Saturday, July 19, 2014

A Training Project for LTE Field Test Engineers

I started a 10-minute-per-day LTE FT training project from January 2014 to train my team members. Though I am not able to share the documents online due to the regulations and restrictions, I list the training topics in this page. Hope it can be helpful for you if you are a field verification engineer/field test engineer/field IOT engineer and you don't have much idea on what to read.
從2014年1月起,我實驗性地為我的團隊展開了一個每日十分鐘的LTE FT培訓計畫。雖因法規與合約問題,我無法公開訓練教材,但這個頁面列出訓練課程。特別是第二階段的spec選讀部分,歡迎有興趣的FT朋友們參考。

[31 JUL 2014] This page listed 100 topics due to my new job contract issue. There are surely more an LTE field verification engineer should learn. Let's keep going! 礙於個人新合約問題,本頁面僅列出100個主題,但我們的學習並不因此而結束。

Please feel free to notify me if you have any comment or you found any error. 若您發現任何錯誤,懇請來信指教:
My email:

[Phase 1] LOG Hands-on
For this part, the best way is finding a good log for each topic and go through mainly the NAS and RRC signalling flow. For some topics, unfortunately you can only read from chipset maker's traces since no signalling on going. 這部分的學習方式是找一個如標題所示的LOG,觀察RRC和NAS的流程,以建立最基本的流程範例概念。有了大架構的概念後,可以稍微查一下24.301/36.331或其他相關spec看哪邊有不懂的,或是特別想知道的。以下大部分內容是OTA訊息,但一部分主題沒有OTA,只能看chipset maker的debug trace.

001W1403.1How to refilter RRC and NAS (CSFB flow observation)
002W1403.2Piggybacking theory and log check. AS & NAS messages in LTE
003W1403.3EUTRAN System Information Blocks
004W1403.4Combined EPS/IMSI attach
005W1403.5IPv4&IPv6 PDN address allocation (SG M1 attach flow observation)
006W1404.1Intra Frequency Handover
007W1404.2RRC States & Signalling radio bearers (36.331/4.2.1, F4.2.1-1, 4.2.2)
008W1404.3CSFB: MT accept case
009W1404.4InterRAT Measurement: L2U Handover during CSFB
010W1404.5Combined TAU: entered new TA case
011W1405.1Authentication: Layer3 and SIM interaction
012W1405.2Periodic TAU and Timer T3412
013W1405.3LAU during CSFB
014W1406.3Default APN
015W1406.4MAC: CBRA and CFRA
016W1406.5TAU Complete: Send or Shouldn't Send
017W1407.1Intra Frequency Cell Reselection: Theory
018W1407.2Intra Frequency Cell Reselection: Case Study
019W1407.3L2U InterRAT Redirection: LTE too weak case
020W1407.5Inter Frequency Cell Reselection
021W1408.1CSFB: Supplementary Service setup case
022W1408.3Radio Frame: MIB/SIB SFN case study
023W1408.4RRC version & UE categories
024W1408.5AS Security Keys
025W1409.1SMS over SGs
026W1409.2W2L: UTRAN RRC SIB19
027W1409.3W2L: Cell Reselection case study
028W1409.4SMS over IMS
029W1410.1EPS Only Attach
030W1410.2IMS SIP commands - MO Call Setup Case

[Phase 2] LTE/VoLTE Spec Study
*This part should be experimental that the topics are not arranged in a systematical way. I suggest the learners to learn each topic carefully and then put all of the topics together to form a big and clear picture.
這部分的課程編排有點試驗性質。雖然都是相對基本的主題,但主題之間沒有順序性。因為目前參加這個訓練的都是有一定經驗的field engineer,主要是希望這些參加者可以仔細研究各主題,最後可以架構出完整而仔細的大全圖。
001W1410.3Cell Selection & Which cell to camp on when Transition to RRC_IDLE(36.300/
002W1410.4NW Identities & CSG(36.300/8.2)(22.220/4)(25.367/4)(36.300/10.7)
003W1410.5EPS Update Status(24.301/
004W1411.1Storage of EMM Information; EF EPSLOCI(24.301/Annex C)(33.102/4.2.91)
005W1411.2Gap assisted or non-gap assisted measurement(36.300/10.1.2)(36.331/5.5.1)
006W1411.3Usage of the TIN(23.401/Annex J.2)
007W1411.4Call Session Control Function (CSCF)(23.228/4.0)(23.002/4a.7.1)(23.228/4.2.3)
008W1411.5Combined Attach Rejected with #7 EPS services not allowed(24.301/
009W1412.2PLMN Selection: E-UTRA case(36.304/
010W1412.3L1 Transport Channels DL(36.300/5.3)
011W1412.4ICSI (IMS communication service identifier)(24.173/5.1)(24.173/5.2)(RFC3840/5)
012W1412.5Paging & CS Service Notification(36.331/
013W1413.1L1 Transport Channels UL(36.300/5.3)
014W1413.2APN AMBR(Aggregate Maximum Bit Rate)(36.300/11.4)(24.301/
015W1413.3ue-Identity in RRCConnectionRequest: S-TMSI or random value?(36.331/
016W1413.4SI 2quater: E-UTRAN Info for G2L Cell Reselection(44.018/
017W1413.5UTRAN RRC Pre-Redirection info IE(25.331/, 13.4.6a)(3GPP/RP-080694/CR3404R1
018W1414.1Access Barring check(36.311/
019W1414.2Semi-Persistent Scheduling (SPS)(36.300/8.1)(36.300/11.1.1)(36.300/11.1.2)(36.321/5.10)(36.331/SPS-Config)
020W1414.3RoHC related IE in RRC(36.323/4.2.2)(36.323/5.5.1)(36.331/supportedROHC-Profiles)(36.331/headerCompression)
021W1415.1Home Network Domain Name & ISIM EFdomain(R11/23.003/13.2)(24.229/C2)(31.103/4.2.3)
022W1415.2G2L 'redirection': CHANNEL RELEASE with Cell selection indicator...(45.008/6.7.1)(44.018/T9.1.7.1, T10.5.2.1e.1)
023W1415.3Multiple Frequency Band Indicator(3GPP/RP-120734)(R10.6+/36.331/, 6.2.2, 6.3.1, 6.3.4, 6.4)
024W1415.4L2 Logical Channels and Channel Mapping to Transport Channels(36.300/6.1.2, 6.1.3)
025W1416.1SIP: registration-state event package (event: reg & application/reginfo+xml)(24.229/, 4.5/4.7.1/6)(RFC3261/6/aor)
026W1416.2SIP: IMEI(+sip.instance); Temporary Public User Identity; P-Associated-URI header (no ISIM case) (24.229/,, C2)(23.228/Annex E.3.1)(23.003/13.4B)
027W1416.3IMS Security Architecture. Unprotected REGISTER. Initial registration using SIP digest.(33.203/4/F1)(24.229/,
028W1416.4sec-agree(RFC3329/6.5, 2.1, 2.3.1)
029W1416.5Public User Identity. tel URI(23.003/13.4)(RFC3966/1, 6)
030W1417.1E-UTRAN to UTRAN SRVCC overview and related IE in Attach Request(23.216/4.2.2)(24.301/
031W1417.2Initial registration using IMS AKA (comparison with 24.229/,
032W1417.4Channel bandwidth & operating band(36.331/6.2.2/MasterInformationBlock)(36.101/3.1/Channel bandwidth)(36.101/5.6, 5.6.1)
033W1417.5SIP: P-Early-Media(24.229/ media)(RFC5009/6, 8)
034W1418.3General description of the ISR concept23.401 Annex J.1
035W1419.1ISR related IE and timers (3323/3423) in NAS registration messages(24.008/T10.5.145, T10.5.149, 11.2.2,, 10.2, 5.3.5)
036W1419.2Network Initiated Detach Procedure(24.301/,, T9.
037W1419.3option tag 100rel & PRACK method: Reliability of Provisional Responses in SIPRFC3262
038W1419.4Downlink Reference signal(36.300/5.1.4)(36.211/6.1.2, 6.10, 6.10.1, T6.2.3-1, F6.10.1.2-1)
039W1420.1Introduction to XML Configuration Access Protocol(XCAP)(24.623/5.1)
040W1420.3SDP Overview(RFC4566/1, 3.1, 4)
041W1420.4[VoLTE] HOLD: Actions at the invoking UE(24.610/
042W1420.5PHY: DL resource grid, resource elements & resource blocks(36.211/6.2.1, 6.2.2, 6.2.3)
043W1421.1E-MBMS Definitions & General(36.300/15, 15.1)
044W1421.2[VoLTE] Early dialogue & Forking(RFC3261/12.1, 12.3, the part mentioned forking)(IR.92/2.2.5)
045W1421.4CSFB Co-existence with IMS services: Domain Selection /T-ADS(23.221/7.2a, 7.2b)
046W1422.3[VoLTE] OIP & OIR Introduction(24.607/4.1, 4.2.1,,, 4.5.1, 4.5.1A, 4.5.1B)
047W1422.4Overview of Carrier Aggregation(36.300/5.5)
048W1422.5Carrier Aggregation: RRC Overview & Deployment Scenarios(36.300/7.5, Annex J.1)
049W1423.2[VoLTE] XCAP Root URI(23.003/,
050W1423.4[VoLTE] Communications Diversion (CDIV) Overview(24.604/4.1,
051W1424.3E-MBMS Logical Architecture(36.300/15.1.1)
052W1424.4[VoLTE] precondition(IR92/2.4.1)(24.229/,, 13.1 e2e)
053W1424.5Carrier Aggregation Capability Related IE in RRC & SIB Handling in CA(36.331/UE-EUTRA-Capability, Annex C.1/, 5.5A))(36.331/
054W1425.1eMBMS RRC Overview(36.331/
055W1425.2SIP: OPTIONS method(RFC3261/7.1, 11, 11.1, 11.2)
056W1425.4Measurement: reportCGI(36.331/,,,, ReportConfigEUTRA, T321)
057W1426.2DRX in RRC_CONNECTED(C-DRX) Overview(36.300/12)
058W1426.3[CA] SCell Activation/Deactivation, Addition/Modification/Release(36.321/5.13)(36.331/,
059W1427.1C-DRX IE in RRC and FET case study(36.331/MAC-MainConfig IE)(observe FET CDRX SFN/SF)
060W1427.3E-UTRA MAC architecture & services(36.321/4.2, 4.2.1, 4.3.1, 4.3.2)
061W1427.5RTP/RTCP Overview and in IR92(RFC3550/1)(IR92/, 3.2.4)
062W1428.4[VoLTE] DTMF(IR92/3.3)(26.114/Annex G.1, G.2, G.3, G.4)
063W1428.5eMBMS related SIB(36.331/SIB 2, 13, 15)
064W1429.3[VoLTE] Conference creation & SIP REFER method(24.147/,
065W1430.5[MAC] DL-SCH HARQ Entiry and Process(36.321/3.1HARQ information, 5.3.2,,
066W1431.1[VoLTE][RTP] Background on AMR & AMR-WB (Partial)(RFC4867/3.1, 3.2, 3.3, 3.4, 3.5)
067W1431.3SIP Response 380 Alternative Service & 3GPP IM CN subsystem XML body(RFC3261/21.3, 21.3.5)(IR92/5.2.1)(24.229/7.6)
068W1431.4[CA] Cross Carrier Scheduling Configuration(36.331/CrossCarrierSchedulingConfig)(36.213/7.1, 9.1)(36.212/5.3.3,
069W1431.5[Volte] Session Timers(RFC4028)
070TBDTTI Bundling(32.824/6)(36.331/MAC-MainConfig information element)(36.321/, 7.5)

How to make use of 3GPP RP doc and CR?
如何使用3GPP RP文件和CR增進對spec的理解
- Take “25.331 Pre-Redirection Info” for example
- 以“25.331 Pre-Redirection Info”為例

(1) For generic study purpose, normally we download a later release of spec (R10/R11)

(2) Check the REL of the IE
Look up “Pre-redirection info” in “10.2.39 RRC CONNECTION REQUEST”, you will see it was defined in REL 8

(3) Download a later version of 25.331 REL 8 . Here I use 8.17.0 for example

(4) Search “Change history” for the keywords. You might use exactly “Pre-Redirection” to search first.

(5) The result turns out that no exactly the same keyword as “Pre-Redirection” in the Change History

(6) Try other related keywords. For this case, you will find useful info by searching “Redirection”.
* This might not be very intuitive for some cases. But there should always be some way for the target. For example, you can minimize the range by checking which version got the change and go to review the change history line by line.
RP-41 RP-080694 3404 1 UE Capabilities and redirection (UTRA-LTE) 8.3.1 8.4.0

(7) When you find the change history which might contain the topic you want to explore, search the RP number in Google. For this case, search “RP-08069”.

(8) You should find below page. And download “”

(9) You will see below info in the “Summary of Change” section in “25331_CR3404R1_(Rel-8)_R2-084694.doc”
‘pre-redirection information’ is included in the RRC CONNECTION REQUEST message; this provides an indication to the network of whether the UE supports E-UTRA or not; the network shall not redirect the UE to E-UTRAN unless this information is provided in the RRC CONNECTION REQUEST. A separate indication is provided for E-UTRA FDD and E-UTRA TDD.