1【测试目的】
CCCH mapped to UL SCH/ DL-SCH / Reserved Logical Channel ID
主要测试的是 CCCH映射到UL-SCH, DL-SCH 和保留LCID的功能.
CCCH 映射到UL-SCH : RRC connection request
CCCH 映射到DL-SCH: RRC connection setup
CCCH 映射到保留LCID :01011 to 11011
2【测试条件】
LTE Rel8 and UEs supporting E-UTRA
3【PASS LOG 信令流程一览】
4【测试流程】
(1)
with { UE in E-UTRA RRC_IDLE state and after transmitting a RRCConnectionRequest message }
ensure that {
when { UE receives a MAC PDU on DL SCH and addressed to its T-CRNTI but including a reserved value for LCID }
then { UE discards the MAC PDU }
}
(2)
with { UE in E-UTRA RRC_IDLE state and after transmitting a RRCConnectionRequest message }
ensure that {
when { UE receives a MAC PDU on DL SCH and addressed to its T-CRNTI with value ‘00000’B as LCID }
then { UE forwards to upper layers the disassembled and demultiplexed SDU on logical channel CCCH }
}
Table 7.1.1.1.3.2-1: Main behaviour
|
St
|
Procedure
|
Message Sequence
|
TP
|
Verdict
|
UE log and comments
|
|
|
|
U - S
|
Message
|
|
|
|
|
|
EXCEPTION: Steps 1 to 4 shall be repeated for decreasing reserved LCID values from 01011 to 11011.
|
-
|
-
|
-
|
-
|
这里需要注意 step1-step4是一个循环的过程，意思就是说从01011(11) – 11011(27), 一共要有17个循环, 每个循环都会有paging.
【注意】：从LTER12甚至R13版本，对该描述一直都是01011 to 11011. 但是从LTE R10开始，11011已经被用于Activation/Deactivation。所以我认为协议应该对此做版本的区分，R9之前从01011到11011. R10之后从01011到11010
|
|
1
|
The SS transmits a Paging message including a matched identity.
|
<--
|
-
|
-
|
-
|
2017 Jan 9 08:04:14.309 [62] 0xB0C0 LTE RRC OTA Packet -- PCCH / Paging
Radio Bearer ID = 0, Physical Cell ID = 0
Freq = 300
SysFrameNum = 717, SubFrameNum = 9
PDU Number = PCCH Message, Msg Length = 7
SIB Mask in SI = 0x00
value PCCH-Message ::=
{
message c1 : paging :
{
pagingRecordList
{
{
ue-Identity s-TMSI :
{
mmec '00000001'B,
m-TMSI '11000010 00110100 01010110 01111000'B
},
cn-Domain ps
}
}
}
}
|
|
2
|
The UE transmits an RRCConnectionRequest message.
|
-->
|
-
|
-
|
-
|
2017 Jan 9 08:04:14.311 [32] 0xB0C0 LTE RRC OTA Packet -- UL_CCCH / RRCConnectionRequest
Radio Bearer ID = 0, Physical Cell ID = 0
Freq = 300
SysFrameNum = N/A, SubFrameNum = 0
PDU Number = UL_CCCH Message, Msg Length = 6
SIB Mask in SI = 0x00
value UL-CCCH-Message ::=
{
message c1 : rrcConnectionRequest :
{
criticalExtensions rrcConnectionRequest-r8 :
{
ue-Identity s-TMSI :
{
mmec '00000001'B,
m-TMSI '11000010 00110100 01010110 01111000'B
},
establishmentCause mt-Access,
spare '0'B
}
}
}
|
|
3
|
The SS Transmits a valid MAC PDU containing RRCConnectionSetup, and Contention Resolution Identity MAC Control Elementexcept for LCID in MAC Header set to reserved value 11011 or lower (depending on iteration number).
|
<--
|
MAC PDU
|
-
|
-
|
// RRC connection request 触发竞争性随机接入, Msg4里只含有CRI，没有RRC connection setup
2017 Jan 9 08:04:14.367 [2A] 0xB063 LTE MAC DL Transport Block
SubPacket - ( DL Transport Block Subpacket )
---------------------------------------------------------------------------------
| | | | | | | | | |
| | | |DL TBS |RLC |HDR | | | |
|SFN |Sub-FN|RNTI Type |(bytes)|PDUs|LEN |Mac Hdr + CE |LC ID|LEN |
---------------------------------------------------------------------------------
| 723| 7| T-C-RNTI| 7| 0| 7| 1C 40 1C 23 45 67 84 |CRID | 6|
2017 Jan 9 08:04:14.365 [18] 0xB16A LTE Contention Resolution Message (MSG4) Report
Version = 1
SFN = 723
Sub-fn = 7
Contention Result = Pass
UL ACK Timing SFN = 724
UL ACK Timing Sub-fn = 1
// LCID = 11, 即使该LCID里的数据是RRC connection setup. UE也不做解析，直接丢弃
2017 Jan 9 08:04:14.467 [CC] 0xB063 LTE MAC DL Transport Block
SubPacket - ( DL Transport Block Subpacket )
---------------------------------------------------------------------------------
| | | | | | | | | |
| | | |DL TBS |RLC |HDR | | | |
|SFN |Sub-FN|RNTI Type |(bytes)|PDUs|LEN |Mac Hdr + CE |LC ID|LEN |
---------------------------------------------------------------------------------
| 729| 2| C-RNTI| 26| 0| 1| 0B | 11| -1|
|
|
|
EXCEPTION: In parallel with step 4, UE may execute parallel behaviour defined in table 7.1.1.1.3.2-2
|
-
|
-
|
-
|
-
|
|
|
4
|
Check: For 5 seconds after Step3, does the UE transmit RRCConnectionSetupComplete message?
|
-->
|
RRCConnectionSetupComplete
|
1
|
F
|
// T300 (1000ms) expire
2017 Jan 9 08:04:15.311 [3D] 0x1FFB Event -- EVENT_LTE_RRC_TIMER_STATUS
Payload String = Timer Name = T300, Timer Value = 0, Timer State = Expire
// RRC 状态变为 Idle camped
2017 Jan 9 08:04:15.312 [3D] 0x1FFB Event -- EVENT_LTE_RRC_STATE_CHANGE
Payload String = RRC State = Idle Camped
|
|
5
|
The SS transmits a Paging message including a matched identity.
|
<--
|
-
|
-
|
-
|
2017 Jan 9 08:06:03.108 [CA] 0xB0C0 LTE RRC OTA Packet -- PCCH / Paging
|
|
6
|
The UE transmits an RRCConnectionRequest message.
|
-->
|
-
|
-
|
-
|
2017 Jan 9 08:06:03.109 [24] 0xB0C0 LTE RRC OTA Packet -- UL_CCCH / RRCConnectionRequest
|
|
7
|
The SS transmits a valid MAC PDU containing RRCConnectionSetup, and Contention Resolution Identity MAC Control Element and LCID in MAC Header set correctly to CCCH 00000
|
<--
|
MAC PDU
|
-
|
-
|
// LCID = 0, this LCID is valid. So UE will decode this MAC DL PDU.
2017 Jan 9 08:06:03.286 [4F] 0xB063 LTE MAC DL Transport Block
SubPacket - ( DL Transport Block Subpacket )
---------------------------------------------------------------------------------
| | | | | | | | | |
| | | |DL TBS |RLC |HDR | | |
|SFN |Sub-FN|RNTI Type |(bytes)|PDUs|LEN |Mac Hdr + CE |LC ID|LEN |
---------------------------------------------------------------------------------
| 349| 9| C-RNTI| 26| 1| 1| 00 | 0| -1|
// UE receive the RRC connection setup
2017 Jan 9 08:06:03.267 [10] 0xB0C0 LTE RRC OTA Packet -- DL_CCCH / RRCConnectionSetup
|
|
8
|
Check: does the UE transmit an RRCConnectionSetupComplete message including SERVICE REQUEST message?
|
-->
|
RRCConnectionSetupComplete
|
2
|
P
|
P
2017 Jan 9 08:06:03.272 [7E] 0xB0C0 LTE RRC OTA Packet -- UL_DCCH / RRCConnectionSetupComplete
|
|
9-12
|
Steps 6 to 9 of the generic radio bearer establishment procedure (TS 36.508 4.5.3.3-1) are executed to successfully complete the service request procedure.
|
-
|
-
|
-
|
-
|
-
|
【问题1】Paging 中的S-TMSI 是哪来的？UE怎么知道寻呼的是自己呢？
【答】：(1) paging ID 有两种，一种是S-TMSI, 代表此意寻呼是一次正常的寻呼，一种是IMSI，表明本次寻呼是一次异常寻呼，用于网络侧的错误恢复，此种情况下UE
需要重新做一次附着(Attach)流程。
(2) 实际上Paging 中的S-TMSI是在UE Attach request 中带的，如果Paging中的S-TMSI 和UE发送的Attach request中的S-TMSI一致，则认为该寻呼是对本UE的寻呼。
(3) S-TMSI 由mme code(1个字节) + M-TMSI(4个字节)组成。
(4) IMSI 有MCC+MNC+MSIN 组成
2017 Jan 9 08:04:00.002 [CA] 0xB0ED LTE NAS EMM Plain OTA Outgoing Message -- Attach request Msg
prot_disc = 7 (0x7) (EPS mobility management messages)
msg_type = 65 (0x41) (Attach request)
lte_emm_msg
emm_attach_request
tsc = 0 (0x0) (cached sec context)
nas_key_set_id = 0 (0x0)
att_type = 2 (0x2) (combined EPS/IMSI attach)
eps_mob_id
id_type = 6 (0x6) (GUTI)
odd_even_ind = 0 (0x0)
Guti_1111 = 15 (0xf)
mcc_1 = 0 (0x0)
mcc_2 = 0 (0x0)
mcc_3 = 1 (0x1)
mnc_3 = 15 (0xf)
mnc_1 = 0 (0x0)
mnc_2 = 1 (0x1)
MME_group_id = 32769 (0x8001)
MME_code = 1 (0x1)
m_tmsi = 3258209912 (0xc2345678)
【问题2】如果Paging 中Paging ID是IMSI，请问eNB又是如何得到的呢？
【答】UE在初始接入的时候，UE 会在attach request 里携带IMSI.??
【问题3】RRC connection request里的原因是mt-Access, 这是什么意思，都有哪些建立原因?
【答】根据TS36.331,有如下几个原因
(1) Emergency 拨打紧急号码
(2) highpriorityAccess 高优先级接入
(3) mt-Access 被叫接入
(4) mo-Signalling 主叫发送信令
(5) mo-Data 发送数据
(6) delayTolerantAccess
【问题4】怎么知道UE所支持的LTE的release 版本信息呢？
【答】可以查看UE capability, UE 会上报自己支持的LTE release 信息，如下所示：
2017 Jan 9 08:04:00.553 [57] 0xB0C0 LTE RRC OTA Packet -- UL_DCCH / UECapabilityInformation
value UE-EUTRA-Capability ::=
{
accessStratumRelease rel10, // LTE Rel10
ue-Category 4,
【参考】
1. RRC connection request 原因：http://blog.sina.com.cn/s/blog_746b60460102uy8c.html
2. LTE UE ID介绍：http://wenku.baidu.com/link?url=wNxN-U0VDvr7o5mDxddqcIHLXepihxsLM_UR2WVIrpobKsdQcvxA2DmP8RmWj5H5BCX9C7_5DnZWmc6c3NnlCjmsDfxaYGKTl6TZC6rPSSS
