UE Capability Transfer in 5G NR

1. Why the Network Has to Ask

NR is not one radio. It is a very large space of options, and a device occupies a small and idiosyncratic corner of it. Two handsets from the same year, on the same band, in the same cell, may differ in how many MIMO layers they can receive, whether they can demodulate 256QAM, how wide a bandwidth part they can tune, how many carriers they can aggregate, whether they support 2-step Random Access, whether they can do DAPS handover, and how long they need between an SRS switch and the next transmission. Nothing in the physical layer reveals any of this.

The consequence is sharper than it sounds. The gNB does not merely lose performance by guessing wrong -- it breaks the link. A UE told to receive four spatial layers when it has two antennas does not decode at reduced rate; it fails every transport block on that grant. A UE configured with an RLC sequence-number length it does not support cannot even establish the bearer. Capability signalling exists because almost every configuration choice the network makes is a hard constraint rather than a soft one.

Table 1. What actually varies, and why capability signalling is a correctness requirement rather than an optimisation. Note that several rows fail silently.

2. When the Enquiry Happens, and When It Does Not

The enquiry is a two-message RRC procedure TS 38.331 cl. 5.6.1 and the network chooses when to run it. There is one hard rule: it may not be sent before AS security has been activated. The capability container is a near-unique fingerprint of a device model, and sending it in clear would let a passive observer identify the handset. So the ordering is always SecurityModeComplete first, UECapabilityEnquiry after.

Table 2. When you should and should not expect to see the exchange. The second row is the one that surprises people: an absent enquiry is usually a cache hit, not a fault.

3. UECapabilityEnquiry: the Request

rrc-TransactionIdentifier

ue-CapabilityRAT-RequestList

rat-Type

capabilityRequestFilter

ue-CapabilityEnquiryExt

capabilityRequestFilterCommon

Table 3. UECapabilityEnquiry IEs, TS 38.331 clause 6.2.2. The two filter mechanisms are at different levels and are not alternatives -- a well-formed enquiry usually uses both.

nr

UE-NR-Capability

eutra-nr

UE-MRDC-Capability

eutra

utra-fdd

Table 4. RAT types and their containers. A UE that does not support a requested RAT simply omits that container -- absence is the answer, not an error.

4. UECapabilityInformation: the Response and Its Containers

The response carries a list of containers, one per RAT, and each container is an OCTET STRING -- not a nested ASN.1 SEQUENCE. The capability structure inside it is separately encoded in unaligned PER and then wrapped as opaque octets.

That is not accidental. It is what allows an NR capability to travel inside an LTE RRC message during EN-DC setup, where the eNB has no NR ASN.1 definitions at all and must forward the octets untouched. It is also why decoding a capability message takes two passes: the outer message decodes to a container of octets, and the container must then be decoded against a different ASN.1 module, chosen by rat-Type.

5. Inside UE-NR-Capability: the Top-Level Structure

accessStratumRelease

pdcp-Parameters

rlc-Parameters

mac-Parameters

phy-Parameters

rf-Parameters

measAndMobParameters

featureSets

featureSetCombinations

Table 5. UE-NR-Capability root components. Note that eleven of the fifteen are OPTIONAL, which is exactly the presence bitmap in the figure above.

6. Band Combinations

supportedBandCombinationList is a list of every simultaneous combination of carriers the UE can operate. Not every band it supports -- that is supportedBandListNR -- but every set it can use at once, with the aggregation class for each. This is the structure whose length drives the whole size problem: maxBandComb is 65 536.

bandList

featureSetCombination

ca-ParametersNR

mrdc-Parameters

supportedBandwidthCombinationSet

powerClass

Table 6. BandCombination fields. Three separate levels of ceiling apply at once: the RF class, the combination-wide ca-ParametersNR, and the per-CC feature set.

7. The Feature Set Indirection

If you take one thing from this document, take this section. Nothing in a band combination states a bandwidth, a subcarrier spacing, a MIMO rank or a modulation order. Those numbers exist exactly once each, in a shared table, and everything refers to them by index. The chain is four hops deep and each hop uses a different indexing convention.

7.1 The four levels

1. BandCombination.featureSetCombination -- a 0-based index into UE-NR-Capability.featureSetCombinations. One integer per combination.

2. featureSetCombinations[i] -- a FeatureSetCombination, which is a list of FeatureSetsPerBand, one per band, positionally aligned with the combination's bandList. Each FeatureSetsPerBand is itself a list of alternatives, each an NR or EUTRA FeatureSet carrying a downlink id and an uplink id.

3. featureSets.featureSetsDownlink[d] -- reached by the downlink id. Holds per-band, per-combination properties (intraBandFreqSeparationDL, scalingFactor, pdcch-MonitoringAnyOccasions, timeDurationForQCL, scellWithoutSSB) and, crucially, featureSetListPerDownlinkCC -- one entry per aggregated carrier.

4. featureSets.featureSetsDownlinkPerCC[c] -- reached by each per-CC id. This is where the actual numbers live: supportedSubcarrierSpacingDL, supportedBandwidthDL, maxNumberMIMO-LayersPDSCH, supportedModulationOrderDL.

7.2 The indexing conventions, which are not the same

This is where hand-decoding goes wrong, and it goes wrong quietly. Three different identifier types with three different base conventions appear in the same chain:

FeatureSetCombinationId

FeatureSetDownlinkId

FeatureSetUplinkId

FeatureSetDownlinkPerCC-Id

FeatureSetUplinkPerCC-Id

Table 7. Mixed indexing in one dereference chain. maxFeatureSetCombinations, maxDownlinkFeatureSets, maxUplinkFeatureSets and maxPerCC-FeatureSets are all 1024.

7.3 Why it was built this way

The indirection is a compression scheme. A flagship declares thousands of band combinations, but they draw on perhaps a few dozen distinct per-CC capability profiles -- "100 MHz at 30 kHz, four layers, 256QAM" appears in almost all of them. Storing that profile once and referencing it by a ten-bit index instead of repeating it costs about two octets per reference instead of about twenty. Without it, UECapabilityInformation would be megabytes rather than tens of kilobytes.

supportedBandCombinationList

featureSetCombinations

featureSetsDownlink

featureSetsDownlinkPerCC

Table 8. The pyramid. Thousands of combinations resolve onto tens of per-carrier profiles, which is why the indirection pays for itself many times over.

8. A Worked Dereference, End to End

Take band combination 37 out of a capability container and follow it all the way to a data rate. This is the exercise you will actually have to do when someone asks why a UE is not getting the throughput its datasheet claims.

8.1 Carrying it through to a peak rate

TS 38.306 clause 4.1.2 gives the approximate peak data rate as a sum over aggregated carriers. Everything in it except the overhead constants comes from the dereference above:

data rate (Mbps) = 1e-6 x SUM over carriers j of
     v_Layers(j) x Q_m(j) x f(j) x R_max
        x N_PRB(BW(j), mu) x 12 / T_s(mu)
        x (1 - OH(j))

  R_max   = 948 / 1024 = 0.9258            (highest code rate)
  T_s(mu) = 1e-3 / (14 x 2^mu)             (OFDM symbol duration)
  OH      = 0.14 FR1 DL, 0.08 FR1 UL, 0.18 FR2 DL, 0.10 FR2 UL
  f(j)    = scalingFactor from FeatureSetDownlink: 1, 0.8, 0.75 or 0.4
  v_Layers, Q_m, N_PRB  -- all from featureSetsDownlinkPerCC

9. What the Network Actually Does With It

maxNumberMIMO-LayersPDSCH

supportedModulationOrderDL

supportedSubcarrierSpacingDL

ca-ParametersNR.maxNumberOfServingCells

simultaneousRxTxInterBandCA

rlc-Parameters.am-WithShortSN

pdcp-Parameters.supportedROHC-Profiles

pdcch-MonitoringAnyOccasions

Table 9. Capability, what it gates, and the diagnostic signature when the network gets it wrong. The pattern worth memorising: capability mismatches produce failures that are flat against radio conditions.

10. Capability Filtering, and Why It Is Not Optional

An unfiltered enquiry asks a flagship handset to enumerate every band combination it supports, including combinations involving bands that do not exist anywhere in the operator's spectrum and EN-DC combinations in a network with no LTE anchor. The answer is tens of kilobytes of information the network can never use. Filtering is how the network says what it actually needs.

ue-CapabilityEnquiryExt

ue-CapabilityEnquiryExt

srs-SwitchingTimeRequest

UE-CapabilityRequestFilterNR

Table 10. Filtering mechanisms. Note the direction of each: most subtract, srs-SwitchingTimeRequest adds.

The UE echoes what it applied. RF-Parameters.appliedFreqBandListFilter in the response repeats the filter the UE actually used, which is the only way the network can tell the difference between the UE does not support band n41 and we did not ask about band n41. Any tool that caches capability containers must key them on the applied filter, not on the device.

11. Message Size, Segmentation and Growth

RRC messages travel on SRB1 or SRB3 over PDCP, and PDCP has a maximum SDU size of 9000 octets TS 38.323 cl. 4.3.1. RLC will happily segment an RLC SDU across many transport blocks, so the air interface is not the limit -- the PDCP SDU size is. When an RRC message exceeds it, RRC itself must segment.

segmentNumber

rrc-MessageSegmentType

Table 11. Segmentation facts. Cross-reference the companion 13 RRC Overview for the segmentation procedure itself.

Growth over releases has been steady and in one direction. Each release adds bands, each new band multiplies the combination count, and each new feature adds fields to the per-CC and per-feature-set structures. There is no mechanism for shrinking a capability container, and no delta encoding: every transfer is a full transfer. RACS (§13) exists because that trend has no natural end.

12. EN-DC and NR-DC: UE-MRDC-Capability

Multi-RAT dual connectivity asks a different question. It is not "what can you do on NR" and "what can you do on LTE" -- it is "what can you do on both at the same time", which is a strictly smaller set. A UE may support LTE band 3 and NR band n78 individually and not be able to transmit on both simultaneously without an uplink sharing arrangement.

rf-ParametersMRDC.supportedBandCombinationList

UE-MRDC-Capability

featureSetCombinations

UE-MRDC-Capability

mrdc-Parameters

measAndMobParametersMRDC

UE-MRDC-Capability

pdcp-ParametersMRDC

UE-MRDC-Capability

pdcp-DuplicationMCG-OrSCG-DRB

Table 12. UE-MRDC-Capability. The third row is the important one: the feature set tables are shared, the combination lists are not.

13. Capability Caching: NGAP, the AMF and RACS

Re-transferring 40 kB every time a UE connects is indefensible for a device that connects dozens of times a day. Two mechanisms remove it, one from Rel-15 and one from Rel-16.

UE Radio Capability for Paging

Table 13. Capability caching mechanisms. RACS is the only one that survives a change of AMF, which is why it matters most for high-mobility and roaming devices.

14. Mandatory, Optional, and the accessStratumRelease Trap

TS 38.306 classifies every capability parameter, and the classification determines what the network may infer from silence:

Table 14. Capability classes. For the overwhelming majority of interesting fields, absence means not supported -- there is no "unknown".

14.1 The accessStratumRelease trap

accessStratumRelease states the highest 3GPP release whose access stratum the UE implements. It is a single enumeration, it is mandatory, and it is the first field in the container -- which makes it very tempting to use as a feature gate. It is not one.

Table 15. What accessStratumRelease does and does not license. Two of the five wrong assumptions produce silent failures.

15. ASN.1 Reference

The messages first, abridged to the fields that matter:

UECapabilityEnquiry-IEs ::= SEQUENCE {
    ue-CapabilityRAT-RequestList    UE-CapabilityRAT-RequestList,
    lateNonCriticalExtension        OCTET STRING                OPTIONAL,
    ue-CapabilityEnquiryExt         OCTET STRING (CONTAINING
                                        UECapabilityEnquiryExt-IEs) OPTIONAL,
    nonCriticalExtension            SEQUENCE {}                 OPTIONAL
}

UE-CapabilityRAT-RequestList ::= SEQUENCE (SIZE (1..maxRAT-CapabilityContainers))
                                     OF UE-CapabilityRAT-Request
    -- maxRAT-CapabilityContainers INTEGER ::= 8

UE-CapabilityRAT-Request ::= SEQUENCE {
    rat-Type                        RAT-Type,
    capabilityRequestFilter         OCTET STRING                OPTIONAL,
    ...
}

RAT-Type ::= ENUMERATED { nr, eutra-nr, eutra, utra-fdd-v1610, ... }

UE-CapabilityRequestFilterNR ::= SEQUENCE {
    frequencyBandList               FreqBandList                OPTIONAL,
    nonCriticalExtension            UE-CapabilityRequestFilterNR-v1540-IEs
                                                                OPTIONAL
}

UE-CapabilityRequestFilterCommon ::= SEQUENCE {
    mfbi-IndicatorNR                ENUMERATED {true}           OPTIONAL,
    omitEN-DC                       ENUMERATED {true}           OPTIONAL,
    ...
}

UECapabilityInformation-IEs ::= SEQUENCE {
    ue-CapabilityRAT-ContainerList  UE-CapabilityRAT-ContainerList OPTIONAL,
    lateNonCriticalExtension        OCTET STRING                OPTIONAL,
    nonCriticalExtension            SEQUENCE {}                 OPTIONAL
}

UE-CapabilityRAT-Container ::= SEQUENCE {
    rat-Type                        RAT-Type,
    ue-CapabilityRAT-Container      OCTET STRING   -- separately encoded
}

Listing 1. Abridged from TS 38.331 clause 6.2.2. ... marks extension markers and omitted members.

Then the container itself, and the indirection:

UE-NR-Capability ::= SEQUENCE {
    accessStratumRelease            AccessStratumRelease,
    pdcp-Parameters                 PDCP-Parameters,
    rlc-Parameters                  RLC-Parameters              OPTIONAL,
    mac-Parameters                  MAC-Parameters              OPTIONAL,
    phy-Parameters                  Phy-Parameters,
    rf-Parameters                   RF-Parameters,
    measAndMobParameters            MeasAndMobParameters        OPTIONAL,
    fdd-Add-UE-NR-Capabilities      UE-NR-CapabilityAddXDD-Mode OPTIONAL,
    tdd-Add-UE-NR-Capabilities      UE-NR-CapabilityAddXDD-Mode OPTIONAL,
    fr1-Add-UE-NR-Capabilities      UE-NR-CapabilityAddFRX-Mode OPTIONAL,
    fr2-Add-UE-NR-Capabilities      UE-NR-CapabilityAddFRX-Mode OPTIONAL,
    featureSets                     FeatureSets                 OPTIONAL,
    featureSetCombinations          SEQUENCE (SIZE (1..maxFeatureSetCombinations))
                                        OF FeatureSetCombination OPTIONAL,
    lateNonCriticalExtension        OCTET STRING                OPTIONAL,
    nonCriticalExtension            UE-NR-Capability-v1530-IEs  OPTIONAL
}

AccessStratumRelease ::= ENUMERATED {rel15, rel16, rel17, rel18,
                                     spare4, spare3, spare2, spare1, ...}

RF-Parameters ::= SEQUENCE {
    supportedBandListNR             SEQUENCE (SIZE (1..maxBands)) OF BandNR,
    supportedBandCombinationList    BandCombinationList         OPTIONAL,
    appliedFreqBandListFilter       FreqBandList                OPTIONAL,
    ...
}

BandCombination ::= SEQUENCE {
    bandList                    SEQUENCE (SIZE (1..maxSimultaneousBands))
                                    OF BandParameters,
    featureSetCombination       FeatureSetCombinationId,
    ca-ParametersEUTRA          CA-ParametersEUTRA              OPTIONAL,
    ca-ParametersNR             CA-ParametersNR                 OPTIONAL,
    mrdc-Parameters             MRDC-Parameters                 OPTIONAL,
    supportedBandwidthCombinationSet BIT STRING (SIZE (1..32))  OPTIONAL,
    powerClass-v1530            ENUMERATED {pc2}                OPTIONAL,
    ...
}

FeatureSetCombination ::= SEQUENCE (SIZE (1..maxSimultaneousBands))
                              OF FeatureSetsPerBand
FeatureSetsPerBand    ::= SEQUENCE (SIZE (1..maxFeatureSetsPerBand))
                              OF FeatureSet

FeatureSet ::= CHOICE {
    eutra   SEQUENCE { downlinkSetEUTRA FeatureSetEUTRA-DownlinkId,
                       uplinkSetEUTRA   FeatureSetEUTRA-UplinkId },
    nr      SEQUENCE { downlinkSetNR    FeatureSetDownlinkId,
                       uplinkSetNR      FeatureSetUplinkId }
}

FeatureSets ::= SEQUENCE {
    featureSetsDownlink       SEQUENCE (SIZE (1..maxDownlinkFeatureSets))
                                  OF FeatureSetDownlink        OPTIONAL,
    featureSetsDownlinkPerCC  SEQUENCE (SIZE (1..maxPerCC-FeatureSets))
                                  OF FeatureSetDownlinkPerCC   OPTIONAL,
    featureSetsUplink         SEQUENCE (SIZE (1..maxUplinkFeatureSets))
                                  OF FeatureSetUplink          OPTIONAL,
    featureSetsUplinkPerCC    SEQUENCE (SIZE (1..maxPerCC-FeatureSets))
                                  OF FeatureSetUplinkPerCC     OPTIONAL,
    ...
}

FeatureSetDownlink ::= SEQUENCE {
    featureSetListPerDownlinkCC SEQUENCE (SIZE (1..maxNrofServingCells))
                                    OF FeatureSetDownlinkPerCC-Id,
    intraBandFreqSeparationDL   FreqSeparationClass             OPTIONAL,
    scalingFactor               ENUMERATED {f0p4, f0p75, f0p8}  OPTIONAL,
    scellWithoutSSB             ENUMERATED {supported}          OPTIONAL,
    csi-RS-MeasSCellWithoutSSB  ENUMERATED {supported}          OPTIONAL,
    type1-3-CSS                 ENUMERATED {supported}          OPTIONAL,
    pdcch-MonitoringAnyOccasions ENUMERATED {withoutDCI-Gap,
                                            withDCI-Gap}       OPTIONAL,
    ...                            -- plus several deprecated dummy fields
}

FeatureSetDownlinkPerCC ::= SEQUENCE {
    supportedSubcarrierSpacingDL SubcarrierSpacing,
    supportedBandwidthDL         SupportedBandwidth,
    channelBW-90mhz              ENUMERATED {supported}         OPTIONAL,
    maxNumberMIMO-LayersPDSCH    MIMO-LayersDL                  OPTIONAL,
    supportedModulationOrderDL   ModulationOrder                OPTIONAL,
    ...
}

SupportedBandwidth ::= CHOICE {
    fr1  ENUMERATED {mhz5, mhz10, mhz15, mhz20, mhz25, mhz30, mhz40,
                     mhz50, mhz60, mhz80, mhz100},
    fr2  ENUMERATED {mhz50, mhz100, mhz200, mhz400}
}
MIMO-LayersDL  ::= ENUMERATED {twoLayers, fourLayers, eightLayers}
ModulationOrder ::= ENUMERATED {bpsk-halfpi, bpsk, qpsk, qam16,
                                qam64, qam256}

FeatureSetCombinationId    ::= INTEGER (0..maxFeatureSetCombinations-1)
FeatureSetDownlinkId       ::= INTEGER (0..maxDownlinkFeatureSets)
FeatureSetUplinkId         ::= INTEGER (0..maxUplinkFeatureSets)
FeatureSetDownlinkPerCC-Id ::= INTEGER (1..maxPerCC-FeatureSets)
FeatureSetUplinkPerCC-Id   ::= INTEGER (1..maxPerCC-FeatureSets)

Listing 2. Abridged from TS 38.331 clause 6.3.3. The last five lines are the whole of §7.2 in ASN.1 form -- note the three different lower bounds.

16. Parameter and Limit Reference

maxBandComb

maxSimultaneousBands

maxFeatureSetsPerBand

maxFeatureSetCombinations

maxPerCC-FeatureSets

maxBands

maxNrofServingCells

maxRAT-CapabilityContainers

accessStratumRelease

maxNumberMIMO-LayersPDSCH

supportedModulationOrderDL

scalingFactor

intraBandFreqSeparationDL

segmentNumber

Table 16. Capability limits and the fields that most often matter. The "typical" column is observational and varies widely by device class.

17. Failure Modes and What Each One Means

Table 17. Capability failure modes. Ten of the eleven are detected by nobody, which is why capability problems are usually found by someone comparing two devices rather than by an alarm.

18. Illustrative Message Traces

18.1 An unfiltered enquiry and its consequences

10:22:04.118  [RRC-DL] UECapabilityEnquiry
                rrc-TransactionIdentifier ....... 1
                ue-CapabilityRAT-RequestList
                 [0] rat-Type .................. nr
                     capabilityRequestFilter ... (absent)   -- ** no filter **
                ue-CapabilityEnquiryExt ......... (absent)

10:22:04.142  [RRC-UL] ULDedicatedMessageSegment
                rrc-MessageSegmentNumber ........ 0
                rrc-MessageSegmentType .......... notLastSegment
                rrc-MessageSegmentContainer ..... 8 800 octets
10:22:04.151  [RRC-UL] ULDedicatedMessageSegment  1  notLastSegment  8 800
10:22:04.159  [RRC-UL] ULDedicatedMessageSegment  2  notLastSegment  8 800
10:22:04.168  [RRC-UL] ULDedicatedMessageSegment  3  notLastSegment  8 800
10:22:04.176  [RRC-UL] ULDedicatedMessageSegment  4  notLastSegment  5 100
10:22:04.181  [RRC-UL] ULDedicatedMessageSegment  5  lastSegment     1 400

10:22:04.182  [RRC]    reassembled UECapabilityInformation, 41 700 octets
                rrc-TransactionIdentifier ....... 1     -- matches
                ue-CapabilityRAT-ContainerList
                 [0] rat-Type .................. nr
                     ue-CapabilityRAT-Container . 41 612 octets

-- 63 ms of SRB1 occupied, six PDCP SDUs, for a container in which the
   gNB will use fewer than 50 of the 2 940 band combinations.

Listing 3. The unfiltered case. Note that segmentation is working correctly here -- the problem is not a failure, it is the cost.

18.2 The filtered enquiry

10:22:04.240  [RRC-DL] UECapabilityEnquiry
                rrc-TransactionIdentifier ....... 2
                ue-CapabilityRAT-RequestList
                 [0] rat-Type .................. nr
                     capabilityRequestFilter
                      UE-CapabilityRequestFilterNR
                       frequencyBandList
                        [0] bandInformationNR  bandNR 78
                              maxCarriersRequestedDL ... 2
                        [1] bandInformationNR  bandNR 3
                        [2] bandInformationNR  bandNR 1
                ue-CapabilityEnquiryExt
                 UECapabilityEnquiryExt-IEs
                  capabilityRequestFilterCommon
                   omitEN-DC ..................... true
                   mfbi-IndicatorNR .............. true

10:22:04.268  [RRC-UL] UECapabilityInformation   (3 100 octets, unsegmented)
                rrc-TransactionIdentifier ....... 2
                ue-CapabilityRAT-ContainerList
                 [0] rat-Type .................. nr

-- decoded container, top level:
     accessStratumRelease ................ rel17
     pdcp-Parameters
       supportedROHC-Profiles .......... profile0x0104, profile0x0106
       maxNumberROHC-ContextSessions ... cs16
     rlc-Parameters
       am-WithShortSN .................. supported
       um-WithLongSN ................... supported
     rf-Parameters
       supportedBandListNR ............. n1, n3, n78    (3 of 41 reported)
       supportedBandCombinationList .... 46 entries
       appliedFreqBandListFilter ....... n78, n3, n1    -- echo of the filter
     featureSets
       featureSetsDownlink ............. 11 entries
       featureSetsDownlinkPerCC ........ 6 entries
       featureSetsUplink ............... 9 entries
       featureSetsUplinkPerCC .......... 5 entries
     featureSetCombinations ............ 18 entries

-- 46 combinations resolving onto 6 downlink per-CC profiles: the pyramid
   of S7.3, at small scale.

Listing 4. The same device, filtered. appliedFreqBandListFilter is what makes this container safe to cache -- and unsafe to reuse in an n41 cell.

18.3 Walking the dereference in a log

-- gNB internal trace of the capability resolution for SCell addition

10:22:04.291  [CAP] intended carriers: n78 100 MHz + n78 100 MHz + n1 20 MHz
10:22:04.291  [CAP] searching supportedBandCombinationList for bandList
                    { n78 classC, n1 classA } ... hit at index 37
10:22:04.291  [CAP] bandCombination[37].featureSetCombination = 12
10:22:04.291  [CAP] featureSetCombinations[12]
                      [0] nr: downlinkSetNR=5  uplinkSetNR=3   -- band n78
                      [1] nr: downlinkSetNR=9  uplinkSetNR=7   -- band n1
10:22:04.292  [CAP] featureSetsDownlink[5].featureSetListPerDownlinkCC
                      = [ 2, 2 ]                         -- 2 CCs on n78
                    featureSetsDownlink[5].scalingFactor = (absent) -> f = 1
10:22:04.292  [CAP] featureSetsDownlink[9].featureSetListPerDownlinkCC
                      = [ 4 ]                            -- 1 CC on n1
10:22:04.292  [CAP] featureSetsDownlinkPerCC[2]
                      supportedSubcarrierSpacingDL ... kHz30
                      supportedBandwidthDL ........... fr1: mhz100
                      maxNumberMIMO-LayersPDSCH ...... fourLayers
                      supportedModulationOrderDL ..... qam256
10:22:04.292  [CAP] featureSetsDownlinkPerCC[4]
                      supportedSubcarrierSpacingDL ... kHz15
                      supportedBandwidthDL ........... fr1: mhz20
                      maxNumberMIMO-LayersPDSCH ...... twoLayers
                      supportedModulationOrderDL ..... qam256
10:22:04.293  [CAP] ca-ParametersNR.maxNumberOfServingCells = 4
                    -> 3 requested <= 4, ok
10:22:04.293  [CAP] resolved: 220 MHz aggregated, DL layers 4+4+2,
                    mcs-Table qam256 permitted on all three carriers
10:22:04.294  [RRC-DL] RRCReconfiguration  (SCellToAddModList: 2 entries)

Listing 5. The dereference of §8 as a gNB would log it. Every line is an index lookup; the numbers appear only in the last two.

18.4 A capability ignored

-- a gNB that gated on accessStratumRelease instead of the capability field

11:40:12.002  [CAP] accessStratumRelease = rel17
11:40:12.002  [CAP] featureSetsDownlinkPerCC[1].maxNumberMIMO-LayersPDSCH
                      = twoLayers                         -- ** two, not four **
11:40:12.003  [SCHED] rank adaptation enabled, max rank 4  (from release)
11:40:12.010  [RRC-DL] RRCReconfiguration
                 csi-ReportConfig  codebookConfig  maxNumberOfLayers .. 4
11:40:12.041  [RRC-UL] RRCReconfigurationComplete       -- accepted!

11:40:13.220  [PHY-DL] DCI 1_1  rank 4  MCS 22  -> HARQ NACK
11:40:13.224  [PHY-DL] DCI 1_1  rank 4  MCS 22  -> HARQ NACK  (RV1)
11:40:13.228  [PHY-DL] DCI 1_1  rank 4  MCS 22  -> HARQ NACK  (RV2)
11:40:13.232  [PHY-DL] DCI 1_1  rank 4  MCS 22  -> HARQ NACK  (RV3)
11:40:13.236  [MAC]    max HARQ retransmissions reached, TB discarded
11:40:13.240  [PHY-UL] CSI report: RI = 2, CQI 14, SINR 24.8 dB
                       -- excellent radio, RI never above 2

-- signature: 100 % BLER on rank-3 and rank-4 grants, 0 % on rank-1 and
   rank-2, at 25 dB SINR. Moving the UE closer changes nothing.
-- the UE accepted the reconfiguration because it is required to ignore
   a codebook configuration it cannot use. Nothing failed loudly.

Listing 6. The characteristic signature of a capability mismatch: failure that is flat against SINR, and a reported rank that never reaches the configured maximum.

18.5 A cache reused outside its filter

-- UE moves from an n78/n3/n1 cluster into a cell on n41

14:05:31.700  [NGAP-DL] INITIAL CONTEXT SETUP REQUEST
                UE Radio Capability ....... present, 3 100 octets
14:05:31.702  [CAP] using cached container, no enquiry
14:05:31.702  [CAP] appliedFreqBandListFilter = n78, n3, n1
14:05:31.702  [CAP] serving cell band = n41
14:05:31.702  [CAP] n41 not in supportedBandListNR
14:05:31.703  [RRC-DL] RRCRelease
                redirectedCarrierInfo ..... (n78 carrier)

-- the UE supports n41 perfectly well. Nobody asked.
-- correct behaviour: appliedFreqBandListFilter does not cover the serving
   band, so the cache is not applicable and a fresh enquiry is required.

Listing 7. Why appliedFreqBandListFilter exists. The cache was valid, the decode was correct, and the conclusion was wrong.

19. Release Deltas: Rel-15 to Rel-18

Table 18. Capability-relevant changes by release. Note that the encoding has never been redesigned -- every mitigation has been about asking for less or transferring less often.

20. Reading Capability in Logs: A Checklist

1. Find out whether an enquiry happened at all. If there is no UECapabilityEnquiry, look for the UE Radio Capability IE in the NGAP INITIAL CONTEXT SETUP REQUEST. A cache hit is the normal case in a mature network (§13).

2. Read the applied filter before anything else in the container. appliedFreqBandListFilter tells you what the UE was allowed to report. Everything absent from the container is either unsupported or outside that filter, and you cannot tell which without it (§10).

3. Check the access stratum release, then ignore it as a feature gate. Use accessStratumRelease only to bound which extension containers can be present. Every individual feature has its own field (§14.1).

4. Resolve the duplex and frequency-range overlays. Apply fdd-Add-, tdd-Add-, fr1-Add- and fr2-Add- differences before quoting any top-level value (§5).

5. Count the four structures. Band combinations, feature set combinations, downlink feature sets, per-CC feature sets. The ratios tell you immediately whether the container is a small filtered one or a full flagship dump (§7.3).

6. Walk the chain by hand for the combination in question. Band combination to featureSetCombination to featureSetsDownlink to featureSetsDownlinkPerCC. Watch the base convention at each hop, and remember that a downlink or uplink set id of 0 means not supported (§7.2).

7. Do not forget the two outer ceilings. scalingFactor and ca-ParametersNR both sit above the per-CC values and can lower them further (§8.1, §6).

8. Diff the configuration against the capability. Take the RRCReconfiguration the gNB actually sent and check every rank, bandwidth, SCS, modulation and SN length against the resolved ceilings. This is the only reliable way to catch a capability fault, because nothing raises an error (§17).

9. When throughput or BLER is flat against SINR, suspect capability. A radio problem improves as the UE approaches the cell. A capability mismatch does not (§9).

10. For EN-DC, get the container from the X2 or Xn message. The NR capability travels through the eNB as opaque octets and may not appear decoded in either RAT's own log (§12).

11. If a fleet-wide problem correlates with a firmware rollout, flush the capability cache. A stale cached container behaves exactly like a network misconfiguration and is invisible in every RRC log (§13).

21. Glossary and References

UE-NR-Capability

UE-MRDC-Capability

appliedFreqBandListFilter

accessStratumRelease

scalingFactor

References

• 3GPP TS 38.331 -- RRC protocol specification. Clause 5.6.1 (UE capability transfer), clause 5.7.7 (RRC message segmentation), clause 6.2.2 (UECapabilityEnquiry, UECapabilityInformation, ULDedicatedMessageSegment), clause 6.3.3 (UE-NR-Capability, RF-Parameters, BandCombination, FeatureSets, FeatureSetDownlink, FeatureSetDownlinkPerCC, UE-CapabilityRequestFilterNR, UE-CapabilityRequestFilterCommon), and the maximum-value constant definitions.
• 3GPP TS 38.306 -- UE radio access capabilities. Clause 4.1.2 (approximate maximum data rate), clause 4.2 (per-parameter definitions and their mandatory/optional classification). This is the normative meaning of every field in the container.
• 3GPP TS 36.331 -- E-UTRA RRC. UE-EUTRA-Capability, and the LTE UECapabilityEnquiry that carries NR containers in EN-DC.
• 3GPP TS 38.323 -- PDCP specification. Clause 4.3.1 (maximum supported PDCP SDU size, 9000 octets -- the segmentation threshold).
• 3GPP TS 38.413 -- NGAP. UE RADIO CAPABILITY INFO INDICATION, the UE Radio Capability, UE Radio Capability ID and UE Radio Capability for Paging IEs, and INITIAL CONTEXT SETUP REQUEST.
• 3GPP TS 23.501 -- System architecture. Clause 5.4.4a (RACS and the UCMF), and the capability-related aspects of registration.
• 3GPP TS 23.502 -- Procedures for the 5G System. UE radio capability ID allocation and the UCMF service operations.
• 3GPP TS 38.101-1 / 38.101-2 -- UE radio transmission and reception. Clause 5.3A (CA bandwidth classes and bandwidth combination sets), power classes, and the RF constraints that band combinations encode.
• 3GPP TS 38.214 -- Physical layer procedures for data. The MCS tables that supportedModulationOrderDL selects between, and the PRB counts per channel bandwidth used in the §8.1 arithmetic.

Companion documents in this set

• 03 Random Access -- 2-step RACH, one of the clearest examples of an optional capability that must be declared before it can be configured.
• 08 Scheduling -- the MCS tables and rank adaptation that per-CC capabilities bound.
• 09 LCP -- what mac-Parameters LCP restrictions gate.
• 11 DRX -- capability-gated DRX and eDRX behaviour.
• 13 RRC Overview -- unaligned PER, SRB1, and the RRC segmentation procedure this document's largest message depends on.
• 15 RRC Procedures -- RRCReconfiguration, the message that spends what the capability allows.
• 19 Paging -- UE Radio Capability for Paging, and the Rel-17 paging features declared here.
• 20 Measurements / 21 Measurement Gaps and SMTC -- what measAndMobParameters gates.
• 22-25 Handover documents -- DAPS and conditional handover, both optional and both capability-gated.
• 27 AS Security Mode -- why the enquiry must come after security activation, and where the UE's security capabilities actually live.