TAU失敗導(dǎo)致UE無法正常使用4G網(wǎng)絡(luò)

1、TAU失敗導(dǎo)致UE無法正常使用4G網(wǎng)絡(luò)1問題現(xiàn)象用戶為CSFB手機，在1月6日18點左右由4G網(wǎng)絡(luò)掉至3G網(wǎng)絡(luò),并且在一天內(nèi)跨越多個位置區(qū)，經(jīng)過 22小時的時間內(nèi)一直無法回到4G網(wǎng)絡(luò)，直到1月7日16點左右進行重新開關(guān)機后才回到4G網(wǎng)絡(luò)。2信令分析2.1 S1-MME 信令通過信令跟蹤平臺 S1-MME 信令分析，發(fā)現(xiàn)用戶在2016-1-6 17:51:34進行了一次CSFB業(yè)務(wù)，并在完成業(yè)務(wù)后返回4G網(wǎng)絡(luò)發(fā)起連續(xù)5次TAU ,之后就沒有4G側(cè)信令，直至2016-1-716:10:06間隔22小時后重新在 4G網(wǎng)絡(luò)發(fā)起 Attach，并在4G網(wǎng)絡(luò)正常駐留。床島開刪WOT 2016-01-06枕

2、 2016-01-06il 2016-01-06*2卜帕lTil9'i36；W317：t5；tl:S3£IT：,】：訂：XE墓廉時«2016-01-06 £016-(?1-» 2016-01-M2 付#01-W門；*?：36：餌 £ 17:9:41:53 1T:H:K:4&2 H：31：折：4 討2016-01-« IT ： 52： 00：割m3Qie-Ql-06 |7；S£:lC：3et2016-0106 17:5:20:361 m-ofc 1丁：醴'鈾：肋1_fe-m-*01-« 17:

3、52:40: BO2016-01 -0617:52:43:150M 2t)lan56 IT：53;8：1K4S 20 e-Ol-OS l?:S2ilO:l41 « 3016-01-tj6 17：12;IO：K1JIS 寅 as SendDE iritiered Service Request TMeklne Area UpdateUdLPWLlnneLlvilTwebJl 燧 TrwcklinsTrack itklfifr-ackiirts Arp* tru ArnOpd«te 0p4*tr Qtenwitt 仍黃Y料t 帆殲-心UE IrlEiercG Scrvl :#

4、fintueit5 2016-01-<17 i$：m：39：幽K 201&-Ql-CfF 1&；13:23;E巧S3 2016-015 16:lSi52:43T20l£-01-ftr 応：10:鵡：3站 2016-01-or |«；3：»：875 2016-01-07 16:15:32:491$1S 軸d lttT<?rk triggered Service- EcquctTTnchlm Area Dnbte顧匹TbSWfiS珀 威功翊avitJi威功 f&JiiC5FB2.2 SGs信令分析SGs信令，發(fā)現(xiàn)用戶在2016-1-

5、6 17:52:00 發(fā)起TAU的同時連續(xù)發(fā)起了5次聯(lián)合位置更新，并且都失敗，失敗原因碼為22，之后就沒有信令，直至2016-1-7 16:10:07重新發(fā)起聯(lián)合位置更新，并成功。型庫因靈里 'J5SF10lT;4S:ll:9Cai2flJft-Ol-0617:<S:12:(raB或明11 Z-016-01-06藥16-01-061 了 ：4S:1Z;(H012 2016-01-061T:9:36:MS2016-01-ti&17:4;36:»T0短君*岌送成勒L3ir：4»:37:OM17:49:3Tf:fl201丁:妙56;9056-01-flan：

6、5S:56:M6IS17 = 50:56:9622fll &-01-CI617:50:5G:W2nsi*分遲成切161T:S1:a*:742Mlfi-Ol-Ofi17:51:3:744專呼rsVJfcST17i52:M:L5S餐魏CIHCauie22 18 2016-01-06lT:TS2:10:2i3lT;52:10:2'iaQBSWiCIHCbuic2219 joifi-oi-oe1T:S2：2D：3?3：lS-01-0617:5；：2O:124竝雷憂斯饗WcmCause22201-01-0617:52:30:40320ie-01-0617:52:30:103tES 更 W

7、燉CllCftUEe22"用匸桓皿監(jiān)-06位 nswiCHCaopc髭223016-0)7raB吏前CSFB2.3 CSFB 信令分析CSFB側(cè)信令，用戶在掛機前發(fā)起了一個短信流程，導(dǎo)致用戶掛機后系統(tǒng)沒有發(fā)送clearcomma nd 命令，UE無法進行FR;在后續(xù)進行的短信流程中，首先由UE向網(wǎng)絡(luò)側(cè)發(fā)起了一次但未得到主動短信流程，在網(wǎng)絡(luò)側(cè)等待CP-ACK的過程中，網(wǎng)絡(luò)側(cè)又向 UE發(fā)送了一條短信,UE的響應(yīng)，此后 UE發(fā)起了一次 CP-ACK ,在完成后釋放資源進入空閑態(tài)，并重選至4G網(wǎng)絡(luò)進行聯(lián)合位置更新2G網(wǎng)絡(luò)側(cè)此時由于短信流程還未完成,認為UE還在2G網(wǎng)絡(luò)中，并在隨后對UE發(fā)起了

8、 1次被叫通話及被叫短信業(yè)務(wù)，但均為成功;UE在4G最后一次聯(lián)合位置更新發(fā)生2016-01-06，相當于5次聯(lián)17:52:40，早于 2G 網(wǎng)絡(luò)側(cè)下發(fā) clear comma nd命令的時間 2016-01-06 17:52:43UE在回到4G進行聯(lián)合位置更新的同時，2G側(cè)網(wǎng)絡(luò)認為業(yè)務(wù)流程還未完成，導(dǎo)致連續(xù)合位置更新失敗Tirww«E*洶比叭毗ILh1?zotie-OL-«:MOiii<：ii：rWJ5III轉(zhuǎn)“at«2m辦恫Tgp；幻“ 1附151巧011i$a1$JQl-Ql-W17： n：3*. Wfl-n9«巧mouaIS201401 Mr

9、：u：）4豪打fl2阿?5J*17201缶EM17:51:34.:1加4 斬1350K31 SS*P fit201« (U-Mi7：n： J*-/Jiacii%J丄1250雪址l»（如巾H（n、塚q忖liTio202aiti-ai-u1；: 11:40. M虻12nsD撫五BSSAP2120i«-01-M143Jjj»?7701 e-Q -«INQ*611"3Z3ZQlC-(U-«ir ： >1：4Z.K331Z3D71zaie Qi-«»Jnw3 Shi祖沖IM】-«H：刃；4邑 Wfi

10、QH1咖«13ua2SlT：H：4t.陽IJmo44外BSa廣"用E,利心1?0*431U'H!53=D?H)7U50*613J*201401 Xi；：H；汕丄時15站201«-ai-Mi'：n ss.Qftsis1350*633gs丹31m電01曲占12»雪疋駐H；蛀;軸 “5MT1350611iSSW332cati-ai-u17sV：Or.0512125003* »EJJjai«-(u-«l：IJ!i.JllW1250t4JJ雷知*升701 e-Q -«V：W!?7.77HWV5e U膽2Q1&

11、#171;-(U-M1?：$2：41.?<JW7liSO17701C-01-Hl'：«!H.7I.751JH31S37QH-0 -«H：刃：4?丁7砒3IMO613K<* (t抻J014-0L-H“；理：）小5間4輛陽IZ50Kb CJNek1料U<X<4IJHliMbiBTle1»i«»rk ypdaT#Pittt> <111SACK on <iV59IAP)> MUfhMrE Ml e訝竿*tgrwE rqapl頸P11& i&T (DTAP> KO<S5)

12、M4FJ1 fKgc imiTruClirfrd&?-P4dl 1iTyCM 5<rv<tr R«|U»f = X 制賓CSS) tcc)g5)屮122UP12flBACK cm fOTAP)' tfn CdtapJ Cfv 環(huán)XMCPLUO' M hUfi火E訂打Xh.?7fl 4M»cmDtlDTIUFLDTI(PT沖Cot.aj"tow£強 M<vKt Aten?( Rd cue CnPVlctE Qieorntcc'=.keIeuc CcwIece 料 V-&AUllQiCH&l

13、t;DfAP><&<?<P-JCiDJ.4 Crt(DTap.)tS«Q<r»-W*加町?jf SACK m 3叭 護等)c4TALIB &Il(DtAPj滬R虬孔3"<"P>rWiM】(DIAP5'滬刃<P-P*TAMR片It我埋PL整 啊 14 NnwK)(h«t4rh to Ni)<*) "-ar比(h4C¥4rh 14 粋J fl*-O*T* 45 10 m十町130 SACK, m (* <S) CF-EPFKMIM NCcm CP

14、T)| r(乖勁CL丄K黑陌蜃A44Gm im£Mi ICFTL111 frtl逛 pn&T lysjlu 亠-17fi MK DTI (Ml百"CllAT 盅吟ihcr =h 2G侵電HH弄ttVtt1竝fOTAP)i (“1暫CurPj CBfS) CP-MT* OlP) ftP-DT* CNcCwdrk Co 略3 tOTAR> (£C> i&4lWr4e侶EWfinitJt i|正常短信流程,UE在回應(yīng)CP-ACK后返回空閑態(tài)cuSBtfswim%*"*7*=強02>4maww:UE揮擁應(yīng)匚 井辿人今闡慮y匚皿1

15、1>R亠hUUAfcWw系統(tǒng)最后在定時器超時后下發(fā)clear comma nd命令，命令中所攜帶的原因值為Radioin terface failure，相當于系統(tǒng)判斷由于得不到UE回應(yīng)而導(dǎo)致的一次異常釋放。IL"活1 二翡，M弓H MH!73 2O16-CH-D& 1丁：52：«，于丁 1I»1 j 01-111-04 丄門,2：iOLQ去駐上 I2»W M irr«： n.7(l JW IJIMOHjjH鮮»!?耳W*swQS*' 5>*13ri140 126 DTl 科fr on 1譏on 7HJ $

16、A£hT1 CPW> (5)1 "工蚯RCPTAPl (CeJ S4Ttjg(SM5)C-fruTA (M崢47. CkHInerk £O 備 tpri*) (CC) iDiirri (iKTZji <WC ? P-IM.-A (ftPJi RF-QTA口 tf«rt to 祥)31 3O1C-G1-H 1：S? L lj_ 2IBJ3口12 H5弭?0J r. Oi f-d J ：2 叮J：'-0巾 r： K-. *1-L U -.w r11 L h 止iAir.! ' M ±1 pHui hj尹 joe-ai-Q

17、S 1丁=$7：2.4丁百3?D«¥?I應(yīng)W 5心OGTE (eSSHA>)Coln*H i*lfr-ni-*n. ir：«：-ij. NSlJ時* SMkSt»1緲來P Cl哄_ . . _-0M - TJO: D"JH C-Ausc -<l> R*lQ "Ihl電rffLCc Fl*?T&； mwLcngtri: 1慎十 ."£亍72 F 寧.m «M1 - caue- (l)|RAd1d1 mefd£c rMiwt Jc* indlLitl3問題分析3.1失敗原因

18、值分析通過3GPP TS 24.301 協(xié)議分析原因碼 22的解釋如下，該問題主要由 MME問題導(dǎo)致。協(xié)議描述:Cause #22-Con gesti onThis EMM cause is sent to the UE because of con gesti on in the n etwork (e.g. noCha nn el, facility busy/c on gested etc.)3.2失敗處理流程分析發(fā)生該問題后的處理策略，協(xié)議描述如下，一共嘗試5次TAU請求，每次間隔為T3411（ 10s），當達到5次后，根據(jù)終端類型是 CS/PS mode 1還是CS/PS mode

19、2 進行不同的流程。如果終端是是 CS/PS mode 1 ，并且不支持IMS voice ，終端將選至 2G/3G 網(wǎng)絡(luò)，并關(guān)閉4G網(wǎng)絡(luò)功能，保證語音業(yè)務(wù)。如果終端是CS/PS mode 2，終端等待T3402（ 12min ），然后重新發(fā)起聯(lián)合 TA/LA更新。協(xié)議描述:Combi ned track ing area up dati ng successful for EPS services only#22(Co ngestio n)The UE shall stop timer T3430 if still running. The track ing area up dati ng

20、 atte mpt cou nter shall be in creme nted, unl ess it was already set to 5.If the track ing area up dati ng atte mpt cou nter is less tha n 5:the UE shall start timer T3411, shall set the EPS up date status to EU1UP DATED and shall en ter stateEMM-REGISTERED.ATTE MP TING-TO-UP DATE-MM. Whe n timer T

21、3411 exp ires the comb ined track ing area up dat ing p rocedure in dicati ng "comb ined TA/LA up dati ng with IMSI attach" is triggered aga in.If the track ing area up dati ng atte mpt cou nter is equal to 5:a UE op erati ng in CS/PS mode 2 of op eratio n shall start timer T3402, shall se

22、t the EPS up date status to EU1 UP DATED and shall en ter state EMM-REGISTERED.ATTE MP TING-TO-UP DATE-MM. When timer T3402 exp ires the comb ined track ing area up dat ing p rocedure in dicati ng "comb ined TA/LA up dati ng with IMSI attach" is triggered aga in;a UE op erat ing in CS/PS m

23、ode 1 of op eratio n with "IMS voice not available" shall atte mpt to select GERAN or UTRAN radio access tech no logy and p roceed with approp riate MM or GMM sp ecific p rocedures. The UE shall disable the E-UTRA cap ability (see subclause 4.5). If the UE is in the EMM-CONNECTED mode, the

24、 UE shall locally release the established NAS sig nalli ng conn ecti on and en ter the EMM-IDLE mode before select ing GERAN or UTRAN radio access tech nology.TIMERNUM.T3411T3430T3402TIMERVALUESTATECAUSE OF STARTNORMAL STOPONEXP IRY10sEMM-DEREGISTEREAt attach failure due to lower layerATTACH REQUEST

25、Retransmission ofD.failure, T3410 timeout or attachsentthe ATTACHATTE MP TING-TO-Arejected with other EMM causeTRACKING AREAREQUEST orTTACHvalues than those treated inUP DATE REQUESTTRACKING AREAsubclause 5.5.125.sentUP DATE REQUESTEMM-REGISTERED.At tracking area up dating failureATTE MP TING-TO-due

26、 to lower layer failure, T3430UPDATEtimeout or TAU rejected withother EMM cause values thanthose treated insubclause .5.15sEMM-TRACKING-ATRACKING AREA UP DATETRACKING AREAStart T3411 or T3402REA- UP DATING-INREQUEST sentUP DATE ACCE PTas described inITIATEDreceivedsubclause .6TRACKING

27、AREAUP DATE REJECTreceivedDefault 12EMM-DEREGISTEREAt attach failure and the attem ptATTACH REQUESTInitiation of themin.Dcounter is equal to 5.sentattach p rocedure orNOTE 1EMM-REGISTEREDAt tracking area up dating failureTRACKING AREATAU p rocedureand the attem pt counter is equalUP DATE REQUESTto 5

28、.sent3.3終端模式分析協(xié)議中關(guān)于終端模式的描述如下,目前UE的工作模式主要有 4種：PS mode 1、PS mode2、CS/PS mode 1、CS/PS mode 2，CS fallback 終端工作在 CS/PS mode 1 、CS/PS mode2，其主要區(qū)別在于 CS/PS mode 1是語音優(yōu)先(voice centric )、CS/PS mode 2 是數(shù)據(jù)優(yōu)先(data cen tric )。LTE網(wǎng)絡(luò)不支持 CSFB，根據(jù)協(xié)議，voice centric的終端，必須支持voice功能，如果注冊到的以及IMS等語音業(yè)務(wù)，那么終端應(yīng)該關(guān)閉LTE的功能，重選回落 2G/3

29、G網(wǎng)絡(luò)，用以保證語音業(yè)務(wù)使用。如果 LTE網(wǎng)絡(luò)支持 CSFB/IMS語音業(yè)務(wù)，那么可以繼續(xù)停留在LTE網(wǎng)絡(luò)上。datacentric的終端，如果注冊到的LTE網(wǎng)絡(luò),既不支持 CSFB，也不支持IMS業(yè)務(wù)，可以繼續(xù)駐留在LTE網(wǎng)絡(luò)。協(xié)議描述:A UE attached for EPS services shall op erate in one of the follow ing op erati on modes:- PS mode 1 of op erati on: the UE registers only to EPS services, and UE's usage sett

30、ing is "voice cen tric"PS mode 2 of op erati on: the UE registers only to EPS services, and UE's usage sett ing is "data cen tric" or the UE has no CS voice cap ability;CS/PS mode 1 of op erati on: the UE registers to both EPS and non-EPS services, and UE's usage sett ing

31、 is "voice cen tric" andCS/PS mode 2 of op erati on: the UE registers to both EPS and non-EPS services, and UE's usage sett ing is "data cen tric" or the UE has no CS voice cap ability.A UE con figured to use CS fallback, shall op erate in CS/PS mode 1 or CS/PS mode 2.Such UE

32、 may also be con figured to use IMS, in which case the voice doma in prefere nee as defi ned in 3GPP TS 24.167 13B shall be used for the selectio n of the doma in for origi nati ng voice com muni cati on services.A UE con figured to use SMS over SGs, but not con figured to use CS fallback, shall op

33、erate in CS/PS mode 1 or CS/PS mode 2.The behaviour of the UE in CS/PS mode 1 of op erati on, upon failure to access theCS domain, will depend on the availability of voice over IMS. In the present docume nt, "IMS voice not available" refers to one of the follow ing con diti ons:- the UE is

34、 not con figured to use IMS;the UE is not con figured to use IMS voice, i.e. whe n the voice doma in pr efere nee, as defi ned in 3GPP TS 24.167 13B, i ndicates that voice commu ni catio n services are allowed to be in voked only over the CS doma in;the UE is con figured to use IMS voice, but the n

35、etwork in dicates in the ATTACH ACCE PT message or the TRACKING AREA UP DATE ACCE PT message that IMS voice over PS sessi ons are not supp orted; or the UE is con figured to use IMS voice, the n etwork in dicates in the ATTACH ACCE PT message or the TRACKING AREA UP DATE ACCE PT message that IMS voi

36、ce over PS sessi ons are supp orted, but registrati on to IMS has failed.當終端發(fā)起attach附著請求，或者 TAU更新求時，會攜帶 ue_usage_setting參數(shù)，說明通過信令跟蹤平臺，用戶，不支持IMS voice。根終端是語音優(yōu)先(voice cen trie)還是是數(shù)據(jù)優(yōu)先(data cen trie )。的終端為 voice centrie ，即 CS/PS mode 1 ，且僅支持 CS Voice only據(jù)協(xié)議描述,當發(fā)生cause#22的聯(lián)合位置更新失敗時，終端將選至2G/3G網(wǎng)絡(luò)，并關(guān)閉 4G網(wǎng)

37、絡(luò)功能。占叮 Ii=I3r心II Llin唸；I詐皇r*c J1+甲*u£"'57-iceJ罷y：:第: sly Ul5jT； t卿-3CT： ZyptEleSfiSt C«-3.4返回4G網(wǎng)絡(luò)方式根據(jù)協(xié)議描述，當終端關(guān)閉4G網(wǎng)絡(luò)后，只能通過模式改變、開關(guān)機、PLMN選網(wǎng)才可以恢復(fù)4G功能；因此用戶長時間無法從2G/3G返回4G網(wǎng)絡(luò)，只能通過開關(guān)機或飛行模式才能解決。Disabli ng and re-e nabli ng of UE's E-UTRA cap abilityWhen the UE supporting the A/Gb and/o

38、rIu mode together with the S1 moden eeds to stay in A/Gb or Iu mode, in order to p reve nt unwan ted han dover or cell reselectionfrom UTRAN/GERAN to E-UTRAN, the UE shall disable the E-UTRAcap ability.-The UE shall not set the E-UTRA support bits of the MS Radio Access cap ability IE(see 3GPP TS 24

39、.008 13, subclause 2a), the E-UTRA support bits ofMobile Station Classmark 3 IE (see 3GPP TS 24.008 13, subclause ) andthe ISR support bit of the MS network cap ability IE (see 3GPP TS 24.008 13, subclause 2) in the ATTACH REQUEST message and the ROUTING AREA UP DATE REQUEST message after it selects GERAN or UTRAN; andthe UE NAS layer shall in dicate the access stratum layer(s) of disabli ng of the E-UTRA cap ability.The UE shall en able the E