When a UMTS UE asks for an RRC connection, the first thing the RNC learns is why the UE is asking. That reason travels as the establishmentCause field in the RRC CONNECTION REQUEST. The RNC reads it before it knows anything else about the call. So the RNC can use it to decide whether to admit the UE when the cell is loaded. Let's look at the list of values first. Then we'll see how the NAS procedure picks one of them, and which rules inside RRC can override the NAS choice.

• Which values can the establishment cause take ?
• Which NAS procedure maps to which establishment cause ?
• How does RRC set and use the cause ?
• Reference

Which values can the establishment cause take ?

The value list is long, and several entries look alike at first glance. Most of them follow a simple pattern: a direction, originating or terminating, combined with a traffic class or a signalling priority. A handful of special values sit outside that pattern, and those are the ones that usually matter in troubleshooting.

Every RRC Connection Request message has its own establishmentCause and understanding the exact meaning of each of these establishment cause would help you with troubleshooting in many cases. In ASN definition, it has a long list of establishmentcause as follows.

The screenshot below is a decoded RRC CONNECTION REQUEST from a UL-CCCH log, not the ASN.1 text itself. The message carries initialUE-Identity set to tmsi-and-LAI, establishmentCause set to registration and protocolErrorIndicator set to noError. The call-out on the right lists the values the decoder offers for the establishmentCause field.

A decoded RRC CONNECTION REQUEST. The UE is asking for a connection in order to register, and the decoder lists 22 possible causes.

• The message : rrcConnectionRequest travels on the UL-CCCH, so the RNC reads it before any dedicated channel exists for the UE.
• The identity : tmsi-and-LAI means upper layers gave the UE a TMSI. By 25.331 subclause 8.5.1, TMSI with LAI has the highest priority, then P-TMSI with RAI, then IMSI, then IMEI.
• The cause : registration is the value that 24.008 uses for a Location update, a GPRS Attach and most routing area updates.
• The list : the call-out stops at mbms-PTP-RB-Request. It was taken from a decoder of an older release and does not show delayTolerantAccess.

The definition below is the ASN.1 text from the current 25.331. It adds delayTolerantAccess after mbms-PTP-RB-Request, and 25.331 subclause 10.3.3.11 marks it as a REL-10 value. After it come nine spare values, so the field has 32 code points in total. PagingCause is shown next to it because the terminating causes are copied from the paging message, as the following sections explain. PagingCause has only seven real values, and each of them has a matching terminating value in EstablishmentCause.

Following is based on 25.331 v19.0.1 (Release 19)

EstablishmentCause ::=			ENUMERATED {
										originatingConversationalCall,
										originatingStreamingCall,
										originatingInteractiveCall,
										originatingBackgroundCall,
										originatingSubscribedTrafficCall,
										terminatingConversationalCall,
										terminatingStreamingCall,
										terminatingInteractiveCall,
										terminatingBackgroundCall,
										emergencyCall,
										interRAT-CellReselection,
										interRAT-CellChangeOrder,
										registration,
										detach,
										originatingHighPrioritySignalling,
										originatingLowPrioritySignalling,
										callRe-establishment,
										terminatingHighPrioritySignalling,
										terminatingLowPrioritySignalling,
										terminatingCauseUnknown,
										mbms-Reception,
										mbms-PTP-RB-Request,
										delayTolerantAccess,
										spare9,
										spare8,
										spare7,
										spare6,
										spare5,
										spare4,
										spare3,
										spare2,
										spare1 }

PagingCause ::=					ENUMERATED {
										terminatingConversationalCall,
										terminatingStreamingCall,
										terminatingInteractiveCall,
										terminatingBackgroundCall,
										terminatingHighPrioritySignalling,
										terminatingLowPrioritySignalling,
										terminatingCauseUnknown,
										spare
 }

The values fall into five groups. The first group is the originating calls, one per UMTS traffic class plus originatingSubscribedTrafficCall. The second group is the terminating calls, with the same traffic classes. The third group is signalling without a call: registration, detach, and the high priority and low priority signalling values. The fourth group is special access, which covers emergencyCall, callRe-establishment and delayTolerantAccess. The last group is the values that RRC or MBMS sets by itself: the two inter-RAT values and the two MBMS values.

• The cause is a request, not a guarantee : the RNC may still reject the connection or redirect the UE. The cause only tells the RNC what the UE intends to do.
• A decoder list can be older than the specification : if a log shows a value your decoder cannot name, check the current EstablishmentCause list before you suspect the UE.
• delayTolerantAccess is the Rel-10 addition : it marks a UE configured for NAS signalling low priority. Under load, the network can reject that UE with an Extended Wait Time of up to 1800 seconds.

Which NAS procedure maps to which establishment cause ?

RRC does not choose the cause by itself in most cases. MM or GMM starts a procedure, and the NAS layer tells RRC which cause to put in the request. So which NAS procedure gives which cause? The answer is a pair of tables in 24.008 Annex L.

You would have to surf through many different specification to find the descriptions for all of these causes, but you would find a list of the most commonly used establishmentcause from the following table defined in 24.008.

24.008 Table L.1.1 covers the CS domain, where MM requests the RR connection. The left column is the CS NAS procedure and the right column is the RRC establishment cause from 25.331.

24.008 Table L.1.1. Every originating CS speech or data call uses Originating Conversational Call, while SMS and supplementary services use the signalling causes.

• Speech and data calls share one cause : both an originating CS speech call and an originating CS data call use Originating Conversational Call.
• SMS has low priority, SS has high priority : MO SMS via CS domain uses Originating Low Priority Signalling. Supplementary Services and the SS part of Location services use Originating High Priority Signalling.
• A paging response copies the paging cause : for an answer to CS paging, the UE sends the paging cause it received in the RRC layer.
• CS fallback is a special case : an answer to paging for CS fallback uses Terminating Conversational Call. The current 24.008 v20.0.0 adds a second line here. If E-UTRAN released the RRC connection with cause CS Fallback High Priority, the cause is Terminating High Priority Signalling instead.

24.008 Table L.1.2 covers the PS domain, where GMM requests the PS signalling connection. The right column is longer here, because several PS procedures give a different cause when the MS has a PDN connection for emergency bearer services.

24.008 Table L.1.2. Most PS procedures have two possible causes, and emergency bearer services decide between them.

• Attach and routing area update normally use Registration : the exception is a RAU for Directed Signalling Connection Re-Establishment, which uses Call Re-Establishment.
• Emergency bearer services override the cause : with an emergency attach, or with a PDN connection for emergency bearer services, the cause becomes Emergency call. Note 2 of the table says that emergency bearer services are only supported in UTRAN Iu mode.
• RAB re-establishment and PDP context activation follow the QoS : the cause is one of the four originating traffic class values. The UE picks the "most demanding" Traffic Class, and Note 1 ranks Conversational first, then Streaming, then Interactive, then Background.
• Other session management uses high priority signalling : Modify PDP Context and Deactivate PDP Context both use Originating High Priority Signalling.
• MBMS has its own two causes : a PS signalling connection for MBMS uses MBMS reception or MBMS p-t-p RB request.

Both tables above are screenshots of an older 24.008 version. I compared them with 24.008 v20.0.0, and the mapping itself is unchanged, but three rows have grown since. The first is the CS fallback line described above. The second is a new last row in both tables. It applies when the initiating uplink message carries the Device properties IE. If the low priority indicator in that IE says "MS is configured for NAS signalling low priority", the cause is Delay tolerant, for any CS or PS NAS procedure. The third is the PS paging row, which now also covers a "call-pull-initiated" indication from the upper layer. The GPRS Attach row also spells out one more condition. An attach that is not an emergency attach still uses Emergency call when the MS starts it to establish emergency bearer services.

24.008 also says why the cause exists. Note 3 of Table L.1.2 states that the network can use the RRC establishment cause to prioritise connection requests at high load. So the mapping is not only bookkeeping. It decides how the RNC ranks a UE against other UEs in a congested cell.

• Registration in a log does not tell you the domain : a Location update, a GPRS Attach and a routing area update all give Registration. Check the CN domain in the following INITIAL DIRECT TRANSFER to see which one it was.
• A PS data session can start with any of four causes : the traffic class of the QoS decides it, so a streaming PDP context gives Originating Streaming Call.
• Newer rows matter for newer UEs : a UE configured for NAS signalling low priority sends Delay tolerant whenever its initiating NAS message carries the low priority indicator.

How does RRC set and use the cause ?

The NAS table decides the cause for most procedures, but RRC holds the value and can replace it. Let's follow the value through RRC, because a log sometimes shows a cause that no row of the 24.008 tables would give.

RRC keeps the cause in the variable ESTABLISHMENT_CAUSE, defined in 25.331 subclause 13.4.6. When upper layers request a signalling connection, the initial direct transfer procedure sets this variable to the cause that upper layers indicate. In idle mode, the UE then starts the RRC connection establishment procedure. The UE copies the variable into the IE "Establishment cause" of the RRC CONNECTION REQUEST, as subclause 8.1.3.3 requires.

Two procedures overwrite the NAS value. In an inter-RAT cell reselection to UTRAN, subclause 8.3.8.2 sets the variable to "Inter-RAT cell reselection". In an inter-RAT cell change order to UTRAN, subclause 8.3.10.2 sets it to "Inter-RAT cell change order". Both subclauses add a note that this value has priority over the cause requested by upper layers. So a UE that arrives from GSM can show one of these two values even for a Location update.

The cause is not limited to the RRC CONNECTION REQUEST. From Rel-5, the INITIAL DIRECT TRANSFER and the CELL UPDATE can also carry an Establishment cause, in their v590 extensions. This matters for a UE that is already connected in one domain and opens a signalling connection in the other one. These two messages can also carry the IE "CS Call type". The UE sets it to speech, video or other when it starts a CS call with Originating Conversational Call or Emergency Call.

The table below collects where each group of causes comes from.

On the network side, the cause is an input to admission control. For example, a congested RNC can keep admitting emergencyCall requests while it rejects low priority requests. The specifications leave the exact policy to the RNC vendor. So two networks can treat the same cause differently. The log only shows the result, an RRC CONNECTION SETUP or an RRC CONNECTION REJECT.

• Check the cause against the procedure that follows : the NAS message inside the next INITIAL DIRECT TRANSFER should match the cause. A registration cause is normally followed by a LOCATION UPDATING REQUEST, an ATTACH REQUEST or a ROUTING AREA UPDATE REQUEST.
• Inter-RAT causes hide the NAS reason : after a reselection from GSM, the RRC cause says Inter-RAT cell reselection. Read the NAS message to find the real purpose.
• Terminating causes follow the paging : if the terminating cause looks wrong, check the paging cause in the PAGING TYPE 1 or PAGING TYPE 2 first.
• Rejects under load often depend on the cause : if only low priority or background requests are rejected, the RNC is probably doing admission control by cause.

Reference

• 3GPP TS 25.331 : Radio Resource Control (RRC); Protocol specification, v19.0.1. Subclauses 8.1.3.3, 8.1.8.2, 8.3.8.2, 8.3.10.2, 8.5.1, 10.3.3.11, 13.4.6 and the ASN.1 of EstablishmentCause and PagingCause.
• 3GPP TS 24.008 : Mobile radio interface Layer 3 specification; Core network protocols; Stage 3, v20.0.0. Annex L, Tables L.1.1 and L.1.2.