中国联通FDD_LTE的CSFB测试和分析一、前言本文主要针对联通FDD-LTE网络，使用华星FLY6.0进行CSFB测试和分析；CSFB 涉及4G侧(LTE)、3G侧（WCDMA）和MSC核心网侧三方的配合。

以下主要是针对测试和事件消息流程进行分析和说明。

二、CSFB测试流程CSFB测试过程主要是主叫4G手机、被叫4G手机分别驻留LTE网络中，连接FLY6.0测试软件，进行主叫4G手机拨打被叫4G手机，主叫4G手机和被叫4G手机分别回落至WCDMA网络进行通话的过程。

CSFB测试流程主要分为测试准备、测试过程和测数据统计三个部分：4、从主被叫的CSFB信令流程来看，主被叫的CSFB信令流程是否正常？一定要查看主被叫的CSFB的起呼、4G 网络RRC释放、4G重选至3G、3G的RRC\RAB\Alerting的完整起呼流程。

验证完全完整后，才算合格。

数据统计1、单站报告中CSFB成功率统计2、CSFB的log记录备份3、若存在测试不成功现象，可初步按照第4节指导进行初步分析原因，待调整后复测分析原因一定要细分类，描述清晰，复测一定要确定故障消除三、正常CSFB信令流程3.1.主叫主要流程当开机做主叫时，UE首先在FDD_LTE注册（attach）,完成注册后进行拨号；通过E_nodeB上发CSFB请求；其主要流程如下：3.1.1开机注册（attach）注册请求消息Attach Request(层三消息RRCConnectionRequest)由UE发出（消息属NAS层），请求中包括UE注册的小区，UE支持的加密算法和方式；联合注册的4G（TAC）和3G(LAC/RAC)及ClassMark;Attach request MORE: 0 LENGTH: 123 LENGTH: 123 LOG_CODE: B0ED timeStamp: 16:20:28.016 LTE NAS EMM plain OTA outgoing msg LOG_VERSION: 1 STD_VERSION: 9 STD_VERSION_MAJOR: 5STD_VERSION_MINOR: 0NAS: Attach requestSecurity Header Type: 0Protocol Discriminator: 7 Message_Types: 65 NAS key set identifier TSC: 0 - native security context NASkeysetidentifier: 1 EPS attach typeEPS attach type value: 2 - combined EPS/IMSI attach EPS mobile identityLength of EPS mobile identity contents: 11 odd_even indic: 0 - even number of identity digits and also when the GUTI is used Type of identity: 6 - GUTIMCC: 460 MNC: 01 MMEGroupID: 9A00MMECode: 206 M_TMSI: 9A00CC345E25 UE network capability EEA0: 1 - supporte128_EEA1: 1 - supported128_EEA2: 1 - supported EEA3: 0 - not supported EEA4: 0 - not supportedEEA5: 0 - not supportedEEA6: 0 - not supported EEA7: 0 - not supported EIA0: 0 - not supported 128_EIA1: 1 - supported128_EIA2: 1 - supportedEIA3: 0 - not supportedEIA4: 0 - not supported EIA5: 0 - not supportedEIA6: 0 - not supportedEIA7: 0 - not supportedUEA0: 1 - supportedUEA1: 1 - supportedUEA2: 0 - not supportedUEA3: 0 - not supported UEA4: 0 - not supported UEA5: 0 - not supportedUEA6: 0 - not supportedUEA7: 0 - not supported UCS2: 0 - not supportedUIA1: 1 - supportedUIA2: 0 - not supported UIA3: 0 - not supportedUIA4: 0 - not supportedUIA5: 0 - not supported UIA6: 0 - not supported UIA7: 0 - not supported ACCCSFB: 1 - supportedLPP: 0 - not supportedLCS: 0 - not supported_1xSRVCC: 0 - not supported NF: 1 - supported ESM message container Length: 38 ESM message container contents: 02,03,D0,31,27,20,80,80,21,10,01,00,00,10,81,06,00,00,00,00,83,06,00,00,00,00,00,0D ,00,00,03,00,00,0A,00,00,10,00 PDN connectivity request Security Header Type: 0 Protocol Discriminator: 2 Message_Types: 208 PDN typePDN type value: 3 - IPv4v6Request type Request type value: 1 - initial requestProtocol configuration optionsLength: 32ProtocolID 0x: 8021 Length of protocol: 16 code: 1 - Configure-Request Identifier: 0 length: 16Type: 129 - Primary DNS Server IP Addresslen: 6 IP Address: 0.0.0.0 Type: 131 - Secondary-DNS-Addresslen: 6 IP Address: 0.0.0.0 ProtocolID 0x: 0DLength of protocol: 0 Tracking area identityMCC: 460MNC: 01 TAC: 37135 DRX parameterSPLIT PG CYCLE CODE: 10CN Specific DRX cycle length coefficient and DRX value for S1 mode: 0SPLIT on CCCH: 0 - is not supportednon-DRX timer: 0 - no non-DRX mode after transfer stateMS network capability Length of MS network capability contents: 3MS network capability value: E5,C0,3ELocation area identification MCC: 460 MNC: 10 Lac: 47889Mobile station class mark 2Revision level: 2 - Used by mobile stations supporting R99 or later versions of the protocol ESIND: 0 - <Controlled Early Classmark Sending> option is not implementedA5/1 algorithm supported: 1 - not available RF Power Capability: reserved PS capability: 0 - not presentSS Screening Indicator: 1 defined in GSM 04.80 SM capability: 1 - Mobile station supports mobile terminated point to point SMS VBS notification reception: 0 - no VBS capability or no notifications wantedVGCS notification reception: 0 - no VGCS capability or no notifications wanted FC Frequency Capability: 0 - The MS does not support the extension band G1 in addition to the primary GSM bandCM3: 1 - The MS supports options that are indicated in class mark 3 IE LCSVA capability: 1 UCS2: 0 - the ME has a preference for the default alphabet over UCS2SoLSA: 0 - The ME does not support SoLSACMSP: 1 - Network initiated MO CM connection request supported for at least one CM protocol A5/3 algorithm supported: 1 - not available A5/2 algorithm supported: 0 - availableSpare half octetLength Of Supported Codec list: 8System Identification: 4Length Of Bitmap for SysID: 2 Length Of Bitmap for SysID: 60 Length Of Bitmap for SysID: 04System Identification: 0 Length Of Bitmap for SysID: 2Length Of Bitmap for SysID: 1FLength Of Bitmap for SysID: 02 Voice domain preference and UE's usage settingLength of Voice domain preference and UE's usage setting contents: 6UE's usage setting: 0 - Voice centricUE's usage setting: 0 - CS Voice onlyVoice domain preference and UE's usage settingGUTI type: 0 - Native GUTIMS network feature supportExtended periodic timers: 1 - MS support3.1.2注册（attach）成功UE收到RRCConnectionSetup消息，进行注册Attach Accepet(层三消息RRCConnectionSetupComplete)，成功消息中包括注册的小区MCC,MNC,MME GroupID,MME Code及UE的M_TMSI等信息．3.1.3UE语音业务请求（CSFB MT START）UE上发Ext service request（NAS到EMM）消息，内容为CS fall back业务请求；Extended service request MORE: 0 LENGTH: 35LENGTH: 35LOG_CODE: B0ED timeStamp: 16:20:44.796 LTE NAS EMM plain OTA outgoing msg LOG_VERSION: 1 STD_VERSION: 9STD_VERSION_MAJOR: 5STD_VERSION_MINOR: 0 NAS: Extended service request Security Header Type: 0 Protocol Discriminator: 7 Message_Types: 76NAS key set identifier TSC: 0 - native security contextNASkeysetidentifier: 1Service typeService type value: mobile originating CS fall back or 1xCS fall backMobile identity Odd/even indication: 0 - even number of identity digits and also when the TMSI/P-TMSI or TMGI and optional MBMS Session Identity is usedType of identity: 4 - TMSI/P-TMSI Identity digits (0x): DC345E25 EPS bearer context status length: 32EBI: 03.1.4E_nodeB指标UE回落E_nodeB在下发给UE的RRCConnectionRelease中给出重定向的目标（utra_FDD=10713）RRCConnectionRelease MORE: 0 LENGTH: 1993 LENGTH: 1993 LOG_CODE: B0C0 timeStamp: 16:20:44.928RRCConnectionRelease VERSION: 7 RRC_REL: 10RRC_REL: 113 RRC_VER: 1 PHYSICAL_CELL_ID: 368(4G服务小区) FREQ: 1650 System_Frame_Number: 34Subframe: 8PDU_NUM: 6 ENCODED_MSG_LEN: 1964 RRC: DL-DCCH-Messagemessagec1rrcConnectionReleaserrc_TransactionIdentifier = 0criticalExtensionsc1rrcConnectionRelease_r8releaseCause = otherredirectedCarrierInfo（重定向方向）utra_FDD = 10713nonCriticalExtensionnonCriticalExtensioncellInfoList_r9 (以下是3G邻区扰码)utra_FDD_r9[0] physCellId_r9 = 201utra_FDD_r9[1] physCellId_r9 = 209utra_FDD_r9[2] physCellId_r9 = 233utra_FDD_r9[3] physCellId_r9 = 393utra_FDD_r9[4] physCellId_r9 = 11utra_FDD_r9[5] physCellId_r9 = 35utra_FDD_r9[6] physCellId_r9 = 448utra_FDD_r9[7] physCellId_r9 = 33.1.5．UE在3G网络进行呼叫UE读取3G网络系统消息，发起业务请求（CM Sercive Request）;请求中包括业务类型，UE能力和支持的加密类型等等．．CM service request MORE: 0 LENGTH: 31 LENGTH: 31 LOG_CODE: 713A timeStamp: 16:20:45.832 UMTS NAS Signaling MessagesDirection: From UE Length: 14 ChannelType: 5MessageType: 36 UMTS NAS Signaling Messages: CM service requestCM service typeService Type : 0Ciphering key sequence numberkey sequence : 1Mobile station classmark Revision level : 2 - Used by mobile stations supporting R99 or later versions of the protocolESIND : 1 - (<Controlled Early Classmark Sending> option is implemented).A5/1 algorithm supported : 0 - (available)RF Power Capability : 7 - reserved PS capability : 1 - (present)SS Screening Indicator : 1(defined in GSM 04.80)SM capability : 1 - Mobile station supports mobile terminated point to point SMSVBS notification reception : 0 - no VBS capability or no notifications wanted VGCS notificationr eception : 0 - no VGCS capability or no notifications wanted 0 - The MS does not support the extension band G1 in addition to the primary GSM bandClassmark 3(CM3) : 1 - The MS supports options that are indicated in classmark 3 IE LCSVA capability : 1 UCS2 : 0 - the ME has a preference for the default alphabet over UCS2SoLSA : 0 - The ME does not support SoLSA CMSP : 1 - Network initiated MO CM connection request supported for at least one CM protocol A5/3 algorithm supported : 1 - (not available)A5/2 algorithm supported : 0 - (available)Mobile identity Type of identity : 4 - TMSI/P-TMSIOdd/even indication : 0 Identity digits : 0x03C3239B3.1.6. RAU和RAB建立在3G网络进行RAU（ROUTING AREA UPDATE REQUEST），无线承载建立请求（RadioBearerSetupComplete），为UE分配无线资源．RadioBearerSetupComplete MORE: 0LENGTH: 26 LENGTH: 26 LOG_CODE: 412F timeStamp: 16:20:47.026 RRC: UL_DCCHintegrityCheckInfomessageAuthenticationCode = 32, 0xB6 0x11 0x69 0x93rrc_MessageSequenceNumber = 2messageradioBearerSetupCompleterrc_TransactionIdentifier = 0start_Value = 20, 0x00 0x00 0110xxxx count_C_ActivationTime = 208 3.1.7. 振铃（Alerting）在3G网络无线资源分配完成后，网络发振铃消息给UE3.1.8.接通（Connect）被叫摘机，链路连通主，被开始通话．3.1.9.挂机（Disconnect）结束通话后主呼挂机，上发拆链消息（Disconnect），下（上）行RRC释放后，通话结束；在E_nodeB下发的RRCConnectionRelease消息中指出了，UE返回4G中心频率(1650)RRCConnectionRelease MORE: 0 LENGTH: 27LENGTH: 27 LOG_CODE: 412F timeStamp: 16:21:10.142RRC: DL_DCCHintegrityCheckInfomessageAuthenticationCode = 32, 0x8D 0xAB 0xEB 0x8Crrc_MessageSequenceNumber = 1messagerrcConnectionRelease r3rrcConnectionRelease_r3rrc_TransactionIdentifier = 0n_308 = 1releaseCause = normalEventlaterNonCriticalExtensionsv690NonCriticalExtensionsrrcConnectionRelease_v690extv770NonCriticalExtensionsrrcConnectionRelease_v770extv860NonCriticalExtensionsrrcConnectionRelease_v860extredirectionInfo （重定向返回系统和小区中心频点）interRATInfoeutraeutra_TargetFreqInfoList[0]dlEUTRACarrierFreq = 16503.1.10.完成TAU（返回4G）UE在4G网络进行TAU请求，TAU完成后UE成功返回4G网络．(TAU详细流程详见FTP下载分析)3.2 .被叫呼叫流程UE接收到寻呼消息（Paging），向网络发起CSFB请求，其他流程与主叫相同．PagingMORE: 0 LENGTH: 36 LENGTH: 36LOG_CODE: B0C0timeStamp: 16:21:44.220PagingVERSION: 7 RRC_REL: 10 RRC_REL: 113RRC_VER: 0PHYSICAL_CELL_ID: 368 FREQ: 1650System_Frame_Number: 145Subframe: 10PDU_NUM: 4ENCODED_MSG_LEN: 7RRC: PCCH-Messagemessagec1pagingpagingRecordList[0]ue_Identitys_TMSImmec = 8, 0xCE m_TMSI = 32, 0xCC 0x73 0xA0 0x25 cn_Domain = cs四.联合附着手机驻留4G由于目前LTE网络暂不支持viop业务，CSFB需要从4G回落至3G进行CS域业务，因此手机选择WCDMA和LTE双模情况下，手机需要在CS域LAC和PS域TAC进行联合附着过程。