Emergency Number List is a mechanism by which a Network tells UEs the list of emergency call that are used in the local area. These number are informed to UE during the registration via Attach Accept message as described below. (See 24.301 5.3.7 Handling of the Local Emergency Numbers List)
A UE already knows a few emergency numbers from its USIM and from the ME itself. But every country also has local numbers that the UE cannot know in advance. The Emergency Number List fills that gap. The network sends the local numbers, and the UE treats a dialled match as an emergency call. The reference above is the LTE procedure in 24.301. For UMTS and GSM, the same rules are in 24.008 clauses 4.4.4.6, 4.7.3.1.3 and 4.7.5.1.3, and the IE itself is defined in clause 10.5.3.13.
This page follows one example from a test network. The list is added to the Attach Accept, decoded field by field, and then tested with an emergency call to one of the configured numbers.
- Where does the list travel in the registration call flow ?
- 25 - RRC : downlinkDirectTransfer + GMM:Attach Accept
- How is the Emergency Number List IE coded ?
- Testing UE
- Reference
Where does the list travel in the registration call flow ?
Which message should carry the list? The UE has to receive it before the user dials, so the list is sent in a registration message. The sequence below is a complete UMTS power-on registration, with a CS location update and a PS attach.
1) MIB
2) SIB
3) RACH Preamble
4) AICH
5) RACH Message
6) RRC: RRC Connection Request
7) RRC: RRC Connection Setup
8) RRC: RRC Connection Setup Complete
9) RRC: initialDirectTransfer + MM: Location Updating Request
10) RRC : downlinkDirectTransfer + MM:Authentication Request
11) RRC: initialDirectTransfer + GMM: Attach Request
12) RRC : uplinkDirectTransfer + MM:Authentication Response
13) RRC : Security Mode Command
14) RRC : Security Mode Complete
15) RRC : downlinkDirectTransfer + MM:Identity Request
16) RRC : uplinkDirectTransfer + MM:Identity Response
17) RRC : downlinkDirectTransfer + MM:Location Updating Accept
18) RRC : uplinkDirectTransfer + MM:TMSI Reallocation Complete
19) RRC : downlinkDirectTransfer + GMM: AuthenticationAndCipheringRequest
20) RRC : uplinkDirectTransfer + GMM: AuthenticationAndCipheringResponse
21) RRC : Security Mode Command
22) RRC : Security Mode Complete
23) RRC : downlinkDirectTransfer + GMM:Identity Request
24) RRC : uplinkDirectTransfer + GMM:Identity Response
25) RRC : downlinkDirectTransfer + GMM:Attach Accept
26) RRC : uplinkDirectTransfer + GMM:Attach Complete
27) RRC : RRC Connection Release
28) RRC : RRC Connection Release Complete
29) < Test UE by making an emergency call with the number you defined here >
The CS domain registers in steps 9 to 18, and the PS attach runs alongside it from step 11 to step 26. In this example the network puts the list only into the GMM Attach Accept at step 25. 24.008 allows three messages for it: LOCATION UPDATING ACCEPT for the CS domain, and ATTACH ACCEPT or ROUTING AREA UPDATE ACCEPT for the PS domain. So a network could equally send the list at step 17, in the Location Updating Accept.
The UE replaces its stored list each time it receives the IE. If a later accept message carries no list, the UE keeps the stored one. The exception is a successful registration to a PLMN in a different country. The numbers are valid only in the country of the cell that sent them, so a UE that crosses a border cannot keep using them.
The list is sent in a registration accept : LOCATION UPDATING ACCEPT, ATTACH ACCEPT or ROUTING AREA UPDATE ACCEPT.This example uses step 25 : the GMM Attach Accept in the PS domain.A new list replaces the old one : and a missing list keeps the stored one, unless the UE registers in another country.
25 - RRC : downlinkDirectTransfer + GMM:Attach Accept
Let's look at where the IE sits inside a real Attach Accept. The capture below is the downlinkDirectTransfer that carried the GMM message, decoded down to the NAS fields. The two entries of the list are highlighted, one colour per entry.
Decoded RRC and NAS message from a tester log,
DL-DCCH-Message
integrityCheckInfo
messageAuthenticationCode: ee131c77
rrc-MessageSequenceNumber: 5
message: downlinkDirectTransfer (5)
downlinkDirectTransfer: r3 (0)
r3
downlinkDirectTransfer-r3
rrc-TransactionIdentifier: 0
cn-DomainIdentity: ps-domain (1)
nas-Message: 080209e00100f1100000801805f4000000803408030111f0...
GSM A-I/F DTAP - Attach Accept
Protocol Discriminator: GPRS mobility management messages
.... 1000 = Protocol discriminator: GPRS mobility management messages (0x08)
0000 .... = Skip Indicator: 0
DTAP GPRS Mobility Management Message Type: Attach Accept (0x02)
Force to Standby
0... .... = Spare bit(s): 0
.000 .... = Force to standby: Force to standby not indicated (0)
Attach Result
.... 1... = Follow-on proceed: True
.... .001 = Result of attach: GPRS only attached (1)
GPRS Timer
GPRS Timer: timer is deactivated
111. .... = Unit: value indicates that the timer is deactivated (7)
...0 0000 = Timer value: 0
Radio Priority 2 - Radio priority for TOM8
Radio Priority (TOM8): priority level 4 (lowest) (0)
Radio Priority - Radio priority for SMS
Radio Priority (PDP or SMS): priority level 1 (highest) (1)
Routing Area Identification - RAI: 1-1-0-128
Routing area identification: 1-1-0-128
Mobile Country Code (MCC): Unknown (1)
Mobile Network Code (MNC): Unknown (01)
Location Area Code (LAC): 0x0000 (0)
Routing Area Code (RAC): 0x80 (128)
Mobile Identity - Allocated P-TMSI - TMSI/P-TMSI (0x0080)
Element ID: 0x18
Length: 5
1111 .... = Unused
.... 0... = Odd/even indication: Even number of identity digits
.... .100 = Mobile Identity Type: TMSI/P-TMSI (4)
TMSI/P-TMSI: 0x00000080
Emergency Number List // I added two emergency number list here
Element ID: 0x34
Length: 8
Emergency Number Information 1
Emergency Number Info length: 3
000. .... = Spare bit(s): 0
...0 .... = Mountain Rescue: False
.... 0... = Marine Guard: False
.... .0.. = Fire Brigade: False
.... ..0. = Ambulance: False
.... ...1 = Police: True
BCD Digits: 110
Emergency Number Information 2
Emergency Number Info length: 3
000. .... = Spare bit(s): 0
...0 .... = Mountain Rescue: False
.... 0... = Marine Guard: False
.... .0.. = Fire Brigade: False
.... ..1. = Ambulance: True
.... ...0 = Police: False
BCD Digits: 9999 // I used the number not commonly used for testing purpose.
Full DCCH Hex : F7 09 8E 3B A9 42 03 61 00 41 3C 00 20 1E 22 00 00 10 03 00 BE 80 00 00 10 06 81 00 60 22 3E 00 60 53 33 20
The Emergency Number List appears near the end, after the allocated P-TMSI. Its IEI is 0x34 and its length is 8 octets. Each entry takes 4 of those octets: one for its own length, one for the Emergency Service Category, and two for the BCD digits. The first entry is 110 with Police set. The number 110 has three digits, so the last octet carries the end mark 1111 in its upper half. The second entry is 9999 with Ambulance set, and its four digits fill both octets.
You can find the same bytes in the nas-Message line, where 34 08 03 01 11 f0 starts the IE. The decoder cut that line short, so the second entry is visible only in the decoded fields. Note also that the attach result is GPRS only attached. The CS registration is the separate location update in step 17, and the Emergency Number List does not depend on it.
IEI 0x34, length 8 : two entries of 4 octets each.One category octet per entry : Police for 110, Ambulance for 9999.Odd digit count : the last octet is padded with the end mark 1111.
How is the Emergency Number List IE coded ?
The decoder output above hides the octet layout, so it helps to see the IE the way 24.008 draws it. The layout also explains the length limits. The IE is a type 4 IE of 5 to 50 octets, so the whole list, with all its entries, has to fit in 48 octets of contents.
Octet | Content |
1 | Emergency Number List IEI, 0x34 in the Attach Accept |
2 | Length of Emergency Number List IE contents |
3 | Length of the 1st Emergency Number information, counting the category octet and the digit octets |
4 | Bits 8 to 6 spare, bits 5 to 1 Emergency Service Category Value |
5 onwards | Number digits in BCD, digit 1 in bits 1 to 4 and digit 2 in bits 5 to 8. An odd number of digits ends with the end mark 1111. |
j onwards | The 2nd and later entries, each with the same layout as octets 3 onwards |
The category bits are coded like bits 1 to 5 of the Service category IE in 24.008 clause 10.5.4.33. The same five bits appear again in the Emergency Setup later on this page.
Bit | Emergency service |
1 | Police |
2 | Ambulance |
3 | Fire Brigade |
4 | Marine Guard |
5 | Mountain Rescue |
The Service category IE has two more bits, 6 and 7, for manually and automatically initiated eCall. The Emergency Number List carries only bits 1 to 5, so a number in the list cannot mark itself as an eCall number. More than one bit can be set in one entry. In that case the MSC routes the call to a combined emergency centre.
The UE uses the list together with the numbers on the SIM or USIM and in the ME. It does not replace them. 24.008 also lets the UE use the list to help the user decide whether a dialled number is an emergency number or, for example, a local directory service. That interaction is implementation specific.
5 to 50 octets : the whole list shares one IE.Five category bits per entry : Police, Ambulance, Fire Brigade, Marine Guard and Mountain Rescue.An addition, not a replacement : the SIM, USIM and ME numbers still count as emergency numbers.
Testing UE
How do you check that the UE really stored the list? You dial one of the numbers that exists only in the list, and you watch what the UE sends. That is why the example uses 9999 rather than a well known number.
If you configured the network (or test equipment) as shown here) and dial '9999', UE should initiate an Emergency Call.
When UE make an Emergency Call, it would configure the Emergency Service Category in CC:Emergency Setup as shown below.
Decoded RRC and NAS message from a tester log,
UL-DCCH-Message
integrityCheckInfo
messageAuthenticationCode: a784079c
rrc-MessageSequenceNumber: 1
message: uplinkDirectTransfer (27)
uplinkDirectTransfer
cn-DomainIdentity: cs-domain (0)
nas-Message: 038e040660040200058140080402600000021f002e0102
GSM A-I/F DTAP - Emergency Setup
Protocol Discriminator: Call Control; call related SS messages
.... 0011 = Protocol discriminator: Call Control; call related SS messages (0x03)
0... .... = TI flag: allocated by sender
.000 .... = TIO: 0
10.. .... = Sequence number: 2
..00 1110 = DTAP Call Control Message Type: Emergency Setup (0x0e)
Bearer Capability - (MS supports at least full rate speech version 1 and half rate speech version 1.
MS has a greater preference for full rate speech version 1 than ...)
Element ID: 0x04
Length: 6
Octet 3
0... .... = Extension: Extended
.11. .... = Radio channel requirement: MS supports at least full rate speech version 1
and half rate speech version 1. ...
...0 .... = Coding standard: GSM standardized coding
.... 0... = Transfer mode: circuit
.... .000 = Information transfer capability: Speech (0x00)
Octets 3a - Speech Versions
0... .... = Extension: Extended
.0.. .... = Coding: octet used for extension of information transfer capability
..00 .... = Spare bit(s): 0
.... 0100 = Speech version indication: GSM full rate speech version 3(FR AMR) (0x04)
0... .... = Extension: Extended
.0.. .... = Coding: octet used for extension of information transfer capability
..00 .... = Spare bit(s): 0
.... 0010 = Speech version indication: GSM full rate speech version 2(GSM EFR) (0x02)
0... .... = Extension: Extended
.0.. .... = Coding: octet used for extension of information transfer capability
..00 .... = Spare bit(s): 0
.... 0000 = Speech version indication: GSM full rate speech version 1(GSM FR) (0x00)
0... .... = Extension: Extended
.0.. .... = Coding: octet used for extension of information transfer capability
..00 .... = Spare bit(s): 0
.... 0101 = Speech version indication: GSM half rate speech version 3(HR AMR) (0x05)
1... .... = Extension: No Extension
.0.. .... = Coding: octet used for extension of information transfer capability
..00 .... = Spare bit(s): 0
.... 0001 = Speech version indication: GSM half rate speech version 1(GSM HR) (0x01)
Supported Codec List
Element ID: 0x40
Length: 8
System Identification (SysID): UMTS (0x04)
Bitmap Length: 2
Codec Bitmap for SysID 1
0... .... = TDMA EFR: False
.1.. .... = UMTS AMR 2: True
..1. .... = UMTS AMR: True
...0 .... = HR AMR: False
.... 0... = FR AMR: False
.... .0.. = GSM EFR: False
.... ..0. = GSM HR: False
.... ...0 = GSM FR: False
00.. .... = Spare bit(s): 0
..0. .... = OHR AMR-WB: False
...0 .... = OFR AMR-WB: False
.... 0... = OHR AMR: False
.... .0.. = UMTS AMR-WB: False
.... ..0. = FR AMR-WB: False
.... ...0 = PDC EFR: False
System Identification (SysID): GSM (0x00)
Bitmap Length: 2
Codec Bitmap for SysID 2
0... .... = TDMA EFR: False
.0.. .... = UMTS AMR 2: False
..0. .... = UMTS AMR: False
...1 .... = HR AMR: True
.... 1... = FR AMR: True
.... .1.. = GSM EFR: True
.... ..1. = GSM HR: True
.... ...1 = GSM FR: True
00.. .... = Spare bit(s): 0
..0. .... = OHR AMR-WB: False
...0 .... = OFR AMR-WB: False
.... 0... = OHR AMR: False
.... .0.. = UMTS AMR-WB: False
.... ..0. = FR AMR-WB: False
.... ...0 = PDC EFR: False
Service Category - Emergency category
Element ID: 0x2e
Length: 1
0... .... = Spare bit(s): 0
.0.. .... = Automatically initiated eCall: False
..0. .... = Manually initiated eCall: False
...0 .... = Mountain Rescue: False
.... 0... = Marine Guard: False
.... .0.. = Fire Brigade: False
.... ..1. = Ambulance: True
.... ...0 = Police: False
Full DCCH Hex : D3 C2 03 CE 0E C0 0B 01 C7 02 03 30 02 01 00 02 C0 A0 04 02 01 30 00 00 01 0F 80 17 00 81 00
The UE sent EMERGENCY SETUP instead of a normal SETUP, so it recognised 9999 as an emergency number. The Service Category IE, IEI 0x2e, has only the Ambulance bit set. That is the category of the 9999 entry in the Attach Accept, so the UE copied the category from the matching list entry. The eCall bits 6 and 7 are both 0, which is required for a call that is not an eCall.
24.008 Table 9.62 lists four optional IEs in EMERGENCY SETUP, and this capture carries three of them. Bearer capability lists the GSM speech versions the UE supports. Supported Codecs is required from a UE that supports UMTS radio access, and here it lists UMTS AMR and UMTS AMR 2 for UMTS. The Emergency category is included when the category is available from the SIM, the USIM or the ME. If the network receives no category, it treats the call as a non-specific emergency call.
EMERGENCY SETUP, not SETUP : the UE matched 9999 against the stored list.Ambulance category : copied from the list entry for 9999.No category bit set, or no IE : the MSC routes the call to an operator defined default emergency centre.
Reference
[1] 3GPP TS 24.008 v20.0.0 - clauses 4.4.4.6, 4.7.3.1.3 and 4.7.5.1.3, Table 9.62 EMERGENCY SETUP, clause 10.5.3.13 Emergency Number List and clause 10.5.4.33 Service category
[2] 3GPP TS 24.301 - clause 5.3.7, Handling of the local emergency numbers list, for LTE