5G Control Plane

The NG-RAN stack is divided into control plane (CP) and user plane (UP) as shown in the figure below. The CP is responsible for the control and management of the radio resources, attachment, and session management. The UP is responsible for the data forwarding.

5G architecture has two modes:

1. Non-standalone (NSA): 5G NSA relies on 4G/LTE for the CP
2. Standalone (SA): 5G SA is fully 5G/NR

The mode options are represented by the table below, where EN-DC refers to Eutra / NR Dual Carrier and NE-DC refers to NR/Eutra Dual Carrier.

Option	SA/NSA	Core	CP-UP	Additional UP	Comment
1	SA	4G-EPC	LTE	-	E-UTRAN
2	SA	5G-CN	NR	-	NR
3/3a/3x	NSA	4G-EPC	LTE	NR	EN-DC
4/4a	NSA	5G-CN	NR	LTE	NE-DC
5	SA	5G-CN	LTE	-	-
6	SA	4G-EPC	NR	-	EPC
7/7a	NSA	5G-CN	LTE	NR	Validation
8/8a	NSA	4G-EPC	NR	LTE	EPC ext: CUPS
?	SA	5G-CN	NR	NR	NR-DC

5G NSA (EN-DC)

In EN-DC, EUTRA (LTE) becomes MCG(Main Cell Group) and NR becomes SCG(Secondary Cell Group), meaning that LTE is the main cell and NR just works as a secondary cell. In NE-DC, NR becomes MCG and Eutra (LTE) becomes SCG, meaning that NR is the main cell and LTE just works as a secondary cell. In EN-DC, Core Network is based on LTE Core, NR just provides an additional RAN pipe. When NR is added to the LTE cell, UE should be able to detect SSB of NR cell and perform RACH procedure to NR. Overview of Signaling Procedure: Adding NR Cell to an Existing LTE Cell.

This section focuses on the process of incorporating an NR cell, known as the Secondary Node (SN), into an existing LTE cell, referred to as the Master Node (MN). The signaling flow for this procedure is outlined in the figure below.

Step 1

The MN, which is an LTE eNB, initiates the process by sending an SgNB (Secondary gNB) Addition Request to the SN, an NR gNB in this scenario. The LTE eNB conveys several crucial pieces of information to the NR gNB, including:

• Characteristics of the E-RAB.
• Detailed SCG (Secondary Cell Group) configuration information, encompassing the entire UE (User Equipment) capabilities and UE capability coordination results.
• The most recent measurement results for the SN to consider.
• Security information required to enable SRB3 (Signaling Radio Bearer 3).

Step 2

If the SN decides to accept the request, it responds with an SgNB Addition Request Acknowledgment, performing the following actions:

• Allocating the necessary radio resources and transport network resources.
• Determining the Pscell (Primary Cell) and other SCG Scells (Secondary Cell) and providing the new SCG radio resource configuration to the MN.
• In scenarios involving the request for SCG radio resources, offering the SCG radio resource configuration.

Step 3

Once the NR gNB accepts the SN addition request and provides all the essential information to the LTE eNB, the LTE eNB generates an RRC Connection Reconfiguration message. This message carries NR RRC Connection Configuration information, enabling the UE to determine the necessary configuration details for the NR gNB.

Step 4

Upon receiving the RRC Connection Reconfiguration message, the UE checks if all the configurations within the message are compatible with the UE's capabilities. If so, the UE sends an RRC Connection Reconfiguration Complete message. This message also includes NR RRC Response data.

Step 5

Once the LTE eNB (MN) receives the RRC Connection Reconfiguration Complete message from the UE, it informs the NR gNB (SN) that the UE has successfully completed the reconfiguration procedure.

Step 6

Based on the information contained in the NR RRC Connection Configuration within the RRC Connection Reconfiguration message, the UE detects the synchronization signals block (SSBlock), comprising Primary Synchronization Signal (PSS), Secondary Synchronization Signal (SSS), and Physical Broadcast Channel (PBCH) of the NR gNB.

Step 7

After successfully detecting the PSS, SSS, and PBCH of the NR gNB, the UE initiates the Contention-free Random Access Channel (RACH) procedure to connect with the Primary Cell (PSCell) of the Secondary Node (SN or NR gNB). All the necessary information for the RACH procedure is acquired from the RRC Connection Reconfiguration message, eliminating the need for System Information Blocks (SIBs).

5G SA

Initial Attach is the process that happens when you power on your phone. Following are the procedures that happen at this stage.

1. Scan and synchronize.
2. Receive MIB (Master Information Blocks) and SIB (System Information Blocks).
3. Cell selection and random access (RACH).
4. RRC connection.
5. NAS registration.
6. PDU session establishment.
7. Send/Receive data.

Let us look at each of these steps in more detail:

Step1: Scan and synchronize

• There is no channel dedicated to the UE at the beginning because it is unknown.
• The UE searches for nearby cells and acquires the synchronization signals, Primary Synchronization Signal PSS and
• Secondary Synchronization Signal SSS, to synchronize with the gNB timing.

Step2: Receive MIB and SIB

• SIB and MIB messages are generated by RRC.
• The most important signals that UE has to detect before trying connection in NR SA are MIB and SIB1.
• MIB is carried by the physical channel PBCH.
• PBCH is a part of a SSB.
• SIB1 is carried by the physical channel PDSCH.
• MIB carries information about reference subcarrier spacing, control channel for SIB PDSCH, ...
• SIB1 carries all the basic information for UE to perform the initial attachment procedure and also carries scheduling information for other SIBs.
• There is one major difference between NR and LTE. In LTE, all the SIBs are broadcasted periodically regardless of whether UE wants it or not. However, in NR there are two different types of SIBs. One type is the one being transmitted periodically like SIBs in LTE and the other type is the one being transmitted only when there is a request from UE.

Step3: Cell selection and Contention-Based random access (CBRA)

The following messages are exchanged between the UE and the gNB in this step as shown in figure below.

• Msg1 (Preamble Transmission): The UE selects a random access preamble from a set of predefined preambles shared with other UEs in the cell and sends it to the gNB on the PRACH.

• Msg2 (Random Access Response): Upon receiving Msg1, the gNB sends a random access response called Msg2 on the PDSCH. Msg2 includes several critical pieces of information, such as the Time Advance (TA) command for timing adjustment, the RAPID (Random Access Preamble ID) matching the preamble sent by the UE, and an initial uplink grant for the UE. The gNB also assigns a temporary identifier called TC-RNTI to the UE.

• Msg3: After getting the RA response, the UE saves the TC-RNTI and applies the received timing correction. The UE doesn’t have a permanent identity so it picks a random number as a UE identity and includes it in msg3 with the TC-RNTI. Using the initial uplink grant provided in Msg2, the UE transmits Msg3 on the PUSCH. Msg3 is a PUSCH which may carry a certain RRC message(e.g, RrcRequest) or just be pure PHY data.

• Msg4 (Contention Resolution): After processing Msg3, the gNB sends Msg4 to the UE. Msg4 is a MAC data which is for Contention Resolution. The Contention Resolution message contains the random identity chosen by the UE and is addressed by TC-RNTI, confirming that the gNB has correctly identified the UE, and contention has been resolved. At this step, the network provides UE with C-RNTI which is equal to the TC-RNTI.

In the contention-based random access procedure, the preamble is randomly chosen by the UE from a pool of preambles shared with other UEs in the cell, with the result that more than one UE may transmit the same preamble simultaneously. Hence it will be a collision.

Let’s take an example of a collision: Let’s say two UEs, UE-A and UE-B, transmit the same PRACH preamble at the same time. In this case, there will be a collision. There are two possibilities:

• gNB is not able to decode preamble sent by any UE: In this case, both UEs will run a backoff timer with some random value and initiate the RA procedure again.

• gNB is able to decode preamble only from UE-A as it has a higher level of power: In this case, gNB will send RAR (msg2) with TC-RNTI for UE-A. Although the RAR is intended for UE-A, both UEs will decode it and work on it because both of them have transmitted the same preamble at the same time. Then, both UEs will choose some random number as an initial identity and send msg3 to the gNB. But gNB will not be able to decode the message from UE-B as UE-B is using the timing advance value that was intended for UE-A. After that, gNB will include the random number of UE-A in msg4 and send it to UE-A. Although both UEs will decode this message because it is addressed by the TC-RNTI, random numbers sent and received by UE-B will mismatch. Only at this stage UE-B will know that it has lost out to some other UE in contention resolution and it should start the RA procedure from the beginning.

Step4: RRC Connection

The messages exchanged between the UE and the gNB in this step are shown in the figure below.

• Msg1 (RRC Connection Request): The UE sends an RRC Connection Request message to the gNB. The RRC Connection Request message contains the UE identity, the establishment cause, and the list of the NR frequencies that the UE can measure.

• Msg2 (RRC Connection Setup): Upon receiving the RRC Connection Request message, the gNB sends an RRC Connection Setup message to the UE. The RRC Connection Setup message contains the RRC configuration information, including the RRC parameters, the security configuration, and the measurement configuration.

• Msg3 (RRC Connection Complete): After receiving the RRC Connection Setup message, the UE sends an RRC Connection Complete message to the gNB. The RRC Connection Complete message contains the UE identity and the RRC parameters.

• Msg4 (RRC Connection Reconfiguration): Upon receiving the RRC Connection Complete message, the gNB sends an RRC Connection Reconfiguration message to the UE. The RRC Connection Reconfiguration message contains the RRC parameters and the security configuration.

• Msg5 (RRC Connection Reconfiguration Complete): After receiving the RRC Connection Reconfiguration message, the UE sends an RRC Connection Reconfiguration Complete message to the gNB. The RRC Connection Reconfiguration Complete message contains the UE identity and the RRC parameters.

Step5: NAS registration

Once the RRC connection is established, the UE sends a NAS Registration Request message to the network (specifically the AMF) to register with the 5G network. This message includes important information such as the UE's security credentials and UE's network capability. To ensure secure communication, the network initiates an authentication process. After successful authentication, the UE and network establish security keys for secure communication. Once the security process is complete, the AMF sends a Registration Accept message to the UE, which includes the UE's 5G-GUTI (Globally Unique Temporary Identifier) and other relevant configuration information. The UE is now successfully registered with the 5G network.

Step6: PDU session establishment

To establish a data session, the UE sends a PDU (Protocol Data Unit) Session Establishment Request message to the network (specifically the SMF). This message includes the UE's data session requirements, SSC Mode, and the 5G-GUTI. The SMF processes the PDU Session Establishment Request and allocates the necessary resources for the data session. The SMF sends a PDU Session Establishment Accept message to the UE, which contains the PDU session configuration information, such as the allocated QoS and the IP address. The UE is now ready for data transmission over the established PDU session.

Step7: Send/Receive data

Finally, the UE is ready to send and receive data.