ZTE UMTS UR15 Connection Management Feature Guide

Connection Management
Feature Guide
Version Date Author Reviewer Notes
Compare to UR14, the following is

modified
3.5.1 Security Mode Control Flow
add “START” and “START list”,
add waitSmcTimer
4.6 ZWF21-01-005 Ciphering Algorithms
UEA0 and UEA1
add URncInfo.uuStartValueSwch
URncInfo.waitSmcTimer
V1.00 2016/04/17 Feng Chao 3.3.1 Paging Flow

add PS Paging discard
4.3 ZWF21-01-003 Paging

add
UExtCelInfoFDD.discPsPagingSwi
UExtCelInfoFDD.discScalPsPaging
3.9 RB Reconfiguration
4.12 Common Parameters
Add para URncInfo.cuInFachRbStSwch
© 2016 ZTE Corporation. All rights reserved.

ZTE CONFIDENTIAL: This document contains proprietary information of ZTE and is not to be disclosed or used
without the prior written permission of ZTE.
Due to update and improvement of ZTE products and technologies, information in this document is subjected to
change without notice.
ZTE Confidential Proprietary 1

TABLE OF CONTENTS
1 Feature Attribute ............................................................................................... 9
2 Overview ............................................................................................................ 9
2.1 Feature Introduction ............................................................................................. 9
2.1.1 ZWF21-01-001 System Information Broadcast .................................................... 9
2.1.2 ZWF21-01-002 Connection Setup and Release ................................................. 11
2.1.3 ZWF21-01-003 Paging ....................................................................................... 11
2.1.4 ZWF21-01-004 NAS Message Transfer ............................................................. 13
2.1.5 ZWF21-01-005 Encryption Algorithms UEA0 and UEA1 .................................... 14
2.1.6 ZWF21-01-006 Integrity Protection Algorithm UIA1............................................ 14
2.1.7 ZWF21-01-007 Radio Connection Monitoring .................................................... 15
2.1.8 ZWF21-30-031 Direct Tunnel ............................................................................. 15
2.1.9 ZWF21-01-019 Faster L1 Synchronization ......................................................... 17
2.1.10 ZWF21-01-009 SIB11bis.................................................................................... 17
2.2 License Control .................................................................................................. 18
2.3 Correlation With Other Features ........................................................................ 18
3 Technical Description ..................................................................................... 19

3.1 System Broadcast .............................................................................................. 19
3.1.1 System Information Broadcast, Scheduling, and Transmission .......................... 19
3.1.2 Information in Different SIBs .............................................................................. 21
3.2 RRC Connection Setup and Release ................................................................. 28
3.2.1 RRC Connection Setup ...................................................................................... 28
3.2.2 Handling Abnormality in the RRC Connection Setup .......................................... 32
3.2.3 Releasing an RRC Connection .......................................................................... 32
3.3 Paging ............................................................................................................... 35
3.3.1 Paging Flow ....................................................................................................... 35
3.3.2 PAGING TYPE 1 ............................................................................................... 36
3.3.3 PAGING TYPE 2 ............................................................................................... 39
3.4 NAS Message Transfer ...................................................................................... 40
3.4.1 NAS Message Forwarding Flow ......................................................................... 40
3.4.2 Setting Up and Releasing an Iu Interface Connection ........................................ 41
3.5 Security Mode Control ....................................................................................... 48
3.5.1 Security Mode Control Flow ............................................................................... 48
3.5.2 Encryption Algorithm and Parameters ................................................................ 53
3.5.3 Integrity Protection Algorithm and Parameters ................................................... 55
3.6 Radio Connection Monitoring ............................................................................. 57
3.7 Iub Interface Radio Link Management................................................................ 58
3.7.1 Establishing an Iub Interface Radio Link ............................................................ 58

3.7.2 Reconfiguring the Iub Interface Radio Link ........................................................ 59

3.7.3 Releasing an Iub Interface Radio Link................................................................ 61
3.8 Iur Interface Radio Link Management ................................................................ 61
3.8.1 Reconfiguring an Iur Interface Radio Link .......................................................... 61
3.8.2 Releasing an Iur Interface Radio Link ................................................................ 62
3.9 RB Reconfiguration ............................................................................................ 62
3.10 Iu Overload Control ............................................................................................ 63
4 Parameters....................................................................................................... 65
4.1 ZWF21-01-001 System Information Broadcast .................................................. 65
4.2 ZWF21-01-002 Connection Setup and Release ................................................. 89
4.3 ZWF21-01-003 Paging ..................................................................................... 102
4.4 ZWF21-01-004 NAS Message Transfer ........................................................... 106
4.5 ZWF21-01-005 Ciphering Algorithms UEA0 and UEA1 .................................... 110
4.6 ZWF21-01-006 Integrity Protection Algorithm UIA1.......................................... 112
4.7 ZWF21-01-007 Radio Connection Monitoring .................................................. 113
4.8 ZWF21-30-031 Direct Tunnel ........................................................................... 115
4.9 ZWF21-01-019 Faster L1 Synchronization ....................................................... 115
4.10 ZWF21-01-009 SIB11bis.................................................................................. 116
4.11 Common Parameters ....................................................................................... 117
5 Related Counters and Alarms ...................................................................... 121

5.1 Related Counters ............................................................................................. 121
5.2 Related Alarms ................................................................................................ 131
6 Engineering Guide ........................................................................................ 131

6.1 Application Scenario ........................................................................................ 131
6.1.1 ZWF21-01-001 System Information Broadcast ................................................ 131
6.1.2 ZWF21-01-002 Connection Setup and Release ............................................... 131
6.1.3 ZWF21-01-003 Paging ..................................................................................... 131
6.1.4 ZWF21-01-004 NAS Message Transfer ........................................................... 132
6.1.5 ZWF21-01-005 Ciphering Algorithm UEA0 and UEA1 ..................................... 132
6.1.6 ZWF21-01-006 Integrity Protection Algorithm UIA1.......................................... 132
6.1.7 ZWF21-01-007 Radio Connection Monitor ....................................................... 132
6.1.8 ZWF21-01-009 Sib11bis .................................................................................. 132
6.1.9 ZWF21-30-031 Direct Tunnel ........................................................................... 132
6.1.10 ZWF21-01-019 Faster L1 Synchronization ....................................................... 132
6.2 Feature Activation Procedure ........................................................................... 133
6.2.3 ZWF21-01-003 Paging ..................................................................................... 152


6.2.8 ZWF21-01-009 Sib11bis .................................................................................. 162
6.3 Feature Validation Procedure .......................................................................... 165
6.3.3 ZWF21-01-003 Paging ..................................................................................... 166
6.3.8 ZWF21-01-009 Sib11bis .................................................................................. 168
6.4 Feature Deactivation Procedure....................................................................... 170
6.4.3 ZWF21-01-003 Paging ..................................................................................... 170
6.4.5 ZWF21-01-005 Ciphering Algorithms UEA0 and UEA1 .................................... 170
6.4.8 ZWF21-01-009 Sib11bis .................................................................................. 170
6.5 Impact on the Network ..................................................................................... 171
6.5.3 ZWF21-01-003 Paging ..................................................................................... 171
6.5.5 ZWF21-01-005 Ciphering Algorithms UEA0 and UEA1 .................................... 172
6.5.7 ZWF21-01-007 Radio Connection Monitoring .................................................. 172
6.5.8 ZWF21-01-009 Sib11bis .................................................................................. 172

7 Abbreviation .................................................................................................. 172
8 Reference Document..................................................................................... 173

FIGURES
Figure 2-1 Overview of Direct Tunnel.................................................................................17

Figure 3-1 System Broadcast.............................................................................................20
Figure 3-2 RRC Connection Establishment Flow ...............................................................29
Figure 3-3 RRC Connection Release Flowchart.................................................................33
Figure 3-4 Paging Flow ......................................................................................................35
Figure 3-5 NAS Message Forwarding Flow ........................................................................40
Figure 3-6 Setting Up an Iu interface Connection...............................................................41
Figure 3-7 Iu Interface Connection Release Initiated by a UE in the DCH State ................43
Figure 3-8 CS and PS Domain Services Are Provided Concurrently and the Service of One
Domain Is Released .............................................................................................................44
Figure 3-9 Iu Interface Connection Release Initiated by a UE in the FACH State...............45
Figure 3-10 Iu Interface Connection Release Initiated by a UE in the PCH State ...............45
Figure 3-11 Iu Interface Connection Release Caused by Signaling Release......................46
Figure 3-12 Iu Interface Connection Release Initiated by the RNC ....................................46
Figure 3-13 Security Mode Control Flow ............................................................................49
Figure 3-14 Querying a UE's Capabilities ..........................................................................52
Figure 3-15 Encryption and Decryption Procedures ...........................................................54
Figure 3-16 f9 Algorithm for Integrity Protection .................................................................56
Figure 3-17 Radio Link Failure ...........................................................................................57
Figure 3-18 RB Reconfiguration .........................................................................................62
Figure 3-19 Iu Overload Control .........................................................................................64
Figure 6-1 Parameter Configuration 1 ..............................................................................134


Figure 6-10 Parameter Configuration 10 ..........................................................................149
Figure 6-13 Parameter Configuration13 ...........................................................................152
TABLES
Table 2-1 License Control List ...........................................................................................18
Table 3-1 Scheduling Levels of the SIBs............................................................................21
Table 3-2 Relation Between Np and Power .......................................................................37
Table 4-1 System Information Broadcast Parameter List ...................................................65
Table 4-2 Connection Setup and Release Parameters List ................................................89
Table 4-3 Paging Parameter List .....................................................................................102

Table 4-4 NAS Message Transfer Parameter List ............................................................106

Table 4-5 Ciphering Algorithm Parameter List..................................................................110
Table 4-6 Integrity Protection Algorithm Parameter List ...................................................112
Table 4-7 Radio Connection Monitoring Parameter List ...................................................113
Table 4-8 Direct Tunnel Parameter List ...........................................................................115
Table 4-9 Faster L1 Synchronization Parameter List .......................................................115
Table 4-10 SIB11bis Parameter List ................................................................................116
Table 4-11 Common Parameter List ................................................................................117
Table 5-1 Counter List .....................................................................................................121
Table 6-1 Feature Validation Procedure 1........................................................................165
Table 6-10 Feature Validation Procedure 10....................................................................169
Table 6-11 RNC parameter list 3 .....................................................................................171
Table 6-12 RNC parameter list 3 .....................................................................................171

1 Feature Attribute
RNC version: [ZXWR RNC V3.15.10.20/ZXUR 9000 V4.15.10.20]
Node B version: [ZXSDR V4.15.10]
Attribute: [Basic]
Involved NEs:
NE Name Related or Not Special Requirement
MS/UE √
BTS/Node B √
BSC/RNC √
iTC -
MSC -
MGW -
SGSN √
GGSN √
HLR -
"√": involved, "-": not involved
2 Overview
2.1 Feature Introduction
2.1.1 ZWF21-01-001 System Information Broadcast
This function allows an entity to broadcast system information periodically with a cell as
the basic unit and update the system information. The system information broadcast over
the BCH channel includes the following content:
 Public Land Mobile Network (PLMN) ID, Location Area (LA), and Route Area (RA)

 Information on the timers and counters related to Radio Resource Control (RRC)
connections
 Configuration information of the UTRAN Registration Area (URA)
 Cell selection and reselection parameters
 Parameters for configuring common channels, such as FACH, PCH, and RACH
 Information on uplink interference related to auxiliary power control
 UE measurement control message about the idle or common channel
 Parameters of the adjacent cell
 AGPS location information
System information is included in System Information Blocks (SIBs). The SIBs supported
by the ZTE RAN include SIB1, SIB2, SIB3, SIB5, SIB7, SIB11, SIB18, and SIB19. Except
SIB7 (containing the uplink interference information) that can be measured and sent by
the Node B, all the other SIBs are controlled and encoded by the RNC.
A SIB can be divided into a maximum of 16 partitions. The length of each partition is up
to 222 bits. Therefore, the maximum length of a SIB is 3552 bits. However, because the
maximum number of adjacent cells that can be contained in a single SIB11 is 96, the SIB
length may exceed 3552 bits. To solve this problem and keep the current system
information architecture, SIB11bis is introduced, whose structure is similar to that of
SIB11 but is optimized. To adapt to SIB11bis, SIB18 contains PLMN identifiers of the
cells in SIB11bis.
The ZTE RAN has removed the limits on the maximum number of adjacent cells in
previous versions. It allows 31 intra-frequency adjacent cells, 32 inter-frequency adjacent
cells, and 32 inter-RAT adjacent cells. In addition, the ZTE RAN has introduced a new
parameter that indicates whether the information about an adjacent cell shall be
transmitted in SIB11 or SIB11bis. The system constructs SIB11 and SIB11bis according
to the adjacent cell configurations and modifies the content in SIB18 according to the
3GPP protocol. If the length of SIB11/Sib11Bis exceeds the maximum length of SIB, the
RNC excludes inter-frequency adjacent cells and GSM adjacent cells. The allowed

number of remaining inter-frequency adjacent cells is determined by

UCelInfoFDD.interNbrNumLimit, and the allowed number of remaining GSM adjacent
cells is determined by UCelInfoFDD.igsmNbrNumLimit.
2.1.2 ZWF21-01-002 Connection Setup and Release
This function is used to manage the setup and release of the RRC connections between
the UTRAN and a UE so that a signaling bearer can be established between the UE and
the UTRAN.
When a UE needs to establish a connection to the network in a specific scenario, such as

LA or RA update, service request, or paging response, the UE initiates an RRC
connection setup request according to the parameters in the broadcast system
information, and the UTRAN allocates resources to set up a Signaling Radio Bearer
(SRB) for the UE and completes the RRC connection setup procedure.
After the completion of the RRC connection setup, the UE establishes an Iu connection
to the Core Network (CN) to update the LA/RA. The SRB also provides a signaling
channel between the UE and the CN. For more details of the Iu connection setup, refer to
the section "ZWF21-01-004 NAS Message Forwarding.
After the completion of the RRC connection setup, the UTRAN monitors the Iu
connection and radio connection of the UE. If all Iu connections are released or the radio
connection to the UE is broken (refer to the section "ZWF21-01-007Radio Connection
Monitor"), the UTRAN releases the RRC connection and all resources allocated to the
UE.
2.1.3 ZWF21-01-003 Paging
When services are demanded in the CN, for example, a UE needs to receive a Short
Message Service (SMS) or Multimedia Message Service (MMS) message, or a UE is
called by another user, the paging function is used to trigger a UE to set up a connection
to the CN. The CN sends a paging message through the Iu interface to the RNC. The
RNC selects an area according to the RRC connection state of the UE and sends a
paging message to the UE.
 The UE is in Idle mode.

The RNC cannot obtain the location of the UE. Therefore, the RNC sends a paging
message within the LA or RA according to the LA/RA information carried in the paging
message of the CN.
 The UE is in PCH mode.
The ZTE RAN supports the URA PCH state. The RNC knows the location information of
the UE in the URA and sends a paging message within the entire URA.
 The UE is in FACH or DCH state.
The RNC knows the location information of the UE in the cell and sends a paging
message to the cell.
The ZTE RAN allows the RNC to initiate a paging procedure in the following special
scenarios:
 When there are data packets in the downlink buffer, the RNC sends a paging
message to trigger the UE to change the state from URA_PCH to CELL_FACH
and set up a service bearer for downlink data transmission.
 After the system information changes, the RNC sends a paging message to
notify all the UEs in Idle or PCH state in the cell.
 When it is necessary to suspend the RRC connection of a UE in PCH state,

the RNC sends a paging message to release the RRC connection of the UE.
The ZTE RAN supports two paging modes: PAGING TYPE 1 and PAGING TYPE 2.
 For a UE in Idle or URA_PCH state, a paging message of PAGING TYPE 1 is

sent.
 For a UE in CELL_FACH or CELL_DCH state, a paging message of PAGING

TYPE 2 is sent.
To improve the paging success rate at the boundary between two location areas, the
RNC has introduced Virtual Location Area Paging. When a cell is at the boundary of a
location area, the paging message is sent to both this cell and the cell of the adjacent
location area.

2.1.4 ZWF21-01-004 NAS Message Transfer
The signaling on the Non-Access Stratum (NAS) between a UE and the CN must go
through the UTRAN. The signaling on the NAS is used to control UE location updates,
authentication, call setup, call release, and SMS data transfer. The UTRAN equipment is
not required to resolve and process NAS signaling and SMS data that is exchanged
between the UE and the CN. The UTRAN transparently transfers NAS signaling and
SMS data between the CN and the UE as parameters in DIRECT TRANSFER messages
defined by the RANAP and RRC protocols.
The ZTE RAN supports three types of directly forwarded messages.
 INITIAL DIRECT TRANSFER message
Once the UTRAN receives an INITIAL DIRECT TRANSFER message from the UE, the
RNC immediately sets up an SCCP connection to the Iu interface of the MSC or SGSN
according to the CN (PS or CS) domain label in the message, adds the NAS message to
the INITIAL UE MESSAGE, and sends the message to the MSC or SGSN. Meanwhile,
the RNC records the binding relation between the SCCP connection and the UE RRC
connection, and sets up a channel for NAS messages between the UE and the CN.
 UPLINK DIRECT TRANSFER message
When receiving an UPLINK DIRECT TRANSFER message from the UE, the UTRAN
adds the NAS message to the DIRECT TRANSFER message according to the CN
domain label in the message, and forwards the message to the MSC or SGSN.
 DOWNLINK DIRECT TRANSFER message
When receiving a DIRECT TRANSFER message from the CN, the UTRAN adds the
NAS message to the DOWNLINK DIRECT TRANSFER message according to the
relation between the SCCP connection and the RRC connection and forwards the
message to the destination UE.
When receiving a message for releasing the Iu connection from the CN, the RNC
releases the Iu connection of the CN and dismisses the binding relation between the
SCCP and the RRC.

2.1.5 ZWF21-01-005 Encryption Algorithms UEA0 and UEA1
When the Uu interface broadcasts data, the function can be used to encrypt service data
and signaling data for protecting the communication security between the RNC and the
UE. The ZTE RAN supports the encryption algorithms UEA0 and UEA1. UEA0 means
that the data from the Uu interface is not encrypted. UEA1 supports encryption and
decryption based on the encryption algorithm f8 of the KASUMI algorithm.
Whether the encryption protection function should be enabled and which encryption
algorithm is to be applied can be configured in the CN. Through the security mode
command procedure of the RAN Application Part (RANAP), a message with the key to
the encryption algorithm is sent to the RNC, requesting the RNC to enable the encryption.
The RNC selects an encryption algorithm according to its encryption capability, the
encryption capability of the UE, and the priorities of optional encryption algorithms, and
then starts the encryption through the security mode command procedure of the RRC.
When the encryption function is enabled, the RNC or the UE encrypts the data to be
transmitted in compliance with the f8 algorithm, which uses the encryption key and
variables varying with the data volume as input parameters. The receiver decrypts the
data using the same algorithm. Encryption is implemented on the RLC layer (AM or UM
mode) or MAC layer (TM mode).
2.1.6 ZWF21-01-006 Integrity Protection Algorithm UIA1
To prevent malicious attack against the Uu interface signaling that is transmitted through
the air interface, the function provides a signaling check mechanism. The ZTE RAN
supports the unique integrity protection algorithm UIA1 defined by the 3GPP, which
implements integrity protection based on the f9 integrity protection algorithm of the
KASUMI algorithm.
Whether integrity protection should be enabled is configured in the CN. The notice of
enabling integrity protection is sent to the RNC through the security mode command
process of the RANAP. The message carries the key of the integrity protection algorithm.
The RNC enables the integrity protection mode through the RRC security mode
command process.

If integrity protection is enabled, before sending an RRC message, the RNC or the UE
first calculates the integrity protection authentication code (MAC-I) through the f9
algorithm, and then adds MAC-I to the message. The receiving end must use the same
algorithm and key as those of the transmitting end to calculate the XMAC-I (the integrity
protection authentication code of the received message), and compare the XMAC-I with
the received MAC-I. If the XMAC-I is the same as the MAC-I, the received message is
considered as correct. Otherwise, the received message is discarded.
Not all Uu interface signaling can be protected. The RRC message from the ZTE RAN for
integrity protection complies with the 3GPP TS25.331 protocol.
2.1.7 ZWF21-01-007 Radio Connection Monitoring
The function monitors the radio connection status of all UEs with established RRCs. If
the RNC detects that the connection between a UE and the network is broken due to
poor radio quality or other reasons, the RNC immediately releases the resources
allocated to the UE (including the RB resources of established services) and releases the
RRC connection.
The ZTE RAN supports the following radio connection monitoring modes:
 The Node B monitors the RL connection status.
 The RNC monitors the RLC connection status.
 The RNC monitors the cell update message of the UE.
 The RNC monitors the UE keep_alive timer.
When detecting a broken connection of a UE, the RNC releases the radio resources and
sends an Iu release request message through the Iu interface to the CN to release the
related RAB resources.
2.1.8 ZWF21-30-031 Direct Tunnel
After HSPA/HSPA+ was introduced to WCDMA networks, data throughput is greatly

increased and the requirements for bandwidth and delay are much higher.

The direct tunnel feature is officially defined in 3GPP R7. It supports the direct
connection of the user plane between an RNC and a GGSN. The direct tunnel feature is
transparent to the RNC. The SGSN determines when the direct tunnel feature is required.
The RNC is not involved during direct tunnel establishment and release. The ZTE RAN
system supports the following functions, which interoperate with the SGSN to implement
the direct tunnel feature.
 Address modification for the user plane of the peer end can be processed in Iu PS
interface protocol RAB modification procedure.
 The RNC can initiate an RAB release request with the reason "GTP Resources
Unavailable" when receiving a GTP user plane error indication.
 The RNC supports IP bearer for the Iu PS interface for connecting to the Gn
interface. Although ATM bearer for the Iu PS interface can also be used for
connecting to Gn interface, an additional ATM gateway router is required.
The direct tunnel feature is enhanced in 3GPP R8 to support a direct connection

between the RNC and an S-GW through an S12 interface. As illustrated in the following
figure, the RAN can be connected to the CN of an LTE network through the S12 interface.
3G users can access the Internet through the direct tunnel and EPS network elements.
To transmit data through the S12 interface, the SGSN must support the S4 interface to
be connected to the MME.

Figure 2-1 Overview of Direct Tunnel
If the direct tunnel feature is required, UIupsLink.SupportDTSwitch must be set to 1.
2.1.9 ZWF21-01-019 Faster L1 Synchronization
In releases earlier than 3GPP R6, a DL DPCCH quality confirmation procedure that takes
40 ms is required for a UE before uplink transmission during physical layer
synchronization in mode A for radio link setup. As specified in 3GPP R6 and later
versions, the DL DPCCH quality confirmation procedure can be omitted to speed up
radio link setup. A UE can start uplink transmission immediately upon receiving
indications from higher layers, and perform another post-verification of DL DPCCH
quality in parallel with uplink transmission.
3GPP has introduced the "Post-verification period" IE to indicate whether a UE uses this
enhanced synchronization. When fastL1Sync is set to 1, the RNC includes the
"Post-verification period" IE in RRC Messages for UEs with R6 or later versions.
2.1.10 ZWF21-01-009 SIB11bis
Limited by the length of the broadcast information block, SIB11 can broadcast
information to up to 96 adjacent cells, including intra-frequency cells, inter-frequency

cells and inter-system cells. In a complicated networking environment with multiple

frequency points, multiple frequency bands, and multiple systems, the configuration of
adjacent cell broadcast is a bottleneck. SIB11bis expands the adjacent cell broadcast
capability of SIB11, and supports a doubled number of adjacent cells.
2.2 License Control
Table 2-1 License Control List
License Configured
Feature ID Feature Name Unit
Control Item NE
ZWF21-01-001 System Information

N/A N/A N/A
Broadcasting
ZWF21-01-002 Connection Setup and

N/A N/A N/A
Release
ZWF21-01-003 Paging N/A N/A N/A
ZWF21-01-004 NAS Message

N/A N/A N/A
Transfer
ZWF21-01-005 Ciphering Algorithm

N/A N/A N/A
UEA0 and UEA1
ZWF21-01-006 Integrity Protection

N/A N/A N/A
Algorithm UIA1
ZWF21-01-007 Radio Connection

N/A N/A N/A
Monitor
ZWF21-30-031 Direct Tunnel N/A N/A N/A
ZWF21-01-019 Faster L1
N/A N/A N/A
Synchronization
ZWF21-01-009 SIB11bis N/A N/A N/A
2.3 Correlation With Other Features
1. Required Features

None.
2. Mutually Exclusive Features
None.
3. Affected Features
None.
3 Technical Description
3.1 System Broadcast
The RNC is responsible for constructing and broadcasting system information. The
system information includes the Non-Access Stratum (NAS) information, configuration
information of common cell channels, cell selection and reselection parameters, initial
access, measurement control, and location information. The system information provides
necessary UTRAN information for Location Area Update (LAU), Route Area Update
(RAU), and RRC setup procedures initiated from a cell.
The system information is divided into three categories: Master Information Blocks
(MIBs), Schedule Blocks (SBs), and System Information Blocks (SIBs).
3.1.1 System Information Broadcast, Scheduling, and Transmission
An MIB can store the scheduling information about SBs and SIBs. SBs (including SB1
and SB2) store the scheduling information about SIBs. A SIB stores the system
information. The ZTE UTRAN supports SB1, SB2, SIB3, SIB5, SIB6, SIB7, SIB11,
SIB11bis, SIB18, and SIB19.
After a cell is created or added, the system broadcasts the system information within the
cell. When the system information is updated or the timer expires (refer to the section
"3.1.2.5 SIB7"), the system also broadcasts the system information, as illustrated in the
following figure.

Figure 3-1 System Broadcast
UE NodeB DRNC SRNC
system information broadcast

scheduler
SYSTEM INFORMATION UPDATE REQUEST
SYSTEM INFORMATION UPDATE RESPONSE
System information broadcast
Condition：informing UE of idle, CELL_PCH、URA_PCH

that system information changed
Paging（ PAGING TYPE1（
Condition：informing UE of CELL_FACH that

system information changed
RRC SYSTEM INFORMATION CHANGE INDICATION RRC
When a cell is created or the system information is updated, the system first
schedules a system information broadcast and specifies the interval at which the
information blocks are to be sent. If UCelInfoFDD.sIBSchuOptSwit is 1, and an MIB can
schedule all SIBs, then SB1 and SB2 are not needed. Otherwise, the system assigns two
priorities to the SIBs according to their significance. The SIBs with the higher priority is
scheduled by the MIB, and the SIBs with the lower priority are scheduled by SB1. The
priority assignment can increase the frequency of system information broadcasts. The
SIBs with little content can be cascaded together and transmitted within the same TTI.
The SIBs with a lot of content can be divided into several segments, such as SIB5 and
SIB11. This following describes SIB division:
 An MIB is used to schedule SB1, SIB1, SIB2, SIB3, SIB5, and SIB7.
 SB1 is used to schedule SIB11 and SIB18.
Except MIBs, all system information blocks are divided into two levels in accordance
with their significance. The significance level represents the priority for filling in system
information.

Table 3-1 Scheduling Levels of the SIBs
Level 1 Information blocks scheduled by MIB: SB1, SIB1, SIB2, SIB3, and SIB7
Level 2 Information blocks scheduled by SB1: SIB11, and SIB18
The relationship between SIB broadcast intervals at different levels: broadcast interval of
SIBs at level 2 ≥ broadcast interval of SIBs at level 1
 After filling in the system information according to the scheduling principles, the
RNC sends a SYSTEM INFORMATION UPDATE REQUEST message to the Node
B. When the RNC receives a correct SYSTEM INFORMATION UPDATE
RESPONSE message, the system information update is considered successful.
 After receiving the system information, the Node B broadcasts the system
information over the BCH channel to each information block at the specified
interval.
When the system information is updated, the system notifies the UE in the Idle,
PCH, or FACH state by the following means:
 Notifying the UE in the Idle or PCH state through paging: The RNC sends a
paging message of PAGING TYPE 1 to the UE. The cell BCCH modification
info in the message indicates that the system information has been updated.
For more details of the paging procedure, refer to the section "3.4 Paging".
 Notifying the UE in the FACH state through the system information update:
The system sends a SYSTEM INFORMATION CHANGE INDICATION to the
UE. The BCCH modification info in the message indicates that the system
information has been updated.
3.1.2 Information in Different SIBs
3.1.2.1 SIB1
SIB1 contains the CN information and UE behavior related timers and counters. The
following describes the IEs that can be configured on the OMCR:

T300 (UUeCnst.t300) specifies the waiting time after the UE sends an RRC
CONNECTION SETUP REQUEST message. The timer is started after the UE sends the
RRC CONNECTION REQUEST message. If the cause of the RRC connection request is
MBMS Reception, the T300 timer is not started. Instead, the T318 timer is started, and
the value of the timer T318 is invariably set to 1000 ms. The T300 timer is stopped when
the message RRC CONNECTION SETUP is received. When the timer expires and the
number of retransmissions is smaller than N300, the UE retransmits the RRC
CONNECTION SETUP REQUEST message.
N300 (UUeCnst.n300) specifies the maximum number of times that an RRC

CONNECTION SETUP REQUEST message is retransmitted. If the T300 timer expires
and the number of retransmissions is equal to or larger than N300 but the RRC
CONNECTION SETUP message has not been received, the UE enters Idle mode.
T312Idle (UUeCnst.t312Idle) specifies the time period during which the UE in Idle mode
waits for the synchronization indication from layer 1 when it establishes a dedicated
physical channel. The timer is started when the UE starts establishing the dedicated
channel. When the UE detects that the number of synchronization indications received
from layer 1 is equal to N312Idle, the T312 timer is stopped. If the timer expires, the
physical channel setup fails.
N312Idle (UUeCnst.n312Idle) is an Idle mode counter that indicates the number of

synchronization indications received from layer 1 when the UE sets up the dedicated
channel.
T302 (UUeCnst.t302) specifies the waiting time after the UE sends the CELL UPDATE or
URA UPDATE message. The counter is started when the UE sends a CELL UPDATE or
URA UPDATE message. It is stopped when the UE receives a CELL UPDATE
CONFIRM or URA UPDATE CONFIRM message. If the counter T302 expires but the
number of retransmitted messages is smaller than N302, the UE retransmits the CELL
UPDATE or URA UPDATE message.
N302 (UUeCnst.n302) specifies the maximum number of times that a CELL UPDATE or
URA UPDATE message is retransmitted. When the T302 counter expires and the
number of the CELL UPDATE or URA UPDATE messages sent by the UE is larger than
or equal to N302, the UE enters Idle mode.

T304 (UUeCnst.t304) specifies the waiting time after the UE sends a UE CAPABILITY
INFORMATION message. When the UE sends a UE CAPABILITY INFORMATION
message, the timer is started. It is stopped when the UE receives a UE CAPABILITY
INFORMATION Confirmed message. When the T304 timer expires and the number of
the CAPABILITY INFORMATION messages sent by the UE is smaller than N304, the UE
retransmits the UE CAPABILITY INFORMATION message.
N304 (UUeCnst.n304) specifies the maximum number of times that a UE CAPABILITY

INFORMATION message is retransmitted. When the T304 counter expires and the
number of retransmissions is equal to or larger than N304, the UE starts the CELL
UPDATE procedure.
T305 (UUeCnst.t305) specifies the interval at which the cell or URA is updated when the
UE is in CELL_FACH, or CELL_PCH/URA_PCH state. The T305 timer is started when
the UE enters the CELL_FACH or CELL_PCH/URA_PCH state. When the UE receives a
CELL UPDATE CONFIRM or URA UPDATE CONFIRM message, the T305 timer is
stopped. When the T305 timer expires and the UE detects its own serving cell, the UE
sends a CELL UPDATE message. When the T305 timer expires and the UE is not in the
serving cell, the T307 timer is started.
T307 (UUeCnst.t307) specifies the time period during which the UE waits for cell
reselection after leaving the serving cell. At the expiry of the timer, the UE returns to the
Idle mode.
T308 (UUeCnst.t308) specifies the waiting time after the UE in the CELL_DCH state
sends an RRC CONNECTION RELEASE COMPLETE message. The T308 timer is
started after the UE sends an RRC CONNECTION RELEASE COMPLETE message.
When the T308 timer expires and the number of the RRC CONNECTION RELEASE
COMPLETE messages sent by the UE is smaller than N308, the UE retransmits the
RRC CONNECTION RELEASE COMPLETE message.
N308 (URncFunction.n308) specifies the maximum number of times that an RRC

CONNECTION RELEASE COMPLETE message is retransmitted. When the T308
counter expires and the number of the RRC CONNECTION RELEASE COMPLETE
messages sent by the UE is larger than or equal to N308, the UE enters the Idle mode.

T309 (UUeCnst.t309) specifies the waiting time after the UE initiates a request for
accessing another system (such as a GSM system). When the UE receives a CELL
CHANGE ORDER FROM UTRAN message, the T309 timer is started. When the UE in
the new cell successfully receives a response to the connection setup request, the T309
timer is stopped. If the T309 timer expires, the UE returns to the original UTRAN.
T312 Connected (UUeCnst.t312Connected) is a timer when the UE is in Connected

mode. The timer specifies the time period during which the UE in connected mode waits
for the synchronization indication from layer 1 after it initiates the setup of a dedicated
physical channel. The timer is started when the UE starts establishing the dedicated
channel. When the UE detects the number of synchronization indications received from
layer 1 is equal to N312, T312 is stopped. If the T312 timer expires, the physical channel
setup fails.
N312Connected (UUeCnst.n312Connected) is the N312 counter in connected mode. It

indicates the number of synchronization indications received from layer 1 before the UE
in Connected mode sets up the dedicated channel successfully.
T313 (UUeCnst.t313) specifies the waiting time after the DPCCH channel set up by the
UE in the DCH state loses synchronization. When the number of synchronization loss
indications received by the UE in the DCH state from layer 1 reaches the value of N313,
the UE starts T313. When the UE receives synchronization indications from layer 1 for
N315 times, it stops the T313 timer. When the T313 timer expires, the radio links with
synchronization loss are broken.
N313 (UUeCnst.n313) specifies the maximum number of synchronization loss

indications received by the UE from layer 1.
N315 (UUeCnst.n315) specifies the maximum number of synchronization loss

indications received by the UE from layer 1 when T313 is in active status.
T314 (UUeCnst.n315) is a UE timer. When the criteria for radio link failure are fulfilled,
T314 is started if a radio bearer (radio bearers) that is (are) associated with T314 exist or
if only an RRC connection exists in the CS domain. When the Cell Update procedure is
completed, T314 is stopped.

T315 (UUeCnst.t315) specifies the time period during which the radio bearers related to
T315 wait for the completion of a cell update after the radio connection setup fails. When
the RB is set up, the system uses T314 or T315 for the RB. When the radio link fails and
the current RB uses T315, the system starts T315. When the cell update procedure is
completed, the system stops T315.
When T314 expires, the UE checks whether T302 is still in running status. If yes, the UE
continues waiting for a CELL UPDATE CONFIRM or URA UPDATE CONFIRM message.
If T302 is not running, the UE checks whether T315 is in running status. If yes, the UE
releases RAB resources related to T314. If T315 is not running, the UE releases all the
RAB resources and enters Idle mode.
If T315 expires, the UE behaves as if T314 expires. At the moment, the UE takes actions
according to the running status of T302 and T314.
T316 (UUeCnst.t316) specifies the time period during which the UE in the
CELL_PCH/URA_PCH state waits for cell selection or reselection after leaving the
serving cell. When the UE in the PCH state leaves the serving cell, the system starts the
T316 timer. When the UE detects the serving cell, the system stops the T316 timer.
When the T316 timer expires, if the UE is in the serving cell, it initiates a cell update
procedure. If the T316 timer is not in the serving cell, it starts the T317 timer and switches
to the FACH state. When the UE detects the serving cell, it starts a cell update.
T317 (UUeCnst.t317) specifies the time period during which the UE in CELL_FACH state
waits for cell selection or reselection after leaving the serving cell. When the T316 timer
expires, the system starts the T317 timer. When the UE in FACH leaves the serving cell,
the system starts the T317 timer. When the UE detects the serving cell, it stops the T317
timer. T317 is fixed as infinity, which is the only value according to 25.331.
CnDomain (UCnInfo.cnDomain) refers to the CN domain supported by the system.
T3212Cs (UCnInfo.t3212Cs) is a periodic location update timer. There are two location
update scenarios. The UE detects LAC variation and initiates a location update, or the
system updates locations periodically. T3212Cs is a periodic location update timer.
ATTIndCs (UCnInfo.attIndCs) is a digital variable and specifies whether the IMSI

ATTACH flow or the DETACH flow is to be used.

NMOPs (UCnInfo.nmops) specifies a network operation mode. Network mode 1

indicates that Gs interfaces exist between the MSCServer and the SGSN. Network mode
2 indicates that Gs interfaces do not exist.
3.1.2.2 SIB2
SIB2 specifies the URA ID of a cell. With SIB2, the UE in the URA_PCH state can update
the URA. URA ID is configured by UUtranRegArea.URA.
3.1.2.3 SIB3/SIB4
Parameters in SIB3 and SIB4 are related to cell selection and cell reselection. SIB3
contains information required by a UE in Idle mode. SIB4 contains information required
by a UE in Connected mode (the FACH and DCH states are under the control of the
measurement policies). If SIB4 is not sent, the UE in Connected mode can still receive
SIB3.
3.1.2.4 SIB5/SIB6
SIB5 and SIB6 are used to configure common transport channels and common physical
channels. SIB5 contains the parameters of the auxiliary common control channels in Idle
mode. SIB6 contains the parameters of the common physical channels or shared
physical channels in connected mode. UEs in Idle mode use SIB5, but UEs in Connected
mode use SIB6. If SIB6 does not exist, a UE in Connected mode can also use SIB5.
3.1.2.5 SIB7
SIB7 is a system information block that is updated periodically. The timer of SIB7 is
calculated as follows:
Expiration timer = MAX (32, SIB_REP * ExpirationTimeFactor)
SIB_REP is the transmission interval of SIB7 and is obtained during broadcast

scheduling. ExpirationTimeFactor is the timeout factor of SIB7 and is set to 2 invariably.

SIB7 is sent by the RNC or Node B. The parameter UUtranCellFDD.SIB7Originator can

be configured on the OMCR to determine the transmitting end of SIB7. By default, the
Node B sends SIB7 for reducing the transmission time.
SIB7 contains the parameter UPrach.DynPstLevelInit required for the calculation of the
PRACH preamble power.
3.1.2.6 SIB11/SIB12
SIB11 and SIB12 are used to configure cell measurement control information. SIB11
specifies the measurement control information required by the UE in Idle mode. SIB12
specifies the measurement control information required by the UE in FACH state. If
SIB12 is not broadcast, the UE in connected mode can use the configuration information
specified by SIB11.
SIB11 and SIB12 contain the information of a lot of adjacent cells. The data configuration
of these cells may be incomplete. If URncFunction.fltIncmpNbrCelSwit is set to 1, the
information about adjacent cells with incomplete configurations is not broadcast through
SIB11/SIB12.
The maximum length of a SIB is limited. Too many adjacent cells in a SIB may result in a
length exceeding the limit. In this case, some adjacent cells are excluded from SIB11 and
SIB12. However, at least UCelInfoFDD.gsmNbrNumLimit GSM cells and
UCelInfoFDD.interNbrNumLimit inter-frequency cells must be contained in a SIB.
3.1.2.7 SIB15
SIB15 contains DGPS, astronomical information, calendar information, UTC and

ionization revision information, cell location information, and encryption support
information. SIB15 is not broadcast in this version.
3.1.2.8 SIB18
SIB18 specifies the PLMN tag that must be considered by the UE in Idle or Connected
mode. Broadcasting SIB18 or not is determined by the parameter
UCelInfoFDD.sib18Ind.

3.1.2.9 SIB11bis
The content in SIB11bis is the same as that in SIB11. The purpose of SIB11bis is to
alleviate the lack of SIB11 space when there are too many adjacent cells. The
parameters UtranRelation.sb11orSib11bis and UGsmRelation.sib11orSib11bis are used
to determine whether the information about an adjacent cell can be broadcast through
SIB11bis. The adjacent cell information is broadcast by SIB11bis when the space in
SIB11 is depleted.
3.1.2.10 SIB19
SIB19 contains inter-RAT frequency and priority information to be used in the cell. The
frequency and priority information is related to UTRAN, GSM, or E-UTRAN.
3.2 RRC Connection Setup and Release
3.2.1 RRC Connection Setup
The RRC connection can be established over:
 A dedicated channel
 A common channel
The following figure shows the RRC connection establishment flow.

Figure 3-2 RRC Connection Establishment Flow
Tar get Sour ce Dr i f t Sour ce

UE
Node B Node B RNC RNC
RRC CONNECTI ON REQUEST

RRC RRC
[ CCCH]
Tr anspor t channel sel ect i on
Condition：setup RRC connection on DCH
Load balance of RRC
RL Set up
Condition：RL setup successful

RRC CONNECTI ON SETUP
RRC RRC
[ CCCH]
RRC CONNECTI ON SETUP COMPLETE

RRC RRC
[ DCCH]
Condition：expiration of waiting RRC CONNECTION COMPLETE
RL Del et e
Condition：RL setup failed
RRC CONNECTI ON REJET

RRC RRC
[ CCCH]
Condition：setup RRC connection on FACH
RRC CONNECTI ON SETUP

RRC RRC
[ CCCH]
RRC CONNECTI ON SETUP COMPLETE

RRC RRC
[ DCCH]
Condition：RRC connection reject
RRC CONNECTI ON REJET

RRC RRC
[ CCCH]
3.2.1.1 Establishing an RRC Connection Over a Dedicated Transport Channel
When receiving an RRC CONNECTION REQUEST message from a UE, the RNC
specifies the channel over which the RRC connection is to be established according to
the parameter URncFunction.InitRrcOnDch.
If the parameter URncFunction.InitRrcOnDch is set to 0 (forced to DCH and using

normal-speed signaling), 1 (forced to DCH and using 13.6 kbps signaling), or 5 (forced to DCH
and using 27.2 kbps signaling), the RNC establishes the RRC connection over the DCH
channel.

If the parameter URncFunction.InitRrcOnDch is set to 3 (not forced, using 3.4 kbps signaling
in Cell-DCH state), 4 (not forced, using 13.6 kbps signaling in Cell-DCH state), or 6 (not forced,
using 27.2 kbps signaling in Cell-DCH state), the RNC establishes the RRC connection
over the DCH according to the Establishment_cause (for example, the UE initiates a call)
in the RRC CONNECTION REQUEST message.
The RNC obtains the cell where the radio link is to be set up using the inter-frequency
load balancing algorithm. For details of the inter-frequency load balancing algorithm,
refer to the ZTE UMTS Load Balance Feature Guide.
The RNC establishes a radio link at the Iub interface. For details, refer to the section
"Establishing the Iub Interface Radio Link".
If URncFunction.parallelRrcSetup is 0, after the radio link is established successfully, the

RNC sends an RRC CONNECTION SETUP message to the UE.
If URncFunction.parallelRrcSetup is 1, the RNC sends an RRC CONNECTION SETUP

message to the UE when sending the radio link setup message to the Node B, and does
not wait for the response message from the Node B.
If the parameter URncFunction.InitRrcOnDch is set to a value that indicates the use of

high-speed signaling, the RNC fills in a 13.6 kbps high-speed SRB for the parameter
Dynamic Transport Format Information in the RRC CONNECTION SETUP message.
Otherwise, the RNC fills in a 3.4 kbps common SRB. If the 13.6 kbps SRB is established,
the RNC fills in a 3.4 kbps SRB when RAB assignment starts.
The RNC retransmits the RRC CONNECTION SETUP message if the RNC does not
receive an RRC CONNECTION SETUP COMPLETE message from the UE after the
period specified by the URncFunction.tRrcSetupRetran timer until the number of
transmissions reaches the maximum number of transmissions specified by
URncFunction.rrcSetupRetraNum.
If the RNC receives an RRC CONNECTION SETUP COMPLETE message from the UE
within the period specified by the URncFunction.tRrcConSetupExp timer, the RRC
connection establishment is determined successful. The procedure is concluded.

3.2.1.2 Establishing an RRC Connection Over a Common Transport Channel
When receiving an RRC CONNECTION REQUEST message from a UE, the RNC
specifies the channel over which the RRC connection is to be established according to
the parameter URncFunction.InitRrcOnDch.
If the parameter URncFunction.InitRrcOnDch is set to 2 (forced to FACH), the RNC

establishes the RRC connection over the FACH channel.
If the parameter URncFunction.InitRrcOnDch is set to 3, 4, or 6, the RNC establishes the

RRC connection according to Establishment_cause. If services are initiated immediately
after the RRC connection setup (for example, the value of Establishment_cause is
Originating Conversational Call), the RNC selects the DCH. If only a signaling procedure
instead of service setup is required to be completed after the RRC connection setup (for
example, the value of Establishment_cause is Registration), the RNC selects a common
channel to bear signaling.
The RNC selects the SCCPCH channel according to the Initial UE Identify of the UE. The
Index of the selected SCCPCH is equal to "Initial UE Identity" mod K, where K represents
the number of FACH SCCPCH channels of the cell. The RNC sends a RRC
CONNECTION SETUP message over the SCCPCH channel to the UE and sends the
SRB configuration.
The RNC retransmits the RRC CONNECTION SETUP message if the RNC does not
receive an RRC CONNECTION SETUP COMPLETE message from the UE after the
period specified by the URncFunction.tRrcSetupRetran timer until the number of
retransmissions reaches the maximum number of retransmissions specified
URncFunction.byrrcSetupRetraNum.
If the RNC receives an RRC CONNECTION SETUP COMPLETE message from the UE
within the period specified by the URncFunction.tRrcConSetupExp timer, the RRC
connection establishment is determined as successful. The procedure is concluded.
3.2.1.3 RRC Connection Flow Control
A sudden increase of RRC connection requests may lead to CPU overload. To avoid the
overload problem, the CMP and DMP monitor the number of received RRC connection

requests every second. When the number exceeds the thresholds defined by the
parameters URncFunction.norCmpUserAcThd and URncFunction.norDmpUserAcThd,
the subsequently received RRC connection requests are discarded in the remnant time
of this time slice.
3.2.2 Handling Abnormality in the RRC Connection Setup
3.2.2.1 Radio Link Setup Failure
If radio link setup fails, the RNC sends an RRC CONNECTION REJECT message to the
UE and fills in Wait Time in the message. The parameter Wait Time
(UUtranCellFDD.Twait) specifies the duration (from the reception of the RRC
CONNECTION REJECT message to the time of sending access request) during which
the UE has to wait.
3.2.2.2 Failure to Receive an RRC Connection Setup Response From a UE
If the RNC does not receive an RRC CONNECTION SETUP COMPLETE message after
waiting for 5 seconds from the first transmitting of RRC CONNECTION SETUP, the RRC
connection setup fails and the UE is still in Idle mode.
If radio links are already set up on the Iub interface, meaning the RRC connection is
planned to be established over a dedicated transport channel, the RNC deletes the radio
links from the Iub interface.
3.2.3 Releasing an RRC Connection
The causes that trigger the RRC connection release include the following:
 The connection carrying service data or NAS signaling is released normally.
 The Node B detects a radio link failure.
 The RNC detects that the RLC connection fails.
 The UE in the DCH or FACH state sends a CELL UPDATE message. The value of
the AM_RLC error indication (RB2, RB3 or RB4) is true.

 The UE in the FACH state sends a CELL UPDATE message to the RNC. The cause
is Radio link failure or RLC unrecoverable error.
 The UE in the FACH or PCH state does not exchange any message or data within
the period of UUtranCellFDD.t305 + 11 minutes.
 Other cases determined by the RNC.
Any of the above cases may trigger the RRC connection release flow. Figure 3-3 shows
the RRC connection release flow.
Figure 3-3 RRC Connection Release Flowchart

UE
Condition：RRC connection release on DCH

RRC CONNECTI ON RELEASE
RRC RRC
[ DCCH（ UM RLC RB1（ ]
RRC CONNECTI ON RELEASE COMPLETE

RRC RRC
[ DCCH（ UM RLC RB1（ ]
RL Del et e
Condition：RRC connection release on FACH
RRC CONNECTI ON RELEASE

RRC RRC
[ CCCH（ DCCH（ AM RLC RB2（ ]
RRC CONNECTI ON RELEASE COMPLETE

RRC RRC
[ CCCH（ DCCH（ AM RLC RB2（ ]
When a UE in the URA_PCH or CELL_PCH state needs to release an RRC connection,

if URncInfo.r5PchRrcRelMode is 0, the RNC will first send a paging message to the UE,
then transfer the UE to the CELL_FACH or CELL_DCH state, and finally release the
RRC connection to the UE. If URncInfo.r5PchRrcRelMode is 1, the RNC will directly
send the release indication to the UE in the paging message.

3.2.3.1 Releasing an RRC Connection Established Over the Dedicated Channel
The UE in the DCH state receives an RRC release request from the RNC, sends an RRC
CONNECTION RELEASE COMPLETE message in UM mode to the RNC, and starts the
T308 timer. When the T308 timer expires, the UE retransmits an RRC CONNECTION
RELEASE COMPLETE message. The number of retransmissions is determined by N308.
The wait time (T308) and the maximum number of retransmissions (N308) can be
configured on the OMCR.
The UE in the FACH state receives an RRC release request from the RNC. The UE
sends an RRC CONNECTION RELEASE COMPLETE message only once.
The RNC releases the radio link from the Iub interface. For more details, refer to the
section "Releasing the Iub Interface Radio Link".
3.2.3.2 Releasing an RRC Connection Established Over the Common Channel
The RNC sends an RRC CONNECTION RELEASE message over the CCCH channel to
a UE or sends an RRC CONNECTION RELEASE message through SRB2 to the UE,
requesting the UE to release the RRC connection.
The UE in the FACH state receives an RRC release request from the RNC. The UE
sends an RRC CONNECTION RELEASE COMPLETE message through the CCCH only
once.
The RNC receives the RRC CONNECTION RELEASE COMPLETE message from the
UE and releases the local resources. The RRC connection is released successfully.
3.2.3.3 Handling Abnormality in the RRC Connection Release
If the RNC does not receive an RRC CONNECTION RELEASE COMPLETE message
from the UE after sending an RRC CONNECTION RELEASE message to the UE, the
RNC retransmits the RRC CONNECTION RELEASE message. The parameter
URncFunction.NreTran specifies the maximum number of times that the RRC
CONNECTION RELEASE message is retransmitted and can be configured on the
OMCR.

If the RNC already sends the RRC CONNECTION RELEASE message for the times
specified by URncFunction.NreTran but does not receive an RRC CONNECTION
RELEASE COMPLETE message within 500 ms, the RNC considers the RRC connection
release as completed, and then releases the local resources.
3.3 Paging
3.3.1 Paging Flow
A paging procedure varies with the object initiating the paging.
Figure 3-4 Paging Flow
UE NodeB DRNC SRNC CN
Condition：PAGING originated by CN
PAGING
Condition：UE in IDLE，PCH
PAGING TYPE 1
Condition：UE in DCH，FACH
PAGING TYPE 2
Condition：PAGING originated by RNC , on Iur interface

PAGING REQ
Condition：PAGING originated by RNC
Condition：UE in IDLE，PCH
PAGING TYPE 1
Condition：UE in DCH，FACH
PAGING TYPE 2
 Paging initiated by the CN that is broadcast through a Node B under the RNC
The RNC sends paging messages of PAGING TYPE1 to the UE in the Idle or PCH state,
and sends paging message of PAGING TYPE2 to the UE in the CELL_FACH or
CELL_DCH state.
when Paging is from PS CN, if the parameter UExtCelInfoFDD.discPsPagingSwi is 1,

RNC will discard randomly the paging according the ratio parameter
UExtCelInfoFDD.discScalPsPaging.

 Paging initiated by another RNC or the local RNC without spanning any Iur interface
The RNC sends paging messages of PAGING TYPE1 to the UE in the Idle or PCH state
and sends paging messages of PAGING TYPE2 to the UE in the CELL_FACH or
CELL_DCH state.
 Paging initiated by the local RNC, which must span an Iur interface
The RNC sends a Paging Request message through RNSAP to the DRNC, requesting
the DRNC to page the UE.
The Total Number of CN Paging per Second handled by the RNC is determined by the
DBS parameter URncInfo.cmpNumforPaging.
3.3.2 PAGING TYPE 1
When the UE is in the Idle or URA_PCH state, the RNC receives a paging message from
the CN and then sends the paging message of PAGING TYPE 1 over the PCH channel
to the UE. To improve the probability of receiving the paging message, the RNC
repeatedly sends the paging message of PAGING TYPE 1 to the UE. The maximum
number of retransmissions is determined by UCelInfoFDD. pagingSendTimesCs for CS
Domain and UCelInfoFDD.PagingSendTimesPs for PS Domain.
To improve the paging success rate, when all Paging Occasions (POs) are congested,
the RNC will find another available PO within OmCon.MaxPagSendTimer to send the
paging message over the PCH channel.
The PCH channel has a corresponding physical PICH channel. The Page Indicator (PI) is
transmitted over the PICH channel with each PI corresponding to a group of UEs. The
following lists the formula for calculating the PI:
PI = DRX Index mod Np
Where,
DRX Index = IMSI div 8192
Np = the number of PIs included in a PICH frame. It can be configured by

UCelInfoFDD.sccpchNp.

The UE checks whether it is being paged in the network by monitoring its own PI. Each
PICH frame can contain the PI of multiple UEs. The parameter Np, namely the number of
PIs included in a PICH frame, can be configured in each PICH frame. If the Np value is
larger, the transmit power of the PICH (PichPwr) is higher. The following table describes
the relationships between the parameter Np and the transmit power.
Table 3-2 Relation Between Np and Power
Number of
Number of PIs in Transmit Power of the PICH in
Repeated Bits in the
Each Frame Comparison with that of the CPICH
PICH
18 16 -7
36 8 -7
72 4 -5
144 2 -2
For the purpose of power saving, the UE in the Idle or PCH state monitors the PICH
channel in Discontinuous Reception (DRX) mode. In DRX mode, the UE detects the PI
once every DRX period. Each UE has its own PO. The UE monitors each PICH frame in
the corresponding SFN and detects its own PI in the frame according to the calculated PI.
Therefore, the RNC fills the PI in the message transmitted over the PICH channel
k
according to the PO of the UE. In the FDD system, a DRX period = 2 frames.
On the OMCR, three DRX cycle length coefficients can be configured: CS Domain DRX
Cycle Length Coefficient Kcs (defined by the parameter UCnInfo.Kcs), PS Domain DRX
Cycle Length Coefficient Kps (defined by the parameter UCnInfo.Kps), and UTRAN DRX
Cycle Length Coefficient KUntan (defined by the parameter URncFunction.KUtran).
The RNC calculates PO as follows:
 When the UE is in Idle mode, the RNC calculates K in the DRX period according to
Kcs, Kps, and DRX Cycle Length Coefficient in the paging message from the CN.
For paging messages from the CS domain, K = Min (Kcs, Kps).

For paging messages from the PS domain, if the CN adds DRX Cycle Length Coefficient
to the paging message, K = Min (Kcs, Kps, DRX Cycle Length Coefficient). If the CN
does not add DRX Cycle Length Coefficient to the paging message, K = Min (Kcs, Kps).
When the UE is in the PCH state, the RNC calculates K in the DRX period according to
Kcs, Kps, KUtran, and DRX Cycle Length Coefficient in the paging message from the
CN.
For paging messages from the CS domain, K = Min (Kcs, KUtran).
For paging messages from the PS domain, if the CN adds DRX Cycle Length Coefficient
to the paging message, K = Min (Kps, KUtran, DRX Cycle Length Coefficient). If the CN
does not add DRX Cycle Length Coefficient to the paging message, K = Min (Kps,
KUtran).
The following is the formula for calculating PO:
Paging Occasion = {(IMSI div N) mod (DRX cycle length div PBP)} * PBP + n * DRX cycle
length + Frame Offset
Where,
N = number of SCCPCH channels carried over the PCH in a cell.
DRX cycle length = 2k frame. K is calculated according to the above-mentioned method.
PBP = 1.
n = SFN.
When the broadcast system information is updated, the RNC sends the paging message
of PAGING TYPE 1 to the UE in the Idle or PCH state. At the moment, the system sends
PIs over the PICH channel during the DRX period. K = MAX (Kcs, Kps, KUtran).
For paging over PCH, when the RNC sends paging messages of Paging Type1 with
URNTI to the UE, paging1RspTimer (defined by the parameter URncFunction.
paging1RspTimer) is started in the case of PS paging, or PchCsPageRsdTimer (defined
the by parameter URncInfo.PchCsPageRsdTimer) is started in the case of CS paging.
When a Paging Response is received, paging1RspTimer or PchCsPageRsdTimer is

stopped. When paging1RspTimer expires, the RNC releases the RRC connection. When
PchCsPageRsdTimer expires, and PchCsPageRsdSwch is set to 1, the RNC sends
paging messages of Paging Type1 with IMSI/TMSI to the UE once again.
3.3.3 PAGING TYPE 2
When the UE is in the DCH or FACH state, the UTRAN initiates the paging procedure
and sends a paging message of PAGING TYPE 2 over the DCCH. The UTRAN
configures the paging cause in the message.
After the UE in the DCH or FACH state receives the message of PAGING TYPE 2, it
starts the paging reception procedure, and reports the paging cause and paging record
type identifier to the upper layer.
To Improve the success rate for concurrent domain service, when RNC receive a Paging
from CN, if UE is in IDLE status, RNC will cache this paging with 3s after sending paging
Type1. If RNC find the other domain’s RAB is established within 3s, RNC will send
Paging Type2 message.
If the parameter URncInfo.pt2DelayRrcRel is set to "1: On", the RNC delays the release
of the other CN domain connection when RNC is waiting for the UE's response of Paging
Type 2 of one CN domain.

3.4 NAS Message Transfer
3.4.1 NAS Message Forwarding Flow
Figure 3-5 NAS Message Forwarding Flow

UE CN
Initial direct transper

message Pr econdi t i on： RRC set up success
I NI TI AL DI RECT TRANSFER
RRC RRC
[ DCCH（ AM RLC RB3（ ]
Condi t i on（ wi t hout I u si gnal i ng connect i on
SCCP Li nk set up
Condi t i on（ wi t h I u si gnal i ng

connect i on
RANAP DI RECT TRANSFER RANAP
Uplink direct transper

UPLI NK DI RECT TRANSFER
RRC RRC
[ DCCH（ AM RLC RB3/ RB4（ ]
Downlink direct
transper
DOWNLI NK DI RECT TRANSFER

RRC RRC
[ DCCH（ AM RLC RB3/ RB4（ ]
The NAS message is forwarded in three occasions: initial direct transfer, uplink direct
transfer, and downlink direct transfer.
Initial direct transfer: When the RNC receives an INITIAL DIRECT TRANSFER message
from the UE, it establishes an Iu interface connection. For details of Iu interface
connection establishment, refer to the section "Setting Up the Iu Interface Connection".
Uplink direct transfer: The RNC receives an UPLINK DIRECT TRANSFER message
from the UE, forwards the information in the message to the CN, and then sends a
DIRECT TRASFER message to the CN.

Downlink direct transfer: The RNC receives a DIRECT TRASFER message from the CN,
forwards the information in the DIRECT TRASFER message to the UE, and transmits the
DOWNLINK DIRECT TRANSFER message to the UE.
3.4.2 Setting Up and Releasing an Iu Interface Connection
3.4.2.1 Setting Up an Iu Interface Connection
After the RRC connection is set up successfully, the UE sends a message to the RNC.
After receiving the message, the RNC initiates the setup of an Iu interface connection
between the RNC and the CN, and sends the initial NAS-PDU to the CN. See the
following Figure.
Figure 3-6 Setting Up an Iu interface Connection
UE RNC CN
RRC 【EP 】
INITIAL DIRECT TRANSFER RRC
Without Iu connection
NNSF
SCCP connection setup

（RANAP： INITIAL UE MESSAGE
）
：
Iu connection has already Setup
RANAP 【EP 】
DIRECT TRANSFER RANAP
After the RRC connection is set up, the UE sends an initial message to the RNC (for
details, refer to the section "NAS Message Transfer"). The RNC receives the direct
transfer message from the UE.
The RNC checks whether an Iu interface connection to the CN exists. If yes, the RNC
sends the direct transfer message to the CN. If not, the RNC acts as follows:
 If the RNC supports the Iu Flex function, it selects an available CN node through the
NAS Node Selection Function (NNSF). The RNC queries the status of the CN node
periodically at the interval of URncFunction.tcnquery. If the RNC does not support
the Iu Flex function, it selects the default CN node. For details, refer to the ZTE
UMTS Iu Flex Feature Guide.

 The RNC initiates a connection setup request to the selected CN node and sends
the initial direct transfer message to the CN. The SAI of the initial UE message
indicates the accessed cell or best cell based on the parameter
URncInfo.initUEFiDAcSai.
If the RNC serving as the DRNC receives a RELOCATION REQUEST message from the
CN, the DRNC sets up the RAB resources. After the completion of the setup, it sends a
RELOCATION REQUEST ACKNOWLEDGE message to the CN, and then sets up the Iu
interface connection.
3.4.2.2 Releasing an Iu Interface Connection
A service release, signaling release, or the Iu release request from the RNC may trigger
the release of an Iu interface connection. The release of an Iu interface connection may
be initiated by the CN or RNC. The Iu interface connection release initiated by the CN
involves two cases: Iu interface connection release caused by service release and Iu
interface connection release caused by signaling release. When the RNC receives an Iu
release command from the CN, the RNC starts the URncFunction.Tiureldelay timer.
When the timer times out, the RNC acts as follows:
 Iu interface connection release initiated by the CN
 The UE in the DCH state initiates a single service and then releases the
service, or the UE initiates multiple services and then releases all of the
services simultaneously .

Figure 3-7 Iu Interface Connection Release Initiated by a UE in the DCH State
UE Node B RNC CN
Iu Release Command
Iu CS service bearer release
Iu PS service bearer release
Iu Release Complete
Iu signaling bearer release
RRC connection release
RL release
The CN sends an IU RELEASE REQUEST message to the RNC. The RNC releases the
RAB resources and returns an IU RELEASE COMPLETE message to the CN.
The RNC releases the RRC connections, RB resources, and Iub Interface Radio Links. If
the UE is in the macro diversity status, the UE must notify the DRNC to release the radio
link (refer to the section "Releasing the Iu Interface Radio Link").
 The UE in the DCH state initiates CS and PS services and releases the CS or PS
service.

Figure 3-8 CS and PS Domain Services Are Provided Concurrently and the Service of
One Domain Is Released
UE Node B RNC CN
Iu Release Command
Iu CS or PS service bearer release
Iu Release Complete
RL reconfigure
RB release
Signaling connection release
The RNC reconfigures the radio link (for details, refer to the section "Reconfiguring the
Iub Interface Radio Link") and modifies the radio link configuration. The RNC then
releases the RB carrying the service.
The RNC sends a SIGNALING CONNECTION RELEASE message to the UE, notifying
the UE to release the signaling connection of the corresponding domain.
 The UE in the FACH state initiates a single service and then releases the service, or
the UE initiates multiple services and then releases all of the services
simultaneously.

Figure 3-9 Iu Interface Connection Release Initiated by a UE in the FACH State
UE Node B RNC CN
Iu Release Command
Iu Release Complete
The RNC releases the RRC connection and the RB resources.
 The UE in the PCH state initiates a single service and then releases the service, or
the UE initiates multiple services and then releases all of the services
simultaneously.
Figure 3-10 Iu Interface Connection Release Initiated by a UE in the PCH State
UE Node B RNC CN
Iu Release Command
Paging type 1
Cell update
Iu Release Complete
The CN sends an IU RELEASE REQUEST message to the RNC. The RNC initiates
paging by sending a paging message of PAGING TYPE 1 to the UE. After receiving the
paging message, the UE sends a CELL UPDATE message with the cause value of
Paging Response to the RNC. After receiving the CELL UPDATE message, the RNC
sends an IU RELEASE COMPLETE message to the CN.

The RNC releases the RRC connection.
 When the UE is in connected mode, it does not initiate any service. The CN requires
the release of the Iu interface connection (signaling release).
Figure 3-11 Iu Interface Connection Release Caused by Signaling Release
UE Node B RNC CN
Iu Release Command
Iu Release Complete
Condition： UE in DCH
RL release
The CN sends an IU RELEASE REQUEST message to the RNC. The RNC returns an IU
RELEASE COMPLETE message to the CN.
The RNC releases the RRC connection. The UE in the DCH state needs to release the
radio link.
 The RNC initiates the Iu interface connection release.
Figure 3-12 Iu Interface Connection Release Initiated by the RNC
UE Node B RNC CN
Condition：Signaling connection release originated by UE
Signaling Connection
Release Indication
Iu Release Request
Iu Release Command
Iu Release Complete
Signaling Connection Release

The RNC initiates the Iu interface connection release because the UE initiates signaling
connection release or the RNC detects the radio connection abnormality. This section
describes the Iu interface connection release caused by the UE signaling connection
release. For example, the UE performs a location update in the CS domain and route
update in the PS domain. When the location update or route update is finished, the UE
immediately notifies the RNC of signaling connection release. For the details of the Iu
interface connection release caused by the radio connection abnormality detected by the
RNC, refer to the section "Radio Connection Monitoring".
If the UE notifies the RNC of the release of a signaling connection, the UE sends a
SIGNALLING CONNECTION RELEASE INDICATION message to the RNC. When the
RNC receives the SIGNALLING CONNECTION RELEASE INDICATION message, if the
domain where the signaling connection is released is the only CN domain of the UE, the
RNC releases the RRC connection. Otherwise, the RNC sends an IU RELEAST
REQUEST message, requesting for the release of the Iu interface.
When the CN receives an IU RELEAST REQUEST message, if the CN determines to

release the Iu interface connection, it sends an IU RELEASE COMMAND message to
the RNC. The RNC returns an IU RELEASE COMPLETE message and releases the Iu
interface signaling bearer.
3.4.2.3 RESET and RESOURCE RESET
 RESET initiated by the CN
When the RNC receives a RESET message from the CN, the RNC releases all Iu
connections, and starts the Tratc timer (UIuCnst.Tratc). After the timer times out, the
RNC sends a RESET ACK response to the CN.
 RESOURCE RESET initiated by the CN
When the RNC receives a RESOURCE RESET message from the CN, the RNC
releases the Iu connections indicated by the message, and starts the tResetDelay
(UIuCnst.tResetDelay) timer. After the timer times out, the RNC sends a RESOURCE
RESET ACK response to the CN.
 RESET initiated by the RNC

When the OMCR initiates RESET, the RNC sends a RESET message to the CN, and
releases all Iu connections. Then the RNC starts the Trafc Timer (UIuCnst.Trafc). When
receiving a RESET ACK message from the CN, the RNC stops the Trafc Timer. If the
timer times out, the RNC resends the RESET message to the CN until the number of
retransmissions reaches the value of UIuCnst.nRepeatrst.
3.5 Security Mode Control
In a 3G system, the security mechanism is applied at multiple layers:
 Network access security provides secure access to the 3G network and prevents
attacks on radio links.
 Network domain security provides security protection for the signaling data
exchanged between nodes in the domain and prevents attacks against the radio
network.
 User domain security provides secure access measures for UEs.
 Application domain security provides secure information exchanges between users

and the domains providing services for service applications.
 Visibility and configurability of security allows users to know whether the security
measure is implemented. Whether the services are used and provided depends on
the security attributes.
The encryption and integrity protection are two security mechanisms for network access.
3.5.1 Security Mode Control Flow
The security mode control flow specifies the algorithms and parameters of the encryption
and integrity protection between the UE and the RNC. The CN sends a security mode
control message to the RNC to specify the algorithms and parameters of integrity check
and encryption. If the RNC finishes the procedure on the radio interface, the RNC sends
a SECURITY MODE COMPLETE message to the CN. Figure 3-13 shows the procedure
of RAN resource allocation.

Figure 3-13 Security Mode Control Flow
Source
UE CN
RNC
RANAP Security Mode Command（ EP（ RANAP
Condition （ arithmetic is not supported
RANAP Security Mode Reject（ EP（ RANAP
Condition （ arithmetic is supported
RRC Security Mode Command（ EP（ RRC
RRC Security Mode Complete（ EP（ RRC
RANAP Security Mode Complete（ EP（ RANAP
RRC Security Mode Failure（ EP（ RRC
RANAP Security Mode Reject（ EP（ RANAP
As shown in the above figure, the RNC receives a SECURITY MODE COMMAND
message from the CN. The message contains Integrity Protection Information and
Encryption Information, or Integrity Protection Information only. Integrity Protection
Information contains two parts: the integrity protection algorithm and integrity protection
key recommended by the CN. Two integrity protection algorithms are supported: UIA1
and UIA2. Encryption Information also contains two parts: the encryption algorithm and
encryption key recommended by the CN. There are three types of encryption algorithms:
no encryption, UEA1 and UEA2.
UEA1 and UIA1 are security algorithms in 3GPP phase 1. UEA2 and UIA2 are
introduced in 3GPP R7. Compared with the security algorithms of phase 1, UEA2 and
UIA2 support higher rates and efficiency and better security performance. The ZTE
UTRAN supports all of these security algorithms.
The control procedure of security mode is as follows:
When the RNC receives a SECURITY MODE COMMAND message from the CN,
the RNC selects security algorithms as follows:
 Encryption algorithm selection:

i The RNC checks whether it supports the encryption algorithm configured in the CN.
If not, the RNC returns the SECURITY MODE REJECT message to the CN. The
encryption algorithm can be configured by ULogicalRnc.encryAlgUEA0,
ULogicalRnc.encryAlgUEA1, and ULogicalRnc.encryAlgUEA2.
ii If there is an intersection between the encryption algorithms supported by the CN

and the RNC, the RNC selects the algorithms supported by both the CN and the RNC,
and keeps the priority queue of the algorithms recommended by the CN.
iii The RNC checks whether the UE supports the algorithm. If the RNC has no
capability information of the UE, it queries the capabilities of the UE. For details, refer to
the section "Querying a UE's Capability".
iv The RNC checks whether this is the first encryption algorithm selection of the UE in
this RNC:
If yes, the RNC selects the first algorithm that the UE supports from the encryption
algorithm intersection supported by the CN and the RNC. If the selection result is UEA0
or no intersection of algorithms exists among the CN, the RNC and the UE, the RNC
selects "no encryption".
If no, the RNC selects the encryption algorithm used for the UE.
 Integrity protection algorithm selection:
i. The RNC checks whether it supports the integrity protection algorithm

configured in the CN. If not, the RNC returns a SECURITY MODE REJECT
message to the CN. The integrity protection algorithm supported by the RNC
can be configured by ULogicalRnc.integrityAlgUIA1 and
ULogicalRnc.integrityAlgUIA2.
ii. If there is an intersection between the algorithms supported by the CN and the
RNC, the RNC selects the algorithms supported by both the RNC and the CN,
and keeps the priority queue of the algorithms recommended by the CN.
iii. The RNC checks whether the UE supports the algorithm. If the RNC does not
know the capabilities of the UE, it queries the capabilities of the UE. For details,
refer to the section "Querying a UE's Capabilities".

iv. The RNC checks whether the UE sets up a connection in another domain:
a) If the UE has a connection in another domain, the RNC selects the

integrity algorithm that is used for the UE in that domain.
b) If the UE has no connection in another domain, the RNC selects the first
algorithm from the encryption algorithm intersection supported by the UE,
CN and RNC.
 If the RNC and the UE support the encryption algorithm and integrity protection
algorithm configured in the CN, the RNC suspends the SRB entities except RB0
and RB2. After the RNC sends a SECURITY MODE COMMAND message to the
UE through SRB2, it then provides integrity protection for the downlink data carried
through SRB2.
 After the UE receives an encryption command, if the processing fails, the UE

returns a SECURITY COMMAND FAILURE message to the RNC. After receiving
the failure message, the RNC recovers the suspended SRBs and sends a
SECURITY COMMAND REJECT message to the CN.
 After the UE receives an encryption command, if the processing succeeds, the UE

returns a SECURITY COMMAND COMPLETE message to the RNC. After receiving
the SECURITY COMMAND COMPLETE message, the RNC recovers the
suspended SRBs and implements integrity protection and encryption for all uplink
and downlink signaling of all SRBs. The RNC returns the SECURITY COMMAND
COMPLETE message to the CN.
After the security mode is terminated, the encryption and integrity protection for the SRBs
are also terminated accordingly. The RNC implements encryption and integrity protection
for the signaling data carried in the SRBs.
The UE stores the encryption parameters and encryption algorithm obtained in the
security mode procedure. After a Data Radio Bearer (DRB) is set up, the UE encrypts the
DRB using the encryption parameters of the CS domain or PS domain.
If RNC does not receive a response within URncInfo.waitSmcTimer from the UE in the
security control procedure, the RNC releases the UE if URncInfo.secModeTimeoutOpSw

is 0, or the RNC send a SECURITY COMMAND REJECT message to the CN if

URncInfo.secModeTimeoutOpSw is 1.
If UE have only single Domain service, the IE “START” and “START list” may be sent to
RNC by UE, RNC will check the consistency of the two value, and take different active
based on the parameter URncInfo.uuStartValueSwch.
3.5.1.1 Querying a UE's Capabilities
The RNC sends a UE CAPABILITY ENQUIRY message to the UE to query the UE

capability information. After receiving the message, the UE sends a UE CAPABILITY
INFORMATION message containing the UE's capabilities. The RNC sends a UE
CAPABILITY INFORMATION CONFIRM message to the UE.
Figure 3-14 Querying a UE's Capabilities
Sour ce
UE
RNC
RRC UE Capability Enquiry RRC
RRC UE Capability Information RRC
RRC UE Capability Information Confirm RRC
As shown in the above figure, the RNC queries the UE capability in the following three
cases:
 When the RNC needs to know the UE's capabilities, it creates a UE CAPABILITY
ENQUIRY message and sends the message to the UE.
 If the UE is in connected mode and its capability information changes, the UE sends
a UE CAPABILITY INFORMATION message to the RNC.
The RNC receives the CAPABILITY INFORMATION message from the UE. The
information in the message includes the UE's protocol version (R99/R4/R5), whether
HS-PDSCH is supported, whether SCCPCH, DPCH, and HS-PDSCH are supported, the
downlink capability when the HS-DSCH is configured concurrently, the physical layer of

the SH-DSCH, and whether it is allowed to estimate the capability of the HS-PDSCH and
HS-SCCH according to the pilot frequency.
After the RNC stores the UE capability information, it creates a UE CAPABILITY

INFORMATION CONFIRM message and sends the message to the UE.
If the RNC does not receive a CAPABILITY INFORMATION message from the UE for
five seconds, it considers the UE capability information query as failed.
3.5.2 Encryption Algorithm and Parameters
3.5.2.1 Authentication and Key Generation
The authentication is intended to verify the key used in the encryption and integrity
protection. Through various algorithms and random numbers, the keys that are
consistent between the UE (or MS) and the UTRAN are generated, including encryption
keys (CKs) and integrity protection keys (IKs).
The VLR/SGSN initiates an authentication request to the HE/HLR. The HE/HLR

generates multiple authentication vectors. Through an authentication response, the
HE/HLR sends these authentication vectors to the VLR/SGSN. The VLR/SGSN saves
the authentication vectors, selects a vector, and initiates an authentication request to the
UE (or MS). The UE (or MS) calculates the CK, IK, and the return value RES according
to the parameters RAND and AUTN in the authentication request. The network
compares the return value RES from the UE (or MS) with the expected XRES and
checks whether they are the same. If yes, the authentication succeeds. The network also
selects the CK and IK that are the same as the UE (or MS).
3.5.2.2 Encryption Algorithm and Parameters
The encryption is done at the RLC layer (AM or IM mode) or the MAC layer (TM mode).
Currently, the encryption algorithms of the Uu interface of the 3G system have three
types: UEA0, UEA1 and UEA2. UEA0 means that the data of the Uu interface is not
encrypted. UEA1 means that the KASUMI algorithm based encryption algorithm f8 is
used. UEA2 means that the SNOW 3G algorithm based encryption algorithm f8 is used.

The parameters of encryption algorithm f8 include:
 Encryption key CK
 COUNT-C (varying with time)
 BEARER (bearer tag)
 DIRECTION (direction indication)
 LENGTH (block length required by the key stream)
 Original code stream
According to these parameters, the encryption algorithm generates a key block with a
specified length. The plain text can be encrypted into cipher text by an exclusive OR
operation with the encryption key. The cipher text can be decrypted into plain text by an
exclusive OR operation with the same encryption key. The following describes the
encryption and decryption procedures.
Figure 3-15 Encryption and Decryption Procedures
COUNT-C DIRECTION COUNT-C DIRECTION
BEARER LENGTH BEARER LENGTH
CK f8 CK f8
KEYSTREAM KEYSTREAM
BLOCK BLOCK
PLAINTEXT CIPHERTEXT PLAINTEXT

BLOCK BLOCK BLOCK
发送端接收端
Sender：UE/RNC Receiver：RNC/UE
UE 或 RNC RNC 或 UE
The encryption-related parameters can be obtained and configured as follows:
 COUNT-C:

 RB in AM mode: COUNT-C = HFN (20 bits) + SN (12 bits)
 RB in UM mode: COUNT-C = HFN (25 bits) + SN (7 bits)
 RB in TM mode: COUNT-C = HFN (24 bits) + CFN (8 bits)
During COUNT-C initialization, the HFN is the RLC hyper frame number (AM mode or
UM mode) or the MAC hyper frame number (TM mode). The value of HFN increases
once in every SN period or every Connection Frame Number (CFN) period. The initial
value of the HFN uses the first 20 bits of START to form the first 20 bits of the initial
COUNT-C, and the other bits are all 0s. The START value is sent by the UE to the RNC
through an uplink message (such as a CELL UPDATE message) over the Uu interface.
The RNC always stores the latest START provided by the UE. When a frame is
transmitted during data transmission, the value of the HFN will increase by SN (or CFN).
The value of COUNT-C generated in each transmission event varies.
 DIRECTION: Indicates the direction of the current encryption event. 0 represents

uplink, and 1 represents downlink.
 CK: encryption key generated in the authentication procedure.
BEARER: bearer tag. The tag corresponds to each RB. BEARER = RB ID – 1.
 LENGTH: Indicates the length of the key stream block.
 DATA: Specifies the data to be encrypted or decrypted.
3.5.3 Integrity Protection Algorithm and Parameters
Integrity protection is implemented at the RRC layer. The integrity protection function
supports the UIA1 and UIA2 algorithms. UIA1 indicates the KASUMI-based encryption
algorithm f9, and UIA2 indicates the SNOW 3G–based encryption algorithm f9. The
following figure shows the f9 algorithm.

Figure 3-16 f9 Algorithm for Integrity Protection
COUNT-I DIRECTION COUNT-I DIRECTION
MESSAGE FRESH MESSAGE FRESH
IK f9 IK f9
MAC -I XMAC -I
发送端
Sender：UE/RNC
接受端
Receiver：RNC/UE
UE 或 RNC RNC 或 UE
The input parameters of the algorithm include IK (integrity protection key), COUNT-I
(integrity SN), FRESH (random number generated in the network), DIRECTOR (direction
bit), and MESSAGE (signaling message). Based on these input parameters, the
transmitting end calculates the authentication code MAC-I by using the f9 algorithm.
MAC-I is added to the message and sent to the receiving end. After receiving the
message, the receiving end calculates XMAC-I in a similar way and compares it with the
received MAC-I for an integrity check.
The following describes the parameters of the algorithm:
Integrity SN: COUNT-I = HFN (28 bits) + SN (4 bits)
Similar to the COUNT-C in the encryption algorithm, the initial value of HFN consists of
the first 20 bits of the parameter START and the other bits are all 0s. The HFN increases
once in every RRC SN period.
The SN is a 4-bit RRC-SN. The RRC-SN can be obtained from each RRC PDU.
IK: integrity key. It is obtained in the authentication procedure.
FRESH: The FRESH parameter prevents users from using the signaling message
repeatedly. FRESH is a random number generated by the RNC. The FRESH varies with
different UEs. In security mode, the FRESH is sent to the UE.
DIRECTOR: direction bit. 0 represents the uplink, and 1 represents the downlink.

3.6 Radio Connection Monitoring
If the RNC detects that the radio connection between a UE and a network is broken due
to poor quality of the radio conditions or other causes, the RNC immediately releases all
resources allocated to the UE, including RB resources where services are distributed,
RRC resources, and the Iu interface connection.
The ZTE RAN supports monitoring radio connections in the following modes:
 The Node B monitors the RL status.
This mode is applicable to a UE in the DCH state. The Node B monitors the radio
link of the UE. The Node B starts the timer T_RLFAILURE (defined by the
parameter UUtranCellFDD.tRlFailure) after receiving NUMOUTSYNCIND (defined
by the parameter UUtranCellFDD.numOutSyncInd) consecutive out-of-sync
indications. The Node B stops and resets the timer T_RLFAILURE upon receiving
NumInSyncInd (defined by the parameter UUtranCellFDD.numInSyncInd)
successive in-sync indications. If T_RLFAILURE expires, the Node B triggers the
RL Failure procedure and indicates which radio link set is out of synchronization.
Figure 3-17 Radio Link Failure
CRNC Node B
RADIO LINK FAILURE INDICATION
If the cause value in the RADIO LINK FAILURE INDICATION message indicates that the
radio link is unrecoverable or the radio link is recoverable but the RNC does not receive
the RADIO LINK RESTORE INDICATION message within URncFunction.WaitRlRestore
seconds, the RNC considers that the radio link of the UE is broken.
 The RNC monitors the RLC connection status.

After the RRC connection is set up, if the RNC sends messages over the RLC layer but
does not receive responses from the UE, the RNC retransmits the message. If number of
retransmissions reaches 15, the RLC layer is reset. If the number of resets reaches 6,
the RNC considers that errors occur on the user plane.
The RNC monitors the RLC connections in AM mode. The ZTE RNC uses the AM mode
for the SRB. Through the function, the RNC can monitor all UEs in connected mode.
 The RNC monitors the CELL UPDATE message of the UE.
The UE in the DCH or FACH state sends the CELL UPDATE message to the RNC. The
value of the parameter AM_RLC error indication (RB2, RB3 or RB4) is TRUE.
The UE in the FACH state sends the CELL UPDATE message to the RNC. If the cause
value in the message is radio link failure or RLC unrecoverable error, when the RNC
receives the cell update message indicating the errors from the UE, the RNC considers
that the radio connection is broken.
 The RNC monitors the keeping alive duration of the UE.
If the RNC does not exchange any message or data with the UE in the FACH or PCH
state within the period of UUeCnst.T305 + 1 minute, the RNC considers that the radio
connection of the UE is broken.
When the RNC detects a broken radio connection of a UE by using any of the above
monitoring methods, it releases the RRC connection and radio resources and sends an
Iu connection release request through the Iu interface to the CN, notifying the CN to
release the RAB resources.
3.7 Iub Interface Radio Link Management
3.7.1 Establishing an Iub Interface Radio Link
In the following two cases, the system needs to set up radio links:
 RRC connection establishment over the DCH

 RRC connection establishment over the FACH and RAB establishment over
the DCH, HS-DSCH, or E-DCH.
The RNC controls radio link admission and allocates code resources before establishing
a radio link.
The RNC sends a RADIO LINK SETUP REQUEST message carrying dedicated channel
configuration parameters to the control port of the Node B.
The RNC receives the RADIO LINK SETUP RESPONSE message from the control port
of the Node B.
The RNC establishes a user plane bearer over a dedicated transport channel and shared
transport channel (if the bearer is used to carry the HSPA service) to the Node B. The
RNC establishes a transport bearer to the Node B and then implements node
synchronization and transport channel synchronization.
3.7.2 Reconfiguring the Iub Interface Radio Link
In the following cases, the system needs to reconfigure radio links:
 RRC connection establishment over the DCH and RAB establishment over the
DCH, E-DCH, or HS-DSCH
 RAB establishment over the DCH, E-DCH, or HS-DSCH, and RAB

reconfiguration over the DCH, E-DCH, or HS-DSCH
 First release of a service in the case of concurrent CS and PS services
1 RL reconfiguration preparation procedure
After radio link admission control and code resource allocation are completed and the
request for dedicated channel resources succeeds, the RNC sends a RADIO LINK
RECONFIGURATION PREPARE message to each Node B.
If the admission control or code resource allocation for a radio link fails when the RNC
requests channels for services, the radio link synchronization reconfiguration preparation
flow is terminated abnormally. If the channelization codes are already allocated, the RNC
releases the downlink channelization codes of the obtained channels.

If URncInfo.RecfgOptMacroDiv is 1, the RNC will consider the preparation as successful

when receiving a RADIO LINK RECONFIGURATION READY messages from any one of
NodeBs.
If URncInfo.RecfgOptMacroDiv is 0, the RNC will consider the preparation as successful

when receiving all RADIO LINK RECONFIGURATION READY messages from all of
NodeBs.
If the RNC receives a RADIO LINK RECONFIGURATION FAILURE message from a

Node B, the preparation for the reconfiguration of the Node B radio link fails. The RNC
only sends a RADIO LINK RECONFIGURATION CANCEL message to the Node Bs with
successful radio link reconfiguration preparation.
If the specified period expires when the RNC waits for a radio link reconfiguration
response from the Node Bs, the radio link reconfiguration preparation fails. The RNC
sends a RADIO LINK RECONFIGURATION CANCEL message to the Node Bs with
successful reconfiguration or reconfiguration timeout.
If the setup of any transport link fails, the radio link reconfiguration fails. The RNC sends
a RADIO LINK RECONFIGURATION CANCEL message to each Node B. The RNC
releases the newly-established user plane resources, links on the transport layer, and
downlink channelization code resources requested for all radio links.
The CFN value is calculated based on UCfnOffset.sigType, UCfnOffset.retranRate,

UCfnOffset.uuPktLenInd, and UCfnOffset.cfnOffset.
If URncInfo.CfnOffsetCompSwch is 1, the CFN value is also adjusted based on the

parameters URncInfo.CfnOffsetComp, UCelInfoFDD.cfnCompEcNoThrd, and
UCelInfoFDD.cfnCompRscpThrd
2 RL reconfiguration
If URncInfo.SyncRecfgSwch is 0, the RNC will send a RADIO LINK

RECONFIGURATION COMMIT message to the related Node Bs after a READY
message is received.

If URncInfo.SyncRecfgSwch is 1, the RNC will send a RADIO LINK

RECONFIGURATION COMMIT message to the related Node Bs when a RLC ACK is
received.
The RNC and Node Bs use the new configuration simultaneously.
3 RL reconfiguration cancellation
If the RNC determines that the radio link reconfiguration must be cancelled, it sends a
RADIO LINK RECONFIGURATION CANCEL message to the related Node Bs. The RNC
cancels the new configuration and recovers the original configuration.
3.7.3 Releasing an Iub Interface Radio Link
The RNC sends a Radio Link Deletion Request message to a Node B, notifying the Node
B to delete a radio link. The RNC receives a radio link deletion response from the Node B
and releases the resources of the deleted radio link.
3.8 Iur Interface Radio Link Management
3.8.1 Reconfiguring an Iur Interface Radio Link
The SRNC sends a Radio Link Reconfiguration Prepare message to the DRNC. The
DRNC prepares for the reconfiguration of the user plane and the Iub interface, and
returns a RADIO LINK RECONFIGURATION READY message to the SRNC.
After receiving the RADIO LINK RECONFIGURATION READY message, the SRNC
reconfigures the FP for the user plane.
After the completion of the reconfiguration preparation, the SRNC sends a RADIO LINK
RECONFIGURATION COMMIT message to the DRNC. After receiving the message, the
DRNC configures the user plane according to the message, and then sends a RADIO
LINK RECONFIGURATION COMMIT message to the Node B.
The SRNC and the DRNC simultaneously activate the new configuration of the radio
links and release the original configuration.

If the SRNC determines that it is necessary to cancel the Iur Interface radio link
reconfiguration, it first cancels the user plane FP configuration, deletes the transport
bearer, and sends a RADIO LINK RECONFIGURATION CANCEL message to the
DRNC. The DRNC receives the RADIO LINK RECONFIGURATION CANCEL
MESSAGE from the SRNC, cancels the reconfiguration task, deletes the transport
bearer, and then sends a RADIO LINK RECONFIGURATION CANCEL message to the
Node B.
3.8.2 Releasing an Iur Interface Radio Link
When receiving a radio link deletion message, the DRNC sends a radio link deletion
message to the Node B. The DRNC receives a radio link deletion success message from
the Node B, releases the transport bearer, and deletes the FP. The DRNC then sends a
radio link deletion success message to the SRNC.
3.9 RB Reconfiguration
During the RAB reconfiguration, the RNC modifies the existing RB. See the following
figure.
Figure 3-18 RB Reconfiguration
Source
UE
RNC
RRC Radio Bearer Reconfiguration RRC
Condition：RB reconfiguration success
RRC Radio Bearer Reconfiguration Complete RRC
Condition：RB reconfiguration
failed
RRC Radio Bearer Reconfiguration Failure RRC
Condition：RNC didn’t receive response message from UE after T1

second
Return the status

before RB
reconfiguration

As shown in the above figure, the RNC sends a RADIO BEAER RECONFIGURATION
message to the UE. The message contains the information about the RB to be
reconfigured, the transport channel, and the physical channel. After receiving the
message, the UE responds with a RADIO BEARER RECONFIGURATION COMPLETE
message. The RNC fills the information about the RB, the transport channel and the
physical channel in the RADIO BEAER RECONFIGURATION message according to the
existing channels of the UE and the channels to be set up for the UE.
The RNC sends the RADIO BEARER RECONFIGURATION message over the RRC
connection to the UE. The RNC receives the RADIO BEARER RECONFIGURATION
COMPLETE message from the UE.
If the RNC receives a RADIO BEARER RECONFIGURATION FAILURE message over

the RRC connection or does not receive any response from the UE within the period (unit:
seconds) specified by T1, the RNC restores the configuration for the user plane and
returns to the status before the RB reconfiguration. If the UE transits to CELL_DCH from
URA_PCH or CELL_FACH, T1 is determined by the parameter
URncFunction.tReCfgLevCmnStat. If the UE transits to CELL_FACH from CELL_FACH,
T1 is determined by the parameter URncFunction.tRbRecfgCmpDtoF. Otherwise, T1 is
set to 5 s.
during the RB setup procedure, if the source and target RRC status equal to FACH, the
RB SETUP message has been sent, the message has been confirmed by the RLC layer,
and the RNC is waiting for the RB SETUP COMPLETE message, when receiving the
CELL UPDATE message with cause "eRRC_CellUpdateCause_cellReselection", if the
parameter URncInfo.cuInFachRbStSwch is 1, the RNC will consider the RB setup
procedure successful and continue to execute the CELL UPDATE procedure.
3.10 Iu Overload Control
When the traffic on the Iu interface is overloaded, the RNC must perform overload control
to ensure the system stability.
When overload is detected, the CN sends a overload message to the RNC. The overload
message must include the Global CN-ID IE if the NNSF is enabled. The RNC performs
the operations as follows when receiving the overload message:

1. If the timer TigOR is not started, the RNC starts the timers TigOR and TinTR. TigOR is
defined by UIuCnst.tigOR, and TinTR is defined by UIuCnst.tinTR.
2. Before the expiry of TigOR, the RNC ignores the subsequent overload messages
sent by the CN.
3. If TinTR expires, the RNC determines that the CN is not overloaded any longer.
When the RNC receives an RRC connection setup request with a reason except
emergency call from the UE, the RNC first checks whether the CN is overloaded. If the
CN is overloaded and neither Iu Flex nor network sharing is enabled in the network (one
MSC node and one SGSN node) and the RNC is set to use RRC Reject to reduce the
system load, the RNC generates a random integer ranging from 1 to 100 with a random
function. If the integer is smaller than the RRC rejection proportion that is previously set
in the system, then RNC initiates RRC Reject. Otherwise, the RNC sets up an RRC
connection. During the NNSF procedure, the RNC shares the load among all CN nodes
that are reachable and not overloaded. If no CN node meets the condition for load
balancing, the RNC shares the load among the CN nodes that are reachable and
overloaded.
Figure 3-19 Iu Overload Control
RNC MSC Server
OVERLOAD
RNC SGSN
OVERLOAD

4 Parameters
4.1 ZWF21-01-001 System Information Broadcast
Table 4-1 System Information Broadcast Parameter List
Recom
Parameter Value Default mende
GUI Name Parameter Description Unit
Name Range Value d
Value
Maximum
Number of
This parameter indicates
Retransmissio
the maximum number of
ns of the RRC
URncFunct retransmissions of the
CONNECTIO 1..8 N/A 1 1
ion.n308 RRC CONNECTION
N RELEASE
RELEASE COMPLETE
COMPLETE
message.
Message
(N308)
0: Band I
1: Band II
2: Band
III
UUtranCell This parameter indicates 3: Band
Frequency
FDD.freqB the frequency band of the IV N/A - -
Band Indicator
andInd central frequency of a cell. 4: Band V
5: Band
VI
7: Band
VIII
PCCPCH
UUtranCell This parameter indicates
Information in
FDD.pccpc whether the PCCPCH 0: False;
SIB6 N/A TRUE TRUE
hInfSib6Pr Information is configured in 1: True
Configuration
e SIB6.
Tag
UUtranCell Dynamic This parameter indicates

0: False;
FDD.prach Persistence whether dynamic N/A FALSE FALSE
1: True
Sib6Pre Level persistence level

Recom
Name Range Value d
Value
Information of information of SIB6
SIB6 PRACH PRACH is configured in
in SIB7 SIB7.
Configuration
Tag

whether the RACH sub
channels in a cell are
consecutive. A 12-bit string
(111111111111) denotes
the sub channels are 0:
consecutive; Available
101010101010 or Subchan
010101010101 denotes nels of
the sub channels are Cell
configured every other Should
Cell Available
one. be
Subchannel
UUtranCell If this parameter is set to Noncons
Number
FDD.celAv "On", the actual available ecutive N/A N/A N/A
Continuity
aSubCha sub channel number is the 1:
Setting
configured Available
Indicator
"AvailSubChanNum". Subchan
If this parameter is set to nels of
"Off", the actual available Cell can
sub channel number is the be
calculation result of Consecut
bitwise-AND ive
"AvailSubChanNum &
(101010101010)" or
"AvailSubChanNum &
(010101010101)" with
maximum 1s.
This parameter is used to

AICH calculate the timing
UAich.aich
Transmission relationship between (0, 1) N/A N/A N/A
TranTime
Timing PRACH preambles,
between the PRACH

Recom
Name Range Value d
Value
preamble and PRACH
message, between AICH
and PRACH. In addition,
this parameter is used by
the UE to calculate the
effective sub-channel No.
available to ASC.

the mapping between AC
and ASC. AC is the access
level stored in UE IMSI.
ASC is the RACH access
level of PRACH physical
channel. Mapping of
UPrach.ac AC-to-ASC 0..7, step
Access Classes to Access N/A N/A N/A
2ASCMap Mapping 1
Service Classes will be
used in initial setup state.
And not be used in
connected state.
Where
MAX_AC_ASC_MAPPING
=7.
The effective signatures

assigned to each ASC of a
PRACH correspond to two
parameters: Available
signature Begin Index and
Available signature End
Available Index.
UPrach.asi 0..15,
Signature Their relation with N/A N/A N/A
gStIdx step 1
Begin Index Available Signature is:
After ordering the
configured Available
Signature (whose bit is 1)
in the ascending order
(such as, 2: 0; 5: 1; 12: 2),
the Available signature

Recom
Name Range Value d
Value
Begin Index and the
Index are the starting index
and ending index after
ordering. Range of
available signatures
(Available signature End
Index-Available signature
Begin Index + 1) of
different ASCs can overlap
each other. Generally
speaking, the higher level
the ASC is, the more
signatures it will be
configured.
Where MAX_ASC =8.
The effective signatures

assigned to each ASC of a
PRACH correspond to two
parameters: Available
signature Begin Index and
Index.
Their relation with
Available Signature is:
Available After ordering the
UPrach.asi 0..15,
Signature End configured Available N/A N/A N/A
gEndIdx step 1
Index Signature (whose bit is 1)
in the ascending order
(such as, 2: 0; 5: 1; 12: 2),
the Available signature
Begin Index and the
Index are the starting index
and ending index after
ordering. Range of
available signatures

Recom
Name Range Value d
Value
(Available signature End
Index-Available signature
Begin Index + 1) of
different ASCs can overlap
each other. Generally
speaking, the higher level
the ASC is, the more
signatures it will be
configured.
Where MAX_ASC =8.

the allocated sub-channel
number for each ASC of
the PRACH. This allocated
sub-channel number can
not be used directly, and
Assigned
UPrach.as after repeating according Bit string
Subchannel N/A N/A N/A
ubChNum to the configured AICH (4)
No.
transmission timing, doing
‘and’ operation with
Available Sub Channel
Number then the actual
value is obtained.
Where MAX_ASC =8.

PRACH the minimum effective
UPrach.av
Available spreading factor that this Bitstring
ailSubCha N/A N/A N/A
Subchannel PRACH can use (limiting (12)
nNum
Number the maximum rate that the
PRACH can transmit).

Initial the initial dynamic
UPrach.dy
Dynamic persistence level used by 1..8, step
nPstLevelI N/A N/A N/A
Persistence the MAC layer to calculate 1
nit
Level the transmission possibility
for the ASCi>=1. Each

Recom
Name Range Value d
Value
PRACH is configured with
one value. The dynamic
persistence level of
several PRACHs allocated
to UE can be broadcast
together in SIB7.
The UE can send access

preamble again if not
Maximum receiving any responses
UPrach.ma Number of from AICH. This parameter
1..64,
xPreamRet Preamble indicates the maximum N/A N/A N/A
step 1
rans Being number that the access
Transmitted preamble can be sent
before L1 receives ACK or
NACK.

the maximum times for
re-sending attempts on
MAC layer. The PRACH
physical layer, L1, returns
three status to MAC layer
when accessing the
physical layer according to
Maximum
the actual cases: ACK
Number of
UPrach.m (acknowledged), NOACK 1..32,
Preamble N/A N/A N/A
max (Node B does not step 1
Ramping
response), and NACK
Cycles
(unacknowledged). When
the MAC layer receives
NACK or NO ACK, adds
the attempt times, M, by 1.
When M is over this
parameter, the MAC layer
exits from the access
process.
UPrach.perPermitted This parameter indicates 1.. N/A N/A N/A

Recom
Name Range Value d
Value
mitMaxAS Maximum the permitted number of MAX_AS
C Access access services for the C, step 1
Service Class PRACH. It sets the size of
the following three arrays:
Available signature Begin
Index, Available signature
End Index and Assigned
Sub-Channel No.

the power ramp step used
by the UE when it does not
PRACH receive any responses
UPrach.pR Preamble from AICH after sending a (1..8)dB,
dB N/A N/A
Step Power Ramp preamble. This parameter step 1dB
Step is used to be added to the
previous power, and then
the next preamble is sent
at this new power.
This parameter is used by

the MAC layer to calculate
the transmission possibility
UPrach.pS Persistence 0.9..0.2,
for the access service N/A N/A N/A
F Scaling Factor step 0.1
class whose ASC is not
less than 2. Where
MAX_ASC_PSF =6.

Persistence the number of the ASCs 0..
UPrach.psf
Scaling Factor which are configured MAX_AS N/A N/A N/A
Num
Number persistence scaling C_PSF
factors.

all effective signatures
UPrach.sig Available when the PRACH is used. Bitstring
N/A N/A N/A
nature Signature 16 bit represents 16 (16)
signatures; the bit which
equals 1 means the

Recom
Name Range Value d
Value
corresponding signature is
valid. Each signature
corresponds one by one to
the channelization code
number of PRACH whose
SF is 16.

0: Not
whether to use IMSI attach
Apply
and detach procedure.
IMSI
TRUE: When the UE is
Attach
switched off or the SIM
and 1:Apply 1:Apply
card is unplugged, it sends
Detach IMSI IMSI
an IMSI detach message
IMSI Attach Procedur Attach Attach
UCnInfo.att to the network side. When
and Detach e; 1: N/A and and
IndCs the UE is switched on, if
Indicator Apply Detach Detach
the UE is still in the
IMSI Proced Proced
registration district where it
Attach ure ure
is deactivated, the UE shall
and
apply IMSI attach to the
Detach
location register.
Procedur
Otherwise, the UE does
e
reguler location register.
0: CS
Domain
This parameter indicates 1: PS 2: CS 2: CS
UCnInfo.cn CN Domain
the CN domain supported Domain N/A +PS +PS
Domain Supported
by PLMN. 2: CS Domain Domain
+PS
Domain
This parameter indicates 0:

1:Netw 1:Netw
the whether the Gs Network
ork ork
interface (between the Mode of
UCnInfo.n Network Mode Mode Mode
MSC server and the Operation N/A
moPs of Operation of of
SGSN) is available. I; 1:
Operati Operati
Network operation mode 1 Network
on II on II
indicates that the Gs Mode of

Recom
Name Range Value d
Value
interface is available, while Operation
Network Operation Mode 2 II
indicates that the Gs
interface is not available.
When the Gs interface is
available, the CN can
support the LA/RA
combined update, which
means, when the UE with
a CS connection trigger
attaching to the SGSN, the
SGSN
will trigger the location
update procedure of CS
domain.

the value of the timer that
controls the periodic
location update. The OMCR:
location update occurs in ( 0,
Timer for the system due to two 0.1..25.5)
Periodic reasons: 1. UE finds the hours,
UCnInfo.t3
Location location area has changed step hours 1hour 1hour
212Cs
Update (different LAC). 2. the 0.1hour
(T3212) network specifies that the RNC:
MS should update the D=P*10
location periodically. The (0..255)
T3212 controls the time
duration for updating the
location periodically.
Maximum This parameter indicates

Number of the maximum number of
Retransmissio retransmissions of the
UUeCnst.n
ns of the RRC RRC CONNECTION (0..7) N/A 3 3
300
CONNECTIO SETUP REQUEST
N REQUEST message.
Message The UE starts the timer

Recom
Name Range Value d
Value
(N300) T300 after transmitting the
RRC CONNECTION
SETUP REQUEST
message. If the timer
expires, the UE
retransmits the RRC
CONNECTION SETUP
REQUEST message. If the
number of retransmissions
of this message is greater
than N300, the UE enters
Idle mode.

retransmissions of the
CELL UPDATE/URA
UPDATE message.
Maximum
A UE starts the timer T302
Number of
after transmitting the CELL
Retransmissio
UPDATE/URA UPDATE
UUeCnst.n ns of the
message. If the timer (0..7) N/A 2 2
302 CELL/URA
expires, the UE
UPDATE
retransmits the CELL
Message
UPDATE/URA UPDATE
(N302)
message. If the number of
retransmissions of this
message is greater than
N302, the UE enters Idle
mode.

Maximum
Number of
retransmissions of the UE
Retransmissio
UUeCnst.n CAPABILITY
ns of the UE (0..7) N/A 2 2
304 INFORMATION message.
CAPABILITY
A UE starts the timer T304
INFORMATIO
after transmitting the UE
N Message
CAPABILITY

Recom
Name Range Value d
Value
(N304) INFORMATION message.
If the timer expires, the UE
retransmits the UE
CAPABILITY
INFORMATION message.
If the number of
N304, the UE initiates a
CELL UPDATE procedure
due to a radio link failure.
OMCR:
(1[0],
2[1], 4[2],
Maximum
10[3],
Number of "In This parameter indicates
20[4],
Sync" the maximum number of
50[5],
UUeCnst.n Received from the "In Sync" indications
100[6],
312Conne L1 in successively received from N/A 1 1
200[7],
cted Connected layer 1 in Connected mode
400[8],
Mode (N312 before the timer
600[9],
in Connected T312Connected expires.
800[10],
Mode)
1000[11])
; RNC:
(0..11)
OMCR:
(1[0],
2[1], 4[2],
Maximum
This parameter indicates 10[3],
Number of "In
the maximum number of 20[4],
Sync"
UUeCnst.n the "In Sync" indications 50[5],
Received from N/A 1 1
312Idle successively received from 100[6],
L1 in Idle
layer 1 in Idle mode before 200[7],
Mode (N312
the timer T312Idle expires. 400[8],
in Idle Mode)
600[9],
800[10],
1000[11])

Recom
Name Range Value d
Value
; RNC:
( 0..11)

the "Out of Sync"
indications successively
received by a UE from
layer 1. OMCR:
In CELL_DCH state, the (1[0],
Maximum UE starts the timer T313 if 2[1], 4[2],
Number of it consecutively receives 10[3],
UUeCnst.n Successive N313 "Out of Sync" 20[4],
N/A 50 50
313 "Out of Sync" indications from layer 1. 50[5],
Received from During the running of 100[6],
L1 (N313) T313, the UE stops and 200[7]);
resets the timer T313 if it RNC:
successively receives (0..7)
N315 "In Sync" indications
from layer 1. If the timer
T313 expires, the UE
considers it as a "Radio
link failure".

OMCR:
(1[0],
the "In Sync" indications
2[1], 4[2],
Maximum successively received by a
10[3],
Number of UE from layer 1 during the
20[4],
Successive time period when the timer
50[5],
"In Sync" T313 is activated.
UUeCnst.n 100[6],
Received from In CELL_DCH state, the N/A 1 1
315 200[7],
L1 During UE starts the timer T313 if
400[8],
T313 is it consecutively receives
600[9],
Activated N313 "Out of Sync"
800[10],
(N315) indications from layer 1.
1000[11])
During the running of
; RNC:
T313, the UE stops and
(0..11)
resets the timer T313 if it

Recom
Name Range Value d
Value
successively receives
N315 "In Sync" indications
from layer 1. If the timer
considers it as a "Radio
link failure".

the time period for a UE to
wait after it sends the RRC
CONNECTION SETUP
REQUEST message.
The UE starts the timer
T300 after transmitting the
OMCR:
RRC CONNECTION
(100[0],
SETUP REQUEST
200[1],
400[2],
expires, the UE
600[3],
retransmits the RRC
800[4],
Waiting Time CONNECTION SETUP
1000[5],
After UE REQUEST message. If the
1200[6],
Sending RRC number of retransmissions
UUeCnst.t 1400[7], 2000m 2000m
CONNECTIO of this message is greater ms
300 1600[8], s s
N REQUEST than N300, the UE enters
1800[9],
Message Idle mode.
2000[10],
(T300)
3000[11],
Start: This UE timer is
4000[12],
started when the RRC
6000[13],
CONNECTION REQUEST
8000[14])
message is transmitted for
ms, RNC:
reasons other than MBMS
(0..14)
reception.
Stop: This UE timer is
stopped when the RRC
CONNECTION SETUP
Expiry: If the number of

Recom
Name Range Value d
Value
RRC CONNECTION
REQUEST message is
less than N300, the RRC
CONNECTION REQUEST
message is retransmitted;
otherwise, the UE enters
Idle mode.

wait after it sends the
CELL/URA UPDATE
message.
T302 after transmitting the OMCR:
CELL UPDATE/URA (100[0],
UPDATE message. If the 200[1],
timer expires, the UE 400[2],
retransmits the CELL 600[3],
UPDATE/URA UPDATE 800[4],
Waiting Time
message. If the number of 1000[5],
After UE
retransmissions of this 1200[6],
Sending
UUeCnst.t message is greater than 1400[7], 1000m 1000m
CELL/URA ms
302 N302, the UE enters Idle 1600[8], s s
UPDATE
mode. 1800[9],
Message
2000[10],
(T302)
Start: This UE timer is 3000[11],
started when the CELL 4000[12],
UPDATE/URA UPDATE 6000[13],
message is transmitted. 8000[14])
Stop: This UE timer is ms; RNC:
stopped when the CELL ( 0..14)
UPDATE/URA UPDATE
CELL UPDATE/URA
UPDATE message is less

Recom
Name Range Value d
Value
than N302, the CELL
UPDATE/URA UPDATE
message is retransmitted;
otherwise, the UE enters
Idle mode.

wait after it sends the UE
CAPABILITY
T304 after transmitting the
UE CAPABILITY
If the timer expires, the UE
retransmits the UE
CAPABILITY
INFORMATION message. OMCR:
Waiting Time
If the number of (100[0],
After UE
retransmissions ofthis 200[1],
Sending UE
UUeCnst.t message is greater than 400[2], 2000m 2000m
CAPABILITY ms
304 N304, the UE initiates a 1000[3], s s
INFORMATIO
CELL UPDATE procedure 2000[4])
N Message
due to a radio link failure. ms; RNC:
(T304)
( 0..4)
started when the UE
CAPABILITY
INFORMATION message
is transmitted.
stopped when the UE
CAPABILITY
INFORMATION CONFIRM
retransmissions of the UE

Recom
Name Range Value d
Value
CAPABILITY
INFORMATION message
is less than N304, the UE
CAPABILITY
INFORMATION message
is retransmitted; otherwise,
the UE initiates a cell
update procedure.

the time period for
Cell/URA update when a
UE is in
CELL_FACH/CELL_PCH/
URA_PCH state.
If the timer T305 expires
and the UE detects the
OMCR:
"out of service area"
( No
indication, the UE starts
update[0]
the timer T307.
Period of , 5[1],
Cell/URA 10[2],
Update When 30[3],
started when the UE
UUeCnst.t UE is in 60[4],
enters CELL_FACH, min 5min 5min
305 CELL_FACH/ 120[5],
URA_PCH, or CELL_PCH
CELL_PCH/U 360[6],
state, or when the CELL
RA_PCH 720[7])mi
UPDATE CONFIRM/URA
State (T305) nutes,
UPDATE CONFIRM
RNC:
(0..7),
step 1
stopped when the UE
enters CELL_DCH or Idle
state.
Expiry: If the timer T307 is
not activated and the UE
detects the "in service
area" indication, the UE
transmits the CELL

Recom
Name Range Value d
Value
UPDATE message.
Otherwise, if the timer
T307 is not activated, the
UE starts it.

attempt to re-enter a
service area after it is out
of service.
If the timer T305 expires
and the UE detects the
"out of service area"
indication, the UE starts
the timer T307. During the
OMCR:
running of the timer T307,
(5[0],
if the UE detects the "in
Waiting Time 10[1],
service area" indication, it
for Cell 15[2],
stops this timer. If the timer
UUeCnst.t Reselection 20[3],
T307 expires, the UE s 30s 30s
307 After UE is out 30[4],
enters Idle mode.
of Service 40[5],
(T307) 50[6])s ,
RNC:
( 0..6)
started when the timer
T305 expires and the UE
detects the "out of service
area" indication.
stopped when the UE
detects the "in service
area" indication.
Expiry: If this timer expires,
the UE enters Idle mode.
Waiting Time This parameter indicates OMCR:

UUeCnst.t After Sending the time period for a UE to (40[0],
ms 40ms 40ms
308 RRC wait after it sends the RRC 80[1],
CONNECTIO CONNECTION RELEASE 160[2],

Recom
Name Range Value d
Value
N RELEASE COMPLETE message in 320[3])m
COMPLETE CELL_DCH state. s, RNC:
Message in The UE starts the timer (0..3)
CELL_DCH T308 after transmitting the
State (T308) RRC CONNECTION
RELEASE COMPLETE
expires, the UE
retransmits the RRC
CONNECTION RELEASE
COMPLETE message. If
the number of
N308, the UE enters Idle
mode.

started when the RRC
CONNECTION RELEASE
COMPLETE message is
transmitted.
Stop: This UE timer is not
stopped.
RRC CONNECTION
RELEASE COMPLETE
message is less than
N308, the RRC
CONNECTION RELEASE
COMPLETE message is
retransmitted; otherwise,
the UE enters Idle mode.
Waiting Time This parameter indicates

UUeCnst.t (1..8)s ,
After the time period for a UE to s 8s 8s
309 step 1s
Requesting wait after it sends the

Recom
Name Range Value d
Value
Connection request for connection
Establishment establishment in other
in Other systems (for example,
System (eg. GSM).
GSM) (T309)
started when the CELL
CHANGE ORDER FROM
UTRAN message is
received.
stopped when the UE
receives a successful
response to the connection
establishment request
from other systems.
Expiry: The UE resumes
the connection to UTRAN.

the waiting time for a UE to
receive "In Sync"
indications from layer 1 in
connected mode.
In Connected mode,
Waiting Time
before establishing
for Receiving
dedicated CHs, the UE
"In Sync" from
UUeCnst.t should consecutively
L1 in (1..15)s ,
312Conne receive N312Connected s 1s 1s
Connected step 1s
cted "In Sync" indications from
Mode (T312 in
layer 1 before the timer
Connected
T312Connected expires.
Mode)

started when the UE starts
to establish dedicated
CHs.

Recom
Name Range Value d
Value
stopped when the UE
detects N312 "In Sync"
indications from layer 1.
Expiry: The criteria for
physical channel
establishment failure are
fulfilled.

the UE timer in idle mode.
In Idle mode, before
establishing a dedicated
channel, the UE should
receive consecutive
N312Idle "in sync"
Waiting Time indications from L1 before
for Receiving the T312Idle expires.
UUeCnst.t "In Sync" from Start: When the UE starts (1..15)s,
s 2s 2s
312Idle L1 in Idle to establish a dedicated step 1s
Mode (T312 in CH, the timer is started.
Idle Mode) Stop: When the UE detects
N312 "in sync" indications
from L1, the timer is
stopped.
Expiry: When the criteria
for physical channel
establishment failure are
fulfilled, the timer expires.

the UE timer.
Waiting Time
In CELL_DCH state, after
After DPCCH
receiving N313
Established in
UUeCnst.t consecutive "out of sync" (0..15)s ,
CELL_DCH s 3s 3s
313 indications from L1, the UE step 1s
State Losing
should start T313. During
Synchronizati
the running of T313, upon
on (T313)
receiving N315 successive
"in sync" indications from

Recom
Name Range Value d
Value
L1, the UE should stop and
reset timer T313. If timer
should consider it as a
"Radio link failure".
Start: When the UE

detects consecutive N313
"out of sync" indications
from L1, the timer is
started.
Stop: When the UE detects
consecutive N315 "in
sync" indications from L1,
the timer is stopped.
Expiry: When the criteria
for Radio Link failure are
fulfilled, the timer expires.

the UE timer.
Start: When the criteria for

radio link failure are
Waiting Time
fulfilled, the timer is started OMCR:
for
if radio bearers that are (0[0],
Completion of
associated with T314 exist, 2[1], 4[2],
Cell Update
or if RRC connection exists 6[3], 8[4],
UUeCnst.t When Radio
only in the CS domain. 12[5], s 4s 4s
314 Link Fails and
Stop: When the Cell 16[6],
Radio Bearer
Update procedure has 20[7])s;
(s) Associated
been completed, the timer RNC:
with T314
is stopped. (0..7)
Exist (T314)
Expiry: If timer T302 is
running, the UE should
continue awaiting CELL
UPDATE CONFIRM or
URA UPDATE CONFIRM

Recom
Name Range Value d
Value
message from UTRAN.
If timer T302 is not running
and timer T315 is running,
the UE should release
radio bearers that are
associated with T314.
If timers T302 and T315
are not running, UE should
release all its radio
resources and enter Idle
mode.

the UE timer.
Start: When the criteria for

radio link failure are
fulfilled, the timer is started
if radio bearers that are
associated with T314 exist,
OMCR:
Waiting Time or if RRC connection exists
(0[0],
for only in the PS domain.
10[1],
Completion of Stop: When the Cell
30[2],
Cell Update Update procedure has
60[3],
UUeCnst.t When Radio been completed, the timer
180[4], s 30s 30s
315 Link Fails and is stopped.
600[5],
Radio Bearer Expiry: If timer T302 is
1200[6],
(s) Associated running, the UE should
1800[7])s
with T315 continue awaiting CELL
; RNC:
Exist (T315) UPDATE CONFIRM or
(0..7)
URA UPDATE CONFIRM
message from UTRAN. If
timer T302 is not running
and timer T314 is running,
the UE should release
radio bearers that are
associated with T315.
If timers T302 and T314

Recom
Name Range Value d
Value
are not running, UE should
release all its radio
resources and enter Idle
mode.

the UE timer.
Start: When the UE

detects "out of service
area" in URA_PCH or OMCR:
Waiting Time
CELL_PCH state, the (0[0],
for Cell
timer is started. 10[1],
Selection/Res
Stop: When the UE detects 20[2],
election After
UUeCnst.t "in service area", the timer 30[3],
UE is out of s 0s 0s
316 is stopped. 40[4],
Service in
Expiry: The UE initiates the 50[5],
CELL_PCH/U
cell update procedure if "in Infinity[6]
RA_PCH
service area" is detected. )s, RNC:
State (T316)
Otherwise the UE starts (0..6)
timer T317, and transits to
CELL_FACH state. The
UE initiates the cell update
procedure when it detects
"in service area".

the minimum number of
neighboring GSM cells in
Filtering Limit the SIB. Based on this
UCelInfoF
of GSM parameter, the RNC
DD.gsmNb 0..32 N/A 5 5
Neighboring ensures that the minimum
rNumLimit
Cell Number number of neighboring
GSM cells can be
broadcast when GSM cells
should be excluded.
UCelInfoF Filtering Limit This parameter indicates

0..32 N/A 5 5
DD.interNb of the minimum number of

Recom
Name Range Value d
Value
rNumLimit Inter-Frequen inter-frequency
cy neighboring cells in the
Neighboring SIB. Based on this
Cell Number parameter, the RNC
ensures that the minimum
number of inter-frequency
neighboring cells can be
broadcast when
inter-frequency
neighboring cells should
be excluded.
The parameter indicates

the Button of Updating SIB
UCelInfoF The Button of completely.If the value of
0:Reset
DD.btnOfU Upating SIB the parameter is modified, N/A 0 0
1:Set
ptSIBCmp completely RNC will update all SIB of
the correponding cell
completely .

the switch of filtering the
incomplete neighboring
cells in SIB.If the value of
the parameter is 1 (On),
RNC will filter the
Switch of neighboring cells
URncFunct
Filtering the configured incompletely in
ion.fltIncm 0:Off
incomplete SIB .If the value of the N/A 1 1
pNbrCelSw 1:On
Neighboring parameter is 0 (Off), RNC
it
Cells in SIB will be unable to get the
information of the
neighboring cells
configured incompletely in
SIB successfully and will
fail to send SIB
information.
UCelInfoF SIB18 When the number of 0:Off N/A 0: Off 0: Off

Recom
Name Range Value d
Value
DD.sib18In Indicator neighboring cells and the 1:On
d number of PLMNs are
large, the length of a
broadcast message may
exceed the upper limit
because of SIB18
broadcast, and leads to
broadcast failure. This
parameter indicates
whether SIB18 is
broadcast in the cell.

whether the configured
0:
resource for PRACH
Random-
preamble part is used for
access in
the random access of R99
Type of R99
Uprach. or common E-DCH
PRACH 1: N/A N/A N/A
prachType services. If both R99
Preamble Random-
services and common
access in
E-DCH services are
Common
required in the cell, both
E-DCH
types of PRACH preamble
should be configured.
4.2 ZWF21-01-002 Connection Setup and Release
Table 4-2 Connection Setup and Release Parameters List
Recom
Name Range Value d
Value
URncFunct Maximum This parameter indicates 1..10 N/A 3 3

Recom
Name Range Value d
Value
ion.nReTra Number of the maximum number of
n Retransmissio times that the RRC
ns of the RRC CONNECTION RELEASE
CONNECTIO message is retransmitted.
N RELEASE
Message
Band I:
10562..1
0838
Band II:
9662..99
38, 412,
437, 462,
487, 512,
537, 562,
587, 612,
637, 662,
687
the central frequency of
Band III:
the downlink carrier used
1162..
by a cell. It is a UTRA
UUtranCell 1513
absolute radio frequency
FDD.uarfc DUARFCN Band V: N/A - -
channel No., indicating the
nDl 4357…
central frequency of the
4458,
carrier used on the
1007,
downlink channel of the
1012,
cell.
1032,
1037,
1062,
1087
Band VI:
4387 …4
413,
1037,
1062
Band VIII:
2937..30

Recom
Name Range Value d
Value
88
0xff
means
invalid.
Band IV:
1537..
1738,188
7, 1912,
1937,
1962,
1987,
2012,
2037,
2062,
2087
Band I:
9612..98
88
Band II:
9262..95
38, 12,
This parameter indicates 37, 62,
the central frequency point 87, 112,
of the uplink carrier used 137, 162,
by a cell. It is the UTRA 187, 212,
UUtranCell
absolute radio frequency 237, 262,
FDD.uarfc UUARFCN N/A - -
channel No., 287
nUl
corresponding tothe Band III:
central frequency of the 937..128
carrier used on the uplink 8
channel of the cell. Band
IV:1312..
1513,166
2, 1687,
1712,
1737,
1762,

Recom
Name Range Value d
Value
1787,
1812,
1837,
1862
Band V:
4132..42
33, 782,
787, 807,
812, 837,
862
Band VI:
4162 …
4188,
812, 837
Band VIII:
2712 ..28
63

specifies the UE waiting
time for the repeated
Wait Time for
accessing request after the
RRC
UCelInfoF UE receives the RRC (0..15)s,
Connection s 5s 5s
DD.twait CONNECTION REJECT step 1s
Reestablishm
message.
ent
This parameter is carried
in the RRC CONNECTION
REJECT message and
sent to the UE.
Maximum
URncFunct Number of
maximum number of
ion.rrcSetu Retransmissio
retransmissions of the 0..10 N/A 2 2
pRetraNu ns of the RRC
RRC CONNECTION
m CONNECTIO
SEUTP message
N SETUP
URncFunct Interval of This parameter indicates 0..100, 100ms 700ms 700ms

Recom
Name Range Value d
Value
ion.tRrcSet Retransmissio the value of the timer that step 1;
upRetran n of RRC specifies the RNC waiting Unit:
CONNECTIO time for the response after 100ms
N SETUP the RNC sends an RRC
CONNECTION SETUP
message.
The timer is started when
the RNC sends an RRC
CONNECTION SETUP
message, and stopped on
receipt of an RRC
CONNECTION SETUP
COMPLETE message sent
by the UE.
At expiry of this timer, if the
number of RRC
CONNECTION SETUP
retransmissions has not
exceeded the
RrcSetupRetraNum (the
threshold value), the RNC
will resend the RRC
CONNECTION SETUP
message. Otherwise, the
RNC will release the RRC
connection of this UE.

specifies the RNC waiting
Time of time for the response of
1..200,
URncFunct Waiting for the RADIO LINK 100 100
step 1;
ion.tWaitRl RADIO LINK RESTORE INDICATION 100ms (100ms (100ms
Unit:
Restore RESTORE message. ) )
100ms
INDICATION There are three application
scenarios as follows:
1. If the RNC receives a
RADIO LINK SETUP

Recom
Name Range Value d
Value
RESPONSE message
from the NodeB/DRNC,
the RNC should wait for
the RADIO LINK
RESTORE INDICATION
message from the
NodeB/DRNC.
RADIO LINK ADD
RESPONSE message
and the added RL belongs
to a new RlSet, the RNC
should wait for the RADIO
LINK RESTORE
INDICATION message
from the NodeB/DRNC.
RADIO LINK FAILURE
INDICATION message
and the failure cause is
synchronisation_failure or
not_enough_user_plane_p
rocessing_resources, the
RNC should wait for the
RADIO LINK RESTORE
INDICATION message
from the NodeB/DRNC.

Time of the value of the timer that
Waiting for is used to wait for the 10...100,
URncFunct
RRC completion of RRC step 1;
ion.tRrcCo 100ms 50 50
CONNECTIO connection setup. Unit:
nSetupExp
N The timer is started when 100ms
COMPLETE the RNC sends an RRC
CONNECTION SETUP

Recom
Name Range Value d
Value
message.
The timer is stopped when
the RNC receives an RRC
CONNECTION SETUP
COMPLETE message.
At expiry of the timer, the
Radiolink is released.
0: 3.4K
Signalling
1: 13.6K
Signalling
This parameter indicates 2: 27.2K
0: 3.4K 0: 3.4K
UCfnOffset Signalling the signaling type for which Signalling
N/A Signalli Signalli
.sigType Service Type a CFN offset needs to be 3: 6.8K
ng ng
configured. Signalling
4:
HS-DSC
H
channel
Data This parameter indicates

Retransmissio the data retransmission
UCfnOffset 0,10,20,5
n Rate Factor rate factor over the Uu % 0 0
.retranRate 0,70,100
over Uu interface corresponding to
Interface the CFN offset.
0:Not
More
than 32
Byte
This parameter indicates [0, 1, 2, [0, 1, 2,
Packet Length 1:Greater
UCfnOffset the size range of packets 3, 4, 5, 3, 4, 5,
Type Indicator than 32
.uuPktLenI over the Uu interface N/A 6, 7, 8, 6, 7, 8,
over Uu Byte and
nd corresponding to the CFN 9, 10, 9, 10,
Interface Not More
offset. 11, 12] 11, 12]
than 80
Byte
2:Greater
than 80

Recom
Name Range Value d
Value
Byte and
Not More
than128
Byte
3:Greater
than 128
Byte and
Not More
than176
Byte
4:Greater
than 176
Byte and
Not More
than 224
Byte
5:Greater
than 224
Byte and
Not More
than 272
Byte
6:Greater
than 272
Byte and
Not More
than 320
Byte
7:Greater
than 320
Byte and
Not More
than 368
Byte
8:Greater
than 368
Byte and

Recom
Name Range Value d
Value
Not More
than 416
Byte
9:Greater
than 416
Byte and
Not More
than 464
Byte
10:Great
er than
464 Byte
and Not
More
than 512
Byte
11:Great
er than
512 Byte
and Not
More
than 560
Byte
12:Great
er than
560 Byte
[56, 72, [56, 72,

87, 96, 87, 96,
111, 111,
120, 120,
the CFN offset, which is
135, 135,
UCfnOffset CFN Offset used to indicate the
0..255 144, 144,
.cfnOffset Value activation time during the
159, 159,
synchronization
171, 171,
reconfiguration procedure.
183, 183,
195, 195,
207] 207]

Recom
Name Range Value d
Value

the admission control
threshold of the number of
users for the CMP board in
normal operating state.
If the parameter is set to 0,
the threshold is invalid,
meaning that the
admission control based
on the number of users is
CMP User
not required.
URncFunct Admission
If the parameter is set to a (0~65535 V3: 480 V3: 480
ion.norCm Control
non-zero value, the )times, times V4: V4:
pUserAcTh Threshold in
number of RRC step 2000 2000
d Normal
connection requests 1times
Running
admitted by the CMP
board per second cannot
exceed this threshold.
If the number of RRC
connection requests
received by the CMP
board per second exceeds
this threshold, the extra
part will be directly
refused.

the admission control
threshold of the number of
DMP User users for the DMP board in
URncFunct Admission normal operating state.
(0~65535
ion.norDm Control If the parameter is set to 0, V3: 120 V3: 120
)times, times
pUserAcTh Threshold in the threshold is invalid, V4: 100 V4: 100
step
d Normal meaning that the
1times
Running admission control based
on the number of users is
not required.
If the parameter is set to a

Recom
Name Range Value d
Value
non-zero value, the
number of RRC
connection requests
admitted by the DMP
board per second cannot
exceed this threshold.
If the number of RRC
connection requests
received by the DMP
board per second exceeds
this threshold, the extra
part will be directly
refused.
This parameter is a switch

that determines whether
the send RL SETUP and
RRC CONNECTION
SETUP in parallel over the
Iub and Uu interfaces
during RRC connection
Switch of
setup.
RNC Send RL
When the switch is turned
SETUP and
on, the RNC sends an
RRC
RRC CONN SETUP
URncFunct CONNECTIO
message over the Uu 0:Off
ion.parallel N SETUP in N/A 0:Off 0:Off
interface and an RL 1:On
RrcSetup Parallel when
SETUP message over the
Setting up
Iub interface in parallel
RRC
during the RRC connection
CONNECTIO
setup procedure if the
N
DCH is used as the
signaling bearer. The
parallel message
transmission reduces the
delay during RRC
connection setup.
When the switch is turned

Recom
Name Range Value d
Value
off, the RRC connection
setup procedure is
performed in sequence,
meaning that the RNC
sends an RRC CONN
SETUP message over the
Uu interface only after
successful RL setup on the
Iub interface.
0: RRC
URncInfo.r R5 and above R5 and above UE RRC release
0: RRC 0: RRC
5PchRrcR UE RRC release mode in PCH 1: direct N/A
release release
elMode release mode status. paging
release
Switch of CFN
The switch control the
offset
URncInfo. function that optimising of
Optimization 0:Off
CfnOfSigO CFN offset Optimization N/A 0: Off 0: Off
when signal 1:On
nHspaSw when signal on HSPA
on HSPA
channel.
channel

whether the CELL deal
with the optimitzation for
synchronisation
reconfiguration .
In the synchronisation
UCelInfoF Switch of reconfiguration procedure,
DD.SyncR Reconfigurati RNC delay sending 0:Off
N/A 0: Off 0: Off
ecfgCellSw on Procedure RadioLinkReconfiguration 1:On
ch Optimization Commit message until the
RNC confirm the UE
receive the Radio Bearer
control message, when the
userplane receive the RLC
ACK of Radio Bearer
control message from the

Recom
Name Range Value d
Value
UE.

CPICH EcN0 Threshold for
CFN offset compensation.
UCelInfoF CPICH EcN0
If the CPICH EcN0 report
DD.cfnCo Threshold for
by UE is below the -24..0 dB -24 -24
mpEcNoTh CFN offset
threshold, then RNC add a
rd compensation
compensation value
to the current CFN offset
value.

RSCP Threshold for CFN
offset compensation.
UCelInfoF RSCP
If the RSCP report by UE
DD.cfnCo Threshold for
is below the (-120..-25 dBm -120 -120
mpRscpTh CFN offset
Threshold,then RNC add a )dBm
rd compensation
compensation value
value.

10,10,1 10,10,1
CFN offset compensation
5,15,15 5,15,15
URncInfo.c CFN offset value.
,20,20, ,20,20,
fnOffsetCo compensation The value is bigger, the 0..255 frames
20,25,2 20,25,2
mp value CFN offset is bigger;
5,30,30 5,30,30
The value is smaller, the
,40 ,40
CFN offset is smaller.

switch for the CFN offset
compensation function.
Switch for
URncInfo.c If the CPICH EcN0 report
CFN offset 0: Off
fnOffsetCo by UE is below the N/A 0: Off 0: Off
compensation 1: On
mpSwch threshold,then RNC add a
function
compensation value
value.

4.3 ZWF21-01-003 Paging
Table 4-3 Paging Parameter List
Recom
Name Range Value d
Value
Sending
UCelInfoF This parameter indicates
Times of
DD.paging the maximum number of
Paging 1..6 N/A 3 3
SendTimes times for sending a paging
Message of
Cs message of CS.
CS
Sending
UCelInfoF This parameter indicates
Times of
DD.Paging the maximum number of
Paging 1..6 N/A 2 2
SendTimes times for sending a paging
Message of
Ps message of PS.
PS

the CS domain DRX cycle
length coefficient.
This parameter is used for
the difficult reception of UE
in the idle mode and
Cell_PCH / URA_PCH
mode. This parameter is
CS Domain
used to calculate the
UCnInfo.kc DRX Cycle
paging occasion, that is, a 6..9 N/A 6 6
s Length
constant required in
Coefficient
monitoring the PICH cycle.
The difficult reception
cycle is 2^k frames.
In the idle mode, if UE has
attached in CS domain and
PS domain, then k is the
minimum value in CS
domain DRX cycle length

Recom
Name Range Value d
Value
coefficient, PS domain
DRX cycle length
coefficient. If UE has
attached only in one
domain (CS domain or PS
domain), then k is attached
coefficient.
In the connection mode, k
is the minimum value in
CS domain DRX cycle
length coefficient, PS
coefficient, and UTRAN
DRX cycle length
coefficient.

the PS domain DRX cycle
length coefficient, used for
UE DRX in both idle mode
and Cell_PCH/URA_PCH
mode.
calculating the paging
occasion (meaning a
PS Domain
constant required in the
UCnInfo.kp DRX Cycle
cycle for listening to 6..9 N/A 6 6
s Length
PICHs). The DRX cycle is
Coefficient
2^k frames.
In the idle mode, if UE has
attached in CS domain and
PS domain, then k is the
minimum value of the CN
domain specific DRX cycle
length coefficient between
CS domain and PS
domain.

Recom
Name Range Value d
Value
If UE has attached only in
one domain (CS domain or
PS domain), then k is DRX
cycle length coefficient in
the attached domain.
In connected mode, the
UE selects the minimum of
"UTRAN DRX cycle length
coefficient" and "CN
domain specific DRX cycle
length coefficient" of the
domain where the attach
operation has been
performed.

the discontinuous
reception of UE in the
connection mode. This
parameter is used to
calculate the paging
occasion, that is, a
constant required in
UTRAN DRX monitoring the PICH cycle.
URncFunct
Cycle Length The discontinuous 3..9 N/A 6 6
ion.kUtran
Coefficient reception cycle is 2k
frames. In the connection
mode, k is the minimum
value in CS domain DRX
cycle length coefficient, PS
coefficient, and UTRAN
DRX cycle length
coefficient.
Number of This parameter indicates

UCelInfoF
Paging the number of PI (18, 36,
the
DD.sccpch N/A 18 18
Indicators per (Paging Indicator) that one 72, 144)
Np
PICH Frame PICH radio frame for PCH

Recom
Name Range Value d
Value
for PCH contains.The larger Np,
the lower the repetition of
each PI, and the higher
power is needed.

that how many CMP
The number modules can handle
URncInfo.c
of CMP for PAGING message for V3:4 V3:4
mpNumfor 1..128 N/A
handling IU/IUR.Value 1 indicate the V4:1 V4:1
Paging
paging Paging message is handled
by the CMP with transport link
which receive the paging
Switch of CS
URncInfo. This parameter indicates
Paging 0: Off
PchCsPag the switch for CS paging N/A 0: Off 0: Off
Resend in 1: On
eRsdSwch resending in PCH status.
PCH Status
Timer of CS
URncInfo. This parameter indicates
Paging
PchCsPag the timer for CS paging 1..255 100ms 16 16
Resend in
eRsdTimer resending in PCH status.
PCH Status

URncFunct Paging Type1
the timer for the RNC to (1~60)s,
ion.paging Response s 5 5
receive the response to a step 1s
1RspTimer Timer
Type 1 Paging message.
OmCon.M Iu Paging
axPagSen Repetition Iu Paging Repetition Timer 0..65535 Ms 5000 5000
dTimer Timer
The parameter is a
UExtCelInf The Switch of function switch. It controls
oFDD.disc Discarding the whether directly discarded 0: Off
N/A 0 0
PsPagingS PS Paging paging messages from PS 1: On
wi message domain, and not send in
cell.
UExtCelInf The Scale of This parameter indicates

0..100 % 50 5
oFDD.disc Discarded Ps the proportion of discarded

Recom
Name Range Value d
Value
ScalPsPag Paging PS paging message.
ing Messages

whether or not the RNC
supports the function of
Paging Type 2 delay RRC
Release procedure.
Switch of If this parameter is set to
Paging Type 2 "1: On", the RNC delays
URncInfo.p
Message the release of the other CN 0: Off
t2DelayRrc N/A 1: On 1
Delay RRC domain connection when 1: On
Rel
Release RNC is waiting for the UE's
Procedure response of Paging Type 2
of one CN domain.
If this parameter is set to
"0: Off", the RNC does not
delay the release of the
other CN domain.
4.4 ZWF21-01-004 NAS Message Transfer
Table 4-4 NAS Message Transfer Parameter List
Recom
Name Range Value d
Value
Filling SAI
corresponding
RNC supports filling SAI
URncInfo.i with CELL 0: 0:
corresponding to at least 0: False
nitUEFiDA consuming N/A False False
one of the cells from which 1:True
cSai radio
the UE is consuming radio
resources
resources.
Indicator

Recom
Name Range Value d
Value

the number of times that
the RESET message is
retransmitted.
After the RNC transmits a
RESET message to the
CN, if it fails to receive the
RESET ACKNOWLEDGE
Maximum
message within the time of
Number of
"Maximum Waiting Time
UIuCnst.n Retransmissio
for RESET in RNC", the 1..5 N/A 3 3
Repeatrst ns of the
RNC retransmits the
RESET
RESET message. If the
Message
number of times that the
RESET message is
retransmitted exceeds the
maximum times, the RNC
terminates the process
and reports the failure to
the operation and
maintenance system.

the timer for State Query.
When in FAIL status, the
URncFunct
Timer for CN Monitor Module should
ion. 10..6000 100ms 1800 1800
State Query check the signaling point
tcnquery
and user service status
periodically according to
timer Tcnquery.
This parameter specifies

the maximum time for
Maximum
waiting for the reset
UIuCnst.tR Waiting Time
procedure in the RNC. (1..120)s, s 8s 8s
afc for RESET in
After the RNC transmits a step 1s
RNC
RESET message to the
CN, if it fails to receive the

Recom
Name Range Value d
Value
RESET ACKNOWLEDGE
message within the time of
"Maximum Waiting Time
for RESET in RNC", the
RNC retransmits the
RESET message. If the
number of times that the
RESET message is
transmitted exceeds the
maximum times, the RNC
terminates the process
and reports the failure to
the operation and
maintenance system.
This parameter specifies a

guard period in the RNC
before the RNC transmits
a RESET
Timer Before ACKNOWLEDGE
Sending message to the CN.
UIuCnst.tR (5..60)s,
RESET After the guard period of s 18s 18s
atc step 1s
Response to TRatC seconds, a RESET
CN ACKNOWLEDGE
message is returned to the
CN, indicating that all
references at the UTRAN
have been cleared.
This parameter specifies a

guard period in the RNC
Timer for
before sending a RESET
Sending
RESOURCE
UIuCnst.tR RESOURCE
ACKNOWLEDGE 50..600 100ms 80 80
esetDelay RESET
message.
Response to
After guard period
CN
Tresetdelay, a RESET
RESOURCE

Recom
Name Range Value d
Value
ACKNOWLEDGE
message is returned to the
CN, indicating that all
references at the UTRAN
have been cleared.

the time delay for releasing
the resources in the Iu
interface.
Time1 indicates the time
point that the RNC
receives the CN
DOWNLINK DIRECT
TRANSFER message or
the UE UPLINK DIRECT
TRANSFER message, and
Time2 indicates the time
point that the RNC
receives the IU RELEASE
URncFunct Timer for IU COMMAND message from
ion.tiurelde Release CN. 1..50 100ms 3 3
lay Resource If
Time2-Time1>=IuRelDelay
, then the RNC will release
the Iu interface resource
after receiving the IU
RELEASE COMMAND
message. If
Time2-Time1<IuRelDelay,
the RNC will set a timer
whose value is
IuRelDelay-
(Time2-Time1), and
release Iu resources after
the timer expires.

Recom
Name Range Value d
Value

Preference
ULogicalR whether the RNC is
For A Certain 0: Off
nc.perferE allowed to give preference N/A 0 0
Encryption 1: On
ncryAlgSw to a specific encryption
Algorithm
algorithm.
ULogicalR Encryption This parameter indicates 0:UEA0

nc.perferE Algorithm for the encryption algorithm 1:UEA1 N/A 0 0
ncryAlg Preference that the RNC prefers. 2:UEA2
4.5 ZWF21-01-005 Ciphering Algorithms UEA0 and

UEA1
Table 4-5 Ciphering Algorithm Parameter List
Recom
Name Range Value d
Value
ULogicalR Encryption This parameter indicates

nc.encryAl Algorithm encryption algorithm 1 that 0, 1 N/A 1 1
gUEA1 (UEA1) the RNC supports.


Improvement This parameter indicates

URncInfo.s
Switch for improvement switch for 0: Off
ecModeTi N/A 0: Off 0: Off
Security Mode Security Mode Response 1: On
meoutOpS
Response message timeout in Uu

Recom
Name Range Value d
Value
w Timeout in Uu interface when there are
interface two connections in Iu
interface.
If the switch is Off, the
RNC release the UE when
Security Mode Response
message timeout in Uu
interface when there are
two connections in Iu
interface.
If the switch is Off, the
RNC send Security Mode
reject to the CN when
Security Mode Response
message timeout in Uu
interface when there are
two connections in Iu
interface.
0: Uu
START
IE and
START
list IE
should
Switch of have the
URncInfo.u Choosing Uu same
Switch of choosing Uu
uStartValu START Value value N/A 1 1
START value for single
eSwch for Single 1: choose
domain.
Domain Uu
START
list value
2: choose
Uu
START
value
URncInfo. Time of This parameter indicates 1..100 s 5 5

Recom
Name Range Value d
Value
waitSmcTi Waiting for the time of waiting for SMC
mer SMC response over Uu
Response interface.
over Uu
Interface
4.6 ZWF21-01-006 Integrity Protection Algorithm UIA1
Table 4-6 Integrity Protection Algorithm Parameter List
Recom
Name Range Value d
Value
0: Not
This parameter indicates a
Integrity Supporte
ULogicalR switch that controls
Protection d UIA1
nc.integrity whether the RNC supports N/A 1 1
Algorithm 1:
AlgUIA1 the integrity protection
(UIA1) Supporte
algorithm UIA1.
d UIA1
0: Not
Integrity Supporte
ULogicalR switch that controls
Protection d UIA2
nc.integrity whether the RNC supports N/A 0 0
Algorithm 1:
AlgUIA2 the integrity protection
(UIA2) Supporte
algorithm UIA2.
d UIA2

4.7 ZWF21-01-007 Radio Connection Monitoring
Table 4-7 Radio Connection Monitoring Parameter List
Recom
Name Range Value d
Value
When the radio link set is

The Number
in the out-of-sync state,
of
after receiving
Consecutive
N_INSYNC_IND
In-Sync
successive in-sync
Indications
indications Node B shall
NodeB
UUtranCell trigger the RL Restore
Received 1..256,
FDD.numI procedure and indicate N/A 4 4
After which step 1
nSyncInd which radio link set has
RL Restore
re-established
Procedure
synchronization. When the
Shall be
RL Restore procedure is
Triggered
triggered, the state of the
(N_INSYNC_I
radio link set change to the
ND)
in-sync state.

in the in-sync state, Node
The Number
B shall start timer
of
T_RLFAILURE after
Consecutive
receiving
Out-of-Sync
N_OUTSYNC_IND
Indications
consecutive out-of-sync
NodeB
UUtranCell indications. Node B shall
Received 1..256,
FDD.numO stop and reset timer N/A 70 70
After which step 1
utSyncInd T_RLFAILURE upon
the Timer
receiving successive
T_RLFAILUR
N_INSYNC_IND in-sync
E Shall be
indications. If
Started
T_RLFAILURE expires,
(N_OUTSYN
Node B shall trigger the RL
C_IND)
Failure procedure and
indicate which radio link

Recom
Name Range Value d
Value
set is out-of-sync. When
the RL Failure procedure is
out-of-sync state.

in the in-sync state, Node
B shall start timer
T_RLFAILURE after
Timer Length receiving
for Trigger N_OUTSYNC_IND
Radio Link consecutive out-of-sync
Failure indications. Node B shall
Procedure stop and reset timer
After NodeB T_RLFAILURE upon
UUtranCell (0..25.5)s
Receive receiving successive
FDD.tRlFai , step s 4 4
N_OUTSYNC N_INSYNC_IND in-sync
lure 0.1s;
_IND indications. If
Consecutive T_RLFAILURE expires,
Out-of-Sync Node B shall trigger the RL
Indication Failure procedure and
(T_RLFAILUR indicate which radio link
E) set is out-of-sync. When
the RL Failure procedure is
out-of-sync state.

4.8 ZWF21-30-031 Direct Tunnel
Table 4-8 Direct Tunnel Parameter List
Recom
Name Range Value d
Value
UIupsLink.
Support DT 0:off
SupportDT Support DT Switch N/A 1:on 1:on
Switch 1:on
Switch
4.9 ZWF21-01-019 Faster L1 Synchronization
Table 4-9 Faster L1 Synchronization Parameter List
Recom
Name Range Value d
Value

whether the faster L1 DCH
synchronization function is
enabled.
If this function is enabled,
the RNC fills the
Post-verification period IE
Switch of
with TRUE during the DCH
URncFunct Faster L1
synchronization 0: Off 0: Off 0: Off
ion.fastL1S DCH N/A
procedure,which instructs 1: On
yncSwch synchronizatio
the UE to perform faster L1
n
DCH synchronization.
If this function is disabled,
the RNC does not set the
Post-verification period IE
during the DCH
synchronization
procedure.

4.10 ZWF21-01-009 SIB11bis
Table 4-10 SIB11bis Parameter List
Recom
Name Range Value d
Value

whether cell information is
broadcast in SIB11 or
SIB11bis. If the number of
neighboring cells exceeds
UUtranRel Broadcast in 0: SIB11
the limit of SIB11,
ation.sb11 either SIB11 1: N/A 0 1
neighboring cells with
orSib11bis or SIB11bis SIB11bis
higher priorities are
broadcast in SIB11, and
lower priorities are
broadcast in SIB11bis.

whether cell information is
broadcast in SIB11 or
SIB11bis. If the number of
neighboring cells exceeds
UGsmRela Broadcast in 0: SIB11
the limit of SIB11,
tion.sib11o either SIB11 1: N/A 0 1
rSib11bis or SIB11bis SIB11bis
higher priorities are
broadcast in SIB11, and
lower priorities are
broadcast in SIB11bis.

4.11 Common Parameters
Table 4-11 Common Parameter List
Recom
Name Range Value d
Value

Wait Time for the time period when an
RADIO RNC waits to receive the
BEARER RADIO BEARER
URncFunct
RECONFIGU RECONFIGURATION
ion.tRbRec (1..60)s, 15
RATION COMPLETE message s 15
fgCmpDto step 1s
COMPLETE from the air interface when
F
when the RNC initiates a
CELL_DCH to reconfiguration for a UE to
CELL_FACH transfer from CELL_DCH
to CELL_FACH.
Wait time for

RECONFIGU
the SRNC waiting time for
RATION
URncFunct the RECONFIGURATION
COMPLETE
ion.tReCfg COMPLETE message (1..60)s,
when UE s 5 5
LevCmnSt from the UE when the UE step 1s
leaving PCH
at leaves PCH or FACH state
or FACH state
and enters CELL_DCH
to enter CELL
state.
_DCH state

whether the RNC deal with
the optimitzation for
synchronization
Switch of
URncInfo. reconfiguration.
Reconfigurati 0:Off
SyncRecfg In the synchronization N/A 0: Off 0: Off
on Procedure 1:On
Swch reconfiguration procedure,
Optimization
RNC delay sending
RadioLinkReconfiguration
Commit message until the
RNC confirm the UE

Recom
Name Range Value d
Value
ACK of Radio Bearer
UE.
The switch control

optimising for
synchronization
reconfiguration procedure
in RAB SETUP case.
In the existing
synchronization
reconfiguration procedure,
only all RLS in the
Switch of ActiveSet reconfiguration
Reconfigurati success, the
URncInfo.
on Procedure reconfiguration procedure 0:Off
RecfgOptM N/A 0: Off 0: Off
Optimization can 1:On
acroDiv
with Macro consider as success; if part
Diversity of RLS reconfiguration fail,
then the reconfiguration
procedure consider as fail.
ZTE optimise the
procedure: in the RAB
SETUP procedure, if part
of RLS reconfiguration fail,
the reconfiguration
procedure can be
continued.

UCelInfoF Switch of whether the CELL deal
DD.syncRe Reconfigurati with the optimitzation for 0:Off
N/A 0: Off 0: Off
cfgCellSwc on Procedure synchronisation 1:On
h Optimization reconfiguration .
In the synchronisation

Recom
Name Range Value d
Value
reconfiguration procedure,
RNC delay sending
RadioLinkReconfiguration
Commit message until the
RNC confirm the UE
ACK of Radio Bearer
UE.
Timer for This parameter indicates

Ignoring all the timer for ignoring
OVERLOAD OVERLOAD messages or
Messages or signaling point congestion
UIuCnst.tig
Signalling information .When this (0..255)s, s 60 60
OR
Point timer is enabled, all step 5s
Congested OVERLOAD messages or
Information signaling point congestion
(TigOR) information are ignored.

timer. When this timer is
Timer for Not enabled, traffic cannot be
UIuCnst.tin Allowing to increased.
(0..300)s, s 100 100
TR Increase When this timer is enabled,
step 10s
Traffic (TinTR) the traffic cannot be
increased in the RNC
system.
Switch of This parameter indicates

Processing Switch of processing CELL
CELL UPDATE message during
URncInfo.c
UPDATE RB SETUP in FACH 0:Off
uInFachRb N/A 0 1
Message procedure. 1:On
StSwch
during RB 1: During the RB setup
SETUP in procedure, if the source
FACH and target RRC status

Recom
Name Range Value d
Value
Procedure equal to FACH, the RB
SETUP message has
been sent, the message
has been confirmed by the
RLC layer, and the RNC is
waiting for the RB SETUP
COMPLETE message,
when receiving the CELL
UPDATE message with
cause
"eRRC_CellUpdateCause
_cellReselection", the
RNC will consider the RB
setup procedure
successful and continue to
execute the CELL
UPDATE procedure.
0: During the RB setup
procedure, if the source
and target RRC status
equal to FACH, the RB
SETUP message has
been sent and has been
confirmed by the RLC
layer, and the RNC is
waiting for the RB SETUP
COMPLETE message,
when receiving the CELL
UPDATE message with
cause
"eRRC_CellUpdateCause
_cellReselection", the
RNC will consider the RB
setup procedure fail,
cancel the procedure and
then execute the CELL
UPDATE procedure.

5 Related Counters and Alarms
5.1 Related Counters
Table 5-1 Counter List
C310080001
C310080002
C310080003
C310080004
C310080005
C310080006
C310080007
C310080008
C310080009
C310080010
C310080011
C310080012
Number of attempted RRC connection establishment,by
C310080013
cause
C310080014
C310080015
C310080016
C310080017
C310080018
C310080019
C310080020
C310080021
C310080022
C310080023
C310080024
C310080025

C310080026
C310080027
C310080028
C310080029
C310080030
C310080031
C310080032
C310080033
C310080034
C310080035
C310080036
C310080037
C310080038
C310080039
C310080040
C310080041
C310080042
C310080043
C310080044
C310080045
C310080046
C310080047 Number of attempted RRC connection establishment,by

C310080048 CallType
C310080049
C310080050
C310080051

C310080053 Domain
C310080054

C310080056 UE Capability

C310080058 UE AS Release
C310080059
C310080060
C310080061
C310080062
C310080063
C310080064
C310080065
C310080066
C310080067
C310080068
C310080069
C310080070
Number of RRC connection preparation failure,by fail
C310080071
cause
C310080072
C310220073
C310220074
C310220075
C310080076
C310080077
C310080078
C310080079
C310080080
C310080081
C310080082
C310080083
C310080084 Number of RRC connection preparation failure,by

C310080085 establishment cause
C310080086
C310080087
C310080088
C310080089

C310080090
C310080091
C310080092
C310080093
C310080094
C310080095
C310080096
C310080097
C310080098
C310080099
C310080100
C310080101
C310080102
Number of RRC connection preparation failure,by call
C310080103
type
C310080104
C310080105 Number of RRC connection preparation failure,by

C310080106 domain
C310080107
Number of RRC connection Refuse for Conversational Call
C310080108
C310080109
Number of RRC connection Refuse for Voice
C310080110
C310080111 Number of RRC connection preparation success,by

C310080112 Channel type
C310080113
C310080114
C310080115
C310080116
Number of RRC connection preparation success,by
C310080117
Direct
C310080118
C310080119
C310080120
C310080121

C310080122
C310080123
C310080124
C310080125
C310080126
C310080127
C310080128
C310080129
C310080130
C310080131
C310080132
C310080133
C310080134
C310080135
C310080136
C310080137
C310080138
C310080139
C310080140
C310080141
C310080142
C310080143
C310080144
C310080145
C310080146
C310080147
C310080148
C310080149
C310080150
C310080151
C310080152
C310080153

C310080154
C310080155
C310080156
C310080157
C310080158
C310080159
C310080160
C310080161
C310080162
C310080163
C310080164
C310080165
C310080166
C310080167
C310080168 Number of RRC access fail,by fail cause
C310080169
C310080170
C310080171
C310080172
C310080173
C310080174
C310080175
C310080176
C310080177
Number of RRC access Success,by establishment cause
C310080178
C310080179
C310080180
C310080181
C310080182
C310080183
C310080184
C310080185

C310080186
C310080187
C310080188
C310080189
C310080190
C310080191
C310080192
C310080193 Number of RRC access Success,by call type
C310080194
C310080195
Number of RRC access Success,by domian
C310080196
C310080197
Number of RRC access Success,by UE Capablity
C310080198
C310080199
C310080200
C310080201
Number of RRC access Success,by UE AS Release
C310080202
C310080203
C310080204
C310080205
C310080206
Number of RRC access Success,by RRC establish time
C310080207
C310080208
C310080209
C310080210
C310080211
C310080212
Number of RRC access Success,by UE Phy Capability
C310080213
Category
C310080214
C310080215
C310080216
C310080217

C310080218
C310080219
C310080220
C310080221
C310080222
C310080223
C310080224
C310080225
C310080226
C310080227
C310080228
C310080229
Number of Triggered RRC connection re-establishment
C310080230
C310080231
C310080232
C310080233
C310080234
C310080235
C310080236
C310080237
Number of attempted RRC connection re-establishment
C310080238
C310080239
C310080240
C310080241
C310080242
C310080243 Number of failed RRC connection re-establishment
C310080244
C310080245
C310080246 Number of failed RRC connection re-establishment
C310080247
C310080248 Number of failed RRC connection re-establishment,by

C310080249 traffic

C310080250
C310080251
C310555127
C310555128
C310555129
C310555130
C310555131
C310555132
C310555133
RRC Connection Establishment Procedures
C310555134
C310555135
C310555162
C310555163
C310555164
C310555171
C310555172
C310555136
C310555137
C310555138
C310555139
C310555140
C310555141
C310555142
C310555143
RRC Connection Release Procedures
C310555144
C310555145
C310555146
C310555147
C310555148
C310555149
C310555150
C310555151

C310555152
C310555153
C310555154
C310555155
C310555156
Cell Paging Procedures
C310555157
C310555158
C310555159
C310555160
C310555161
C310555165
C310555166
C310555167
Cell Security Procedures
C310555168
C310555169
C310555170
C310565185
C310565186
C310565187
C310565188
C310565189
C310565190 Radio Bearer Reconfiguration Procedures Signaling

C310565191 Statistic
C310565192
C310565193
C310565194
C310565195
C310565196
C310595406
C310595407
Radio Link Setup Procedures
C310595408
C310595409

C310595410
C310595411
C310595412
C310595413
C310595414
C310595415
C310595416
C310595417
C310595418
C310595419
C310595420
5.2 Related Alarms
This feature has no related alarm.
6 Engineering Guide
6.1 Application Scenario
This is a mandatory and basic feature in the RNC.
6.1.3 ZWF21-01-003 Paging

6.1.5 ZWF21-01-005 Ciphering Algorithm UEA0 and UEA1
6.1.7 ZWF21-01-007 Radio Connection Monitor
6.1.8 ZWF21-01-009 Sib11bis
If there are too much neighbor cells, this feature can be activated to broadcast much
more neighbor cells in air interface.
If a direct connection between the RNC and GGSN exists, this feature can be activated
to decrease time delay of data packets.
If there is a large number of R6 or post-R6 UEs, this feature can be activated to improve
user experience.

6.2 Feature Activation Procedure
This procedure describes how to locate the parameters related to this feature in the GUI.
The parameter values on the screenshots in the procedure are for reference only. Refer
to Chapter 4 for the recommended values of the related parameters.
In the configuration resource tree, select Modify Area > Managed Element, and
double-click UMTS Logical Function Configuration and set Maximum Number of
Retransmissions of the RRC CONNECTION RELEASE COMPLETE Message (N308)
and Switch of Filtering the incomplete Neighboring Cells in SIB, see Figure 6-1.

Figure 6-1 Parameter Configuration 1
In the configuration resource tree, select Modify Area > Managed Element > UMTS
Logical Function Configuration > Global Information Configuration, and
double-click UE Timers and Constants Information and set Maximum Number of
Retransmissions of the RRC CONNECTION REQUEST Message (N300), Maximum
Number of Retransmissions of the CELL/URA UPDATE Message (N302), Maximum
Number of Retransmissions of the UE CAPABILITY INFORMATION Message
(N304), Maximum Number of In Sync Received from L1 in Connected Mode (N312
in Connected Mode), Maximum Number of In Sync Received from L1 in Idle Mode
(N312 in Idle Mode), Maximum Number of Successive Out of Sync Received from
L1 (N313), Maximum Number of Successive In Sync Received from L1 During T313
is Activated (N315), Waiting Time After UE Sending RRC CONNECTION REQUEST
Message (T300), Waiting Time After UE Sending CELL/URA UPDATE Message

(T302), Waiting Time After UE Sending UE CAPABILITY INFORMATION Message

(T304), Period of Cell/URA Update When UE is in
CELL_FACH/CELL_PCH/URA_PCH State (T305), Waiting Time for Cell Reselection
After UE is out of Service (T307), Waiting Time After Sending RRC CONNECTION
RELEASE COMPLETE Message in CELL_DCH State (T308), Waiting Time After
Requesting Connection Establishment in Other System (eg. GSM) (T309), Waiting
Time for Receiving In Sync from L1 in Connected Mode (T312 in Connected Mode),
Waiting Time for Receiving In Sync from L1 in Idle Mode (T312 in Idle Mode),
Waiting Time After DPCCH Established in CELL_DCH State Losing
Synchronization (T313), Waiting Time for Completion of Cell Update When Radio
Link Fails and Radio Bearer (s) Associated with T314 Exist (T314), Waiting Time for
Completion of Cell Update When Radio Link Fails and Radio Bearer (s) Associated
with T315 Exist (T315) and Waiting Time for Cell Selection/Reselection After UE is
out of Service in CELL_PCH/URA_PCH State (T316), see Figure 6-2.


Logical Function Configuration, and double-click UTRAN Cell and set Frequency
Band Indicator, PCCPCH Information in SIB6 Configuration Tag, Dynamic
Persistence Level Information of SIB6 PRACH in SIB7 Configuration Tag and Cell
Available Sub channel Number Continuity Setting Indicator, see Figure 6-3.

Logical Function Configuration, and double-click UTRAN Cell and set Broadcast in
either SIB11 or SIB11bis, see Figure 6-4.


Logical Function Configuration > UTRAN Cell > Channel Configuration, and
double-click AICH Configuration and set AICH Transmission Timing, see Figure 6-5.

Logical Function Configuration > UTRAN Cell > Channel Configuration > AICH
Configuration, and double-click PRACH Configuration and set AC-to-ASC Mapping,
Available Signature Begin Index, Available Signature End Index, Assigned Sub
channel No., PRACH Available Sub channel Number, Initial Dynamic Persistence

Level, Maximum Number of Preamble Being Transmitted, Maximum Number of

Preamble Ramping Cycles, Permitted Maximum Access Service Class, PRACH
Preamble Power Ramp Step, Persistence Scaling Factor, Persistence Scaling
Factor Number and Available Signature, see Figure 6-6.

Logical Function Configuration > PLMN Relating Configuration, and double-click
CN NAS System Information and set IMSI Attach and Detach Indicator, CN Domain

Supported, Network Mode of Operation and Timer for Periodic Location Update
(T3212), see Figure 6-7.
Logical Function Configuration > UTRAN Cell, and double-click Extended Info of
UTRAN Cell and set Filtering Limit of GSM Neighboring Cell Number, Filtering Limit
of Inter-Frequency Neighboring Cell Number, The Button of Updating SIB
completely, Switch of SIB Scheduling Optimization and SIB18 Indicator, see Figure
6-8.


double-click UMTS Logical Function Configuration and set Maximum Number of
Retransmissions of the RRC CONNECTION RELEASE Message, Maximum Number
of Retransmissions of the RRC CONNECTION SETUP, Interval of Retransmission
of RRC CONNECTION SETUP, Time of Waiting for RADIO LINK RESTORE
INDICATION, Time of Waiting for RRC CONNECTION COMPLETE, CMP User
Admission Control Threshold in Normal Running, DMP User Admission Control
Threshold in Normal Running, and Switch of RNC Send RL SETUP and RRC
CONNECTION SETUP in Parallel when Setting up RRC CONNECTION, see Figure
6-9.


Logical Function Configuration, and double-click Extended Info of RNC and set R5
and above UE RRC release mode, Switch of CFN offset Optimization when signal
on HSPA channel, CFN offset compensation value and Switch for CFN offset
compensation feature, see Figure 6-10.


Logical Function Configuration, and double-click Extended Info of RNC and set
Signaling Service Type, Data Retransmission Rate Factor over Uu Interface,
Packet Length Type Indicator over Uu Interface and CFN Offset Value, see Figure
6-11.
Logical Function Configuration, and double-click UTRAN Cell and set UUARFCN,
DUARFCN, see Figure 6-12.

UTRAN Cell and set Wait Time for RRC Connection Reestablishment, Switch of
Reconfiguration Procedure Optimization, CPICH EcN0 Threshold for CFN offset
compensation and RSCP Threshold for CFN offset compensation, see Figure 6-13.

Figure 6-13 Parameter Configuration13
6.2.3 ZWF21-01-003 Paging

double-click UMTS Logical Function Configuration and set UTRAN DRX Cycle
Length Coefficient and Paging Type1 Response Timer, see Figure 6-14.
Logical Function Configuration, and double-click Extended Info of RNC and set The
number of CMP for handling paging and Switch of CS Paging Resend in PCH
Status and Timer of CS Paging Resend in PCH Status, see Figure 6-15.

Logical Function Configuration > PLMN Relating Configuration, and double-click
CN NAS System Information and set CS Domain DRX Cycle Length Coefficient and
PS Domain DRX Cycle Length Coefficient, see Figure 6-16.

Logical Function Configuration, and double-click UTRAN Cell and set Sending times
of paging message of CS, Sending times of paging message of PS, Number of
Paging Indicators per PICH Frame for PCH, see Figure 6-17.


Logical Function Configuration > UTRAN Cell, and double-click Radio network
Layer User Plane Global Parameters and set Iu Paging Repetition Timer, see Figure
6-18.
double-click UMTS Logical Function Configuration and set Timer for State Query
and Timer for IU Release Resource, see Figure 6-19.

Filling SAI corresponding with CELL consuming radio resources Indicator, see
Figure 6-20.
Logical Function Configuration > PLMN Relating Configuration, and double-click Iu

Interface Timers and Constants Information and set Maximum Waiting Time for
RESET in RNC, Timer Before Sending RESET Response to CN, Timer for Sending
RESOURCE RESET Response to CN and Maximum Number of Retransmissions of
the RESET Message, see Figure 6-21.
Logical Function Configuration > PLMN Relation Configuration, and double-click
Logic RNC Configuration and set Encryption Algorithm (UEA0), Encryption
Algorithm (UEA1) and Encryption Algorithm (UEA2), see Figure 6-22.

Switch of Reconfiguration Procedure Optimization, see Figure 6-23.
Logical Function Configuration > PLMN Relation Configuration, and double-click

Logic RNC Configuration and set Integrity Protection Algorithm (UIA1) and Integrity
Protection Algorithm (UIA2), see Figure 6-22.
Logical Function Configuration, and double-click UE Timers and Constants
Information and set The Number of Consecutive In-Sync Indications NodeB
Received After which RL Restore Procedure Shall be Triggered (N_INSYNC_IND),
The Number of Consecutive Out-of-Sync Indications NodeB Received After which
the Timer T_RLFAILURE Shall be Started (N_OUTSYNC_IND) and Timer Length for
Trigger Radio Link Failure Procedure After NodeB Receive N_OUTSYNC_IND
Consecutive Out-of-Sync Indication (T_RLFAILURE), see Figure 6-22.

6.2.8 ZWF21-01-009 Sib11bis
double-click UMTS Logical Function Configuration and set Switch of Filtering the
incomplete Neighboring Cells in SIB, see Figure 6-226.

UTRAN Cell and set Filtering Limit of Inter-Frequency Neighboring Cell Number and
Filtering Limit of GSM Neighboring Cell Number, see Figure 6-27.
Logical Function Configuration > Link Configuration, and double-click Iups Link and
set Support DT Switch, see Figure 6-28.

Logical Function Configuration, and double-click UE Timers and Constants
Information and set Switch of Faster L1 DCH synchronization, see Figure 6-22.

6.3 Feature Validation Procedure
Table 6-1 Feature Validation Procedure 1
Test Item System Information Broadcast
1. The WCDMA system is ready.

Prerequisite
2. Cell1 supports HSUPA, HSDPA and DCH.
Steps Power on UE1 in Cell1, so that it reads SIB information from Cell1.
Expected As shown in the UE1 log, UE1 can receive the MIB SB, and SIB
Result information correctly.
Test Item Connection Setup and Release
3. The initial RRC setup channel is configured to use low rate signaling in the
Prerequisit
Cell_DCH state.
e
4. UE1 camps on Cell1 in Idle mode.
5. UE1 supports R6 and subscribes to the interactive or background service,
MBR = UL2 Mbps/ DL2 Mbps.
1. Activates a PS service on UE1 in Cell1 and start FTP download.

Steps
2. Release the service.
The signaling is established on the DCH/DCH channel in the RRC

Expected
connection setup stage, and the low rate signaling bearer is 3.4 kbps or
Result
6.8 kbps.

6.3.3 ZWF21-01-003 Paging
Test Item Paging

Prerequisit
2. Cell1 supports HSUPA, HSDPA and DCH and belongs to LAC1.
e
3. UE1 camps on Cell1 in Idle mode.
1. Make a voice call on UE1 to PSTN or another UE to trigger the

paging procedure.
Steps
2. Capture the Iu interface signaling.
3. Release the AMR voice call.
1. The CS CN sends a Paging message to the RNC. The Paging message
includes the CN domain indicator (CS), the permanent NAS UE identity
(IMSI) or the temporary UE identity (TMSI), and the paging area (LAC1).
Expected
2. The RNC sends a paging message on the PCH channel in the paging
Result
area.
3. UE1 responses to this paging message. The voice call is

established successfully.
Test Item NAS Message Transfer

Prerequisit
e
3. UE1 and UE2 camp on Cell1 in Idle mode.
1. Make a voice call on UE1 to UE2 in Cell1.

Steps
Expected The uplink direct transfer of the NAS signaling message between the
Result CN and UE is successful.

Test Item Ciphering

Prerequisit
e

Steps
Expected In the Security Mode Command message, the ciphering method is

Result UEA1 or UEA0.
Test Item Integrity Protection

Prerequisit
e

Steps
Expected In the Security Mode Command message, the integrity protection

Result method is UIA1


Prerequisit
e
2. UE1 moves away from Cell1 until the signal quality becomes poor and the
Steps
NodeB sends an RL failure message to the RNC.
3. The RNC releases the AMR voice call.
Expected The NodeB sends an RL failure message to the RNC when the Radio
Result Link is unsynchronized from the uplink.
6.3.8 ZWF21-01-009 Sib11bis
Test Item SIB11bis

3. Cell1 has 31 intra-frequency + 32 inter-frequency + 32 inter-RAT
neighbor cells.
Prerequisit
4. 31 intra-frequency neighbors of Cell1 sent by Sib11, 12
e
inter-frequency and 10 neighbor inter-RAT cells sent by Sib11, and
other cells sent by Sib11bis are configured. Cell2 belongs to the
other 20 inter-frequency cells sent by Sib11bis.
5. UE1 supports Sib11bis and camps on Cell1 in Idle mode.
1. Power on UE1, so that it reads SIB information from Cell1.
Steps 2. UE1 moves from Cell1 to Cell2
3. Check UE1’s neighbor cell list from the UE log.
Expected 1. In step 1, 96 neighbor cells can be found in the SIB message.

Result 2. In step 2, the cell reselection is successful.

Test Item Fast Dormancy
Prerequisit 2. Cell1 supports HSUPA, HSDPA and DCH.

e 3. UE1 camps on the Cell1 in Idle mode.
4. Both RNC and CN support the direct tunnel feature.
1. Activate a PS call on UE1 in Cell1.

Steps 2. The GTPU address is GGSN address in the RAB assignment
message sent from the CN to the RNC.
Expected 1. The GTPU address is GGSN address in the RAB assignment

Result message sent from the CN to the RNC.
Test Item Faster L1 Synchronization
Prerequisit 3. UE1 supports R6 and camps on Cell1 in Idle mode.

e
4. UE1 subscribes to the interactive or background service, with MBR =
UL2Mbps/ DL2Mbps.
5. Activate the Faster L1 Synchronization feature.
1. Activate a PS call on UE1 in Cell1.

Steps
2. Release the PS service.
In step 1, during the RRC establishment on cell_dch, there is an IE

Expected postVerificationPeriodPresent = 1 and postVerificationPeriod
Result =eRRC_DL_CommonInformation_r6_postVerification Period_true in the
Uu signaling message RRCConnectionSetup

6.4 Feature Deactivation Procedure
N/A
N/A
6.4.3 ZWF21-01-003 Paging
N/A
N/A
6.4.5 ZWF21-01-005 Ciphering Algorithms UEA0 and UEA1
N/A
N/A
N/A
6.4.8 ZWF21-01-009 Sib11bis
N/A

Table 6-11 RNC parameter list 3
Managed Object. logic Default Value Deactivation

GUI Name
name Value
Support DT
UIupsLink.SupportDTSwitch 1:on 0:Off
Switch
Table 6-12 RNC parameter list 3
Managed Object. logic name Defaul Deactivation

GUI Name
t Value Value
vsDataURncFunction.fastL1Syn Switch of Faster L1 DCH

0:Off 0:Off
cSwch synchronization
6.5 Impact on the Network
N/A
N/A
6.5.3 ZWF21-01-003 Paging
N/A
N/A

6.5.5 ZWF21-01-005 Ciphering Algorithms UEA0 and UEA1
N/A
N/A
6.5.7 ZWF21-01-007 Radio Connection Monitoring
N/A
6.5.8 ZWF21-01-009 Sib11bis
N/A
The advantage of this feature is as follows:
 The data packet time delay between the RNC and CN will be decreased, and the
user experience will be improved.
The advantage of this feature is as follows:
 The synchronization time of DCH establishment will be decreased, and the call
setup will be faster.
7 Abbreviation
Abbreviation Full Name
AMR Adaptive Multi Rate
BCCH Broadcast Control Channel
CN Core Network

CS Circuit Switch
DT Direct Tunnel
MIB Master Information Block
NAS Non Access Stratum
NBAP Node B Application Part
PI Page Indicator
PO Page Occasion
PS Packet Switch
RNC Radio Network Controller
SB Schedule Block
UTRAN UMTS Terrestrial Radio Access Network
WCDMA Wideband Code Division Multiple Access
8 Reference Document
[1]ZXUR 9000 UMTS(V4.15.10.20)Radio Network Controller Radio parameter Reference
[2]ZXUR 9000 UMTS(V4.15.10.20)Radio Network Controller Ground Parameter

Reference
[3]ZXUR 9000 UMTS(V4.15.10.20)Radio Network Controller Performance Counter

Reference
[4]ZXWR RNC(V3.15.10.20)Radio Network Controller Radio parameter Reference
[5]ZXWR RNC(V3.15.10.20)Radio Network Controller Ground Parameter Reference
[6]ZXWR RNC(V3.15.10.20)Radio Network Controller Performance Counter Reference
[7]ZTE UMTS Iu Flex Feature Guide
[8]ZTE UMTS Load Balance Feature Guide

ZTE UMTS UR15 Connection Management Feature Guide

Transféré par

Informations du document

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

ZTE UMTS UR15 Connection Management Feature Guide

Transféré par

Droits d'auteur :

Formats disponibles

Connection Management

Compare to UR14, the following is

V1.00 2016/04/17 Feng Chao 3.3.1 Paging Flow

4.3 ZWF21-01-003 Paging

© 2016 ZTE Corporation. All rights reserved.

ZTE Confidential Proprietary 1

3 Technical Description ..................................................................................... 19

ZTE Confidential Proprietary 2

3.7.2 Reconfiguring the Iub Interface Radio Link ........................................................ 59

5 Related Counters and Alarms ...................................................................... 121

6 Engineering Guide ........................................................................................ 131

ZTE Confidential Proprietary 3

6.2.5 ZWF21-01-005 Ciphering Algorithm UEA0 and UEA1 ..................................... 159

ZTE Confidential Proprietary 4

7 Abbreviation .................................................................................................. 172

8 Reference Document..................................................................................... 173

ZTE Confidential Proprietary 5

Figure 2-1 Overview of Direct Tunnel.................................................................................17

ZTE Confidential Proprietary 6

Figure 6-8 Parameter Configuration 8 ..............................................................................145

ZTE Confidential Proprietary 7

Table 4-4 NAS Message Transfer Parameter List ............................................................106

ZTE Confidential Proprietary 8

Node B version: [ZXSDR V4.15.10]

2.1 Feature Introduction

2.1.1 ZWF21-01-001 System Information Broadcast

ZTE Confidential Proprietary 9

 Configuration information of the UTRAN Registration Area (URA)

 Cell selection and reselection parameters

 Information on uplink interference related to auxiliary power control

 UE measurement control message about the idle or common channel

 Parameters of the adjacent cell

 AGPS location information

ZTE Confidential Proprietary 10

number of remaining inter-frequency adjacent cells is determined by

2.1.2 ZWF21-01-002 Connection Setup and Release

When a UE needs to establish a connection to the network in a specific scenario, such as

2.1.3 ZWF21-01-003 Paging

 The UE is in Idle mode.

ZTE Confidential Proprietary 11

 The UE is in PCH mode.

 The UE is in FACH or DCH state.

 When it is necessary to suspend the RRC connection of a UE in PCH state,

 For a UE in Idle or URA_PCH state, a paging message of PAGING TYPE 1 is

 For a UE in CELL_FACH or CELL_DCH state, a paging message of PAGING

ZTE Confidential Proprietary 12

2.1.4 ZWF21-01-004 NAS Message Transfer

The ZTE RAN supports three types of directly forwarded messages.

 INITIAL DIRECT TRANSFER message

 UPLINK DIRECT TRANSFER message

 DOWNLINK DIRECT TRANSFER message

ZTE Confidential Proprietary 13

2.1.5 ZWF21-01-005 Encryption Algorithms UEA0 and UEA1

2.1.6 ZWF21-01-006 Integrity Protection Algorithm UIA1

ZTE Confidential Proprietary 14

2.1.7 ZWF21-01-007 Radio Connection Monitoring

 The Node B monitors the RL connection status.

 The RNC monitors the RLC connection status.

 The RNC monitors the cell update message of the UE.

 The RNC monitors the UE keep_alive timer.

2.1.8 ZWF21-30-031 Direct Tunnel

After HSPA/HSPA+ was introduced to WCDMA networks, data throughput is greatly

ZTE Confidential Proprietary 15

The direct tunnel feature is enhanced in 3GPP R8 to support a direct connection