The VoLTE Machine

The complete technical theory behind lessons 1-1 through 1-6 — written as a book chapter. Configuration, protocol, tools, measurement, and governance of VoLTE on an Ericsson eNodeB, with every value taken from a live network node.

CH 1Anatomy of a VoLTE call

VoLTE is voice carried as IP packets over the LTE packet system, with the IMS (IP Multimedia Subsystem) as the call-control brain and the LTE radio network as the delivery machine. Understanding it requires holding two planes in mind at once: the signaling plane, where SIP messages negotiate the call, and the user plane, where RTP packets carry the actual voice every 20 ms.

The two bearers

A VoLTE-capable phone maintains two parallel PDN connections. The first, to the internet APN, carries ordinary data on a default bearer with QCI-9. The second, to the well-known IMS APN, is opened immediately at attach and carries a default bearer with QCI-5 — the IMS signaling bearer. QCI-5 exists for one purpose: SIP must always get through. It is established once and persists for as long as the phone is attached, idling at near-zero traffic between calls.

The voice media itself never touches either of these. When a call is established, the network builds a dedicated bearer with QCI-1 — guaranteed bit rate, sized for the negotiated codec — and tears it down when the call ends. Two bearers, two jobs: QCI-5 carries INVITE, 183, re-INVITE, BYE; QCI-1 carries nothing but RTP voice.

The five interfaces

The chain of command

The defining moment of VoLTE is the Rx/Gx cascade. When the SDP answer in SIP 183 Session Progress fixes the codec, the P-CSCF describes the required media path to the PCRF over Rx (Diameter AA-Request). The PCRF converts this into a policy-and-charging rule and orders the PGW over Gx (Re-Auth-Request) to install a dedicated bearer. The PGW issues a GTPv2-C Create Bearer Request that rolls through the SGW to the MME, and the MME finally speaks S1AP to the eNodeB: E-RAB SETUP REQUEST. One phone call, translated step by step into a radio-resource command. Chapter 3 decodes that command completely.

CH 2The QCI architecture on Ericsson

On an Ericsson eNodeB, all bearer-level QoS configuration lives in one subtree:

ManagedElement
└─ ENodeBFunction=1
   └─ QciTable=default            ← reservedBy[9]: all nine EUtranCellFDD of the site
      ├─ QciProfilePredefined=qci1 … qci9, qci65, qci66, qci69, qci70, default
      └─ LogicalChannelGroup=0 … 3

The MOM states it plainly: “Each QciProfilePredefined corresponds to a standardized QCI as described in 3GPP TS 23.203… This MO is created by the system.” You cannot create or delete these profiles, only tune them. If a bearer arrives with a QCI that has no defined profile, QciProfilePredefined=default is used — the safety net. On the reference node the QciTable is referenced by all nine cells (three sectors × bands 4, 2, 12), so one attribute change touches voice behavior on the whole site.

The three profiles, side by side (live node values)

Reading the voice profile as design decisions

resourceType = GBR. A non-GBR bearer competes for leftovers; a GBR bearer holds a reservation that admission control accepted and the scheduler must honor every TTI. The difference between a promise and a hope.

serviceType = VOIP is a gate, not a label. The MOM dependency states that DELAY_BASED scheduling “can only be used if serviceType is VOIP or PTT.” Configuration trees have legality rules, and they are written on the MOM page.

schedulingAlgorithm = DELAY_BASED. Proportional-fair schedulers chase throughput and love good channels. Voice wants punctuality. The delay-based scheduler ranks each waiting voice packet against its deadline — the packet's age, not the user's channel, drives the decision. The deadline is pdb = 80 ms: the MOM defines pdb as “the contribution from eNodeB to the Packet Delay Budget… delays outside eNodeB are excluded”; 3GPP TS 23.203 gives QCI-1 100 ms end-to-end, and this node assigns 80 of it to the radio leg. pdbOffset = 50 belongs to active queue management, under the MOM rule pdb + pdbOffset ≥ 0.

The priority flip. TS 23.203 Table 6.1.7 assigns priority 2 to QCI-1 and priority 1 to QCI-5. This node — and its golden file (“qci1, Value=1”) — deliberately invert that, promoting voice media to the top of the scheduler's priority scale. A documented operator decision that disagrees with the spec default: the reason audits are run against operator policy, not against the 3GPP table.

The HARQ set. harqPriority 90 + dl/ulMaxHARQTxQci 7 work as a unit. The limits apply only while this QCI holds the highest HARQ priority on the UE; they require the Service-Specific HARQ license (FAJ 121 4645 / CXC4012070 — ACTIVATED on this node); and they override MACConfiguration::dlMaxHARQTx. Voice gets seven attempts because of what comes next:

rlcMode = UM. RLC for voice never retransmits — old voice is worthless. HARQ at the MAC layer is the only repair mechanism, so it gets maximum depth. QCI-5 is the deliberate mirror: AM, because a lost INVITE is a lost call but a late INVITE is merely a slow call. Sequence-number lengths follow the same fitted-suit logic (12/10 bits for tiny constant voice packets; 15/16 for CA-scale data in flight).

rohcEnabled = true — only on qci1. RTP/UDP/IP headers cost ~40 bytes around a ~30-byte narrowband voice payload. The MOM restricts RoHC to QCIs carrying RTP voice. Without it the radio spends more on bureaucracy than on the human voice.

dscp — the transport bridge. 40 (voice), 26 (signaling), 10 (data) are stamped into the IP header of every S1-U packet: radio QoS becomes transport QoS at the node's edge. The 15-member dscpArpMap struct is all −1 on this node — an unused per-ARP refinement, and knowing what is deliberately unused is also configuration literacy.

DRX. drxPriority 11 binds qci1 to DrxProfile=1 (longDrxCycle SF40, onDuration PSF10, inactivity PSF8, retransmission PSF2 — the 40 ms voice rhythm), while everything else rides DrxProfile=0 (SF320, inactivity PSF100). The highest drxPriority among a UE's bearers decides the whole UE's sleep cycle.

The expert's attribute: ulMinBitRate = 100, dormant. The MOM dependency says it is consumed only by proportional-fair-family schedulers. qci1 runs DELAY_BASED, so the value is configured but inert — it would wake only if someone changed the algorithm. Configuration is values × conditions.

Economics and measurement. qciSubscriptionQuanta (20 / 3 / 150, and 600 for qci6) is the load-balancing cost of a bearer. counterActiveMode changes the definition of “active” used by the active-E-RAB counters — configuration and measurement are one system (see Chapter 5).

CH 3The E-RAB contract — S1AP, IE by IE

S1AP (TS 36.413) is the application protocol of S1-MME, carried over SCTP and encoded with ASN.1 PER. The reference node terminates 24 TermPointToMme connections. Per-UE messages are addressed by the MME-UE-S1AP-ID / eNB-UE-S1AP-ID pair — no IMSI travels on this interface.

E-RAB SETUP REQUEST — the item that builds a voice bearer

The node's answer is policy, not obedience

On the reference node, ENodeBFunction=1,AdmissionControl=1 holds the policy that decides the answer:

# live kget — AdmissionControl=1 (selected attributes)
arpBasedPreEmptionState        1 (ACTIVATED)   ← pre-emption armed; “irrelevant without a valid
                                                 Differentiated Admission Control license” (MOM)
paArpOverride                  6               ← ARP 1–6 treated as Privileged Access (MOM default 7)
paArpOverrideHpa               4               ← ARP 1–4 = High Priority Access
nrOfPaConnReservationsPerCell  20              ← PA seats held per cell — range maximum; MOM default 1
dlAdmOverloadThr / ulAdmOverloadThr  850 / 850 ← GBR admitted only under 85% utilization (MOM default 950)
admResourceMinQciPrio          5               ← which DRBs count toward measured utilization

If the GBR budget fails, the failure has names: pmErabEstabFailGbrDlEnb / …UlEnb, and ARP-based rejections land in pmErabEstabAttRejAdmMsr…Arp. If the budget holds, RRCConnectionReconfiguration builds the DRB (TS 36.331 §5.3.5) and delivers the NAS letter; only then does the node send E-RAB SETUP RESPONSE with its own transportLayerAddress and gTP-TEID — the downlink tunnel endpoint. Uplink TEID from the request + downlink TEID from the response = one complete GTP-U tunnel pair. The failed list (E-RAB-FailedToSetupList + cause) is where trace reading starts.

CH 4The toolchain

Every optimization task is one loop: photograph → read → compare → change. The five weapons map onto it.

moshell & kget — photograph

moshell is Ericsson's engineering terminal. Daily commands: lt (the MO tree), get (read), set (write — fear and respect), mom (in-terminal documentation), and the pm family for counters. kget all writes the entire configuration to a file: the reference photograph is 32 MB, 493,320 lines, 25,224 MOs, ~384k attribute values. Record format: a proxy id, the full DN, then attributes one per line; enums show 1 (ACTIVATED) (number + decoded name); structs announce their member count with members on >>> lines; arrays carry counts in brackets. Three traps: CRLF endings, struct members attach to the line above, and an empty value is still a value.

MOM & CPI — read

The MOM for LTE RAN 25.Q4.4 is 2,791 class pages. Navigate by skeleton: containment tree → description → references → actions → attributes. Each attribute row is a five-clause contract: type+default · description · Dependencies · Disturbances · Takes effect. The CPI's 418 Feature Descriptions are the biographies of licensed features — identity table (name, FAJ, value package, licensing), operation, network impact, parameters.

The golden file — compare

The operator's policy: 6,027 parameter rows (MO class + parameter + recommended value + exceptions) and 533 feature-activation rows (FAJ + CXC + required state). Join keys: kget×golden on class+parameter; golden×FD on FAJ/CXC; kget×MOM on class. One row, audited: pdb on qci1 — kget 80, golden “qci1=80”, MOM {0..500}/1 ms/next-cell-unlock → compliant. Multiply by six thousand rows: that is a configuration audit.

CH 5The KPI tree

A performance counter is a register stepped when a defined event occurs — and the definition is everything. The reference node configures 7,856 MeasurementTypes. VoLTE KPI counters are 256-bin arrays indexed by QCI: voice in bin 1, SIP in bin 5, data in bin 9.

Accessibility

The counter inventory is literal: pmErabEstabAttAddedQci steps “at reception of S1-AP message E-RAB Setup Request”; pmErabEstabSuccAddedQci steps “at transmission of S1-AP message E-RAB Setup Response” — exactly the two messages of Chapter 3.

Added vs Init: the …Init… pair steps at Initial Context Setup (attach-time default bearers). The VoLTE dedicated bearer is an added bearer — mixing the pairs pollutes the KPI. And honesty requires the full chain: end-to-end accessibility = RRC setup SR × S1 signaling SR × E-RAB SR; a perfect E-RAB rate can hide a failing RRC stage.

Retainability

Releases are separated by initiator and outcome: pmErabRelNormalEnbQci (finished call), pmErabRelMmeQci (core-ordered teardown), pmErabRelAbnormalEnbQci (something broke). The drop definition is surgical — pmErabRelAbnormalEnbActQci steps only when the released E-RAB was active (data queued in DL or UL) and excludes releases due to successful handover. A drop is a bearer that died with voice still in its hands.

The session-time variant (a DRB is “in session” if any data moved in the last 100 ms — definition quoted from the inventory) does not flatter short calls. Use both.

Integrity

Three loss surfaces: uplink air loss — pmPdcpPktLostUlQci over (lost + pmPdcpPktReceivedUlQci); downlink in-node discard — pmPdcpPktDiscDlPelrQci (no part transmitted: load/scheduling problem); downlink air loss — pmPdcpPktDiscDlPelrUuQci (transmitted, never acknowledged: coverage/link-adaptation problem). Denominator: pmPdcpPktTransDlQci. The human anchor: codec concealment starts failing around 1% sustained loss — and TS 23.203 sets the QCI-1 PELR target at exactly 10⁻².

CH 6Feature governance

Under SystemFunctions=1,Lm=1 the reference node carries 618 FeatureState objects — 216 ACTIVATED. A modern eNodeB is a warehouse of capabilities; the operator switches on the purchased, chosen subset.

The identity triangle

FAJ — commercial identity (feature descriptions, price lists). CXC — software product identity, used by the license system. On the node, the FeatureState MO is indexed by CXC. Robust Header Compression: FAJ 121 0892 = CXC4010990 = FeatureState=CXC4010990.

The three-state machine

OPERABLE requires license ENABLED ∧ feature ACTIVATED ∧ preconditions met. Activated-but-unlicensed is INOPERABLE plus a license alarm. Licensing even steps traffic counters: pmErabEstabFailAddedLic exists — bearer setups can fail purely for a missing license.

Live examples from the kget

What a professional does with a finding: never flip the switch. ① Classify it — the golden sheet carries exceptions and notes (Service-Specific HARQ explicitly “requires TTI Bundling coordination”). ② Check change history. ③ Raise it with evidence — golden row + kget line + Feature Description — and let the change process decide. The states tell you what, never why. And every activation needs a verification plan: which counters should move if the feature truly went OPERABLE. Activating a feature without one is hope with a command line.

CH 7KPI-optimization case studies

Three scenarios that exercise Module 1's machinery end to end. Format: KPI symptom → counter evidence → root cause → parameter action (exact MO.attribute) → verification → rollback.

Case A — Voice integrity degrades at cell edge: a pdb/scheduler scenario

KPI: Uplink Packet Loss Rate bin 1 (pmPdcpPktLostUlQci[1] / (lost+received)) crosses 1% (the TS 23.203 PELR line) on three rural cells; accessibility and drops are clean. Evidence: loss concentrates at low-RSRP samples; tReorderingUl=60 expiries; HARQ already at its 7-attempt maximum behind harqPriority=90. Root cause: the delay-based scheduler is honoring pdb=80 — at the edge, packets either make the deadline with too few HARQ rounds left or die in reordering. Action: this is a Module 4 coverage problem (TTI bundling / robust UL LA), not a pdb problem — raising QciProfilePredefined=qci1.pdb trades deadline slack against end-to-end latency for the whole site (one QciTable, nine cells, reservedBy[9]) and needs next-cell-unlock. If trialed at all: one off-peak window, pdb 80→100 with pdbOffset per the MOM rule pdb+offset ≥ 0. Verify: UL loss and mouth-to-ear delay together — improving one while breaking the other is failure. Rollback: restore 80 at next unlock.

Case B — The TTI Bundling governance finding becomes a trial

KPI driver: the same edge-loss cells as Case A. Finding (lesson 1-4/1-6): FeatureState=CXC4011253 (TTI Bundling, FAJ 121 2051) is licenseState ENABLED but featureState DEACTIVATED / serviceState INOPERABLE, while the golden Feature Activations sheet says ACTIVATED — with a comment that Service-Specific HARQ (FAJ 121 4645, ACTIVATED) requires TTI-bundling coordination. Action: not an instinctive set — classify (band/region exceptions?), check change history, then a scoped trial: activate on the three cells in a window, with the FD's parameter set staged. Verify: UL loss bin 1 and pmErabRelAbnormalEnbActQci[1] down on trial vs control; watch UL capacity cost (bundling spends PRBs). Rollback: featureState DEACTIVATED — one attribute, new-connection semantics.

Case C — Two nodes, same formula, different truth: counterActiveMode

KPI symptom: after a parameter alignment, one market's VoLTE drop rate appears 15% worse than another's with identical radio conditions. Evidence: market A runs qci1.counterActiveMode=true (active = first-to-last data occurrence), market B false (buffer + 100 ms guard) — the “active E-RAB” population in the denominator-side counters differs by definition. Root cause: configuration and measurement are one system; the KPI was compared across differently-configured nodes. Action: align counterActiveMode per golden before comparing markets; annotate dashboards with the config dependency. Verify: recompute the trend after alignment; the “regression” disappears. Lesson: some KPI optimizations are measurement repairs, not radio changes.

REFReferences

• 3GPP TS 23.203 — Policy and charging control architecture (QCI characteristics, Table 6.1.7)
• 3GPP TS 23.401 — GPRS enhancements for E-UTRAN access (EPC architecture, dedicated bearer activation)
• 3GPP TS 23.228 — IP Multimedia Subsystem (IMS), Stage 2
• 3GPP TS 36.413 — S1 Application Protocol (E-RAB Setup §8.2.1, IEs §9.1.3/§9.2.1)
• 3GPP TS 36.331 — RRC protocol (reconfiguration §5.3.5) · TS 36.322 — RLC (UM §5.1) · TS 36.323 — PDCP · TS 36.321 — MAC/HARQ
• 3GPP TS 29.212 (Gx) · TS 29.214 (Rx) · TS 29.274 (GTPv2-C) · TS 24.229 (IMS call control) · TS 33.203 (IMS AKA)
• Ericsson MOM, LTE RAN 25.Q4.4 — class QciProfilePredefined (doc 616/155 54-LZA 701 6014/33), class QciTable, class AdmissionControl, class FeatureState, class DrxProfile, class LogicalChannelGroup
• Ericsson CPI Feature Descriptions — FAJ 121 0892 (RoHC), FAJ 121 1789 (Delay-Based Scheduling), FAJ 121 3011 (Service Specific DRX), FAJ 121 2051 (TTI Bundling), FAJ 121 4645 (Service-Specific HARQ), FAJ 121 4224 (VoLTE Frequency Hopping)
• Live node: production tri-band NYC RadioNode (anonymized), software 25.Q3, kget of 25,224 MOs · operator golden parameter file (6,027 parameter rows, 533 feature activations)