Manual PLMN network selection and search
preface
The best way to learn this content is to combine theory with cases
1, Network selection and search theory of manual plmn
1.1 theory of manual network selection
TS 3GPP 23.223-h20
1. The mobile phone prompts the PLMN network currently accessible to the user
2. Only when the user manually selects a network from the list can he initiate registration with the network to obtain normal services.
3. The searched list is based on all RAT system capabilities supported by the current mobile phone, including the prohibition of FPLMN.
4. The accessible network list found manually is displayed according to HPLMN / ehplmn -- > user controlled PLMN -- > operator controlled PLMN -- > in the order of Others with strong signal strength, as follows:
5. UPLMN and OPLMN in SIM card
6. It should be noted that once the user triggers manual network search and selection, the mobile phone will not automatically switch to other networks. Even if it is shut down and restarted, it will not be effective unless the network selection mode is changed back to automatic mode.
1.2 process of manual network selection
In general, the flow chart of PLMN manual network selection under normal conditions is marked by the red line below. First take Line 1 to circle C, and then take line 2 to circle A.
2, Qualcomm manual search log
2.1. Start manual search
[5012/0002] MSG 09:42:43.752 DS AT Command Parser/High[dsatcmdp.c 1250] Command Name +cops Op = 0x7 [0005/0002] MSG 09:42:43.752 Call Manager/High [cm.c 12082] =CM= CM_PH_CMD_GET_NETWORKS: network_type 62, list_type 0, subs_id 0, GW BAND PREF 0xffffffff bfffffff [0005/0002] MSG 09:42:43.752 Call Manager/High [cm.c 12087] =CM= User LTE BAND PREF 0x000007ff ffdf3fff ,User TDS BAND PREF 0x00000000 0000003f [0005/0002] MSG 09:42:43.753 Call Manager/High [cmph.c 14415] =CM= CM_PH_CMD_GET_NETWORKS sys_mode 9 [0005/0002] MSG 09:42:43.754 Call Manager/High [cmph.c 20801] =CM= GET_NET mode pref 61 ue mode capability 2568 [0005/0001] MSG 09:42:43.754 Call Manager/Medium [cmph.c 54139] =CM= LTE bands 1_64: 0x000001e0 00000000
1. Sent at+cops =? Command, start searching the Internet. The operation type is 0x7. See the code later.
2,network_type 62, what does this 62 mean? You need to look at the code.
3. Multimode LTE BAND PREF 0x000007ff ffdf3fff needs to be converted into binary, and then from right to left. Bit 0 is B1, 1 stands for support, 0 stands for no support, and so on.
Support band pref B1-B14,B17-B21, B23-B43.
Last supported by the terminal band pref = Supported from a protocol Perspective band pref + RF Angle support calibration band + Operator specific restrictions band The intersection of the three. 1,It must be in the agreement band in 2,RF They are usually calibrated 3,Operator restrictions So, let's look at what the terminal finally supports band，It depends on the operator band pref What are the restrictions in the terminal? The rest are supported by the terminal band
5.5 of agreement 36.101
B1-32 are FDD bands
B33-B46 is the TDD band and the reserved band after B64
4,sys_mode 9 current LTE
5,GET_NET mode pref 61 ue mode capability 2568
Note that there are two concepts when the internal printing mode of the general mobile phone supports several modes, One is the user's network mode in the mobile network settings, which is 4 G Priority, 3 G Priority or only 2 G Wait, it's called mode pref，Corresponding to NV10； One is that after developing multi card and all Netcom mobile phones in developing countries, mobile phones support the largest stack on each software protocol stack RAT Ability, called ue mode capability. When DSDS Mobile non DDS The maximum capacity of the stack where the card is located cannot be PS only of LTE and HDR Ability,
6,LTE bands 1_64: 0x000001e0 00000000 band has become a band that only supports B38, B39, B40 and B41. The number of bands directly supported here has been reduced to four TDD bands
2.2. L-RRC module initiates BPLMN search
[3010/0002/0003/0004] MSG 09:42:43.759 NAS REG/High [ reg_state.c 8829] =REG= CM_NETWORK_LIST_REQ [3010/0002/0003/0004] MSG 09:42:43.759 NAS REG/High [ reg_state.c 1328] =REG= Rat priority list num_items = 3 [3010/0002/0003/0004] MSG 09:42:43.759 NAS REG/High [ reg_state.c 1332] =REG= sys_mode = 9//LTE [3010/0002/0003/0004] MSG 09:42:43.759 NAS REG/High [ reg_state.c 1340] =REG= : LTE bands 1_64 : 0,LTE bands 65_128 : 0,LTE bands 129_192 : 0,LTE bands 193_256 : 0//There were four before this. How did they disappear here? You need to look at the code [3010/0002/0003/0004] MSG 09:42:43.759 NAS REG/High [ reg_state.c 1332] =REG= sys_mode = 11//??? [3010/0002/0003/0004] MSG 09:42:43.759 NAS REG/High [ reg_state.c 1349] =REG= band_cap = 33 [3010/0002/0003/0004] MSG 09:42:43.759 NAS REG/High [ reg_state.c 1332] =REG= sys_mode = 3//GSM [3010/0002/0003/0004] MSG 09:42:43.759 NAS REG/High [ reg_state.c 1349] =REG= band_cap = 384 [3010/0002/0003/0004] MSG 09:42:43.760 NAS REG/High [ reg_send.c 1269] =REG= MMR_PLMN_SEARCH_REQ RAT(LTE) TI (1) scan scope 0 [9501/0002/0022] MSG 09:42:43.763 LTE RRC/High [lte_rrc_plmn_search.c 6300] PLMN_SEARCH: Starting Guard Timer for 180000 ms //3 minute timer [9501/0002/0022] MSG 09:42:43.764 LTE RRC/High [lte_rrc_plmn_search.c 1926] PLMN_SEARCH: Sending 4 LTE bands
1. The search order is L - > 11 (you need to see the code) > G, and supports the printing of various standard band s.
2. Turn on the protection timer for 3 minutes. If all bplmns are not found in 3 minutes, it shows that manual network search fails.
3. L-RRC only scans cells in B38, B39, B40 and B41 bands.
If the test network is in cell B1 of FDD, the network will not be displayed when searching the network manually.
Because the current L-RRC will not search the PLMN of B1 of FDD, so this network will not be displayed.
If the comparator shows the network, there will be a difference.
2.3 reasons for the reduction of BAND to 4.
Is the last BPLMN Searched LTE band support=NV65633 of lte_band_pref + Stack lte band Support the intersection operation of capabilities. (need to see the code)
1. Band supported by NV65633 = B1, B3, B4, B5, B7, B8, B12, B17, B20, B34, B38, B39, B40, B41
2. Stack lte band support capability, in a policy configuration file.
(you need to look at the code and see where the file is.)
In this way, no matter what band your terminal supports, you have to set it as my limited band.
This is a normal phenomenon, a normal process.
3, The manual network search is interrupted by PS.
Because the 3GPP specification does not specify the priority of various services and manual search process during concurrent operation, all platform manufacturers, whether Qualcomm or MTK, basically give priority to user experience. CS voice service > PS service may > manual search process.
NV72528 conn_mode_manual_search，
Q platform is not stupid. This protocol is not standardized. It's not a human thing. I give the decision to the mobile phone manufacturer. You decide whether PS Service > manual search network or manual search network > PS service. I'll open an interface for you,
If the value is 1, it means that any new PS data connection request will be rejected in the process of manual network search (manual network search > PS service)
(currently, our Q products do not have this NV.)
4, Manual network search is interrupted by CS
The strategy of Q platform is as follows:
When the mobile phone is in the connected state, the BPLMN search is cached. If it can return to the Idle state of the Idle before the protection timer expires, the BPLMN search can be resumed. If it remains in the connected state after the timeout, the L-RRC on the mobile phone side directly abandons the BPLMN search and reports the failure of manual search to the NAS. Of course, the timeout value of this protection timer can be 2 minutes, 2.5 minutes and 3 minutes. At present, if it is a DSDS mobile phone, considering that RF resources need to be time-sharing multiplexed to another card, the maximum value is 3 minutes.
Note: according to the article "mobile phone network selection" in the official account of WeChat public, PLMN manual search net selection of those things. There is no current q code, so some need to be added later.