To be able to monitor the overall health of the network, authorized users will have to set the thresholds used for generating Performance Alarms (see section 5.6). It is the Operator's responsibility to ensure that threshold values are defined appropriately in order to detect performance degradations before they become service affecting. An alarm threshold may be defined for one or more instances of a managed object class supporting measurements. The threshold will be monitored based on a monitor granularity period, where the monitor granularity period is a multiple of measurements collection granularity period. Following threshold creation, it shall be possible to query the threshold information defined for an object instance. The threshold definition shall allow the user to assign up to four different severity levels (critical, major, minor, warning) based on different threshold values. The threshold direction should also be defined as increasing or decreasing, according to which direction raises the Performance Alarm. More generally, any Performance Management specific parameters of the triggered alarm notification as described in TS 32.111-2 will be specified within the threshold configuration information. All performance measurement types are available for threshold management. When defining thresholds, the user shall be able to select from any of the performance measurement types relevant for the object instance to which the threshold applies. Thresholds are evaluated as performance data become available. For each measurement type, the current value is checked against the defined alarm threshold(s). Depending upon the previous value for this measurement type, a new alarm, a changed alarm or a clear alarm may be raised upon the (a) crossing or (b) reaching of this threshold. The behaviour of performance alarms shall be the same as that of the AlarmIRP ([21]). The threshold value for cumulative counters should be a rate of variation defined in an independent way of the monitor granularity period, e.g. an alarm could be triggered when PDP context activation requests are received at a rate exceeding 20 requests/s. The following figure describes examples of threshold crossing for a Cumulative Counter measurement type in the context the changed alarm is supported:

• At T1, a new alarm notification A1 (minor) is generated when Level 1 is crossed
• At T2, a changed alarm notification A1 (critical) is generated when Level 2 and 3 are crossed
• At T3, a changed alarm notification A1 (minor) is generated when Level 3 and 2 are crossed
• At T4, a cleared alarm notification A1 is generated when Level 1 is crossed

For gauge measurements, the observed value of a gauge at the end of the monitor granularity period is compared to the threshold value. The following figure describes examples of threshold crossing for a Gauge measurement type in the context the changed alarm is supported:

• At T1, a new alarm notification A1 (minor) is generated when Level 1 is crossed
• At T2, a changed alarm notification A1 (major) is generated when Level 2 is crossed
• At T3, a cleared alarm notification A1 is generated when Level 2 and 1 are crossed

In order to avoid repeatedly triggering Performance Alarms around a particular threshold level, an hysteresis mechanism may also be provided by defining threshold levels in pairs (high levels and low levels). In that case, the high level value shall be greater than or equal to the low level value. For each pair of high and low threshold levels, one of them shall generate an alarm notification, and the other shall generate an alarm clear notification. If the direction of the threshold is increasing, a new alarm will not be generated before the measurement value has (a) crossed or (b) reached the high level threshold value. Furthermore, the alarm will not be cleared before the measurement value has reached the low level threshold value. For decreasing thresholds, the opposite is applied. The alarm notification shall always be generated before the alarm clear notification. The hysteresis mechanism can be used for both Gauges and Cumulative Counters thresholds. The following figure describes examples of threshold crossings with hysteresis for a Gauge measurement type in the context the changed alarm is supported:

• At T1, a new alarm notification A1 (e.g. minor) is generated when notifyHigh1 is reached
• At T2, a changed alarm notification A1 (e.g. major) is generated when notifyHigh2 is reached
• At T3, a changed alarm notification A1(e.g. minor) is generated when notifyLow2 is reached
• At T4, a cleared alarm notification A1 is generated when notifyLow1 is reached
• At T5, a new alarm notification A2 is generated when notifyHigh1 is reached

For a threshold crossing with hysteresis example of Cumulative Counter measurement type, the monitored value for the alarms generation would be the derivative of the CC value, i.e. its rate of variation. For DER and SI, the value of the counter will be calculated over the complete monitor granularity period. For SI, the counter will be sampled at regular time intervals and the mean value over the monitor granularity period will be calculated and compared with the threshold. For DER type, the threshold is compared with the mean value of all observations collected during the monitor granularity period. For a DER type, if no observations are made during the monitor granularity period then the DER will have a value of NULL. No valid comparison with a threshold can be made in this case. If an alarm has previously been detected it will remain outstanding. The following figure describes examples of threshold crossings for a DER measurement type in the context the changed alarm is supported:

• At T1, a new alarm notification A1 (minor) is generated when Level 1 is crossed
• At T2, a changed alarm notification A1 (major) is generated when Level 2 is crossed
• At T3, a cleared alarm notification A1 is generated when Level 1 is crossed