Category: LTE and SAE

One of the big changes brought about by LTE is that when the mobile device connects to the network it also implicitly gets an IP address. This is called "Default EPS Bearer Activation". What seems to be a trivial change at first is actually a whole new way of thinking compared GSM and UMTS.

In 2G and 3G systems, the mobile registers to the network first and in order to get an IP address, a "PDP context activation procedure" has to follow. This is also what is known as establishing a "packet call". I never very much liked the term "packet call" which was probably created because of the still mainly circuit switched thinking at the time. So with the default bearer activated right from the start, the "packet call" and all the legacy behind it has become history.

To build on the default bearer there is also a procedure in LTE called "Dedicated EPS Bearer Activation" which is initiated for the network. But what is it needed for, most people ask at first, the mobile already has an IP address!? True, the mobile already has an IP address but the default bearer comes without any quality of service guarantees. For VoIP, IMS, VoLGA and other real time streaming applications, it would be good to have some QoS, especially on the air interface. This ensures that the base station and other network components deliver IP packets for those applications with a higher priority. Also on the mobile side, such IP packets should get a higher priority than other packets, especially when the bandwidth is limited. And that's what is done with a dedicated bearer.

In the network, the dedicated bearer is connected to a Traffic Flow Template (TFT), a concept that already exists in GSM and UMTS. In this template, think of it as a list of ip addresses and tcp/udp port combinations, describes which IP packets should be given a higher priority. The TFT is also forwarded to the mobile during the dedicated bearer activation and it helps the protocol stack to put the IP packets to or from a specific TCP/UDP port and/or IP addresses into a special QoS queue that is treated with a higher priority.

No need for the mobile to have an extra IP address for this higher priority traffic, as the protocol stack uses the Traffic Flow Template information to decide what to do with each IP packet. In other words for those who are familiar with GSM and UMTS, a dedicated bearer activation is pretty similar to a Secondary PDP context activation in 2G and 3G that can be used by the IMS for example to ensure real time data is delivered promptly.

For the details have a look at 3GPP TS 24.301, chapter 6.4 and table 8.3.3.1 a bit further down for the message details.

This is part 3 of my mini-series on the latest version of 3GPP TS 23.401 which describes how the LTE/SAE core network manages user mobility and routes data. In part 1, I've taken a look at the flexibility in terms of load balancing and network node distribution and part 2 featured a look at connection and mobility management. Part 3 now focuses at how the MME (Mobility Management Entity) keeps track of users while they are moving and helps handing over connections from one base station to the other.

As described in previous parts an LTE mobile always has an IP address assigned while it is switched on. To conserve battery and to reduce signaling there are two basic activity states are: While data is exchanged the mobile is seen as connected. If no data is transferred for some time, the network moves the connection to idle, which means the mobile has no physical connection over the air interface during that time. Data can still be sent and received but the air interface connection needs to be re-established first. For applications this is transparent, they will just notice some delay.

Mobility While Being Idle

Let's look at the idle state (to be exact RRC idle and ECM idle) first because that is the most simple from the network point of view. Here, the mobile is free to roam from one cell to another and only contact the network if it suddenly finds itself with a cell that is outside the group of cells to which its former cell belonged to. Such groups are referred to as Tracking Areas (TA) and the action performed when changing to a new cell in a different TA is referred to as a Tracking Area Update (TAU). For a mobile it is simple to detect a tracking area change because each cell broadcasts its Tracking Area ID as part of its general cell information. In case data arrives from the Internet for that user while the device is in idle state, the network has to search the mobile first and sends a 'paging' message via all cells belonging to the TA. The mobile then re-establishes the air interface connection and implicitly reports it's current location to the network.

Now let's have some fun with a couple of further abbreviations, because they are really cute. In GPRS and UMTS the mobile's temporary id was the Packet Temporary Mobile Identity, or the P-TMSI. This id is changed on a frequent basis and used instead of the IMSI (The International Mobile Subscriber Identification) in most air interface messages for security reasons. In LTE, the P-TMSI is now called the Globally Unique Temporary ID, or the GUTI. Some of the digits in the GUTI identify the Mobility Management Entity the mobile was last registered with and they are referred to as the Globally Unique MME Identifier, or the GUMMEI.

When contacting the network, the mobile sends the GUTI to the base station which then uses the parameter to identify the MME to which it will send the request to re-establish the communication session. It's also possible to roam between different radio technologies. If the mobile has reselected from a UMTS cell to an LTE cell, a TAU is made and since the mobile does not have a GUTI, the P-TMSI is sent instead. This way, the newly assigned MME can contact the 3G SGSN to request the subscribers current profile (IP address, PDP contexts, etc.). The same mechanisms apply when the mobile reselects from an LTE cell to a UMTS or GPRS cell. In this case the GUTI is sent in the P-TMSI parameter and the procedure is reffered to as Routeing Area Update (RAU) instead of TAU.

Handover between Two LTE Cells

3GPP TS 23.401 also describes the possible scenarios for handovers, i.e. the handing over of an active radio network connection. Unlike the cell reselection in idle state above, which is controlled by the mobile device, handovers are controlled by the network. Due to the flat network architecture of LTE, the handover is directly initiated by the base station and not, like in previous network architectures, by a higher network element. If implemented, two base stations can organize a handover between the two of them (over the X2 interface) and only report the successful execution to the MME afterwards. The MME then either just acknowledges the handover and the serving gateway is informed to redirect the downlink data traffic to the new cell. In case it makes sense from a network topology or traffic point of view, the MME can at this point also assign a new serving gateway. Note that in practice, the X2 interface is not a physical interface, i.e. base stations are only logically connected with each other over IP and not via a direct physical link.

If there is no direct interface between two base stations, or the base stations do not yet have that functionality implemented, the current base station can also ask the MME to coordinate the handover. This is called an S1 handover, due to the name of the interface between the base station on the MME. Again, there are a number of different variants such as with or without a change of the Serving Gateway.

Inter Radio Access Technology (Inter-RAT) Handovers

And last but not least, there is also the possibility to perform a handover from and to a different radio network architecture, i.e. from/to a GPRS or UMTS network. Three different variants exist:

• To/from an SGSN that is aware how a LTE core network works and has the S4 interface implemented.
• In case Direct Tunnel is used in a UMTS network, the S4 and S12 interfaces are used for the handover.
• And for networks without upgraded SGSNs there is a backwards compatible variant. In this case the MME acts like an SGSN for the older network elements. This is probably the way how handovers to and from LTE will be made at first. This variant is described in Annex-D of the specification, which kind of marks it as a temporary solution.

It all sounds very complicated with lots of options and it probably is. It makes one appreciate network operators who have done their homework and have optimized their networks for seamless nationwide handovers without dropped calls and lost IP addresses. Yes, they do exist.

Nevertheless, to me this all looks a lot more straight forward compared to how things are done in UMTS. Here, the RNC complicates matters and in practice not all network elements can communicate with all others. In LTE/SAE, the removal of the RNC and using IP as the routing protocol for all network activities instead of ATM makes things a lot simpler. Those who don't believe me should have a look at the situation that requires a UMTS SRNS relocation for both the circuit switched and packet switched side simultaneously and how the messaging looks like…

For those who would like to know more about Inter-RAT handovers with CDMA networks I can warmly recommend the several hundred pages of specification in an additional document, 3GPP TS 23.402. Another tribute to CDMA that is also described there is the use alternative use of PMIP (Proxy Mobile IP) instead of the 3GPP GTP (GPRS Tunneling Protocol) on the Interface between the MME and the PDN-Gateway (to the Internet). Long live the options!

There we go, we are almost through with the main SAE features. Remains the Idle State Signaling Reduction (ISR) feature, but I keep that for part 4.

LTE and SAE are making big steps forward and the major specification documents are nearing completion. In part 1 of this mini-series, I've started taking a closer look at 3GPP TS 23.401, the main SAE (System Architecture Evolution) specification document and reported about the flexible meshed like architecture design. In this part, I'll have a look at Evolved Packet System Mobility Management (EMM) and EPS Connection Management (ECM) and their differences to Mobility- and Session Management of UMTS.

Before taking a look at the features in SAE, let's have a look at how similar things work today with UMTS as many of you will be familiar to that. Here, the SGSN at the border between the radio access network and the core network has two management tasks:

UMTS – Packet Mobility Management

The first is called Packet Mobility Management (PMM) and deals with keeping track of the whereabouts of mobile devices. There are three states: A mobile device is PMM detached when it is switched off or if it is not connected to the packet switched part of the UMTS network. That's the case for example if the device has been set to connect to the circuit switched part right at power on but not to the packet switched part unless it becomes necessary, i.e. the user wants to establish a data session. When a data session is established, the connection state changes to PMM connected. Afterwards, if the mobile is connected but hasn't exchanged data with the network for some time, the radio network controller (RNC) can ask the SGSN to release the mobility management connection. The connection then enters PMM idle state and the mobile only reports to the SGSN when it changes a routing or location area. If an IP address was assigned, it is kept. From the application layer point of view (e.g. the web browser) there is no difference between PMM connected and PMM idle.

UMTS – Session Management

The Mobility Management only deals with the whereabouts and tracking of the mobile device, so this state machine knows nothing about assigned IP addresses and contexts. This is task of Session Management (SM). Here there are only two states, either a device has a session and an IP address or it hasn't. 

And now to SAE / LTE

In SAE things work a bit different and I guess that's the reason why the mechanisms had to change as well. The biggest difference in SAE is that once a mobile device is switched on it always has at least a default bearer. In other words, it always has an IP address when it is switched on. And again in other words it's not possible for a mobile device to be attached to the network and not have an IP address. Hence, session managements makes no sense in LTE/SAE. To reflect this, the following two state machines are used in LTE/SAE:

EPS – Mobility Management

This EMM state machine only has two states. When a mobile is switched off or uses a different radio access network technology (e.g. GPRS or UMTS) it's state is EMM deregistered. That's simple. There's an optional feature referred to as Idle-mode Signaling Reducation (ISR) described in Annex J of 23.401 that changes that rule somewhat but let's ignore it for now. Once the mobile sees an LTE network it tries to register and if successful it's state is changed to EMM registered. At the same time the mobile is also assigned an IP address. As a consequence mobile devices in EMM registered state always have an IP address. But the EMM state machine does not care about that fact, it is only influenced by mobility management procedures such as Attach, Detach and Tracking Area Updates. While in EMM registered, the network knows the location of the mobile device either on a cell level or a tracking area level. Which of the two depends on the connection management state machine described right below.

EPS – Connection Management

When a mobile device is registered (EMM state = registered) it can be in two connection management (ECM) states. While a data transfer is ongoing the device is in ECM connected state. For the mobile device this means that on the radio link a Radio Resource Control (RRC) connection is established. For the network, ECM connected means that both the Mobility Management Entity (MME) and the Serving (User Data) Gateway (SGW) have an connection to the mobile device via the S1 interface (the physical and logical link between the core network and the radio access network). in ECM connected state, the location of the mobile is known to the cell level and cell changes are controlled by handovers.

If there is no activity for some time, the network can decide that it is no longer worthwhile to keep a logical and physical connection in the radio network. The connection management state is then changed to ECM idle. Note the use of the term 'idle'. It doesn't mean the connection completely goes away. Logically, it is still there but the RRC connection to the mobile is removed as well the S1 signalling and data link. The mobile continues to be EMM registered and the IP address it has been assigned remains in place. In ECM idle state the location of the mobile is only known down to the tracking area level and cell changes are performed autonomously by the device without any signaling exchanges with the network

Interactions With the Radio Interface

From the base station and mobile device point of view there is a lot of room for maneuvering between ECM connected and ECM idle. While a lot of data is exchanged, the air interface can be fully activated for a device so it has to continuously listen for incoming data. In times of lower activity or even no activity at all, the base station can activate a discontinuous reception (DRX) mode so mobile devices can power down their transcievers for some time. The power down cycles range from milliseconds to seconds. In fact, the longest DRX cycle is as long as the paging interval. So from a mobile point of view the main difference between being in ECM connected state with a DRX cycle the length of a paging intervall and being in ECM idle state without a radio interface connection is how it's mobility is controlled. In ECM connected state, handovers are performed, in ECM idle state, it can change its serving cell autonomously and only has to report to the network when it leaves the current tracking area. In other words, the base station is likely to keep the mobile device in ECM connected state for as long as possible by using DRX so data transfers can be resumed very quickly before cutting the link entirely and setting the state to ECM idle.

Summary

Quite difficult to make a summary as Mobility Management, Connection Management and air interface DRX control are in theory independent from each other but have to be looked at in common to make sense. In a rough generalization I would say that during normal operation:

• a mobile is always in EMM registered state because it's identiy is known to the network and, implicity, an IP address has been assigned;

• a mobile transfering data is always in ECM connected state;

• a mobile not transfering data is also in ECM connected state but DRX is activated on the air interface;

• only mobile whith very long periods of inactivity are in ECM idle state while staying EMM registered.

I hope this look at EMM and ECM from different points of view have made the concepts a bit clearer. In the next part of this mini-series, I'll have a look at the different handover variants the SAE architecture supports to ensure the mobile device is always best connected. As always, comments are welcome.

Release 8 of the 3GPP specification is nearing completion and I thought it's the right time to have a closer look at one of the key core network architecture specifications for LTE, or to be precise, the SAE (System Architecture Evolution) in 3GPP TS 23.401. It's title 'GPRS enhancements for E-UTRAN' is a bit misleading as it is an architecture document in itself that shows the full architecture and not only enhancements. It has become a massive document, 219 pages at the moment, so a single blog post won't do to describe the features which are different compared to GSM and UMTS. So I've decided to split the review into several parts and start with the flexibility and redundancy of network elements which is built into the system from day one.

In the initial 3GPP specs for UMTS (Release 99 or Release 3 if you will after the current counting method), the network was pretty hierarchical. One UMTS base station (NodeB) was connected to one radio network controller (RNC) which was in turn connected to one MSC for voice calls and one SGSN (Serving GPRS Support Node) for packet data traffic. In later 3GPP releases the RNC interface has become more flexible (the famous Iu flex) and in theory, a single UMTS RNC can now be connected to several MSCs and SGSNs for redundancy and load sharing purposes. In practice, however, I suspect it is not used a lot (yet).

Splitting the gateway into MME and SGW and assigning several to a single base station

In the LTE/SAE specs, flexibility and redundancy is built in from day one.  A single LTE base station, called eNodeB, can now be connected to several gateway nodes simultaneously. The gateway node itself is split into a Mobility Management Entity (MME) and a Serving Gateway (SGW) and an interface has been defined between the two. So in practice both can be in the same physical device or split into two different devices. There is also no need to have the same number of MMEs and SGWs in the network, so capacity can be independently increased for the management part (MME) or the datapath (SGW) as needed.

Moving subscribers from one gateway to another and creating redundancy

There are even functions foreseen to move subscribers of one MME or SGW to another MME or SGW, for example to upgrade the software and then reboot the device. Another benefit of pools is that in case one device fails, not all users in the area are affected. If one node fails and the connection is interrupted a device can quickly reconnect and be assigned to a different node. Quite a difference to today where the failure of a single SGSN immediately renders a part of the network useless. It happens often enough…

[Updated 7. September 2009] Tracking Area Lists to prevent border hopping

Another piece of flexibility are tracking area lists, which used to be called location areas (LAs) or routing areas (RAs) in UMTS. Like LAs and RAs, a tracking area is a conglomerate of one or more cells. Mobile devices currently not connected to the network only have to report to the network when they change to a tracking area which is not in the list that was assigned to them by the MME during the last tracking area update. This reduces power consumption and reduces mobility management signaling in the network. Tracking area lists in effect blur the tracking area boundaries and prevent scenarios in which a mobile device keeps hopping between two cells in different tracking areas resulting in frequent signaling exchanges and battery drain.

Packet Data Network Gateway flexibility

And of course the packet data gateway (PDN-GW), the gatekeeper between the mobile network and the Internet (or a fixed line IP network in general) is also not fixed but can be chosen from a pool.

Summary

As shown above, the whole LTE/SAE architecture has been defined in a very flexible way for several reasons. Compared with the flexibility added to GSM/GPRS and UMTS over time, this goes one step further and the use of IP for all interfaces helps a great deal to make this much more simple than in 2G and 3G networks.

So much for today. In the next part, I'll look at Mobility- and Connection Management (EMM and CMM) and the differences to UMTS's Packet Mobility Management and Session Management (PMM and SM).