LT3600/v1.1 © Wray Castle Limited iii
Contents
State Management...7.1 Combining EPS States...7.2 Active EPS Bearers and Bearer Contexts ...7.3 Inactive EPS Bearers and Bearer Contexts...7.4 Attach and Registration Requirements ...7.5 EPS Initial Attach ...7.6 Default Bearer Establishment ...7.7 UE Idle Mode Functions...7.8 EPC Support for Idle Mode ...7.9 TAU (Tracking Area Update)...7.10 Idle-mode Signalling Reduction ...7.11 Paging ...7.12 IMS Functions in Idle Mode...7.13 Levels of Connectivity ...7.14 UE-Triggered Service Request ...7.15 Handling Additional Traffic Flows...7.16 Dedicated Bearer Creation...7.17 IMS Connection Establishment...7.18 Charging Capture Points...7.19 Connected Mode Procedures ...7.20 Intra-E-UTRAN Handover (X2-based) ...7.21 S-GW Relocation (X2-based)...7.22 MME Relocation...7.23
LTE/SAE Engineering Overview
iv © Wray Castle Limited LT3600/v1.1
Inter-RAT Handover ...7.26 Inter-RAT Handover Preparation ...7.27 Inter-RAT Handover Execution ...7.28 IMS Procedures ...7.30 E-UTRAN Detach...7.31 UE-initiated Detach ...7.32
EPC Operations
LT3600/v1.1 © Wray Castle Limited v
Objectives
At the end of this section you will be able to:
describe the set of ‘state machines’ employed within the EPS
outline the roles of the Mobility Management and Connection Management state machines
discuss the concept of the EPS Bearer Context
describe the EPS network selection and Attach processes
outline the set of activities required to establish a default EPS bearer and discuss the reasoning behind the decision to make this a stage in the attach process
describe the activities related to IMS registration
discuss the roles played by various devices involved in EPS device selection
outline the set of functions a UE will perform when in idle mode
describe the functions performed by the EPC in support of UEs in Idle Mode
outline the set of activities related to the Tracking Area Update (TAU) process
discuss the activities performed to allow UEs to be paged
outline the functions related to ISR (Idle-mode Signalling Reduction)
describe the actions performed by the MME and HSS in support of UE Reachability
discuss the use of the Service Request process and its relationship to the modify and create bearer functions
list the stages through which the IMS connection establishment process must proceed
outline the processes used to establish CS services for EPS attached subscribers
describe how IMS signalling and media flows are routed and handled
outline the EPC’s support for charging
describe the functions that enable connected mode mobility management to operate
outline the processes employed to support various handover scenarios including intra-E-UTRAN and inter-RAT HO
describe the procedures employed to detach a UE from the EPS
LTE/SAE Engineering Overview
vi © Wray Castle Limited LT3600/v1.1
EPC Operations
LT3600/v1.1 © Wray Castle Limited 7.1
RRC
eNB
ECM
EMM
State machines store UE and bearer context data
MME
RRC
ECM
EMM
UE
State Management
State Management
In order to offer effective service to UEs, the EPS needs to be able to define and keep track of the availability and reachability of each terminal. It achieves this by maintaining two sets of ‘contexts’ for each UE – an EMM (EPS Mobility Management) context and an ECM (EPS Connection
Management) context – each of which is handled by ‘state machines’ located in the UE and the MME.
A further state machine operates in the UE and serving eNB to track the terminal’s RRC state, which can be either RRC-IDLE (which relates to a UE in idle mode) or RRC-CONNECTED (which relates to a UE with an active traffic bearer).
Further Reading: 3GPP TS 23.401:4.6
LTE/SAE Engineering Overview
UE powered off,unreachable or non-EPC attached
Combining EPS States
Although the EMM and ECM states are independent of each other they are related and any discussion of a UE’s reachability is best served by viewing these states in a combined fashion.
There are three main phases of UE activity, each of which can be described by a combination of EMM and ECM states.
In the UE Powered Off/Unreachable phase a UE is not contactable via the EPS and cannot use the EPS network’s services. This may be because the UE is powered off, has no signal, or is connected to a non-3GPP access network. This could be described as EMM-DEREGISTERED/ECM-IDLE. It was previously described as LTE_DETACHED.
RRC will also be idle.
In the UE Powered On but Idle phase a UE is powered on and has attached to the EPS network, but is idle. This could be described as EMM-REGISTERED/ECM-IDLE. It was previously described as LTE_IDLE.
RRC will also be idle.
In the UE with Active Traffic Connection phase the UE has an established EPS bearer over which traffic is flowing. This could be described as EMM-REGISTERED/ECM-CONNECTED. It was previously described as LTE_ACTIVE.
RRC will also be connected.
Further Reading: 3GPP TS 24.801
EPC Operations
LT3600/v1.1 © Wray Castle Limited 7.3
Bearer Context –Active
Radio Bearer/E-RAB/EPS Bearer Active
RRC S1 Tunnel S5/S8 Tunnel
UE eNB S-GW PDN-GW
MME Bearer Attributes
Active EPS Bearers and Bearer Contexts
Active EPS Bearers and Bearer Contexts
An EPS bearer provides a data path between a UE and an APN located in a PDN-GW. Once created, an EPS bearer can be in one of two states – active or inactive.
When active, the EPS bearer is assigned bearer resources that amount to a radio bearer and GTP tunnels, with assigned TEIDs that will carry the E-RAB and EPS Bearer over the Uu, S1-U and S5/S8 interfaces.
Each PDN connection and default and dedicated EPS bearer is described by a Bearer Context stored in the UE and MME and in other devices required to serve each bearer.
Default and dedicated bearer contexts describe the UE’s current ECM state (idle or connected) plus the bearer’s EPS bearer ID and QoS parameters, and can be either active or inactive.
Further Reading: 3GPP TS 23.401:4.7.2
LTE/SAE Engineering Overview
7.4 © Wray Castle Limited LT3600/v1.1
Bearer Context –Inactive
S5/S8 EPS Bearer Active S5/S8 Tunnel
UE eNB S-GW PDN-GW
MME Bearer Attributes
Radio Bearer/
E-RAB Released
Inactive EPS Bearers and Bearer Contexts
Inactive EPS Bearers and Bearer Contexts
When an EPS Bearer is inactive, either as a result of an instruction from the UE or MME or of an inactivity timer expiring, Uu and S1-U resources are released, although the S5/S8 tunnel is retained and details of the bearer context are retained by the UE and the MME for future reactivation when required.
The separation of the bearer resources from the bearer context means that details of each bearer can be retained by the network even when the physical resources associated with it have been released during periods of inactivity.
An inactive bearer context can be reactivated by either the UE or the network using the Service Request procedure.
The S-GW may invoke the Downlink Data Notification procedure if data arrives for an inactive bearer.
The Bearer Context data held in the UE and the MME may become unsynchronized during periods of inactivity, both devices will attempt to re-synchronize this data when a signalling connection is re-established.
Further Reading: 3GPP TS 23.401:4.7.2
EPC Operations
LT3600/v1.1 © Wray Castle Limited 7.5
Stored Information:
Last used ECGI and EARFCN
Initial Cell selection:
Scan frequency bands, compile list of strongest allowed cells
Attach and Registration Requirements
Attach and Registration Requirements
As with legacy 3GPP systems, a UE can only access network services after it has performed an Attach and can only access IMS services once it has Registered.
An Attach is usually required when a UE is powered on or after it returns from a period outside of network coverage. Prior to the attach being initiated, the UE must perform either ‘stored information’
or ‘initial’ cell selection functions to allow it to determine the best available cell resource via which to connect.
The EPS specifications include the ‘stored information cell selection’ process that allows details of the
‘last used’ cell to be retained in the USIM so that the UE can attempt to reconnect quickly to that resource on power on. Stored last cell details include the ECGI (E-UTRAN Cell Global Identity), and EARFCN (E-UTRAN Absolute Radio Frequency Channel Number).
If there are no stored cell details, or if the stored cell is unavailable, the UE must scan for available cells and perform an ‘initial cell selection’. Again, data stored on the USIM can aid this process allowing the UE to be instructed to search for preferred EARFCNs, preferred networks and preferred radio access technologies.
Cell selection is based on similar criteria to those employed in legacy systems – after searching at least a minimum number of carriers the UE will have compiled a list of ‘acceptable’ cells from which it will select a ‘suitable’ cell, which is the one it regards as offering the best service, and will attempt to attach.
Before attempting to attach the UE must check to ensure that the selected cell is not barred and that it meets the USIM access priority level indicated on the cell’s BCCH.
Further Reading: 3GPP TS 23.011; 36.300:10
LTE/SAE Engineering Overview
4. Identity Request/Response 4. ME Identity Check
5. Update Location 5. Insert Subscriber Data 5. Insert Subscriber Data Ack 5. Update Location Ack 4. Ciphered Options Request
4. Ciphered Options Response
Optional Stage
EPS Initial Attach
EPS Initial Attach
The UE’s objective when performing an attach is to register the subscriber’s identity and location with the network to enable services to be accessed. During the attach procedure the UE will be assigned a default EPS bearer to enable always-on connectivity with a PDN. The UE may be provided with details of a local P-CSCF to enable it to register with the IMS.
A simplified view of the attach process – assuming that it is an initial attach with stored details from a recent previous context for a UE using its H-PLMN (Home PLMN) and accessing via the Home E-UTRAN – is shown, and the stages of the process are described below.
Once a suitable cell has been selected the UE employs the Random Access procedure to request an RRC connection with the chosen eNB. With that in place an Attach Request message (1) can be transmitted. If the UE has previously been registered with the PLMN, it may include a previously assigned GUTI in the message, otherwise the Attach Request message contains the subscriber’s IMSI and some other parameters.
On receipt of the Attach Request the eNB either derives the identity of the previously used MME from the supplied GUTI or selects an MME from the pool available and forwards the message (2).
The MME contacts the HSS indicated by the subscriber’s IMSI and in response receives the relevant elements of the ‘quintuplet’ that allows the EPS-AKA process to take place (3).
Optionally, at this point the MME may be required to check the identity and status of the UE via the EIR (4) using the ME Identity Check process. Ciphering may then be invoked over the air interface.
Once the AKA procedures have successfully concluded the MME transmits an Update Location message to the HSS and receives the Insert Subscriber Data message in response containing the user’s service profile (5). An Insert Subscriber Data Ack from the MME is followed by an Update Location Ack from the HSS. The UE is now Attached to the EPC.
Further Reading: 3GPP TS 23.401:5.3.2
EPC Operations
LT3600/v1.1 © Wray Castle Limited 7.7
6. Create Default Bearer Request
7. PCC Lookup 8. Create Default
Bearer Response
9. Initial Context Setup Request/ Attach Accept 10. RRC Conn
Reconfig 11. RRC Conn
Reconfig
Complete 12. Initial Context Setup Response
Default Bearer Establishment
A default bearer must then be established and the MME selects the S-GW that will handle and a PDN-GW that supports the requested APN. The MME issues a Create Default Bearer Request to the selected S-GW, which assigns a GTP TEID to the EPS bearer and passes the request to the
indicated PDN-GW (6).
If the network employs dynamic PCC the PDN-GW will query the PCRF assigned to serve the UE for bearer parameters, otherwise the bearer will be established using local QoS parameters stored in the PDN-GW (7).
If the network employs dynamic PCC the PDN-GW will query a PRCF for bearer parameters, otherwise the bearer will be established using local QoS parameters stored in the PDN-GW (7).
A Create Default Bearer Response message passes from the PDN-GW to the S-GW, which contains relevant parameters such as the EPS bearer’s IP address and possibly the IP address or DNS name of a local IMS P-CSCF. The S-GW creates the bearer as specified and passes the Create Default Bearer Response message to the MME (8). The details that define the S1-U service will also have been defined during this stage.
The MME sends an Initial Context Setup Request/Attach Accept message, which contains the assigned parameters for the EPS bearer context, to the eNB (9). That element in turn sends an RRC Connection Reconfiguration message to the UE (10) to inform it of the bearer details and the changed air interface parameters.
The UE returns an RRC Connection Reconfiguration Complete message (11) to verify that the radio bearer, which was initially established just to carry the attach message, has been reconfigured to support the new parameters. The eNB forwards an Attach Complete message to the MME (12).
The UE then sends a Direct Transfer message to the eNB (13), which confirms the details of the EPS Bearer. Finally, the eNB sends an Attach Complete message to the MME to confirm that both the Attach and the Default EPS Bearer processes have completed successfully.
Uplink and downlink data can now flow if required.
Further Reading: 3GPP TS 23.401:5.3.2
LTE/SAE Engineering Overview
7.8 © Wray Castle Limited LT3600/v1.1
UE Idle Mode Functions:
No active Bearer Contexts Neighbour Cell List only necessarily contains neighbour frequencies, cell
details are optional Neighbour measurements required
only if serving cell falls below threshold
Tracking Area Update (TAU) performed if required
UE Idle Mode Functions
UE Idle Mode Functions
A UE in idle mode needs to perform a set of functions that enable it to stay camped onto the best of the available local cells. It achieves this by performing the cell reselection process, which although similar to that employed by legacy 3GPP systems such as GSM and UMTS, is slightly different in the E-UTRAN.
Detailed NCLs (Neighbour Cell Lists) are optional in the E-UTRAN, on a cell-by-cell basis, and in most cells the NCL requirement is limited to advertising the set of ‘non-intra frequency’ channels employed by EUTRAN and ‘inter-RAT’ neighbours. A full N-Cell list is only deployed in cells with specific requirements or complex reselection options.
This change means that the UEs can be responsible for discovering neighbour cells and that they are not required to measure those neighbours continuously. A UE only needs to undertake neighbour cell measurements if the current serving cell’s signal drops below a broadcast minimum threshold. If the signal strength is above the threshold the UE will only measure the serving cell.
The E-UTRAN is able to control the how Idle mode terminals behave by issuing each UE an RFSP Index (Index to RAT/Frequency Selection Priority). The RFSP Index specifies the priority the UE should assign to the available local radio channels belonging the any of the allowed radio access technologies and allows the network to control which cells are viewed as re-selection candidates by the UE (and which are not). Use of the RFSP standardizes some of the informal techniques that have previously been used to influence UE reselection activities, such as adjusting C2 values to make a cell unattractive to UEs.
The RFSP Index is UE-specific and is provided to a serving MME in HSS data.
If a reselection is deemed necessary the UE will obtain the new cell’s TAI after the change has been achieved. If the new cell’s TAI is different to those broadcast by the old cell, the UE will perform a TAU.
Further Reading: 3GPP TS 36.304; 23.401:4.3.6 (RFSP)
EPC Operations
LT3600/v1.1 © Wray Castle Limited 7.9
EPC Support for Idle Mode
UE TA List
TA 9 TA 12
ECM State EPS Bearer ID
QoS UE Default Bearer Context –Inactive
TA 9
TA 12 MME Pool A
EPC Support for Idle Mode
The MME currently serving each UE is responsible for ensuring its ‘reachability’. It achieves this by monitoring the current TA in which the terminal is located.
The EPS allows a cell to be a member of more than one TA. This allows a UE to roam within a set of contiguous TAs without being required to perform a TAU, which reduces the amount of location-related signalling that is required, although it may conversely increase the amount of paging required per UE connection request.
The MME reflects this extended mobility by maintaining a TA list for each registered UE within which the list shows the set of TAs the UE is currently registered.
During a TAU, and periodically in the event that a TAU does not occur within a set time-frame, the MME is responsible for reauthenticating each registered UE and for reissuing the M-TMSI used to confidentially identify it.
When a UE drops into the ECM-IDLE state its existing default bearer can be ‘parked’ and any dedicated bearers can either be parked or released. To support this, the MME stores details of the UE’s current ‘bearer contexts’ ready to reactivate them in the event of a UE or network-triggered Service Request.
A TAU may result in the need to change the S-GW assigned to handle an idle UE’s bearer contexts or of the MME with which the UE is registered, if the reselected cell is associated with a different S-GW Service Area or MME Pool.
If ISR (Idle-mode Signalling Reduction) is active for a UE, the MME may be required to pass location updates and other pertinent information to the SGSN with which the UE is co-registered.
Further Reading: 3GPP TS 23.401:4.3.5
LTE/SAE Engineering Overview
7.10 © Wray Castle Limited LT3600/v1.1
HSS MME
eNB
TAU trigger event
1. TAU Request
2. TAU Request + TAI and ECGI
3. Authentication/Security
4. TAU Accept
5. TAU Complete UE
Optional Stage
TAU (Tracking Area Update)
TAU (Tracking Area Update)
A TAU takes place between a UE and the MME with which it is registered and is triggered by the UE detecting a change in TAI after a cell reselection. A TAU is also be used as part of the Initial Attach process and may additionally be triggered by events such as the expiry of the periodic TAU timer or as part of MME load balancing or rebalancing.
In the example message flow it is assumed that the UE is connected to its HPLMN and that an S-GW change and MME relocation are not required.
After detecting a change in TAI, the UE transmits a TAU Request message to the eNB (1). The TAU Request contains data such as the old GUTI, old TAI, EPS bearer status and a NAS MAC (Message Authentication Code) for integrity protection purposes.
The eNB forwards the TAU Request (plus the new TAI and ECGI) to the MME indicated by the supplied GUTI (2). If the MME indicated by the GUTI is not associated with the new eNB, an MME relocation will be triggered and the base station will select a new MME to pass the TAU Request to.
The eNB forwards the TAU Request (plus the new TAI and ECGI) to the MME indicated by the supplied GUTI (2). If the MME indicated by the GUTI is not associated with the new eNB, an MME relocation will be triggered and the base station will select a new MME to pass the TAU Request to.