Location Service (LCS) — positioning services via GMLC and LMF¶

Difficulty: Intermediate–Advanced ／ Estimated study time: 30 min ／ Prerequisites: Registration, Paging ／ Lead roles: GMLC, LMF, AMF ／ Main Interfaces: Le (GMLC⇔external), NL-family (AMF⇔LMF), N2

Learning objectives¶

After reading this chapter, you will be able to:

Explain that Location Service (LCS) is "the mechanism for obtaining a UE's location (positioning result) and providing it to the requester."
Explain the division of roles between GMLC (the front desk for external LCS clients) and LMF (the NF that performs the positioning computation).
Explain that the hub of the positioning procedure is the AMF, which exchanges the positioning protocols LPP with the UE and NRPPa with the RAN.
Diagram the flow of the representative procedure MT-LR (Mobile Terminated Location Request) (external request → GMLC → AMF → LMF → positioning → response).
Explain the correspondence from 4G's GMLC/E-SMLC to 5G's GMLC/LMF.

Prerequisites¶

Registration (initial registration) — that the UE is registered and being served by an AMF is a prerequisite for positioning.
Paging — when positioning an idle UE, it must first be woken up (network-initiated positioning).
QoS (the 5G QoS model) — supplementary for the idea of the response-time and accuracy requirements of positioning (QoS of Location).
Supplementary: AMF (the hub of the positioning procedure) / N2 (the control path to the RAN, which carries NRPPa).

Focus of this chapter

Because GMLC / LMF appear for the first time in this chapter, they are introduced in a column to the extent needed as characters (individual NF pages are not yet created; for a list see the NF Dictionary). This chapter focuses on "how the location-obtaining procedure flows across the whole 5GC (who exchanges what via LPP/NRPPa)." The details of the radio-side positioning algorithms (OTDOA / observed time-difference, etc.) are out of scope and marked to be confirmed.

Why — why a location service is needed¶

There are many requests to know "where is this device (UE) right now."

Emergency calls — conveying the caller's location to the fire department / police (often mandated by regulation).
Law enforcement (Lawful Interception family) — location determination based on regulations.
Commercial services — location requests from apps (external LCS clients), such as navigation, watch-over, and area-linked services.

On the other hand, to actually obtain a UE's location, specialized processing is required to gather radio measurements (time differences and signal strength with base stations, GNSS assistance, etc.) and compute the result. Rather than cramming this into a single NF, the 5GC design divides the labor: a front desk that receives requests, a brain that computes positioning, with a central core NF (AMF) handling the traffic control of the procedure.

This whole "mechanism for providing a location to the requester" is Location Service (LCS). It is specified in 3GPP TS 23.273 (stage 2 for 5GS positioning) (the detailed clause numbers are to be confirmed). Thanks to LCS, everything from emergency calls to commercial apps can obtain locations within a unified framework.

Analogy: LCS is a "location-investigation agency." The client (external client) asks the reception (GMLC), "find this person's whereabouts"; the reception relays it to the responsible desk (AMF); the desk instructs the surveyor (LMF) to take the measurements. The surveyor gathers measurement values from the person themselves (UE) and the site (RAN), works out the coordinates, and returns the result to the client.

Overview¶

Location Service operates through the collaboration of the following characters:

External LCS client — the requester that wants to know a location (emergency agency, app, etc.). It requests from the GMLC.
GMLC (Gateway Mobile Location Centre) — the front-desk NF for external requests. It authorizes the requester, finds the AMF serving the target UE, and relays the request.
AMF — the hub of the positioning procedure. It receives the request from the GMLC, asks the LMF to perform positioning, and mediates the positioning protocols with the UE/RAN.
LMF (Location Management Function) — the NF that computes positioning. It gathers the necessary measurements from the UE (LPP) and the RAN (NRPPa), calculates the location, and returns it via the AMF.

The representative procedure is MT-LR (Mobile Terminated Location Request) — the pattern where "the location of a specific UE is requested from outside the network." The request descends external → GMLC → AMF → LMF, the LMF gathers measurements from the UE (LPP) / RAN (NRPPa) and calculates the location, and the response returns in reverse order.

The key points are the three-way division of labor of "front desk (GMLC) / hub (AMF) / brain (LMF)" and that the positioning protocols come in two lines, LPP (UE⇔LMF) and NRPPa (RAN⇔LMF), both of which the AMF mediates and carries.

Column: what are GMLC and LMF

GMLC (Gateway Mobile Location Centre) — the gateway NF standing between external LCS clients and the 5GC. It receives requests over the external interface Le (external client⇔GMLC), performs authorization of the requester, discovery of the serving AMF of the target UE, privacy checks, and so on, then relays inward. It collaborates with other NFs (UDM, etc.) over SBI (HTTP/2) (service names and clause numbers are to be confirmed).
LMF (Location Management Function) — the brain NF that computes positioning. It receives positioning requests from the AMF, instructs and collects measurements via LPP (LTE Positioning Protocol) to the UE and NRPPa (NR Positioning Protocol A) to the RAN, and calculates the location. It collaborates with the AMF over the NL-family interface (AMF⇔LMF; name and number to be confirmed).

Both are defined in 3GPP TS 23.273 / TS 23.501 (individual clause numbers are to be confirmed).

Architecture¶

graph LR
    EXT["External LCS client"] -- "Le" --> GMLC["GMLC (front desk)"]
    GMLC -- "SBI" --> AMF["AMF (hub)"]
    AMF -- "NL-family" --> LMF["LMF (positioning computation)"]
    AMF -- "N2(NGAP)" --> RAN["NG-RAN"]
    UE["UE"] -. "LPP (carried via AMF/RAN)" .-> LMF
    RAN -. "NRPPa (carried via N2/AMF)" .-> LMF

How to read the diagram: the external client requests a location from the GMLC over Le. The GMLC finds the serving AMF of the target UE and relays the request, and the AMF asks the LMF to perform positioning. The LMF exchanges measurements with the UE via LPP and with the RAN via NRPPa, but these are mediated and carried by the AMF (over NAS toward the UE, over N2/NGAP toward the RAN). The positioning computation is done by the LMF, and the result returns in reverse order AMF → GMLC → external client. For the general role of the AMF, see the AMF page (not repeated in this chapter).

Network Function¶

NF	Role	Information held	APIs consumed	APIs provided	Related Interfaces	Impact on failure
GMLC	Front desk for external requests, authorization, AMF discovery, privacy check	LCS client authorization info	(SBI to UDM, etc.)	Ngmlc-family (to be confirmed)	Le, SBI	External location requests cannot be received
AMF	Hub of the positioning procedure. Mediates GMLC⇔LMF⇔UE/RAN	UE context, serving information	Nlmf (to be confirmed)	Namf	N2, NL-family, SBI	The entire positioning procedure fails to start
LMF	Positioning computation. Collects measurements via LPP/NRPPa and calculates location	Positioning assistance data	—	Nlmf (to be confirmed)	NL-family	The location cannot be calculated
NG-RAN	Provides radio measurements via NRPPa	Cell / radio measurements	—	—	N2	RAN positioning measurements cannot be obtained

Service names and NL numbers to be confirmed

The SBI service names (Ngmlc/Nlmf, etc.), the official number of the AMF⇔LMF NL-family interface, and the operation names used by GMLC/AMF/LMF differ by Release, and this chapter does not fabricate them but marks them to be confirmed. What can be stated with certainty is only the division of roles and the use of the positioning protocols (LPP/NRPPa).

Interface / positioning protocols¶

Name	Segment	Type	Role
Le	External LCS client ⇔ GMLC	External IF	Reception of external location requests (to be confirmed: detailed spec)
NL-family	AMF ⇔ LMF	SBI-equivalent	Exchange of positioning requests / results (official number and name to be confirmed)
N2 (NGAP)	NG-RAN ⇔ AMF	Control	Carriage of NRPPa (instructing / collecting RAN positioning measurements)
N1 (NAS)	UE ⇔ AMF	Control	Carriage of LPP (instructing / collecting UE positioning measurements)

The division between LPP and NRPPa

LPP (LTE Positioning Protocol) — the positioning protocol between UE ⇔ LMF. It carries the UE's GNSS measurements and signal measurements. Its carriage path is NAS (N1) → AMF → LMF.
NRPPa (NR Positioning Protocol A) — the positioning protocol between NG-RAN ⇔ LMF. It carries base-station-side measurements (time differences of arrival, etc.). Its carriage path is N2 (NGAP) → AMF → LMF.

In both, the AMF acts as the relay, and they are logical protocols for the LMF to directly exchange with its positioning peer (UE / RAN). The detailed spec and clause numbers of the protocols are to be confirmed.

Procedure — Call Flow (MT-LR)¶

We understand the representative procedure MT-LR (Mobile Terminated Location Request) in four stages: (A) external request reception → (B) relay to AMF → (C) positioning at LMF → (D) response.

sequenceDiagram
    participant EXT as External LCS client
    participant GMLC
    participant AMF
    participant LMF
    participant UE
    participant RAN as NG-RAN

    Note over EXT,GMLC: (A) External location request
    EXT->>GMLC: Le location request (target UE identifier)
    Note over GMLC: Requester authorization / privacy check / serving AMF discovery

    Note over GMLC,AMF: (B) Relay to AMF
    GMLC->>AMF: Location request (SBI)
    opt If the UE is idle
        AMF->>RAN: N2 Paging trigger
        RAN-->>UE: Paging (wake up)
    end

    Note over AMF,RAN: (C) Positioning at LMF
    AMF->>LMF: NL-family positioning request
    LMF->>UE: LPP (via NAS/AMF) measurement instruction
    UE-->>LMF: LPP measurement result
    LMF->>RAN: NRPPa (via N2/AMF) measurement instruction
    RAN-->>LMF: NRPPa measurement result
    Note over LMF: Calculate the location

    Note over EXT,LMF: (D) Response (reverse order)
    LMF-->>AMF: NL-family positioning result
    AMF-->>GMLC: Location result (SBI)
    GMLC-->>EXT: Le location response

Explanation of the procedure:

(A) External request reception — the external LCS client requests the location of the target UE from the GMLC over Le. The GMLC performs authorization of the requester, privacy check, and discovery of the serving AMF.
(B) Relay to AMF — the GMLC passes the location request to the AMF serving the target UE. If the UE is idle (CM-IDLE), it is first woken up with Paging.
(C) Positioning at LMF — the AMF asks the LMF to perform positioning. The LMF instructs the UE (LPP) and RAN (NRPPa) to take measurements, gathers the results, and calculates the location. Both LPP/NRPPa are mediated and carried by the AMF.
(D) Response — the calculated location returns in reverse order LMF → AMF → GMLC → external client.

MO-LR / NI-LR as other patterns

The subject of this chapter is the externally-initiated MT-LR, but there are also MO-LR (Mobile Originated), in which the UE itself requests its own location, and NI-LR (Network Induced, emergency calls, etc.), triggered by the network itself. The skeleton (AMF as hub, LMF for positioning, LPP/NRPPa) is common; the originator and request path differ. The details and conditions of each pattern are to be confirmed in TS 23.273.

Signal Flow¶

Signal	Purpose	Source	Destination	Key information	Result
Le location request	Positioning request from outside	External client	GMLC	Target UE identifier, QoS of Location	GMLC authorizes and relays
Location request (SBI)	Ask AMF for positioning	GMLC	AMF	Target UE, request type	AMF starts the procedure
Positioning request (NL-family)	Instruct LMF to perform positioning	AMF	LMF	Positioning method, required accuracy	LMF begins positioning
LPP measurement instruction/result	Collection of UE measurements	LMF⇔UE	(via AMF/NAS)	Measurement request, GNSS/signal measurements	UE measurements obtained
NRPPa measurement instruction/result	Collection of RAN measurements	LMF⇔RAN	(via AMF/N2)	Measurement request, time difference of arrival, etc.	RAN measurements obtained
Positioning result (NL-family)	Return of the calculated location	LMF	AMF	Location (coordinates/accuracy)	Result to AMF

Comparison with EPC¶

In 4G: the location service was handled by the GMLC (external front desk) and the E-SMLC (Evolved Serving Mobile Location Centre, positioning computation), with the MME mediating the procedure. The positioning protocols used were LPP with the UE and LPPa with the eNB.
In 5G: the front-desk GMLC is carried over, positioning computation corresponds to E-SMLC → LMF, and procedure mediation corresponds to MME → AMF. The positioning protocol with the RAN is replaced by LPPa → NRPPa, while LPP with the UE continues.

4G (EPC)	5G (5GC)
GMLC (external front desk)	GMLC (external front desk)
E-SMLC (positioning computation)	LMF (positioning computation)
MME (procedure mediation)	AMF (procedure mediation)
LPP (UE⇔E-SMLC)	LPP (UE⇔LMF)
LPPa (eNB⇔E-SMLC)	NRPPa (NG-RAN⇔LMF)

The skeleton of the three-way division of labor "external front desk (GMLC) / positioning computation (E-SMLC→LMF) / procedure mediation (MME→AMF)" is continuous from 4G. The main changes in 5G are the name of the positioning-computation NF (LMF) and its SBI-ization, and the RAN positioning protocol LPPa→NRPPa.

Release differences¶

Rel-15: the 5GS LCS foundation (GMLC/LMF/AMF, LPP/NRPPa) was introduced.
Rel-16 onward: improvements in positioning accuracy and latency (for industrial use cases) proceed. In Rel-17/18, positioning enhancements and NTN-related extensions are discussed (see Rel-17 & Rel-18). Specific accuracy figures, methods, and clause numbers are to be confirmed (not asserted in this chapter).

Trouble Shooting¶

Symptom	Likely cause	Check points	Log/Packet	Direction of resolution
External location request does not go through	Authorization failure at GMLC	LCS client authorization settings	Le request/response	Check client authorization and privacy settings
Positioning does not start	Serving AMF discovery failure	GMLC→AMF relay	GMLC/AMF logs	Check UE registration state and AMF discovery procedure
Cannot position an idle UE	Failure to wake it up with Paging	CM state, Paging response	N2 Paging	Check Paging and reachability
The location is not calculated	LMF cannot gather measurements	LPP/NRPPa round trips	LPP, NRPPa	Check UE/RAN positioning support and assistance data
Accuracy does not meet the requirement	Positioning-method / environment dependent	QoS of Location, positioning method	LMF logs	Positioning-method selection, to be confirmed (environment/implementation-dependent)

3GPP Specification¶

3GPP TS 23.273 — 5GS Location Services (positioning) stage 2. The main basis of this chapter (GMLC/LMF/AMF procedures). Individual clause numbers are to be confirmed.
3GPP TS 23.501 / TS 23.502 — the definition of GMLC/LMF and their positioning in the system (clause numbers to be confirmed).
3GPP TS 38.305 — positioning in the NG-RAN (the positioning of NRPPa). Clause numbers to be confirmed.
3GPP TS 37.355 — LPP (LTE Positioning Protocol). Clause numbers to be confirmed.
3GPP TS 38.455 — NRPPa (NR Positioning Protocol A). Clause numbers to be confirmed.

Scope of assertion in this chapter

What is asserted is only the three-way division of labor of LCS (GMLC = front desk / LMF = positioning computation / AMF = mediation), the use of the positioning protocols (LPP = UE⇔LMF, NRPPa = RAN⇔LMF), the MT-LR flow, and the correspondence with 4G (E-SMLC/LPPa). The SBI service names (Ngmlc/Nlmf), the official NL-family numbers, the clause-number sub-branches, the accuracy figures per positioning method, and the radio positioning algorithms are not fabricated but marked to be confirmed.

FAQ¶

Q. What kind of mechanism is Location Service (LCS), after all? A. It is a mechanism for obtaining a UE's location and providing it to the requester. The external front desk GMLC, the positioning-computation LMF, and the procedure-mediating AMF work together, gathering measurements from the UE (LPP) and the RAN (NRPPa) to calculate the location. It is specified in 3GPP TS 23.273.

Q. What is the difference between GMLC and LMF? A. GMLC is the front desk for external LCS clients (authorization, AMF discovery, privacy check), while LMF is the brain that computes positioning (gathering measurements via LPP/NRPPa to calculate the location). The characteristic is that the front desk and the computation are separated.

Q. How are LPP and NRPPa used differently? A. LPP is the positioning protocol for UE⇔LMF (the UE's measurements), and NRPPa is for NG-RAN⇔LMF (the base station's measurements). Both are mediated and carried by the AMF (over NAS toward the UE, over N2/NGAP toward the RAN).

Q. What is MT-LR? A. Mobile Terminated Location Request — the pattern where the location of a specific UE is requested from outside the network. It descends external → GMLC → AMF → LMF, performs positioning, and responds in reverse order. There are also MO-LR (UE-initiated) and NI-LR (network-initiated, emergency, etc.).

Q. What is different from 4G's LCS? A. The skeleton (GMLC front desk, positioning-computation NF, procedure-mediation NF) is common. In 5G, positioning computation changed to E-SMLC→LMF, mediation to MME→AMF, and the RAN positioning protocol to LPPa→NRPPa. LPP with the UE continues.

Summary¶

Location Service (LCS) is the mechanism for obtaining a UE's location and providing it to the requester (3GPP TS 23.273).
Three-way division of labor: GMLC (external front desk, authorization, AMF discovery) / LMF (positioning computation) / AMF (procedure mediation).
The positioning protocols come in two lines: LPP (UE⇔LMF) and NRPPa (NG-RAN⇔LMF). Both are mediated and carried by the AMF.
The representative procedure MT-LR positions via external → GMLC → AMF → LMF and responds in reverse order. An idle UE is woken with Paging.
4G's GMLC / E-SMLC / MME / LPPa correspond to 5G's GMLC / LMF / AMF / NRPPa (LPP continues).

Practice — comprehension check and exercises¶

Comprehension check¶

Q1. Explain the division of roles among GMLC, LMF, and AMF.

GMLC is the front desk for external LCS clients (requester authorization, discovery of the serving AMF of the target UE, privacy check), LMF is the brain that computes positioning (gathering measurements via LPP/NRPPa to calculate the location), and AMF is the hub and mediator of the procedure (bridging GMLC⇔LMF⇔UE/RAN). The three-way division of front desk, computation, and mediation is the key point.

Q2. For which segment is each of LPP and NRPPa the positioning protocol?

LPP (LTE Positioning Protocol) is for UE⇔LMF, and NRPPa (NR Positioning Protocol A) is for NG-RAN⇔LMF. Both are mediated and carried by the AMF, carried via NAS (N1) toward the UE and via N2 (NGAP) toward the RAN.

Q3. Describe the MT-LR flow in order, from the external request to the response.

(A) The external client requests a location from the GMLC over Le → the GMLC authorizes and discovers the serving AMF; (B) the GMLC relays to the AMF (an idle UE is woken with Paging); (C) the AMF asks the LMF for positioning → the LMF gathers measurements from the UE (LPP) / RAN (NRPPa) and calculates the location; (D) the result returns in reverse order LMF → AMF → GMLC → external.

Exercises¶

Draw the sequences of MT-LR (externally initiated) and MO-LR (UE-initiated) side by side, and summarize the difference in originator and request path, contrasting them with the common skeleton (AMF as hub, LMF for positioning, LPP/NRPPa).
Create your own correspondence table between 4G's LCS (GMLC/E-SMLC/MME/LPPa) and 5G's (GMLC/LMF/AMF/NRPPa), and organize what is a rename and what is new.

Next Step¶

Paging — the wake-up procedure that precedes positioning an idle UE.
AMF — the central NF of the positioning procedure. Details of its role.
N2 — the RAN⇔core control path that carries NRPPa.
Rel-17 & Rel-18 — the positioning of the latest extensions such as positioning enhancements and NTN.
Emergency (emergency calls) — a representative use case where location provision becomes important.