130)
SSCOP
Service Specific Connection Oriented Protocol (ITU-T Q.2110)
SSCOPMCE
Service Specific Connection Oriented Protocol in a Multi-link or

Connectionless Environment (ITU-T Q.2111)
SSCS
Service Specific Convergence Sublayer
SSDT
Site Selection Diversity Transmission
SSF
Service Switching Function (CAMEL)
SSI
Short Subscriber Identity
SSID
Service Set Identifier (IEEE 802.11)
SSN
SubSlot Number
SSN
Start Sequence Number (related to ARQ-Bitmap in GPRS /

EGPRS) or Send Sequence Number (GSM MM and CCProtocols) or Sub-System Number (SCCP)
SSN
Send Sequence Number (GSM MM and CC-Protocols)
SSP
Service Switching Point (IN)
SSRC
Contributing Source (RTP)
SSRTG
Subscriber Station Receive to transmit Turnaround Gap (IEEE

802.16 (3.53)) Time that the SS needs to switch from receive
to transmit.
SSS
Secondary sync Sequence Set
SSSAR
Service Specific Segmentation And Reassembly (ITU-T

I.366.1)
ssthresh
Slow start threshold (RFC 2001, RFC 2960)
SSTTG
Subscriber Station Transmit to receive Turnaround Gap (IEEE

802.16 (3.54)) Time that the SS needs to switch from transmit
to receive.
SSVE
Sum Square Vector Error
ST
Stuffing Table (DVB-SI)
STA
Station
STAkey
Station Key
STAkeySA
Station Key Security Association
STANAG
Standardisation Agreement (NATO)
STBC
Space Time Block Coding
STC
Space Time Coding
STC
Signaling Transport Converter on MTP-3 and MTP-3b (ITU-T

Q.2150.1) / Signaling Transport Converter on SSCOP and
SSCOPMCE (ITU-T Q.2150.2)
List of Acronyms
STCH
STealing CHannel
STF
Short Training Field
STP
Signaling Transfer Point
STS
Space Time Stream
STTD
Space Time block coding based Transmission Diversity
STUN
Simple Traversal of UDP through Network Address Translators

(RFC 3489)
SU
Scheduling Unit
SUA
SCCP User Adaptation Layer (RFC 3868)
SUERM
Signal Unit Error Rate Monitor (ITU-T Q.703 (10))
SUFI
Super Field (RLC-Protocol)
SUN
Originally stood for Stanford University Network
SVC
Switched Virtual Circuit
SVG
Scalable Vector Graphics
SW
Software
SWAP
Shared Wireless Access Protocol (Home RF)
SwMI
Switching and Management Infrastructure
SYNC
Synchronization protocol in LTE for E-MBMS
T-PDU
Payload of a G-PDU which can be user data, i.e. possibly

segmented IP-frames, or GTP signaling information (GTP)
T.38
Fax Specification
TA
Transmitter Address
TA
Tracking Area
TA
Timing Advance
TA
Terminal Adapter (ISDN)
TAC
Tracking Area Code
TACS
Total Access Communication System
TAF
Terminal Adopter Function (3GTS 27.001)
TAI
Tracking Area Identity (3GTS 24.301)
TAI
Timing Advance Index
TB
Transport Block
TBCP
Talk Burst Control Protocol
TBF
Temporary Block Flow
TBS
Transport Block Set
TC
Turbo Coding (3GTS 25.212)
TC
Technical Committee
TCAP
Transaction Capabilities Application Part (Q.771 - Q.773)
- 343 -
- 344 -
TCB
Transmission Control Block
TCH
Traffic Channel
TCH-AFS
Traffic CHannel Adaptive Full rate Speech
TCH-AHS
Traffic Channel Adaptive Half rate Speech
TCH-P8/10,8
Traffic CHannel, pi/8-D8PSK, net rate = 10,8 kbit/s
TCH/2,4
Traffic CHannel, net rate = 2,4 kbit/s
TCH/4,8
TCH/7,2
TCH/FD
Traffic Channel / Fullrate Downlink
TCH/S
Speech Traffic CHannel
TCP
TCP/BFCP
Transmission Control Protocol / Binary Floor Control Protocol

(draft-ietf-xcon-bfcp-05.txt)
TCP/IP
Transmission Control Protocol over IP
TCP/RTP/AVP
Real-time Transport Protocol / Audio Video Profile over TCP

(used in SDP-descriptions)(draft-ietf-avt-rtp-framing-contrans06.txt)
TCP/TLS/BFCP
Transmission Control Protocol / Transport Layer Security /

Binary Floor Control Protocol (draft-ietf-xcon-bfcp-05.txt)
TCTF
Target Channel Type Field
TCTV
Transport Channel Traffic Volume
TDD
Time Division Duplex
TDM
Time Division Multiplexing
TDMA
Time Division Multiple Access
TDOA
Time Difference of Arrival
TDT
Time and Date Table (DVB-SI)
TE
Terminal Equipment
TE2
TE presenting a TETRA interface
TEA1/2/3/4
TETRA Encryption Algorithm(s) 1,2,3 and 4
TEBS
Total E-DCH Buffer Status
TEDS
TETRA Enhanced Data Service
TEI
Terminal Equipment Identity
TEID
Tunnel Endpoint Identifier (GTP / 3GTS 29.060)
TEK
Traffic Encryption Key (IEEE 802.16)
Term
Explanation
TETRA
Terrestrial Trunked Radio
TETRA V+D
TETRA Voice + Data
TF
Transport Format
List of Acronyms
TFC
Transport Format Combination
TFCI
Transport Format Combination Identifier
TFCS
Transport Format Combination Set
TFI
Transport Format Indication (UMTS)
TFI
Temporary Flow Identity ((E)GPRS)
TFO
Tandem Free Operation (3GTS 22.053)
TFRC
Transport Format and Resource Combination (3GTS 25.308)
TFRI
Transport Format and Resource Indicator (3GTS 25.308,

25.321)
TFS
Transport Format Set
TFT
TFTP
Trivial File Transfer Protocol (RFC 1350)
TGD
Transmission Gap start Distance (3GTS 25.215)
TGL
Transmission Gap Length (3GTS 25.215)
TGPRC
Transmission Gap Pattern Repetition Count (3GTS 25.215)
TGSN
Transmission Gap Starting Slot Number (3GTS 25.215)
TH-CDMA
Time Hopping Code Division Multiple Access
THIG
Topology Hiding Inter Network Gateway
THP
Traffic Handling Priority (DiffServ Term)
THz
Tera Hertz (1012 Hertz)
TI
Transaction Identifier
TIA
Telecommunications Industry Association
TID
Tunnel Identifier
TID
Traffic Identifier
TIM
Traffic Indication Map
TIP
TETRA Interoperability Profile
TIPHON
Telecommunications and Internet Protocol Harmonization Over

Networks (ETSI Project)
TISPAN
Telecoms & Internet converged Services & Protocols for

Advanced Networks (ETSI Working Group to define IMS for
fixed broadband access networks)
TK
Temporal Key
TKIP
Temporal Key Integrity Protocol
TL
TETRA LLC
TLA-SAP
TETRA LLC Service Access Point A
TLB-SAP
TETRA LLC Service Access Point B
TLC-SAP
TETRA LLC Service Access Point C
TLE-SAP
TETRA LLC Service Access Point E
- 345 -
- 346 -
TLLI
Temporary Logical Link Identifier
TLS
Transport Layer Security (RFC 2246 / RFC 3546 / formerly

known as SSL or Secure Socket Layer)
TLV
Tag / Length / Value Notation
TM
Trunked Mode
TM
TM
Transmission Modules
TM
TETRA MAC
TMA-SAP
TETRA MAC Service Access Point A
TMB-SAP
TETRA MAC Service Access Point B
TMC-SAP
TETRA MAC Service Aaccess Point C
TMD
Transparent Mode Data (UMTS RLC PDU-type)
TMD-SAP
TETRA MAC Service Aaccess Point D
TMGI
Temporary Mobile Group Identity (3GTS 23.003 (15.2))
TMN
Telecommunication Management Network
TMSI
Temporary Mobile Subscriber Identity
TMV-SAP
TETRA MAC Virtual SAP
TN
Timeslot Number
TNCC-SAP
TETRA Network layer Call Control - Service Access Point
TNL
Transport Network Layer (3GTS 25.401)
TNMM
TETRA Network Mobility Management
TNP
TETRA Network Protocol
TNSDS-SAP
TETRA Network layer Short Data Service - Service Access

Point
TNSS-SAP
TETRA Network layer Supplementary Services - Service Access

Point
TOI
Transport Object Identifier
ToIP
Text over IP
TOM
Tunneling Of Messages [3GTS 44.064]
TOM2
Tunneling Of Messages over LLC-SAPI 2 (for high priority

signaling messages)[3GTS 44.064]
TOM8
Tunneling Of Messages over LLC-SAPI 8 (for low priority

signaling messages)[3GTS 44.064]
TOS
Type of Service
TOT
Time Offset Table
TP
Traffic Physical channel
TP-UD
Transfer Protocol - User Data (in GSM)
TPC
Transmit Power Control
List of Acronyms
TPC
Transmit Power Command
TPS
Transmission Parameter Signaling (DVB-H)
TPTI
Transmitting Party Type Identifier
TQI
Temporary Queuing Identifier
TRAU
Transcoder and Rate Adaption Unit
TrCH
Transport Channel (UMTS)
TrFO
Transcoder Free Operation
TrGw
Transition Gateway (IPv4 IPv6) (3GTS 23.228 (5.18))
TRX
Transmitter / Receiver
TS
Transport Stream
TS
Traffic Stream
TS
Timeslot
TS
Time Sharing
TSC
Training Sequence Code
TSC
Temporal Key Integrity Protocol Sequence Counter
TSI
TETRA Subscriber Identity
TSN
Transmission Sequence Number
TSTD
Time Switched Transmit Diversity
TTA
Telecommunications Technology Association (South Korean

standards organization)
TTG
Tunnel Termination Gateway
TTG
Transmit receive Transition Gap (IEEE 802.16 (3.63)) the time

between a downlink subframe and the subsequent uplink
subframe in a TDD-system
TTI
Transmission Time Interval
TTL
Time To Live (IP-Header / RFC 791)
TTR
TETRA Association Technical Report
TU50
Typical Urban 50 km/h
TUA
TCAP User Adaptation Layer
TUP
Telephone User Part
TUSC
Tile Use of Subchannels
TV
Television
Tx
Transmit(ter)
TX
Transmit
TxAA
Transmit Adaptive Arrays
TXOP
Transmission Opportunity
U-MST
Uplink Multiple Slot Transmission
- 347 -
- 348 -
U-SAP
User Service Access Point
UA
User Agent (SIP-Term / RFC 3261)
UA
Unnumbered Acknowledgement (LAPD/LLC/RLP-Frame Type)
UAC
User Agent Client (SIP-Term / RFC 3261)
UARFCN
UMTS Absolute Radio Frequency Channel Number
UART
Universal Asynchronous Receiver and Transmitter
UAS
User Agent Server (SIP-Term / RFC 3261)
UAS-X
egprs2 Uplink level A modulation and coding Scheme (x =

7..11)
UBS-X
egprs2 Uplink level B modulation and coding Scheme (x =

5..12)
UCD
Uplink Channel Descriptor (WiMAX Message)
UCI
Uplink Control Indicator
UCS
Universal Character Set
UCS-2
Universal Character Set coded in 2 octets
UDCH
User-plane Dedicated Channel (3GTS 45.902)
UDH
User Data Header
UDP
UDPTL
UDP Transport Layer (used in SDP-description for T.38 faxapplications)
UE
User Equipment
UEA
UMTS Encryption Algorithm (3GTS 33.102)
UGS
Unsolicited Grant Service (IEEE 802.16 Traffic Class)
UHF
Ultra High Frequency
UI
Unnumbered Information (LAPD) / Unconfirmed Information

(LLC) / Frame Type
UIA
UMTS Integrity Algorithm (3GTS 33.102)
UICC
Universal Integrated Circuit Card (3GTS 22.101 / Bearer card

of SIM / USIM)
UIUC
Uplink Interval Usage Code (WiMAX Term)
UL
Uplink
UL_DTX
Uplink Discontinuous Transmission
UL-MAP
Uplink-Medium Access Protocol (MAC-Message in WiMAX /

IEEE 802.16)
UL-SCH
UM
UMA
Unlicensed Mobile Access (3GTS 43.318)
UMAN
Unlicensed Mobile Access Network
UMB
Ultra Mobile Broadband (3GPP2's EV-DO Rev C)
List of Acronyms
UMD
Unacknowledged Mode Data (UMTS RLC PDU-type)
UMS
User Mobility Server (HSS = HLR + UMS)
UMTS
Universal Mobile Telecommunication System
UMTS-AKA
Universal Mobile Telecommunication System - Authentication

and Key Agreement (3GTS 33.102)
UNC
UMA Network Controller
UNC-SGW
UMA Network Controller Security Gateway
UNI
User-to-Network Interface
UP
User Priority
UP
Unallocated Physical channel
URA
UTRAN Registration Area
URA_PCH
RRC URA State in UTRA
URB
User Radio Bearer
URI
Uniform Resource Identifier
URL
Uniform Resource Locator (RFC 1738)
US
United States
USA
United States of America
USAT
USIM Application Toolkit
USB
Universal Serial Bus
USCH
Uplink Shared Channel (UMTS Transport Channel TDD only)
USD
User Service Description
USF
Uplink State Flag
USIM
USS
Uplink sync Sequence Set
USSI
Unexchanged Short Subscriber Identity
UTF-16BE
Unicode Transformation Format serialized as two bytes in BigEndian format
UTF-8
Unicode Transformation Format-X (Is an X-bit) lossless

encoding of Unicode characters
UTRA
UMTS (Universal Mobile Telecommunication System)

UTRAN
UMTS (Universal Mobile Telecommunication System)

UUI
User to User Information
UUS
User-User-Signaling (3GTS 23.087)
UV
Ultra Violet
UWB
Ultra-Wide Band (IEEE 802.15.3)
- 349 -
- 350 -
UWC
Universal Wireless Convergence (Merge IS-136 with GSM)
V-PLMN
Visited PLMN
V+D
Voice plus Data
V5UA
V5.2-User Adaptation Layer (RFC 3807)
VA
Vehicular A mobile radio channel
VAD
Voice Activity Detector
VBS
Voice Broadcast Service (GSM-R)
VC
Virtual Circuit
VCC
Voice Call Continuity (3GTS 23.206)
VCI
Virtual Circuit Identifier (ATM)
VCO
Voltage Controlled Oscillator
VCT
MPEG PSI tables for ARIB
VDSL
Very high data rate Digital Subscriber Line (ITU-T G.993.1)
VE
Virtual Engine
VGCS
Voice Group Call Service (GSM-R)
VHE
Virtual Home Environment (3GTS 22.121, 3GTS 23.127)
VHF
Very High Frequency
VI
Video
VLAN
Virtual LAN
VLR
Visitor Location Register
VO
Voice
VoD
Video on Demand
VoIMS
Voice over IMS
VoIP
Voice over IP
VPI
Virtual Path Identifier (ATM)
VPLMN
Visited Public Land Mobile radio Network
VPN
Virtual Private Network
VSI
Virtual Socket Interface
VSRB
Variable Sized Radio Blocks
VW
Virtual Wire PDB (DiffServ Term)
W-AMR
Wideband AMR-Codec (Adaptive Multirate) (3GTS 26.190)
W-AMR+
Extended Wideband AMR-Codec (Adaptive Multirate) (3GTS

26.290)
W-APN
WLAN-APN (Wireless Local Area Network - Access Point Name)

(3GTS 23.234)
WAG
WLAN (Wireless Local Area Network) Access Gateway
WAN
Wide Area Network
List of Acronyms
WAP
Wireless Application Protocol
WCDMA
Wide-band Code Division Multiple Access
WDS
Wireless Distribution System
WEP
Wired Equivalent Privacy
WG
Working Group
WI
Work Item
WiBro
Wireless Broadband, Korean WiMAX Version
WiFi
Wireless Fidelity (www.wi-fi.org)
WiMAX
Worldwide Interoperability for Microwave Access (IEEE

802.16)
WINS
Windows Internet Name Service
WLAN
Wireless Local Area Network (IEEE 802.11)
WM
Wireless Medium
WMAN
Wireless Metropolitan Area Network
WMAX
Alliance of IEEE-802.11-Standard Manufacturers
WMM
WiFi MultiMedia
WPA
WiFi Protected Access
WPA2
WiFi Protected Access Version 2
WRED
Weighted Random Early Detection
WS
Window Size
WSN
Window Size Number
WWW
World Wide Web
X-CSCF
Call Session Control Function (any, there is I-CSCF, P-CSCF

and X-CSCF)
X2-AP
X2-interface Application Part protocol (3GTS 36.423)
X2AP
X2-interface Application Part protocol (3GTS 36.423)
XHTML
Extensible Hypertext Markup Language
XID
Exchange Identification (LAPD/LLC-Frame Type)
XMAC
Expected Message Authentication Code
XMF
Extensible Music Format
XOR
Exclusive-Or Logical Combination
XRES
XUA
Any User Adaptation Layer (M2UA, M3UA, SUA)
XXX_PCH
RRC States: CELL_PCH or URA_PCH
ZF
Zero Forcing
- 351 -
- 352 -
Index
Index
A
AM..................................................240
B
Broadcast information.....................103
H
HARQ.............................................218
M
MAC................................................218
MAC control element......................232
MAC PDU.......................................230
P
PDCP..............................................248
PDCP PDU.....................................250
R
RA-RNTI.........................................226
Random access procedure.....224, 228
RLC.................................................240
RLC AM PDU with a segment header
........................................................244
RLC PDU........................................242
RRC................................................102
RRC_CONNECTED.......................104
RRC_IDLE .....................................104
T
TCP/IP............................................254
TM...................................................240
U
UM..................................................240
- 353 -
- 354 -

LTE Signaling & Protocol Focus On E-UTRAN and UE

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

LTE Signaling & Protocol Focus On E-UTRAN and UE

Uploaded by

Copyright:

Available Formats

LTE

Signaling & Protocol

Cover design by Stefan Kohler

Color Codes in Frame Formats:

Color Codes in Scenarios:

Foreword of the Publisher:

Extreme degree of detailed information about a certain technology.

Extensive and detailed index to allow instant access to information

Incorporation of several practical exercises.

If applicable, incorporation of examples from our practical field

References to the respective standards and recommendations on

Gunnar Heine / President & CEO of INACON GmbH

1.1.2 Zoom into the EPS......................................................................4

1.1.3 Network Elements and their Functions within the EPC...............6

1.1.3.2 Serving Gateway (S-GW)..............................................................16

1.1.3.3 PDN Gateway (P-GW or PDN-GW)..............................................22

1.1.3.4 enhanced Packet Data Gateway (ePDG)......................................28

1.2 Protocol Stacks......................................................................34

LTE Signaling & Protocol Analysis (E-UTRAN and UE)

1.3 Security Architecture..............................................................40

1.3.2 Operation of UMTS-AKA...........................................................42

1.3.4 EPS-AKA in Operation during Initial Attach Procedure.............50

The Non-Access-Stratum: EMM & ESM................................55

2.1.2 State Machine...........................................................................58

2.1.3 Network Operation Modes.........................................................60

2.1.5 Important EMM-Scenarios.........................................................64

2.2.1 Important ESM-Procedures.......................................................86

2.2.2 State Machine...........................................................................88

2.3.5 Dedicated EPS Bearer Establishment.......................................94

3.2 State Characteristics of RRC...............................................104

3.3 Signaling Radio Bearers (SRB)............................................106

3.3.2 Mapping of RRC-Messages to SRB's and to Channels..........108

3.4 Message Encoding through ASN.1 PER-unaligned..............116

3.4.4 Comprehension Check & Practical Exercise:

3.5 RRC Procedures..................................................................128

3.5.2 Connection Management Related Procedures........................140

LTE Signaling & Protocol Analysis (E-UTRAN and UE)

3.5.3 Inter RAT RRC Procedures.....................................................162

3.5.5 Other RRC Procedures...........................................................176

3.5.7 Idle Mode Procedures Neighbor Cell Monitoring & Cell

3.6 GERAN to E-UTRAN Cell Reselection.................................206

Lower Layers of the Uu-Interface: MAC, RLC & PDCP.....217

4.1.2 Radio Network Temporary Identifiers (RNTI's) in E-UTRAN...220

4.1.3 MAC Random Access Procedure............................................224

4.1.4 Structure of MAC-PDU............................................................230

4.1.5 MAC Control Elements............................................................232

4.1.6 Practical Exercise: MAC Operation.........................................234

4.2 Features of RLC...................................................................240

4.2.2 Structure of RLC PDU.............................................................242

4.3 Features of PDCP................................................................248

4.3.2 Structure of PDCP PDU..........................................................250

LTE Signaling & Protocol Analysis (E-UTRAN and UE)

X2- and S1-Interfaces: X2AP- and S1-AP-Protocols.........257

5.1.3 X2-based Handover Scenario.................................................262

5.2 The S1-AP Protocol.............................................................266

Revisiting important Details of the EPS

Revisiting important Details of the EPS

How does the architecture of the LTE-network look like?

How does security operate in LTE?

LTE Signaling & Protocol Analysis (E-UTRAN and UE)

1.1 Architecture Overview

These network parts and clouds are illustrated in gray color.

I-WLAN IP access from non-3GPP non-trusted access network may be achieved