1、TAU失敗導(dǎo)致UE無(wú)法正常使用4G網(wǎng)絡(luò)1 問(wèn)題現(xiàn)象用戶為CSFB手機(jī)，在1月6日18點(diǎn)左右由4G網(wǎng)絡(luò)掉至3G網(wǎng)絡(luò)，并且在一天內(nèi)跨越多個(gè)位置區(qū)，經(jīng)過(guò)22小時(shí)的時(shí)間內(nèi)一直無(wú)法回到4G網(wǎng)絡(luò)，直到1月7日16點(diǎn)左右進(jìn)行重新開(kāi)關(guān)機(jī)后才回到4G網(wǎng)絡(luò)。2 信令分析2.1 S1-MME信令通過(guò)信令跟蹤平臺(tái)S1-MME信令分析，發(fā)現(xiàn)用戶在2016-1-6 17:51:34進(jìn)行了一次CSFB業(yè)務(wù)，并在完成業(yè)務(wù)后返回4G網(wǎng)絡(luò)發(fā)起連續(xù)5次TAU，之后就沒(méi)有4G側(cè)信令，直至2016-1-7 16:10:06間隔22小時(shí)后重新在4G網(wǎng)絡(luò)發(fā)起Attach，并在4G網(wǎng)絡(luò)正常駐留。2.2 SGs信令分析SGs信令，發(fā)現(xiàn)用戶在2

2、016-1-6 17:52:00發(fā)起TAU的同時(shí)連續(xù)發(fā)起了5次聯(lián)合位置更新，并且都失敗，失敗原因碼為22，之后就沒(méi)有信令，直至2016-1-7 16:10:07重新發(fā)起聯(lián)合位置更新，并成功。2.3 CSFB信令分析CSFB側(cè)信令，用戶在掛機(jī)前發(fā)起了一個(gè)短信流程，導(dǎo)致用戶掛機(jī)后系統(tǒng)沒(méi)有發(fā)送clear command命令，UE無(wú)法進(jìn)行FR；在后續(xù)進(jìn)行的短信流程中，首先由UE向網(wǎng)絡(luò)側(cè)發(fā)起了一次主動(dòng)短信流程，在網(wǎng)絡(luò)側(cè)等待CP-ACK的過(guò)程中，網(wǎng)絡(luò)側(cè)又向UE發(fā)送了一條短信，但未得到UE的響應(yīng)，此后UE發(fā)起了一次CP-ACK，在完成后釋放資源進(jìn)入空閑態(tài)，并重選至4G網(wǎng)絡(luò)進(jìn)行聯(lián)合位置更新2G網(wǎng)絡(luò)側(cè)此時(shí)由于短

3、信流程還未完成，認(rèn)為UE還在2G網(wǎng)絡(luò)中，并在隨后對(duì)UE發(fā)起了1次被叫通話及被叫短信業(yè)務(wù)，但均為成功；UE在4G最后一次聯(lián)合位置更新發(fā)生2016-01-06 17:52:40，早于2G網(wǎng)絡(luò)側(cè)下發(fā)clear command命令的時(shí)間2016-01-06 17:52:43，相當(dāng)于UE在回到4G進(jìn)行聯(lián)合位置更新的同時(shí)，2G側(cè)網(wǎng)絡(luò)認(rèn)為業(yè)務(wù)流程還未完成，導(dǎo)致連續(xù)5次聯(lián)合位置更新失敗正常短信流程，UE在回應(yīng)CP-ACK后返回空閑態(tài)系統(tǒng)最后在定時(shí)器超時(shí)后下發(fā)clear command命令，命令中所攜帶的原因值為Radio interface failure，相當(dāng)于系統(tǒng)判斷由于得不到UE回應(yīng)而導(dǎo)致的一次異常釋放

4、。3 問(wèn)題分析3.1 失敗原因值分析通過(guò)3GPP TS 24.301協(xié)議分析原因碼22的解釋如下，該問(wèn)題主要由MME問(wèn)題導(dǎo)致。協(xié)議描述：Cause #22 CongestionThis EMM cause is sent to the UE because of congestion in the network (e.g. no channel, facility busy/congested etc.)3.2 失敗處理流程分析發(fā)生該問(wèn)題后的處理策略，協(xié)議描述如下，一共嘗試5次TAU請(qǐng)求，每次間隔為T(mén)3411（10s），當(dāng)達(dá)到5次后，根據(jù)終端類(lèi)型是CS/PS mode 1還是CS/PS mo

5、de 2進(jìn)行不同的流程。如果終端是是CS/PS mode 1，并且不支持IMS voice，終端將選至2G/3G網(wǎng)絡(luò)，并關(guān)閉4G網(wǎng)絡(luò)功能，保證語(yǔ)音業(yè)務(wù)。如果終端是CS/PS mode 2，終端等待T3402（12min），然后重新發(fā)起聯(lián)合TA/LA更新。協(xié)議描述：Combined tracking area updating successful for EPS services only#22(Congestion)The UE shall stop timer T3430 if still running. The tracking area updating attempt counte

6、r shall be incremented, unless it was already set to 5.If the tracking area updating attempt counter is less than 5:-the UE shall start timer T3411, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM. When timer T3411 expires the combined trac

7、king area updating procedure indicating "combined TA/LA updating with IMSI attach" is triggered again.If the tracking area updating attempt counter is equal to 5:-a UE operating in CS/PS mode 2 of operation shall start timer T3402, shall set the EPS update status to EU1 UPDATED and shall e

8、nter state EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM. When timer T3402 expires the combined tracking area updating procedure indicating "combined TA/LA updating with IMSI attach" is triggered again;-a UE operating in CS/PS mode 1 of operation with "IMS voice not available" shall att

9、empt to select GERAN or UTRAN radio access technology and proceed with appropriate MM or GMM specific procedures. The UE shall disable the E-UTRA capability (see subclause 4.5). If the UE is in the EMM-CONNECTED mode, the UE shall locally release the established NAS signalling connection and en

10、ter the EMM-IDLE mode before selecting GERAN or UTRAN radio access technology.TIMER NUM.TIMER VALUESTATECAUSE OF STARTNORMAL STOPON EXPIRYT341110sEMM-DEREGISTERED. ATTEMPTING-TO-ATTACHEMM-REGISTERED. ATTEMPTING-TO-UPDATEAt attach failure due to lower layer failure, T3410 timeout or attach rejected w

11、ith other EMM cause values than those treated in subclause 5.5.1.2.5.At tracking area updating failure due to lower layer failure, T3430 timeout or TAU rejected with other EMM cause values than those treated in subclause 5.5.3.2.5.ATTACH REQUEST sentTRACKING AREA UPDATE REQUEST sentRetrans

12、mission of the ATTACH REQUEST or TRACKING AREA UPDATE REQUESTT343015sEMM-TRACKING-AREA-UPDATING-INITIATEDTRACKING AREA UPDATE REQUEST sentTRACKING AREA UPDATE ACCEPT receivedTRACKING AREA UPDATE REJECT receivedStart T3411 or T3402 as described in subclause 5.5.3.2.6T3402Default 12 min.NOTE 

13、;1EMM-DEREGISTEREDEMM-REGISTEREDAt attach failure and the attempt counter is equal to 5.At tracking area updating failure and the attempt counter is equal to 5.ATTACH REQUEST sentTRACKING AREA UPDATE REQUEST sentInitiation of the attach procedure or TAU procedure3.3 終端模式分析協(xié)議中關(guān)于終端模式的描述如下，目前UE的工作模式主要有

14、4種：PS mode 1 、PS mode 2、CS/PS mode 1、CS/PS mode 2，CS fallback終端工作在CS/PS mode 1、CS/PS mode 2，其主要區(qū)別在于CS/PS mode 1是語(yǔ)音優(yōu)先（voice centric）、CS/PS mode 2是數(shù)據(jù)優(yōu)先（data centric）。根據(jù)協(xié)議，voice centric的終端，必須支持voice功能，如果注冊(cè)到的LTE網(wǎng)絡(luò)不支持CSFB，以及IMS等語(yǔ)音業(yè)務(wù)，那么終端應(yīng)該關(guān)閉LTE的功能，重選回落2G/3G網(wǎng)絡(luò)，用以保證語(yǔ)音業(yè)務(wù)使用。如果LTE網(wǎng)絡(luò)支持CSFB/IMS語(yǔ)音業(yè)務(wù)，那么可以繼續(xù)停留在LTE

15、網(wǎng)絡(luò)上。data centric的終端，如果注冊(cè)到的LTE網(wǎng)絡(luò)，既不支持CSFB，也不支持IMS業(yè)務(wù)，可以繼續(xù)駐留在LTE網(wǎng)絡(luò)。協(xié)議描述：A UE attached for EPS services shalloperate in one of the following operation modes:-PS mode 1 of operation: the UE registers only to EPS services, and UE's usage setting is "voice centric"-PS mode 2 of operation: the

16、 UE registers only to EPS services, and UE's usage setting is "data centric" or the UE has no CS voice capability;-CS/PS mode 1 of operation: the UE registers to both EPS and non-EPS services, and UE's usage setting is "voice centric" and-CS/PS mode 2 of operation: the UE

17、 registers to both EPS and non-EPS services, and UE's usage setting is "data centric" or the UE has no CS voice capability.A UE configured to use CS fallback, shall operate in CS/PS mode 1 or CS/PS mode 2. Such UE may also be configured to use IMS, in which case the voice domain prefer

18、ence as defined in 3GPP TS 24.167 13B shall be used for the selection of the domain for originating voice communication services.A UE configured to use SMS over SGs, but not configured to use CS fallback, shall operate in CS/PS mode 1 or CS/PS mode 2.The behaviour of the UE in CS/PS m

19、ode 1 of operation, upon failure to access the CS domain, will depend on the availability of voice over IMS. In the present document, "IMS voice not available" refers to one of the following conditions:-the UE is not configured to use IMS;-the UE is not configured to use IMS voice, i.e. wh

20、en the voice domain preference, as defined in 3GPP TS 24.167 13B, indicates that voice communication services are allowed to be invoked only over the CS domain;-the UE is configured to use IMS voice, but the network indicates in the ATTACH ACCEPT message or the TRACKING AREA UPDATE AC

21、CEPT message that IMS voice over PS sessions are not supported; or-the UE is configured to use IMS voice, the network indicates in the ATTACH ACCEPT message or the TRACKING AREA UPDATE ACCEPT message that IMS voice over PS sessions are supported, but registration to IMS has failed.當(dāng)終端發(fā)起attach附著請(qǐng)求，或者

22、TAU更新求時(shí)，會(huì)攜帶ue_usage_setting參數(shù)，說(shuō)明終端是語(yǔ)音優(yōu)先（voice centric）還是是數(shù)據(jù)優(yōu)先（data centric）。通過(guò)信令跟蹤平臺(tái)，用戶的終端為voice centric，即CS/PS mode 1，且僅支持CS Voice only，不支持IMS voice。根據(jù)協(xié)議描述，當(dāng)發(fā)生cause#22的聯(lián)合位置更新失敗時(shí)，終端將選至2G/3G網(wǎng)絡(luò)，并關(guān)閉4G網(wǎng)絡(luò)功能。3.4 返回4G網(wǎng)絡(luò)方式根據(jù)協(xié)議描述，當(dāng)終端關(guān)閉4G網(wǎng)絡(luò)后，只能通過(guò)模式改變、開(kāi)關(guān)機(jī)、PLMN選網(wǎng)才可以恢復(fù)4G功能；因此用戶長(zhǎng)時(shí)間無(wú)法從2G/3G返回4G網(wǎng)絡(luò)，只能通過(guò)開(kāi)關(guān)機(jī)或飛行模式才能解決。

23、Disabling and re-enabling of UE's E-UTRA capabilityWhen the UE supporting the A/Gb and/or Iu mode together with the S1 mode needs to stay in A/Gb or Iu mode, in order to prevent unwanted handover or cell reselection from UTRAN/GERAN to E-UTRAN, the UE shall disable the E-UTRA capability.-The UE

24、shall not set the E-UTRA support bits of the MS Radio Access capability IE (see 3GPP TS 24.008 13, subclause 10.5.5.12a), the E-UTRA support bits of Mobile Station Classmark 3 IE (see 3GPP TS 24.008 13, subclause 10.5.1.7) and the ISR support bit of the MS net

25、work capability IE (see 3GPP TS 24.008 13, subclause 10.5.5.12) in the ATTACH REQUEST message and the ROUTING AREA UPDATE REQUEST message after it selects GERAN or UTRAN; and-the UE NAS layer shall indicate the access stratum layer(s) of disabling of the E-UTRA capability.The UE

26、shall enable the E-UTRA capability again in the following cases:- the UE mode of operation changes from CS/PS mode 1 of operation to CS/PS mode 2 of operation;-the UE mode of operation changes from PS mode 1 of operation to PS mode 2 of operation;-the UE powers off and powers on again; or- for the PLMN sel