UMTS interview questions and answer: Rajdeep

What is RRC? What are the RRC states?

The Radio Resource Control (RRC) protocol belongs to the UMTS WCDMA protocol stack
and handles the control plane signaling of Layer 3 between the UEs (User Equipment) and
the UTRAN. It includes:

 Functions for connection establishment and release,

 Broadcast of system information,
 Radio bearer establishment/reconfiguration and release,
 RRC connection mobility procedures,
 Paging notification and release,
 Outer loop power control.

There can only be one RRC connection open to a UE at any one time
There are four RRC States :

a) Cell DCH
b) Cell FACH
c) Cell PCH
d) URA PCH

CELL_DCH state is characterized by:

 A dedicated physical channel is allocated to the UE in uplink and downlink.
 The UE is known on cell level according to its current active set.
 Dedicated transport channels, downlink and uplink (TDD) shared transport
channels, and a combination of these transport channels can be used by the UE.

CELL_FACH state is characterized by:

 No dedicated physical channel is allocated to the UE.
 The UE continuously monitors a FACH in the downlink.
 The UE is assigned a default common or shared transport channel in the uplink
(e.g. RACH) that it can use anytime according to the access procedure for that
transport channel.
 The position of the UE is known by UTRAN on cell level according to the cell
where the UE last made a cell update.
 In TDD mode, one or several USCH or DSCH transport channels may have been
established.

CELL_PCH state is characterized by:

 No dedicated physical channel is allocated to the UE.
 The UE selects a PCH with the algorithm, and uses DRX for monitoring the
selected PCH via an associated PICH.
 No uplink activity is possible.
 The position of the UE is known by UTRAN on cell level according to the cell
where the UE last made a cell update in CELL_FACH state.
 URA_PCH State is characterized by:
 No dedicated channel is allocated to the UE.
 The UE selects a PCH with the algorithm, and uses DRX for monitoring the
selected PCH via an associated PICH.
 No uplink activity is possible.
 The location of the UE is known on UTRAN Registration area level according to
the URA assigned to the UE during the last URA update in CELL_FACH state.

Describe different RRC States?

a. Cell DCH:
When UE is switched ON, it assumes the CELL_DCH State by default.
It exists when UE really requires UL/DL dedicated resource.
UE is characterized at cell level according to its current Active set.
Logical channels DCCH+DTCH are mapped to transport channel DCH.
E.g. Voice call(CS), Video telephony(CS+PS)

b.Cell FACH:
This happens when,
(1) UE doesn’t require continuous circuit connection with n/w, but DL packets will work.
(2) UE is forced to release the n/w resources to decrease the congestion problems (flip-flop
between DCH and FACH).
(3) Eventual location updates to support CELL_PCH and URA_PCH states (flip-flop between
FACH and PCH).
E.g. Call on hold(CS), File downloading(PS)
No dedicated UL/DL is provided. However, UE will keep monitoring to DL common transport
channel FACH ‘continuously’ and receives packet data meant for UE itself.
When UL transmission is required, it uses RACH for 1-2 frames or CPCH for few more
frames, depending on common access procedures; still UL transmission will be
‘discontinuous’.
UE is known on cell level, but this time it’s based on the last cell update it made.

c.Cell PCH:
This happens when UE doesn’t require an active connection(common/dedicated). But still
needs to be connected, as it’s expecting a n/w initiated or terminated call(CS or PS) in
future.
So, no UL transmission is allowed. Selects a PCH(based on algo.) and keep monitoring
(receiving) it in ‘discontinuous’ mode(DRX).
Can commute only into CELL_FACH state.
E.g. No outgoing call or data receive for long time
UE is still identified on cell level, but now in the cell where UE made its last update, when it
was in CELL_FACH state.
At regular time interval, UE would have to move in CELL_FACH state to update the location
area. If UE is traveling, this update will become frequent because of changing cells.
In some cases UE can have the transition from CELL_DCH to CELL_PCH, but not vice versa;
it has to go via CELL_FACH.

d.URA PCH:
This can be considered as a general case of CELL_PCH state. Because all the characteristics
are same except one.
That is, UE is known on URA(UTRAN Registration Area) level rather than cell level. It listens
to PCH(and updates URA when required).
If UE is traveling continuously from one cell to another. It would have to transit multiple
time to CELL_FACH state for location update. By assigning URA_PCH state, this condition is
avoided, since 1 URA contains one or more cells and vice versa.

3)In which conditions UE will be in Cell FACH state?

This happens when,
UE doesn’t require continuous circuit connection with n/w, but DL packets will work.
UE is forced to release the n/w resources to decrease the congestion problems (flip-flop
between DCH and FACH).
Eventual location updates to support CELL_PCH and URA_PCH states (flip-flop between
FACH and PCH).
E.g. Call on hold(CS), File downloading(PS)
4)What is the difference between Cell PCH and URA PCH state?
UE is known on URA(UTRAN Registration Area) level rather than cell level
If UE is traveling continuously from one cell to another. It would have to transit multiple
time to CELL_FACH state for location update. By assigning URA_PCH state, this condition is
avoided, since 1 URA contains one or more cells and vice versa

5)What is U-RNTI?
URNTI is a 32bit identity.
SRNC identifier + SRNTI makes URNTI

6)Describe the CELL search procedure?

The Cell Search procedure can be summarised into the following steps:
a.Cell Selection: Determine the cell whose received carrier power is the strongest
b.Slot Synchronisation: the UE reads the P-SCH of the strongest carrier and feeds the
received signal through a matched filter (that is matched to the Primary Synchronisation
Code). The slot timing is detected via detection of peaks in the output of the matched filter.
c.Frame Synchronisation and Scrambling Code Group Identification: the UE reads the S-SCH
of the strongest carrier, and correlates the received signal with all the possible 64
Secondary Synchronisation Codes. The output that gives maximum correlation gives the
group of the Primary Scrambling Code used in the cell. This process also gives the frame
timing since the Secondary Synchronisation Code is different for each slot and the group
tells the mapping between slots and SSCs.
d.Scrambling Code Identification: The UE attempts then to read the P-CPICH so as to
extract the Primary Scrambling Code used in the cell. The P-CPICH is always scrambled by
the Primary Scrambling Code of the cell and is spread a factor 256 and an OVSF whose
index is zero. Since the Primary Scrambling Codes are grouped into 64 groups of 8
Scrambling Codes and the S-SCH has
given the Scrambling Code group only 8 possibilities remain. So the P-CPICH is unscrambled
separately withevery possible Scrambling Code (8) in the group and only one output will
produce correct results and the Primary Scrambling Code of the cell is determined.
e.Read Broadcast Information: Since the P-CCPCH is always scrambled by the Primary
Scrambling Code of the cell (which has now been determined) and is always spread using
SF=256 with OVSF index=1, The UE can read the P-CCPCH without any problem. The P-
CCPCH carries the BCH where system information blocks are broadcast throughout the
entire cell. The UE can acquire at this stage various information (e.g. Spreading Factors,
OVSF indexes and Scrambling Codes used in other downlink channels, important
parameters for PRACH transmission, Measurement Parameters, Transport Formats etc.) and
can then decodeother downlink channels, initiate a PRACH procedure, performs some
specific measurements etc.

7)Radio bearer configuration mappings?

Signalling radio bearer RB0 shall be used for all messages sent on the CCCH (UL: RLC-TM,
DL: RLC-UM).
Signalling radio bearer RB1 shall be used for all messages sent on the DCCH, when using
RLC unacknowledged mode (RLC-UM).
Signalling radio bearer RB2 shall be used for all messages sent on the DCCH, when using
RLC acknowledged mode (RLC-AM), except for the RRC messages carrying higher layer
(NAS) signalling.
Signalling radio bearer RB3 and optionally Signalling radio bearer RB4 shall be used for the
RRC messages carrying higher layer (NAS) signalling and sent on the DCCH in RLC
acknowledged mode (RLC-AM).
Additionally, RBs whose identities shall be set between 5 and 32 may be used as signalling
radio bearer for the RRC messages on the DCCH sent in RLC transparent mode (RLC-TM).
8)What are the types of RNTI s? In Which context C-RNTI and U-RNTI used?

9)What are the types of hand over?

Here are following categories of handover (also referred to as handoff):
Hard Handover
Hard handover means that all the old radio links in the UE are removed before the new
radio links are established. Hard handover can be seamless or non-seamless. Seamless hard
handover means that the handover is not perceptible to the user. In practice a handover
that requires a change of the carrier frequency (inter-frequency handover) is always
performed as hard handover.
Soft Handover
Soft handover means that the radio links are added and removed in a way that the UE
always keeps at least one radio link to the UTRAN. Soft handover is performed by means of
macro diversity, which refers to the condition that several radio links are active at the same
time. Normally soft handover can be used when cells operated on the same frequency are
changed.
Softer handover
Softer handover is a special case of soft handover where the radio links that are added and
removed belong to the same Node B (i.e. the site of co-located base stations from which
several sector-cells are served. In softer handover, macro diversity with maximum ratio
combining can be performed in the Node B, whereas generally in soft handover on the
downlink, macro diversity with selection combining is applied.
Generally we can distinguish between intra-cell handover and inter-cell handover. For UMTS
the following types of handover are specified:
Handover 3G -3G (i.e. between UMTS and other 3G systems)
FDD soft/softer handover
FDD inter-frequency hard handover
FDD/TDD handover (change of cell)
TDD/FDD handover (change of cell)
TDD/TDD handover
Handover 3G - 2G (e.g. handover to GSM)
Handover 2G - 3G (e.g. handover from GSM)

The most obvious cause for performing a handover is that due to its movement a user can
be served in another cell more efficiently (like less power emission, less interference). It
may however also be performed for other reasons such as system load control.
10)Handover procedures?
11)What are types of measurements?
Intra-frequency measurements: measurements on downlink physical channels at the same
frequency as the active set. A measurement object corresponds to one cell. Detailed
description is found in subclause 14.1.
Inter-frequency measurements: measurements on downlink physical channels at
frequencies that differ from the frequency of the active set and on downlink physical
channels in the active set. A measurement object corresponds to one cell. Detailed
description is found in subclause 14.2.
Inter-RAT measurements: measurements on downlink physical channels belonging to
another radio access technology than UTRAN, e.g. GSM. A measurement object corresponds
to one cell. Detailed description is found in subclause 14.3.
Traffic volume measurements: measurements on uplink traffic volume. A measurement
object corresponds to one cell. Detailed description is found in subclause 14.4.
Quality measurements: Measurements of downlink quality parameters, e.g. downlink
transport block error rate. A measurement object corresponds to one transport channel in
case of BLER. A measurement object corresponds to one timeslot in case of SIR (TDD only).
Detailed description is found in subclause 14.5.
UE-internal measurements: Measurements of UE transmission power and UE received signal
level. Detailed description is found in subclause 14.6.
UE positioning measurements: Measurements of UE position. Detailed description is found in
subclause 14.7.

12)What is paging? Why paging is required?

Paging: This procedure is used to transmit paging information to selected UEs in idle mode,
CELL_PCH or URA_PCH state using the paging control channel (PCCH).
Paging can be initiated :
Upper layers in the network may request paging, to e.g. establish a signaling connection.
UTRAN may initiate paging for UEs in CELL_PCH or URA_PCH state to trigger a cell update
procedure.
UTRAN may initiate paging for UEs in idle mode, CELL_PCH and URA_PCH state to trigger
reading of updated system information.
UTRAN may also initiate paging for UEs in CELL_PCH and URA_PCH state to release the RRC
connection.
13)Type of Paging?

Paging Type 1
Paging Type 2(UE dedicated paging)

14)When dedicated paging is used?

a.This procedure is used to transmit dedicated paging information to one UE in connected

mode in CELL_DCH , CELL_FACH or CELL_PCH (FDD only) state. Upper layers in the
network may request initiation of paging.
b.For a UE in CELL_DCH, CELL_FACH or CELL_PCH (FDD only) state, UTRAN initiates the
procedure by transmitting a PAGING TYPE 2 message on the DCCH using AM RLC. When not
stated otherwise elsewhere, the UTRAN may initiate the UE dedicated paging procedure also
when another RRC procedure is ongoing, and in that case the state of the latter procedure
shall not be affected.
c.UTRAN should set the IE "Paging cause" to the cause for paging received from upper
layers. If no cause for paging is received from upper layers, UTRAN should set the value
"Terminating – cause unknown".

15)In what situation UE goes to CELL PCH and URA PCH states?
a.Cell PCH:
This happens when UE doesn’t require an active Connection(common/dedicated). But still
needs to be connected, as it’s expecting a n/w initiated or terminated call(CS or PS) in
future
b.URA PCH:
In Cell PCH UE is still identified on cell level, but now in the cell where UE made its last
update, when it was in CELL_FACH state.At regular time interval, UE would have to move in
CELL_FACH state to update the location area. If UE is traveling, this update will become
frequent because of changing cells. If UE is traveling continuously from one cell to another.
It would have to transit multiple time to CELL_FACH state for location update. By assigning
URA_PCH state, this condition is avoided, since 1 URA contains one or more cells and vice
versa

16)What is Cell Update Procedure? What are various Cell Update causes?

1> Uplink data transmission:

2> for FDD, if the variable H_RNTI is not set, and for TDD:
3> if the UE is in URA_PCH or CELL_PCH state; and
3> if the UE has uplink RLC data PDU or uplink RLC control PDU on RB1 or upwards to
transmit:
4> perform cell update using the cause "uplink data transmission".
1> Paging response:
2> if the criteria for performing cell update with the cause specified above. are not met;
and
2> if the UE in URA_PCH or CELL_PCH state, receives a PAGING TYPE 1 .message fulfilling
the conditions for initiating a cell update procedure.
3> perform cell update using the cause "paging response".
1> Radio link failure:
2> if none of the criteria for performing cell update with the causes specified above in the
current subclause is met:
3> if the UE is in CELL_DCH state and the criteria for radio link failure are ,or
3> if the transmission of the UE CAPABILITY INFORMATION message fails.
4> perform cell update using the cause "radio link failure".
1> MBMS ptp RB request:
2> if none of the criteria for performing cell update with the causes specified above in the
current subclause is met; and
2> if the UE is in URA_PCH, Cell_PCH or Cell_FACH state; and
2> if the UE should perform cell update for MBMS ptp radio bearer request,
3> perform cell update using the cause "MBMS ptp RB request".
1> Re-entering service area:
2> if none of the criteria for performing cell update with the causes specified above in the
current subclause is met; and
2> if the UE is in CELL_FACH or CELL_PCH state; and
2> if the UE has been out of service area and re-enters service area before T307 or T317
expires:
3> perform cell update using the cause "re-entering service area".
1> RLC unrecoverable error:
2> if none of the criteria for performing cell update with the causes specified above in the
current subclause is met; and
2> if the UE detects RLC unrecoverable error [16] in an AM RLC entity:
3> perform cell update using the cause "RLC unrecoverable error".
1> Cell reselection:
2> if none of the criteria for performing cell update with the causes specified above in the
current subclause is met:
3> if the UE is in CELL_FACH or CELL_PCH state and the UE performs cell re-selection; or
3> if the UE is in CELL_FACH state and the variable C_RNTI is empty:
4> perform cell update using the cause "cell reselection".
1> Periodical cell update:
2> if none of the criteria for performing cell update with the causes specified above in the
current subclause is met; and
2> if the UE is in CELL_FACH or CELL_PCH state; and
2> if the timer T305 expires; and
2> if the criteria for "in service area" and
2> if periodic updating has been configured by T305 in the IE "UE Timers and constants in
connected mode" set to any other value than "infinity":
3> perform cell update using the cause "periodical cell update".
1> MBMS reception:
2> if none of the criteria for performing cell update with the causes specified above in the
current subclause is met; and
2> if the UE is in URA_PCH, Cell_PCH or Cell_FACH state; and
2> if the UE should perform cell update for MBMS counting ,
3> perform cell update using the cause "MBMS reception".

17)What is Active set?

Active Set is defined as the set of Node-Bs the UE is simultaneously connected to (i.e., the
UTRA cells currently assigning a downlink DPCH to the UE constitute the active set).

18)What is Virtual Active Set?

19)What is Monitor set and detected set Cells?
a.Cells, which are not included in the active set, but are included in the CELL_INFO_LIST
belong to the Monitored Set.
b.Cells detected by the UE, which are neither in the CELL_INFO_LIST nor in the active set
belong to the Detected Set. Reporting of measurements of the detected set is only
applicable to intra-frequency measurements made by UEs in CELL_DCH state.
20)Call and session set up procedure?

Call set up procedure for mobile terminating circuit switched calls:

Step
Direction
Message
Comments
UE
SS
1

SYSTEM INFORMATION (BCCH)
Broadcast
2

PAGING (PCCH)
Paging
3

RRC CONNECTION REQUEST (CCCH)
RRC
4

RRC CONNECTION SETUP (CCCH)
RRC
5

RRC CONNECTION SETUP COMPLETE (DCCH)
RRC
6

PAGING RESPONSE
RR
7

AUTHENTICATION REQUEST
MM
8

AUTHENTICATION RESPONSE
MM
9

SECURITY MODE COMMAND
RRC
10

SECURITY MODE COMPLETE
RRC
11

SET UP
CC (see note)
12

CALL CONFIRMED
CC
13

RADIO BEARER SETUP
RRC RAB SETUP
14

RADIO BEARER SETUP COMPLETE
RRC
15

ALERTING
CC (this message is optional)
16

CONNECT
CC
17

CONNECT ACKNOWLEDGE
CC
NOTE: The "Signal" information element is not included in the SETUP message.

Call set-up procedure for mobile originating circuit switched calls:

Step
Direction
Message
Comments
UE
SS
1

SYSTEM INFORMATION (BCCH)
Broadcast
2

RRC CONNECTION REQUEST (CCCH)
RRC
3

RRC CONNECTION SETUP (CCCH)
RRC
4

RRC CONNECTION SETUP COMPLETE (DCCH)
RRC
5

CM SERVICE REQUEST
MM
6

AUTHENTICATION REQUEST
MM
7

AUTHENTICATION RESPONSE
MM
8

SECURITY MODE COMMAND
RRC
9

SECURITY MODE COMPLETE
RRC
10

SET UP
CC
11

CALL PROCEEDING
CC
12

RADIO BEARER SETUP
RRC RAB SETUP
13

RADIO BEARER SETUP COMPLETE
RRC
14

ALERTING
CC
15

CONNECT
CC
16

CONNECT ACKOWLEDGE
CC

Session set up procedure for mobile terminating packet switched sessions:

Step
Direction
Message
Comments
UE
SS
1

SYSTEM INFORMATION (BCCH)
Broadcast
2

PAGING TYPE1 (PCCH)
Paging
3

RRC CONNECTION REQUEST (CCCH)
RRC
4

RRC CONNECTION SETUP (CCCH)
RRC
5

RRC CONNECTION SETUP COMPLETE (DCCH)
RRC
6

SERVICE REQUEST
GMM
7

AUTHENTICATION AND CIPHERING REQUEST
GMM
8

AUTHENTICATION AND CIPHERING RESPONSE
GMM
9

SECURITY MODE COMMAND
RRC
10

SECURITY MODE COMPLETE
RRC
11

REQUEST PDP CONTEXT ACTIVATION
SM
12

ACTIVATE PDP CONTEXT REQUEST
SM
13

RADIO BEARER SETUP
RRC RAB SETUP
14

RADIO BEARER SETUP COMPLETE
RRC
15

ACTIVATE PDP CONTEXT ACCEPT
SM

Session set up procedure for mobile originating packet switched sessions:

Step
Direction
Message
Comments
UE
SS
1

SYSTEM INFORMATION (BCCH)
Broadcast
2

RRC CONNECTION REQUEST (CCCH)
RRC
3

RRC CONNECTION SETUP (CCCH)
RRC
4

RRC CONNECTION SETUP COMPLETE (DCCH)
RRC
5

SERVICE REQUEST
GMM
6

AUTHENTICATION AND CIPHERING REQUEST
GMM
7

AUTHENTICATION AND CIPHERING RESPONSE
GMM
8

SECURITY MODE COMMAND
RRC
9

SECURITY MODE COMPLETE
RRC
10

ACTIVATE PDP CONTEXT REQUEST
SM
11

RADIO BEARER SETUP
RRC RAB SETUP
12

RADIO BEARER SETUP COMPLETE
RRC
13

ACTIVATE PDP CONTEXT ACCEPT
SM

21)What are the different parameters in the measurement control message?

22)What are the various types of RNC?

a.Serving RNC
b.Drift RNC
c.Controlling RNC

23)What is the use and difference between CRNC, Drift RNC and SRNC?
RNC from which the UE is currently getting Served or connected to is called SRNC or
Serving RNC.
During a soft handover procedure the RNC UE is moving to, is called Drift RNC.
The RNC which controls the movement of UE from Serving RNC to the Drift RNC is called
Controlling RNC.
24)What is initial direct transfer message? What is the use?
The initial direct transfer procedure is used in the uplink to establish a signaling connection.
It is also used to carry an initial upper layer (NAS) message over the radio interface.
25)Difference between initial direct transfer message and the Uplink direct transfer
message?
26)What is security mode command? Why it is used?

Security mode command is a RRC Message,

The purpose of this procedure :
To trigger the start of ciphering or to command the restart of the ciphering with a new
ciphering configuration, for the radio bearers of one CN domain and for all signalling radio
bearers.
It is also used to start integrity protection or to modify the integrity protection configuration
for all signalling radio bearers

27)What is Ciphering and Integrity?

28) What is CCTrCH?

A Coded Composite Transport Channel is the result of combining (multiplexing) several

Transport Channels of the same type; i.e.: we can have a CCTrCh made up of one or
several DCHs, a CCTrCh made up of DSCHs. One exception is that we can have one or
several FACHs multiplexed with a PCH on the same CCTrCh.
A better notation would be for example:
CCTrCh4DCH: A CCTrCh consisting of 4 DCHs
CCTrCh3FACH: A CCTrCh consisting of 3 FACHs
CCTrChPCH,2FACH: A CCTrCh consisting of the PCH and 2 FACHs

29)What is compressed mode?

Higher layers can request a UE to monitor cells on other frequencies (FDD, TDD), or other
systems (GSM). This implies that the UE has to perform measurements, on the other
frequencies/systems and thus higher layers command the UE to enter Compressed Mode.
The UTRAN need to send to the UE all the parameters for the Compressed Mode.
Compression Methods:
When in Compressed Mode the information normally transmitted during a 10 ms frame is
compressed in time sothat gaps of adequate length are created. To achieve this one of three
mechanisms
Puncturing
This method is NOT applicable to downlink.
Spread Factor Reduction
Actually halving the Spread Factor. So with this method if SF is used in non-compressed
frames then SF/2 is used in the compressed frames.
Higher Layer Scheduling
Higher Layers set restrictions so that only a subset of allowed TFCs are used in Compressed
Mode.
Compressed Mode Parameter:
TGSN (Transmission Gap Starting Slot Number): A transmission gap pattern begins in a
radio frame, called firstradio frame of the transmission gap pattern, containing at least one
transmission gap slot. TGSN is the slot numberof the first transmission gap slot within the
first radio frame of the transmission gap pattern;
• TGL1 (Transmission Gap Length 1): Duration of the first transmission gap within the
transmission gap pattern, expressed in number of slots;
• TGL2 (Transmission Gap Length 2): Duration of the second transmission gap within the
transmission gap pattern, expressed in number of slots. If this parameter is not explicitly
set by higher layers, then TGL2 =TGL1;
• TGD (Transmission Gap Start Distance): Duration between the starting slots of two
consecutive transmission gaps within a transmission gap pattern, expressed in number of
slots. The resulting position of the second transmission gap within its radio frame(s) shall
comply with the limitations of TS 25.101 (Ref [2]). If this parameter is not set by higher
layers, then there is only one transmission gap in the transmission gap pattern;
• TGPL1 (Transmission Gap Pattern Length): Duration of transmission gap pattern 1;
• TGPL2 (Transmission Gap Pattern Length): Duration of transmission gap pattern 2. If this
parameter is not explicitly set by higher layers, then TGPL2 = TGPL1.
The following two parameters (integers) control the transmission gap pattern sequence start
and repetition:
• TGPRC (Transmission Gap Pattern Repetition Count): Number of transmission gap
patterns within the transmission gap pattern sequence; From Figure 10 it seems TGPRC is
even, therefore the number of slots in TG Sequence is: 0.5*TGPRC (TGPL1+TGPL2)
• TGCFN (Transmission Gap Connection Frame Number): CFN of the first radio frame of the
first pattern 1 within the transmission gap pattern sequence.

30) What is FACH measurement occasion?

GAPs in S-CCPCH to perform measurement on Different Frequencies or Interrat resection.
31) What is idle update procedure? (CS/PS)

Registration on CS:

Step
Direction
Message
Comments
UE
SS
1
¬
SYSTEM INFORMATION (BCCH)
NW Broadcast
2

RRC CONNECTION REQUEST (CCCH)
RRC
3
¬
RRC CONNECTION SETUP (CCCH)
RRC
4

RRC CONNECTION SETUP COMPLETE (DCCH)
RRC
5

LOCATION UPDATING REQUEST
MM
6
¬
AUTHENTICATION REQUEST
MM
7

AUTHENTICATION RESPONSE
MM
8
¬
SECURITY MODE COMMAND
RRC
9

SECURITY MODE COMPLETE
RRC
10
¬
LOCATION UPDATING ACCEPT
MM
11

TMSI REALLOCATION COMPLETE
MM
12
¬
RRC CONNECTION RELEASE
RRC
13

RRC CONNECTION RELEASE COMPLETE
RRC
Registration on PS:

Step
Direction
Message
Comments
UE
SS
1

SYSTEM INFORMATION (BCCH)
NW Broadcast
2

RRC CONNECTION REQUEST (CCCH)
RRC
3

RRC CONNECTION SETUP (CCCH)
RRC
4

RRC CONNECTION SETUP COMPLETE (DCCH)
RRC
5

ATTACH REQUEST
GMM
6

AUTHENTICATION AND CIPHERING REQUEST
GMM
7

AUTHENTICATION AND CIPHERING RESPONSE
GMM
8

SECURITY MODE COMMAND
RRC
9

SECURITY MODE COMPLETE
RRC
10

ATTACH ACCEPT
GMM
11

ATTACH COMPLETE
GMM
12

RRC CONNECTION RELEASE
RRC
13

RRC CONNECTION RELEASE COMPLETE
RRC

32)Physical/Transport/Logical channel mapping?

33) Features of Rel99/Rel5/Rel6/7?

Release '99
Bearer services
64 kbit/s circuit switched
384 kbit/s packet switched
Location services
Call services: compatible with Global System for Mobile Communications (GSM), based on
Universal Subscriber Identity Module (USIM)
Release 4
Edge radio
Multimedia messaging
MeXe levels
Improved location services
IP Multimedia Services (IMS)
Release 5
IP Multimedia Subsystem (IMS)
IPv6, IP transport in UTRAN
Improvements in GERAN, Mexe, etc
HSDPA
Release 6
WLAN integration
Multimedia broadcast and multicast
Improvements in IMS
HSUPA
34) MIB/SB/SIB details?
MIB: The Scheduling of MIB is Static.
35) What is Channelisation / scrambling?
Spreading is applied to the Physical Channels (except SCH). It consists of two distinct
operations: a. Channelisation and b. Scrambling
Channelisation is performed before scrambling.
Channelisation:
The term spreading is also used to refer to channelisation. Channelisation is the basis for
Code Division Multiple Access (CDMA) encoding. This operation transforms every data
symbol of a signal into a number of chips. The bandwidth of the resulting signal occupies a
much larger bandwidth typically 5 MGHz and therefore the name Wideband-CDMA or W-
CDMA. The number of chips per data symbol is called the Spreading Factor (SF).
Scrambling:
36) When secondary scrambling code used?
When there is any conflict with the Primary Scrambling code then Secondary Scrambling
Code will be used.

37) Why we perform Channelisation or spreading before scrambling?

Before sending a data we need to identify the channel to send the data. A particular
Channelisation code is the “identity” for the channel.
Hence we use Channelisation code to select the channel and then scramble it so as to send
the identity of the UE over the channel

38) When TMSI , P- TMSI , IMSI , IMEI used?

TMSI (GSM-MAP): The TMSI (GSM-MAP) shall be chosen if available. The IE "LAI" in the IE
"Initial UE identity" shall also be present when TMSI (GSM-MAP) is used, for making it
unique.
P-TMSI (GSM-MAP): The P-TMSI (GSM-MAP) shall be chosen if available and no TMSI (GSM-
MAP) is available. The IE "RAI" in the IE "Initial UE identity" shall in this case also be
present when P-TMSI (GSM-MAP) is used, for making it unique.
IMSI (GSM-MAP): The IMSI (GSM-MAP) shall be chosen if available and no TMSI (GSM-MAP)
or P-TMSI is available.
IMEI: The IMEI shall be chosen when none of the above three conditions are fulfilled.
39)What is Auto attached?

Auto Attach
Enabled
Disabled
When Power On
If
MNO I
It will perform a combined Attach
If NMOII
It will do a LAU and Attach.
If UE is Location updated i.e. SIM LAI is same as Cell LAI
Then it will do nothing.
If UE is not Location updated i.e.
SIM LAI differs from the Cell LAI then UE will perform Location Area Update
PS Call
Same RRC connection can be used for the PS call.
Will do a PS attach then the PS call.
40)What is the property of ABP (Anite Baseband Processor) which combined with Agilent
8960 makes a 3G Cell?

41)Why we do a Combined Attach?

If the network operates in Network Mode Of Operation I i.e. NMO I and GPRS MS that
operates in Mode A or Mode B will do a simultaneous IMSI attach for GPRS and non GPRS
services and shall use the Combined GPRS attach, combined and periodic routing area
updating procedures instead of the corresponding MM specific procedures IMSI attach and
normal and periodic Location area updating.

41)When UE triggers Event 3A Measurement Report?

Event 3A:The Estimated Quality of currently used UTRAN frequency is below a certain
threshold and the estimated quality of the other system is above a certain threshold.

42) How many transport channels will be configured when a CSV and a PSD call is
simultaneously going on?
Five transport channels will be configured.
1 for 4 SRBs
3 for CSV
1 for PSD

42)When event 2A, 2B, 2C,2E occurs?

Event 2a: Change of best frequency

Event 2b: The estimated quality of the currently used frequency is below a certain threshold
and the estimated quality of a non-used frequency is above a certain threshold.

Event 2c: The estimated quality of a non-used frequency is above a certain threshold

Event 2d: The estimated quality of the currently used frequency is below a certain threshold

Event 2e: The estimated quality of a non-used frequency is below a certain threshold

43)When event 1A – 1F Event occurs?

event 1A: A Primary CPICH enters the reporting range
event 1B: A primary CPICH leaves the reporting range
event 1C: A non-active primary CPICH becomes better than an active primary CPICH
event 1D: Change of best cell
event 1E: A Primary CPICH becomes better than an absolute threshold
event 1F: A Primary CPICH becomes worse than an absolute threshold

42)Where CK and IK gets generated?

In RRC CK and IK gets generated.
43)Where CK and IK gets stored?
In USIM CK and IK will get stored.
44)Where the Security procedure will start?
Security Procedure will start in RRC but Ciphering will start for AM and UM data security
procedure will start at RLC layer. And for TM mode security procedure start at MAC layer.
45)What are the mandatory SIB’s which UE has to read before campign?
SIB 1,3,5,7,11(It contains neighbor cell Information.)
46) What are the important RACH parameters and which SIB contains this information?
SIB 7/5
47) Which SIB contains S criteria information?
SIB 3
48) Basic things like MO,MT complete voice call flow, Packet call flow?

49) Which NAS message contains the information about Qos and where Qos is been decide
on the network side?
PDP context req.SGSN.

50) Different Measurement reporting criteria, like Event 1 series , Event 2 series?
51) What information does RRC connection setup contain and what RB setup contain?
52) What is SHO and HHO? Which are the layers which are impacted with SHO and HHO?
SHO - RRC,L1
HHO – L1
53) What are the messages which flow for SHO and what are the messages which gets
exchanged with HHO?
54)Different modes of operation in RLC?
55)What do you mean by Special length indicator?

56) Header and payload structure for RLC?

57) Different Reset procedures of RLC?

58) LAI and RAI structure and where is it broadcasted?

MNC+MCC+LAC=LAI
LAI+RAC=RAI
SIB 1.Need to check on MNC can be 2 bit also.
59) Cell synchronization procedure? Channel mapping..
60) What is Multiple PDP and what is meant by MultiRAB and multicall?
2 PS - Multiple PDP
PS+CS – MultiRAB
2CS – MultiCall.
61) Different type of Paging procedures?
62) Different modes of network operation and different class of mobiles with examples?
63) Different sync procedures? (Sync A and Sync B procedures)
64) What is the difference between 8480A,8480B and 8480C? How many Tx and Rx are
there in each of the equipment? How can we configure 8480B or 8480C for SHO?
65)Different SRB’s and its functionality?
66) How would you define a real-time embedded system?
67)What is the purpose of an ISR?
68) What is mutual exclusion?
69)How would you avoid mutual exclusion problems?
70) What is re-entrant?
71) What is a context switch?
72) What does the watchdog timer do?
73) What is priority inversion?
74)What is a deadlock?
75)What is memory mapped I/O?
76)How would you debug a memory leak?
77) What method would you use for scheduling in a complex system like a mobile phone
which has L1, L2, L3, Applications?
78) Why are global variables bad?
79) What is the difference between Message based and Event based processing?
80) How would you write the main processing function for a task?
81) How would you define a realistic software development lifecycle?
82) What debugging tools have you used to debug problems?
83) What source code control tools have you used?
84) What defect tracking tools have you used?
85) Describe the signaling that is required to setup a Mobile Originated GSM Voice call.
86) What layers are involved for setting up a Mobile Originated voice GSM voice call?
87) Describe the signaling that is required to setup a Mobile originated circuit switched data
call.
88) What layers are involved for setting up a Mobile Originated voice GSM circuit switched
data call?
89) Describe the signaling required to setup a Mobile Originated UMTS voice call.
90) What layers are involved in setting up a Mobile Originated UMTS voice call?
91) Describe the signaling required to setup a Mobile Originated Packet Switched UMTS call.
92) What layers are involved in setting up a Mobile Originated Packet Switched UMTS call?
93) What is the main responsibility for the RRC layer in UMTS?
94)What is the main responsibility for the RLC layer in UMTS?
95) What is the main responsibility for the MAC layer in UMTS?
96) What is the difference between an internal and external data call for UMTS?
PPP negotiation happens in case of External Data call. In case of internal data call
application handles packets directly.
97)Can you travel at least a few times a year?
98) Do you like working in group projects that incorporate multiple sites?
99)Tell me how your skill set that can benefit our organization?
100) What do you like doing, new feature development, bug fixes, architecture or testing?
101) Do you like giving giving presentations to the group either live or via NetMeeting?
102)How do like leading conference calls across cross-functional teams at different sites?
103) If you have a problem with your co-worker, how do you resolve that conflict?
104) Why should we hire you?