Quality-Of-Service Handling

Handling of different quality-of-service (QoS) requirements is possible already in LTE, and NR

builds upon and enhances this framework. The key principles of LTE are kept, namely that the
network is in charge of the QoS control and that the 5G core network but not the radio-access
network is aware of the service. QoS handling is essential for the realization of network slicing.

For each connected device, there is one or more PDU sessions, each with one or more QoS flows
and data radio bearers. The IP packets are mapped to the QoS flows according to the QoS
requirements, for example in terms of delay or required data rate, as part of the UDF
functionality in the core network. Each packet can be marked with a QoS Flow Identifier (QFI) to
assist uplink QoS handling. The second step, mapping of QoS flows to data radio bearers, is done
in the radio-access
network.

Thus, the core network is aware of the service requirements, while the radio-access
network only maps the QoS flows to radio bearers. The QoS-flow-to-radio-bearer mapping is not
necessarily a one-to-one mapping; multiple QoS flows can be mapped to the same data radio
bearer.

There are two ways of controlling the mapping from quality-of-service flows to data radio
bearers in the uplink: reflective mapping and explicit configuration.
In the case of reflective mapping, which is a new feature in NR when connected to the 5G core
network, the device observes the QFI in the downlink packets for the PDU session. This provides
the device with knowledge about which IP flows are mapped to which QoS flow and radio bearer.
The device then uses the same mapping for the uplink traffic.
Radio Protocol Architecture

User-Plane Protocols
Service Data Adaptation Protocol (SDAP)

The Service Data Adaptation Protocol (SDPA) is responsible for mapping between a quality-of
service flow from the 5G core network and a data radio bearer, as well as marking the quality-of
service flow identifier (QFI) in uplink and downlink packets. This protocol layer is not
present in LTE but introduced in NR when connecting to the 5G core network due to the
new quality-of-service handling.

What is radio bearer ?

A radio bearer is the collection of PDCP, RLC, and MAC protocol entities and their configuration
parameters that the UE and gNB set up to carry a specific flow of data with specific QoS behavior.

It is a logical protocol path, not a physical channel.

Packet-Data Convergence Protocol (PDCP)

PDCP is a protocol layer in the NR (and LTE) user plane and control plane.
Every radio bearer has its own PDCP entity.

PDCP processes packets coming from SDAP (in NR) or directly from IP/RLC (in LTE EPC/NSA),
and prepares them for transmission over RLC → MAC → PHY.
 1. IP Header Compression (ROHC):

PDCP can compress the IP header using ROHC (Robust Header Compression).

Why?

Because:

 IPv4 header = typically 20 bytes

 IPv6 header = typically 40 bytes
 UDP/TCP headers = 8–20 bytes

Most of that header doesn’t change between packets, so PDCP compresses it.

Only the minimum necessary fields are sent over the air.

At the receiver, PDCP decompresses it back into the original IP header.

This has no effect on integrity of the data; it just reduces overhead.

2. Ciphering (Encryption)

PDCP encrypts the payload of each PDU.

Ciphering:

 Prevents eavesdropping
 Applies to both user-plane and control-plane traffic

3. Integrity Protection (Control Plane Only)

For control-plane messages, PDCP also applies integrity protection.

This prevents:

 Fake RRC messages

 Tampering
 Injection attacks

User-plane traffic normally does not get integrity protection due to overhead.
4. Duplicate Removal

PDCP maintains a PDCP sequence number (SN) for each PDU.

It uses this SN to: Duplicate Removal

When duplicates arrive, PDCP compares sequence numbers and discards replicas.

Duplicates appear in two scenarios:

1. Handover packet forwarding

Old gNB forwards undelivered PDCP PDUs to new gNB.
Some PDUs may also arrive directly from the old path.
The UE receives duplicates → PDCP removes them.

2. PDCP Duplication (for reliability)

Same PDU transmitted via two paths (MCG + SCG).
PDCP removes the duplicate on reception.

5. PDCP Duplication (Reliability Technique)

PDCP can duplicate outgoing PDUs so they are sent through multiple transmission paths.

Example:
Send the same PDCP PDU through:

 Master Cell Group (MCG)

 Secondary Cell Group (SCG)

This increases reliability because the UE only needs one copy to be correct.

At the receiver, PDCP compares sequence numbers and discards duplicates.

This is useful for URLLC (ultra-high reliability services).

6. Dual Connectivity: PDCP-Mediated Split Bearers

Dual connectivity = device connected to two nodes (MCG + SCG), typically:

 MCG → LTE or NR anchor

 SCG → additional NR capacity
Split bearer (the interesting case)

In a split bearer:

 One PDCP entity distributes PDUs to two RLC/MAC/PHY paths:

o One via the Master Cell Group
o One via the Secondary Cell Group

The PDCP entity decides how to route each PDU

Difference between Master Cell Group(MCG) and Secondary Cell Group(SCG):

Master Cell Group (MCG):

 This is the primary cell or group of

cells serving the device.

 Managed by the Master gNB

(MgNB).

 Handles:

 Main control-plane signaling

 Most mobility procedures
 Usually carries some or all user-
plane data

Secondary Cell Group (SCG):

 An additional cell or group of

cells the UE is connected to at the
same time.
 Managed by the Secondary gNB
(SgNB).
 Used mainly to boost throughput
or reliability.
 Usually carries:
o Extra user-plane data
o Sometimes duplicates for
reliability

In simple terms: an extra connection

added on top of the MCG.
Radio Link Control (RLC)

RLC is a protocol layer between PDCP and MAC.

Its job is purely about how to cut, package, and (optionally) retransmit data before it goes to
MAC.

RLC operates on:

 RLC SDUs = data received from PDCP

 RLC PDUs = data sent to MAC

RLC must convert SDUs into PDUs of sizes that fit the scheduled transport block for each
transmission.

1. RLC Modes (three types)

a) Transparent Mode (TM)

 Used for broadcast (e.g., system information).

 No RLC header added.
 No segmentation, no retransmission.

b) Unacknowledged Mode (UM)

 Segmentation
 Duplicate detection
 No retransmission
Used for delay-sensitive traffic (e.g., VoIP, real-time).

c) Acknowledged Mode (AM)

 Segmentation
 Duplicate detection
 Retransmissions (ARQ)
Used for high-reliability data (e.g., general IP traffic).

2. Why NR removes Concatenation

LTE concatenate multiple SDUs into one PDU to reach exactly the needed size.
NR changes it: NR pre-assembles RLC PDUs in advance
(no concatenation, only segmentation). This is a critical low-latency design detail.
 3. RLC has its own retransmission system (ARQ)

This applies only in RLC Acknowledged Mode (AM).

Every RLC PDU has an RLC Sequence Number (RLC SN)

(different from PDCP SN and MAC HARQ process ID)

The receiver checks the sequence numbers it receives

If a PDU is missing, the receiver sends a Status Report

The transmitter then retransmits only the missing RLC PDUs

PDCP Tx → RLC Tx → MAC Tx → PHY Tx → AIR → PHY Rx → MAC Rx → RLC Rx → PDCP Rx

MAC – Medium Access Control

The MAC layer is the traffic controller of NR.

It decides what gets sent, when it gets sent, on which resources, and in what format.

Everything below MAC (PHY) deals with radio signaling.

Everything above MAC (RLC/PDCP) deals with data streams.

MAC is the bridge that turns “data” into “transmittable radio blocks”.

1. Logical channels and Transport channels

Logical channels and transport channels are NOT physical “things”.

They are interfaces or categories the MAC layer uses to organize data. They exist
only inside the MAC layer’s view, not as real packets floating around.

Logical channels exist between RLC and MAC. Think of them as labels describing
what kind of information the data represents.

Examples

 BCCH – broadcast system information

 PCCH – paging

 DCCH – dedicated control

 DTCH – user data

 CCCH – random access signaling

Transport channels exist between MAC and physical layer (PHY). Transport
channels describe how the data will be transmitted over the air. Each transport
channel defines modulation+coding, TBS, mapping to physical resources, HARQ
process.

Examples:

DL-SCH – main downlink data channel

 UL-SCH – main uplink data channel

BCH – fixed, used for MIB

PCH – paging channel

2. MAC now uses “sub headers” placed before EACH PDU

This is a design improvement from LTE.

LTE puts all headers at the start → can’t assemble data until scheduler tells TB size.

NR places header right before each SDU/PDU → MAC can pre-assemble content
before scheduling info arrives → this reduces latency.

This is one of NR’s low-latency tricks.

3. MAC also inserts MAC Control Elements (MAC CEs)

These are special MAC messages used for fast in-band control.

They also use LCID values but are reserved LCID numbers.

Examples:

 Buffer Status Report (BSR)

 Power Headroom Report (PHR


4. Scheduling

The scheduler lives in the MAC layer

Think of it as the traffic controller at the gNB.

Every slot (or even faster), it decides:

 Who gets to transmit/receive

 When they do it
 Where in the frequency band
 How (modulation, coding, MIMO layers)

NR uses shared channels, so all UEs are fighting over the same time–frequency “grid,” and the
scheduler assigns pieces of that grid dynamically.
.

5. Hybrid-ARQ With Soft Combining: If a transport block (TB) isn't decoded

correctly, retransmit it quickly — and combine old + new copies (“soft combining”)
so chances of decoding improve.

 HARQ sits in MAC → Physical Layer does the combining

 It works only for DL-SCH and UL-SCH
 NR uses Asynchronous HARQ for BOTH UL and DL

6. Transport block creation – multiplexing

Physical Layer

Think of the physical layer as the part of the 5G system that actually touches the air.
Everything above it (MAC, RLC, PDCP) is logical and protocol-driven, but the physical layer deals
with bits → waveforms → radio signals.

Here’s what the physical layer does:

 coding (LDPC, Polar)

 HARQ soft combining
 modulation (QPSK, 16QAM, 256QAM…)
 MIMO / beamforming
 mapping those signals onto specific OFDM time–frequency resources

Physical Channels (what’s transmitted over the air)

Now the PHY maps the above transport channels to physical channels, which are actual radio
resources identified in the OFDM grid.

Here are the physical channels and their jobs:

1. PDSCH (Physical Downlink Shared Channel)

 Carries almost all downlink data:

o unicast data
o paging
o random access response
o parts of system information (e.g. SIBs)

This is the physical-layer “workhorse” in downlink.

Transport channel → DL-SCH → PDSCH

2. PBCH (Physical Broadcast Channel)

 Carries MIB (Master Information Block)

 Needed for initial access
 Works along with SSB (Synchronization Signal Block)

Transport channel → BCH → PBCH

3. PDCCH (Physical Downlink Control Channel)

This is control, not data.

Carries DCI (Downlink Control Information):

 scheduling grants for DL (PDSCH)

 scheduling grants for UL (PUSCH)
 HARQ PIDs, MCS, resource assignments
 format structures

Important:
PDCCH has no transport channel.
It's purely an L1/L2 signaling mechanism.

4. PUSCH (Physical Uplink Shared Channel)

 Uplink counterpart of PDSCH.

 Carries uplink data (UL-SCH).
 Used for scheduled uplink transmissions.

Transport channel → UL-SCH → PUSCH

5. PUCCH (Physical Uplink Control Channel)

Also no transport channel.

Carries uplink control info:

 HARQ ACK/NACK for downlink PDSCH

 CSI reports (PMI, RI, CQI)
 Scheduling requests (SR)

PUCCH is critical because uplink control needs very reliable, low-latency signaling.

6. PRACH (Physical Random-Access Channel)

 Used only for random access (RACH procedure).

 Carries the preamble used to get the network's attention.

Transport channel → RACH → PRACH

Why some physical channels don’t have transport channels

The book calls this out:

PDCCH and PUCCH have no transport channels. Why?

Because these channels carry control information that isn’t passed through the MAC as a data
block.
Instead:

 PDCCH carries DCI (L1/L2 control format)

 PUCCH carries UCI (ACKs, SR, CSI)

These don’t come from the MAC in the form of transport blocks — they are generated by
PHY/MAC processes themselves.

So they don't need transport channels.

Control-Plane Protocols

The control-plane protocols are, among other things, responsible for connection setup, mobility,
and security.

Two main control-plane layers:

NAS – Between UE ↔ AMF (core network)

NAS has nothing to do with radio details. It manages:

 authentication
 security keys
 IP address assignment to UE
 paging from core network
 registration/attach

Think of NAS as “UE ↔ Core brain”.

RRC – Between UE ↔ gNB (the radio access network)

This is closer to the radio, and it controls:

 broadcasting system info (SIBs, MIB)

 paging (over radio)
 establishing the RRC context
 configuring bearers (SRB/DRB)
 mobility (handover, reselection config)
 measurement reporting
 sending UE capability info
 maintaining all parameters needed for that UE’s connection

RRC is the “traffic cop” for the entire RAN side.

How RRC Messages Are Actually Carried

RRC messages are not special packets magically floating around — they go through the same
user-plane stack:

RRC → PDCP → RLC → MAC → PHY

Using special logical channels:

 Before connection setup:

SRB0 uses CCCH (common control channel)
 After RRC_CONNECTED is established:
SRB1/2 use DCCH (dedicated control channel)

So even RRC messages get segmented, ciphered, HARQ’ed, etc., but:

 early messages run unciphered

 later control may use ciphering and integrity protection

RRC State Machine

A UE doesn’t need the same amount of signaling or power all the time.
Sometimes it’s sending/receiving data continuously.
Sometimes it’s asleep.
Sometimes it sends tiny bursts every few minutes.

So NR defines three states, each balancing:

 power consumption
 latency
 signaling load
 mobility handling
 1. RRC_IDLE — “Deep Sleep / No Context”

This is the lowest-activity mode.

Characteristics

 The UE has no RRC context in the RAN.

(The gNB stores nothing about this UE.)
 The UE does not belong to any specific cell.
 UE is also CN_IDLE (core doesn’t maintain a connection).
 No UL data can be sent, except starting Random Access.
 Downlink: UE wakes up periodically to check paging.
 Mobility: handled solely by UE using cell reselection.
 Uplink sync is lost, so any UL needs a new RA.

2. RRC_CONNECTED — “Fully Active / Everything Configured”

This is the high-activity mode.

Characteristics

 UE has an RRC context stored in the gNB (all configs, security, bearers).
 UE is in CN_CONNECTED.
 UE belongs to a specific serving cell, with a C-RNTI.
 UE can send and receive data immediately.
 DRX can be used for moderate power saving.
 Mobility is controlled by the network, using measurement reports.
 Uplink timing alignment may be present; if not, RA is needed once.

3. RRC_INACTIVE — “Light Sleep / Fast Resume (New in NR)”

This is the innovation in NR, designed to solve a real LTE problem.

In LTE, UE had only IDLE ↔ CONNECTED.

Apps on phones send small, sporadic traffic (e.g., messaging, push notifications).
This caused:

 many IDLE ↔ CONNECTED transitions

 tons of signaling
 higher latency
NR introduces RRC_INACTIVE to fix this.

Characteristics

 RRC context is kept in both UE and gNB

(No need to re-establish RRC.)
 UE is still CN_CONNECTED (core connection maintained).
 Network does NOT release the context to the core → reduces signaling.
 UE may sleep almost like in IDLE using paging DRX.
 But resume is very fast (only RAN signaling, no CN signaling).
 Mobility is handled like IDLE using cell reselection, not handover.

What is paging channel ?

The paging channel is the downlink mechanism the network uses to notify a UE that:

 there is incoming data for it

 it needs to establish a connection
 system information has changed
 public warning messages are broadcast

In NR, paging is carried on PDSCH but indicated via PDCCH with a Paging DCI.
In LTE, it was the PCH → mapped to PDSCH

The paging channel is the downlink mechanism used by the network to wake up dormant UEs by
sending paging messages during their scheduled wake-up times. Paging does NOT require a
dedicated connection. It uses broadcast transmission, not per-UE signaling.
What is random access ?

When the UE goes to RRC_IDLE, the network forgets about the UE: (no RRC context, no CRNTI, no
uplink timing assignment, no dedicated resources). Basically, the gNB treats the UE like a new
stranger.

Because of that, if the UE wants to send any uplink data again, it must introduce itself first.
And in wireless networks, the way a UE introduces itself is:

Random Access Procedure (RACH).

Idle-State and Inactive-State Mobility

When a UE is in RRC_IDLE or RRC_INACTIVE, the network does not track the UE at a precise cell
level.

But the network still needs to be able to page the UE when there’s incoming data

5G uses a compromise:

Instead of tracking the exact cell, the UE is tracked at a group-of-cells level.

Three Important Location Areas in NR

1. Cell – smallest area

2. RAN Area (RAI) – group of multiple cells (used by the gNB to track)
3. Tracking Area (TAI) – larger group of RAN Areas (used by the core to track)

Connected-State Mobility

When the UE is in RRC_CONNECTED:

 The UE never decides mobility.

 The UE continuously measures surrounding cells.
 The UE reports these measurements back to the network.
 The network (gNB) uses those reports to decide when to handover.