State Machine OverviewThe main topic on this page is to go
through the state sequence
(s0)->(a1)->(b1)->(c1)->(e1)->(f1)->(g1)->(g2).
But other state transition sequence involving two cells will be
treated as well.
Overview of Handover Process- LTE to LTEThe simplest way to
define the word 'handover' would be "chaging the partner".Who is
chaning the partner ?I meant "UE (Mobile Phone)".Who is the parter
in this case ?I meant "Cell".Therefore "Handover" is the process in
which UE changes the cell.Overall logic is simple and this process
are the same (or at least very similar) in every technology.i) A UE
is in connection with a cell (let's call this 'Cell A').ii) Now a
situation that requires handover happened.iii) Network send "signal
qualitymeasurement" command to UEfor the garget cell ('Cell B') to
which it will handover to.iv) UE performance the measurement and
report the "measurement result" to the network via the current cell
(Cell A).v) Network evaluate the measurement result reported by
UE.vi) If the evaluation result turns out to be good for handover,
Network send 'Change Cell' command to UE.vii) UE perform the cell
change process.viii) If cell change process is completed properly,
UE send 'cell change completion' message to the network via the
target cell (Cell B).I used very generic term e.g, "signal quality
measurement command","measurement result","Change Cell Command",
"Cell Change Completion Message" etc. These generic commands can be
translated to a specific jargon for each technology. For example,
if I translate these for UMTS, they would be as follows :"Signal
quality measurement command" ==> Measurement Control"Measurement
Result" ==> Measurement Report"Change Cell Command" ==>
Physical Channel Reconfiguration or ActiveSetUpdate"Cell Change
Compeletion Message ==> Physical Channel Reconfiguration
Complete or ActiveSetUpdateCompleteIf you translate them into LTE
jargon, they will be as follows."Signal quality measurement
command" ==> RRC Connection Reconfiguration"Measurement Result"
==> Measurement Report"Change Cell Command" ==> RRC
Connection Reconfiguration"Cell Change Compeletion Message ==>
RRC Connection Reconfiguration CompleteYou may noticed that LTE is
using the same message called "RRC Connection Reconfiguration" both
for "Signal quality measurement command" and "Change Cell Command".
How UE can tell whether it means "Signal quality measurement
command" or"Change Cell Command" ?Good question ! You will see the
answer later.Then you may have whole lots of questions. It is very
good. The more questions you have, the more information you will
get through this page.. (not now, in the future -: ) Following is a
set of my personal questions.i) you talked about "Signal Quality
Measurement". What kind of signal quality UE has to measure ? Would
it be a certain absolute value ? or a some relative value with
reference to some other value ? or is it a special event changes
?ii) How much time I can leave the current cell to perform the
measurement for target cell ? (If theleave too long from the
current cell to measure target cell, the call would drop. But if
this time is too short, UE would not get correct measurement
values).iii) What if UE failed to performe the measurement or fail
to find the target cell ?iv) you talked about "Change Cell", how UE
can change cell ? Just cut the connection with the current cell and
reconnect to the target cell ? or is there any specific procedure
?v) Cutting the connection from the current cell will be easy, but
how can UE reconnect to target cell ?vi) What if UE failed to
reconnect to target cell after he cut off the connection with the
current cell ?This list would get longer and longer.Now let's jump
into detailed technical aspects of LTE handover. Following is the
overall and simplest form of LTE-LTE handover procedure. (This
sequence is based on 36.523 TC 8.2.4.2 and I modified the sequence
a little bit for clear/easy understanding, hopefully -:). It means
this is mainly for UE side aspect of Handover
process.StepDirectionMessageTarget CellMemo
1UE SS< Power On and Registration >Cell 1
2UE SS< Now UE is in IDLE mode >Cell 1
3UE SSRRC Connection RequestCell 1
5UE SSRRC Connection Setup CompleteCell 1
7UE SSSecurity Mode CompleteCell 1
9UE SSRRCConnectionReconfigurationCompleteCell 1
11UE SSRRCConnectionReconfigurationCompleteCell 1
13UE ---> SSMeasurement ReportCell 1
14UE SSPRACHCell 2
16UE SSRRCConnectionReconfigurationCompleteCell 2PASS/FAIL
18UE SSueCapabilityInformationCell 2
20UE ---> SSulInformationTransfer + Detach RequestCell 2
21UE WCDMA)Before you go through this, I recommend you to read
throughCS Fallbacksection ofLTE Quick Referenceif you are totally
new to the concept of CS Fallback.There are several variations in
CS Fallback.i) Somebodymake a voice call to you when you are in .
(CSFB is triggered by Paging message)ii) You make a voice call when
you are in iii) Somebody make a voice call to you while you are in
and you switch to a legacy network by Redirection.iv) Somebody make
a voice call to you while you are in and you switch to a legacy
network by Handover.v) You make a voice call when you are in and
you switch to a legacy network by Redirection.vi) You make a voice
call when you are in and you switch to a legacy network by
Handover.Following is an example of CS Fallback from LTE to WCDMA
Voice Call. You will get some detailed information that was not
posted in the Quick Reference Page. (This is for case iii) listed
above)StepDirectionMessageTarget CellMemo
1UE SS< Power On >Cell 1
2UE SS< PRACH and RACH Response>Cell 1
3UE ---> SSRRC Connection RequestCell 1
4UE SSRRC Connection Setup Complete + Attach Request + PDN Conn
ReqCell 1
6UE SS< NAS : Security Mode Establishment >Cell 1
7UE ---> SS< RRC: Security Mode Establishment >Cell
1
8UE SSRRCConnectionReconfigurationComplete / Attach Complete /
...Cell 1
10UE SS< Packet Data Transaction >Cell 1
11SSLTE Network Gets CS Notification from WCDMA NW
12UE SSExtended Service RequestCell 1
14UE Cell 2
16UE ---> SSRouting Area Update RequestCell 2
17UE SS< Authentication >Cell 2
18UE SS< Voice Call Setup >Cell 2
One important thing to notice is that 'EPS/IMSI combined Attach'
process should be properly completed during the attach process
(Step 3 ~ 9).If I decribe the combined attach process including
core network activity, it goes as follows.i) UE send the Attach
Request to MME. In this message, the attach type should be
'EPS/IMSI Combined Attach' and this means that UE is capable and
configured to use CS fallback. If UE support SMS only in CS domain
and does not support CSFB, UE have to indicate 'SMS-only'.ii) MME
allocate a default LAI and derives the VLR number based on the
allocated LAI and IMSI.iii) MME sends a Location Update Request
message to VLR. This Location Update Request message contains new
LAI, IMSI, MME IP, Location Update Type etc.iv) The VLR stores the
MME addressv) The VLR performs Location Updating procedure in CS
domainvi) The VLR sends Location Update Accept with TMSI to the
MMEvii) The MME send Attach Accept carrying LAI and TMSI. The
existence of LAI and TMSI in the Attach Accept message indicates
successful attach to CS domain.Followings are the two messages that
triggers CSFB process.< CS Service Notification >+-c1 ::=
CHOICE [dlInformationTransfer]+-dlInformationTransfer ::=
SEQUENCE+-rrc-TransactionIdentifier ::= INTEGER (0..3)
[0]+-criticalExtensions ::= CHOICE [c1]+-c1 ::= CHOICE
[dlInformationTransfer-r8]+-dlInformationTransfer-r8 ::= SEQUENCE
[0]+-dedicatedInfoType ::= CHOICE [dedicatedInfoNAS]|
+-dedicatedInfoNAS ::= OCTET STRING SIZE(ALIGNED)
[270DCBC04504076401]+-nonCriticalExtension ::= SEQUENCE
OPTIONAL:OmitCS service notification ::= DIVISION+-Security header
type ::= V| +-Security header type ::= CHOICE [Plain NAS message,
not security protected]+-EPS mobility management protocol
discriminator ::= V| +-Protocol discriminator ::= PD [7]+-CS
service notification message identity ::= V| +-Message type ::= MSG
[64]+-Paging identity ::= V| +-Octet1 ::= DIVISION| +-spare ::= FIX
[0]| +-Paging identity value ::= CHOICE [TMSI]+-CLI ::= TLV
OPTIONAL:Omit| +-Octet1 ::= DIVISION| | +-CLI IEI ::= IEI [60]|
+-Octet2 ::= DIVISION| | +-Length of CLI ::= LEN (0..255) [0]|
+-Octet3 ::= DIVISION| | +-ext ::= EXT (0..1) [1]| | +-type of
number ::= INT (0..7) [0]| | +-Numbering plan identification ::=
INT (0..15) [0]| +-Octet3a ::= DIVISION| | +-ext ::= EXT1 [1]| |
+-presentation indicator ::= CHOICE [Presentation allowed]| |
+-spare ::= FIX [0]| | +-screening indicator ::= CHOICE
[User-provided, not screened]| +-Octet4-12 ::= DIVISION| +-Number
digit ::= DIGIT SIZE(0..10)+-SS Code ::= TV OPTIONAL:Omit| +-Octet1
::= DIVISION| | +-SS Code IEI ::= IEI [61]| +-Octet2 ::= DIVISION|
+-SS Code value ::= CHOICE [allSS]+-LCS indicator ::= TV
OPTIONAL:Omit| +-Octet1 ::= DIVISION| | +-LCS indicator IEI ::= IEI
[62]| +-Octet2 ::= DIVISION| +-LCS indicator value ::= CHOICE
[MT-LR]+-LCS client identity ::= TLV OPTIONAL:Omit+-Octet1 ::=
DIVISION| +-LCS client identity IEI ::= IEI [63]+-Octet2 ::=
DIVISION| +-Length of LCS client identity ::= LEN (0..255)
[0]+-Octet3- ::= DIVISION+-LCS client identity(value part) ::=
OCTETARRAY SIZE(0..255) [00]< Extended Service Request >+-c1
::= CHOICE [ulInformationTransfer]+-ulInformationTransfer ::=
SEQUENCE+-criticalExtensions ::= CHOICE [c1]+-c1 ::= CHOICE
[ulInformationTransfer-r8]+-ulInformationTransfer-r8 ::= SEQUENCE
[0]+-dedicatedInfoType ::= CHOICE [dedicatedInfoNAS]|
+-dedicatedInfoNAS ::= OCTET STRING SIZE(ALIGNED)
[274D83AB1F04074C0105F400000001B1]+-nonCriticalExtension ::=
SEQUENCE OPTIONAL:OmitNAS_LTE:EMM,Extended service requestExtended
service request ::= DIVISION+-Security header type ::= V|
+-Security header type ::= CHOICE [Plain NAS message, not security
protected]+-EPS mobility management protocol discriminator ::= V|
+-Protocol discriminator ::= PD [7]+-Extended service request
message identity ::= V| +-Message type ::= MSG [4C]+-NAS key set
identifier ::= V| +-TSC ::= CHOICE [native security context (for
KSI ASME)]| +-NAS key set identifier ::= CHOICE [possible values
for the NAS key set identifier 0]+-Service type ::= V| +-Service
type value ::= CHOICE [mobile terminating CS fallback or 1xCS
fallback]+-M-TMSI ::= LV| +-Octet1 ::= DIVISION| | +-Length of
mobile identity contents ::= LEN (0..255) [5]| +-Octet2 ::=
DIVISION| | +-Identity digit 1 ::= INT (0..15) [15]| | +-Odd/even
indication ::= CHOICE[even number of identity digits and also when
the TMSI/P-TMSI is used]| | +-Type of identity ::= CHOICE
[TMSI/P-TMSI/M-TMSI]| +-Octet3-Octet6 ::= DIVISION| +-Identity
digit p ::= OCTETARRAY SIZE(0..4) [00000001]+-CSFB response ::= TV
OPTIONAL:Exist+-Octet1 ::= DIVISION+-CSFB response IEI ::= IEI
[B-]+-spare ::= FIX [0]+-CSFB response value ::= CHOICE [CS
fallback accepted by the UE]One of the important steps of CSFB is
to optimize 'RRC Release' message from LTE network. (This is step
14 in the example sequence of this section). This is important step
because the time delay (Redirection Delay) between LTE RRC Release
and UMTS PRACH may vary depending on how much detailed information
that this message carries. As far as I experienced, there may be
several different types of RRC Release message as shown below
(These are only examples)< RRC Connection Release - Release
8>DL-DCCH-Message ::= SEQUENCE+-message ::= CHOICE [c1]+-c1 ::=
CHOICE [rrcConnectionRelease]+-rrcConnectionRelease ::=
SEQUENCE+-rrc-TransactionIdentifier ::= INTEGER (0..3)
[0]+-criticalExtensions ::= CHOICE [c1]+-c1 ::= CHOICE
[rrcConnectionRelease-r8]+-rrcConnectionRelease-r8 ::= SEQUENCE
[100]+-releaseCause ::= ENUMERATED [other]+-redirectedCarrierInfo
::= CHOICE [utra-FDD] OPTIONAL:Exist| +-utra-FDD ::= INTEGER
(0..16383) [9900]+-idleModeMobilityControlInfo ::= SEQUENCE
OPTIONAL:Omit+-nonCriticalExtension ::= SEQUENCE OPTIONAL:Omit<
RRC Connection Release - Release 9 with PCI only and NoBCCH
Information >DL-DCCH-Message ::= SEQUENCE+-message ::= CHOICE
[c1]+-c1 ::= CHOICE [rrcConnectionRelease]+-rrcConnectionRelease
::= SEQUENCE+-rrc-TransactionIdentifier ::= INTEGER (0..3)
[0]+-criticalExtensions ::= CHOICE [c1]+-c1 ::= CHOICE
[rrcConnectionRelease-r8]+-rrcConnectionRelease-r8 ::= SEQUENCE
[101]+-releaseCause ::= ENUMERATED [other]+-redirectedCarrierInfo
::= CHOICE [utra-FDD] OPTIONAL:Exist| +-utra-FDD ::= INTEGER
(0..16383) [9900]+-idleModeMobilityControlInfo ::= SEQUENCE
OPTIONAL:Omit+-nonCriticalExtension ::= SEQUENCE [01]
OPTIONAL:Exist+-lateNonCriticalExtension ::= OCTET STRING
OPTIONAL:Omit+-nonCriticalExtension ::= SEQUENCE [10]
OPTIONAL:Exist+-cellInfoList-r9 ::= CHOICE [utra-FDD-r9]
OPTIONAL:Exist| +-utra-FDD-r9 ::= SEQUENCE OF
SIZE(1..maxCellInfoUTRA-r9[16]) [1]| +-CellInfoUTRA-FDD-r9 ::=
SEQUENCE| +-physCellId-r9 ::= INTEGER (0..511) [202]|
+-utra-BCCH-Container-r9 ::= OCTET STRING
SIZE(ALIGNED)+-nonCriticalExtension ::= SEQUENCE OPTIONAL:Omit<
RRC Connection Release - Release 9 with PCIand BCCH Information
>DL-DCCH-Message ::= SEQUENCE+-message ::= CHOICE [c1]+-c1 ::=
CHOICE [rrcConnectionRelease]+-rrcConnectionRelease ::=
SEQUENCE+-rrc-TransactionIdentifier ::= INTEGER (0..3)
[0]+-criticalExtensions ::= CHOICE [c1]+-c1 ::= CHOICE
[rrcConnectionRelease-r8]+-rrcConnectionRelease-r8 ::= SEQUENCE
[101]+-releaseCause ::= ENUMERATED
[loadBalancingTAUrequired]+-redirectedCarrierInfo ::= CHOICE
[utra-FDD] OPTIONAL:Exist| +-utra-FDD ::= INTEGER (0..16383)
[9900]+-idleModeMobilityControlInfo ::= SEQUENCE
OPTIONAL:Omit+-nonCriticalExtension ::= SEQUENCE [01]
OPTIONAL:Exist+-lateNonCriticalExtension ::= OCTET STRING
OPTIONAL:Omit+-nonCriticalExtension ::= SEQUENCE [10]
OPTIONAL:Exist+-cellInfoList-r9 ::= CHOICE [utra-FDD-r9]
OPTIONAL:Exist| +-utra-FDD-r9 ::= SEQUENCE OF
SIZE(1..maxCellInfoUTRA-r9[16]) [1]| +-CellInfoUTRA-FDD-r9 ::=
SEQUENCE| +-physCellId-r9 ::= INTEGER (0..511) [9]|
+-utra-BCCH-Container-r9 ::= OCTET STRING SIZE(ALIGNED)
[285084403C...00]+-nonCriticalExtension ::= SEQUENCE
OPTIONAL:OmitFor the fully decoded example of this message, seethis
file.
