Protocol Sequence - Attach - None Combined

This page lists the messages of a non-combined registration on a TD-SCDMA network. In a non-combined registration, the UE registers to the two core network domains one after the other. It sends a LOCATION UPDATING REQUEST to the CS domain first, and then an ATTACH REQUEST to the PS domain. A UE in MS operation mode A or B does this when the network operates in network operation mode II, where the network does not support the combined GMM procedures. Both registrations use one RRC connection, and the UE releases it at the end. The messages are checked against 24.008 v20.0.0 and 25.331 v19.0.1.

The topics on this page are listed below.

Which messages make up a non-combined attach ?

Let's look at the whole sequence before we split it into phases. Each line shows the direction of one message. "UE --> NW" is an uplink message, and "UE <-- NW" is a downlink message.

(1) UE <-- NW : SYSTEM INFORMATION

(2) UE --> NW : RRC CONNECTION REQUEST

(3) UE <-- NW : RRC CONNECTION SETUP

(4) UE --> NW : RRC CONNECTION SETUP COMPLETE

(5) UE --> NW : LOCATION UPDATING REQUEST

(6) UE <-- NW : AUTHENTICATION REQUEST

(7) UE --> NW : AUTHENTICATION RESPONSE

(8) UE <-- NW : SECURITY MODE COMMAND

(9) UE --> NW : SECURITY MODE COMPLETE

(10) UE <-- NW : LOCATION UPDATING ACCEPT

(11) UE --> NW : TMSI REALLOCATION COMPLETE

(12) UE --> NW : ATTACH REQUEST

(13) UE <-- NW : AUTHENTICATION AND CIPHERING REQUEST

(14) UE --> NW : AUTHENTICATION AND CIPHERING RESPONSE

(15) UE <-- NW : SECURITY MODE COMMAND

(16) UE --> NW : SECURITY MODE COMPLETE

(17) UE <-- NW : ATTACH ACCEPT

(18) UE --> NW : ATTACH COMPLETE

(19) UE <-- NW : RRC CONNECTION RELEASE

(20) UE --> NW : RRC CONNECTION RELEASE COMPLETE

The twenty steps fall into four groups. Steps 1 to 4 set up the RRC connection. Steps 5 to 11 register the UE in the CS domain with MM messages. Steps 12 to 18 attach the UE to the PS domain with GMM messages. Steps 19 and 20 release the RRC connection again. The NAS messages of steps 5 to 18 travel inside RRC direct transfer messages, so the RRC connection must remain in place until step 18.

The sequence runs one registration after the other, and it does not run them in parallel. The UE sends the ATTACH REQUEST only after the CS registration has ended with the TMSI REALLOCATION COMPLETE. The combined attach reaches both domains with one ATTACH REQUEST instead, and it needs only 13 steps.

Two domains mean two NAS procedures : MM handles the CS registration and GMM handles the PS attach. Each one has its own request, authentication and accept.
Security runs twice : steps 8 and 15 are both SECURITY MODE COMMAND messages. The first one starts security for the CS domain, and the second one for the PS domain.
Step 11 is an uplink message : the UE sends TMSI REALLOCATION COMPLETE to confirm the new TMSI from step 10.
One RRC connection carries everything : the UE does not release the RRC connection between the CS and the PS part.

How does the UE get an RRC connection in TD-SCDMA ?

Steps 1 to 4 look like the same steps in WCDMA, but the access underneath them is different. TD-SCDMA synchronizes the UE in the uplink before the UE may send the RRC CONNECTION REQUEST. So one message line in the list hides a short physical layer exchange.

The UE first reads the SYSTEM INFORMATION in step 1. System Information Block type 1 carries the CN domain system information for both domains. For the CS domain, it gives the T3212 timer and the ATT flag. For the PS domain, it gives the routing area code and the NMO bit, where 0 means network operation mode I and 1 means network operation mode II. The NMO bit tells the UE whether it must register as on this page or with the combined attach. System Information Block type 5 and type 6 give the random access parameters, such as PRX_UpPCHdes and the power ramp step.

Step 2 needs the random access procedure of 25.224 subclause 5.6.3. The UE sends a SYNC_UL signature on the UpPCH and listens to the FPACH for a few sub-frames. If no answer arrives, it raises the power by the ramp step and tries again. The FPACH answer gives a timing correction and the desired PRACH RX power. Two sub-frames after the answer, the UE sends the RRC CONNECTION REQUEST on the PRACH. The UL power control page shows how the UE sets the power for the UpPCH and the PRACH.

The RRC CONNECTION REQUEST carries the initial UE identity and an establishment cause. For this sequence, the cause is "registration". In step 3, the RNC answers on the downlink CCCH with RRC CONNECTION SETUP, which configures the signalling radio bearers. In step 4, the UE confirms on the DCCH with RRC CONNECTION SETUP COMPLETE. This message carries the START list for ciphering and integrity, and the UE radio access capability.

The NMO bit selects the registration type : a UE in network operation mode II follows this page, and a UE in network operation mode I uses the combined attach.
TD-SCDMA adds an uplink sync step : the SYNC_UL and FPACH exchange comes before the PRACH, so the RRC CONNECTION REQUEST arrives with the right timing.
The cause tells the RNC why the UE connects : with "registration", only NAS signalling follows, and no radio bearer for user data is set up on this page.

How does the CS domain register the UE ?

Steps 5 to 11 are one MM location updating procedure. When the UE switches on, it must tell the MSC/VLR that its IMSI is active and where it is. The procedure also gives the network a chance to authenticate the UE, to start security and to allocate a new TMSI.

The LOCATION UPDATING REQUEST in step 5 carries a location updating type. After switch-on, the type is "IMSI attach" if the ATT flag requires IMSI attach, the update status is U1 UPDATED and the stored location area identification matches the current cell. Otherwise, the UE uses "normal location updating". The UE sends this first NAS message in an RRC INITIAL DIRECT TRANSFER, and it starts timer T3210 of 20 s.

In steps 6 and 7, the network runs the MM authentication procedure. The AUTHENTICATION REQUEST carries the RAND and the AUTN, and the UE answers with its response in the AUTHENTICATION RESPONSE. The network supervises this exchange with T3260 of 12 s. After a successful authentication, the UE and the network share new CS domain keys.

Steps 8 and 9 are RRC messages, not MM messages. The RNC sends the SECURITY MODE COMMAND with the CN domain identity set to the CS domain. The UE starts integrity protection and ciphering, and it confirms with SECURITY MODE COMPLETE. After that, the network sends the LOCATION UPDATING ACCEPT in step 10 with the location area identification and a new TMSI. The network starts T3250 of 12 s, and the UE returns TMSI REALLOCATION COMPLETE in step 11.

IMSI attach is a location updating type : there is no separate IMSI ATTACH message in 24.008. The LOCATION UPDATING REQUEST simply carries the type "IMSI attach".
The security mode command belongs to RRC : the core network decides to start security, but the RNC sends the message, and it names the CN domain that the keys belong to.
Step 11 closes the TMSI reallocation : it is the UE's answer to the new TMSI in the LOCATION UPDATING ACCEPT, so it is sent from the UE to the network.
Timers guard each exchange : T3210 protects the whole location updating on the UE side, and T3260 and T3250 protect the authentication and the TMSI reallocation on the network side.

How does the PS domain attach the UE ?

Steps 12 to 18 repeat the same pattern for the PS domain, with GMM messages sent to the SGSN. The SGSN does not take part in the CS registration that just ended. So it authenticates the UE again and needs its own security mode command.

The ATTACH REQUEST in step 12 carries the attach type "GPRS attach", which is the value 001 in 24.008. The UE starts T3310 of 15 s. In steps 13 and 14, the SGSN runs the GMM authentication and ciphering procedure. This is the PS domain version of steps 6 and 7, and the network supervises it with T3360 of 6 s. Steps 15 and 16 are a second RRC security mode exchange, this time with the CN domain identity set to the PS domain. The UE keeps separate keys for each CN domain, so the RNC must start security for the PS domain on its own.

The ATTACH ACCEPT in step 17 ends the attach. If it contains a P-TMSI, the UE stores the new P-TMSI and returns ATTACH COMPLETE in step 18. The network stops T3350 when this message arrives. Then the RNC releases the RRC connection in step 19. In CELL_DCH, the UE sends RRC CONNECTION RELEASE COMPLETE in step 20 with UM RLC on the DCCH. The UE repeats this message when T308 expires, until the counter V308 is greater than N308, and then enters idle mode.

GMM uses a combined authentication and ciphering message : the PS domain sends AUTHENTICATION AND CIPHERING REQUEST, while the CS domain sends AUTHENTICATION REQUEST.
ATTACH COMPLETE depends on a new P-TMSI : the UE sends it when the ATTACH ACCEPT allocates a P-TMSI, or when the network asked for inter-RAT handover information.
The release complete has no acknowledgement : UM RLC gives no delivery confirmation, so the UE repeats the message up to N308 times instead.
The UE ends in idle mode with two registrations : it holds a TMSI for the CS domain and a P-TMSI for the PS domain. Voice and packet calls can then start from idle, as the voice call and packet call pages show.

Reference

24.008 Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 - v20.0.0, subclauses 4.4 MM specific procedures, 4.7.3 GPRS attach procedure, 10.5.1.12 CN domain specific system information and 11.2 timers
25.331 Radio Resource Control RRC protocol specification - v19.0.1, subclauses 8.1.3 RRC connection establishment, 8.1.4 RRC connection release and 8.1.12 Security mode control
25.224 Physical layer procedures TDD - v19.0.0, subclause 5.6.3 Random access procedure