SRVCC/e-SRVCC
SRVCC enables VoIP services of LTE user to be handover and carried in the circuit switched (CS) domain of
2G/3G network, ensuring voice service continuity
There are two handover solution:
SRVCC: Ensure voice service continuity
eSRVCC: Enhancement on top of existing SRVCC solution
Note: eSRVCC is commonly used in present live network
1
SRVCC
Definition
Call established on the LTE and IMS networks
During a call, when a UE moves out of the LTE coverage area,
the voice service hands over to CS network
The media handover point is the peer NE (peer UE), when
the local access network changes, the local UE sends the
new SDP information to the peer NE to update the media
path
Re-establish E2E signaling and media bearers
2
eSRVCC
What is e-SRVCC
The media handover point is changed to the NE closer to the
local NE to reduce the HO duration
In the eSRVCC network architecture, the ATCF/ATGW is
added between the P-CSCF and the I-CSCF/S-CSCF, Media
session is anchored to the ATGW
Only media information on the ATGW needs to be updated
when an SRVCC handover occurs. Media information on the
remote UE does not need to be updated
3
SRVCC/e-SRVCC
 Difference between SRVCC and e-SRVCC
4
eSRVCC Procedure
MSC
IM-MGW
SRVCC
-IWF
UE1
eNB
MME
1.RRC CONN ReCFG
2.RRC CONN ReCFG Complete
4.HO Required
3.MR
6.MAP PREPARE HO Req
Uu and A/Iu
Interface Resource
Allocation
10.IAM
5.SRVCC PS to CS Req
CS Bearer
Establishment
Procedure
7.MAP PREPARE HO CNF
8.ADD REQ
9.ADD REPLY
Assign Termination Resource
11.ACM
12.ADD REQ
13.ADD REPLY
14.SRVCC PS to CS Rsp
15.HO CMD
16.Mobility from EUTRAN CMD
5
eSRVCC Procedure
MSC
IM-MGW
SRVCCIWF
UE1
MME
17.INVITE
18.200
19.ACK
20.ADD REQ
21.ADD REPLY
22.NTFY REQ
23.NTFY REPLY
P-CSCF
/ATCF
/ATGW
MM tel
/SCC AS
ATCF
Termination
Establishment
Procedure
CS Location Update
Access Domain
Modification
Procedure
24.INVITE
25.200
26.ACK
Original Call
Release Procedure
27.BYE
28.200 (BYE)
29.BYE
30.200 (BYE)
HSS
Course Contents
• VoLTE Signaling analysis
• VoLTE global cases
7
Overview

Voice over LTE (VoLTE) is expected to become the mainstream solution for providing voice services in commercial LTE networks in the
upcoming years, it integrates voice over IP (VoIP), LTE radio network (i.e., E-UTRAN), LTE core network (i.e., EPC), and the IMS (IP
Multimedia Subsystem) to support voice services.

The SIP (Session Initiation protocol) protocol plays a essential role in VoLTE calls. It is used to create, update and terminate a VoLTE call.
During a VoLTE call, there’re SIP messages resembling those in 2G/3G voice call such as CALL SETUP, SETUP, ALERTING, CONNECT
etc.

SIP messages are transmitted in QCI5, which is a default EPS bearer from UE towards IMS APN, so the SIP Signaling is actually not in
conventional CS(Circuit Switch) domain, but in PS(Packet Switch) domain.
8
VoLTE Bearer

QCI1/QCI2/QCI5 are setup in order to support voice & video call over
LTE networks recommended by 3GPP . Each QCI’s parameters is
standardized for different purposes such as priority/PLR etc.

Radio network may setup QCI5&CQI1&QCI2 bearers for VoLTE
services. These QCIs have higher priority of scheduling, Less PLR,
lower latency, and so on.
9
VoLTE procedures

The figure below indicates the standard procedures when a VoLTE UE power on, including registration, calling, and termination.
10
SIP Architecture

The Session Initiation Protocol (SIP) is an application-layer control protocol (defined in RFC3261) stipulated by IETF for creating,
modifying, and terminating sessions with one or more participants.

SIP runs on top of IP. The network-layer protocol is IP and the transport-layer protocol is TCP or UDP (recommended). The bellow
figure shows the SIP protocol stack.
11
SIP messages

SIP messages are either requests or responses

A SIP request is named by a word, to indicate a special purpose.
12
SIP messages

A SIP respond is a Status-Code of 3-digit integer that indicates the outcome of an attempt to understand and satisfy a request;

The first digit of the Status-Code defines the class of response
13
Registration
EPS Attachment(1)

Registration procedure includes EPS attachment and IMS registration.

3GPP IR.92 standard recommends VoLTE to use dual APN architecturE. Internet APN and IMS APN.

VoLTE UE sets up QCI9 radio bearer when attaching to Internet APN, and sets up QCI5 radio bearer when attaching to IMS APN

VoLTE UE indicates it’s voice domain preference and SRVCC ability in Attach request message.

EPC indicates whether CN support voice over LTE by responding Attach accept message .
14
EPC Attachment
Registration
EPS Attachment(2)

The procedure of IMS APN attachment & QCI5 Activation.
16
SIP Registration

QCI5 bearer is activated during a VoLTE UE attaching to IMS APN, but a VoLTE call can’t be initiated unless the VoLTE UE registers with
the IMS network, and the SIP registration messages run over the QCI5. The following figure shows the procedure of SIP registration

The procedure of SIP registration:
1) Register: UE reads the IMSI, and sends a Register message to the P-CSCF on the visited IMS network;
2) 401: The P-CSCF takes & save the IK and CK, and forwards the RAND and AUTN to UE in SIP respond 401;
3) Register: UE calculates a RES using the shared key and RAND, constructs a new Register message that contains the RES, and sends the
message to the P-CSCF.
4) 200 OK: The P-CSCF sends a 200 message(constructed by S-CSCF) to the UE, indicating that the basic registration is successful.
18
Basic Calling

A voice call over LTE
network also require
SIP protocol to initiate
a session between
MO and MT.

The figure in the
middle shows a basic
flow of SIP when a
Voice call over LTE is
made. Meanwhile, the
usage of the typical
SIP requests &
Invite：When the MO (caller) initiates a call, it will send an
Invite called to the MT (called).
100 Trying：MT(called) or IMS responds Invite request by
100 Trying, to indicate the Invite request is in handling.
183 session progress： This respond indicates a session is
in process, especially a bearer resource is allocated while
precondition mode is enabled, usually sent by MT(called) or
IMS.
PRACK：PRACK is subsequent to 183 session progress, to
indicate the bearer resource is creating.
UPDATE：UPDATE request is used to negotiate the
parameters between MT and MO, such as media type etc.
180 Ringing：This respond send from MT to inform MO that
the bell is ringing
200 OK：similar with 180 Ring, it’s sent by MT, but this
respond means called has already answered the phone.
responds are listed
behind it.
20
Voice Call Scenario

The figure in left shows a basic voice
call flow between MO and PCSCF(part of IMS).

There are 2 sorts of messages. 1st
one is SIP message which is already
explained in previous page. 2nd is L3
message of UU interface, please note
the messages in rectangle which are
used to activate the bearer of QCI1.

Activation of QCI1 is trigged by 183
session progress.
21
Basic Call Signaling
Call termination

During the termination of voice call over LTE,
the signaling messages here are also consist
of 2 sorts of message, 1st one is SIP
message, 2nd one is L3 messages.

For the SIP messages, either MO or MT can
terminate the call by initiating a Bye request.

The messages in rectangle shows how QCI1
deactivated.
23
Call termination Signaling
24
SRVCC
SRVCC – Architecture and Principle

VoLTE provides very excellent voice quality and experience to users in LTE hotspot area. However, when UE moves to weak coverage area of the LTE network,
the call may drop and lead to a complaint. SRVCC is an expected mechanism that can guarantee the voice service continuity.

When UE moves to weak coverage area of LTE
network, a SRVCC handover should be triggered, the
Voice should be handover to CS domain of 2G/3G.

In order to support SRVCC handover function, 2G/3G
CN require to upgrade to provide Sv interface.
Interface
Description
Protocol
Sv
Sv interface between the Mobility Management Entity (MME) or Serving GPRS Support Node (SGSN) and 3GPP MSC server enhanced for SRVCC. Sv
interface is used to support Inter-RAT handover from VoIP/IMS over EPS to CS domain over 3GPP UTRAN/GERAN access or from UTRAN (HSPA) to
3GPP UTRAN/GERAN access. It’s based on GTPv2 protocol.
3GPP TS29.280
25
SRVCC Control Flow

The procedure of SRVCC handover seems a
duplication of data interRAT handover’s in
radio part.

SRVCC handover transmit UE from PS domain
of LTE to CS domain of UMTS/GSM, the
information can be observed in “handover
Required”.

For VoLTE SRVCC with data service
accompanied, there are 2 scenarios: (1)CS only
SRVCC , data service could be recovered in a
few seconds after RAU; (2)CS+PS SRVCC, data
service could be recovered in hundreds of
millisecond
26
SRVCC Media Flow

When a Voice over LTE service with data service
accompanied needs SRVCC handover, the MME will
handover the voice service to legacy CS domain with
cooperation of eMSC, and the data service to legacy PS
domain.

When SRVCC handover occurs, service interruption duration is
about 0.5s ~1s, so eSRVCC is introduced to minimum the service
interruption duration

ATCF and ATGW are deployed in IMS as the media anchor to
reduce the service interruption duration to 300ms.
27
SRVCC Signaling example
IP Short message
Registration

IP SMS is a sole service like the VoLTE call. A new NE named IP-SM-GW is required to deploy thise service. Registration to IP-SM-GW is also necessity.

The Registration request and response are SIP messages, so they run on QCI5. 2 SIP messages can be observed in UU interface – Register(indicating that UE
supports IP short messages by Key IE in contact section of SIP head) and 200 OK.

QCI1 is not required In IP SMS service.
29
IP Short message flow
 The SIP messages transported in UU interface contains 4 steps:
1. UE sends a MESSAGE request to the P-CSCF(proxy-call session control function), The P-CSCF forwards the MESSAGE request to
the serving-call session control function (S-CSCF).
2. The IP-SM-GW sends a 202 respond to UE, indicating that the IP-SM-GW has received the short message.
3. The IP-SM-GW sends a MESSAGE request to UE after the short message has been delivered.
4. UE returns a 200 respond to the IP-SM-GW.
30
IP Short message Signaling
31
Course Contents
• VoLTE Signaling analysis
• VoLTE global cases
32
Case # 1 Call Setup Failure
① Symptom
The VoLTE call always failed in a particular location, after preliminary
analysis of SIP flow, we found there’re long delay between SIP
messages.
4. The Callee SBC forwarded 183 SESSION PROGRESS
immediately, and this message was sent down to Caller
eNodeB in 0.5S to make SDP resource reservation,
unfortunately, eNodeB sent 500 PRECONDITION FAILURE
back.
② Analysis
1.
2.
Capture SIP message in SBC(part of IMS) to analysis.
The Caller sent INVITE message, and SBC received it at 16:29:53.881,
and SBC sent 100 TRYING to caller at once, the time stamp is exactly
same.
5. Due to the long delay of SIP message, the Caller had already
release the VoLTE context and may triggered CSFB(depend on UE
types).
3.
The INVITE message was forwarded to Callee SBC, and SBC sent down
the INVITE to Callee at 16:29.54.806, SBC received the 100 TRYING
about 5.6S latter, and received 183 SESSION PROGRESS after 4 more
seconds.
6. The Callee’s SINR is -10dB during the test and RRC
reestablishment failure was found.
Optimization
Enhance the coverage and reduce interference to improve the UU interface quality.
33
Case # 2 Call Setup Failure
① Symptom
The VoLTE call test always failed in several newly on aired eNodeBs, the
failures were due to QCI1’s establishment, in addition, the establishment
of QCI5 is normal.
② Analysis
1. Refer to the signaling of UE, there’s no QCI1 establishment
requested by CN.
4. In the KPIs, there’s no DL packets on QCI5, while some UL packets
2. Due to the limitation of the SW version, some SIP messages could
were counted in.
not observed through UE log, in order to troubleshoot this issue,
capture the SIP by wireshark.
3. There’s only the 1st SIP REGISTER message during the registration
procedure.
4. Compared with the precious snapshot, we can make sure that, the
the DL packets, 401 UNAUTHORIZED, should be received by
eNodeB and UE were missing.
5. Push transmission engineer to check and found the DSCP of QCI5
Optimization
packet was not 46 which need configured by transmission
equipment.
Push transmission engineer to check and modify
34
Case # 3 Call Drop
① Symptom
There’re 19 VoLTE call drops during a drive test, all the
call drops were happened after RLF, QCI1 couldn’t be
reestablished due to RRC reestablishment failure.
② Analysis
1. There’re 10 MSG1 sent in an example of RA
procedure, the retry times 10 hereby was defined in
preambleTransMax (n10，SIB2)
3. The RLF occurred in case of MSG1 retransmitted for 10 times.
Usually, the RLF would not trigger a VoLTE call drop unless the RL
can be restored.
4. The UE tried to reestablish the RRC but the was rejected. Then UE
access to a new cell by RRC connection setup message.
2. The RA error information were shown as follows.
35
Case # 3 Call Drop
5. In the new cell, the default EPS bearer was established, but the
dedicate EPS bearer wasn’t exist, IMS sent UE the BYE message due to
503 “A.450.402.228.0.0.00045.00000002 Media Bearer Lost” 5 seconds
latter, and VoLTE call drop happened.
③ Conclusion
UE RA to a new cell after RLF, and the dedicate EPS bearer didn’t exist
led to IMS release the VoLTE call.
④ Optimization
Enhance the coverage to avoid the RRC reestablishment.
36
Case # 4 Call Drop
① Symptom
The VoLTE call drop rate is high and access success rate is low in
TOP sites
② Analysis
The VoLTE call drop rate is high and access success rate is low
in TOP sites. And by checking the RSRP we found UE call drop
was not due to weak coverage(Uplink RSRP was 10dB higher
than -130dBm)
37
Case # 4 Call Drop
③ Conclusion
Use online wideband spectrum scanning function on eNodeB, we found
there are strong inter-modulation interference in uplink, and RTWP
between different channel were different(10MHz/842~852).
④ Optimization
Checking RF Channel and resolve the inter-modulation interference.
38
Case # 5 Voice Quality issue
① Symptom
At a site, a UE-UE MOS test is performed for VoLTE services ,and the
test result shows that most of MOS scores are extremely low
② Analysis
1) The results of actions 1-9 are normal.
2) During action 10, the log traced shows that during the period when
MOS score is 1, the number of PDUs on the uplink PDCP layer does not
increase. This indicates that no packets are sent during this period.
39
Case # 5 Voice Quality issue
① Symptom
At a site, a UE-UE MOS test is performed for VoLTE services ,and the
test result shows that most of MOS scores are extremely low
② Analysis
1) The results of actions 1-9 are normal.
2) During action 10, the log traced shows that during the period when
MOS score is 1, the number of PDUs on the uplink PDCP layer does not
increase. This indicates that no packets are sent during this period.
40
Case # 5 Voice Quality issue
③ Conclusion
The preceding analysis shows that the low MOS score is caused by
UE faults. This problem does not exist
after another UE is used.
④ Optimization
The root cause of this issue can be found by performing action 10:
Packet loss impact analysis.
41
Case # 6 Voice Quality issue
① Symptom
2. Because of the weak coverage, the eRAB were released
abnormally, besides, RRC reestablishment was rejected too.
RRC reestablished always happened in a particular location during DT,
the radio link broken duration led to voice packets lost, finally affected
the MOS accordingly.
② Analysis
1. During the DT, there’re many A3 event report at that location,
meanwhile, the RSRQ decreased to -20dB.
42
Case # 6 Voice Quality issue
3. Then UE initiated RA procedure, and there’re about 470ms
interval during which voice packets were lost.
4. During the RRC reestablishment and RA procedure,
about 13 RTP packets lost.
43
Case # 6 Voice Quality issue
5. The MOS value decreased from 3.62 to 1.27.
Optimization
Add the neighbor cell and Ncell relationship for the relevant cells.
44
Case # 7 e-SRVCC Failure
① Symptom
The eSRVCC from HW LTE to E/// UMTS always failed in drive test.
② Analysis
1. The eSRVCC failure message came down from MME, and the root
cause was “unknown target ID”, the reason must because of
neighbor cell’s configuration.
3. Push customer to checked the RNC ID, and the ID was
mismatched.
③ Conclusion
The mismatched RNC ID led to eSRVCC failure.
④ Optimization
Alter the RNC ID in UMTS side.
45