To better understand the VoLTE signaling procedures on the RAN side, use the PA tool to analyse some DT logfiles
1.The Cause Analysis of the Called UE Initiates CSFB
1.1 symptom:
Use the Probe to play back VoLTE DT logfiles. During the VoLTE call test, you can see that CSFB occurs on the called UE in the Event window.

The L3 signaling shows that the called UE MS2 initiates the ESR, and the CSFB procedure is performed.

1.2 Analysis
Firstly, view the radio coverage of the called UE, the probe shows that the RSRP of the called UE is -83dBm and the SINR is -12dB when CSFB occurs, it indicates that the radio coverage is good, so, the CSFB is not triggered by the poor coverage.

Check the SIP message, it is found that the UE had initiated a procedure of IMS registration before the called UE initiating CSFB, the signaling is as follows(see the red box)

According to the VoLTE standard IMS registration signaling procedure, a 200 OK message sent from network site to UE is missing.

After the VoLTE UE accessing the network and establishing the default bear for QCI5 and QCI9, it also needs to initiate IMS registration, the standard procedure is shown in the following figure:
1.SIP:Register—The UE initiates a registration to authenticate IMS network and obtain the authentication parameters from IMS network.
2.SIP:401 Unauthorized—The UE hasn't passed the IMS authentication yet for it was rejected by the IMS, but there are anthentication parameters of UE(RAND and AUTN) in the message.
3.SIP:Register—The UE initiates registration request again (it carries authentication parameters that obtained from last step), it is the IMS authentication at this moment (verify whether the UE can call VoLTE and download the user’s subscription data from HSS).
4.SIP:200OK—UE anthenticates on the core network successfully and then registers to IMS.

View the L3 signaling, it was found that the UE initiated a Detach request at 05:52:56.333, double-click the signaling and found the type of Detach initiating is switch-off.

Next, the phone starts to read system message and initiates an Attach request at 05:52:57.531, after the Attach is complete, the default bearer is set up, it means that the defalult bearer of the MME QCI9 and the IMS QCI5 have been set up. The IMS registration is the IMS registration that has not been completed before.

1.3 root cause
Check the Event, it was found the called MS didn't receive the IMSRegisterSuc event after it initiated the IMSRegisterAttempt, and then the called MS intiated ERS(CSFB) request immediately, it could be seen from the time that the MS was under authentication to UE in the network side at 05:52:59.425, howerer, the MS has initiated CSFB at 05:52:59.082, it indicates the calling terminal initiated VoLTE before the called terminal completing the IMS registration, therefore, the CSFB is initiated.
1.4 Conclusion
The called MS initiates the CSFB. It is suspected that the called MS is rebooted manually, it receives the VoLTE from calling MS before the called MS completes the IMS registration, but there is no information of the called MS in the IMS, so it directly initiates the CSFB.
