中国联通FDD_LTE的CSFB测试和分析
一、前言
本文主要针对联通FDD-LTE网络，使用华星FLY6.0进行CSFB测试和分析；CSFB 涉及4G侧(LTE)、3G侧（WCDMA）和MSC核心网侧三方的配合。以下主要是针对测试和事件消息流程进行分析和说明。
二、CSFB测试流程
CSFB测试过程主要是主叫4G手机、被叫4G手机分别驻留LTE网络中，连接FLY6.0测试软件，进行主叫4G手机拨打被叫4G手机，主叫4G手机和被叫4G手机分别回落至WCDMA网络进行通话的过程。
CSFB测试流程主要分为测试准备、测试过程和测数据统计三个部分：
三、正常CSFB信令流程
3.1.主叫主要流程
当开机做主叫时，UE首先在FDD_LTE注册（attach）,完成注册后进行拨号；
通过E_nodeB上发CSFB请求；其主要流程如下：
3.1.1开机注册（attach）
注册请求消息Attach Request(层三消息RRCConnectionRequest)由UE发出（消息属NAS层），请求中包括UE注册的小区，UE支持的加密算法和方式；联合注册的4G（TAC）和3G(LAC/RAC)及ClassMark;
Attach request
MORE: 0
LENGTH: 123
LENGTH: 123
LOG_CODE: B0ED
timeStamp: 16:20:28.016
LTE NAS EMM plain OTA outgoing msg
LOG_VERSION: 1
STD_VERSION: 9
STD_VERSION_MAJOR: 5
STD_VERSION_MINOR: 0
NAS: Attach request
Security Header Type: 0
Protocol Discriminator: 7
Message_Types: 65
NAS key set identifier
TSC: 0 - native security context
NASkeysetidentifier: 1
EPS attach type
EPS attach type value: 2 - combined EPS/IMSI attach
EPS mobile identity
Length of EPS mobile identity contents: 11
odd_even indic: 0 - even number of identity digits and also when the GUTI is used
Type of identity: 6 - GUTI
MCC: 460
MNC: 01
MMEGroupID: 9A00
MMECode: 206
M_TMSI: 9A00CC345E25
UE network capability
EEA0: 1 - supporte
128_EEA1: 1 - supported
128_EEA2: 1 - supported
EEA3: 0 - not supported
EEA4: 0 - not supported
EEA5: 0 - not supported
EEA6: 0 - not supported
EEA7: 0 - not supported
EIA0: 0 - not supported
128_EIA1: 1 - supported
128_EIA2: 1 - supported
EIA3: 0 - not supported
EIA4: 0 - not supported
EIA5: 0 - not supported
EIA6: 0 - not supported
EIA7: 0 - not supported
UEA0: 1 - supported
UEA1: 1 - supported
UEA2: 0 - not supported
UEA3: 0 - not supported
UEA4: 0 - not supported
UEA5: 0 - not supported
UEA6: 0 - not supported
UEA7: 0 - not supported
UCS2: 0 - not supported
UIA1: 1 - supported
UIA2: 0 - not supported
UIA3: 0 - not supported
UIA4: 0 - not supported
UIA5: 0 - not supported
UIA6: 0 - not supported
UIA7: 0 - not supported
ACCCSFB: 1 - supported
LPP: 0 - not supported
LCS: 0 - not supported
_1xSRVCC: 0 - not supported
NF: 1 - supported
ESM message container
Length: 38
ESM message container contents: 02,03,D0,31,27,20,80,80,21,10,01,00,00,10,81,06,00,00,00,00,83,06,00,00,00,00,00,0D, 00,00,03,00,00,0A,00,00,10,00
PDN connectivity request
Security Header Type: 0
Protocol Discriminator: 2
Message_Types: 208
PDN type
PDN type value: 3 - IPv4v6
Request type
Request type value: 1 - initial request
Protocol configuration options
Length: 32
ProtocolID 0x: 8021
Length of protocol: 16
code: 1 - Configure-Request
Identifier: 0
length: 16
Type: 129 - Primary DNS Server IP Address
len: 6
IP Address: 0.0.0.0
Type: 131 - Secondary-DNS-Address
len: 6
IP Address: 0.0.0.0
ProtocolID 0x: 0D
Length of protocol: 0
Tracking area identity
MCC: 460
MNC: 01
TAC: 37135
DRX parameter
SPLIT PG CYCLE CODE: 10
CN Specific DRX cycle length coefficient and DRX value for S1 mode: 0
SPLIT on CCCH: 0 - is not supported
non-DRX timer: 0 - no non-DRX mode after transfer state
MS network capability
Length of MS network capability contents: 3
MS network capability value: E5,C0,3E
Location area identification
MCC: 460
MNC: 10
Lac: 47889
Mobile station class mark 2
Revision level: 2 - Used by mobile stations supporting R99 or later versions of the protocol
ESIND: 0 -
A5/1 algorithm supported: 1 - not available
RF Power Capability: reserved
PS capability: 0 - not present
SS Screening Indicator: 1 defined in GSM 04.80
SM capability: 1 - Mobile station supports mobile terminated point to point SMS
VBS notification reception: 0 - no VBS capability or no notifications wanted
VGCS notification reception: 0 - no VGCS capability or no notifications wanted
FC Frequency Capability: 0 - The MS does not support the extension band G1 in addition to the primary GSM band
CM3: 1 - The MS supports options that are indicated in class mark 3 IE
LCSVA capability: 1
UCS2: 0 - the ME has a preference for the default alphabet over UCS2
SoLSA: 0 - The ME does not support SoLSA
CMSP: 1 - Network initiated MO CM connection request supported for at least one CM protocol
A5/3 algorithm supported: 1 - not available
A5/2 algorithm supported: 0 - available
Spare half octet
Length Of Supported Codec list: 8
System Identification: 4
Length Of Bitmap for SysID: 2
Length Of Bitmap for SysID: 60
Length Of Bitmap for SysID: 04
System Identification: 0
Length Of Bitmap for SysID: 2
Length Of Bitmap for SysID: 1F
Length Of Bitmap for SysID: 02
Voice domain preference and UE's usage setting
Length of Voice domain preference and UE's usage setting contents: 6
UE's usage setting: 0 - Voice centric
UE's usage setting: 0 - CS Voice only
Voice domain preference and UE's usage setting
GUTI type: 0 - Native GUTI
MS network feature support
Extended periodic timers: 1 - MS support
3.1.2注册（attach）成功
UE收到RRCConnectionSetup消息，进行注册Attach Accepet(层三消息RRCConnectionSetupComplete)，成功消息中包括注册的小区MCC,MNC,MME GroupID,MME Code及UE的M_TMSI等信息．
3.1.3UE语音业务请求（CSFB MT START）
UE上发Ext service request（NAS到EMM）消息，内容为CS fall back业务请求；
Extended service request
MORE: 0
LENGTH: 35
LENGTH: 35
LOG_CODE: B0ED
timeStamp: 16:20:44.796
LTE NAS EMM plain OTA outgoing msg
LOG_VERSION: 1
STD_VERSION: 9
STD_VERSION_MAJOR: 5
STD_VERSION_MINOR: 0
NAS: Extended service request
Security Header Type: 0
Protocol Discriminator: 7
Message_Types: 76
NAS key set identifier
TSC: 0 - native security context
NASkeysetidentifier: 1
Service type
Service type value: mobile originating CS fall back or 1xCS fall back
Mobile identity
Odd/even indication: 0 - even number of identity digits and also when the TMSI/P-TMSI or TMGI and optional MBMS Session Identity is used
Type of identity: 4 - TMSI/P-TMSI
Identity digits (0x): DC345E25
EPS bearer context status
length: 32
EBI: 0
3.1.4E_nodeB指标UE回落
E_nodeB在下发给UE的RRCConnectionRelease中给出重定向的目标（utra_FDD=10713）
RRCConnectionRelease
MORE: 0
LENGTH: 1993
LENGTH: 1993
LOG_CODE: B0C0
timeStamp: 16:20:44.928
RRCConnectionRelease
VERSION: 7
RRC_REL: 10
RRC_REL: 113
RRC_VER: 1
PHYSICAL_CELL_ID: 368(4G服务小区)
FREQ: 1650
System_Frame_Number: 34
Subframe: 8
PDU_NUM: 6
ENCODED_MSG_LEN: 1964
RRC: DL-DCCH-Message
message
c1
rrcConnectionRelease
rrc_TransactionIdentifier = 0
criticalExtensions
c1
rrcConnectionRelease_r8
releaseCause = other
redirectedCarrierInfo（重定向方向）
utra_FDD = 10713
nonCriticalExtension
nonCriticalExtension
cellInfoList_r9 (以下是3G邻区扰码)
utra_FDD_r9[0] physCellId_r9 = 201
utra_FDD_r9[1] physCellId_r9 = 209
utra_FDD_r9[2] physCellId_r9 = 233
utra_FDD_r9[3] physCellId_r9 = 393
utra_FDD_r9[4] physCellId_r9 = 11
utra_FDD_r9[5] physCellId_r9 = 35
utra_FDD_r9[6] physCellId_r9 = 448
utra_FDD_r9[7] physCellId_r9 = 3
3.1.5．UE在3G网络进行呼叫
UE读取3G网络系统消息，发起业务请求（CM Sercive Request）;请求中包括业务类型，UE能力和支持的加密类型等等．．
CM service request
MORE: 0
LENGTH: 31
LENGTH: 31
LOG_CODE: 713A
timeStamp: 16:20:45.832
UMTS NAS Signaling Messages
Direction: From UE
Length: 14
ChannelType: 5
MessageType: 36
UMTS NAS Signaling Messages: CM service request
CM service type
Service Type : 0
Ciphering key sequence number
key sequence : 1
Mobile station classmark
Revision level : 2 - Used by mobile stations supporting R99 or later versions of the protocol
ESIND : 1 - (
A5/1 algorithm supported : 0 - (available)
RF Power Capability : 7 - reserved
PS capability : 1 - (present)
SS Screening Indicator : 1(defined in GSM 04.80)
SM capability : 1 - Mobile station supports mobile terminated point to point SMS
VBS notification reception : 0 - no VBS capability or no notifications wanted VGCS notificationr eception : 0 - no VGCS capability or no notifications wanted
0 - The MS does not support the extension band G1 in addition to the primary GSM bandClassmark 3(CM3) : 1 - The MS supports options that are indicated in classmark 3 IE LCSVA capability : 1
UCS2 : 0 - the ME has a preference for the default alphabet over UCS2
SoLSA : 0 - The ME does not support SoLSA
CMSP : 1 - Network initiated MO CM connection request supported for at least one CM protocol
A5/3 algorithm supported : 1 - (not available)
A5/2 algorithm supported : 0 - (available)
Mobile identity
Type of identity : 4 - TMSI/P-TMSI
Odd/even indication : 0
Identity digits : 0x03C3239B
3.1.6. RAU和RAB建立
在3G网络进行RAU（ROUTING AREA UPDATE REQUEST），无线承载建立请求（RadioBearerSetupComplete），为UE分配无线资源．
RadioBearerSetupComplete
MORE: 0
LENGTH: 26
LENGTH: 26
LOG_CODE: 412F
timeStamp: 16:20:47.026
RRC: UL_DCCH
integrityCheckInfo
messageAuthenticationCode = 32, 0xB6 0x11 0x69 0x93
rrc_MessageSequenceNumber = 2
message
radioBearerSetupComplete
rrc_TransactionIdentifier = 0
start_Value = 20, 0x00 0x00 0110xxxx count_C_ActivationTime = 208
3.1.7. 振铃（Alerting）
在3G网络无线资源分配完成后，网络发振铃消息给UE
3.1.8.接通（Connect）
被叫摘机，链路连通主，被开始通话．
3.1.9.挂机（Disconnect）
结束通话后主呼挂机，上发拆链消息（Disconnect），下（上）行RRC释放后，通话结束；
在E_nodeB下发的RRCConnectionRelease消息中指出了，UE返回4G中心频率(1650)
RRCConnectionRelease
MORE: 0
LENGTH: 27
LENGTH: 27
LOG_CODE: 412F
timeStamp: 16:21:10.142
RRC: DL_DCCH
integrityCheckInfo
messageAuthenticationCode = 32, 0x8D 0xAB 0xEB 0x8C
rrc_MessageSequenceNumber = 1
message
rrcConnectionRelease r3
rrcConnectionRelease_r3
rrc_TransactionIdentifier = 0
n_308 = 1
releaseCause = normalEvent
laterNonCriticalExtensions
v690NonCriticalExtensions
rrcConnectionRelease_v690ext
v770NonCriticalExtensions
rrcConnectionRelease_v770ext
v860NonCriticalExtensions
rrcConnectionRelease_v860ext
redirectionInfo （重定向返回系统和小区中心频点）
interRATInfo
eutra
eutra_TargetFreqInfoList[0]
dlEUTRACarrierFreq = 1650
3.1.10.完成TAU（返回4G）
UE在4G网络进行TAU请求，TAU完成后UE成功返回4G网络．(TAU详细流程详见FTP下载分析)
3.2 .被叫呼叫流程
UE接收到寻呼消息（Paging），向网络发起CSFB请求，其他流程与主叫相同．
Paging
MORE: 0
LENGTH: 36
LENGTH: 36
LOG_CODE: B0C0
timeStamp: 16:21:44.220
Paging
VERSION: 7
RRC_REL: 10
RRC_REL: 113
RRC_VER: 0
PHYSICAL_CELL_ID: 368
FREQ: 1650
System_Frame_Number: 145
Subframe: 10
PDU_NUM: 4
ENCODED_MSG_LEN: 7
RRC: PCCH-Message
message
c1
paging
pagingRecordList[0]
ue_Identity
s_TMSI
mmec = 8, 0xCE m_TMSI = 32, 0xCC 0x73 0xA0 0x25 cn_Domain = cs
四.联合附着手机驻留4G
由于目前LTE网络暂不支持viop业务，CSFB需要从4G回落至3G进行CS域业务，因此手机选择WCDMA和LTE双模情况下，手机需要在CS域LAC和PS域TAC进行联合附着过程。
若是LAC~TAC联合附着成功，手机双模可驻留4G；若是LAC~TAC联合附着不成功，手机双模时会回落至3G。
目前手机双模LAC~TAC联合附着主要通过以下2个途径：
（1）TAU过程中进行LAC~TAC联合附着；
（2）Attach过程中进行联合附着；
只要通过以上之一联合附着成功，手机双模就可以驻留4G;