FDD LTE Basic Signaling Analysis

FDD LTE Basic Signaling
Analysis
FDD LTE Basic Signaling Analysis Internal Use Only▲
LEGAL INFORMATION
By accepting this certain document of ZTE CORPORATION you agree to the following terms. If you do
not agree to the following terms, please notice that you are not allowed to use this document.
Copyright © 2013 ZTE CORPORATION. Any rights not expressly granted herein are reserved. This
document contains proprietary information of ZTE CORPORATION. Any reproduction, transfer,
distribution, use or disclosure of this document or any portion of this document, in any form by any
means, without the prior written consent of ZTE CORPORATION is prohibited.
and are registered trademarks of ZTE CORPORATION. ZTE’s company name, logo
and product names referenced herein are either trademarks or registered trademarks of ZTE
CORPORATION. Other product and company names mentioned herein may be trademarks or trade
names of their respective owners. Without the prior written consent of ZTE CORPORATION or the
third party owner thereof, anyone’s access to this document should not be construed as granting, by
implication, estopped or otherwise, any license or right to use any marks appearing in the document.
The design of this product complies with requirements of environmental protection and personal
security. This product shall be stored, used or discarded in accordance with product manual, relevant
contract or laws and regulations in relevant country (countries).
This document is provided “as is” and “as available”. Information contained in this document is subject
to continuous update without further notice due to improvement and update of ZTE CORPORATION’s
products and technologies.
ZTE CORPORATION
Address: NO. 55
Hi-tech Road South
ShenZhen
P.R.China
518057
Website: http://support.zte.com.cn
Email: 800@zte.com.cn
ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. I

Revision History
Product Version Document Version Serial Number Reason for Revision

V2.10.080b P02 R1.0 - First published
Author
Date Document Version Prepared by Reviewed by Approved by

2012-08-31 R1.0 Zhang Shihui Jin Haitao -
ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. II

Intended audience: FDD LTE network optimization engineers and maintenance engineers
Proposal: Before reading this document, you had better have the following knowledge and skills.
SEQ Knowledge and skills Reference material
LTE, The UMTS Long Term Evolution From
1 LTE basic knowledge and key technologies
Theory to Practice
LTE FDD P&O skill certification training
2 Basic LTE network optimization skills
materials
Follow-up document: After reading this document, you may need the following information.
SEQ Reference material Information
Evolved Universal Terrestrial Radio Access
1 3GPP TS36.331 (E-UTRA); Radio Resource Control (RRC);
Protocol specification
2 3GPP TS36.321 (E-UTRA); Medium Access Control (MAC)
protocol specification
3 3GPP TS36.211
(E-UTRA); Physical Channels and Modulation
ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. III
TABLE OF CONTENTS
1 Overview ......................................................................................................... 1
2 System Information ........................................................................................ 1

2.1 Master Information Block .................................................................................. 1
2.2 System Information ........................................................................................... 2
2.3 System Information Block Type1 ...................................................................... 5
3 Access Procedure .......................................................................................... 7

3.1 Air Interface ...................................................................................................... 7
3.1.1 RRC Connection Request................................................................................. 7
3.1.2 RRC Connection Setup .................................................................................... 7
3.1.3 RRC Connection Setup Complete .................................................................. 17
3.1.4 RRC Connection Reject .................................................................................. 18
3.1.5 RRC Connection Reconfiguration ................................................................... 18
3.1.6 Security Mode Command ............................................................................... 25
3.1.7 Security Mode Complete ................................................................................ 26
3.1.8 Security Mode Failure ..................................................................................... 26
3.2 S1 Interface .................................................................................................... 27
3.2.1 Initial UE Message .......................................................................................... 27
3.2.2 Initial Context Setup Request ......................................................................... 28
3.2.3 Initial Context Setup Response ....................................................................... 30
3.2.4 Initial Context Setup Failure ............................................................................ 30
4 Handover Procedure .................................................................................... 31

4.1 Measurment Report ........................................................................................ 31
4.2 RRC Connection Reconfiguration ................................................................... 32
4.2.1 mobilityControlInfo .......................................................................................... 32
4.2.2 radioResourceConfigDedicated ...................................................................... 38
4.2.3 securityConfigHO ........................................................................................... 40
4.3 RRC Connection Reconfiguration Complete ................................................... 40
5 Release Procedure ....................................................................................... 41

5.1 Air Interface .................................................................................................... 41
5.1.1 RRC Connection Release ............................................................................... 41
5.2 S1 Interface .................................................................................................... 41
5.2.1 S1AP_UeContext Release Request ............................................................... 41
5.2.2 S1AP_UeContext Rrelease Command ........................................................... 42
5.2.3 S1AP_UeContext Release Complete ............................................................. 43
6 Reestablishment Procedure ........................................................................ 43

6.1.1 RRC Connection Reestablishment Request ................................................... 43
6.1.2 RRC Connection Reestablishment ................................................................. 43
6.1.3 RRC Connection Reestablishment Complete ................................................. 44
6.1.4 RRCConnectionReestablishmentReject ......................................................... 44
ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. IV

7 UE Capability Enquiry Procedure ................................................................ 44

7.1 UE Capability Enquiry ..................................................................................... 44
7.2 UE Capability Information ............................................................................... 45
ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. V

FIGURES
Figure 2-1 System Information Signaling .............................................................................. 1

Figure 2-2 Master Information Block .................................................................................... 1
Figure 2-3 System Information ............................................................................................. 2
Figure 2-4 SystemInformationBlockType1 ............................................................................ 5
Figure 3-1 RRC Connection Request ................................................................................... 7
Figure 3-2 RRC Connection Setup ....................................................................................... 7
Figure 3-3 srb_ToAddModList .............................................................................................. 8
Figure 3-4 rlc_Config ............................................................................................................9
Figure 3-5 logicalChannelConfig ........................................................................................ 10
Figure 3-6 mac_MainConfig ............................................................................................... 11
Figure 3-7 physicalConfigDedicated ................................................................................... 13
Figure 3-8 pdsch, pucch, pusch, and uplinkPowerControlDedicated .................................. 13
Figure 3-9 tpc-PDCCH-ConfigPUCCH ............................................................................... 14
Figure 3-10 cqi_ReportConfig ............................................................................................ 15
Figure 3-11 antennaInfo and schedulingRequestConfig ..................................................... 16
Figure 3-12 RRC Connection Setup Complete ................................................................... 17
Figure 3-13 RRCConnectionReject .................................................................................... 18
Figure 3-14 measConfig ..................................................................................................... 18
Figure 3-15 measObjectToAddModList .............................................................................. 18
Figure 3-16 reportConfigToAddModList ............................................................................. 21
Figure 3-17 measIdToAddModList ..................................................................................... 23
Figure 3-18 speedStatePars .............................................................................................. 24
Figure 3-19 dedicatedInfoNASList ...................................................................................... 25
Figure 3-20 SecurityModeCommand .................................................................................. 25
Figure 3-21 Security Mode Complete ................................................................................. 25
Figure 3-22 Security Mode Failure ..................................................................................... 26
Figure 3-23 Security Mode Complete ................................................................................. 26
Figure 3-24 Security Mode Failure ..................................................................................... 26
Figure 3-25 initialUEMessageMsg ...................................................................................... 27
Figure 3-26 initialContextSetupRequest ............................................................................. 28
Figure 3-27 e_RABToBeSetupListCtxtSUReq.................................................................... 28
Figure 3-28 uESecurityCapabilities .................................................................................... 29
ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. VI

Figure 3-29 initialContextSetupResponse .......................................................................... 30

Figure 3-30 InitialContextSetupFailure ............................................................................... 30
Figure 4-1 Handover Procdure on the UE end ................................................................... 31
Figure 4-2 Measurement Report ........................................................................................ 31
Figure 4-3 MobilityControlInfo ............................................................................................ 32
Figure 4-4 radioResourceConfigCommon .......................................................................... 33
Figure 4-5 rach_ConfigCommon ........................................................................................ 33
Figure 4-6 prach_Config..................................................................................................... 35
Figure 4-7 phich_Config ..................................................................................................... 36
Figure 4-8 radioResourceConfigDedicated ........................................................................ 38
Figure 4-9 mac_MainConfig ............................................................................................... 38
Figure 4-10 SecurityConfigHO ........................................................................................... 40
Figure 4-11 RRC Connection Reconfiguration complete .................................................... 40
Figure 5-1 RRCConnectionRelease ................................................................................... 41
Figure 5-2 S1AP_UeContext Release Request .................................................................. 41
Figure 5-3 S1AP_UeContext Rrelease Command.............................................................. 42
Figure 5-4 S1AP_UeContext Release Complete ................................................................ 43
Figure 6-1 RRC Connection Reestablishment Request ...................................................... 43
Figure 6-2 RRC Connection Reestablishment .................................................................... 43
Figure 6-3 RRCConnectionReestablishmentComplete ....................................................... 44
Figure 6-4 RRCConnectionReestablishmentReject ............................................................ 44
Figure 7-1 UECapabilityEnquiry ......................................................................................... 44
Figure 7-2 UECapabilityInformation ................................................................................... 45
TABLES
Table 2-1 Barring Parameters .............................................................................................. 3

Table 2-2 Common Radio Resource Configuration Parameters ........................................... 3
Table 3-1 LTE Band Indicator vs Frequency ...................................................................... 19
Table 3-2 Convertion between the Frequency and the EAFRCN........................................ 20
ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. VII
1 Overview
Basic signaling procedures are the bases for analyzing and locating problems that occur
in network optimization. Understanding and analyzing these procedures and the
signaling there is a basic and useful skill for network optimization engineers.
This document analyzes the basic signaling procedures of FDD LTE systems, focusing
on the L3 signaling, including system information, access, handover, and release
procedures.
2 System Information
The system information is sent through the air interface. The process for a UE to obtain
the system information is illustrated in Figure 2-1.
Figure 2-1 System Information Signaling
Generally, the UE accesses the following three types of information successively:
1. Master Information Block (MIB): where the basic information of the cell is included,
such as system bandwidth, physical channel configuration, and system frame
number.
2. System information: where the public configuration information of radio resources is

included, such as the configuration of each channel, UE-related timers, and counter.
3. System Information Block Type1 (SIB1): including network identity, cell residence,
and cell reselection.
ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. 1

2.1 Master Information Block

The MIB tells the UE about the basic information of the cell. It is dispatched in a fixed way:
repeatedly sent at an interval of 40 ms. It is first sent on subframe 0 of the radio frame
whose frame number is SFN mod 4 = 0, and then it is repeatedly sent on subframes 0 of
other frames.
The messages included in the MIB are shown in Figure 2-2 and detailed below:
Figure 2-2 Master Information Block
 dl_Bandwidth: system bandwdith. Its value ranges from 0 to 5, which correspond to

1.4 MHz (6RB), 3MHz (15RB), 5 MHz (25RB), 10 MHz (50RB), 15 MHz (75RB), and
20 MHz (100RB) respectively. For example, in Figure 2-2, the setting is 3, which
means the system bandwidth is 10 MHz (50RB).
 phich_Duration: the duration of a physical channel symbol. It has two options: 0

(normal) and 1 (extented).
 phich_Resource: Its values should be one of the following: one Sixth, half, one, and
two. It is used to calculate the group factor of physical resources. For details, refer to
Section 6.9 of 3GPP TS 36.211.
 SystemFrameNumber: system frame number.
2.2 System Information

The messages in the system information involve the barring parameters for cell selection
and access, the common parameters of radio resources, and configuration information of
each physical channel, uplink power control, and UE-related timers and counters, as
shown in Figure 2-3.

Figure 2-3 System Information

 Barring parameters
Table 2-1 Barring Parameters
Value Range
Parameter Meaning Explicit Value Range
in Memory
enumerate(0, 0.05, 0.1, 0.15, 0.2,
Ac_Barring Access barring
0.25, 0.3, 0.4, 0.5, 0.6, 0.7, 0.75, 0 - 15
Factor factor
0.8, 0.85, 0.9, 0.95)
Ac_Barring Access barring enumerate(4, 8, 16, 32, 64, 128,
0-7
Time time 256, 512) s
 Common radio resource configuration parameters

Table 2-2 Common Radio Resource Configuration Parameters

Value
Parameter Meaning Explicit Value Range Range in
Memory
Number of
enumerate(4, 8, 12, 16, 20,
NumberOfRA_p contention-based
24, 28, 32, 36, 40, 44, 48, 52, 0 - 15
reambles random access
56, 60, 64)
preambles
enumerate(4, 8, 12, 16, 20,
SizeOfRA_prea Number of preambles
24, 28, 32, 36, 40, 44, 48, 52, 0 - 14
mblesGroupA in Group A
56, 60)
powerRampings
Step of PRACH power enumerate(0,2,4,6)dB 0-3
tep
Maximum times of
preambleTrans enumerate(3, 4, 5, 6, 7, 8, 10,
PRACH preamble 0 - 10
Max 20, 50, 100, 200)
retransmission
enumerate(-120, -118, -116,
preambleInitialre Received target power
-114, -112, -110, -108, -106,
ceivedTargetPo in initial PRACH 0 - 15
-104, -102, -100, -98, -96,
wer preamble
-94, -92, -90)dBm
Power offset
MessagePower configured at eNodeB enumerate(minusinfinity, 0, 5,
0-7
OffsetGroupB for Message3 8, 10, 12, 15, 18)dB
transmission
Size of search window
RA_RsponseWi of UE for responding to enumerate(2,3,4,5,6,7,8,10)
0-7
nSize random access ms
preambles
MAC_Connectio
MAC contention enumerate(8,16,24,32,40,48,
nResolutionTim 0-7
resolution timer 56,64) sf
er
Maximum times of
MaxHARQ_Msg
Message3 1-8 1-8
3Tx
transmission
 BCCH configuration
In BCCH Configuration information, BCCH modification periodCoeff is given. It is

the coefficient of BCCH modification period. Its value ranges from 0 to 3,
corresponding to 2, 4, 8 and 16 respectively.
 PCCH configuration
Among PCCH Configuration information, there are two parameters:
− Defaulpaging: the cyclic period of incontinuous receiving of paging occasion.

Its value ranges from 0 to 3, corresponding to 32, 64, 128, and 256 radio
frames respectively.

− nB: the coefficient of paging adjustment. Its value ranges from 0 to 7,

corresponding to 4T, 2T, T, 1/2T, 1/4T, 1/8T, 1/16T, and 1/32T respectively.
 PRACH Configuration
PRACH configuration information mainly provides the PRACh configuration index,

zero correlation zone configuration, and PRACH frequency offset.
 PDSCH Configuration
− Referencesignalpower: reference signal power (absolute value) of one RE. Its

value is an integral, ranging from -60 to 50 dBm.
− P_B: the ratio of the EPRE of the PDSCH containing RS to the EPRE of the
PDSCH not containing RS. Its value is an integral, ranging from 0 to 3.
− pusch-ConfigCommon
n-SB (Nsb): For details, refer to Section 5.3.4 of 3GPP TS 36.211.
hoppingMode (Hopping-mode): It has two options: interSubFrame an

intraAndInterSubFrame. For details, refer to Section 5.3.4 of 3GPP TS
36.211.
HO ): Its value is an integral, ranging from 0 to 98.

pusch-HoppingOffset ( N RB
For details, refer to Section 5.3.4 of 3GPP TS 36.211.
enable64QAM: Its value is a Boolean one: True means 64 QAM is allowed,

and False means 64 QAM is not allowed. For details, refer to Section 8.6.1
of 3GPP TS 36.213.
 PUSCH Configuration
− N_SB: the number of subband assigned when PUSCH hopping. Its value is an
integral, ranging from 0 to 4.
− hoppingMode: the hopping mode of PUSCH. It has two options: 0 and 1,

corresponding to interSubFrame and intraAndInterSubFrame respectively.
− hoppingOffset: the hopping offset of PUSCH. Its value is an integral, ranging

from 0 to 98.
 PUCCH Configuration
− DeltaPUCCH_Shift: the cyclic shift of PUCCH format 1, 1a, or 1b. Its value
should be among the integral set {ds1, ds2, ds3}, where ds1 denotes 1, ds2
denotes 2, and so on.

− nRB_CQI: the number of RBs used for CQI transmission. Its value is an
− nCS_AN: the number of RBs used for hybrid transmission of PUCCH formats
1/1a/1b and formats 2/2a/2b.
− n1PUCCH_AN: the index of RBs used for transmission of PUCCH format 1, 1a

and 1b. Its value is an integral, ranging from 0 to 2047.
 Uplink power control configuration
− P0_nominalPUSCH: the nominal power of PUSCH. It is often an absolute

value, set based on actual situations.
− PoNominalPucch: the nominal power of PUCCH. It is often an absolute value,

set based on actual situations.
 UE-related Timers and Counters
− T300: the timer for UE waiting for RRC connection response. Its value ranges
from 0 to 7, corresponding to 100 ms, 200 ms, 300 ms, 400 ms, 600 ms, 1000
ms, 1500 ms, and 2000 ms respectively.
− T301: the timer for UE waiting for RRC reconnection response. Its value
ranges from 0 to 7, corresponding to 100 ms, 200 ms, 300 ms, 400 ms, 600 ms,
1000 ms, 1500 ms, and 2000 ms respectively.
− T310: the timer for UE detecting RRC connection failure. Its value ranges from
0 to 7, corresponding to 1, 2, 3, 4, 6, 8, 10, and 20 respectively.
− N310: the maximum number of asynchronous instructions received by the UE

on the downlink. Its value ranges from 0 to 6, corresponding to 0 ms, 50 ms,
100 ms, 200 ms, 500 ms, 1000 ms, 1500 ms, and 2000 ms respectively.
− T311: the timer for UE converting to the idle state after RRC connection failure.
Its value ranges from 0 to 6, corresponding to 1000 ms, 3000 ms, 5000 ms,
10000 ms, 15000 ms, 20000 ms, and 30000 ms respectively.
− N311: the maximum number of synchronous instructions received by the UE

on the downlink. Its value ranges from 0 to 6, corresponding to 1, 2, 3, 4, 5, 6, 8,
and 10 respectively.
− TimeAlignmentTimer: the timer timed assignment. Its value ranges from 0 to 7,

corresponding to 500 subframes, 750 subframes, 1280 subframes, 1920
subframes, 2560 subframes, 5120 subframes, 10240 subframes, and infinity
subframes respectively.

2.3 System Information Block Type1

The SIB1 carries information such as PLMN ID, cellbarried, and cell reselection. Like MIB,
it is dispatched in a fixed way: repeatedly sent at an interval of 80 ms. It is first sent on
subframe 5 of the radio frame whose frame number is SFN mod 8 = 0, and then it is
repeatedly sent on subframes 5 of the frames with a frame number of SFN mod 2 = 0.
The messages included in the SIB1 are shown in Figure 2-4 and detailed below:
Figure 2-4 SystemInformationBlockType1
 PLMN_IdentityList: The list of PLMN IDs
− MCC: the mobile country code of the neighbor cell
− MNC: the mobile network code of the neighbor cell
 TrackingAreaCode: the tracking area code
 CellIdentity: the cell’s identity

 Cellbarred: It indicates whether the cell’s access is barred. It has two options: 0 and
1, which correspond to “barred” and “not barred” respectively.
 IntraFreqReseletion: It indicates whether cell reselection is allowed within the

frequency. It has two options: 0 and 1, which correspond to “allowed” and “not
allowed” respectively.
 q_RxlevMin: The minimum receiving level required for cell selection. Its value
ranges from -140 dBm to -44 dBm, at a step of 2 dBm.
 q_RxlevMinOffset: The minimum receiving level offset required for cell selection. Its
value ranges from 2 dB to 16 dB, at a step of 2 dB.
 P_Max: The maximum transmit power allowed for the UE. It is often set to 23 dBm.
 freqbandIndicator: The indicator of thefrequency band.
 SchedulingInfoList: the scheduling list of system information. It consists of sevearl

scheduling information.
− SchedulingInfo: Each scheduling information contains two messages:

si-Periodicity and sib-MappingInfo
 si-Periodicity: the scheduling period of the SI message. It has seven

opations, 0 - 6, which correspond to rf8, rf16, rf32, rf64, rf128, rf256, and
rf512 respectively. rf8 represents eight radio frames.
 sib-MappingInfo, It consists of several SIB types. Its function is to send the

system information of different SIB types (except SIB2) as one SI. The
SIB2 is always the first SIB of the first scheduling information.
− SIB-Type: It indicates which SIBs are included in the current SI. its value is
taken from the function: enumerate {sibType3, sibType4, sibType5, sibType6,
sibType7, sibType8, sibType9, sibType10, sibType11, spare7, spare6, spare5,
spare4, spare3, spare2, spare1, ...}.
 si-WindowLength: The length of the SI window. This length applies to all SIs, and its
value ranges from 0 to 6, which correspond to ms1, ms2, ms5, ms10, ms15, ms20,
and ms40 respectively. Here ms1 means 1 millisecond.
3 Access Procedure

3.1 Air Interface
3.1.1 RRC Connection Request
The information included in the RRC connection request message is shown in Figure 3-1.
Figure 3-1 RRC Connection Request
The RRC connection request message mainly includes two types of information:
ue_Identity and establishmentCause.
 ue_Identity: there are two types of UE identities: s-TMSI and randomValue. In

principle, if there is a valid s-TMSI at the UE side, use the option s-TMSI; otherwise,
use randomValue.
 establishmentCause: It indicates the reason for RRC connection establishment. It

has five options: emergency (emergency call), highPriorityAccess (a high-priority
access request), mt-Access (request by a paging message), mo-Signalling (request
as a result of Attach/TAU) and mo-Data (terminal-initiated data service request).
3.1.2 RRC Connection Setup
The information included in the RRC connection setup message is shown in Figure 3-2
and is described below.

Figure 3-2 RRC Connection Setup
The RRC Connection Setup message mainly includes the following information:
 rrc_TransactionIdentifier: The identifier of RRC transaction. Its value ranges from 0

to 3.
 radioResourceConfigDedicated: It indicates that the dedicated radio resource

configuration is used for SRB1 setup.
The dedicated radio resource configuration is used for SRB1 involves the following:
 srb_ToAddModList
 mac_MainConfig
 physicalConfigDedicated
3.1.2.1 srb_ToAddModList
As the RRC Connection Setup message is mainly for SRB1 setup, the
srb_ToAddModList should be included. Besides, srb_ToAddModListPresent should be
set to 1.
The structure of srb_ToAddModList is shown in Figure 3-3.

Figure 3-3 srb_ToAddModList
As shown in Figure 3-3, the srb_ToAddModList involves three aspects: SRB identity,
RLC configuration, and logical channel configuration. They are detailed below.
 srb_Identity: It has two options: 1 and 2. 1 indicates SRB1, while 2 indicates SRB2.
 rlc_Config: The configuration of RLC layer parameters, as shown in Figure 3-4.
Figure 3-4 rlc_Config
RLC parameters can be configured in one of the two ways: 1 (explicit value) and 2
(default value).
As to RLC mode, according to 3GPP specifications, the RLC mode of either SRB1
or SRB2 should be AM.

The uplink RLC AM mode (ul_AM_RLC) can be configured as follows:
− t-PollRetransmit: RLC AM timer. Its value is among the set {ms5, ms10, ms15,
ms20, ms25, ms30, ms35, ms40, ms45, ms50, ms55, ms60, ms65, ms70,
ms75, ms80, ms85, ms90, ms95, ms100, ms105, ms110, ms115, ms120,
ms125, ms130, ms135, ms140, ms145, ms150, ms155, ms160, ms165,
ms350, ms400, ms450, ms500, spare9, spare8, spare7, spare6, spare5,
spare4, spare3, spare2, spare1}. The unit is millisecond. ms5 denotes 5
milliseconds, ms10 denotes 10 ms, and so on.
− pollPDU: This parameter triggers PDU polling. Its value is among the set {p4,
p8, p16, p32, p64, p128, p256, pInfinity}, where p4 denotes four PDUs, p8
denotes eight PDUs, and so on.
− pollByte: This parameter indicates the byte of polling. Its value is among the
set {kB25, kB50, kB75, kB100, kB125, kB250, kB375, kB500, kB750, kB1000,
kB1250, kB1500, kB2000, kB3000, kBinfinity, spare1}, where kB25 denotes 25
kBytes, kB50 denotes 50 kBytes, and so on.
− maxRetxThreshold: the maximum times of retransmission of one AM PDU. Its

value is among the set {t1, t2, t3, t4, t6, t8, t16, t32}, where t1 denotes one time,
t2 denotes two times, and so on.
The down RLC AM mode (dl_AM_RLC) can be configured as follows:
− t-Reordering: reordering timer, used for check the loss of RLC PDU in lower
layers. For each RLC entity, there should be only one t_Reordering that is
running. The value of this parameter should be among the set {ms0, ms5,
ms140, ms150, ms160, ms170, ms180, ms190, ms200, spare1}. The unit is
millisecond. ms5 denotes 5 milliseonds, ms10 denotes 10 ms, and so on.
− StatusProhibit: the status report timer. If it is started, the STATUS PDU is not
allowed to send. The value of this parameter should be among the set {ms0,
ms5, ms10, ms15, ms20, ms25, ms30, ms35, ms40, ms45, ms50, ms55, ms60,
ms300, ms350, ms400, ms450, ms500, spare8, spare7, spare6, spare5,
spare4, spare3, spare2, spare1}. The unit is millisecond. ms5 denotes 5
milliseonds, ms10 denotes 10 ms, and so on.
If t is set to 2 (i.e. t = 2), refer to default RLC configuration for SRB1 in Section
9.2.1.1 or for SRB2 in Section 9.2.1.2 of 3GPP TS36.331 for details.

 logicalChannelConfig: the configuration of logical channels, as shown in Figure 3-5.
Figure 3-5 logicalChannelConfig
Like RLC parameters, logical parameters can be configured in one of the two ways:
1 (explicit value) and 2 (default value).
When t is set to 1 (i.e. explicitValue), the following parameters should be configured:
− priority: the priority of a logical channel. Its value ranges from 1 to 16. The
larger the value, the higher the priority is.
− prioritisedBitRate: Prioritized bit rate. Its value should be among the set {kBps0,
kBps8, kBps16, kBps32, kBps64, kBps128, kBps256, infinity, spare8, spare7,
spare6, spare5, spare4, spare3, spare2, spare1}. The unit is kB/s. kBps0
denotes 0 kB/second, kBps8 denotes 8 kB/second, and so on.
− bucketSizeDuration: Bucket size duration. Its value should be among the set
{ms50, ms100, ms150, ms300, ms500, ms1000, spare2, spare1}. The unit is
millisecond. ms50 denotes 50 milliseonds, ms100 denotes 100 ms, and so on.
− logicalChannelGroup: the group of the logical channel. Its value ranges from 0
to 3.
If t is set to 2 (i.e. t = 2), refer to the default logical channel configuration for SRB1 as
specified in Section 9.2.1.1 or for SRB2 as specified in Section 9.2.1.2 of 3GPP
TS36.331 for details.
3.1.2.2 mac_MainConfig
mac_MainConfig is the configuration of MAC main parameters.

The structure of mac_MainConfig is shown in Figure 3-6.
Figure 3-6 mac_MainConfig
MAC main parameters can also be configured in one of the two ways: 1 (explicit value)
and 2 (default value).
When t is set to 1 (i.e. explicitValue), the following parameters should be configured:
 ul_SCH_Config
− maxHARQ_Tx: The maximum transmission number of UL HARQ processes.

Its value should be among the set {n1, n2, n3, n4, n5, n6, n7, n8, n10, n12, n16,
n20, n24, n28, spare2, spare1}, where n1 denotes one HARQ process.
− periodicBSR_Timer: the timer for periodic BSR report. Its value should be
among the set {sf5, sf10, sf16, sf20, sf32, sf40, sf64, sf80, sf128, sf160, sf320,
sf640, sf1280, sf2560, infinity, spare1}, where sf10 denotes 10 subframes, sf20
denotes 20 subframes, and so on.
− retxBSR_Timer: the timer for retransmission BSR report. Its value should be
among the set {sf320, sf640, sf1280, sf2560, sf5120, sf10240, spare2, spare1},

where sf320 denotes 320 subframes, sf640 denotes 640 subframes, and so
on.
− ttiBundling: It indicates whether TTI bunlding is valid. It has two options: TURE
(the bunding is valid) and FALSE (the bunding is invalid).
 timeAlignmentTimerDedicated: It is used to control the clock synchronization time of

the UE on the uplink. Its value should be among the set {sf500, sf750, sf1280,
sf1920, sf2560, sf5120, sf10240, infinity}, where sf500 denotes 500 subframes,
sf750 denotes 750 subframes, and so on.
 phr_Config
phr_Config has two switches: t = 1 (release the existing PHR) and t = 2 (configure
PHR). To configure PHR, set the following parameters:
− periodicPHR-Timer: the timer for periodic PHR report. Its value should be
among the set {sf10, sf20, sf50, sf100, sf200, sf500, sf1000, infinity}, where
sf10 denotes 10 subframes, sf20 denotes 20 subframes, and so on.
− prohibitPHR-Timer: the timer for prohibiting PHR report. Its value should be
among the set {sf0, sf10, sf20, sf50, sf100, sf200, sf500, sf1000}, where sf0
denotes 0 subframe, sf10 denotes 10 subframes, and so on.
− dl-PathlossChange: the change of path loss on the downlink of PHR report. Its
value should be among the set {dB1, dB3, dB6, infinity}. The unit is dB. dB1
denotes 1 dB, dB3 denotes 3 dB, and so on.
 DRX-Config
Similarly, DRX-Config has two switches: t = 1 (release the existing DRX) and t = 2
(configure DRX). To configure DRX, set the following parameters:
− onDurationTimer: It defines the maximum continuous PDCCH subframes

starting from DRX. If the UE decodes one PDCCH, it is in active state and the
inactivity timer is started. The value of this parameter should be among the set
{psf1, psf2, psf3, psf4, psf5, psf6, psf8, psf10, psf20, psf30, psf40, psf50, psf60,
psf80, psf100, psf200}, where psf1 denotes 1 PDCCH subframe, psf2 denotes
2 PDCCH subframes, and so on.
− drx-InactivityTimer: It defines the maximum continuous PDCCH subframes

starting from UL/DL user data transmission after the decoding is done. Its
value should be among the set {psf1, psf2, psf3, psf4, psf5, psf6, psf8, psf10,
psf20, psf30, psf40, psf50, psf60, psf80, psf100, psf200, psf300, psf500,
psf750, psf1280, psf1920, psf2560}, where psf1 denotes 1 PDCCH subframe,
psf2 denotes 2 PDCCH subframes, and so on.

− drx-RetransmissionTimer: the timer for DRX retransmission. It defines the

maximum continuous PDCCH subframes starting from transmission on the
downlink. Its value should be among the set {psf1, psf2, psf4, psf6, psf8, psf16,
psf24, psf33}, where psf1 denotes 1 PDCCH subframe, psf2 denotes 2
PDCCH subframes, and so on.
− longDRX-Cycle and StartOffset: Its value should be among the set {sf10,(0-9);
sf20,(0-19); sf32,(0-31); sf40,(0-39); sf64,(0-63); sf80,(0-79); sf128,(0-127);
sf160,(0-59); sf256,(0-255); sf320,(0-319); sf512,(0-511); sf640,(0-639);
sf1024,(0-1023); sf1280,(0-1279); sf2048,(0-2047); sf2560,(0-2559)}, where
sf10 denotes 10 subframes, and (0-9) denotes the possible offset.
− shortDRX-Cycle: Its value should be among the set {sf2, sf5, sf8, sf10, sf16,
sf20, sf32, sf40, sf64, sf80, sf128, sf160, sf256, sf320, sf512, sf640}, where sf2
denotes 2 subframes, sf5 denotes 5 subframes, and so on.
− drxShortCycleTimer: It value is INTEGER (1..16).
3.1.2.3 physicalConfigDedicated
physicalConfigDedicated is the configuration of dedicate physical channels.
The structure of physicalConfigDedicated is shown in Figure 3-7.
Figure 3-7 physicalConfigDedicated
The details of the parameteres involved in dedicated physical channel configuration are
described below.

Figure 3-8 pdsch, pucch, pusch, and uplinkPowerControlDedicated
 pdsch_ConfigDedicated
The value of p_a should be among the set {dB-6, dB-4.77, dB-3, dB-1.77, dB0, dB1,
dB2, dB3}, where dB-6 denotes -6 dB, dB1 denotes 1 dB, and so on.
 pucch_ConfigDedicated
There are two options for ackNackRepetition: t = 1 (cancel the repetition) and t = 2
(configure the repetition). When t is set to 2, configure the parameters below:
− repetitionFactor: Its value should be among the set {n2, n4, n6, spare1}, where
n2 denotes the repetition factor 2, n4 denotes the repetition factor 4, and so on.
(1)
− n1PUCCH-AN-Rep ( nP U C C HA, N R ep): For details about the parameter, refer to
3GPP TS 36.213.
− tddAckNackFeedbackMode: This parameter refers to the TDD ACK/NACK

feedback mode. It can be set the same for PUCCH and PUSCH. For details,
refer to 3GPP TS 36.213.
 pusch_ConfigDedicated
− HARQ − ACK
betaOffset-ACK-Index ( I offset ): Its value is an integral number, ranging from
0 to 15. For details, refer to Table 8.6.3-1 in 3GPP TS 36.213.

− RI
betaOffset-RI-Index ( I offset ): For details, refer to Table 8.6.3-2 in 3GPP TS
36.213.
CQI
− betaOffset-CQI-Index ( I offset ): For details, refer to Table 8.6.3-3 in 3GPP TS
36.213.
 uplinkPowerControlDedicated
− p0-UE-PUSCH ( PO_UE_PUSCH (1) ): Its value is an integral number, ranging from -8 to

7. Its unit is dB and it is only applicable to non-persistent scheduling. For
details, refer to Section 5.1.1.1 of 3GPP TS 36.213.
− deltaMCS-Enabled (Ks): Its can be set to 0 or 1.25, where 0 corresponds to

en0 (disabled) and 1.25 corresponds to en1 (enabled). For details, refer to
Section 5.1.1.1 of 3GPP TS 36.213.
− accumulationEnabled: Its value is a BOOLEAN value: TRUE (enabled) and

FALSE (disabled). For details, refer to Section 5.1.1.1 of 3GPP TS 36.213.
− p0-uE-PUCCH ( PO_UE_PUCCH ): Its value is an integral number, ranging from -8 to

7. Its unit is dB. For details, refer to Section 5.1.1.1 of 3GPP TS 36.213.
− pSRS-Offset (PSRS_OFFSET): Its value is an integral number, ranging from 0 to 15.

When Ks is set to 1.25, the value of the parameter is pSRS-Offset value – 3,
ranging from 3 to 12; when Ks is set to 0, the value of the parameter is -10.5 +
1.5*pSRS-offset, ranging from -10.5 to 12. For details, refer to Section 5.1.3.1
of 3GPP TS 36.213.
− filterCoefficient: It is the filter coefficient for calculating RSRP measurement of

path loss. For details, refer to Section 5.1.1.1 of 3GPP TS 36.213.
 tpc_PDCCH_ConfigPUCCH

Figure 3-9 tpc-PDCCH-ConfigPUCCH
tpc_PDCCH_ConfigPUCCH has two switches: t = 1 (release the existing PUCCH)

and t = 2 (configure the PUCCH). To configure the PUCCH, set the following
parameters:
− tpc_RNTI: It is a 16-bit value, indicating the RNTI for 3/3A power control in the
format of DCI.
− indexOfFormat3: It the N index when the DCI format 3 is used. Its value is an
integral number, ranging from 1 to 15.
− indexOfFormat3A: It the M index when the DCI format 3 is used. Its value is an
integral number, ranging from 1 to 31.
 tpc_PDCCH_ConfigPUSCH: The configuration of tpc_PDCCH_ConfigPUSCH is

similar to that of tpc_PDDCH_ConfigPUCCH.
 cqi_ReportConfig
The structure of cqi_ReportConfig is shown in Figure 3-10.

Figure 3-10 cqi_ReportConfig
− cqi-ReportModeAperiodic: The report mode of PUSCH. Its value should be

among the set {rm12, rm20, rm22, rm30, rm31, spare3, spare2, spare1},
where rm12 denotes mode 1-2, rm20 denotes mode 2-0, and so on. For details,
refer to Section 7.2.1 of 3GPP TS 36.213.
− nomPDSCH-RS-EPRE-Offset ( ∆ offset ): Its value is an integral number, ranging

from -1 to 6. Actually, it can be calculated with this formula: IE * 2 (dB). For
details, refer to Section 7.2.3 of 3GPP TS 36.213.
− cqi-ReportPeriodic
cqi-ReportPeriodic has two options: t=1 (release) and t=2 (setup).
When t is set to 2, configure the parameters below:
 cqi-PUCCH-ResourceIndex ( nPUCCH
(2)
): Its value is an integral number,
ranging from 0 to 1185. For details, refer to Section 7.2 of 3GPP TS
36.213.
 cqi-pmi-ConfigIndex (ICQI/PMI): The index of CQI/PMI period and offset. Its

value is an integral number, ranging from 0 to 1023. For details, refer to
Tables 7.2.2-1A and 7.2.2-1C in 3GPP TS 36.213.
 cqi-FormatIndicatorPeriodic: The mode of UE’s reporting CQI in a periodic

way on the PUCCH. It has two options: WB (wideband) and FSSubband.
By default, it is set to WB. When the FSSubband is configured, wideband

CQI/PMI has to be reported in addition to the CQI of the corresponding

subband.
 ri-ConfigIndex (IRI): The index of RI configuration. Its value is an integral

number, ranging from 0 to 1023. For details, refer to Table 7.2.2-1B in
3GPP TS 36.213.
 simultaneousAckNackAndCQI: Its value is a BOOLEAN value. If it is set to

be TRUE, it means ACK/NACK and CQI are allowed to be transmitted
simultaneously. For details, refer to Section 10.1 of 3GPP TS 36.213.
 soundingRS_UL_ConfigDedicated
It has two options: t=1 (release) and t=2 (setup).
− srs-Bandwidth: the bandwidth of SRS. Its value should be among the set {bw0,
bw1, bw2, bw3}, where bw0 denotes 0, bw1 denotes 1, and so on. It actual
configuration depends on the uplink bandwith. For details, refer to Tables
5.5.3.2-1, 5.5.3.2-2, 5.5.3.2-3, and 5.5.3.2-4 in 3GPP TS 36.211.
− srs-HoppingBandwidth: the bandwidth of SRS hopping. Its value should be

among the set {hbw0, hbw1, hbw2, hbw3}, where hbw0 denotes 0, hbw1
denotes 1, and so on. For details, refer to Section 5.5.3.2 of 3GPP TS 36.211.
− freqDomainPosition ( n RRC ): Its value is an integral number, ranging from 0 to

23. For details, refer to Section 5.5.3.2 of 3GPP TS 36.211.
− duration: Its value is a BOOLEAN value: FALSE (single) or TRUE (indefinite).

For details, refer to Section 8.2 of 3GPP TS 36.213.
− srs-ConfigIndex (ISRS): Its value is an integral number, ranging from 0 to 1023.

For details, refer to Table 8.2-1 in 3GPP TS 36.213.
− transmissionComb: Its value is an integral number, 0 or 1. For details, refer to

Section 5.5.3.2 of 3GPP TS 36.211.
− cyclicShift (n_SRS): Its value should be among the set {cs0, cs1, cs2, cs3, cs4,
cs5, cs6, cs7}, where cs0 denotes 0, cs1 denotes 1, and so on. For details,
refer to Section 5.5.3.1 of 3GPP TS 36.211.
 antennaInfo
It has two options: t=1 (ExplicitValue) and t=2 (DefaultValue).

− transmissionMode: the transmission mode. Its value should be among the set
{tm1, tm2, tm3, tm4, tm5, tm6, tm7, spare1}, where tm1 denotes transmission
mode 1, tm2 denotes transmission mode 2, and so on. For details, refer to
Section 7.1 of 3GPP TS 36.213.
− codebookSubsetRestriction: It indicates whether transmissionMode is set to

tm3, tm4, tm5 or tm6.
− ue-TransmitAntennaSelection: It has two options: t = 1 (release) and t = 2

(configure).
When t is set to 2, the default values are used.
 schedulingRequestConfig
It has two options: t=1 (release) and t=2 (setup).
− sr-PUCCH-ResourceIndex ( nPUCCH,
(1)
SRI
): Its value is an integral number, ranging
from 0 to 2047. For details, refer to Section 10.1 of 3GPP TS 36.213.
− sr-ConfigIndex: Its value is an integral number, ranging from 0 to 157.
− dsr-TransMax: the maximum transmission times of SR. Its value should be

among the set {n4, n8, n16, n32, n64, spare3, spare2, spare1}, where n4
denotes four times, n8 denotes eight times, and so on.

Figure 3-11 antennaInfo and schedulingRequestConfig
3.1.3 RRC Connection Setup Complete
The information included in the RRC connection setup complete message is shown in
Figure 3-12 and is described below.

Figure 3-12 RRC Connection Setup Complete
 rrc_TransactionIdentifier: Its value should be the same as that in the RRC

connection setup message.
 SelectedPLMN_Identity: The index of plmn-IdentityList broadcasted in the SIB1. If it

is set to 1, it means the first one in the plmn-IdentityList in the SIB1.
 registerMME: The MME where the UE is registered.
 dedicatedInfoNAS: The NAS messages, such as ATTACH REQUEST, TAU

REQUEST, and SERVICE REQUEST.
3.1.4 RRC Connection Reject
The RRC connection reject message is mainly used to reject one RRC connection. The
main information included in the message is the wait time.
Figure 3-13 RRCConnectionReject
 waitTime: Its value ranges from 1 to 16, with a unit of second. It is the waiting time
for the UE to try RRC connection again afte the RRC connection request is rejected.

3.1.5 RRC Connection Reconfiguration
The RRC connection reconfiguration message involves the following configuration:
 measConfig
 mobilityControlInfo
 dedicatedInfoNASList
 radioResourceConfigDedicated
 securityConfigHO
In the access procedure, the measConfig and dedicatedInfoNASList are involved.
3.1.5.1 measConfig
The structure of measConfig is shown in Figure 3-14.
Figure 3-14 measConfig
 measObjectToRemoveList: the list of measurement objects to be removed. The

maximum value is 32.
 measObjectToAddModList: the list of measurement objects to be added or modified.

Figure 3-15 measObjectToAddModList
− measObjectId: the identity of the measurement object
− measObjectEUTRA: the measurement ojbect is E-UTRAN
 carrierFreq: the carrier frequency of the E-UTRAN
In GSM and UMTS, the Absolute Radio Frequency Channel Number

(ARFCN) is configured and transmitted. In LTE, the actual central
frequency is configured in the EMS, and the E-UTRA ARFCN (EARFCN)
is transmitted. Therefore, the central frequency should be converted to the
EARFCN before sent to the UE.
Table 3-1 shows the relationship between LTE bands and the frequencies.

Table 3-1 LTE Band Indicator vs Frequency
The formula for calculating the central frequency configured in the EMS
with the EARFCN is as follows:
FDL = FDL_low + 0.1(NDL – NOffs-DL), FUL = FUL_low + 0.1(NUL – NOffs-UL)
where FDL is the downlink frequency, NDL is the downlink EARFCN, and
FDL_low and NOffs-DL can be looked up in Table 3-2.
Table 3-2 Convertion between the Frequency and the EAFRCN

So the EARFCN can be calculated with the following formula:
NDL= 10（FDL – FDL_low）+ NOffs-DL
 allowedMeasBandwidth: It indicates the bandwidth that is allowed for

measurement. Its value should be one of the following: mbw6, mbw15,
mbw25, mbw50, mbw75, and mbw100, which correspond to 6, 15, 25, 50,
75, and 100 RBs respectively. For details, refer to 3GPP TS 36.104.
 presenceAntennaPort1: It indicates whether all neighbor cells use Antenna

Port 1. Its value is a Boolean one. When it is set to TRUE, it means the
dedicated antenna ports of at least two cells are used.
 neighCellConfig: It is the uplink/downlink configuration information of

MBSFN and neighbor cells. In configuring the information, it is required to
convert the decimal number into a binary value and the left two digits are
used. This parameter has the following options:
00: It means not all the neighbor cells have the same MBSFN subframes
as the serving cell.
01: It means no neighbor cell has MBSFN subframes.
10: It means all the neighbor cells have the same MBSFN subframes as
the serving cell or its subsets.
11: It means the neighbor cells have different MBSFN subframes as the
serving cell on the TDD uplink or downlink.
 offsetFreq: the offset applicable to the carrier
 cellsToAddModList: the list of neighbor cells to be added or modified in the

measurement objects
 cellIndex: the index of neighbor cell. It has two parameters: physCellId (the
PCI of the neighbor cell) and cellIndividualOffset (the cell individual offset
of the neighbor cell)
 blackCellsToRemoveList: the neighbor cells to be deleted from the black

list of neighbor cells
 blackCellsToAddMoList: the neighbor cells to be added or modified in the

black list of neighbor cells
 cellForWhichToReportCGI: PCI of unknown neighbor cell whose CGI is to

be measured after the ANR function is enabled
 reportConfigToRemoveList: The list of report configurations to be deleted from the

measurement report. Its maximum value is 32.

 reportConfigToAddModList
The structure of reportConfigToAddModList is shown in Figure 3-16.
Figure 3-16 reportConfigToAddModList
Each report configuration is identified by a reportConfigId. And the parameters

involved are described below, here we take example for the configuration for
E-UTRAN:
− triggerType: There are two types, t = 1 (event) and 2 (periodical).
 eventId: the EUTRA event that triggers the measurement report. The
report event is marked with AN, where N is 1, 2, 3, 4, or 5.
 a3_Offset: the threshold for the report triggered by event A3. Its value is
equal to IE value * 0.5 dB.

 reportOnLeave: It indicates whether the UE reports the event when the

A3-2 condition is met. It is a Boolean value. If it is set to True, the UE
reports the event.
 Threshold_RSRP: the RSRP threshold for event reporting, applicable to

events A1, A2, A4, and A5. Its value ranges from -140 dBm to -44 dBm. In
actual situations, its value is (IE value–140) dBm.
 Threshold_RSRQ: the RSRQ threshold for event reporting, applicable to

events A1, A2, A4, and A5. Its value ranges from -19.5 dBm to -3 dBm. In
actual situations, its value is (IE value–40/2) dBm.
 Hysteresis: The hysteresis resulted from the judgment of event reporting. It

is used for avoiding jitter. Its value ranges from 0 to 30 dB. In actual
situations, its value is (IE value * 0.5) dB.
 timeToTrigger: the duration for the reporting condition being met. It is used
in judgment and used for avoiding jitter and false reporting. Its value
should be among the set (0, 40, 64, 80, 100, 128, 160, 256, 320, 480, 512,
640, 1024, 1280, 2560, 5120)ms.
− triggerQuantity: the quantity used for evaluating the trigger condition. It has two
options: rsrp and rsrq, which correspond to RSRP and RSRQ values
respectively.
− reportQuantity: the quantities included in the measurement report. Often a

measurement report includes both RSRP and RSRQ.
− maxReportCells: the maximum number of cells in the measurement report
− reportInterval: the interval of reporting. If the UE reports periodically (the

reportAmount exceeds 1), this parameter is applicable to the case where
triggerType is ‘event’ or ‘periodical’. Its value starts with ms, followed by a
number, for example, ms120, which means 120 ms.
− reportAmount: the amount of reports. It is only applicable to the case where

triggerType is ‘event’ or ‘periodical’. When purpose is set to reportCGI, this
value is 1.
− reportConfigInterRAT: the inter-RAT event that trigger the measurement report.

These events are marked with B1 or B2.
 measIdToRemoveList: its value ranges from 1 to maxMeasId, where maxMeasId is

32 at most.
 measIdToAddModList: The list of measurement IDs to be added or modified. Each

Item includes the following parameters:

− measId: the identity of measurement configuration
− measObjectId: the identity of a measurement object
− reportConfigId: the identify of measurement report configuration
Figure 3-17 measIdToAddModList
 quantityConfig
− quantityConfigEUTRA: the quantity for filtering E-UTRA measurement
− filterCoefficientRSRP: the filter coefficient of RSRP
− filterCoefficientRSRQ: the filter coefficient of RSRQ
 measGapConfig: It has two configuration options: t=1 (release) and t=2 (set up).
When t is set to 1 and Maximum Gap Repetition Period (MGRP) is 40 ms, gapOffset
is gp0; when t is set to 2 and MGRP is 80 ms, gapOffset is gp1. The UE decides the
measurement gap depends on the gapOffset it receives.

 s-Measure: the quality threshold of the serving cell. Its value is an integral, ranging
from 0 to 97. 0 indicated invalid s-Measure.
 speedStatePars: It has two options: t=1 (release) and t=2 (set up).
Figure 3-18 speedStatePars
When t is set to 2, the following parameters should be configured:
− mobilityStateParameters: It indicates the mobility state of a UE. Within the

t-Evaluation, if the number of cell reselections of a UE is greater than
n-CellChangeHigh, the UE is regarded in high-mobility state; if the number of
cell reselections of a UE is greater than n-CellChangeMedium, the UE is
regarded in medium-mobility state. If within t-HystNormal (it is greater than
t-Evaluation), the UE does not meet the high or medium-mobility state, it is
regarded in normal-mobility state.
 t-Evalulation: the duration for evaluating allowed amount of cell

reselection(s). It is the same as TCRmax in 3GPP TS TS 36.304. Its value
should be among the set {s30, s60, s120, s180, s240, spare3, spare2,
spare1}, where s30 denots 30 seconds, s60 denotes 60 seconds, and so
on.
 t-HystNormal: the additional time period before the UE can enter

Normal-mobility state. It is the same as TCRmaxHyst in 3GPP TS TS 36.304.
Its value should be among the set {s30, s60, s120, s180, s240, spare3,
spare2, spare1}, where s30 denots 30 seconds, s60 denotes 60 seconds,
and so on.
 n-CellChangeMedium: the maximum number of cell reselections to enter

Medium-mobility state. It is the same as NCR_M in 3GPP TS TS 36.304. Its
value is an integral, ranging from 1 to 16.
 n-CellChangeHigh: the maximum number of cell reselections to enter

High-mobility state. It is the same as NCR_H in 3GPP TS TS 36.304. Its
value is an integral, ranging from 1 to 16.

− timeToTrigger-SF: the mobility control factor used when the UE is in high or

medium mobility state.
 sf-Medium: the mobility control factor used when the UE is in medium

mobility state. The handover condition is obtained by multiplying the
mobility control-related parameter by the factor. Its value should be
among the set {0.25, 0.5, 0.75, 1.0}.
 sf-High: the mobility control factor used when the UE is in high mobility
state. The handover condition is obtained by multiplying the mobility
control-related parameter by the factor. Its value should be among the set
{0.25, 0.5, 0.75, 1.0}.
3.1.5.2 dedicatedInfoNASList
The RRC connection reconfiguration message carries the NAS request of

InitialUeMessage for initial access.
Figure 3-19 dedicatedInfoNASList
3.1.6 Security Mode Command
The structure of the security mode command messages is shown in Figure 3-20.

Figure 3-20 SecurityModeCommand
This message is sent by an eNodeB to the UE, and it mainly contains the security
algorithms, such as ciphering algorithm and integrity protection algorithm:
 cipheringAlgorithm: It has three options 0 (eea0), 1 (eea1), and 2 (eea2).
 integrityProtAlgorithm: It has three options 0 (served), 1 (eia1), and 2 (eia1).
Figure 3-21 illustrates a procedure where the UE succeeds to complete the security
mode command.
Figure 3-21 Security Mode Complete

Figure 3-22 illustrates a procedure where the UE fails to complete the security mode
command.
Figure 3-22 Security Mode Failure
3.1.7 Security Mode Complete
This message is just a response to the Security Mode Command message, and it does
not contain any concrete information, as shown in Figure 3-23.
Figure 3-23 Security Mode Complete
3.1.8 Security Mode Failure
This message is just a response to the Security Mode Command message, and it does
not contain any concrete information, as shown in Figure 3-24.

Figure 3-24 Security Mode Failure
3.2 S1 Interface
3.2.1 Initial UE Message

The structure of the initial UE message is shown in Figure 3-25.
Figure 3-25 initialUEMessageMsg

 eNB_UE_S1AP_ID: the context ID of the UE over the S1 interface on the eNodeB

side
 nAS_PDU: the NAS PDU information in the RRCConnectionSetupComplete

message
 tAI: the identity of the tracking area where the UE is. It is made up of PLMN Identity
and TAC. Among them, PLMN identity consists of the following two codes:
− MCC
− MNC
 eUTRAN_CGI: The unique global identity of an EUTRAN cell. It is made up of

PLMN Identity and CellID.
 rRC_Establishment_Cause: the reasons for RRC connection establishment. It has

the following options: emergency, highPriorityAccess, mt-Access, mo-Signalling,
and mo-Data.
3.2.2 Initial Context Setup Request
The initial context setup request involves the following parameters:
Figure 3-26 initialContextSetupRequest
 mME_UE_S1AP_ID: the context ID of the UE over the S1 interface on the MME

32
side. Its value ranges from 0 to 2 -1.

 eNB_UE_S1AP_ID: the context ID of the UE over the S1 interface on the eNodeB

24
side. Its value ranges from 0 to 2 -1.
 uEaggregateMaximumBitrate: the sum of the maximum bit rates of the UE. It is

applicable to all non-GBR E-RABs of the UE.
− UE Aggregate Maximum Bit Rate Uplink: UE Aggregate Maximum Bit Rate on

the uplink
− UE Aggregate Maximum Bit Rate Downlink: UE Aggregate Maximum Bit Rate

on the downlink
 e_RABToBeSetupListCtxtSUReq: the list of E-RABs to be set up during initial

context set up.
The structure of e_RABToBeSetupListCtxtSUReq is shown in Figure 3-27.
Figure 3-27 e_RABToBeSetupListCtxtSUReq
− ERAB ID: the unique ID of the E-RAB. Its value ranges from 0 to 15. However,
by default, the E-RAB is numbered from 5, and the numbers 0 to 4 are
reserved.
− E-RAB Level QoS Parameters: QoS parameters of E-RAB, including,

 QCI: QoS Class Identifier. Its value ranges from 1 to 9
 ARP: Allocation and Retention Priority. It consists three parts: Priority

Level (the priority level for assignment and retaining. Its value ranges from
0 to 15. 15 indicates no priority, 1 indicates the highest priority, while 14
indicates the lowest priority); Pre-emption Capability (the capability of the
E-RAB pre-empting other E-RABs. It has two options: shall not trigger
pre-emption, may trigger pre-emption); and Pre-emption Vulnerability (the
vulnerability of the E-RAB being pre-empted. It has two options: not
pre-emptable, pre-emptable.)
− TransportLayerAddress: the uninterrupted address of the radio network layer
− GTP_TEID: GTP Tunnel Endpoint Identifier
− NAS_PDU: the NAS PDU in the InitialUeMessage message.
− UE Security Capabilities: the encription and integrity protection algorithms

supported by the UE
Figure 3-28 uESecurityCapabilities
 Encryption Algorithms
 Integrity Protection Algorithms
 Security Key
3.2.3 Initial Context Setup Response
The structure of the initial context response message is shown in Figure 3-29.

Figure 3-29 initialContextSetupResponse
 MME_UE_S1AP_ID: the context ID of the UE over the S1 interface on the MME

side
 ENB_UE_SAP_ID: the context ID of the UE over the S1 interface on the eNodeB

side
 e_RABSetupListCtxtSURes: the list of E-RABs that have been set up
− TransportLayerAddress: the uninterrupted address of the radio network layer.

It is an IP address, sent to the network layer for interpretation.
− GTP_TEID：GTP Tunnel Endpoint Identifier, used for user-plane transmission

between the eNodeB and the serving gateway.
3.2.4 Initial Context Setup Failure
The structure of the initial context setup failure message is shown in Figure 3-30.

Figure 3-30 InitialContextSetupFailure
 MME_UE_S1AP_ID: the context ID of the UE over the S1 interface on the MME

side
 ENB_UE_S1AP_ID: the context ID of the UE over the S1 interface on the eNodeB

side
 Cause: the reason for the failure.
The value t indicates the location of the failure, and it has four options: 1 (radio
network layer), 2 (transport layer), 3 (NAS layer), and 4 (protocol).
The value u indicates the reason for the failure. For example, if the failure occurs at
the radio network layer (t = 1) and the reason value u is 25, it means radio resources
are not available.
4 Handover Procedure
Figure 4-1 illustrates the entire handover procedure on the UE end.

Figure 4-1 Handover Procedure on the UE end
As shown in the figure, after the handover conditions are met, the UE first reports the
measurement report to the eNodeB. If the eNodeB agrees to perform a handover, it
sends a handover command to the UE through the RRC Connection Reconfiguration
message. Upon completion of the configuration, the UE returns the RRC Connection
Reconfiguration Complete message to the eNodeB to complete the handover.
The signaling involved in the handover procedure is discussed below in this chapter.
4.1 Measurement Report

As shown in Figure 4-2, the Measurement Report message includes information such as
the RSRP and RSRQ values of the source cell, and the PCI, RSRP, and RSRQ values of
the target cell.
Figure 4-2 Measurement Report

4.2 RRC Connection Reconfiguration

In the RRC connection reconfiguration procedure, three kinds of information are involved:
 mobilityControlInfo
 radioResourceConfigDedicated
 securityConfigHO
4.2.1 mobilityControlInfo
The structure of MobilityControlInfo is shown in Figure 4-3.
Figure 4-3 MobilityControlInfo
 targetPhysCellId: the PCI of the target cell. Its value is an integral, ranging from 0 to
503.
 carrierFreq: It contains two parameters:
− dl-CarrierFreq: downlink carrier frequency. Its value is an integral, ranging from

0 to maxEARFCN.
− ul-CarrierFreq: uplink carrier frequency. Its value is an integral, ranging from 0

to maxEARFCN.

 carrierBandwidth
− dl-Bandwidth: downlink bandwidth. Its value should be among the set {n6, n15,
n25, n50, n75, n100, spare10, spare9, spare8, spare7, spare6, spare5, spare4,
spare3, spare2, spare1}, where n6 denotes 6 RBs, corresponding to 1.4 MHz,
n15 denotes 15 RBs, corresponding to 3 MHz, and spare* is reserved for
future use. For details refer to 3GPP TS 36.101.
− ul-Bandwidth: uplink bandwidth. Its value should be among the set {n6, n15,
n25, n50, n75, n100, spare10, spare9, spare8, spare7, spare6, spare5, spare4,
spare3, spare2, spare1}, where n6 denotes 6 RBs, corresponding to 1.4 MHz,
n15 denotes 15 RBs, corresponding to 3 MHz, and so on.
 t304: Its value should be among the set {ms50, ms100, ms150, ms200, ms500,
ms1000, ms2000, spare1}, where ms50 denotes 50 ms, ms100 denotes 100 ms,
and so on.
 newUE-Identity: the identity of a new UE
 rach_ConfigDedicate: dedicated RACH configuration, used for setting dedicated

random access parameters
− ra-PreambleIndex: dedicated RA preamble for RA selection. Its value is an

− ra-PRACH-MaskIndex: the index of a PRACH mask for RA selection.. Its value

is an integral, ranging from 0 to 15.
 radioResourceConfigCommon
The basic information of the target cell is set here.

Figure 4-4 radioResourceConfigCommon
− rach-ConfigCommon

Figure 4-5 rach_ConfigCommon
 preambleInfo
numberOfRA-Preambles: the number of non-dedicated RA preambles. Its

value should be among the set {n4, n8, n12, n16 ,n20, n24, n28, n32, n36,
n40, n44, n48, n52, n56, n60, n64}, where n4 denotes 4, n8 denotes 8,
and so on. For details, refer to 3GPP TS 36.321.
preamblesGroupAConfig: the configuration of preamble group. If it is not

set, its value is equal to numberOfRA-Preambles. For details, refer to
3GPP TS 36.321. Three parameters are included in the configuration:
 sizeOfRA-PreamblesGroupA: the size of RA preamble group A. Its

value should be among the set {n4, n8, n12, n16 ,n20, n24, n28, n32,
n36, n40, n44, n48, n52, n56, n60}, where n4 denotes 4, n8 denotes 8,
and so on.
 messageSizeGroupA: the limit of preamble selection. Its value should

be among the set {b56, b144, b208, b256}, where b56 denotes 56 bits,
b144 denotes 144 bits, and so on.
 messagePowerOffsetGroupB: Its value should be among the set

{minusinfinity, dB0, dB5, dB8, dB10, dB12, dB15, dB18}.
 powerRampingParameters

powerRampingStep: the step of power ramping. It is the same as the

power ramping factor in 3GPP TS 36.321. Its value should be among the
set {dB0, dB2,dB4, dB6}, where dB0 denotes 0 dB, dB2 denotes 2 dB, and
so on.
preambleInitialReceivedTargetPower: the initial preamble power. Its value

should be among the set {dBm-120, dBm-118, dBm-116, dBm-114,
dBm-112, dBm-110, dBm-108, dBm-106, dBm-104, dBm-102, dBm-100,
dBm-98, dBm-96, dBm-94, dBm-92, dBm-90}, where dBm-120 denotes
-120 dBm, dBm-118 denotes -118 dBm, and so on.
 ra-SupervisionInfo
preambleTransMax: the maximum quantity of preamble transmission. Its

value should be among the integral set {n3, n4, n5, n6, n7, n8, n10, n20,
n50, n100, n200}, where n3 denotes 3, n4 denotes 4, and so on.
ra-ResponseWindowSize: the size of the RA response window. Its value

should be among the set {sf2, sf3, sf4, sf5, sf6, sf7, sf8, sf10}, where sf2
denotes 2 subframes, sf3 denotes 3 subframes, and so on.
mac-ContentionResolutionTime: the time for contention resolution. Its

value should be among the set {sf8, sf16, sf24, sf32, sf40, sf48, sf56,
sf64} }, where sf8 denotes 8 subframes, sf16 denotes 16 subframes, and
so on.
 maxHARQ-Msg3Tx: the maximum quanity of Msg3 HARQ transmission.

Its value is an integral, ranging from 1 to 8.
− prach-Config

Figure 4-6 prach_Config
 rootSequenceIndex (RACH_ROOT_SEQUENCE): Its value is an integral,

ranging from 0 to 837. For details, refer to Section 5.7.1 of 3GPP TS
36.211.
 prach-ConfigInfo
prach-ConfigIndex (prach-ConfigurationIndex): Its value is an integral,

ranging from 0 to 63. For details, refer to Section 5.7.1 of 3GPP TS
36.211.
highSpeedFlag (High-speed-flag): Its value is a Boolean one: True means

restricted set, and False means unrestricted set. For details, refer to
Section 5.7.2 of 3GPP TS 36.211.
zeroCorrelationZoneConfig (NCS): Its value is an integral, ranging from 0 to

15. For details, refer to Table 5.7.2-2 in 3GPP TS 36.211.
prach-FreqOffset (prach-FrequencyOffset): Its value is an integral, ranging

from 0 to 94. For details, refer to Section 5.7.1 of 3GPP TS 36.211.
− pdsch-ConfigCommon

 referenceSignalPower (Reference-signal power): Its value is an integral,

ranging from -60 to 50 dBm. For details, refer to Section 5.2 of 3GPP TS
36.213.
 p-b ( PB ): Its value is an integral, ranging from 0 to 3. For details, refer to

Table 5.2-1 in 3GPP TS 36.213.
− pusch-ConfigCommon
 pusch-ConfigBasic
n-SB (Nsb): Its value is an integral, ranging from 1 to 4. For details, refer to
Section 5.3.4 of 3GPP TS 36.211.
hoppingMode (Hopping-mode): It has two options: interSubFrame an

intraAndInterSubFrame. For details, refer to Section 5.3.4 of 3GPP TS
36.211.
pusch-HoppingOffset ( N RB
HO
): Its value is an integral, ranging from 0 to 98.
enable64QAM: Its value is a Boolean one: True means 64 QAM is allowed,

and False means 64 QAM is not allowed. For details, refer to Section 8.6.1
of 3GPP TS 36.213.
 ul-ReferenceSignalsPUSCH
groupHoppingEnabled (Group-hopping-enabled): Its value is a Boolean

one: For details, refer to Section 5.5.1.3 of 3GPP TS 36.211.
groupAssignmentPUSCH (∆SS): Its value is an integral, ranging from 0 to

29. For details, refer to Section 5.5.1.3 of 3GPP TS 36.211.
sequenceHoppingEnabled (Sequence-hopping-enabled): Its value is a

Boolean one. For details, refer to Section 5.5.1.4 of 3GPP TS 36.211.
cyclicShift (cyclicShift): Its value is an integral, ranging from 0 to 7. For

details, refer to Table 5.5.2.1.1-2 in 3GPP TS 36.211.
− phich-Config

Figure 4-7 phich_Config
 phich-Duration (PHICH-Duration): It has two options: normal and extended.

If it is set to normal, it means PHICH is mapped to the first OFDM symbol;
if it is set to extended, it means PHICH is mapped to all OFDM symbols
occupied by PDCCH. For details, refer to Table 6.9.3-1 in 3GPP TS
36.211.
 phich-Resource (Ng): the factor of PHICH group. Its value should be

among the set {oneSixth, half, one, two}. For details, refer to Section 6.9
of 3GPP TS 36.211.
It is used to calculate the number of groups occupied by the PHICH with

the following formula:
group 
=
 (
 N g N RBDL
)
8 for normal cyclic prefix
 ( )
N PHICH
2 ⋅ N g N RB 8
DL
for extended cyclic prefix
− pucch-ConfigCommon

 deltaPUCCH-Shift ( ∆ shift ): the cyclic shift of PUCCH format 1, 1a, or 1b.

PUCCH
It is related to performance and the number of users. Its value should be

among the integral set {ds1, ds2, ds3}, where ds1 denotes 1, ds2 denotes
2, and so on. For details, refer to Section 5.4.1 of 3GPP TS 36.211.
 nRB-CQI ( N RB
(2)
): the number of RBs used for CQI transmission. Its value is
an integral, ranging from 0 to 98. For details, refer to Section 5.4 of 3GPP
TS 36.211.
 nCS-AN ( N cs(1) ): the number of RBs used for hybrid transmission of

PUCCH formats 1/1a/1b and formats 2/2a/2b. Its value is an integral,
ranging from 0 to 7. For details, refer to Section 5.4 of 3GPP TS 36.211.
(1)
 n1PUCCH-AN ( N PUCCH ): the index of RBs used for transmission of
PUCCH format 1, 1a and 1b. Its value is an integral, ranging from 0 to
2047. For details, refer to Section 10.1 of 3GPP TS 36.213.
− soundingRS-UL-ConfigCommon
It has two options: t=1 (relase) and t=2 (setup).
When t is set to 2, the following parameter should be configured:
 srsBandwidthConfig: the bandwidth of SRS. Its value should be among the

set {bw0, bw1, bw2, bw3, bw4, bw5, bw6, bw7}, where bw0 denotes 0,
bw1 denotes 1, and so on. For details, refer to Tables 5.5.3.2-1, 5.5.3.2-2,
5.5.3.2-3, and 5.5.3.2-4 in 3GPP TS 36.211.
 srsSubframeConfig: the configuration of SRS subframe. Its value should

be among the set {sc0, sc1, sc2, sc3, sc4, sc5, sc6, sc7, sc8, sc9, sc10,
sc11, sc12, sc13, sc14, sc15}, where sc0 denotes 0, sc1 denotes 1, and
so on. For details, refer to Table 5.5.3.3-1 in 3GPP TS 36.211.
 ackNackSRS-SimultaneousTransmission. Its value is a Boolean one. It is

the same as Simultaneous-AN-and-SRS in Section 8.2 of 3GPP TS
36.213.
− uplinkPowerControlCommon
 p0-NominalPUSCH ( PO_NOMINAL_ PUSCH (1) ): the nominal transmit power of

PUSCH in dynamic scheduling mode. Its value is an integral, ranging from
-126 to 24 (dBm). For details, refer to Section 5.1.1.1 of 3GPP TS 36.213.
 alpha (α): Its value should be among the set {al0, al04, al05, al06, al07,
al08, al09, al1}, where al0 denotes 0, al04 denotes 0.4, and so on. For

 p0-NominalPUCCH ( PO_NOMINAL_ PUCCH ): the nominal transmit power of

PUCCH. Its value is an integral, ranging from -127 to -96 (dBm). For
 deltaFList-PUCCH ( ∆ F_PUCCH ( F ) ): It indicates the PUCCH format. For

details, refer to Section 5.1.2 of 3GPP TS 36.213
deltaF-PUCCH-Format1: Its value should be among the set {deltaF-2,

deltaF0, deltaF2}, where deltaF-2 denotes -2 dB, deltaF0 denotes 0 dB,
and so on.
deltaF-PUCCH-Format1b: Its value should be among the set {deltaF1,

deltaF3, deltaF5}, where deltaF1 denotes 1 dB, deltaF3 denotes 3 dB, and
so on.
deltaF-PUCCH-Format2: Its value should be among the set {deltaF-2,

deltaF0, deltaF1, deltaF2}, where deltaF-2 denotes -2 dB, deltaF0 denotes
0 dB, and so on.
deltaF-PUCCH-Format2a: Its value should be among the set {deltaF-2,

and so on.
deltaF-PUCCH-Format2b: Its value should be among the set {deltaF-2,

and so on.
 deltaPreambleMsg3 ( ∆ PREAMBLE _ Msg 3 ): Its value is an integral, ranging from

-1 to 6. It can be calculated with the following formula: IE * 2 (dB). For
− antennaInfoCommon: the number of the antenna ports. Its value should be

among the set {an1, an2, an4, spare1}, where an1 denotes one antenna port,
an2 denotes two antenna ports, and so on.
− p-Max: the maximum power of the target cell. If the value is left blank, the UE
will use the maximum power that is available.
− ul-CyclicPrefixLength: the length of the uplink cyclic prefix. It has two values:
len1 and len2, which correspond to normal cyclic prefix and extended cyclic
prefix respectively. For details, refer to Section 5.2.1 of 3GPP TS 36.211.
4.2.2 radioResourceConfigDedicated
The structure of radioResourceConfigDedicated is shown in Figure 4-8.

Figure 4-8 radioResourceConfigDedicated
 drb_ToAddModList
− drb_Identity: the identity of DRB.
− logicChannelConfig: It contains such information as Priority, prioritisedBitRate,

BucketSizeDuration, and LogicalChannelGroup.
 prioritisedBitRate: the prioritised bit rate for logical channels. Its value
ranges from 0 to 10,000,000 kbps.
 BucketSizeDuration: the duration of bucket size for logical channels. Its

value is one of the following: 50, 100, 150, 300, 500, and 1000 ms.
 mac_MainConfig
It has two options: t = 1 (explicitValue) and t = 2 (defaultValue).

Figure 4-9 mac_MainConfig
When t is set to 1, the following parameter should be configured:
− ul_SCH_Config: It contains information such as maxHARQ_Tx,

periodicBSR_Timer, retxBSR_Timer, and ttiBunding.
 maxHARQ_Tx: the maximum times of HARQ message transmission. Its

value should be among the set {n1, n2, n3, n4, n5, n6, n7, n8, n10, n12,
n16, n20, n24, n28, spare2, spare1}.
 periodicBSR_Timer: the timer for period Buffer Satus Report (BSR). Its
value should be among the set {5, 10, 16, 20, 32, 40, 64, 80, 128, 160,
320, 640, 1280, 2560, infinity}, where 5 denotes 5 subframes, 10 denotes
10 subframes, and so on.

 retxBSR_Timer: the timer for retransmission of BSRs between UEs. Its

value should be among the set {sf320, sf640, sf1280, sf2560, sf5120,
sf10240, spare2, spare1}.
 TTI bundling: the switch for bundling TTI. Its value is a Boolean one.
− drx_Config
 onDurationTimer: Its value should be among the set {1, 2, 3, 4, 5, 6, 8, 10,

20, 30, 40, 50, 60, 80, 100, 200} ms. The timer starts when the following
condition is met: [(SFN * 10) + subframe number] module (longDRX -
Cycle) = drxStartOffset; and it stops when the timer expires or the DRX
MAC CE is received.
 drx-InactivityTimer: Its value should be among the set {1, 2, 3, 4, 5, 6, 8, 10,

20, 30, 40, 50, 60, 80, 100, 200, 300, 500, 750, 1280, 1920, 2560,
spare10, spare9, spare8, spare7, spare6, spare5, spare4, spare3, spare2,
spare1} ms. The timer starts when a PDCCH transmission command is
received on the downlink or uplink; and it stops when the timer expires or
the DRX MAC CE (Control Element) is received.,
 drx-RetransmissionTimer: Its value should be among the set {1, 2, 4, 6, 8,

16, 24, 33} ms. The timer starts when HARQ RTT Timer expires but the
data of the process have not been transmitted; and it stops when the timer
expires or the downlink data (such as transmission data, retransmission
data or SPS data) are received.
 longDRX-CycleStartOffset: the offset for long DRX cycle, used in this

formula: [(SFN * 10) + subframe number] module (longDRX-Cycle).
− timeAlignmentTimerDedicated
timeAlignmentTimerDedicated: the timer for scheduling UL_SCH messages.

Its value ranges from 0 to 7, corresponding to 500, 750, 1280, 1920, 2560,
5120, 10240, and infinity subframes respectively.
− phr_Config: Power Headroom Report (PHR) configuration
 periodicPHR-Timer: Its value should be among the set {sf10, sf20, sf50,
sf100, sf200, sf500, sf1000, infinity}.
 prohibitPHR-Timer: Its value should be among the set {sf0, sf10, sf20, sf50,
sf100,sf200, sf500, sf1000}.
 dl-PathlossChange: Its value should be among the set {dB1, dB3, dB6,
infinity}. For details, refer to 3GPP TS 36.321.

4.2.3 securityConfigHO
It has two options: t = 1 (intraLTE) and t = 2 (interRAT).
Figure 4-10 SecurityConfigHO
 intraLTE
− securityAlgorithmConfig
 cipheringAlgorithm: the ciphering algorithm for SRB. Its value should be

among the set {eea0, eea1, eea2, spare5, spare4, spare3, spare2,
spare1, ...}. For details, refer to Section 5.1.4.2 of 3GPP TS 33.401.
 integrityProtAlgorithm: the integrity protection algorithm for SRB and DRB.

Its value should be among the set {eia0-v920, eia1, eia2, spare5, spare4,
spare3, spare2, spare1, ...}.
− keyChangeIndicator: It indicates whether the UE obtains KeNB from the

KASME that is used in the former NAS SMC process or from the KASME of
current keNB. Its value is a Boolean one.
− nextHopChainingCount: For details, refer to 3GPP TS 33.401.
 interRAT
− securityAlgorithmConfig: see related descriptions in the section of intraLTE.
− nas-SecurityParamToEUTRA: It indicates the dedicated NAS information

transmission between the the network and the UE.
4.3 RRC Connection Reconfiguration Complete

The RRC Connection Reconfiguration Complete message is just a response to the RRC
Connection Reconfiguration message, and it does not include any concrete information,
as shown in Figure 4-11.

Figure 4-11 RRC Connection Reconfiguration complete
5 Release Procedure
The release procedure is completed through both the air interface and the S1 interface.
5.1 Air Interface
5.1.1 RRC Connection Release
The RRC Connection Release message is used by an eNodeB to release one RRC
connection.
Figure 5-1 RRCConnectionRelease
The information included in the RRC connection release message is described below.
 ReleaseCause: The reason for the release of one RRC connection. It has the
following options: loadBalancingTAUrequired, other, spare2, and spare1.
 redirectedCarrierInfo: the carrier to which the UE is re-assigned to. It is selected by

means of cell seclection. For details, refer to 3GPP TS 36.304.
 idleModeMobilityControlInfo: the priority for cell reselection. For details about cell
reselection, refer to 3GPP TS 36.304. It has two parameters:
− FreqPriorityListEUTRA: the list of frequency priorities for E-UTRAN.
 carrierFreq

 cellReselectionPriority
− t320: cell reselection priority timer. Its value should be among the set {min5,
min10, min20, min30, min60, min120, min180, spare1}. The timer is started
when the UE receives the RRC connection release message containing
IdleModeMobilityControlInfo or the specical reslection signalingmessage from
other RATs. It stops when the UE enters the RRC_CONNECTED state, when
PLMN selection is performed according to the request of NAS, or when the cell
is selected (reselected) to another RAT. When the timer expires, the UE
discards the cell reselection priority provied by the special signaling message.
5.2 S1 Interface
5.2.1 S1AP_UeContext Release Request

The message is sent from an eNodeB to the MME.
Figure 5-2 S1AP_UeContext Release Request
 MME_UE_S1AP_ID: The context ID of the UE over the S1 interface on the MME

side
 ENB_UE_SAP_ID: The context ID of the UE over the S1 interface on the eNodeB

side

the radio network layer (t = 1) and the reason value u is 6, it means handover failure
in target EPC/eNB or target system.
5.2.2 S1AP_UeContext Release Command
The message is sent from the MME to the eNodeB for releasing the UE’s context over
the S1 interface. It contains the context ID as well as the reason for release.
The structure of uEContextRreleaseCommandMsg is shown in Figure 5-3.
Figure 5-3 S1AP_UeContext Release Command
 MME_UE_S1AP_ID: The context ID of the UE over the S1 interface on the MME

side
 ENB_UE_SAP_ID: The context ID of the UE over the S1 interface on the eNodeB

side
the NAS layer (t = 3) and the reason value u is 2, it means the release reason is
detach.

5.2.3 S1AP_UeContext Release Complete
This message is just a response to the S1AP_UeContext Release Command message,

and it does not include any concrete information.
Figure 5-4 S1AP_UeContext Release Complete
6 Reestablishment Procedure
The reestablishment procedure is completed through the air interface only.
6.1.1 RRC Connection Reestablishment Request
The RRC connection reestablishment request is initiated by one UE, requesting for
reestablishment of one RRC connection.
Figure 6-1 RRC Connection Reestablishment Request
 ReestabUE_Identity: It contains the following fields:

− C_RNTI: the context of the reestablished UE
− ShortMAC_I: short MAC identity for low-level contention solution
− PhysCellId: the identity of the physical cell where the UE connected before the
reestablishment
 ReestablishmentCause: It indicates the reason for the failure that triggers such a
reestablishment. It has three options: reconfigurationFailure, handoverFailure, and
otherFailure.
6.1.2 RRC Connection Reestablishment
The message is used for contention solution and SRB1 reestablishment.
Figure 6-2 RRC Connection Reestablishment
 RRC_TransactionIdentifier: the identifier of a RRC transaction. Its value ranges from

0 to 3. It is set when an eNodeB sends a RRC request.
 radioResourceConfigDedicated: Refer to Section 3.1.2 RRC Connection Setup.
 NextHopChainingCount: Used to update KeNB key. For details, refer to Section

7.2.8.4 of 3GPP TS 33.401.
6.1.3 RRC Connection Reestablishment Complete
This message is a response to the RRC Connection Reestablishment message.

Figure 6-3 RRCConnectionReestablishmentComplete
 RRC_TransactionIdentifier: the identifier of a RRC transaction. It should be the

same as that in the RRCConnectionReestablishment.
6.1.4 RRCConnectionReestablishmentReject
This message is just a response to the RRC Connection Reestablishment message, and
it does not include any concrete information.
Figure 6-4 RRCConnectionReestablishmentReject
7 UE Capability Enquiry Procedure

The UE capability enquiry procedure is completed through the air interface.
7.1 UE Capability Enquiry

This message is used for enquiring the radio access performance of the UE. It includes a
list of RATs, such as E-UTRA, UTRA, GERAN-CS, GERAN-PS, and CDMA2000.

Figure 7-1 UECapabilityEnquiry
7.2 UE Capability Information

This message is used to transmit the UE’s radio access performance requested by the
E-UTRAN.
Figure 7-2 UECapabilityInformation
 RAT_Type: the type of RAT
 ueCapabilityRAT_Container: the UE performance container of the RAT. For

E-UTRAN, the UE performance codes are defined in the IE UE-EUTRA-Capability.
For details, refer to 3GPP TS 36.306.

FDD LTE Basic Signaling Analysis

Hochgeladen von

Dokumentinformationen

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

FDD LTE Basic Signaling Analysis

Hochgeladen von

Copyright:

Verfügbare Formate

FDD LTE Basic Signaling

ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. I

Product Version Document Version Serial Number Reason for Revision

Date Document Version Prepared by Reviewed by Approved by

ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. II

2 System Information ........................................................................................ 1

3 Access Procedure .......................................................................................... 7

4 Handover Procedure .................................................................................... 31

5 Release Procedure ....................................................................................... 41

6 Reestablishment Procedure ........................................................................ 43

ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. IV

7 UE Capability Enquiry Procedure ................................................................ 44

ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. V

Figure 2-1 System Information Signaling .............................................................................. 1

ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. VI

Figure 3-29 initialContextSetupResponse .......................................................................... 30

Table 2-1 Barring Parameters .............................................................................................. 3

Figure 2-1 System Information Signaling

Generally, the UE accesses the following three types of information successively:

2. System information: where the public configuration information of radio resources is

ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. 1

2.1 Master Information Block

Figure 2-2 Master Information Block

 dl_Bandwidth: system bandwdith. Its value ranges from 0 to 5, which correspond to

 phich_Duration: the duration of a physical channel symbol. It has two options: 0

 SystemFrameNumber: system frame number.

2.2 System Information

ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. 2

Figure 2-3 System Information

ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. 3

Table 2-1 Barring Parameters

 Common radio resource configuration parameters

ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. 4

Table 2-2 Common Radio Resource Configuration Parameters

In BCCH Configuration information, BCCH modification periodCoeff is given. It is

Among PCCH Configuration information, there are two parameters:

− Defaulpaging: the cyclic period of incontinuous receiving of paging occasion.

ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. 5

− nB: the coefficient of paging adjustment. Its value ranges from 0 to 7,

PRACH configuration information mainly provides the PRACh configuration index,

− Referencesignalpower: reference signal power (absolute value) of one RE. Its

n-SB (Nsb): For details, refer to Section 5.3.4 of 3GPP TS 36.211.

hoppingMode (Hopping-mode): It has two options: interSubFrame an

HO ): Its value is an integral, ranging from 0 to 98.

enable64QAM: Its value is a Boolean one: True means 64 QAM is allowed,

− hoppingMode: the hopping mode of PUSCH. It has two options: 0 and 1,

− hoppingOffset: the hopping offset of PUSCH. Its value is an integral, ranging

ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. 6

− n1PUCCH_AN: the index of RBs used for transmission of PUCCH format 1, 1a

 Uplink power control configuration

− P0_nominalPUSCH: the nominal power of PUSCH. It is often an absolute

− PoNominalPucch: the nominal power of PUCCH. It is often an absolute value,

 UE-related Timers and Counters

− N310: the maximum number of asynchronous instructions received by the UE

− N311: the maximum number of synchronous instructions received by the UE

− TimeAlignmentTimer: the timer timed assignment. Its value ranges from 0 to 7,

ZTE Confidential Proprietary © 2013 ZTE CORPORATION. All rights reserved. 7

2.3 System Information Block Type1

Figure 2-4 SystemInformationBlockType1

 PLMN_IdentityList: The list of PLMN IDs

− MCC: the mobile country code of the neighbor cell

− MNC: the mobile network code of the neighbor cell

 TrackingAreaCode: the tracking area code

 CellIdentity: the cell’s identity