Paging in 5G NR

1. Why Paging Exists, and What Triggers It

Every other downlink transmission in NR is addressed to a UE the gNB is already talking to. Paging is the exception, and it exists because of one design decision made much higher up: a UE in RRC_IDLE reselects cells freely and tells nobody. It does not report its serving cell, it does not answer polls, and it keeps its receiver off almost all the time. The 5GC knows only which tracking areas the UE registered in, possibly hundreds of cells across dozens of gNBs. RRC_INACTIVE narrows this but does not remove it -- the anchor gNB knows only a RAN Notification Area.

So when something downlink-bound arrives, the network cannot unicast. It must broadcast a short notification over an area, in a way that costs the UE almost no battery to check and costs the network almost no capacity to send. That is the whole problem paging solves, and every peculiarity of the mechanism -- the identity hash, the sparse wake-up schedule, the fixed well-known RNTI, the 32-record cap -- follows from it.

ng-5G-S-TMSI

fullI-RNTI

ng-5G-S-TMSI

ng-5G-S-TMSI

ng-5G-S-TMSI

ng-5G-S-TMSI

Table 1. Paging triggers, the identity each one uses, and the RRC procedure it provokes. The last two rows carry no UE identity at all, which is why they behave completely differently in logs.

2. Three Kinds of Page: CN, RAN, and Identity-Free

The specifications talk about CN-initiated paging and RAN-initiated paging TS 38.300 cl. 9.2.5. They are genuinely different procedures with different originators, different scopes, different identities and different recovery behaviour. They share only the last hop.

Table 2. The three things a P-RNTI transmission can be. Only the first two involve a Paging RRC message at all.

The third case deserves emphasis because it surprises people. When the Short Messages Indicator in the DCI is set to 10, the DCI carries eight bits of short message and schedules no PDSCH. There is no Paging message, no pagingRecordList, no UE identity anywhere in the transmission. Every UE that happens to be awake in that occasion decodes it and acts on it. It is a cell-wide broadcast flag delivered through the paging channel, and it is how SI changes and emergency notifications reach sleeping UEs without a per-UE message.

3. The Channel Chain: PCCH, PCH, PDSCH and P-RNTI

A Paging message travels a deliberately minimal path. It is an RRC message, it is placed on the PCCH logical channel, PCCH maps to the PCH transport channel, and PCH is carried on PDSCH. There is no PDCP entity, and the RLC entity is in Transparent Mode -- no header, no segmentation, no ARQ, no ciphering, no integrity protection. The full channel picture is in the companion 06 Channel Mapping document.

Table 3. Paging's protocol stack is mostly holes. Each absence is a design choice that shows up somewhere else as a constraint.

P-RNTI is fixed at 0xFFFE TS 38.321 cl. 7.1. It is not allocated, not signalled and not per-cell; every NR UE in the world descrambles paging DCI with the same value. That is what makes paging monitoring possible for a UE with no context.

Table 4. Where P-RNTI sits in the RNTI space. The two fixed values are at the top of the range precisely so they never collide with an allocated C-RNTI.

Which search space the UE monitors is set by pagingSearchSpace in PDCCH-ConfigCommon TS 38.213 cl. 10.1. The value 0 has a special meaning: the UE monitors the same search space it used for SIB1, i.e. searchSpaceZero in CORESET#0. Any other value points at a configured SearchSpace. A cell that leaves pagingSearchSpace unset but expects paging elsewhere is one of the more entertaining ways to make a cell that attaches fine and never receives a call.

4. Paging Frames and Paging Occasions: the Arithmetic

A UE cannot afford to check every paging opportunity in a cell, and the network cannot afford to repeat every page in all of them. NR therefore assigns each UE a deterministic subset of opportunities, derived from a hash of the UE's own identity and the cell's broadcast paging configuration. Both sides compute it independently and must agree exactly TS 38.304 cl. 7.1.

4.1 The formulae

UE_ID = 5G-S-TMSI mod 1024              -- the low 10 bits of the 5G-S-TMSI

Paging Frame (PF):
    (SFN + PF_offset) mod T  =  (T div N) x (UE_ID mod N)

Paging Occasion index within the PF:
    i_s = floor(UE_ID / N) mod Ns

  T          the UE's paging DRX cycle, in radio frames
  N          number of paging frames in one cycle T
  PF_offset  frame offset applied to the whole pattern
  Ns         number of paging occasions per paging frame -- 1, 2 or 4
  SFN        system frame number, 0 .. 1023

The PF equation is a congruence, not an assignment: it does not give one SFN, it gives the residue class of SFNs that are paging frames for this UE. With T = 64 there are 1024 / 64 = 16 matching frames in each SFN wrap.

4.2 Where N, Ns, T and PF_offset come from

This is the point at which people who learned paging on LTE go wrong. In LTE, N and Ns were derived arithmetically from nB and T. NR does not have nB. N and PF_offset come together out of a single CHOICE, and Ns is a separate enumeration:

Table 5. Every input to the PF/PO calculation, and what changing it does. N and PF_offset are two halves of one ASN.1 CHOICE and cannot be set independently of each other.

4.3 Which paging cycle wins

T can be configured from three directions at once, and the rule is that the shortest value applies -- a UE that has been told to check more often always checks more often TS 38.304 cl. 7.1:

defaultPagingCycle

ran-PagingCycle

Table 6. Sources of the paging cycle. The shortest wins -- which means a UE-specific value can only ever make a UE wake up more often, never less.

4.4 How much capacity the arithmetic buys

N x Ns is the number of distinct paging occasions in one cycle, and it is always at most 1024 because that is all the UE_ID space there is. Dividing 1024 by N x Ns gives the number of UE_ID values sharing each occasion, which is the sharing factor that determines how many paging records a single occasion may need to carry.

Table 7. Representative configurations. The bottom row is a pathological one: 64 UE_IDs funnelled into each of only 16 occasions per 2.56 s, which will overflow maxNrofPageRec in any busy cell.

5. Two Worked PF/PO Derivations

The arithmetic is short enough to do by hand, and doing it by hand is the only way to be certain that a UE and a gNB agree. Both examples below use real-shaped 5G-S-TMSI values and carry through to an SFN you could look for in a log.

5.1 One paging frame per frame, two occasions in it

This is the configuration in the original worked example, expanded. defaultPagingCycle = rf128, nAndPagingFrameOffset = oneT (so N = T = 128 and PF_offset = 0), ns = two (so Ns = 2).

The UE therefore keeps its receiver off for 127 of every 128 radio frames, and even in frame 84 it only opens the receiver for the few symbols of the first paging occasion. Everything else in the cell -- other UEs' pages, other occasions, the other paging frame slots -- is invisible to it and can be slept through.

5.2 Sixteen paging frames per cycle, four occasions in each

The second example uses a configuration much closer to what a loaded macro cell ships: a shorter cycle, a sparse PF pattern with an offset to stagger against neighbours, and the maximum four occasions per frame.

5.3 Paging latency for a given cycle

Paging latency is dominated by one thing: how long the page has to wait for the UE's next occasion. Everything else -- NGAP transport, scheduling, Random Access, RRCSetup -- is tens of milliseconds.

6. Inside a Paging Occasion: Monitoring Occasions and Beams

A paging occasion is not an instant. It is a set of PDCCH monitoring occasions -- by default one per actually transmitted SSB, so that the same page is repeated on every beam the cell sweeps and a UE anywhere in the cell can hear it TS 38.304 cl. 7.1. S is the number of SSBs actually transmitted, taken from ssb-PositionsInBurst in SIB1, not the maximum the band allows.

The numbering rule matters more than it looks. PDCCH monitoring occasions for paging are numbered sequentially from zero starting at the first one in the paging frame, and occasions that overlap uplink symbols are skipped before numbering. In a TDD cell the monitoring-occasion index and the slot index therefore diverge immediately, and any hand calculation that assumes they are the same will point at the wrong slot.

firstPDCCH-MonitoringOccasionOfPO

nrofPDCCH-MonitoringOccasionPerSSB-InPO

Table 8. What defines the shape of a paging occasion. S x X monitoring occasions per PO, Ns POs per PF.

7. DCI Format 1_0 with P-RNTI, and the Short Message

The DCI the UE hunts for in its monitoring occasions is format 1_0 with the CRC scrambled by P-RNTI. It is the same format used for fallback scheduling, but with a different field set: the HARQ fields are gone and two paging-specific fields take their place TS 38.212 cl. 7.3.1.2.1.

Table 9. DCI format 1_0 with P-RNTI, field by field. Total 41 bits at a 106-PRB BWP, plus a 24-bit CRC scrambled by 0xFFFE.

Table 10. The two-bit indicator, which is the branch point for the whole reception procedure in §9.

7.1 The eight short-message bits

systemInfoModification

etwsAndCmasIndication

Table 11. Short Message bit assignments, TS 38.331 Table 6.5-1. Bits 1 and 2 are Rel-15; bit 3 arrived with Rel-17 eDRX.

8. The Paging RRC Message

When the indicator says a PDSCH is scheduled, the transport block carries a PCCH-Message whose only useful content is a Paging message. It is a small, flat structure with one list in it.

PCCH-Message ::= SEQUENCE {
    message   PCCH-MessageType
}

PCCH-MessageType ::= CHOICE {
    c1        CHOICE { paging   Paging },
    messageClassExtension SEQUENCE {}
}

Paging ::= SEQUENCE {
    pagingRecordList          PagingRecordList         OPTIONAL,  -- Need N
    lateNonCriticalExtension  OCTET STRING             OPTIONAL,
    nonCriticalExtension      Paging-v1700-IEs         OPTIONAL
}

PagingRecordList ::= SEQUENCE (SIZE(1..maxNrofPageRec)) OF PagingRecord
    -- maxNrofPageRec INTEGER ::= 32

PagingRecord ::= SEQUENCE {
    ue-Identity               PagingUE-Identity,
    accessType                ENUMERATED {non3GPP}     OPTIONAL,  -- Need N
    ...
}

PagingUE-Identity ::= CHOICE {
    ng-5G-S-TMSI              NG-5G-S-TMSI,      -- BIT STRING (SIZE (48))
    fullI-RNTI                I-RNTI-Value,      -- BIT STRING (SIZE (40))
    ...
}

-- Rel-17 extension
Paging-v1700-IEs ::= SEQUENCE {
    pagingRecordList-v1700    PagingRecordList-v1700  OPTIONAL,  -- Need N
    nonCriticalExtension      SEQUENCE {}             OPTIONAL
}

PagingRecord-v1700 ::= SEQUENCE {
    pagingCause-r17           ENUMERATED {voiceCall}  OPTIONAL   -- Need N
}

Listing 1. Abridged from TS 38.331. ... marks extension markers. The Rel-17 cause list is parallel to the main record list -- the n-th entry of one corresponds to the n-th entry of the other.

pagingRecordList

ue-Identity

accessType

Table 12. Paging record IEs. accessType is a single-valued enumeration, which is a common source of confusion when reading a decode that simply omits it.

9. What the UE Does When It Is Paged

1. Wake at the computed PO. The UE opens its receiver for the S x X monitoring occasions of its own PO and monitors pagingSearchSpace for DCI format 1_0 with the CRC descrambled by P-RNTI 0xFFFE.

2. No DCI: go back to sleep. This is the overwhelmingly common outcome and costs a handful of symbols of receiver time.

3. Read the Short Messages Indicator. It decides whether there is a short message, a PDSCH, or both (§7).

4. Act on the short message if present. SI change is deferred to the next modification period boundary; ETWS/CMAS is acted on immediately. This happens regardless of whether the UE is individually paged.

5. Decode the PDSCH if scheduled and walk pagingRecordList comparing ue-Identity against the UE's own 5G-S-TMSI (in RRC_IDLE) or its fullI-RNTI (in RRC_INACTIVE).

6. No match: go back to sleep. The records belonged to the other UE_IDs sharing this occasion. This is normal, not an error, and its rate is governed by the sharing factor from §4.4.

7. Match in RRC_IDLE: initiate RRC connection establishment. RRCSetupRequest with establishmentCause = mt-Access, and NAS then sends a Service Request. See 03 Random Access for the access itself and 15 RRC Procedures for the establishment.

8. Match in RRC_INACTIVE: initiate resume. RRCResumeRequest with resumeCause = mt-Access, carrying shortI-RNTI and a resumeMAC-I. See 14 RRC States.

One consequence worth stating plainly: a paged UE does not reply to the page. It starts an access procedure. There is no acknowledgement of the Paging message anywhere in the protocol, so from the network's point of view the only evidence a page arrived is an RRCSetupRequest or an RRCResumeRequest with cause mt-Access turning up within a plausible window. If it does not, the network cannot distinguish page not delivered from page delivered and ignored.

10. RAN Paging in Detail: RNA, I-RNTI and the Anchor gNB

RRC_INACTIVE exists so that a UE with intermittent traffic can keep its AS context, its bearers and its NG-U tunnel while behaving, on the air, almost like an idle UE. The price is that somebody has to keep that context, and that somebody -- the anchor gNB -- becomes responsible for finding the UE again. RAN paging is that mechanism.

ran-NotificationAreaInfo

suspendConfig

ran-PagingCycle

suspendConfig

t380

suspendConfig

Table 13. RAN paging configuration, all of it delivered in one suspendConfig at release time. The UE cannot be reconfigured while it is inactive.

Two details of the arithmetic are easy to get wrong. First, the paging occasion for an RRC_INACTIVE UE is still computed from UE_ID = 5G-S-TMSI mod 1024 -- not from the I-RNTI. The identity that appears in the record and the identity that selects the occasion are different things. Second, ran-PagingCycle competes with, rather than replaces, the default and NAS cycles: the shortest applicable value still wins.

When the UE does answer at a neighbour, the new gNB decodes the I-RNTI to find the anchor and issues an XnAP RETRIEVE UE CONTEXT REQUEST. The anchor validates the resumeMAC-I -- a short MAC-I computed over the request, covered in the companion 27 AS Security Mode document -- and returns the AS security context, the bearer configuration and the NG-U endpoints. If the anchor cannot be reached, or refuses, the new gNB has no context to resume and must fall back to RRCSetup, which the UE sees as having its resume rejected.

11. Latency, Capacity and Repetition at the AMF

11.1 What a cell can carry

Paging capacity is the product of occasions per second and records per occasion. Both are small numbers, and the result is the reason paging load is a real dimensioning concern in dense urban cells.

11.2 Repetition and area escalation at the AMF

The AMF does not page once. It runs a paging strategy, and the shape of that strategy is operator policy rather than a fixed procedure TS 23.501 cl. 5.4.4 TS 23.502. A typical escalation:

Table 14. A representative CN paging escalation. The details are policy, but the shape -- narrow first, widen on failure -- is universal, and the Paging Attempt Information IE exists to let the RAN see where in the sequence it is.

12. Rel-17 and Rel-18: Early Indication, Subgrouping, eDRX, RedCap

Everything in §4 through §9 is Rel-15 and is still the core of the mechanism. Rel-17 added a layer above it whose sole purpose is to stop UEs from decoding pages that were never for them.

12.1 Paging Early Indication

The expensive part of a paging occasion for the UE is not the PDCCH monitoring -- it is everything before it: waking the receiver, running AGC, re-synchronising to the SSB, and tracking time and frequency. A UE does all of that and then, in the overwhelming majority of occasions, finds nothing. Paging Early Indication (PEI) puts a much cheaper signal a configurable distance ahead of the PO: DCI format 2_7, addressed by a configured PEI-RNTI, saying only there is or is not a page coming in the next group of occasions. A UE that sees no PEI can skip the full wake-up entirely.

12.2 Paging subgrouping

PEI is per group of POs, which would still wake every UE sharing those POs. Subgrouping refines it: the 1024 UE_IDs mapped to a PO are divided into subgroups, and the PEI payload carries one bit per subgroup. A UE wakes only if its own subgroup bit is set. Two ways of assigning a subgroup exist:

Table 15. Subgrouping methods, TS 38.304 and TS 38.331 PEI-Config. A cell may configure both, with CN-assigned taking precedence for UEs that have an assignment.

12.3 Extended DRX

For a device that only ever reports a meter reading, even a 2.56 s paging cycle is a large fraction of its power budget. Rel-17 eDRX extends the cycle far beyond what the 10-bit SFN can express, by adding a hyper-frame layer on top:

Table 16. eDRX, approximately. Cycle values and the PTW mechanism follow TS 38.304; exact enumerations differ between the idle and inactive cases and should be read from the release you are working against.

12.4 RedCap

Reduced Capability UEs may be confined to a separate initial downlink BWP, and paging follows them there: Rel-17 allows a separate firstPDCCH-MonitoringOccasionOfPO for the RedCap initial BWP, and separate PCCH-Config fields where the RedCap BWP differs. The practical consequence is that one cell can have two disjoint sets of paging monitoring occasions, and a page for a RedCap UE placed in the non-RedCap occasion is simply never heard. Rel-17 also introduced nrofPDCCH-MonitoringOccasionPerSSB-InPO, which repeats each occasion, specifically to recover the link budget a one-antenna RedCap receiver loses.

13. Paging Policy Differentiation and Paging Priority

Not all downlink packets deserve the same paging effort. A TCP keep-alive and a voice call both trigger paging, and treating them identically means either wasting capacity on the first or under-serving the second. Two independent mechanisms address this.

Table 17. Three ways to say "this page matters more". The first two are invisible to the UE; the third is the only one it can see.

14. Configuration Reference: ASN.1, Ranges and Timers

The broadcast paging configuration lives at SIB1 -> servingCellConfigCommon -> downlinkConfigCommon -> pcch-Config. That is the whole cell-level configuration; everything else is either UE-specific (suspendConfig, NAS DRX) or derived.

PCCH-Config ::= SEQUENCE {
    defaultPagingCycle              PagingCycle,
    nAndPagingFrameOffset           CHOICE {
        oneT                            NULL,
        halfT                           INTEGER (0..1),
        quarterT                        INTEGER (0..3),
        oneEighthT                      INTEGER (0..7),
        oneSixteenthT                   INTEGER (0..15)
    },
    ns                              ENUMERATED {four, two, one},
    firstPDCCH-MonitoringOccasionOfPO CHOICE {
        sCS15KHZoneT                    SEQUENCE (SIZE (1..maxPO-perPF))
                                            OF INTEGER (0..139),
        sCS30KHZoneT-SCS15KHZhalfT      SEQUENCE (SIZE (1..maxPO-perPF))
                                            OF INTEGER (0..279),
        sCS60KHZoneT-SCS30KHZhalfT-SCS15KHZquarterT
                                        SEQUENCE (SIZE (1..maxPO-perPF))
                                            OF INTEGER (0..559),
        ...                             -- five further SCS / T-fraction branches
    }                                                        OPTIONAL,  -- Need R
    ...,
    [[  -- Rel-17 additions
    nrofPDCCH-MonitoringOccasionPerSSB-InPO-r17  INTEGER (2..4)  OPTIONAL,
    ]]
}

PagingCycle ::= ENUMERATED {rf32, rf64, rf128, rf256}
maxPO-perPF INTEGER ::= 4

-- where it sits
DownlinkConfigCommonSIB ::= SEQUENCE {
    frequencyInfoDL     FrequencyInfoDL-SIB,
    initialDownlinkBWP  BWP-DownlinkCommon,   -- contains pagingSearchSpace
    bcch-Config         BCCH-Config,          -- modificationPeriodCoeff
    pcch-Config         PCCH-Config,
    ...
}

-- RRC_INACTIVE side, delivered once at release
SuspendConfig ::= SEQUENCE {
    fullI-RNTI                  I-RNTI-Value,
    shortI-RNTI                 ShortI-RNTI-Value,
    ran-PagingCycle             PagingCycle,
    ran-NotificationAreaInfo    RAN-NotificationAreaInfo   OPTIONAL,
    t380                        PeriodicRNAU-TimerValue    OPTIONAL,
    nextHopChainingCount        NextHopChainingCount,
    ...
}

Listing 2. Abridged from TS 38.331. ... marks omitted branches, members and extension markers.

defaultPagingCycle

nAndPagingFrameOffset

ns

firstPDCCH-MonitoringOccasionOfPO

nrofPDCCH-MonitoringOccasionPerSSB-InPO

pagingSearchSpace

modificationPeriodCoeff

ran-PagingCycle

ran-NotificationAreaInfo

eDRX-AllowedIdle

Table 18. Paging parameter reference. All the cell-level fields are in SIB1, so any change to them is a BCCH modification and is itself announced by a short message.

t380

T319

T300

Table 19. Timers that bound a paging attempt at each level. Note how the scales differ: milliseconds at RRC, seconds at NAS, tens of minutes at the AMF's reachability logic.

15. Failure Modes and What Each One Means

Paging fails silently. There is no acknowledgement, no error message and no counter that increments at the point of failure -- the first symptom is usually a user complaint about missed calls. The failure modes below are ordered roughly by how often they are the actual cause.

Table 20. Paging failure modes. Note how many rows say "detected by nobody" -- paging has almost no built-in observability, which is why the mt-Access ratio in §9 is worth instrumenting.

16. Illustrative Message Traces

16.1 The broadcast configuration, and the occasion it implies

SIB1
 servingCellConfigCommon
  downlinkConfigCommon
   initialDownlinkBWP
    pdcch-ConfigCommon
     pagingSearchSpace ............ 0            -- reuse searchSpaceZero
   bcch-Config
    modificationPeriodCoeff ....... n4           -- mod period = 4 x T
   pcch-Config
    defaultPagingCycle ............ rf64         -- T = 64 frames = 640 ms
    nAndPagingFrameOffset
     quarterT ..................... 2            -- N = 16, PF_offset = 2
    ns ............................ four         -- Ns = 4
    firstPDCCH-MonitoringOccasionOfPO
     (absent)                                    -- default: PO starts at i_s x S
 ssb-PositionsInBurst
  inOneGroup .................... 10001000      -- S = 4 transmitted SSBs

-- UE-side derivation for 5G-S-TMSI 0x00411CB42E77
   UE_ID       = 0x2E77 & 0x3FF          = 631
   631 mod 16  = 7   -> (SFN+2) mod 64   = 4 x 7 = 28
                        SFN mod 64       = 26
   i_s         = floor(631/16) mod 4     = 39 mod 4 = 3
   -> monitor PF SFN 26, 90, 154, ... ; PO index 3; MOs 12..15

Listing 3. pcch-Config as decoded from SIB1, with the derivation of §5.2 carried straight through to the monitoring occasions.

16.2 A CN page, delivered and answered

09:41:12.104  [NGAP-DL] PAGING
              UE Paging Identity
                fiveG-S-TMSI ......... 0x00411CB42E77
              Paging DRX ............. v64          -- matches the UE's NAS DRX
              TAI List for Paging .... [ TAC 0x000101, TAC 0x000102 ]
              Paging Priority ........ (absent)
              Paging Attempt Information
                Paging Attempt Count ..... 1
                Intended Nr of Attempts ... 3
                Next Paging Area Scope .... changed

09:41:12.105  [SCHED]   paging record queued
              UE_ID .................. 631   (5G-S-TMSI mod 1024)
              target PF .............. SFN 26 (next occurrence SFN 794)
              target PO .............. i_s 3  -> MOs 12..15, slots 15..18
              wait ................... 428 ms

09:41:12.533  [PHY-DL]  PDCCH, DCI 1_0, CRC scrambled by P-RNTI 0xFFFE
              SFN 794 slot 15   (MO 12, SSB #0 beam)
              Short Messages Indicator ... 01     -- scheduling info only
              Frequency domain res alloc . RIV 0x0C82 -> 8 PRB from PRB 12
              Time domain res alloc ...... row 2  (S=2, L=12)
              VRB-to-PRB mapping ......... 1      -- interleaved
              MCS ........................ 2
              TB scaling ................. 0
              -- repeated in MOs 13,14,15 on SSB #1,#2,#3

09:41:12.534  [RRC-DL-PCCH] Paging  (18 octets)
              pagingRecordList: 2 records
               [0] ue-Identity
                     ng-5G-S-TMSI ...... 0x00411CB42E77   -- our UE
                   accessType .......... (absent)         -- i.e. 3GPP access
               [1] ue-Identity
                     ng-5G-S-TMSI ...... 0x0041 7702 1E77 -- a different UE_ID 631

09:41:12.536  [RRC]     own 5G-S-TMSI matched in record 0
              -> initiate RRC connection establishment
09:41:12.548  [MAC-UL]  RA preamble 41, RA-RNTI 1287
09:41:12.571  [RRC-UL]  RRCSetupRequest
                ue-Identity
                  ng-5G-S-TMSI-Part1 ... 0x1CB42E77
                establishmentCause .... mt-Access        -- the paging fingerprint
09:41:12.594  [RRC-DL]  RRCSetup
09:41:12.612  [RRC-UL]  RRCSetupComplete + NAS Service Request
09:41:12.618  [NGAP-UL] INITIAL UE MESSAGE  (RRCEstablishmentCause mt-Access)

-- end to end from PAGING to INITIAL UE MESSAGE: 514 ms,
   of which 428 ms was waiting for the paging occasion

Listing 4. A complete CN paging success. The second record shows the sharing effect: another UE_ID 631 in the same occasion, whose 5G-S-TMSI differs everywhere except the low ten bits.

16.3 A RAN page answered at a neighbour cell

14:07:55.880  [GTP-U]   DL PDU on NG-U TEID 0x0000A17C
              UE state ............... RRC_INACTIVE since 14:03:22
              fullI-RNTI ............. 0x1A2B3C4D5E
              ran-PagingCycle ........ rf64
14:07:55.881  [RAN-PAGE] RAN paging initiated, attempt 1 of 2
              RNA .................... cellList, 12 cells across 2 gNBs
14:07:55.882  [XNAP-DL] RAN PAGING -> neighbour gNB
              UE RAN Paging Identity . I-RNTI 0x1A2B3C4D5E
              RAN Paging Area ........ 12 cells
              Paging DRX ............. v64

14:07:56.204  [RRC-DL-PCCH] (neighbour cell) Paging  (11 octets)
              pagingRecordList: 1 record
               [0] ue-Identity
                     fullI-RNTI ........ 0x1A2B3C4D5E    -- RAN paging, not CN

14:07:56.206  [RRC]     fullI-RNTI matched -> resume (not setup)
14:07:56.231  [RRC-UL]  RRCResumeRequest  on CCCH
                resumeIdentity (shortI-RNTI) .. 0x3C4D5E
                resumeMAC-I ................... 0x9B41
                resumeCause ................... mt-Access
14:07:56.234  [XNAP-UL] RETRIEVE UE CONTEXT REQUEST -> anchor gNB
                I-RNTI ........................ 0x1A2B3C4D5E
14:07:56.241  [XNAP-DL] RETRIEVE UE CONTEXT RESPONSE
                resumeMAC-I verified .......... ok
                AS security context, DRB config, PDCP SN status
14:07:56.258  [RRC-DL]  RRCResume  on SRB1 (integrity protected, ciphered)
14:07:56.281  [RRC-UL]  RRCResumeComplete
14:07:56.286  [NGAP-UL] PATH SWITCH REQUEST -> AMF

-- the AMF was never involved in the paging itself, only in the path switch

Listing 5. RAN paging with the UE answering under a different gNB. The record carries fullI-RNTI, which is the only thing in the transmission that distinguishes it from a CN page.

16.4 A short message with no paging record at all

22:15:00.008  [PHY-DL] PDCCH, DCI 1_0, CRC scrambled by P-RNTI 0xFFFE
              SFN 512 slot 0
              Short Messages Indicator ... 10     -- short message ONLY
              Short Message .............. 0b10000000
                bit 1 systemInfoModification ...... 1
                bit 2 etwsAndCmasIndication ....... 0
                bit 3 systemInfoModification-eDRX . 0
                bits 4..8 ......................... 0  (ignored)
              -- no PDSCH scheduled, no Paging message, no UE identity
22:15:00.009  [RRC]    SI change indicated
              current modification period ends at SFN 768
              -> re-acquire SIB1 and changed SI from SFN 768

22:41:33.120  [PHY-DL] PDCCH, DCI 1_0, P-RNTI 0xFFFE
              Short Messages Indicator ... 11     -- short message AND paging
              Short Message .............. 0b01000000
                bit 2 etwsAndCmasIndication ....... 1
22:41:33.121  [RRC]    ETWS/CMAS indicated -> acquire SIB6/SIB7/SIB8 now
              (not deferred to a modification period boundary)
22:41:33.122  [RRC-DL-PCCH] Paging  (12 octets)
              pagingRecordList: 1 record
               [0] ng-5G-S-TMSI ..... 0x0041 88C1 04B2   -- not our UE
22:41:33.123  [RRC]    no identity match -> no access initiated,
                       but the ETWS action above still applies

Listing 6. The two identity-free cases. The second shows indicator 11: the short message is acted on even though the paging record belongs to somebody else.

16.5 A UE that is never reachable

-- UE registers and works normally for mobile-originated traffic

10:02:11.400  [NAS]     Registration Accept
                5G-GUTI ................ 0x0041 1CB4 2E77
                Requested DRX param .... 32 radio frames   -- UE asked for rf32
                Negotiated DRX param ... 32 radio frames

-- UE therefore uses T = 32 (shortest applicable), and computes
   631 mod 16 = 7 -> (SFN+2) mod 32 = (32 div 16) x 7 = 14 -> SFN mod 32 = 12
   -> PF at SFN 12, 44, 76, ...

10:14:38.002  [NGAP-DL] PAGING
                fiveG-S-TMSI ........... 0x00411CB42E77
                Paging DRX ............. (absent)          -- ** not relayed **
10:14:38.003  [SCHED]   no Paging DRX IE -> fall back to defaultPagingCycle rf64
                gNB computes  (SFN+2) mod 64 = 28 -> SFN mod 64 = 26
                target PF .............. SFN 26
10:14:38.240  [PHY-DL]  paging transmitted at SFN 26, PO i_s 3

-- the UE was awake at SFN 12 and 44, asleep at 26. Nothing is logged as an
   error anywhere: the gNB transmitted, the UE slept.

10:14:44.010  [NGAP-DL] PAGING   Paging Attempt Count 2   (AMF timer expired)
10:14:50.015  [NGAP-DL] PAGING   Paging Attempt Count 3
10:14:56.020  [AMF]     paging abandoned, SMF notified of delivery failure

-- diagnostic: compare the negotiated NAS DRX against the NGAP Paging DRX IE.
   T differs -> the PF residues differ -> the two patterns never intersect.

Listing 7. The most expensive paging bug there is: a UE-specific DRX cycle that the AMF negotiated and then failed to relay. Every layer reports success.

17. Release Deltas: Rel-15 to Rel-18

Table 21. Paging-relevant changes by release. Feature presence should be confirmed against the UE capability exchange -- see the companion 26 UE Capability document.

18. Reading Paging in Logs: A Checklist

1. Read the record identity first. ng-5G-S-TMSI means CN paging and expect RRCSetupRequest. fullI-RNTI means RAN paging and expect RRCResumeRequest. No record at all means a short message, and expect no response from anyone (§1, §8).

2. Compute UE_ID by hand. Take the low ten bits of the 5G-S-TMSI. Then run the PF congruence and the i_s expression from §4 with the cell's own pcch-Config. If your computed PF does not match the SFN the page was transmitted in, stop -- you have found the bug.

3. Check that T is the same on both sides. Compare the NAS-negotiated DRX, the NGAP Paging DRX IE, ran-PagingCycle if the UE was inactive, and defaultPagingCycle. The shortest should win everywhere. A missing Paging DRX IE is the single most common cause of a UE that only fails mobile-terminated (§4.3, §16.5).

4. Decode the Short Messages Indicator before anything else in the DCI. With value 10 there is no PDSCH, so an absent Paging message is correct behaviour and not a decode failure (§7).

5. Count the paging records. A list running at or near 32 in a busy hour means the occasion is saturated and pages are being deferred a whole cycle. The fix is more occasions (N x Ns), not a shorter cycle (§8, §11.1).

6. Convert monitoring-occasion index to slot index properly. Occasions overlapping uplink symbols are skipped before numbering, so in a TDD cell the two indices differ. Recount before concluding the gNB transmitted in the wrong place (§6).

7. Look for the mt-Access cause. mt-Access is the only end-to-end evidence that a page was received. Count mt-Access accesses against pages requested; nothing else in the protocol closes the loop (§9).

8. Check the Paging Attempt Count on the NGAP message. If terminating calls connect but connect slowly, and the attempt count is routinely 2 or 3, the problem is the AMF's first narrow attempt missing rather than the air interface (§11.2).

9. For an RRC_INACTIVE UE, check the RNA and the RNA-update timer before the radio. t380 too long, or an RNA smaller than the real mobility pattern, and RAN paging misses. A resume that arrives as a setup means RAN paging never reached the UE and CN paging cleaned up afterwards (§10).

10. If PEI is enabled, disable it once as a control. A paging failure that disappears with PEI off, with every other parameter unchanged, is a PEI or subgroup problem and no amount of PF/PO arithmetic will find it (§12.2).

19. Glossary

20. References

• 3GPP TS 38.304 -- UE procedures in Idle mode and RRC Inactive state. Clause 7 (paging), clause 7.1 (discontinuous reception, the PF and i_s formulae, monitoring occasion numbering, firstPDCCH-MonitoringOccasionOfPO), clause 5 (cell selection and reselection, which determines where a page must be sent).
• 3GPP TS 38.331 -- RRC protocol specification. Clause 5.2 (paging reception and short message handling), clause 5.3.13 (RRC connection resume), clause 6.2 (PCCH-Message, Paging, PagingRecord, PagingUE-Identity, PCCH-Config, SuspendConfig, PEI-Config), clause 6.5 and Table 6.5-1 (Short Message bit definitions).
• 3GPP TS 38.212 -- Multiplexing and channel coding. Clause 7.3.1.2.1 (DCI format 1_0, including the P-RNTI field set and the Short Messages Indicator).
• 3GPP TS 38.213 -- Physical layer procedures for control. Clause 10.1 (search spaces, pagingSearchSpace and Type2-PDCCH common search space).
• 3GPP TS 38.321 -- MAC protocol specification. Clause 7.1 (RNTI values, including P-RNTI = 0xFFFE).
• 3GPP TS 38.300 -- NR overall description. Clause 9.2.5 (paging), clause 9.2.2 (RRC states and the RRC_INACTIVE model that RAN paging serves).
• 3GPP TS 38.413 -- NGAP. The PAGING message and its IEs: UE Paging Identity, Paging DRX, TAI List for Paging, Paging Priority, Assistance Data for Paging, Paging Attempt Information, UE Radio Capability for Paging.
• 3GPP TS 38.423 -- XnAP. The RAN PAGING message, and RETRIEVE UE CONTEXT REQUEST / RESPONSE used when a paged UE resumes at a different gNB.
• 3GPP TS 23.501 -- System architecture. Clause 5.4.4 (paging policy differentiation), clause 5.3 (registration and connection management states, CM-IDLE and CM-CONNECTED).
• 3GPP TS 23.502 -- Procedures for the 5G System. Network-triggered Service Request, which is the procedure CN paging sits inside.
• 3GPP TS 24.501 -- NAS protocol for 5GS. UE specific DRX parameters in the Registration procedure, and the AMF paging timer.
• 3GPP TS 38.306 -- UE radio access capabilities. The capability bits gating eDRX, PEI and subgrouping support.

Companion documents in this set

• 02 Radio Frame Structure -- SFN, radio frames and slots, which the whole PF/PO calculation indexes.
• 03 Random Access -- what a paged UE does immediately after a match.
• 06 Channel Mapping -- the PCCH / PCH / PDSCH chain of §3 in its full context.
• 11 DRX -- connected-mode DRX, the same idea applied to a UE that already has a C-RNTI.
• 13 RRC Overview -- the RRC layer and its bearers; PCCH is the one logical channel with no SRB.
• 14 RRC States -- RRC_INACTIVE, suspendConfig, I-RNTI and the RNA update procedure that RAN paging depends on.
• 15 RRC Procedures -- RRCSetup and RRCResume in detail.
• 17 System Information / 18 MIB and SIB1 IEs -- where pcch-Config is broadcast, and the modification period the short message refers to.
• 26 UE Capability -- where support for eDRX, PEI and subgrouping is declared.
• 27 AS Security Mode -- the resumeMAC-I that validates a RAN-paged resume, and why the Paging message itself cannot be protected.