TAU失败导致UE无法正常使用4G网络

1、TAU失败导致UE无法正常使用4G网络1 问题现象用户为CSFB手机，在1月6日18点左右由4G网络掉至3G网络，并且在一天内跨越多个位置区，经过22小时的时间内一直无法回到4G网络，直到1月7日16点左右进行重新开关机后才回到4G网络。2 信令分析2.1 S1-MME信令通过信令跟踪平台S1-MME信令分析，发现用户在2016-1-6 17:51:34进行了一次CSFB业务，并在完成业务后返回4G网络发起连续5次TAU，之后就没有4G侧信令，直至2016-1-7 16:10:06间隔22小时后重新在4G网络发起Attach，并在4G网络正常驻留。2.2 SGs信令分析SGs信令，发现用户在2

2、016-1-6 17:52:00发起TAU的同时连续发起了5次联合位置更新，并且都失败，失败原因码为22，之后就没有信令，直至2016-1-7 16:10:07重新发起联合位置更新，并成功。2.3 CSFB信令分析CSFB侧信令，用户在挂机前发起了一个短信流程，导致用户挂机后系统没有发送clear command命令，UE无法进行FR；在后续进行的短信流程中，首先由UE向网络侧发起了一次主动短信流程，在网络侧等待CP-ACK的过程中，网络侧又向UE发送了一条短信，但未得到UE的响应，此后UE发起了一次CP-ACK，在完成后释放资源进入空闲态，并重选至4G网络进行联合位置更新2G网络侧此时由于短

3、信流程还未完成，认为UE还在2G网络中，并在随后对UE发起了1次被叫通话及被叫短信业务，但均为成功；UE在4G最后一次联合位置更新发生2016-01-06 17:52:40，早于2G网络侧下发clear command命令的时间2016-01-06 17:52:43，相当于UE在回到4G进行联合位置更新的同时，2G侧网络认为业务流程还未完成，导致连续5次联合位置更新失败正常短信流程，UE在回应CP-ACK后返回空闲态系统最后在定时器超时后下发clear command命令，命令中所携带的原因值为Radio interface failure，相当于系统判断由于得不到UE回应而导致的一次异常释放

4、。3 问题分析3.1 失败原因值分析通过3GPP TS 24.301协议分析原因码22的解释如下，该问题主要由MME问题导致。协议描述：Cause #22 CongestionThis EMM cause is sent to the UE because of congestion in the network (e.g. no channel, facility busy/congested etc.)3.2 失败处理流程分析发生该问题后的处理策略，协议描述如下，一共尝试5次TAU请求，每次间隔为T3411（10s），当达到5次后，根据终端类型是CS/PS mode 1还是CS/PS mo

5、de 2进行不同的流程。如果终端是是CS/PS mode 1，并且不支持IMS voice，终端将选至2G/3G网络，并关闭4G网络功能，保证语音业务。如果终端是CS/PS mode 2，终端等待T3402（12min），然后重新发起联合TA/LA更新。协议描述：Combined tracking area updating successful for EPS services only#22(Congestion)The UE shall stop timer T3430 if still running. The tracking area updating attempt counte

6、r shall be incremented, unless it was already set to 5.If the tracking area updating attempt counter is less than 5:-the UE shall start timer T3411, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM. When timer T3411 expires the combined trac

7、king area updating procedure indicating "combined TA/LA updating with IMSI attach" is triggered again.If the tracking area updating attempt counter is equal to 5:-a UE operating in CS/PS mode 2 of operation shall start timer T3402, shall set the EPS update status to EU1 UPDATED and shall e

8、nter state EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM. When timer T3402 expires the combined tracking area updating procedure indicating "combined TA/LA updating with IMSI attach" is triggered again;-a UE operating in CS/PS mode 1 of operation with "IMS voice not available" shall att

9、empt to select GERAN or UTRAN radio access technology and proceed with appropriate MM or GMM specific procedures. The UE shall disable the E-UTRA capability (see subclause 4.5). If the UE is in the EMM-CONNECTED mode, the UE shall locally release the established NAS signalling connection and en

10、ter the EMM-IDLE mode before selecting GERAN or UTRAN radio access technology.TIMER NUM.TIMER VALUESTATECAUSE OF STARTNORMAL STOPON EXPIRYT341110sEMM-DEREGISTERED. ATTEMPTING-TO-ATTACHEMM-REGISTERED. ATTEMPTING-TO-UPDATEAt attach failure due to lower layer failure, T3410 timeout or attach rejected w

11、ith other EMM cause values than those treated in subclause 5.5.1.2.5.At tracking area updating failure due to lower layer failure, T3430 timeout or TAU rejected with other EMM cause values than those treated in subclause 5.5.3.2.5.ATTACH REQUEST sentTRACKING AREA UPDATE REQUEST sentRetrans

12、mission of the ATTACH REQUEST or TRACKING AREA UPDATE REQUESTT343015sEMM-TRACKING-AREA-UPDATING-INITIATEDTRACKING AREA UPDATE REQUEST sentTRACKING AREA UPDATE ACCEPT receivedTRACKING AREA UPDATE REJECT receivedStart T3411 or T3402 as described in subclause 5.5.3.2.6T3402Default 12 min.NOTE 

13、;1EMM-DEREGISTEREDEMM-REGISTEREDAt attach failure and the attempt counter is equal to 5.At tracking area updating failure and the attempt counter is equal to 5.ATTACH REQUEST sentTRACKING AREA UPDATE REQUEST sentInitiation of the attach procedure or TAU procedure3.3 终端模式分析协议中关于终端模式的描述如下，目前UE的工作模式主要有

14、4种：PS mode 1 、PS mode 2、CS/PS mode 1、CS/PS mode 2，CS fallback终端工作在CS/PS mode 1、CS/PS mode 2，其主要区别在于CS/PS mode 1是语音优先（voice centric）、CS/PS mode 2是数据优先（data centric）。根据协议，voice centric的终端，必须支持voice功能，如果注册到的LTE网络不支持CSFB，以及IMS等语音业务，那么终端应该关闭LTE的功能，重选回落2G/3G网络，用以保证语音业务使用。如果LTE网络支持CSFB/IMS语音业务，那么可以继续停留在LTE

15、网络上。data centric的终端，如果注册到的LTE网络，既不支持CSFB，也不支持IMS业务，可以继续驻留在LTE网络。协议描述：A UE attached for EPS services shalloperate in one of the following operation modes:-PS mode 1 of operation: the UE registers only to EPS services, and UE's usage setting is "voice centric"-PS mode 2 of operation: the

16、 UE registers only to EPS services, and UE's usage setting is "data centric" or the UE has no CS voice capability;-CS/PS mode 1 of operation: the UE registers to both EPS and non-EPS services, and UE's usage setting is "voice centric" and-CS/PS mode 2 of operation: the UE

17、 registers to both EPS and non-EPS services, and UE's usage setting is "data centric" or the UE has no CS voice capability.A UE configured to use CS fallback, shall operate in CS/PS mode 1 or CS/PS mode 2. Such UE may also be configured to use IMS, in which case the voice domain prefer

18、ence as defined in 3GPP TS 24.167 13B shall be used for the selection of the domain for originating voice communication services.A UE configured to use SMS over SGs, but not configured to use CS fallback, shall operate in CS/PS mode 1 or CS/PS mode 2.The behaviour of the UE in CS/PS m

19、ode 1 of operation, upon failure to access the CS domain, will depend on the availability of voice over IMS. In the present document, "IMS voice not available" refers to one of the following conditions:-the UE is not configured to use IMS;-the UE is not configured to use IMS voice, i.e. wh

20、en the voice domain preference, as defined in 3GPP TS 24.167 13B, indicates that voice communication services are allowed to be invoked only over the CS domain;-the UE is configured to use IMS voice, but the network indicates in the ATTACH ACCEPT message or the TRACKING AREA UPDATE AC

21、CEPT message that IMS voice over PS sessions are not supported; or-the UE is configured to use IMS voice, the network indicates in the ATTACH ACCEPT message or the TRACKING AREA UPDATE ACCEPT message that IMS voice over PS sessions are supported, but registration to IMS has failed.当终端发起attach附着请求，或者

22、TAU更新求时，会携带ue_usage_setting参数，说明终端是语音优先（voice centric）还是是数据优先（data centric）。通过信令跟踪平台，用户的终端为voice centric，即CS/PS mode 1，且仅支持CS Voice only，不支持IMS voice。根据协议描述，当发生cause#22的联合位置更新失败时，终端将选至2G/3G网络，并关闭4G网络功能。3.4 返回4G网络方式根据协议描述，当终端关闭4G网络后，只能通过模式改变、开关机、PLMN选网才可以恢复4G功能；因此用户长时间无法从2G/3G返回4G网络，只能通过开关机或飞行模式才能解决。

23、Disabling and re-enabling of UE's E-UTRA capabilityWhen the UE supporting the A/Gb and/or Iu mode together with the S1 mode needs to stay in A/Gb or Iu mode, in order to prevent unwanted handover or cell reselection from UTRAN/GERAN to E-UTRAN, the UE shall disable the E-UTRA capability.-The UE

24、shall not set the E-UTRA support bits of the MS Radio Access capability IE (see 3GPP TS 24.008 13, subclause 10.5.5.12a), the E-UTRA support bits of Mobile Station Classmark 3 IE (see 3GPP TS 24.008 13, subclause 10.5.1.7) and the ISR support bit of the MS net

25、work capability IE (see 3GPP TS 24.008 13, subclause 10.5.5.12) in the ATTACH REQUEST message and the ROUTING AREA UPDATE REQUEST message after it selects GERAN or UTRAN; and-the UE NAS layer shall indicate the access stratum layer(s) of disabling of the E-UTRA capability.The UE

26、shall enable the E-UTRA capability again in the following cases:- the UE mode of operation changes from CS/PS mode 1 of operation to CS/PS mode 2 of operation;-the UE mode of operation changes from PS mode 1 of operation to PS mode 2 of operation;-the UE powers off and powers on again; or- for the PLMN sel