Protocol Sequence - Attach - Non Combined

This page lists the messages of a combined attach on a TD-SCDMA network. In a combined attach, the UE registers to the CS domain and the PS domain with one GMM procedure. It sends a single ATTACH REQUEST to the SGSN, and the SGSN registers the UE with the MSC/VLR on its behalf. A UE in MS operation mode A or B uses this procedure when the network operates in network operation mode I. The page title reads "Non Combined", but the sequence below is the combined GPRS attach. The non-combined sequence is on the None Combined page. The messages are checked against 24.008 v20.0.0 and 25.331 v19.0.1.

The topics on this page are listed below.

Which messages make up a combined attach ?

Let's look at the whole sequence first, and then compare it with the non-combined one. Each line shows the direction of one message. "UE --> NW" is an uplink message, and "UE <-- NW" is a downlink message.

(1) UE <-- NW : SYSTEM INFORMATION

(2) UE --> NW : RRC CONNECTION REQUEST

(3) UE <-- NW : RRC CONNECTION SETUP

(4) UE --> NW : RRC CONNECTION SETUP COMPLETE

(5) UE --> NW : ATTACH REQUEST

(6) UE <-- NW : AUTHENTICATION AND CIPHERING REQUEST

(7) UE --> NW : AUTHENTICATION AND CIPHERING RESPONSE

(8) UE <-- NW : SECURITY MODE COMMAND

(9) UE --> NW : SECURITY MODE COMPLETE

(10) UE <-- NW : ATTACH ACCEPT

(11) UE --> NW : ATTACH COMPLETE

(12) UE <-- NW : RRC CONNECTION RELEASE

(13) UE --> NW : RRC CONNECTION RELEASE COMPLETE

The thirteen steps fall into three groups. Steps 1 to 4 set up the RRC connection. Steps 5 to 11 are one combined GPRS attach procedure with GMM messages. Steps 12 and 13 release the RRC connection again.

The non-combined sequence needs twenty steps for the same result. It runs a full MM location updating procedure, with its own authentication and security mode command, before the GPRS attach starts. In the combined attach, the UE talks only to the SGSN. So the air interface carries no MM message at all, and the UE authenticates only once.

One NAS procedure covers both domains : the ATTACH REQUEST, ATTACH ACCEPT and ATTACH COMPLETE carry information for the GPRS and the non-GPRS services together.
No MM message appears on the air interface : there is no LOCATION UPDATING REQUEST and no TMSI REALLOCATION COMPLETE in this sequence.
Security runs once : steps 8 and 9 start security for the PS domain only. The CS domain starts its own security later, when the UE sets up a CS connection.

How does the UE decide on a combined attach ?

The UE cannot choose the combined attach on its own. The network must support the combined GMM procedures, and the UE learns this from the system information in step 1, before it sends anything.

System Information Block type 1 carries the CN domain system information. For the PS domain, it gives the routing area code and the NMO bit. The value 0 means network operation mode I, where the combined procedures are supported. The value 1 means network operation mode II, where the UE must use the MM location updating and the GPRS attach separately. For the CS domain, System Information Block type 1 gives the T3212 timer and the ATT flag. In network operation mode I, the UE performs the combined attach whatever the value of the ATT flag.

Steps 2 to 4 are the same as in the non-combined sequence. The UE first runs the TD-SCDMA random access. It sends a SYNC_UL signature on the UpPCH, waits for the FPACH answer, and then sends the RRC CONNECTION REQUEST on the PRACH. The UL power control page shows how the UE sets the power for this exchange. The establishment cause is "registration". The RNC answers with RRC CONNECTION SETUP, and the UE confirms with RRC CONNECTION SETUP COMPLETE, which carries the START list and the UE radio access capability.

Two conditions make a UE in network operation mode I act as if in network operation mode II. The first is domain specific access control that bars the PS or the CS domain. The second is a PLMN in the list of "forbidden PLMNs for GPRS service". In both cases, the UE runs the non-combined procedures.

The NMO bit comes first : the UE reads it in System Information Block type 1, and it decides between the two attach pages before step 2.
The RRC part does not change : the RRC connection setup is identical in both sequences. Only the NAS messages differ.
Mode I can still end in a non-combined registration : with barring or a forbidden PLMN, the UE uses the separate procedures.

How does one ATTACH REQUEST register both domains ?

Steps 5 to 11 hold the combined GPRS attach procedure of 24.008 subclause 4.7.3.2. The key point is that the SGSN does the CS registration for the UE. So the UE sees a GPRS attach with a few extra fields, and the MSC/VLR never talks to the UE in this sequence.

The ATTACH REQUEST in step 5 carries the attach type "combined GPRS/IMSI attach", which is the value 011 in 24.008. The UE includes the TMSI status IE if it has no valid TMSI. It starts T3310 of 15 s and enters the GMM state GMM-REGISTERED-INITIATED and the MM state MM LOCATION UPDATING PENDING. In steps 6 and 7, the SGSN runs the GMM authentication and ciphering procedure. Steps 8 and 9 are the RRC security mode exchange for the PS domain.

The ATTACH ACCEPT in step 10 carries an attach result. The value "combined GPRS attach" means that both registrations succeeded. The message can carry a P-TMSI, and it can also carry a TMSI with the location area identification. If the ATTACH ACCEPT contains a new TMSI or P-TMSI, the UE stores it and returns ATTACH COMPLETE in step 11. This one message confirms both identities. The SGSN then passes the TMSI confirmation to the VLR with a BSSAP+ TMSI reallocation complete message.

The attach result can also be "GPRS only". In that case, the PS attach succeeded but the CS registration failed, and a GMM cause explains why. For cause #16 "MSC temporarily not reachable" and cause #17 "Network failure", the UE retries with a combined routing area update. After five failed attempts, a UE in MS operation mode A uses the MM specific procedures instead, and its MM sublayer acts as in network operation mode II. Finally, the RNC releases the RRC connection in steps 12 and 13, unless the ATTACH ACCEPT indicated "follow-on proceed".

The attach type selects the procedure : 001 is "GPRS attach" and 011 is "Combined GPRS/IMSI attach". The value 010 is not used any more, and a network that receives it treats it as a combined attach.
One ATTACH COMPLETE confirms two identities : it replaces both the ATTACH COMPLETE and the TMSI REALLOCATION COMPLETE of the non-combined sequence.
Check the attach result, not only the message name : an ATTACH ACCEPT with "GPRS only" means that the UE has no CS registration yet. The UE must still register for CS services before it can make a voice call.
The UE ends in idle mode with two registrations : voice and packet calls can then start from idle, as the voice call and packet call pages show.

Reference

24.008 Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 - v20.0.0, subclauses 4.7.3.2 Combined GPRS attach procedure, 10.5.1.12 CN domain specific system information and 10.5.5.2 Attach type
25.331 Radio Resource Control RRC protocol specification - v19.0.1, subclauses 8.1.3 RRC connection establishment and 8.1.12 Security mode control