Protocol Sequence - Voice Call (MO)

This page lists the messages of a mobile originated voice call on a TD-SCDMA network. The UE is already registered and in idle mode when the user dials. The call then needs three layers of setup, one after the other. RRC gives the UE a signalling connection, MM gives the call a secured MM connection to the MSC, and CC sets up the call itself with a radio bearer for the speech. The messages are checked against 24.008 v20.0.0 and 25.331 v19.0.1.

The topics on this page are listed below.

Which messages make up an MO voice call ?

Let's look at the whole sequence first, and then split it by layer. Each line shows the direction of one message. "UE --> NW" is an uplink message, "UE <-- NW" is a downlink message, and a line in angle brackets is a state or a user action rather than a message.

(1) UE <--> NW : Registration (Combined or Non-Combined)

(2) UE <--> NW : < IDLE >

(3) UE : < Make a MO Voice Call >

(4) UE --> NW : RRC CONNECTION REQUEST

(5) UE <-- NW : RRC CONNECTION SETUP

(6) UE --> NW : RRC CONNECTION SETUP COMPLETE

(7) UE --> NW : CM SERVICE REQUEST

(8) UE <-- NW : AUTHENTICATION REQUEST

(9) UE --> NW : AUTHENTICATION RESPONSE

(10) UE <-- NW : SECURITY MODE COMMAND

(11) UE --> NW : SECURITY MODE COMPLETE

(12) UE --> NW : SETUP

(13) UE <-- NW : CALL PROCEEDING

(14) UE <-- NW : RADIO BEARER SETUP

(15) UE --> NW : RADIO BEARER SETUP COMPLETE

(16) UE <-- NW : ALERTING

(17) UE <-- NW : CONNECT

(18) UE --> NW : CONNECT ACKNOWLEDGE

Steps 1 to 3 are the starting point. Step 1 is the registration, which runs as on the combined or the non-combined attach page. After that, the UE stays in idle mode until the user makes the call in step 3.

The remaining fifteen messages fall into three groups. Steps 4 to 6 set up the RRC connection. Steps 7 to 11 set up the MM connection, including authentication and security. Steps 12 to 18 are the call control messages, and the radio bearer for the speech is set up in the middle of them, in steps 14 and 15.

The call starts from idle : the UE has no RRC connection when the user dials, so the RRC setup is part of every MO call from idle.
MM comes before CC : the UE sends the SETUP only after the MM connection is ready and secured.
The speech bearer comes late : the RADIO BEARER SETUP arrives after CALL PROCEEDING, when the network has accepted the call request.

How does the UE get an MM connection for the call ?

The SETUP message cannot go to the MSC on its own. CC messages travel on an MM connection, and the MM connection needs an RRC connection underneath it. So steps 4 to 11 build these two layers before the first CC message.

Steps 4 to 6 use the same RRC connection establishment as the attach pages. In TD-SCDMA, the UE first sends a SYNC_UL signature on the UpPCH and waits for the FPACH answer. It then sends the RRC CONNECTION REQUEST on the PRACH. The UL power control page shows the power used for this exchange. For this call, the establishment cause is "originatingConversationalCall", because speech belongs to the conversational traffic class.

The CM SERVICE REQUEST in step 7 asks the MSC for an MM connection. Its CM service type is "Mobile originating call establishment or packet mode connection establishment", the value 0001 in 24.008. The UE starts T3230 of 15 s, and CC starts T303 of 30 s at the same time. The MSC then authenticates the UE in steps 8 and 9, and the RNC starts ciphering and integrity protection for the CS domain in steps 10 and 11.

Note that the list has no CM SERVICE ACCEPT. The network does not need to send one here. In Iu mode, the UE treats the indication that the security mode control procedure is completed as the service acceptance. So the SECURITY MODE COMPLETE in step 11 also completes the MM connection establishment, and the UE stops T3230.

Two events can open the MM connection : the UE accepts either a completed security mode control or a CM SERVICE ACCEPT as the service acceptance. This sequence shows the first case.
Authentication is optional per call : the MSC decides whether to run steps 8 and 9. A live log may skip them and continue directly with the SECURITY MODE COMMAND.
The establishment cause names the call type early : "originatingConversationalCall" tells the RNC that the connection is for a speech call, before any NAS message arrives.

How does call control connect the call ?

Steps 12 to 18 are the CC part of the call. The UE asks for a call to a number, the network routes it, and the called party answers. The network also has to build a speech path for the UE in the middle of this exchange.

The SETUP in step 12 carries two mandatory information elements. The Bearer capability 1 IE describes the speech service, and the Called party BCD number IE carries the dialled number. The network answers with CALL PROCEEDING in step 13. This message tells the UE that the network has received the call establishment information and will not accept more of it. The UE stops T303 and starts T310 of 30 s.

Next, the MSC asks the RNC for a radio access bearer. The RNC sends the RADIO BEARER SETUP in step 14, and the UE answers with RADIO BEARER SETUP COMPLETE in step 15. After this pair, the UE has a radio bearer for the speech. The network then sends ALERTING in step 16 when the called party is ringing, and the UE stops T310. The speech path already exists at this point, so the network can send an in-band ringback tone over it. Finally, the called party answers. The network sends CONNECT in step 17, and the UE answers with CONNECT ACKNOWLEDGE in step 18. The call is now in the active state.

Two timers supervise the call setup : T303 runs from the CM SERVICE REQUEST until the CALL PROCEEDING, and T310 runs from the CALL PROCEEDING until the ALERTING or the CONNECT. Both are 30 s on the UE side.
The radio bearer is an RRC procedure inside a CC exchange : steps 14 and 15 are RRC messages from the RNC, while the steps around them are CC messages from the MSC.
CONNECT ACKNOWLEDGE ends the setup : after this message, both the UE and the network are in the active state, and the speech runs on the radio bearer from step 14.

Reference

24.008 Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 - v20.0.0, subclauses 4.5.1.1 MM connection establishment, 9.3.23.2 SETUP, 10.5.3.3 CM service type and 11.3 call control timers
25.331 Radio Resource Control RRC protocol specification - v19.0.1, subclauses 8.1.3 RRC connection establishment, 8.1.12 Security mode control and 10.3.3.11 Establishment cause