中国联通CSFB测试的主要流程信令.doc

中国联通FDD_LTE的CSFB测试和分析一、 前言本文主要针对联通FDD-LTE网络，使用华星FLY6.0进行CSFB测试和分析；CSFB涉及4G侧(LTE)、3G侧（WCDMA）和MSC核心网侧三方的配合。以下主要是针对测试和事件消息流程进行分析和说明。二、 CSFB测试流程CSFB测试过程主要是主叫4G手机、被叫4G手机分别驻留LTE网络中，连接FLY6.0测试软件，进行主叫4G手机拨打被叫4G手机，主叫4G手机和被叫4G手机分别回落至WCDMA网络进行通话的过程。CSFB测试流程主要分为测试准备、测试过程和测数据统计三个部分：步骤工作项目备注测试准备1、测试手机是否支持FDD-LTE和3G双模;使用中兴Q801U测试手机，支持FDDLTE和WCDMA2、测试SIM卡是否具备4G和3G属性测试卡4G/3G测试都具备；部分老3G卡需增加4G属性；删除4G属性的卡会出现“AU鉴权失败，无法驻留4G网络”现象3、测试手机是否连接FLY6.0 测试软件,并进行记录每个小区都需要记录CSFB测试log3、测试手机是否开启LTE和WCDMA双模模式，手机“网络模式”中4、手机选择双模后，是否稳定驻留4G;5、无线环境是否稳定？（RSRP-100dBm,SINR0dB）6、从空口消息观察TAC配置，检查TAC和LAC的对应关系是否正常； 测试过程1、主叫手机和被叫手机是否稳定驻留在4G网络；2、主叫4G手机拨打被叫4G手机，是否拨通？进行重复多次尝试；1、若是未拨通，是否听见回铃音，判断主叫信令是否正常；2、若主叫信令正常，判断被叫寻呼消息和CSFB信令是否正常3、从主被叫的KPI统计中观测CSFB是否统计正常？4、从主被叫的CSFB信令流程来看，主被叫的CSFB信令流程是否正常？一定要查看主被叫的CSFB的起呼、4G网络RRC释放、4G重选至3G、3G的RRCRABAlerting的完整起呼流程。验证完全完整后，才算合格。数据统计1、单站报告中CSFB成功率统计2、CSFB的log记录备份3、若存在测试不成功现象，可初步按照第4节指导进行初步分析原因，待调整后复测分析原因一定要细分类，描述清晰，复测一定要确定故障消除三、 正常CSFB信令流程3.1.主叫主要流程当开机做主叫时，UE首先在FDD_LTE注册（attach）,完成注册后进行拨号；通过E_nodeB上发CSFB请求；其主要流程如下：3.1.1开机注册（attach）注册请求消息AttachRequest(层三消息 RRCConnectionRequest)由UE发出（消息属NAS层），请求中包括UE注册的小区，UE支持的加密算法和方式；联合注册的4G（TAC）和3G(LAC/RAC)及ClassMark;Attach request MORE: 0 LENGTH: 123 LENGTH: 123 LOG_CODE: B0ED timeStamp: 16:20:28.016 LTE NAS EMM plain OTA outgoing msg LOG_VERSION: 1 STD_VERSION: 9 STD_VERSION_MAJOR: 5 STD_VERSION_MINOR: 0 NAS: Attach request Security Header Type: 0 Protocol Discriminator: 7 Message_Types: 65 NAS key set identifier TSC: 0 - native security context NASkeysetidentifier: 1 EPS attach type EPS attach type value: 2 - combined EPS/IMSI attach EPS mobile identity Length of EPS mobile identity contents: 11 odd_even indic: 0 - even number of identity digits and also when the GUTI is used Type of identity: 6 - GUTI MCC: 460 MNC: 01 MMEGroupID: 9A00 MMECode: 206 M_TMSI: 9A00CC345E25 UE network capability EEA0: 1 - supporte 128_EEA1: 1 - supported 128_EEA2: 1 - supported EEA3: 0 - not supported EEA4: 0 - not supported EEA5: 0 - not supported EEA6: 0 - not supported EEA7: 0 - not supported EIA0: 0 - not supported 128_EIA1: 1 - supported 128_EIA2: 1 - supported EIA3: 0 - not supported EIA4: 0 - not supported EIA5: 0 - not supported EIA6: 0 - not supported EIA7: 0 - not supported UEA0: 1 - supported UEA1: 1 - supported UEA2: 0 - not supported UEA3: 0 - not supported UEA4: 0 - not supported UEA5: 0 - not supported UEA6: 0 - not supported UEA7: 0 - not supported UCS2: 0 - not supported UIA1: 1 - supported UIA2: 0 - not supported UIA3: 0 - not supported UIA4: 0 - not supported UIA5: 0 - not supported UIA6: 0 - not supported UIA7: 0 - not supported ACCCSFB: 1 - supported LPP: 0 - not supported LCS: 0 - not supported _1xSRVCC: 0 - not supported NF: 1 - supported ESM message container Length: 38 ESM message container contents: 02,03,D0,31,27,20,80,80,21,10,01,00,00,10,81,06,00,00,00,00,83,06,00,00,00,00,00,0D,00,00,03,00,00,0A,00,00,10,00 PDN connectivity request Security Header Type: 0 Protocol Discriminator: 2 Message_Types: 208 PDN type PDN type value: 3 - IPv4v6 Request type Request type value: 1 - initial request Protocol configuration options Length: 32 ProtocolID 0x: 8021 Length of protocol: 16 code: 1 - Configure-Request Identifier: 0 length: 16 Type: 129 - Primary DNS Server IP Address len: 6 IP Address: 0.0.0.0 Type: 131 - Secondary-DNS-Address len: 6 IP Address: 0.0.0.0 ProtocolID 0x: 0D Length of protocol: 0 Tracking area identity MCC: 460 MNC: 01 TAC: 37135 DRX parameter SPLIT PG CYCLE CODE: 10 CN Specific DRX cycle length coefficient and DRX value for S1 mode: 0 SPLIT on CCCH: 0 - is not supported non-DRX timer: 0 - no non-DRX mode after transfer state MS network capability Length of MS network capability contents: 3 MS network capability value: E5,C0,3E Location area identification MCC: 460 MNC: 10 Lac: 47889 Mobile station class mark 2 Revision level: 2 - Used by mobile stations supporting R99 or later versions of the protocol ESIND: 0 - option is not implemented A5/1 algorithm supported: 1 - not available RF Power Capability: reserved PS capability: 0 - not present SS Screening Indicator: 1 defined in GSM 04.80 SM capability: 1 - Mobile station supports mobile terminated point to point SMS VBS notification reception: 0 - no VBS capability or no notifications wanted VGCS notification reception: 0 - no VGCS capability or no notifications wanted FC Frequency Capability: 0 - The MS does not support the extension band G1 in addition to the primary GSM band CM3: 1 - The MS supports options that are indicated in class mark 3 IE LCSVA capability: 1 UCS2: 0 - the ME has a preference for the default alphabet over UCS2 SoLSA: 0 - The ME does not support SoLSA CMSP: 1 - Network initiated MO CM connection request supported for at least one CM protocol A5/3 algorithm supported: 1 - not available A5/2 algorithm supported: 0 - available Spare half octet Length Of Supported Codec list: 8 System Identification: 4 Length Of Bitmap for SysID: 2 Length Of Bitmap for SysID: 60 Length Of Bitmap for SysID: 04 System Identification: 0 Length Of Bitmap for SysID: 2 Length Of Bitmap for SysID: 1F Length Of Bitmap for SysID: 02 Voice domain preference and UEs usage setting Length of Voice domain preference and UEs usage setting contents: 6 UEs usage setting: 0 - Voice centric UEs usage setting: 0 - CS Voice only Voice domain preference and UEs usage setting GUTI type: 0 - Native GUTI MS network feature support Extended periodic timers: 1 - MS support3.1.2注册（attach）成功 UE收到RRCConnectionSetup消息，进行注册Attach Accepet(层三消息RRCConnectionSetupComplete)，成功消息中包括注册的小区MCC,MNC,MME GroupID,MME Code及UE的M_TMSI等信息3.1.3 UE语音业务请求（CSFB MT START） UE上发Ext service request（NAS到 EMM）消息，内容为CS fall back业务请求；Extended service request MORE: 0 LENGTH: 35 LENGTH: 35 LOG_CODE: B0ED timeStamp: 16:20:44.796 LTE NAS EMM plain OTA outgoing msg LOG_VERSION: 1 STD_VERSION: 9 STD_VERSION_MAJOR: 5 STD_VERSION_MINOR: 0 NAS: Extended service request Security Header Type: 0 Protocol Discriminator: 7 Message_Types: 76 NAS key set identifier TSC: 0 - native security context NASkeysetidentifier: 1 Service type Service type value: mobile originating CS fall back or 1xCS fall back Mobile identity Odd/even indication: 0 - even number of identity digits and also when the TMSI/P-TMSI or TMGI and optional MBMS Session Identity is used Type of identity: 4 - TMSI/P-TMSI Identity digits (0x): DC345E25 EPS bearer context status length: 32 EBI: 03.1.4 E_nodeB指标UE回落E_nodeB在下发给UE的RRCConnectionRelease中给出重定向的目标（utra_FDD=10713）RRCConnectionRelease MORE: 0 LENGTH: 1993 LENGTH: 1993 LOG_CODE: B0C0 timeStamp: 16:20:44.928 RRCConnectionRelease VERSION: 7 RRC_REL: 10 RRC_REL: 113 RRC_VER: 1 PHYSICAL_CELL_ID: 368(4G服务小区) FREQ: 1650 System_Frame_Number: 34 Subframe: 8 PDU_NUM: 6 ENCODED_MSG_LEN: 1964 RRC: DL-DCCH-Message message c1 rrcConnectionRelease rrc_TransactionIdentifier = 0 criticalExtensions c1 rrcConnectionRelease_r8 releaseCause = other redirectedCarrierInfo（重定向方向） utra_FDD = 10713 nonCriticalExtension nonCriticalExtension cellInfoList_r9 (以下是3G邻区扰码) utra_FDD_r90 physCellId_r9 = 201 utra_FDD_r91 physCellId_r9 = 209 utra_FDD_r92 physCellId_r9 = 233 utra_FDD_r93 physCellId_r9 = 393 utra_FDD_r94 physCellId_r9 = 11 utra_FDD_r95 physCellId_r9 = 35 utra_FDD_r96 physCellId_r9 = 448 utra_FDD_r97 physCellId_r9 = 3 3.1.5UE在3G网络进行呼叫UE读取3G网络系统消息，发起业务请求（CM Sercive Request）;请求中包括业务类型，UE能力和支持的加密类型等等CM service request MORE: 0 LENGTH: 31 LENGTH: 31 LOG_CODE: 713A timeStamp: 16:20:45.832 UMTS NAS Signaling Messages Direction: From UE Length: 14 ChannelType: 5 MessageType: 36 UMTS NAS Signaling Messages: CM service request CM service type Service Type : 0 Ciphering key sequence number key sequence : 1 Mobile station classmark Revision level : 2 - Used by mobile stations supporting R99 or later versions of the protocol ESIND : 1 - ( option is implemented). A5/1 algorithm supported : 0 - (available) RF Power Capability : 7 - reserved PS capability : 1 - (present) SS Screening Indicator : 1(defined in GSM 04.80) SM capability : 1 - Mobile station supports mobile terminated point to point SMS VBS notification reception : 0 - no VBS capability or no notifications wanted VGCS notificationr eception : 0 - no VGCS capability or no notifications wanted 0 - The MS does not support the extension band G1 in addition to the primary GSM bandClassmark 3(CM3) : 1 - The MS supports options that are indicated in classmark 3 IE LCSVA capability : 1 UCS2 : 0 - the ME has a preference for the default alphabet over UCS2 SoLSA : 0 - The ME does not support SoLSA CMSP : 1 - Network initiated MO CM connection request supported for at least one CM protocol A5/3 algorithm supported : 1 - (not available) A5/2 algorithm supported : 0 - (available) Mobile identity Type of identity : 4 - TMSI/P-TMSI Odd/even indication : 0 Identity digits : 0x03C3239B3.1.6. RAU和RAB建立在3G网络进行RAU（ROUTING AREA UPDATE REQUEST），无线承载建立请求（RadioBearerSetupComplete），为UE分配无线资源 RadioBearerSetupComplete MORE: 0 LENGTH: 26 LENGTH: 26 LOG_CODE: 412F timeStamp: 16:20:47.026 RRC: UL_DCCH integrityCheckInfo messageAuthenticationCode = 32, 0xB6 0x11 0x69 0x93 rrc_MessageSequenceNumber = 2 message radioBearerSetupComplete rrc_TransactionIdentifier = 0 start_Value = 20, 0x00 0x00 0110xxxx count_C_ActivationTime = 2083.1.7. 振铃（Alerting）在3G网络无线资源分配完成后，网络发振铃消息给UE3.1.8.接通（Connect）被叫摘机，链路连通主，被开始通话 3.1.9.挂机（Disconnect）结束通话后主呼挂机，上发拆链消息（Disconnect）， 下（上）行 RRC释放后，通话结束；在E_nodeB下发的RRCConnectionRelease消息中指出了，UE返回4G中心频率(1650)RRCConnectionRelease MORE: 0 LENGTH: 27 LENGTH: 27 LOG_CODE: 412F timeStamp: 16:21:10.142 RRC: DL_DCCH integrityCheckInfo messageAuthenticationCode = 32, 0x8D 0xAB 0xEB 0x8C rrc_MessageSequenceNumber = 1 message rrcConnectionRelease r3 rrcConnectionRelease_r3 rrc_TransactionIden