中国联通CSFB测试的主要流程信令

中国联通FDD_LTE的CSFB测试和分析

一、前言

本文主要针对联通FDD-LTE网络，使用华星FLY6.0进行CSFB测试和分析；CSFB 涉及4G侧(LTE)、3G侧（WCDMA）和MSC核心网侧三方的配合。以下主要是针对测试和事件消息流程进行分析和说明。

二、CSFB测试流程

CSFB测试过程主要是主叫4G手机、被叫4G手机分别驻留LTE网络中，连接FLY6.0测试软件，进行主叫4G手机拨打被叫4G手机，主叫4G手机和被叫4G手机分别回落至WCDMA网络进行通话的过程。

CSFB测试流程主要分为测试准备、测试过程和测数据统计三个部分：

4、从主被叫的CSFB信令流程来看，主被叫的CSFB信令流程是否正常？一定要查看主被叫的CSFB的起呼、4G 网络RRC释放、4G重选至3G、3G的RRC\RAB\Alerting的完整起呼流程。验证完全完整后，才算合格。

数据统计1、单站报告中CSFB成功率统计

2、CSFB的log记录备份

3、若存在测试不成功现象，可初步按照

第4节指导进行初步分析原因，待调整后

复测

分析原因一定要细分类，描述清晰，复

测一定要确定故障消除

三、正常CSFB信令流程

3.1.主叫主要流程

当开机做主叫时，UE首先在FDD_LTE注册（attach）,完成注册后进行拨号；

通过E_nodeB上发CSFB请求；其主要流程如下：

3.1.1开机注册（attach）

注册请求消息Attach Request(层三消息RRCConnectionRequest)由UE发出（消息属NAS层），请求中包括UE注册的小区，UE支持的加密算法和方式；联合注册的4G（TAC）和3G(LAC/RAC)及ClassMark;

Attach request MORE: 0 LENGTH: 123 LENGTH: 123 LOG_CODE: B0ED timeStamp: 16:20:28.016 LTE NAS EMM plain OTA outgoing msg LOG_VERSION: 1 STD_VERSION: 9 STD_VERSION_MAJOR: 5

STD_VERSION_MINOR: 0

NAS: Attach request

Security Header Type: 0

Protocol Discriminator: 7 Message_Types: 65 NAS key set identifier TSC: 0 - native security context NASkeysetidentifier: 1 EPS attach type

EPS attach type value: 2 - combined EPS/IMSI attach EPS mobile identity

Length of EPS mobile identity contents: 11 odd_even indic: 0 - even number of identity digits and also when the GUTI is used Type of identity: 6 - GUTI

MCC: 460 MNC: 01 MMEGroupID: 9A00

MMECode: 206 M_TMSI: 9A00CC345E25 UE network capability EEA0: 1 - supporte

128_EEA1: 1 - supported

128_EEA2: 1 - supported EEA3: 0 - not supported EEA4: 0 - not supported

EEA5: 0 - not supported

EEA6: 0 - not supported EEA7: 0 - not supported EIA0: 0 - not supported 128_EIA1: 1 - supported

128_EIA2: 1 - supported

EIA3: 0 - not supported

EIA4: 0 - not supported EIA5: 0 - not supported

EIA6: 0 - not supported

EIA7: 0 - not supported

UEA0: 1 - supported

UEA1: 1 - supported

UEA2: 0 - not supported

UEA3: 0 - not supported UEA4: 0 - not supported UEA5: 0 - not supported

UEA6: 0 - not supported

UEA7: 0 - not supported UCS2: 0 - not supported

UIA1: 1 - supported

UIA2: 0 - not supported UIA3: 0 - not supported

UIA4: 0 - not supported

UIA5: 0 - not supported UIA6: 0 - not supported UIA7: 0 - not supported ACCCSFB: 1 - supported

LPP: 0 - not supported

LCS: 0 - not supported

_1xSRVCC: 0 - not supported NF: 1 - supported ESM message container Length: 38 ESM message container contents: 02,03,D0,31,27,20,80,80,21,10,01,00,00,10,81,06,00,00,00,00,83,06,00,00,00,00,00,0D ,00,00,03,00,00,0A,00,00,10,00 PDN connectivity request Security Header Type: 0 Protocol Discriminator: 2 Message_Types: 208 PDN type

PDN type value: 3 - IPv4v6

Request type Request type value: 1 - initial request

Protocol configuration options

Length: 32

ProtocolID 0x: 8021 Length of protocol: 16 code: 1 - Configure-Request Identifier: 0 length: 16

Type: 129 - Primary DNS Server IP Address

len: 6 IP Address: 0.0.0.0 Type: 131 - Secondary-DNS-Address

len: 6 IP Address: 0.0.0.0 ProtocolID 0x: 0D

Length of protocol: 0 Tracking area identity

MCC: 460

MNC: 01 TAC: 37135 DRX parameter

SPLIT PG CYCLE CODE: 10

CN Specific DRX cycle length coefficient and DRX value for S1 mode: 0

SPLIT on CCCH: 0 - is not supported

non-DRX timer: 0 - no non-DRX mode after transfer state

MS network capability Length of MS network capability contents: 3

MS network capability value: E5,C0,3E

Location area identification MCC: 460 MNC: 10 Lac: 47889

Mobile station class mark 2

Revision level: 2 - Used by mobile stations supporting R99 or later versions of the protocol ESIND: 0 - option is not implemented

A5/1 algorithm supported: 1 - not available RF Power Capability: reserved PS capability: 0 - not present

SS Screening Indicator: 1 defined in GSM 04.80 SM capability: 1 - Mobile station supports mobile terminated point to point SMS VBS notification reception: 0 - no VBS capability or no notifications wanted

VGCS notification reception: 0 - no VGCS capability or no notifications wanted FC Frequency Capability: 0 - The MS does not support the extension band G1 in addition to the primary GSM band

CM3: 1 - The MS supports options that are indicated in class mark 3 IE LCSVA capability: 1 UCS2: 0 - the ME has a preference for the default alphabet over UCS2

SoLSA: 0 - The ME does not support SoLSA

CMSP: 1 - Network initiated MO CM connection request supported for at least one CM protocol A5/3 algorithm supported: 1 - not available A5/2 algorithm supported: 0 - available

Spare half octet

Length Of Supported Codec list: 8

System Identification: 4

Length Of Bitmap for SysID: 2 Length Of Bitmap for SysID: 60 Length Of Bitmap for SysID: 04

System Identification: 0 Length Of Bitmap for SysID: 2

Length Of Bitmap for SysID: 1F

Length Of Bitmap for SysID: 02 Voice domain preference and UE's usage setting

Length of Voice domain preference and UE's usage setting contents: 6

UE's usage setting: 0 - Voice centric

UE's usage setting: 0 - CS Voice only

Voice domain preference and UE's usage setting

GUTI type: 0 - Native GUTI

MS network feature support

Extended periodic timers: 1 - MS support3.1.2注册（attach）成功UE收到RRCConnectionSetup消息，进行注册Attach Accepet(层三消息RRCConnectionSetupComplete)，成功消息中包括注册的小区MCC,MNC,MME GroupID,MME Code及UE的M_TMSI等信息．

3.1.3UE语音业务请求（CSFB MT START）

UE上发Ext service request（NAS到EMM）消息，内容为CS fall back业务请求；

Extended service request MORE: 0 LENGTH: 35

LENGTH: 35

LOG_CODE: B0ED timeStamp: 16:20:44.796 LTE NAS EMM plain OTA outgoing msg LOG_VERSION: 1 STD_VERSION: 9

STD_VERSION_MAJOR: 5

STD_VERSION_MINOR: 0 NAS: Extended service request Security Header Type: 0 Protocol Discriminator: 7 Message_Types: 76

NAS key set identifier TSC: 0 - native security context

NASkeysetidentifier: 1

Service type

Service type value: mobile originating CS fall back or 1xCS fall back

Mobile identity Odd/even indication: 0 - even number of identity digits and also when the TMSI/P-TMSI or TMGI and optional MBMS Session Identity is used

Type of identity: 4 - TMSI/P-TMSI Identity digits (0x): DC345E25 EPS bearer context status length: 32

EBI: 0

3.1.4E_nodeB指标UE回落

E_nodeB在下发给UE的RRCConnectionRelease中给出重定向的目标（utra_FDD=10713）

RRCConnectionRelease MORE: 0 LENGTH: 1993 LENGTH: 1993 LOG_CODE: B0C0 timeStamp: 16:20:44.928

RRCConnectionRelease VERSION: 7 RRC_REL: 10

RRC_REL: 113 RRC_VER: 1 PHYSICAL_CELL_ID: 368(4G服务小区) FREQ: 1650 System_Frame_Number: 34

Subframe: 8

PDU_NUM: 6 ENCODED_MSG_LEN: 1964 RRC: DL-DCCH-Message

message

rrcConnectionRelease

rrc_TransactionIdentifier = 0

criticalExtensions

rrcConnectionRelease_r8

releaseCause = other

redirectedCarrierInfo（重定向方向）

utra_FDD = 10713

nonCriticalExtension

cellInfoList_r9 (以下是3G邻区扰码)

utra_FDD_r9[0] physCellId_r9 = 201

utra_FDD_r9[1] physCellId_r9 = 209

utra_FDD_r9[2] physCellId_r9 = 233

utra_FDD_r9[3] physCellId_r9 = 393

utra_FDD_r9[4] physCellId_r9 = 11

utra_FDD_r9[5] physCellId_r9 = 35

utra_FDD_r9[6] physCellId_r9 = 448

utra_FDD_r9[7] physCellId_r9 = 3

3.1.5．UE在3G网络进行呼叫

UE读取3G网络系统消息，发起业务请求（CM Sercive Request）;请求中包括业务类型，UE能力和支持的加密类型等等．．

CM service request MORE: 0 LENGTH: 31 LENGTH: 31 LOG_CODE: 713A timeStamp: 16:20:45.832 UMTS NAS Signaling Messages

Direction: From UE Length: 14 ChannelType: 5

MessageType: 36 UMTS NAS Signaling Messages: CM service request

CM service type

Service Type : 0

Ciphering key sequence number

key sequence : 1

Mobile station classmark Revision level : 2 - Used by mobile stations supporting R99 or later versions of the protocol

ESIND : 1 - ( option is implemented).

A5/1 algorithm supported : 0 - (available)

RF Power Capability : 7 - reserved PS capability : 1 - (present)

SS Screening Indicator : 1(defined in GSM 04.80)

SM capability : 1 - Mobile station supports mobile terminated point to point SMS

VBS notification reception : 0 - no VBS capability or no notifications wanted VGCS notificationr eception : 0 - no VGCS capability or no notifications wanted 0 - The MS does not support the extension band G1 in addition to the primary GSM bandClassmark 3(CM3) : 1 - The MS supports options that are indicated in classmark 3 IE LCSVA capability : 1 UCS2 : 0 - the ME has a preference for the default alphabet over UCS2

SoLSA : 0 - The ME does not support SoLSA CMSP : 1 - Network initiated MO CM connection request supported for at least one CM protocol A5/3 algorithm supported : 1 - (not available)

A5/2 algorithm supported : 0 - (available)

Mobile identity Type of identity : 4 - TMSI/P-TMSI

Odd/even indication : 0 Identity digits : 0x03C3239B

3.1.6. RAU和RAB建立

在3G网络进行RAU（ROUTING AREA UPDATE REQUEST），无线承载建立请求（RadioBearerSetupComplete），为UE分配无线资源．

RadioBearerSetupComplete MORE: 0

LENGTH: 26 LENGTH: 26 LOG_CODE: 412F timeStamp: 16:20:47.026 RRC: UL_DCCH

integrityCheckInfo

messageAuthenticationCode = 32, 0xB6 0x11 0x69 0x93

rrc_MessageSequenceNumber = 2

message

radioBearerSetupComplete

rrc_TransactionIdentifier = 0

start_Value = 20, 0x00 0x00 0110xxxx count_C_ActivationTime = 208 3.1.7. 振铃（Alerting）

在3G网络无线资源分配完成后，网络发振铃消息给UE

3.1.8.接通（Connect）

被叫摘机，链路连通主，被开始通话．

3.1.9.挂机（Disconnect）

结束通话后主呼挂机，上发拆链消息（Disconnect），下（上）行RRC释放后，通话结束；

在E_nodeB下发的RRCConnectionRelease消息中指出了，UE返回4G中心频率(1650)

RRCConnectionRelease MORE: 0 LENGTH: 27

LENGTH: 27 LOG_CODE: 412F timeStamp: 16:21:10.142

RRC: DL_DCCH

integrityCheckInfo

messageAuthenticationCode = 32, 0x8D 0xAB 0xEB 0x8C

rrc_MessageSequenceNumber = 1

message

rrcConnectionRelease r3

rrcConnectionRelease_r3

rrc_TransactionIdentifier = 0

n_308 = 1

releaseCause = normalEvent

laterNonCriticalExtensions

v690NonCriticalExtensions

rrcConnectionRelease_v690ext

v770NonCriticalExtensions

rrcConnectionRelease_v770ext

v860NonCriticalExtensions

rrcConnectionRelease_v860ext

redirectionInfo （重定向返回系统和小区中心频点）

interRATInfo

eutra

eutra_TargetFreqInfoList[0]

dlEUTRACarrierFreq = 1650

3.1.10.完成TAU（返回4G）

UE在4G网络进行TAU请求，TAU完成后UE成功返回4G网络．(TAU详细流程详见FTP下载分析)

3.2 .被叫呼叫流程

UE接收到寻呼消息（Paging），向网络发起CSFB请求，其他流程与主叫相同．

Paging

MORE: 0 LENGTH: 36 LENGTH: 36

LOG_CODE: B0C0

timeStamp: 16:21:44.220

Paging

VERSION: 7 RRC_REL: 10 RRC_REL: 113

RRC_VER: 0

PHYSICAL_CELL_ID: 368 FREQ: 1650

System_Frame_Number: 145

Subframe: 10

PDU_NUM: 4

ENCODED_MSG_LEN: 7

RRC: PCCH-Message

message

paging

pagingRecordList[0]

ue_Identity

s_TMSI

mmec = 8, 0xCE m_TMSI = 32, 0xCC 0x73 0xA0 0x25 cn_Domain = cs

四.联合附着手机驻留4G

由于目前LTE网络暂不支持viop业务，CSFB需要从4G回落至3G进行CS域业务，因此手机选择WCDMA和LTE双模情况下，手机需要在CS域LAC和PS域TAC进行联合附着过程。

若是LAC~TAC联合附着成功，手机双模可驻留4G；若是LAC~TAC联合附着不成功，手机双模时会回落至3G。

目前手机双模LAC~TAC联合附着主要通过以下2个途径：

（1）TAU过程中进行LAC~TAC联合附着；

（2）Attach过程中进行联合附着；

只要通过以上之一联合附着成功，手机双模就可以驻留4G;