Everybody would know what Emergency Call is.. (it is like 911 in north america, 112 in South Korea etc). So I would not explain what Emergency call is. I will focus more on the type of conditions in which the emergency call is allowed and the details of emergency call protocol sequence.
You can make an Emergency call in several different condition as listed below.
- i) The Cell is not Barred for Emergency Call
- ii) UE is registered to a cell
- iii) UE has a USIM but the USIM is not provisioned by the network in which the UE is in (In this case, UE would not perform the registeration process to the cell)
- iv) UE does not have any USIM in it(In this case, UE would not perform the registeration process to the cell)
The two cases below are captures from a WCDMA UE. Before them, one section lists the information elements that mark a call as an emergency call. After them, one section collects the rules that decide whether the network accepts the call.
Followings are the protocol sequence and message details for typical cases of emergency call in WCDMA.
- Which information elements mark a call as an emergency call ?
- Case 1 : Normal Registration and Normal USIM
- Case 2 : No Registration and No USIM
- When does the network accept an emergency call ?
- Reference
Which information elements mark a call as an emergency call ?
An emergency call in UMTS uses the same RRC, MM and CC procedures as a normal voice call. So the network needs a marker in each layer to treat the call differently. Let's list those markers first, and then find each of them in the captures.
The UE marks the call four times. The first mark is in RRC, where the RRC Connection Request carries establishmentCause emergencyCall. The second is in MM, where the CM Service Request carries the CM service type Emergency call establishment. The third is the CC message itself, because the UE sends EMERGENCY SETUP instead of SETUP. The fourth is optional. It is the Emergency category IE in EMERGENCY SETUP, which tells the network which emergency service the user wants.
Layer |
Message |
Emergency marker |
Specification |
RRC |
RRC Connection Request |
establishmentCause = emergencyCall |
25.331 |
MM |
CM Service Request |
CM service type = Emergency call establishment, 0010 |
24.008 10.5.3.3 |
CC |
EMERGENCY SETUP |
message type Emergency setup, with no called party number |
24.008 9.3.8 |
CC |
EMERGENCY SETUP |
Emergency category IE, bits for Police, Ambulance, Fire Brigade and others |
24.008 10.5.4.33 |
Look closely at the missing called party number. The UE dials 112 or 911, but EMERGENCY SETUP does not carry those digits. The network therefore routes the call on the emergency category and on the location of the cell. If the UE leaves the Emergency category out, the network assumes a non-specific emergency call.
Four markers, three layers : RRC cause, CM service type, EMERGENCY SETUP and the optional Emergency category.No dialled digits reach the network : EMERGENCY SETUP has no called party number.The category is optional : without it, the network treats the call as a non-specific emergency call.
Case 1 : Normal Registration and Normal USIM
When you have a USIM in the phone, overall Emergency Call processing is very similar to normal call process except a couple of information elements as marked in the following links.
01) < In Idle Mode >
02) < Make an Emergency Call from UE >
03) RACH Preamble
04) AICH
05) RACH Message
06) RRC : RRC Connection Request
07) RRC : RRC Connection Setup
08) RRC : RRC Connection Setup Complete
09) RRC: initialDirectTransfer + MM : CM Service Request
10) RRC : downlinkDirectTransfer + MM:Authentication Request
11) RRC : uplinkDirectTransfer + MM:Authentication Response
12) RRC : Security Mode Command
13) RRC : Security Mode Complete
14) RRC : uplinkDirectTransfer + CC : Emergency Setup
15) RRC : downlinkDirectTransfer + CC : Call Proceeding
16) RRC : Radio Bearer Setup
17) RRC : Radio Bearer Setup Complete
18) RRC : downlinkDirectTransfer + CC : Alerting
19) RRC : uplinkDirectTransfer + CC : Connect
20) RRC : downlinkDirectTransfer + CC : Connect Acknowledge
21) < Voice Traffic >
06 - RRC : RRC Connection Request
The RRC Connection Request is the first message that tells the network about the emergency. Look at establishmentCause, which is emergencyCall (9). The UE identifies itself with its IMSI here, because it has a valid USIM.
Decoded message from a UE log,
rrcConnectionRequest
initialUE-Identity: imsi (0)
imsi: 15 items
Item 0
Digit: 0
Item 1
Digit: 0
Item 2
Digit: 1
Item 3
Digit: 0
Item 4
Digit: 1
Item 5
Digit: 0
Item 6
Digit: 1
Item 7
Digit: 2
Item 8
Digit: 3
Item 9
Digit: 4
Item 10
Digit: 5
Item 11
Digit: 6
Item 12
Digit: 7
Item 13
Digit: 8
Item 14
Digit: 9
establishmentCause: emergencyCall (9)
protocolErrorIndicator: noError (0)
measuredResultsOnRACH
currentCell
modeSpecificInfo: fdd (0)
fdd
measurementQuantity: cpich-Ec-N0 (0)
cpich-Ec-N0: 43
v3d0NonCriticalExtensions
rRCConnectionRequest-v3d0ext
v4b0NonCriticalExtensions
rrcConnectionRequest-v4b0ext
accessStratumReleaseIndicator: rel-8 (4)
v590NonCriticalExtensions
rrcConnectionRequest-v590ext
0... .... predefinedConfigStatusInfo: False
v690NonCriticalExtensions
rrcConnectionRequest-v690ext
ueCapabilityIndication: hsdch-edch (1)
domainIndicator: cs-domain (0)
cs-domain
csCallType: speech (0)
v6b0NonCriticalExtensions
rrcConnectionRequest-v6b0ext
v6e0NonCriticalExtensions
rrcConnectionRequest-v6e0ext
v770NonCriticalExtensions
rrcConnectionRequest-v770ext
mac-ehsSupport: true (0)
v7b0NonCriticalExtensions
rrcConnectionRequest-v7b0ext
v860NonCriticalExtensions
rrcConnectionRequest-v860ext
UL CCCH (Hex) : 38 90 01 01 01 23 45 67 89 48 2B A9 68 A9 40 00 00 00 00 00 00
The rest of the message is the same as for a normal call. The domainIndicator is cs-domain with csCallType speech, so the RNC knows early that a CS speech bearer will follow.
09 - RRC: initialDirectTransfer + MM : CM Service Request
The CM Service Request is the NAS level marker. The UE asks the MM layer for an MM connection with the CM service type Emergency call establishment, instead of Mobile originating call establishment.
Decoded message from a UE log,
initialDirectTransfer
cn-DomainIdentity: cs-domain (0)
intraDomainNasNodeSelector
version: release99 (0)
release99
cn-Type: gsm-Map-IDNNS (0)
gsm-Map-IDNNS
routingbasis: localPTMSI (0)
localPTMSI
routingparameter: 0000
0... .... dummy: False
nas-Message: 052402035758a605f400000000
GSM A-I/F DTAP - CM Service Request
Protocol Discriminator: Mobility Management messages
.... 0101 = Protocol discriminator: Mobility Management messages (0x05)
0000 .... = Skip Indicator: No indication of selected PLMN (0)
00.. .... = Sequence number: 0
..10 0100 = DTAP Mobility Management Message Type: CM Service Request (0x24)
Ciphering Key Sequence Number
0... .... = Spare bit(s): 0
.000 .... = Ciphering Key Sequence Number: 0
CM Service Type
.... 0010 = Service Type: (2) Emergency call establishment
Mobile Station Classmark 2
Length: 3
0... .... = Spare: 0
.10. .... = Revision Level: Used by mobile stations supporting R99
or later versions of the protocol (2)
...1 .... = ES IND: Controlled Early Classmark Sending option is implemented in the MS
.... 0... = A5/1 algorithm supported: encryption algorithm A5/1 available
.... .111 = RF Power Capability: RF Power capability is irrelevant in this information element (7)
0... .... = Spare: 0
.1.. .... = PS capability (pseudo-synchronization capability): PS capability present
..01 .... = SS Screening Indicator: Capability of handling of ellipsis notation
and phase 2 error handling (1)
.... 1... = SM capability (MT SMS pt to pt capability):
Mobile station supports mobile terminated point to point SMS
.... .0.. = VBS notification reception: no VBS capability or no notifications wanted
.... ..0. = VGCS notification reception: no VGCS capability or no notifications wanted
.... ...0 = FC Frequency Capability: The MS does not support the E-GSM or R-GSM band
1... .... = CM3: The MS supports options that are indicated in classmark 3 IE
.0.. .... = Spare: 0
..1. .... = LCS VA capability (LCS value added location request notification capability):
LCS value added location request notification capability supported
...0 .... = UCS2 treatment: the ME has a preference for the default alphabet
.... 0... = SoLSA: The ME does not support SoLSA
.... .1.. = CMSP: CM Service Prompt:
Network initiated MO CM connection request supported for at least one CM protocol
.... ..1. = A5/3 algorithm supported: encryption algorithm A5/3 available
.... ...0 = A5/2 algorithm supported: encryption algorithm A5/2 not available
Mobile Identity - TMSI/P-TMSI (0x0000)
Length: 5
1111 .... = Unused: 0x0f
.... 0... = Odd/even indication: Even number of identity digits
.... .100 = Mobile Identity Type: TMSI/P-TMSI/M-TMSI (4)
TMSI/P-TMSI: 0x00000000
v3a0NonCriticalExtensions
initialDirectTransfer-v3a0ext
start-Value: 000040 [bit length 20, 4 LSB pad bits, 0000 0000 0000 0000 0100 .... decimal value 4]
laterNonCriticalExtensions
v590NonCriticalExtensions
initialDirectTransfer-v590ext
v690NonCriticalExtensions
initialDirectTransfer-v690ext
v770NonCriticalExtensions
initialDirectTransfer-v770ext
v860NonCriticalExtensions
initialDirectTransfer-v860ext
supportOfCSG: true (0)
UL DCCH (Hex) : 15 00 00 00 60 29 20 10 1A BA C5 30 2F A0 00 00 00 06 00 00 8D 12
The UE identifies itself with a TMSI here. For emergency call establishment, 24.008 sets the priority of the mobile identity. The UE uses the TMSI if its location update status is UPDATED and the stored LAI matches the cell. Otherwise it uses the IMSI, and without a valid SIM or USIM it uses the IMEI.
14 - RRC : uplinkDirectTransfer + CC : Emergency Setup
The CC layer now sends EMERGENCY SETUP rather than SETUP. Compare its short IE list with the SETUP of a normal call. The dialled number is absent, and only Bearer capability, Supported Codecs and the Emergency category are present.
Decoded message from a UE log,
uplinkDirectTransfer
cn-DomainIdentity: cs-domain (0)
nas-Message: 038e040660040200058140080402600000021f002e0104
GSM A-I/F DTAP - Emergency Setup
Protocol Discriminator: Call Control; call related SS messages
.... 0011 = Protocol discriminator: Call Control; call related SS messages (0x03)
0... .... = TI flag: allocated by sender
.000 .... = TIO: 0
10.. .... = Sequence number: 2
..00 1110 = DTAP Call Control Message Type: Emergency Setup (0x0e)
Bearer Capability - (MS supports at least full rate speech version 1 and half rate speech version 1.
MS has a greater preference for full rate speech version 1 than for half rate speech version 1)
Element ID: 0x04
Length: 6
Octet 3
0... .... = Extension: Extended
.11. .... = Radio channel requirement: MS supports at least full rate speech version 1
and half rate speech version 1.
MS has a greater preference for full rate speech version 1
than for half rate speech version 1
...0 .... = Coding standard: GSM standardized coding
.... 0... = Transfer mode: circuit
.... .000 = Information transfer capability: Speech (0x00)
Octets 3a - Speech Versions
0... .... = Extension: Extended
.0.. .... = Coding: octet used for extension of information transfer capability
..00 .... = Spare bit(s): 0
.... 0100 = Speech version indication: GSM full rate speech version 3(FR AMR) (0x04)
0... .... = Extension: Extended
.0.. .... = Coding: octet used for extension of information transfer capability
..00 .... = Spare bit(s): 0
.... 0010 = Speech version indication: GSM full rate speech version 2(GSM EFR) (0x02)
0... .... = Extension: Extended
.0.. .... = Coding: octet used for extension of information transfer capability
..00 .... = Spare bit(s): 0
.... 0000 = Speech version indication: GSM full rate speech version 1(GSM FR) (0x00)
0... .... = Extension: Extended
.0.. .... = Coding: octet used for extension of information transfer capability
..00 .... = Spare bit(s): 0
.... 0101 = Speech version indication: GSM half rate speech version 3(HR AMR) (0x05)
1... .... = Extension: No Extension
.0.. .... = Coding: octet used for extension of information transfer capability
..00 .... = Spare bit(s): 0
.... 0001 = Speech version indication: GSM half rate speech version 1(GSM HR) (0x01)
Supported Codec List
Element ID: 0x40
Length: 8
System Identification (SysID): UMTS (0x04)
Bitmap Length: 2
Codec Bitmap for SysID 1
0... .... = TDMA EFR: False
.1.. .... = UMTS AMR 2: True
..1. .... = UMTS AMR: True
...0 .... = HR AMR: False
.... 0... = FR AMR: False
.... .0.. = GSM EFR: False
.... ..0. = GSM HR: False
.... ...0 = GSM FR: False
00.. .... = Spare bit(s): 0
..0. .... = OHR AMR-WB: False
...0 .... = OFR AMR-WB: False
.... 0... = OHR AMR: False
.... .0.. = UMTS AMR-WB: False
.... ..0. = FR AMR-WB: False
.... ...0 = PDC EFR: False
System Identification (SysID): GSM (0x00)
Bitmap Length: 2
Codec Bitmap for SysID 2
0... .... = TDMA EFR: False
.0.. .... = UMTS AMR 2: False
..0. .... = UMTS AMR: False
...1 .... = HR AMR: True
.... 1... = FR AMR: True
.... .1.. = GSM EFR: True
.... ..1. = GSM HR: True
.... ...1 = GSM FR: True
00.. .... = Spare bit(s): 0
..0. .... = OHR AMR-WB: False
...0 .... = OFR AMR-WB: False
.... 0... = OHR AMR: False
.... .0.. = UMTS AMR-WB: False
.... ..0. = FR AMR-WB: False
.... ...0 = PDC EFR: False
Service Category - Emergency category
Element ID: 0x2e
Length: 1
0... .... = Spare bit(s): 0
.0.. .... = Automatically initiated eCall: False
..0. .... = Manually initiated eCall: False
...0 .... = Mountain Rescue: False
.... 0... = Marine Guard: False
.... .1.. = Fire Brigade: True
.... ..0. = Ambulance: False
.... ...0 = Police: False
UL DCCH (Hex) : 8B ED 0C 6B 8E C0 0B 01 C7 02 03 30 02 01 00 02 C0 A0 04 02 01 30 00 00 01 0F 80 17 00 82 00
The capture shows three of the four optional IEs of 24.008 Table 9.62. Bearer capability lists five GSM speech versions, FR AMR first. Supported Codec List offers UMTS AMR and UMTS AMR 2 for UMTS, and the five GSM codecs for GSM. 24.008 requires this IE from a UE that supports UMTS radio access. The Emergency category has only Fire Brigade set, so the user chose the fire service. The two eCall bits are False, because this is a normal emergency call.
Case 1 looks like a normal call : authentication and security mode still run, because the UE has a USIM and is registered.establishmentCause and CM service type mark it : emergencyCall in RRC, and Emergency call establishment in MM.EMERGENCY SETUP carries a category : Fire Brigade in this capture, and no dialled number.
Case 2 : No Registration and No USIM
When there is No USIM in the phone. You may see on the UE display a kind of warning saying "No SIM inserted. Only Emgergency Call is allowed". When you make an emergency call from UE, it would go through following procedure.
UE would send RRC Connection Request with the cause of Emergency Call and with IMEI (Not IMSI nor TMSI) and Network would allow the call setup without going through Authentication and Security procedure.
01) < No Registered : Emergency Only Mode >
02) < Make an Emergency Call from UE >
03) RACH Preamble
04) AICH
05) RACH Message
06) RRC : RRC Connection Request
07) RRC : RRC Connection Setup
08) RRC : RRC Connection Setup Complete
09) RRC: initialDirectTransfer + MM : CM Service Request
10) RRC : downlinkDirectTransfer + MM : CM Service Accept
14) RRC : uplinkDirectTransfer + CC : Emergency Setup
15) RRC : downlinkDirectTransfer + CC : Call Proceeding
16) RRC : Radio Bearer Setup
17) RRC : Radio Bearer Setup Complete
18) RRC : downlinkDirectTransfer + CC : Alerting
19) RRC : uplinkDirectTransfer + CC : Connect
20) RRC : downlinkDirectTransfer + CC : Connect Acknowledge
21) < Voice Traffic >
06 - RRC : RRC Connection Request
Without a USIM, the UE has no IMSI and no TMSI to offer. So initialUE-Identity carries the IMEI, while establishmentCause is still emergencyCall (9), exactly as in Case 1.
Decoded message from a UE log,
rrcConnectionRequest
initialUE-Identity: imei (3)
imei: 15 items
Item 0
IMEI-Digit: 3
Item 1
IMEI-Digit: 5
Item 2
IMEI-Digit: 6
Item 3
IMEI-Digit: 4
Item 4
IMEI-Digit: 3
Item 5
IMEI-Digit: 2
Item 6
IMEI-Digit: 0
Item 7
IMEI-Digit: 5
Item 8
IMEI-Digit: 7
Item 9
IMEI-Digit: 9
Item 10
IMEI-Digit: 3
Item 11
IMEI-Digit: 4
Item 12
IMEI-Digit: 5
Item 13
IMEI-Digit: 3
Item 14
IMEI-Digit: 0
establishmentCause: emergencyCall (9)
protocolErrorIndicator: noError (0)
measuredResultsOnRACH
currentCell
modeSpecificInfo: fdd (0)
fdd
measurementQuantity: cpich-Ec-N0 (0)
cpich-Ec-N0: 43
v3d0NonCriticalExtensions
rRCConnectionRequest-v3d0ext
v4b0NonCriticalExtensions
rrcConnectionRequest-v4b0ext
accessStratumReleaseIndicator: rel-8 (4)
v590NonCriticalExtensions
rrcConnectionRequest-v590ext
.... 0... predefinedConfigStatusInfo: False
v690NonCriticalExtensions
rrcConnectionRequest-v690ext
ueCapabilityIndication: hsdch-edch (1)
domainIndicator: cs-domain (0)
cs-domain
csCallType: speech (0)
v6b0NonCriticalExtensions
rrcConnectionRequest-v6b0ext
v6e0NonCriticalExtensions
rrcConnectionRequest-v6e0ext
v770NonCriticalExtensions
rrcConnectionRequest-v770ext
mac-ehsSupport: true (0)
v7b0NonCriticalExtensions
rrcConnectionRequest-v7b0ext
v860NonCriticalExtensions
rrcConnectionRequest-v860ext
pre-redirectionInfo
.... .1.. supportEUTRA-FDD: True
.... ..0. supportEUTRA-TDD: False
The same identity rule applies to the CM Service Request of step 09. Step 09 links to the Case 1 capture, which shows a TMSI. In Case 2 the Mobile Identity of that message is the IMEI instead. The network must accept an IMEI for this case to work. If it does not, it answers with CM SERVICE REJECT, for example with cause #5 IMEI not accepted.
The list of Case 2 also skips steps 11 to 13. Without a USIM there is no key to authenticate with, so the network answers the CM Service Request with CM SERVICE ACCEPT and runs no security mode procedure. The call then continues with EMERGENCY SETUP as in Case 1.
The IMEI replaces the IMSI : the UE uses the IMEI in RRC and in MM when no valid USIM is present.No authentication and no security : CM SERVICE ACCEPT follows the CM Service Request directly.The network can refuse IMEI calls : cause #5 IMEI not accepted in CM SERVICE REJECT.
When does the network accept an emergency call ?
The conditions at the top of this page say when a UE may try an emergency call. The network still has its own rules, and they decide whether the attempt succeeds. Three rules matter most on UMTS: access class barring, the identity the UE can offer, and the list of emergency numbers.
The first rule is Access Class 10. Every UE has one of the access classes 0 to 9, and some also have a special class from 11 to 15. SIB3 carries an Access Class Barred list with 16 entries, and one of them is Access Class 10. This bit says whether UEs with access classes 0 to 9, or without an IMSI, may make emergency calls. A UE with a class from 11 to 15 is blocked for emergency calls only if both Access Class 10 and its own class are barred. So condition i) at the top of this page is, in practice, the state of the Access Class 10 bit.
The second rule is the identity. 24.008 allows an MM connection for an emergency call in every MM state that allows a normal originating call, and in all service states where a cell is selected. As a network option, it may still reject the request in some of those states. A network that does not support IMEI-based calls rejects Case 2 with cause #5.
The third rule decides whether a dialled number is an emergency number at all. The UE checks the number against the emergency numbers stored on the SIM or USIM and in the ME. The network can add up to ten local emergency numbers in the Emergency Number List IE of LOCATION UPDATING ACCEPT. These numbers are valid only in networks of the same country, and the UE deletes them at switch off or when the USIM is removed.
Access Class 10 gates normal UEs : it controls emergency calls for classes 0 to 9 and for UEs without an IMSI.The network may reject IMEI calls : support for Case 2 is a network option.Local emergency numbers come from the network : up to ten, in LOCATION UPDATING ACCEPT, valid within one country.
Reference
[1] 3GPP TS 24.008 v20.0.0 - clauses 4.4.4.6, 4.5.1.5, 9.3.8, 10.5.4.33 and the Mobile Identity rules of 10.5.1.4
[2] 3GPP TS 25.331 v19.0.1 - RRC Connection Request and the Access Class Barred list of SIB3
[3] 3GPP TS 22.011 v19.6.0 - clause 4.4, Emergency Calls and Access Class 10