VoLTE Fundamentals and Initial Tuning

Private & Confidential

INDEX

What is VoLTE?

VoLTE architecture

What is IMS

What is SIP

VoLTE Call Flow

VoLTE Call flow in Layer 3

VoLTE negative event test cases

Effect of RRC drop on VoLTE call

Private & Confidential

VoLTE Architecture overview

Private & Confidential

VoLTE Architecture and functionality (Ericsson)

Private & Confidential

 IMS Nodes

Proxy CSCF (P-CSCF) Interrogating CSCF (I-CSCF) Serving CSCF (S-CSCF)

 First contact point for the UE  First contact point of another  Loads IMS User Profiles from the
operator‘s network. HSS
 Forwarding of SIP messages
 Queries HSS to Assign of S-CSCFs  Performs the IMS User
 Generation of Charging CDRs to SIP registering UE Authentication

 Integrity and Confidentiality  Forwarding of SIP  Performs Session & Service (AS)
Protection Support request/response to SCSCF control

 QoS Authorization Support  Generation of Charging CDRs  Always located in Home n/w
Address Translation
 SIP Header Compression using  Topology Hiding Support upto R6.
SigComp R7 onwards  Generation of Charging CDRs

 done by IBCF  Lawful Interception Support

Private & Confidential

VoLTE Architecture and functionality (Nokia)

Private & Confidential

 Media Servers (Nokia)

Media servers
The Media Resource Function (MRF) provides media related functions such as media manipulation (e.g. voice stream
mixing) and playing of tones and announcements.
Each MRF is further divided into a media resource function controller (MRFC) and a media resource function processor
(MRFP).
The MRFC is a signalling plane node that interprets information coming from an AS and S-CSCF to control the MRFP
The MRFP is a media plane node used to mix, source or process media streams. It can also manage access right to shared
resources.
The Media Resource Broker (MRB) is a functional entity that is responsible for both collection of appropriate published
MRF information and supplying of appropriate MRF information to consuming entities such as the AS. MRB can be used
in two modes:
Query mode: AS queries the MRB for media and sets up the call using the response of MRB
In-Line Mode: AS sends a SIP INVITE to the MRB. The MRB sets up the call

Breakout gateway
A Breakout Gateway Control Function (BGCF) is a SIP proxy which processes requests for routing from an S-CSCF when
the S-CSCF has determined that the session cannot be routed using DNS or ENUM/DNS. It includes routing functionality
based on telephone numbers.

Private & Confidential

 What Is IMS?

IMS is an architectural framework that converges the Telecom and Internet environment. It was designed to:
Deliver IP based services in mobile telephony systems
Deliver multimedia services over IP

To overcome the challenges of integrating legacy mobile networks with internet, IMS uses following protocols:

 IETF (Internet Engineering Task Force) protocols: One example of IETF is Session Initiation Protocol (SIP), which is
used for exchanging signaling messages.
 Real-time Transport Protocol (RTP): used for delivering audios and videos over IP.

The main drivers of IMS in today’s telecom environment

are :
 Voice Over LTE
 PSTN modernization -multimedia telephony over IP
 Fixed Mobile Convergence
 Rich Communication Suite enhanced, enriched
communication services for mobile (and fixed) users
 VISUALCOM –a standardized platform for the next
generation video communication and video
conferencing

Private & Confidential

IMS Architecture

Private & Confidential

IMS Architecture (Layered)

Private & Confidential

VoLTE Call Flow (Attach to Termination)

Private & Confidential

 Radio Bearers in VoLTE

An IMS UE will have two bearers allocated all the time

• The default bearer to Internet APN (QCI=9) (non-GBR RLC-AM)
• The default bearer to IMS APN (QCI=5) (non-GBR RLC-AM)
During a VoLTE call a third bearer will be activated (QCI=1)
• QCI1 is a dedicated bearer to the IMS APN (GBR RLC-UM)

 Voice media should always be mapped to a separate EPS bearer as it has GBR (Guaranteed Bit Rate). SIP
signaling should also be protected against congestion by being mapped to a separate EPS bearer.

Private & Confidential

 Radio Bearers in VoLTE

INVITE message contains following elements:

 Mobile number of MO and MT UEs

 Cell Global Identity of eNB (CGI is available for MO UE only)
 Unique Call ID of both MO and MT UEs

Private & Confidential

 SIP Signaling

SIP –Session Initiation Protocol, is an application layer signaling protocol used for IMS signaling and runs on TCP, UDP and
SCTP.

A SIP message is either a request from a client to a server, or a response from a server to a client. Message type as
follows:

 Request: A SIP message sent from a client to a server, for initiating a call.
 Response: A SIP message sent from a server to a client, indicating the status of a request sent from the client to the
server.

 REGISTER: Used by a UA to indicate its current IP address and the URLs for which it would like to receive calls.
 INVITE: Used to establish a media session between user agents.
 ACK: Confirms reliable message exchanges.
 CANCEL: Terminates a pending request.
 BYE: Terminates a session between two users in a conference.
 PRACK (Provisional Response Acknowledgement): PRACK improves network reliability by adding an
acknowledgement system to the provisional Responses (1xx).

Private & Confidential

 SIP Signaling Message Response Type

 1xx: Provisional --request received, continuing to process the request

 2xx: Success --the action was successfully received, understood, and accepted;

 3xx: Redirection --further action needs to be taken in order to complete the request

 4xx: Client Error --the request contains bad syntax or cannot be fulfilled at this server

 5xx: Server Error --the server failed to fulfill an apparently valid request;

 6xx: Global Failure --the request cannot be fulfilled at any server.

Private & Confidential

 Attach Session Signaling Flow

HSS

Update
Update Location
Authentication
Authentication Answer
Information
Location Request
• UE
Answer AMBR
Information
• IMSI Request
••• APN (default),
E-UTRAN
IMSI AMBR, QCI
Authentication vector
• APN, AMBR,
(KASME, RAND, QCIAUTN, and
• APN, AMBR, QCI
XRES)
MME
AttachAccept
Attach
Security
Attach Request
Authentication
Complete command
mode complete
•Request Create Session Response
PDN address (IP)algorithm
IMSI
EPS
• Responseciphering
/ GUTI
• PDNSession
Create
Modify Bearer Request
addressResponse
(IP)
Request
• • AMBR
IMEI
EPS
RAND
RES integrity
and
andQCI
AUTNalgorithm
• • PCO
UE capability •• APN,
QCI, S1u
eNB AMBR,
AMBR ARPPDN type
and
IP, teid
with DNS
•• MME
PCO with DNS
S11 teid
• SGW S11 & S1u teids
InitialContextSetup
initialUEMessage
downlinkNASTransport
uplinkNASTransport
uplinkNASTransport
downlinkNASTransport
UE eNodeB InitialContextSetupResponse
uplinkNASTransport SGW PGW
• • TACAMBR
••• Cell
eNB id
S1u IP, TAC
Bearer and
teid
AMBR, QCI, ARP
RRC • SGW S1u IP, teid
RRC
RRC
RRC

Create
Create Session
Session Response
Request
• PDN address (IP)
• APN, AMBR and PDN type
Default Bearer •
• QCI, AMBR, ARP
SGW S5 teid
• PCO with DNS
• PGW S5 teid

Private & Confidential

 Detailed Attach Session Signaling Flow

1. The UE initiates the Attach procedure by sending an Attach Request message, including the IMSI, IMEI, or the GUTI .
If the UE identifies itself to the MME with an unknown GUTI, the MME sends the Identity Request message to the
UE. The UE sends an Identity Response message with IMSI information.

2. The Mobility Management Entity (MME) receives the authentication vectors which contain K ASME, RAND, AUTN, and
XRES from the HSS
The MME sends Authentication Request containing the authentication parameters RAND and AUTN.
Authentication Response message from the UE containing the calculated RES value. If the RES value is identical to
the XRES value received from the HSS, the authentication is successful.

The MME sends Security Mode Command message containing the selected Non Access Stratum (NAS) security
algorithms and the KSI. When the UE has verified the integrity of the Security Mode Command message, the UE
responds with the integrity protected and encrypted Security Mode Complete message and all NAS messages
exchanged between the UE and the MME are integrity protected and ciphered using the selected security
algorithms.

3. MME sends an Update Location Request message to the Home Subscriber Server (HSS) to inform it about the
identity of the MME currently serving the user and to get subscription data. For an unauthenticated UE requesting an
emergency-attach, no Update Location Request message is sent to the HSS. The HSS sends an Update Location
Answer message to the MME to update the MME subscription data. The MME validates the data and sets up a
context for the UE.

4. Depending on the TAC provided by the eNB and the APN the MME will query the DNS to find the best SGW and PGW
match and sends a Create Session Request message to the PGW through the SGW. The request message includes

Private & Confidential

 Detailed Attach Session Signaling Flow

the International Mobile Subscriber Identity (IMSI) of the UE, an APN, and QoS parameters, as well as the Tunnel
Endpoint Identifier (TEID) of the MME for signaling traffic.
The PGW creates a new entry in the EPS bearer context table. After negotiating with the Policy and Charging Rules
Function (PCRF), the PGW sends a Create Session Response message to the MME through the SGW.

5. The Initial Context Setup Request message contains an Attach Accept message, which is forwarded to the UE. This
message contains the Tunnel Endpoint Identifier (TEID) and the IP address of the SGW for user-plane traffic. A new
GUTI is allocated.
The eNodeB sends the Initial Context Setup Response message to the MME, after the bearers towards the UE are set
up. This message contains the TEID and the IP address of the eNodeB for user-plane traffic.

6. The UE sends the Attach Complete message through the eNodeB to the MME.

7. The MME sends a Modify Bearer Request message to the SGW, containing the TEID of the eNodeB and the IP
address of the eNodeB.
The SGW acknowledges the request by sending the Modify Bearer Response message to the MME.

Private & Confidential

 Activation Of IMS Default Bearer

MME
Activate default EPS bearer context accept
request
Create
Modify SessionResponse
Response
• APN=“ims” ModifyBearer
Bearer Request
• Create Session
PDN address (IP)Request
• PDN
PDN address connectivity request
(IP) • eNB S1u IP, teid
• • QCI,
APN=“ims”,
AMBR, ARP AMBR and
• AMBR, QCI• and more QoS parameters
APN=“ims”
PDN type
• PCO with DNS and P-CSCF
• PCO with DNS and P-CSCF
• SGW
SGW S11
S11 teid teids Create Session Response
& S1u
• Create Session
PDN address Request
(IP)
UE eNodeB uplinkNASTransport
SGW • • QCI,APN=“ims”,
AMBR, ARP AMBR and PGW
E-RABSetupResponse
E-RABSetupRequest
•• eNB
Cell id and TAC • PCOPDNwith
typeDNS and P-CSCF
AMBR S1u teid and ip
• • PGW
SGWS5S5teid
teid
RRC
RRC
RRC • SGW S1u teid and ip

Default Bearer (internet)

Default Bearer (APN = “ims”)

SIP message SIP message

According to GSMA IR.92, the IMS default bearer should not be the first default
bearer setup during attach

According to GSMA IR.88, the APN name for the IMS default bearer must be “ims”
which will be requested by the UE after attach

Private & Confidential

 Activation Of Default IMS Bearer

MME
Activate default EPS bearer context accept
request
Create
Modify SessionResponse
Response
• APN=“ims” ModifyBearer
Bearer Request
• Create Session
PDN address (IP)Request
• PDN
PDN address connectivity request
(IP) • eNB S1u IP, teid
• • QCI,
APN=“ims”,
AMBR, ARP AMBR and
• AMBR, QCI• and more QoS parameters
APN=“ims”
• PCOPDN type
with DNS and P-CSCF
• PCO with DNS and P-CSCF
• SGW
SGW S11
S11 teid teids Create Session Response
& S1u
• Create Session
PDN address Request
(IP)
UE eNodeB uplinkNASTransport
SGW • • QCI,APN=“ims”,
AMBR, ARP AMBR and PGW
E-RABSetupResponse
E-RABSetupRequest
•• eNB
Cell id and TAC • PCOPDNwith
typeDNS and P-CSCF
AMBR S1u teid and ip
• • PGW
SGWS5S5teid
teid
RRC
RRC
RRC • SGW S1u teid and ip

Default Bearer (internet)

Default Bearer (APN = “ims”)

SIP message SIP message

According to GSMA IR.92, the IMS default bearer should not be the first default
bearer setup during attach

According to GSMA IR.88, the APN name for the IMS default bearer must be “ims”
which will be requested by the UE after attach

Private & Confidential

Default Bearer Setup (QCI 9)

Private & Confidential

Default Bearer Setup (QCI 9)

Private & Confidential

Default Bearer Setup (QCI 5)

Private & Confidential

Default Bearer Setup (QCI 5)

Private & Confidential

Default Bearer Setup (QCI 5)

Private & Confidential

 UE Registration With IMS Network

IMS
UE eNB MME SGW PGW PCRF SBG
CSCF

IMS PDN Connection

Default Bearer QCI = 5. IMS Signaling.

SIP Register

401 Unauthorized (nonce)

SIP Register (with Auth Info)

200 OK

Private & Confidential

 Initial Registration Process

6. Server Assignment
HSS
HSS Request
7. Server Assignment
Register
(Cx)Registration
(Cx)User REGISTER
Authority
Authority
Req/Resp
Rqst 3. User.Auth.
Response
Request
The
The I-CSCF
The
I-CSCF
The HSS IMS
P-CSCF forwards
client
requests,
requestperforms
the inthe
and theaRegister
UE
location
the DNS
HSS of 4. User. Auth
query
informs
sends message
the S-CSCFtoalocate
the tothe
I-CSCF
- and
register the aS-CSCF
ifI-CSCF
of S-CSCF
either
message (home
the
is
to Answer
not (Cx)
location
network Server
allocated, ofentry
the Assignment
theuser
HSS
point).(which
willThe
inform
S- 5. REGISTER
the IP address
Request/Response
which was I-CSCF S-CSCF
CSCF)
Register
the I-CSCF.
or sufficient
messageThe information
I-CSCF
is forwarded
will to I-CSCF S-CSCF
The obtained
S-CSCF at
informs P-CSCF
theaHSS that
allow theselect
towards
I-CSCF a S-CSCF.
select
I-CSCF. S-CSCF 8. 200
it is the Discovery.
S-CSCF for that
9. 200 2. REGISTER
subscriber, 200 andOK requests user
data.
The S-CSCF indicates that
HSS returns user data P-CSCF
registration was successful with P-CSCF
the 200 OK message 10. 200 1. REGISTER

Note: Service, Security and SLF Aspects Not shown

Private & Confidential

After Registration Process

HSS
HSS
HSS
The HSS remembers where the S-
CSCF for the user is

S-CSCF
I-CSCF
I-CSCF S-CSCF
S-CSCF
The S-CSCF remembers the user
profile of the user, including the
service triggers

I-CSCF
P-CSCF
P-CSCF
The I-CSCF does not remember
anything

P-CSCF
The P-CSCF remembers how to
route the SIP signaling to the S-
CSCF of the user

Private & Confidential

 IMS Registration

After registration, IMS nodes are equipped with following information:

P-CSCF Public User ID
UE IP Address
S-CSCF name/address

S-CSCF Public User ID

UE IP Address and Port
User Service Profile
HSS
P-CSCF name/address

HSS S-CSCF

 The P-CSCF now knows the user’s public id and IP address. It has also received information about the S-CSCF in the
Service-Route header of the response to the REGISTER.
 The S-CSCF has user information, such as the user’s service profile, downloaded from HSS, and the user’s current
address. It also has the HSS name, if there happened to be more than one, and the P-CSCF name or address, received
in the path header of the REGISTER message.
 The HSS has saved the S-CSCF where the user is currently registered, in the user profile.

Private & Confidential

 Messages of UE Registration With IMS

• UE attempts to register with IMS

server.

• The server responds back with a

challenge in the form 401
Unauthorized Message

• UE responds to the challenge

with another REGISTER message
along with the credentials

• Once IMS server receives these

user credentials its responds
with status 200 OK marking
successful registration, and UE is
successfully registered.

UE IMSI

Private & Confidential

 End To End IMS Flow

HLR /
Location HSS

query
Signaling

IBCF
TAS S-CSCF I-CSCF S-CSCF TAS

ENUM

Media
IMS RTP IMS P-CSCF
P-CSCF TrGW AGW
AGW

EPC EPC

SIP (INVITE)

LTE LTE

Originating network Terminating network

Private & Confidential

 SIP Call Initiation Flow

IMS
UE eNB MME SGW PGW PCRF SBG CSCF

IMS PDN Connection

Default Bearer QCI = 5. IMS Signaling.

SIP Invite

183 Session Progress

Dedicated Bearer QCI = 1 Interactive Voice.

Application/Service Info

IP-CAN Session Modify

Create Bearer Req.
Create Bearer Req.

Bearer Setup Req

RRC Conn. Reconfig Session Mgmt Req

Session Mgmt Resp.

Create Bearer Resp.
Create Bearer Resp.

IP-CAN Session Modify ACK

Private & Confidential

 Dedicated Voice Bearer Setup

PCRF

MME
Application/Service Info
Create
Create Bearer
Bearer
Re-Auth Request
Response
Request
Re-Auth Answer
request
Activate dedicated EPS bearer context accept ••(Charging-Rule-Install)
QCI=1
eNB and(Voice)
SGW S1u teid
• •• MBR & (Voice)
GBR (DL & UL)
QCI=1 (Voice) QCI=1 SBG/CSCF
• MBR & GBR (DL & UL •• Linked
MBR & GBR& (DL
EBI S1u&teid
UL)
• New EBI and linked EBI
UE SGW/PGW
eNodeB E-RABSetupRequest
E-RABSetupResponse
UplinkNASTransport
• eNB
QCI=1 (Voice)
S1u teid
RRC • MBR & GBR (DL & UL)
• Teid, E-RAB ID = EBI SGi
S1u

Default Bearer (APN = “ims”)

SIP invite 183 180

Session
200 OKProgress
Ringing

Dedicated Bearer – QCI = 1 (voice)

RTP // Voice
RTP Voice RTP / Voice

Private & Confidential

 IMS Call Answered

IMS
UE eNB MME SGW PGW PCRF SBG CSCF

IMS PDN Connection

Dedicated Bearer QCI = 5. IMS Signaling.

200 OK

Dedicated Bearer QCI = 1 Interactive Voice.

Packet Voice

Private & Confidential

 VoLTE Call Setup

The I-CSCF sends a LIR request

to the HSS for the user
Originating Half-call
identified by the Request-URI.
Terminating Half-call
If PUI (in R-URI) is telephone
number, the S-CSCF makes DNS/ HSS
HSS The HSS uses the PUI
ENUMAt reception of LIA
number normalization and (TEL‑URI) to fetch the
message the INVITE
identity of the S-CSCF to
makes ENUM query to LIR
request is sent to which the called user is
obtain a corresponding SIP terminating S-CSCF. LIA
assigned and returns in a LIA
URI (including destination INVITE INVITE response.
INVITE The S-CSCF determines the
domain). S-CSCF
S-CSCF I-CSCF
I-CSCF S-CSCF
S-CSCF Contact to send the SIP
Makes DNS query to obtain INVITE to. The R-URI is
address of the terminating replaced with the address
INVITE
network (destination stored for the Contact.
The P-CSCF validates
domain) and forwards the registration and forwards the The SIP INVITE is sent to the
request to itsP-CSCF
I-CSCF. messages from the UE to a S- P-CSCF serving the Contact
P-CSCF P-CSCF
P-CSCF
CSCF in the orig. NW. The (Route header is made from
address of S- was obtained at Path headers at registration.)
registration (Service‑Route The P-CSCF sends the SIP
header). INVITE to user B.
INVITE
The UE send SIP INVITE to
INVITE
the allocated P-CSCF (Route
header). R-URI contains PUI
User Aof user B. User B
A
A B
B

Private & Confidential

 VoLTE Call Setup

Originating Half-call Terminating Half-call

DNS/ HSS
HSS
ENUM

S-CSCF
S-CSCF I-CSCF
I-CSCF S-CSCF
S-CSCF
183 183
200 200
183
200
183
200

P-CSCF
P-CSCF P-CSCF
P-CSCF

183
200 Media 183
200

The UE of User B receives the SIP

INVITE and alerts the user and
User A User B responds with an 183 including
A
A B
B an SDP answer

Private & Confidential

 Normal Call Termination/Release Dedicated Bearer

PCRF

MME
Deactivate dedicated EPS bearer context accept Application/Service Info

Deactivate dedicated EPS bearer context request Re-Auth Request

• Re-Auth
Delete Answer
Bearer Request
EBI Delete Bearer Response
(Charging-Rule-Remove SBG/CSCF
• Cause: Deactivation • EBI
UE SGW/PGW
eNodeB E-RABReleaseCommand
UplinkNASTransport
E-RABReleaseResponse
• • E-RAB
E-RABIDID= =EBI
EBI
RRC

S1u SGi

Default Bearer (IMS)

BYE 200 OK

Dedicated Bearer – QCI = 1 (voice)

Private & Confidential

 IMS Call Termination

IMS
UE eNB MME SGW PGW PCRF SBG CSCF

IMS PDN Connection

Default Bearer QCI = 5. IMS Signaling.

BYE
200 OK

Dedicated Bearer QCI = 1 Interactive Voice.

Packet Voice

Application/Service Info

IP-CAN Session Modify

Delete Bearer Req.
Delete Bearer Req.

Deactivate Bearer Req

RRC Conn. Reconfig

Deactivate Bearer Resp.

Delete Bearer Resp.
Delete Bearer Resp.

IP-CAN Session Modify ACK

Private & Confidential

 State After IMS Call Normal Termination

IMS
UE eNB MME SGW PGW PCRF SBG CSCF

IMS PDN Connection

Default Bearer QCI = 5. IMS Signaling.

Private & Confidential

 SIP Message Flow

Call setup

Call conversation

Call termination

Private & Confidential

 VoLTE Call Flow in Layer 3 messages

VoLTE Call attempt from UE (INVITE)

Response from server (100 Trying)

VoLTE radio bearer setup process:

183 session progress: SIP session is
in progress
PRACK: Response from UE
200 OK: Confirmation that SDP is
reserving resources
UPDATE and 200 OK: Resource
availability confirmed, UPDATE sent
to other side for confirmation with
included changes

180 Ringing: User alerted of Call

200 OK: User answered VoLTE call

BYE: VoLTE call Normal

termination/Call end

BYE: VoLTE call Normal

termination/Call end acknowledged

Private & Confidential

 INVITE Message Details

INVITE message contains following elements:

 Mobile number of MO and MT UEs

 Cell Global Identity of eNB (CGI is available for MO UE only)
 Unique Call ID of both MO and MT UEs

Private & Confidential

Dedicated Bearer Setup (QCI 1)

Private & Confidential

Call Setup and Complete Messages

Call setup
successful

Call completion
successful

Call Session Setup Time:

INVITE message to 180 Ringing

Call Setup Completion: 200 OK for BYE

message after the call session setup is
successful

Private & Confidential

Call Flow (With SRVCC)

Private & Confidential

Call Flow (With SRVCC)

Analysis:
1,2,3,4 &5. VoLTE call is normally set up
6. Packets started flowing in UL and DL.
4
7&8. A2 and B2 events are triggered.
9 &10. Again A5 & B2 events are triggered
owing to poor RF conditions.
11&12. SRVCC Handover took place and MO
entered into WCDMA mode.

Private & Confidential

Call Flow (With SRVCC)

8
Private & Confidential
Call Flow (With SRVCC)

10

11

12

Private & Confidential

Case Studies

Private & Confidential

 Multi Target RRC Connection Re-establishment

HOW MULTI TARGET RRC CONNECTION RE-ESTABLISHMENT WORKS:

1. UE detects radio link failure

2. UE selects a new cell ( on same or different frequency) and attempts RRC CONNECTION RE-ESTABLISHMENT
3. UE sends PCI, C-RNTI, short MAC-I of the last serving cell in re-establishment message
4. New cell attempts to fetch UE context from cells having the same PCI through X2 interface
5. If the context fetch is successful, RRC connection re-establishment procedure is completed

For multi target RRC connection re-establishment to be successful neighbor relations must be defined from source to
target cell and vice versa.
Private & Confidential
 Multi Target RRC Connection Re-establishment
(Context fetch timeout ( IFHO NBR not defined)

4
1

2 1

PENDING
5
3 4
4

1. UE is served by cell ILL00012_7B_1 (PCI-367) and attempts HO to PCI 71 When the new cells tries to fetch
which fails. RRC connection Re-establishment complete message does not context from old cell, the old cell is
reach ENB. (not seen in UETR) now aware that UE is no longer
2. UE latches on to a new cell ( 0x338c217 = ILL01138_2B_1) . connected to it, hence it releases
UE dropped on first carrier & latched on to second carrier cell the UE context (#5)
3. UE attempts RRC CONNECTION RE-ESTABLISHMENT (multi target)
4. Context fetch result shows cause as “2” . 2 represents context fetch This will always result in VOLTE
timeout. DROP
This is a case of AT&T, which has 1C & 2C on 700 & 2100 MHz. Neighbor is not
defined from 1C to 2C due to which Re-establishment fails.
Private & Confidential
 MT RRC Re-establishment Workaround

Purpose: improve the performance of Multi Target RRC Connection re-establishment feature

 MT RRC feature does not work if cell relation is missing and result in VoLTE as well as LTE Drop.

 In this case as per Operator strategy (Layer management), Handover is not allowed from 1 st carrier to second carrier
hence there was no frequency relation defined either. So , following solutions were implemented to reduce the
limitation:
 Add 2C Frequency in 1C cells
 Relax the IF ANR parameters
 Increase the neighbor removal time
 Block the neighbor so ANR can not delete it

Parameters Adjusted:
Parameter Value
removeNrelTime 5
anrUesThreshInterFMax 2
anrUesThreshInterFMin 0
a5Threshold1Rsrp (cell level) -112
a5Threshold2Rsrp (cell level) -112
a5Threshold1RsrpAnrDelta (cell level) 10
a5Threshold2RsrpAnrDelta (cell level) 1
IsRemove Allowed FALSE

Private & Confidential

 VoLTE Drop without RRC Drop (Ericsson)
2 3
1

4
1. UE sets up RRC connection (MT-access).
2. VoLTE bearer is established.
3. Event A4 is triggered indicating HO for IFLB, followed by
handover.
4. UE performs HO (RF HO successful)
5 5. 20 sec after HO RRC connection is released due to User
Inactivity.
Private & Confidential
 VoLTE Drop without RRC Drop (Ericsson) Contd.
UETR message 1 1 1

2 2 4

2
Site WIL09113 did not have RLC - UM feature for VoLTE bearer ( QCI 1) activated

UE was served by cell WIL00113_7B_1(PCI 458). Event A4 is triggered for IFLB HO.
3
1.Source cell WIL00113_7B_1 sends “HO Request “ to target cell WIL09113_2B_1
2.Target cell WIL09113_2B_1 accepts two default bearers & does not admit VoLTE
bearer.
3.HO is successful but VoLTE bearer is dropped
4
4.20 sec later, S1 UE context is released due to user inactivity

Private & Confidential

 VoLTE Drop without RRC Drop (Ericsson) Contd.

Typical causes for VoLTE Drop without RRC drop:

 RLC mode mismatch in source & target cell

RLC mode for QCI 1 should be RLC-UM

 PDCP SN length for QCI 1 mismatch in source & target cell

Current Gold Standard for AT&T NW is 12

 RLC SN length for QCI 1 mismatch in source & target cell

Current Gold Standard for AT&T NW is 5

In some cases RLC mode /PDCP / RLC SN length mismatch was observed in configured value & drive layer 3
message.
Site should be locked & unlocked after PDCP/RLC parameter change

Private & Confidential

 RRC Drop Without VoLTE Drop (Ericsson) Contd.
There is an time offset of 6Hrs b/t drive logs & UETR

1
1 1

2 2

3 3

1&2: Dedicated VoLTE bearer is setup with EPS bearer Id:7 & QCI:1
3: UE performs successful HO

Private & Confidential

RRC Drop Without VoLTE Drop (Ericsson) Contd.
New Cell Old Cell

4 6

4. Due to poor RF conditions, RRC ReConfig msg sent by ENB is

4 missed out.
5. Before the old ENB can detect the RLF, UE establishes new RRC
7 connection with 211226.
6. UE requests for all 3 bearers. When MME receives initial
context request , it realizes that UE is no longer connected to
210918. It transfers all the three bearers to new ENB.
7. MME commands old ENB to release all the bearers (as UE is
now connected to new cell)
VolTE call continues as the UE gets back all the three bearers

Private & Confidential

 RRC Drop Without VoLTE Drop (Ericsson) Contd.

Effect of RLF on continuation of VOLTE call:

 RLF can be UE detected or ENB detected

 If the RLF is UE detected & makes a successful RRC connection before MME releases the UE context then
VOLTE call will continue

 If the RLF is ENB detected then ENB will request MME to release the bearers resulting in VoLTE drop.

Private & Confidential

 VoLTE Call Drop Case 1
1

Analysis:
UE initiated MO data call and ended with normal RRC Connection release. In the mean time, some abnormality during BYE
ACK from network was observed.
1,2,3 &4. VoLTE MO data call initiated and setup normally and Packets started flowing in UL and DL direction.

Private & Confidential

 VoLTE Call Drop Case 1

MT

6
7

Analysis
5&6. MO sent BYE message in UL to the network and MT received the same within 300ms.
7&8. MT sent the ACK to IMS after 100ms of receipt of BYE message, but MO received the BYE ACK from IMS after 7s.
(Issue needs to be checked at IMS end.)
9. EPS Bearer deactivated and RRC Connection is released normally.

Private & Confidential

 VoLTE Call Drop Case 1

Healthy RF conditions
Private & Confidential
VoLTE Call Drop Case 2

Analysis:
5 1,2,3,4 &5: VoLTE MO data call
initiated and setup normally.

Private & Confidential

VoLTE Call Drop Case 2

6
MT

10
Analysis:
6. Packets start flowing in UL and DL.
9 7. After that packets were only flowing in UL and MS1 sent BYE
message in UL.
8.After 200ms, MS2 received the BYE message and sent BYE ACK to
MS1 after 100ms.
9. But MS1 received BYE ACK from IMS end after 4s of BYE ACK sent
by MS2.
11
10. In between, TEMS-D triggered MO Session Completion Failure
with Cause “Timeout, BYE ACK Not Received”.
11. EPS bearer deactivated and RRC Connection was released
normally.
Private & Confidential
 VoLTE Call Drop Case 2

Healthy RF conditions

Private & Confidential

 VoLTE Call Drop Case 3

Analysis
1. UE initiates MO data call with SIP invite request.
2. Call in progress is indicated by 183 session progress indicator and EPS bearer is setup for QCI1. Call proceeds normally
with 180 ringing.
3. Packets in UL and DL starts flowing.

Private & Confidential

 VoLTE Call Drop Case 3
4

Analysis
4. UE sent BYE message in UL for the release of QCI 1.
5. Due to poor RF conditions, BYE message could not reach the network. Since, the default bearers are still there, the call proceeds
with the network sending packets in DL.
6. After that, packets were flowing in DL only and no response from UE in UL observed
Private & Confidential
7. After a certain timestamp, Network deactivated the EPS bearer and RRC Connected was released normally.
 VoLTE Call Drop Case 3

RF condition poor to sustain a call

Private & Confidential
 VoLTE Call Drop Case 3

Analysis
1. UE initiates MO data call with SIP invite request.
2. In response, the network sends out 100 trying, Call in progress is indicated by 183 session progress indicator.
3. EPS bearer is setup for QCI1. Call proceeds normally with 180 ringing.
4. Packets started flowing in UL and DL.

Private & Confidential

VoLTE Call Drop Case 3
Analysis
5. RRC Re-establishment request was sent
by UE and due to poor RF condition, request
5 was rejected by network.
6. A new RRC Connection set up and
network started sending packets in DL, but
no response was sent by UE in UL due to
poor RF conditions.
7. After RRC Reconfiguration Complete, UE
6
sent BYE message to network with reason
“Dedicated Bearer Lost”.
8. Packets only in DL are observed and no
response is sent by UE in UL
7 9. Network acknowledged the BYE message
with 200 OK.
8

Private & Confidential

 VoLTE Call Drop Case 3

RF condition poor to sustain a call

Private & Confidential

VoLTE Call Drop Case 4
1

4
5

1,2,3,4,5 &6 Volte MT call initiated and normally set up

Private & Confidential

 VoLTE Call Drop Case 4
7

10

7 &8 Intra cell handover to PCI 21 Intra cell handover to PCI 418.
9.Packet were seen only in uplink . TEMS generate internal event no Audit received
10 After some time Network send a bye message with cause code speech dedicated bearer lost. UE respond with 200 ok and dedicated
bearer is deactivated.
It is to be noted that at MO side MS1 release these session on account of poor radio coverage so essentially it is a N/w initiated release at
MT side
Private & Confidential
 VoLTE Call Drop Case 4

RF condition ok during the call at MT side

Private & Confidential

 Incorrect MCS Leading to VoLTE Drop Case 5
1
1

2
1

3
4

1. UE reports MR for HO
2. Source ENB responds RRC connection reconfiguration. RSRP = -108.2 / SINR = -0.3 dB
3. UE misses the RRC connection reconfiguration message. UE assumes that HO is not initiated & sends multiple MR
for HO.
4. Tx2Relocoverall timer expires ( 5 sec) & UE context is released.
Since the UE context is released, this will always result in VoLTE drop.
SINR was poor but not the kind of SINR that UE would not be able decode the L3 message.
Further investigation was performed on such behavior
Private & Confidential
 Incorrect MCS Leading to VoLTE Drop Case 5

Further investigation revealed that target ENB sent the

RRC connection reconfiguration with a different MCS
(modulation coding scheme)

The UE’s used for drive test was Rel-8, MCS coding
assigned to UE was in accordance with Rel-10

Rel-10 UE’s can decode messages with relative higher

MCS when compared to Rel-8 device for a specific SINR

Hence, higher MCS was assigned RRC reconfiguration

message which the Rel-8 UE could not decode.

Solution
Solution(Ericsson):
(Ericsson): CHICAGO market trend for reference
ENB
ENBsoftware
software was
wasupgraded
upgradedto to L13B
L13BEP14
EP14 which
which
fixed
fixedthis
thisissue
issue
L13B EP 14 Software Green CL
rollout drive stopped.

Private & Confidential

 FCC Limited Area/Band Border Case 6

Private & Confidential

FCC Limited Area/Band Border Case 7

Private & Confidential

 FCC Limited Area/Band Border Case 7

LTE and UMTS Network radio conditions

Private & Confidential

 HO Failure - Drop Due Cell Range/Overshooting Case 8

UE1 Start SINR0 : End SINR0

UE1 Start SINR1 : End SINR1

UE2 Start SINR0 : End SINR0

UE2 Start SINR1 : End SINR1

UE1: No.of HO/ seq from

UE2: No.of HO/ seq from

UE1 VOLTE-S Silent Pkts

UE1 VOLTE-S Voice Pkts
UE1 Start Cell - End Cell

UE2 Start Cell - End Cell

VoLTE-R Cont Pkt Event

VoLTE-R Pkt Loss Count

VoLTE-R Cont Pkt Loss

UE1 # of times PHR<0

UE2 # of times PHR<0

UE1 Start : End Net Id
UE2 Start : End Net Id
UE1 Start : End RSRP

UE2 Start : End RSRP

VOLTE-R Silent Pkts

VOLTE-R Voice Pkts

Audio Attenuation
isDroppedCall
PlayStartTime

% Packet Loss

UE1 Min PHR

UE2 Min PHR

PlayEndTime

M2M-L HO
M2M-L HO
MOS (UE2)
Clip ID

24_140 15:43:03 15:43:15 3.35 1 WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) 0 0 -106:-109 -105:-106 2-2 2-2 276 42 76 103 0 0.00% 0 0 -2.8dB 0:-4.2 -2.2:-3.6 -0.6:6 -3:4.5 -21 53 -23 40
24_141 15:43:15 15:43:27 3.52 0 WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) 0 0 -109:-109 -106:-104 2-2 2-2 249 0 47 75 0 0.00% 0 0 -3.13dB -4.2:1.2 -3.6:-0.1 6:8.2 4.5:6.5 -16 52 -13 40
24_142 15:43:27 15:43:39 2.65 0 WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) 0 0 -109:-107 -104:-102 2-2 2-2 248 0 47 75 0 0.00% 0 0 -3.37dB 1.2:-1.4 -0.1:-2.4 8.2:9.5 6.5:7.4 -11 52 -13 41
24_143 15:43:39 15:43:51 2.57 0 WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) 0 0 -107:-109 -102:-104 2-2 2-2 248 0 48 75 0 0.00% 0 0 -3.01dB -1.4:-4.3 -2.4:-2.5 9.5:3.5 7.4:3.6 -17 51 -12 41
24_144 15:43:51 15:44:03 2.42 0 WIL00198_7A_1 PCI(239) -- WIL00013_7C_1 PCI(388) WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) 0 0 -109:-110 -104:-106 2-2 2-2 248 0 47 57 2 0.68% 1 0 -3.24dB -4.3:-4.3 -2.5:-5.5 3.5:-0.8 3.6:-1.9 -19 39 -22 43
24_145 15:44:03 15:44:15 0 0 WIL00013_7C_1 PCI(388) -- WIL00198_7A_1 PCI(239) WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) 0 0 -110:-108 -106:-107 2-2 2-2 130 0 16 0 0 0.00% 0 0 0 -4.3:8 -5.5:6.3 -0.8:2 -1.9:4.1 -12 11 -20 20
24_146 15:44:15 15:44:27 0 0 WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) 0 0 -108:-103 -107:-107 2-2 2-2 0 0 0 0 0 #DIV/0! 0 0 0 8:4.4 6.3:3.3 2:1.6 4.1:1.7 -8 3 -9 1
24_147 15:44:27 15:44:39 0 0 WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) 0 0 -103:-103 -107:-107 2-2 2-2 0 0 0 0 0 #DIV/0! 0 0 0 4.4:10 3.3:7.8 1.6:7 1.7:7 -4 1 -23 0
24_148 15:44:39 15:44:51 0 0 WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) 0 0 -103:-101 -107:-107 2-2 2-2 0 0 0 0 0 #DIV/0! 0 0 0 10:-0.3 7.8:-1.2 7:0 7:0 -21 0 -23 0
24_149 15:44:51 15:45:11 0 0 WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) WIL00198_7A_1 PCI(239) -- WIL00198_7A_1 PCI(239) 0 0 -101:-108 -107:-107 2-2 2-2 0 0 0 0 0 #DIV/0! 0 0 0 -0.3:5.7 -1.2:4 0:0 0:0 -21 0 -23 0

Drop during clip 5

Observation:
1. Power headroom was limited for both the UEs.
Off-Air sites
Site MS149 FCST
2. Both the UE’s are served by cell WIL00198_7A_1 PCI(239) and
WIL00018 5/31/2014 UE1 attempts HO to WIL00013_7C_1 PCI(388) in poor coverage
WIL00054 3/31/2014
area
WIL00059 6/30/2014
WIL00090 3/31/2014
WIL00176 3/31/2014
Drop 3. PCIs are overshooting in this area due to sites that are not yet
WIL00204 5/31/2014 launched
Private & Confidential
HO Failure - Drop Due Cell Range/Overshooting Case 8
MO (UE1) 3
1 2
2

3 4 NCM

5
4

1. UE 1 sets up RRC connection & is served by cell WIL00198_7A_1 PCI(239)

2. VoLTE bearer is established
3. UE receives a handover command.
4. UE performs RACH to WIL00013_7C_1 (388) for handover which fails at MSG 2.

6 5. UE1 detects a radio link failure and does RACH on WIL00013_7C_1 (388) for RRC
connection re-establishment , which fails on MSG 2 .
6. 6 sec after HO failure, RRC connection is setup
7. HO to WIL00013_7C_1 (388) Failed in poor coverage, PCI 388 is 11.8 miles away.
Current Cell range set is 18 km (11.1 miles).

Private & Confidential

HO Failure - Drop Due Cell Range/Overshooting Case 8

SubNetwork MeContext cellRange

ONRM_ROOT_MO_R WIL00013 18
ONRM_ROOT_MO_R WIL00013 18
ONRM_ROOT_MO_R WIL00013 18

Observation: CHI-M11-C
Cell range of WIL00013_7C_1 (388)
is set at 18 KM.
However, drop location is more than
18 km, therefore, RACH attempt has
failed.

Private & Confidential

 QCI-1 Profile Not Defined Case 9
1

2
2

Ericsson UETR trace (OSS

measurement)
3

CAUSE: QCI-1 Profile was not activated in the site.

1. Default bearers (Internet and IMS) are setup

2. MME Requests ENB to setup QCI1 bearer ( VoLTE bearer)
3. ENB fails to setup QCI 1 & responds with “not-supported-QCI-Value”

Private & Confidential

 High UL RSSI on Target Cell Case 10
Case : High UL RSSI on ILL00438_7C_1
UE2 RSRP UE2 SINR

UE2 EARFCN
UE2 PCI

Private & Confidential

 High UL RSSI on Target Cell Case 10
Case : High UL RSSI-ILL00438_7C_1

1
Comments:
1. UE1: VoLTE Bearer is setup,
2. UE handovers to PCI 329 of
ILL00438_7C_1

Private & Confidential

 High UL RSSI on Target Cell Case 10
Case : High UL RSSI-ILL00438_7C_1

3
3

Comments:
After the UE handovers to PCI 329
of ILL00438_7C_1 it loses sync and
performs the RACH process which
is not successful and the call finally
drops.

Private & Confidential

 High UL RSSI on Target Cell Case 10
Case : High UL RSSI -ILL00438_7C_1

Observations:
The UL RSSI is little high at ILL00438_7C_1 (~ -100 dBm) to sustain call. Due to high RSSI, UE has lost sync.
Recommendation:
Check the UL RSSI on site ILL00438_7C_1.

Private & Confidential

THANKS

Private & Confidential