Scott Baxter Total

Welcome!
2013 Course Series
511-311-512-513-312
LTE, GSM, GPRS, EDGE, UMTS/WCDMA, HSPA
To download this entire course series:

http://scottbaxter.com/total.pdf
December, 2013 (c)2013 Scott Baxter Slide 1

Course 511
LTE Long Term Evolution

Introduction, Air Interface, Core Network, Operation
To download this course only:

http://scottbaxter.com/511.pdf
December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 2

511 Course Contents
 Introduction to all the Wireless Techologies

 What is LTE?
• LTE’s place in the family of wireless technologies, and current deployment
• LTE features: Speed, Latency, total flexibility
 The LTE Air Interface
• Basic Signal Structure, OFDM, and what is it doing in my LTE?
• Multiple Antenna Techniques (MIMO) –we can have our cake and eat it too!
• Understanding LTE’s speed capabilities
 LTE Core Network Architecture
• The EPC: Evolved Packet Core network
• The RAN: Radio Access Network, with ENodeBs
 LTE-Advanced
• Wider Bandwidth, Carrier Aggregation and Relay Backhaul
 Current Hot Topics in LTE
• Voice-over-IP: LTE voice techniques and legacy fallback
• HETNETS: Heterogeneous Networks

The Wireless Technology Family Tree
ETSI TIA
Pre-
Cellular
IMTS 1961
1G
9600 b/s
Analog 1983
NMT AMPS
1981, 1986 ETSI TIA
Pre-
Cellular
IMTS 1961
1996
14-304 kb/s
EDGE
1xRTT
GPRS 2G CDMA
GSM
1991 1996
1G
9600 b/s
Analog 1983
NMT AMPS
1981, 1986 ETSI TIA
Pre-
Cellular
IMTS 1961
2009 2006
3-7 Mb/s
HSPA
2003 UMTS 3G EV-DO
WCDMA
2002
1996
14-304 kb/s
EDGE
1xRTT
GPRS 2G CDMA
GSM
1991 1996
1G
9600 b/s
Analog 1983
NMT AMPS
1981, 1986 ETSI TIA
Pre-
Cellular
IMTS 1961
LTE LTE
100 Mb/s +
2010 ETSI 4G TIA 2010
2009 2006
3-7 Mb/s
HSPA
2003 UMTS 3G EV-DO
WCDMA
2002
1996
14-304 kb/s
EDGE
1xRTT
GPRS 2G CDMA
GSM
1991 1996
1G
9600 b/s
Analog 1983
NMT AMPS
1981, 1986 ETSI TIA
Pre-
Cellular
IMTS 1961
Largest US Wireless Providers YE 2012
333M total
Bands and Technologies
Subs (M)
MVNOs and
Cellular PCS AWS
800 1900 1700/2100
700 Other Affiliated Companies
109 CDMA EVDO LTE LTE

National
UMTS
103 GSM LTE
HSPA
WiMAX
CDMA
56 LTE-TDD
EVDO
IDEN
GSM
34
HSPA+
CDMA
CDMA
12 EVDO
EVDO
Regional
LTE
CDMA CDMA
11 EVDO EVDO
LTE LTE
CDMA CDMA
8 EVDO EVDO
LTE LTE
December, 2013 Course 511 v3.0 (c)2013 Scott Baxter 511 - 9

The US CDMA Providers
196M total
Subs (M)
MVNOs and
Cellular PCS AWS
800 1900 1700/2100

National
WiMAX
CDMA
56 LTE-TDD
EVDO
IDEN
CDMA
CDMA
12 EVDO
EVDO
Regional
LTE
CDMA CDMA
11 EVDO EVDO
LTE LTE
CDMA CDMA
8 EVDO EVDO
LTE LTE

The US GSM Providers
137M total
Subs (M)
MVNOs and
Cellular PCS AWS
800 1900 1700/2100
National
UMTS
103 GSM LTE
HSPA
GSM
34
HSPA+
Regional
511 - 11 Course 511 v3.0 (c)2013 Scott Baxter December, 2013

Summary of Major Progress
in Wireless Communications
Cellular Frequency Reuse Concept
From No Frequency Reuse
with handoffs
Progress in
Network Configuration
to
and Frequency Reuse
B D
A C
Progress in
Devices

Multiple Access Methods
FDMA FDMA: AMPS & NAMPS

•Each user occupies a private Frequency,
Power protected from interference through physical
separation from other users on the same
frequency
TDMA: IS-136, GSM
•Each user occupies a specific frequency but
TDMA only during an assigned time slot. The
Power frequency is used by other users during
other time slots.
CDMA
CDMA •Each user uses a signal on a particular
frequency at the same time as many other
users, but it can be separated out when
Power receiving because it contains a special code
of its own
Slide 13 Course 511 v3.0 (c)2013 Scott Baxter December, 2013

Highly Advanced Multiple Access Methods
OFDM OFDM, OFDMA
• Orthogonal Frequency Division Multiplexing;
Orthogonal Frequency Division Multiple Access
Power
• The signal consists of many (from dozens to
Frequency
thousands) of thin carriers carrying symbols
• In OFDMA, the symbols are for multiple users
• OFDM provides dense spectral efficiency and robust
resistance to fading, with great flexibility of use
Multiple-Antenna Techniques to Multiply Radio Throughput
MIMO MIMO
• Multiple Input Multiple Output
• An ideal companion to OFDM, MIMO allows
exploitation of multiple antennas at the base station
and the mobile to effectively multiply the throughput
for the base station and users
SMART ANTENNAS
• Beam forming for C/I improvement and
interference reduction
Meet LTE

Why all the Excitement about LTE?
Radio Signal Advantages:
 Tremendously improved signal/air interface
• Faster than any previous mobile
technology (100 Mb/s down, 50 Mb/s up) AIR INTERFACE
• Most flexibility, can use almost any-size
spectrum
• MIMO can multiply speed by 2x or 4x
• Best QOS (quality of service) ever,
guaranteed speed and latency
 Radio Access Network (RAN) Improved RADIO ACCESS NETWORK
• More intelligence than ever before in the RAN
base stations (eNB); fast scheduling
• Easy to use macrocells, microcells,
femtocells in “heterogeneous networks”
• Lower cost per bit than ever before

Network Advantages:
 Simplified, non-proprietary Core Network
• Uses standard TCP/IP protocols and CORE NETWORK
network elements
• Non-proprietary MME (Mobility MOBILITY MANAGEMENT ENTITY
Management Entity) instead of past MME
proprietary RNC (Radio Network
Controllers) handling mobility features
 Handovers provided to/from LTE-HSPA- BETTER
INTERWORKING & HANDOFF
UMTS-GSM-GPRS-EDGE, CDMA, EVDO
 Greatly improved spectral efficiency for
carrying voice when VOLTE is implemented Excellent Capacity for
Voice Calls
 LTE is the preferred migration path for all
previous wireless technologies
Reduced Cost, great
• Wider Acceptance, economies of scale
Economies of Scale
• Lower CAPEX and OPEX, better
national and global roaming
User Advantages:
Always-On
 Always-on, constant data connection
 Extremely high data rates and very low
latency for good quality of service in each Blazingly Fast
type of traffic – voice, video, etc.
 Multiple connections of different apps and
data types can be simultaneous Multitasking
 Dynamic adaptation to RF channel
conditions for best possible results under Dynamic Channel
all situations Adaptation
 Low Cost due to wide acceptance and
deployment with economies of scale Low Cost
 Widespread roaming due to
standardization
Roaming

Capacity of LTE
Bandwidth of LTE Downlink Uplink Speed, # Active Users
Signal (FDD) U or D Speed, MHz. MHz. On one Cell
20 MHz. 100 Mb/s 50 Mb/s > 400
15 MHz. 75 Mb/s 37.5 Mb/s > 400

10 MHz. 50 Mb/s 25 Mb/s > 400
5 MHz. 25 Mb/s 12.5 Mb/s > 200
3.2 MHz. 16 Mb/s 8 Mb/s > 200
3.0 MHz. 15 Mb/s 7.5 Mb/s > 200
1.6 MHz. 7 Mb/s 3.5 Mb/s > 200
1.4 MHz. 6 Mb/s 3 Mb/s > 200
 Speed gains from MIMO (2x or 4x) are additional, not shown
 Values shown are for full cell (sector), for dividing among all users
LTE and LTE Advanced
Characteristic LTE LTE Advanced

DL: 100 Mbps DL: 1 Gbps
Peak Data Rate
UL: 50 Mbps UL: 500 Mbps
C-Plane: <100 ms C-Plane: <50 ms
Latency:
U-Plane: <5 ms usually U-plane: <5 ms always
Multiple Blocks,
Spectral Width One Block, up to 20 MHz
up to 100 MHz. +
DL: ~5 b/s/Hz DL: up to ~30 b/s/hz
Peak Spectral Efficiency
UL: ~2.5 b/s/Hz UL: up to ~15 b/s/Hz
Control-Plane At least 200 active in 5 >300 active in 5 MHz.
User Capacity MHz., 400 in > 5 MHz. without DRX, >600 in 5+
 Many features of LTE-Advanced are already implemented in

current commercial-production network equipment
 Data rate figures above don’t include the speed-increasing
effects of MIMO or Smart Antennas

LTE Systems by Country – December, 2012

Calling Things by their Official Names
UE eNb, eNodeB
4G User Equipment Enhanced Node B
UE
3G User Equipment Node B
Mobile Cell Site, BTS

2G Handset, Terminal Base Station
1G Mobile Cell Site,

Handset, Terminal Base Station
Analog
TIA
Pre-
Cellular Mobile Base Station
Spectrum for LTE

Current Wireless Spectrum in the US
CELL UPLINK
CELL DNLNK
Proposed AWS-2
PCS AWS
AWS?
AWS PCS Down-
SAT
SAT
IDEN
IDEN
700 MHz. Down-
Uplink Uplink Link
Link
700 MHz 800 900 1700 1800 1900 2000 2100 2200
Frequency, MegaHertz
 Modern wireless began in the 800 MHz. range, when the US FCC
reallocated UHF TV channels 70-83 for wireless use and AT&T’s
proposed analog technology “AMPS” was chosen.
 Nextel bought many existing 800 MHz. Enhanced Specialized Mobile
Radio (ESMR) systems and converted to Motorola’s “IDEN” technology
 The FCC allocated 1900 MHz. spectrum for Personal Communications
Services, “PCS”, auctioning the frequencies for over $20 billion
 With the end of Analog TV broadcasting in 2013, the FCC auctioned
former TV channels 52-69 for wireless use, the “700 MHz.” band
 The FCC also auctioned spectrum near 1700 and 2100 MHz. for
Advanced Wireless Services, “AWS”.
 Technically speaking, any technology can operate in any band. The
choice of technology is largely a business decision by system operators.

LTE Band
Classes
 The LTE Band Classes
are listed in the ETSI
document 36.101 in the
table shown at left
 Blocks 1-26 are for FDD,
Frequency-Division-
Duplex use
 Blocks 33-43 are for
TDD Time-Division-
Duplex use
 As new frequencies are
purposed for LTE around
the world, new band
classes will be added
 VZW US: Bandclass 13
 ATT US: Bandclass 17,
soon bandclass 12

The LTE Air Interface

LTE Uses OFDM
Orthogonal Frequency Division Multiplexing
 An LTE signal is made up of many

small ordinary radio signals
(“subcarriers”) standing together
• The “bundle” could be from a few
dozen to over 1000 subcarriers,
whatever your spectrum can hold
• subcarriers are on 15 kHz. steps
 Each subcarrier can carry whatever bits we put on it
 We can send a large amount of data very fast by splitting it up and
sending it in parallel over a large number of subcarriers
 Subcarriers are created and received using Discrete Fourier
Transforms, so they don’t interfere (they’re “orthogonal”)
 1980’s technology would have needed an individual transmitter and
receiver for each subcarrier – mobiles bigger than suitcases with
car batteries strapped on outside – but modern LTE chipsets keep
a user’s equipment (UE) small and compatible with small batteries
LTE: Best Flexibility Using Available Spectrum
FDD
 LTE offers operating modes to fit
almost any available spectrum
f  FDD Frequency Division Duplex
Uplink Downlink
• Fits in paired spectrum with
different uplink and downlink
TDD frequencies
• Continuous uplink and downlink
f  TDD Time Division Duplex
Alternating Uplink/Downlink
• Fits in single blocks of spectrum
• Forward and reverse links take
20 turns on the same spectrum
Available 15  LTE signal width can range from
Bandwidths 10 1.4 to 20 MHz. and more, to fully
5 utilize whatever spectrum is
3 available to your company
1.4 • 1.4, 1.6, 3, 3.2, 5, 10, 15, 20
Dynamic Scheduling of LTE Content
Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.
The width of the LTE signal can be set to fill any authorized frequency block
VOIP VOIP Messaging Email Data Video Video Multimedia

user user user User user user user user
 Uplink and downlink are dynamically scheduled taking into account

user traffic volume, types, and quality-of-service (QoS) objectives
 Data is sent in bursts of 1 millisecond or multiples, on groups or
multiples of 12 subcarriers

Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.



Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.



Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.



Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.



Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.



Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.



Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.



Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.



Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.



Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.



Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.



Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.



Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.



Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.



Uplink Downlink
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.



Above is a “spectragram” showing the output of an LTE base station.
The width of the signal is 10 MHz., from side to side Like the view looking
back from a speedboat, the “waves” of brighter colors are bursts of data
sent to various users . The view goes from “now” back about 1/2 second.

Above is a “spectragram” showing the output of an LTE mobile (UE). The
width of the signal is 10 MHz., from side to side. Like the view looking
back from a speedboat, the “waves” of brighter colors are bursts of data
sent by this mobile. The view goes from “now” back about 1/2 second.

MIMO – It’s like having your cake
And eating it too!

MIMO
 MIMO (Multiple Input, Multiple Output) is a way of getting “double

duty” from radio spectrum
• Two different radio signals can be transmitted at the same time
on the very same frequencies from one place to another, and
separated after reception – getting twice the normal amount of
information over the radio spectrum!
– This requires two transmitting antennas and two receiving
antennas, and receiving circuitry to do some hairy math
• With four transmitting and four receiving antennas, it is even
possible to get almost four times the normal amount of
information per second!
 Although MIMO has been physically possible for several years,
LTE is the first technology to actually use it on a large scale
 Most LTE systems today have two-branch MIMO; four-branch will
begin widespread deployment in another two years or so

SISO, MISO, SIMO, MIMO for LTE
 Single-Input Single-Output was the

default mode for radio links until the
late 1960’s, and the baseline for
further comparisons.
 Multiple-Input Single Output provides
transmit diversity (much like
CDMA2000 OTD). It reduces the total
transmit power required, but does not
increase data rate.
 Single-Input Multiple Output is “receive
diversity”. It reduces the needed SNR
but does not increase data rate. By
coincidence, it’s also the last name of
Dr. Ernest Simo, noted CDMA expert.
 Multiple-Input Multiple Output is highly
effective, using the differences in path
characteristics to carry twice or four
times as much data per second
without any increase in occupied
spectrum
March, 2010 Course 511 v3.0 (c)2013 Scott Baxter Slide 49
SU-MIMO, MU-MIMO, Co-MIMO in LTE
 Single-User MIMO gives a

single user twice or 4x data
speed by having multiple
essentially independent
paths for data
 Multi-User MIMO allows
multiple users on the
reverse link to transmit
simultaneously to the eNB,
increasing system capacity
 Cooperative MIMO allows a
user to receive its signal
from multiple eNBs in
combination, increasing
reliability and throughput
The LTE Core Network

Basic Elements of an
LTE Core Network
LTE Standalone
Policy and Charging Rules Function
PCRF
Home Subscriber Server

“Super HLR”
Mobility Management Entity, HSS

User Plane Entity
Internet
Evolved MME SGW PDN
Serving
RAN: eNB UPE Gateway GW
LTE radio Inter Access System Anchor IASA
Networks
Uu Evolved Packet Core
The PDN Gateway is also sometimes called

the “System Architecture Evolution” Anchor

Functions of the Core Network Elements
• NAS signaling
• Mobility between 3GPP Ans • UE IP Address allocation
• Idle mode UE connectivity • Mobility Anchor • Packet
PolicyScreening & Rules Function
and Charging
• P-GW and S-GW selection • Packet Routing Filtering
• SGSN selection at HO • Idle Mode packet buffering PCRF
• Policy Enforcement
• Authentication & DL initiation • $Charging Support
• Bearer Establishment • Legal Interception • Legal Interception

“Super HLR”
Mobility Management Entity HSS

User Plane Entity
Internet
Evolved MME SGW PDN
Serving
Networks

Adding CDMA and EVDO Networks
to an LTE Core Network
LTE Standalone
PCRF

“Super HLR”

User Plane Entity
Internet
Evolved MME SGW PDN
Serving
Networks
1xRTT, CDMA2000, Non-3GPP

EV-DO networks
IP access

Adding GSM/GPRS/EDGE and UMTS/WCDMA/HSPA
Networks to an LTE Core Network
Legacy GSM radio Networks LTE, GSM/GPRS/EDGE,
UMTS/WCDMA/HSPA
GERAN Policy and Charging Rules Function
SGSN GPRS CORE PCRF

UTRAN
WCDMA /HSPA radio Networks “Super HLR”

User Plane Entity
Internet
Evolved MME SGW PDN
Serving
Networks

An LTE Core Network connected to
GSM/HSPA, CDMA/EVDO, and LAN Networks
Legacy GSM radio Networks
LTE, GSM/GPRS/EDGE,
UMTS/WCDMA/HSPA, CDMA/EVDO
GERAN Gb
SGSN GPRS CORE PCRF

UTRAN Iu S7 Rx+
S3 S4
S5b
S5a
Ref Pt.
Mobility Management Entity S6a HSS
User Plane Entity
S1 SGi Internet
Evolved MME SGW PDN
Serving
RAN: eNB Ref Pt. UPE Gateway GW
Networks

S2a S2b,c
1xRTT, CDMA2000, Non-3GPP WLAN 3GPP
EV-DO networks
IP access IP access

Tunnels, Connections and Bearers
 When a UE sends and receives data, it needs data pathways

through the network to and from the internet.
 These pathways are called “bearers”
• A separate bearer is set up to handle each different type of
data that a UE may be using at any moment – HTTP, video,
email, voice, etc.
• Each bearer has its own target speed and latency
specifications for appropriate quality of service (QoS)
• Each bearer may handle one or more streams of traffic of its
specified type, called service data flows (SDFs)

Examples of Bearers through the Network
 In LTE, data plane traffic travels in streams of bits called service

data flows (SDFs).
 SDFs travel over bearers: Virtual containers with specified target
QoS characteristics.
 A bearer is a datapath between UE and PDN, in three segments:
• Radio bearer between UE and eNodeB
• Data bearer between eNodeB and SGW (S1 bearer)
• Data bearer between SGW and PGW (S5 bearer)
LTE Network Manufacturers
 Ericsson has the most LTE deployments.TeliaSonera in
Norway, Sweden and Finland; Verizon Wireless and
MetroPCS in the United States; Vodafone in Germany and
EMT in Estonia.
 Nokia Siemens Networks (NSN) has numerous
deployments, including TeliaSonera, Tele2 Sweden and
Elisa in Finland and the core for NTT DoCoMo's Japan
LTE rollout.
 Huawei has networks on-air in Poland and Germany and
Uzbekistan, and a few in the US despite political concerns
 Alcatel-Lucent has Verizon Wireless, Cricket, and 58 trials
worldwide including Russia’s Vimpelcom, Chunghwa in
Taiwan; MTS in Ukraine, Orange, Vodafone and Bouygues
in Europe and Singapore Telecom in Singapore.
 ZTE powers CSL LTE network in Hong Kong and
Uzbekistan.
 In the United States, Ericsson and Alcatel-Lucent are the
leaders, with contracts with Verizon Wireless and AT&T
Mobility.

Equipment Gallery:
Lucent “Piggyback” eNodeB

Equipment Gallery:
Lucent External RF Head

Equipment Gallery:
Ericsson Core Components (1)

Equipment Gallery:

Equipment Gallery:

Equipment Gallery:
Ericsson Indoor eNB beside Lucent CDMA BTS

Equipment Gallery:
Ericsson eNB 3-Sector Cabling and Close-Up

Equipment Gallery:
Nokia Siemens Networks Flexi-MultiRadio
 The strong point of the Nokia-Siemens radio access networks is

the Flexi MultiRadio, available in LTE and every other current
technology except CDMA2000.

LTE Security

LTE Security Objectives
 LTE security is extremely important. LTE must provide acceptable

levels of security without adversely impacting the user experience.
 Users must operate freely and without fear of attack from hackers
and the network must also be secure against a variety of attacks.
 LTE security basics: Requirements for LTE security
• provide at least same level of security as in 3G services.
• LTE security measures must not affect user convenience.
• provide defense from attacks from the Internet.
• LTE security functions should not impede the transition from
existing 3G services to LTE.
• The USIM currently used for 3G services should still be used.

The LTE USIM
 The Subscriber Identity Module

(SIM) is one of the key security
elements of GSM, UMTS and
now LTE. This card holds identity
of the subscriber in an encrypted
form within the phone or device.
 In transition from 2G/GSM to
3G/UMTS, the SIM concept was
upgraded and the USIM/UMTS
Subscriber Identity Module is
used for UMTS and LTE. It has
more functionality, larger
memory, etc. than the GSM SIM
 For LTE, only the USIM may be
used - older GSM SIM cards are
not compatible and cannot be
used.

Voice over LTE

80% of Wireless Revenue Still Comes
from Circuit-Switched Voice Traffic
 Although most wireless operators are rushing to

implement LTE for high speed data in their networks,
the majority of wireless revenue today still comes from
traditional voice traffic
 The legacy technologies CDMA and GSM are not as
spectrum-efficient as LTE. Therefore the long-term goal
is to migrate all voice traffic from the old 2G circuit-
switched networks onto the LTE network
 The industry has had divided opinions regarding the
best method for delivering Voice of IP over LTE
 Over the past year it has become apparent that the
industry will converge on use of a voice-over-LTE
technology called “VOLTE”

Options for Voice over LTE
 There are several options for delivering Voice over LTE:

• CSFB, Circuit Switched Fall Back: automatically falling back
the old 2G or 3G system when an LTE UE initiates a call. This
spec also allows SMS to be carried over an interface known as
SGS, so messages can be sent over an LTE channel.
• SV-LTE - simultaneous voice LTE: SV-LTE can run packet
switched LTE services simultaneously with circuit switched
voice service. However, it requires two radios to run at the
same time within the handset, with serious battery drain
• VoLGA, Voice over LTE via GAN: The VoLGA standard is
based on existing 3GPP Generic Access Network (GAN)
standards, aiming to deliver consistent user services while the
network transitions to LTE (low-risk, popular with operators)
• One Voice / later called Voice over LTE, VoLTE: Provides
voice over the LTE system using IMS as part of a rich media
solution which can handle multimedia as well

Continuing Work on Voice Over LTE
 Work to define Voice over LTE (VoLTE) is ongoing, including the

following elements:
• ensuring continuity of Voice calls as a user moves from an LTE
coverage area to an area where a fallback to another
technology is required. This form of handover will be achieved
using Single Radio Voice Call Continuity, or SR-VCC).
• Providing optimal routing of bearers for voice calls when
customers are roaming.
• establishing commercial frameworks for roaming and
interconnect for services implemented using VoLTE definitions,
necessary to set up roaming agreements
• Providing capabilities for roaming hubbing
• Providing security and fraud threat measures to prevent
hacking and unauthorized network penetration

IMS
IP Multimedia Subsystem

IMS Basics
 IMS, the IP multimedia subsystem is an architecture, not a technology

• It uses Internet standards to deliver services on new networks.
• It uses Session Initiation Protocol (SIP) for establishing, managing and
terminating sessions on IP networks.
 The overall IMS architecture uses several components to enable multimedia
sessions between two or more end devices.
• One element is a presence server to handle user status
– a key element in Push to talk over Cellular (PoC) where the presence, or
user status is key to enabling one user to be able to talk to another.
 Users often need multiple concurrent sessions for different applications
• IMS provides a common IP interface for simplified signaling, traffic, and
application development
• In addition, under IMS architecture subscribers can connect to a network using
multiple mobile and fixed devices and technologies. With new applications
such as Push to talk over Cellular (PoC), gaming, video and more, seamless
integration is necessary for users to get the full benefits.
 IMS has advantages for operators too. In addition to maximum services for
maximum revenues, functions like billing, and "access approval" can be unified
across network applications, greatly simplifying deployment and management

IMS Architecture Functional View
Elements of overall IMS architecture: CSCF =
 Server CSCF (Call Session Control Function): Call Session Clontrol Function
session control for endpoint devices; maintains state
 Proxy CSCF: entry point to IMS for the UE; forwards
SIP messages to user's home S-CSCF; controls inter-
working security; QoS mgt.
 Interrogating CSCF: a session control for endpoint
devices.
 Home Subscriber Server, HSS: provides subscriber
database for the home network.
 Breakout gateway control function, BGCF: selects the
network in which a PSTN breakout is to occur. If on in
the same network as the BGCF, also selects a media
gateway control function, MGCF
 Media gateway control function, MGCF: interworks
the SIP signalling. manages sessions across multiple
media gateways
 Media server function control, MSCF: manages the
use of resources on media servers.
 SIP applications server, SIP-AS: execution platform
to deploy more services

LTE Advanced

LTE Advanced
 The main goal in LTE–Advanced (LTE R-10) is to achieve higher

data speeds in a cost efficient way, at the same time completely
fulfilling the requirements set by ITU for IMT Advanced, true “4G”.
 In LTE-Advanced focus is on higher capacity:
• increased peak data rate, DL 3 Gbps, UL 1.5 Gbps
• higher spectral efficiency, from a maximum of 16bps/Hz in R8
to 30 bps/Hz in R10
• increased number of simultaneously active subscribers
• improved performance at cell edges, e.g. for DL 2x2 MIMO at
least 2.40 bps/Hz/cell.
 The main new functionalities introduced in LTE-Advanced are
• Carrier Aggregation (CA),
• enhanced use of multi-antenna techniques (smart antennas)
• support for Relay Nodes (RN).

What’s a Heterogeneous Network?
 A heterogeneous network is a non-uniform, seemingly disjointed combination of

macro and micro/pico/femtocells, delivering coverage where it is needed most in
both outdoor and indoor environments
• Macrocells still cover large areas, from many city blocks to whole counties
• Distributed antenna systems (“DAS”) serve large public venues (malls, airports,
arenas, road tunnels, subways, etc. where traditional cells aren’t effective
• Non-traditional small cells are used to deliver coverage to individual homes,
businesses and any small but important problem areas
• Non-traditional backhaul is used (in-band relay, home broadband, etc)
 Solutions to traffic or coverage problems can be achieved much more quickly using
non-traditional methods

Smart Antennas in LTE eNodeBs
 “Smart” antennas are now

available for LTE eNodeBs
• Multiple steerable “beams”
 A smart antenna can send multiple focused beams across
different parts of the cell or sector, giving a special “boost” to
one or more mobiles with coverage or interference problems
• This can increase overall capacity and quality
LTE Advanced (2)
Carrier Aggregation
 The simplest way to increase capacity
is to add more bandwidth.
 To keep backward compatibility with R8
and R9 mobiles the increase in
bandwidth in LTE-Advanced is
provided through aggregation of R8/R9
carriers. Carrier aggregation can be
used for both FDD and TDD.
 Each aggregated carrier is referred to
as a “component carrier”.
 A component carrier can have a
bandwidth of 1.4, 3, 5, 10, 15 or 20
MHz. Up to five component carriers can  The maximum aggregate
be aggregated. bandwidth is 100 MHz.
 R10 UEs can use DL and UL on up to  The number of aggregated
five Component Carriers (CC). R8/R9 carriers can be different in DL
UEs can use any ONE of the and UL, but UL is never larger
component carriers. The Component than DL. The individual
Carriers can have different bandwidths. component carriers can have
different bandwidths.
LTE Advanced (3)
Continuous and Non-Continuous Aggregation
 Contiguous component carriers in the same operating frequency band are called
“intra-band contiguous”. Available licensed spectrum doesn’t always provide this.
 Non-contiguous allocation can be intra-band, i.e. the component carriers belong to
the same operating frequency band, but are separated by a gap
 Non-contiguous allocation can be inter-band, in which case the component carriers
belong to different operating frequency bands
 Each component carrier is present on certain cells. Not all cells have all carriers.
The coverage of serving cells may differ due to different frequencies and powers
 RRC connection is handled by one cell, the Primary serving cell, using the Primary
component carrier (DL and UL PCC). The other component carriers are called
Secondary component carriers (DL and UL SCC).

Differing Coverage of Different Carriers
 Different component carriers may have different coverage

• Different frequencies have different path losses, so inter-band
aggregated carriers will have different coverage distances
 In the example above, carrier aggregation on all three component
carriers can only be used by the black UE. The white UE is not
within the coverage area of the red component carrier. Note that
for UEs using the same set of CCs, they can have different PCC.
Course 311
General Introduction to GSM,

GPRS/EDGE, and UMTS/WCDMA/HSPA


311 Course Contents
 Introduction
• Wireless Standards and Standards Organizations
 GSM: The “Mother” of 2G Wireless Technologies
• The Air Interface: GSM’s TDMA signal
• GSM Network Architecture: Elements and their functions
• Subscriber Equipment
• The SIM card and its special features
 Data over the 2G GSM Signal? GPRS and EDGE
• Air Interface: a Hotel with two types of guests; the check-in process
• The network: parallel circuit-switched voice and packet data branches
 True 3G: UMTS – WCDMA
• a new Air Interface using CDMA technology
• UMTS Core Network and its elements
 Almost 4G: HSPA
• Air Interface and the shape of the network
• HSPA+: getting close to 4G speeds

Introduction

The Role of Standards Organizations
 Our modern wireless technologies have been created by many

companies and wireless groups working together under the
leadership of standards organizations
 In the United States, we have a history of individual companies
developing products which have become so widely used that they
are regarded as “de facto” standards in their industries
• For example, Motorola, E. F. Johnson, and others developed
individual standards for two-way “trunked radio” systems used
by businesses and law enforcement
• De facto standards usually involve intellectual property and
patents of their developers. Hefty licensing fees often are
charged to other companies to wanting use them
• The European way to manage standards is to use standards
organizations to “sponsor” specific standards, and to persuade
developing companies to allow use of their proprietary
techniques at reasonable prices to allow competition, multi-
sourcing, and wide adoption
Wireless Families and Standards Organizations
 The ITU (International Telecommunications Union) is the “mother”

umbrella organization for telecommunications standards around the world
• Standardizes radio spectrum assignments around the world, providing
a forum for negotiation between industries and governments
 The ETSI (European Telecommunications Standards Institute) is the
official sponsor of GSM, GPRS, EDGE, UMTS, and HSPA, and a
competitor to CDMA, EVDO, and WiMAX
 ANSI (American National Standards Association) issues voluntary
consensus standards for a wide range of products, from photographic film
speeds to manufacturing processes, alternative fuels, and even WiMAX,
aiming for American products to be usable around the world
 The TIA (Telecommunications Industry Association) is a technical forum
producing standards for North American telecommunications
• It issues wireline and wireless telephone standards, including AMPS,
CDMA, EVDO, WiMAX,
 The EIA (Electronics Industry Association) represents electronics
manufacturers primarily in North America


frequency
TDMA: IS-136, GSM
other time slots.
CDMA
of its own

GSM: The “Mother” of
2G Wireless Technologies

The Birth of GSM
 In 1983, The US had just implemented its analog cellular systems,

using the AMPS technology – Advanced Mobile Phone Service
• Developed by AT&T Bell Labs, with Motorola contributions
 Europe preferred to leapfrog to a digital technology, standardized
so it could be implemented internationally on a wide scale
 The ETSI Group Special Mobile (GSM) developed the standard,
which bears its initials, in 1982
• Today marketed as “Global System for Mobile communication”
 GSM was field-tested in 1986, a “memorandum of understanding”
was signed in 1988, and GSM commercially launched in 1991
• By 1995 GSM coverage of most of Europe was complete
 Today there are more than 5 billion GSM users in 212 countries
worldwide, about 80% of the global mobile market.

Standards for just Radio,
or the whole Network?
 The American cellular technologies AMPS (TIA-EIA 553), US

TDMA (IS-136) and CDMA (IS-95) all began as radio standards,
specifying the radio signal details without much reference to the
elements of an overall network
• A separate standard, IS-41, was needed to define how
networks handle intersystem handoff and roaming call delivery
 By contrast, the ETSI standards for GSM, GPRS and EDGE
provide extensive specifications not only for the radio signal but
also for the major functional blocks of the network and the network
functioning as a whole
• This allows much better interworking between networks of
different operators, and even some limited opportunities to
blend equipment from different manufacturers into the same
network, for cost savings and easier expansion

Basic GSM Network – Voice Only
NSS BSS
HLR BSC
MSC BTS
PSTN MS
TRC
OMC-S OMC-R
 MS – mobile station OSS
 BSS – base station subsystem
• BTS – base transceiver station, BSC – base station controller
 NSS – network subsystem
• MSC – Mobile Switching Center
 PSTN – public switched telephone network
 OSS – Operations Subsystem
• OMC-R – Operation and Maintenance Center – Radio
• OMC-S – Operation and Maintenance Center – System
December, 2013 Course 311 v3.0 (c)2013 Scott Baxter 94
Compare with
A CDMA Network – Voice Only
HLR BSC
MSC BTS
PSTN MS
V
 The elements in a CDMA voice-only network map almost exactly to

their counterparts in a GSM voice-only network.
 Americans are just a little less formal about the overall architecture of
things, allowing each network manufacturer to implement the
connections between elements and the overall network organization as
they think best
• However, this tolerance of proprietary interfaces means network
elements of different manufacturers are not directly interchangeable
and interoperable, reducing competition and operator flexibility
GSM On Radio: Time Division Multiple Access:
GSM Uplink and Downlink Frequencies and Timing
Uplink Downlink
Mobile Transmit Base Station Transmit
D
B H
G
E D
C
F B H
A
G
BCCH C E
A F A – voice user
Frequency
3 slots B – voice user
C – voice user
Frequency D – voice user
E – voice user
F – voice user
G – voice user
H – voice user
Data over the 2G GSM Signal?
GPRS and EDGE

GSM “Add-ons”: GPRS and EDGE
 GSM was designed for voice calls only, but interest in mobile data
grew and eventually a data service, HSCSD “High Speed Circuit
Switched Data” was implemented at 32 kb/s using the GSM signal.
 There was demand for higher speeds than HSCSD, so the
General Packet Radio Service (GPRS) was developed in 1998
• GPRS uses timeslots in the GSM signal for packet data and
delivers typical data speeds of around 40 kb/s
 There was demand for even higher speeds than GPRS, so
Enhanced Data rates for GSM Evolution (EDGE) came in 1999
• EDGE uses timeslots in the GSM signal like GPRS, with more
advanced modulation (8PSK) for typical speeds up to 200 kb/s
 Today virtually every GSM phone or device sold, and all worldwide
GSM networks, have both GPRS and EDGE capability
• GPRS and EDGE users are normally billed for volume of data,
and prices are substantially higher than for later technologies
 A GSM base stations is called a BTS (Base Transceiver Station)

A GSM/GPRS Network – Voice and Data
Internet NSS
VPNs
BSS
GGSN SGSN BSC
HLR
MSC BTS
PSTN MS
TRC
OMC-S OMC-R
OSS
 Adding GPRS packet services to a GSM network requires two new
network elements, the GGSN and the SGSN
 GGSN Gateway GPRS Support Node
• Hosts IP addresses, routes data packets into and out of the radio
network; acts as a router for packets within the network
 SGSN Serving GPRS Support Node
• Maintains packet delivery connection with mobiles in its area
 Data is “tunneled” from the GGSN to the SGSN using GTP, GPRS
Tunneling Protocol, carrying packets between mobile and GGSN
 PCU Packet Controller Unit manages RF timeslots for packets

Compare with
A CDMA/1xRTT Network – Voice and Data
Internet
VPNs
AAA
PDSN PDSN BSC
Home Agent Foreign Agent
HLR BTS
MSC MS
PSTN
V
 The network elements of GSM/GPRS/EDGE networks have direct

counterparts in CDMA/1xRTT networks
 The GGSN performs the same function as a 1xRTT PDSN Home Agent
• It is the “anchor” point for a range of internet IP addresses
 The SGSN performs the same function as a 1xRTT PDSN Foreign Agent
• It routes packets to and from the GGSN to actual users no matter
where they are in the network
 The HLR function in CDMA networks applies only to voice calls. A
separate function “AAA” serves as the data “HLR”.
 The MSC and BSC administrative functions are handled by separate
terminals, like the OMC-S and OMC-R, but with proprietary mfr’s. names
How does a User get their packets anywhere?
Through Tunnels between the SGSN and GGSN
Just like SGSN GGSN
Home! 158766 158774 158782
GRAND 158767 158775 158783
HOTEL 158768 158776 158784
158769 158785
Encapsulation 158770 158778 158786 Internet

158771 158779 158787
158772 158780 158788
158773 158781 158789

FedEx
FedEx
Secure Tunneling
Forward and Reverse IP Address
Mobile Assigned
User To User
The GPRS-EDGE (and even UMTS/HSPA) packet network relies on

secure tunneling of forwarded packets in both directions between a
User, the SGSN, and the GGSN which actually “owns” the internet IP
address assigned to the User at that moment.

GSM and GPRS Radio Operations Together
A Mix of Voice and Data Users on Different Timeslots
Uplink Downlink
D
B H
G
E D
C
F B H
A
G
BCCH C E
Frequency
C – data user
E – voice user
F – data user
G – data user
H – voice user
GSM/GPRS Terminology:
Cells and Sectors
 Some terms have different

meanings when used in GSM
Sector or North American practice! Cell
α α
CELL Cell BTS Cell

Sector Sector
γ β γ β
It’s a Sector! It’s a Cell!
Sector Sector Cell Cell

γ β γ β
That was a Handoff! That was a Handover!

The frequencies used The frequencies used
by each sector are by each cell are
its channel set. its allocation.

True 3G:
UMTS - WCDMA
Higher Speeds: UMTS / WCDMA
 Even the best speeds of EDGE are still far below the data speeds
of DSL and Cable Modems for users in homes and businesses
 The ETSI combined the GSM, GPRS, and EDGE standards and
added a new wideband technology for even higher data rates
 The new overall family is called UMTS (Universal Mobile
Telecommunications Services) and that is the name normally used
for the new technology, based on wideband CDMA (WCDMA)
• It’s different, and not directly compatible with US CDMA
• The UMTS/WCDMA signal can carry up to roughly 200 voice
calls as well as data bursts up to as much as 2 Mb/s overall
• One UMTS signal occupies about 3.84 MHz. of radio spectrum,
and can fit within a licensed spectrum block 5 MHz. wide
– This is about 3-times wider than a US CDMA signal
 A UMTS base station is called a “Node B”
The UMTS / WCDMA Radio Signal
At left, four UMTS/WCDMA carriers
stand side by side in 20 MHz. of
spectrum. Each of the carriers can
handle in excess of 200 voice calls as
well as numerous data connections
with peak rates up to 1 Mb/s each.
As we’ll see in the next section, one
or more of the carriers can also
handle HSPA fast data too.
 The UMTS signal uses wideband CDMA

• RF bandwidth is 3.84 MHz., 3x wider than US CDMA signals
• UMTS uses up to 256 codes, same as US CDMA Walsh codes
but called “OVSF” Orthogonal Variable Spreading Factor
• UMTS establishes timeslots for use of the OVSF codes,
creating “TDMA in a WCDMA shell” for operational flexibility
• Up to two 1 Mb/s data channels can exist at any instant
• Instead of a PN “short code” with timing offsets to distinguish
sectors, UMTS uses 512 different Gold Codes as carriers
A UMTS Network
Internet NSS BSS
VPNs
RNC
GGSN SGSN
HLR
MSC
PSTN UE
Node B
OMC-S OMC-R
OSS BTS
 The core voice and packet network in UMTS is the same as in

GSM/GPRS, but the BSS Base Station Subsystem is changed a lot
 Radio Resource Control for packet and voice and the packet control
function uses a new element, the RNC Radio Network Controller
 Each base station is now called a “Node B”
 A customer mobile is now called a UE, User Equipment
 The required SIM card is special, including UMTS features

Compare with
An EV-DO Network
Internet
VPNs
RNC
AAA
PDSN PDSN
HLR
PSTN MSC BTS UE
 The network elements of UMTS networks have direct counterparts in

CDMA/EV-DO networks
separate function “AAA” serves as the data “HLR” for EV-DO.
Almost 4G: HSPA, HSPA+
Even Higher Speeds – HSPA and HSPA+
 As UMTS was born, Qualcomm and American operators had

applied the newest principles to its CDMA technology, producing a
hybrid variation called EVDO (Evolved, Data Optimized).
• Adding higher order modulation to the basic CDMA signal,
EVDO offered data speeds of up to 3.1 Mb/s downlink, 1.8
Mb/s up on a single CDMA-like signal just 1.2 MHz. wide
 The ETSI community wasted no time doing the same to its UMTS
/WCDMA signal, achieving speeds of up to 7 Mb/s downlink, 3.5
Mb/s uplink on a single UMTS-like signal just 3.8 MHz. wide
• This signal was called HSPA, High Speed Packet Access
• Downlink and uplink versions were called HSDPA and HSUPA
 If multiple HSPA signals are harnessed together for even greater
speed, this is called HSPA+
• The most advanced HSPA+ multicarrier arrangements offer up
to 44 Mb/s downlink, 22 Mb/s uplink
 AT&T and T-Mobile have advertised HSPA+ as a “4G technology”
Calling Things by their Official Names
4G UE eNb, eNodeB
LTE User Equipment Enhanced Node B
3G UE
Node B
UMTS User Equipment
HSPA
2G Mobile Cell Site, BTS

GSM Handset, Terminal Base Station
GPRS/EDGE

Analog
TIA
Pre-
Traditional Network Architecture
 Traditional wireless systems were composed mainly of macrocells

• The network structure was homogeneous, composed of many
similar cells in a uniform fabric
• Cells covered large areas of a city or rural area
• Cells used relatively large transmit power and antenna heights
• Cells used conventional backhaul technologies
• Network growth was managed at a high level, with substantial
cost and effort levels involved in adding new or expanded cells
 Construction and Expansion of classical homogeneous networks
faces increasing obstacles
• Addition of new cells is expensive and slow
• major regulatory obstacles and public opposition are often
encountered
• Traffic bottlenecks are difficult to relieve
Additional Wireless Developments
 Along with improvements in signal capacity and data speeds,
wireless operators are also using advanced techniques to improve
the scope and reach of wireless delivery to new places and users
 DAS Distributed Antenna Systems can extend coverage in malls,
sports and entertainment venues, tunnels, and any place where
large numbers of users gather but have poor or no coverage
• A private DAS amplifies the signal of just one operator or group
• A neutral-host DAS amplifies the signal of many wireless
operators, who share the cost.
 Micro-, Pico- and Femto-cells and Home eNodeBs can extend
coverage into homes, businesses and small venues
• Normally sold in operator’s retail stores, their prices are
subsidized to get higher customer uptake
• They require customer-provided DSL or cable broadband
access to connect with the wireless operators’ core networks
 A network with a diverse mix of macro-BTS and micro/pico/
femtocells is called a Heterogeneous Network (‘HetNet’)
Typical Large-Venue Neutral-Host DAS
What’s a Heterogeneous Network (HetNet)?

macro and micro/pico/femtocells, delivering RF where it is needed most in both
outdoor and indoor environments
• Macrocells continue to deliver widespread public coverage
• Distributed antenna systems (“DAS”) serve large public venues where
traditional cells aren’t effective
businesses and problem areas
Heterogeneous Network Details
and Critical Design Questions
 Multi-Band Deployment
• Overlay-Underlay, or Segmented?
– non-traditional spectrum strategies
• Transition triggers and methods
• Micro-Pico-Femtocell on Customer Premises
• Backhaul availability and economics
• Pricing – operator vs. customer contribution, business plan
• Special factors: S1 vs X2? Doppler and other exotic triggers?
• WiFi access by UE
• WiFi networks: operator provided, business-hosted, user
premises?
The Final (for now) Frontier:
LTE
Where do we go from here?
 The whole telecommunications world is converging on the next

ETSI standard, LTE Long Term Evolution. LTE offers
• Higher data speeds and lower packet latency than any
previous radio technology
• A streamlined packet core network
• A non-proprietary method for providing mobility and roaming
• A better user experience through Quality of Service (QOS)
• Lower costs through widespread use and economies of scale
• A vehicle for handling voice calls with much greater spectral
efficiency, offloading most voice traffic from 2G/3G networks
within five years
 LTE is described in companion course 511
 What comes after LTE?
• More advanced signal, smaller cells, higher speeds
• Call it “5G” for now and look for it in 10 years!
Course 512
LTE Long Term Evolution

Introduction, Air Interface, Core Network, Operation

http://scottbaxter.com/total.pdf
512 Course Contents
 Introduction to LTE
• LTE’s place in the family of wireless technologies
• LTE Features, Advantages, Comparison to prior wireless technologies
 The LTE Air Interface
• Basic signal structure, OFDM details, Downlink and Uplink structure
• MIMO, Scheduling, Link Adaptation, Multicast MGSFN, MCH
 LTE Core Network Architecture
• SAE: The Evolved Packet Core Network Architecture
• Network Functional Elements and Standard Interfaces
• The Protocol Stack/Layers: Physical, MAC, RLC, PDCP, RRC, NAS
 LTE Advanced
• Carrier Aggregation, Multi-antenna solutions, relay technology
 Current Hot Topics in LTE
• Voice-over-IP: LTE voice techniques and legacy fallback
• HetNets, Home eNBs, advanced integration
Introduction to LTE
Wireless Generations and Sector Data Speeds
EARLY ANALOG MTS, IMTS AutoTel
 In the days before analog cellular, various wide-area mobile

telecommunications systems were used
• They covered wide areas with only a few channels available
• Voice calls only - the internet didn't even exist
1G AMPS: Analog Cellular NMT450, NMT900 LMR, SMR
 1G: When the first cellular systems launched, even though data
wasn't offered by the carriers, a few hardy users provided their own
(MNP10) modems for haphazard, slow data via dialup access
• The internet wasn't a big factor yet!
2G CDMA IS-95, J-Std 008 TDMA: NADC, IS-136 TDMA: GSM, HSCSD TDMA: IDEN
 2G provided digital data but at low bit rates -- 9600 - 32k bps
• Downloading a 2MB file took an hour or more (if it didn't drop in
the middle and require manually re-starting)
• Travel agents with telephones were still faster than online res.
153˅ 200+˅
153˄ 200+˄
2.5 G CDMA-2000, 1xRTT GPRS, EDGE
 When 1xRTT, GPRS, and EDGE became available, suddenly it

was possible to do direct IP web access at speeds of 150 kbps or
higher. This was better than dial-up speeds, especially on a hotel
switchboards. Nerds and even some normal people on the road
were finally free to stay connected on-line
3.1M˅
1.8M˄ 7M+˅
153˅ 200+˅
3M+˄
153˄ 200+˄
3G 1xEV-DO UMTS WCDMA HSPA
 When the true 3G services 1xEV-DO and WCDMA/UMTS/HSPA

became available, wireless speeds were boosted into the Mb/s
range for downloading and approaching 1 Mb/s for uploading
 Now mobile users had almost normal internet access, although
many networks had heavy congestion in dense usage areas
100M˅ 100M˅
50M˄ 50M˄
44M˅
22M˄
HSPA+
3.1M˅
1.8M˄ 7M+˅
153˅ 200+˅
3M+˄
153˄ 200+˄
4G WiMAX LTE
 The first WiMAX and LTE networks brought user speeds of up to

12 Mb/s and even 3G HSPA was enhanced to HSPA+, providing
nearly transparent internet usage for the first time.
 4G Network buildouts were slow, with some carriers still building
only trial networks even in late 2011
1000M˅
100M˅ 100M˅ 500M˄
50M˄ 50M˄
44M˅
22M˄
HSPA+
3.1M˅
1.8M˄ 7M+˅
153˅ 200+˅
3M+˄
153˄ 200+˄
4G WiMAX LTE LTE adv.
 Within 2 years of initial LTE buildouts,

• Widespread use of MIMO is expected to boost speed 3-4x
• LTE-Advanced technology is expected to boost speeds to 500-
1000 Mb/s for stationary downlink users
1000M˅
100M˅ 100M˅ 500M˄
50M˄ 50M˄
44M˅
22M˄
HSPA+
3.1M˅
VOIP?
7M+˅
VOIP
VOIP
1.8M˄
153˅ 200+˅
3M+˄
153˄ 200+˄
 Finally the industry will settle on one or two VOIP standards for
LTE, voice traffic of legacy CDMA and GSM will finally go to LTE
 Nearly all WiMax networks will finally convert to LTE
 CDMA and LTE voice networks won't die until 2017 or even later!
1000M˅
100M˅ 100M˅ 500M˄
50M˄ 50M˄
44M˅
22M˄
HSPA+
3.1M˅
VOIP?
7M+˅
VOIP
VOIP
1.8M˄
153˅ 200+˅
3M+˄
153˄ 200+˄
 1G: Users provided their own modems for haphazard, slow data
 2G provided digital data but at low bit rates -- 9600 - 32k bps
 3G data users finally passed 1 Mb/s in EV-DO and HSPA
 4G users finally get10 Mb/s+
LTE Design Objectives
 LTE was intended to be a major leap forward in performance compared to

the 3G technologies HSPA and EV-DO
 LTE objectives as expressed in the early document TR25.913:
• Gross data rate100 Mb/s in 20 MHz. for downlink, 50 Mb/s in 20 MHz.
for uplink, where separate uplink and downlink frequencies are used,
not taking into account multiplying effects available using MIMO
• Control Plane (“setup”) Latency: camped to active <100 ms., dormant
to active <50 ms.
• User Plane (“data”) Latency: 5 ms 1-way on unloaded network
• # Active Users: >200 in 5 MHz., >400 in wider than 5 MHz. block
• Distance: Full performance to 5 km, good to 30 km, up 100 km. is not
specified but to be substantially better than 3G technologies
• Handoff Delay: negligible LTE-LTE, less than 512 ms LTE>GSM
• Bandwidth scalable for incremental transition in existing spectrum
• MBMS (Multimedia Broadcast Multicast Service) to allow about 16 TV
channels simultaneously in 5 MHz. at efficiency of about 1 b/s/hz
LTE
 The Evolved Packet System (EPS) is purely IP based. Both real time
services and datacom services are carried by the IP protocol.
• An outside IP address is allocated when the mobile is switched on and
released when it has been switched off for some time.
The new LTE radio signal uses OFDMA (Orthogonal Frequency
Division Multiple Access) to handle high data rates and volumes.
• High order modulation (up to 64QAM), large bandwidth (up to 20
MHz) and MIMO transmission on the downlink (up to 4x4) is also
available. Up to 170 Mbps on uplink and 300 Mbps on the downlink!
 The EPC core network can inter-work with Non-3GPP access such as
WiMAX, WiFi, CDMA and EV-DO.
• Non 3GPP access solutions can be treated as trusted or non-trusted
(using independent security) based on operator requirements.
 The LTE access network (“RAN”) is simply a network of base stations
(eNodeBs) in a flat architecture. There is no centralized intelligent
controller, and the eNBs are normally inter-connected by the X2-interface
and connected towards the core network by the S1-interface.
 Distributing intelligence among eNodeBs speeds up connection set-up
and handovers, especially critical for some types of user traffic.
LTE vs. LTE Advanced
Characteristic LTE LTE Advanced

DL: 100 Mbps DL: 1 Gbps
Peak Data Rate
UL: 50 Mbps UL: 512 Mbps
C-Plane: <100 ms C-Plane: <50 ms
Latency:
U-Plane: <5 ms usually U-plane: <5 ms always
Multiple Blocks,
Spectral Width One Block, up to 20 MHz
up to 100 MHz. +
DL: ~5 b/s/Hz DL: up to ~30 b/s/hz
Peak Spectral Efficiency
UL: ~2.5 b/s/Hz UL: up to ~15 b/s/Hz
Control-Plane At least 200 active in 5 >300 active in 5 MHz.
User Capacity MHz., 400 in > 5 MHz. without DRX, >600 in 5+
 Many features of LTE-Advanced are already implemented in

current commercial-production network equipment
 Data rate figures above do not include benefits of MIMO

frequency
TDMA: IS-136, GSM
other time slots.
CDMA
of its own
Slide 134 512 v3.0 (c) 2013 Scott Baxter December, 2013
Highly Advanced Multiple Access Methods
OFDM OFDM, OFDMA
• Orthogonal Frequency Division Multiplexing;
Orthogonal Frequency Division Multiple Access
Power
• The signal consists of many (from dozens to
Frequency
thousands) of thin carriers carrying symbols
• In OFDMA, the symbols are for multiple users
• OFDM provides dense spectral efficiency and robust
resistance to fading, with great flexibility of use
Multiple-Antenna Techniques to Multiply Radio Throughput
MIMO MIMO
• Multiple Input Multiple Output
• An ideal companion to OFDM, MIMO allows
exploitation of multiple antennas at the base station
and the mobile to effectively multiply the throughput
for the base station and users
SMART ANTENNAS
• Beam forming for C/I improvement and
interference reduction
with handoffs
Progress in
to
and Frequency Reuse
B D
A C
Progress in TDMA (US)
1xRTT RC4
1xEV-DO
Analog*
Signal
CDMA
GPRS
EDGE
GSM
UMTS HSPA LTE
Technology
Signal Bandwidth, MHz = 0.03 0.03 0.2 0.2 0.2 1.2 1.2 1.2 3.84 3.84 20
User Bits/Second = 9600* 28k 104k 160k 384k 360k 720k 3.1M 2M 8M 100M
Signal Efficiency bits/Hz = 0.3* 0.9 0.5 0.8 1.9 0.3 0.6 2.4 0.5 2.1 5.5
Frequency Reuse N = 7 7 3 3 3 1 1 1 1 1 ~3
MIMO factor = 1 1 1 1 1 1 1 1 1 1 4
Spectral Efficiency bits/Hz/Area = 0.04 0.13 0.17 0.27 0.63 0.3 0.6 2.4 0.5 2.1 7.3
Progress in
Devices
December, 2013 Course 512 v3.0.1 (c)2013 Scott Baxter Slide 136
Introducing The LTE Air Interface
LTE Uses OFDM
Orthogonal Frequency Division Multiplexing
 An LTE signal is made up of many

small ordinary radio signals
(“subcarriers”) standing together
• The “bundle” could be from a few
dozen to over 1000 subcarriers,
whatever your spectrum can hold
• subcarriers are on 15 kHz. steps
 Each subcarrier can carry whatever bits we put on it
 We can send a large amount of data very fast by splitting it up and
sending over a large number of subcarriers in parallel
 Subcarriers are created and received using Discrete Fourier
Transforms, so they don’t interfere (are “orthogonal”)
 1980’s technology would have needed an individual transmitter and
receiver for each subcarrier – mobiles bigger than suitcases with
car batteries strapped on outside – but modern LTE chipsets keep
a user’s equipment (UE) small and compatible with small batteries
FDD LTE: Frequency Division Duplex
Uplink Downlink eNodeB
706 716 730 740

1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.
UE  When an operator’s licensed spectrum includes separate frequency

blocks for uplink and downlink, this is called “Frequency Division
Duplex” operation
 The LTE standard contains a list of several dozen “band classes”,
different arrangements of the uplink and downlink blocks and their
frequencies as used in different countries around the world
 Downlink is sometimes called “Forward Link”, and uplink called
“Reverse Link”
 LTE mobiles are called “User Equipment” (UE)
 LTE base stations are “Enhanced Node-Bs” (eNodeB, or eNB)
TDD LTE: Time Division Duplex
Downlink
Frequency
Uplink
 In TDD, uplink and downlink take turns transmitting in a single block
of spectrum.
 Operators’ choice of FDD or TDD operation is usually dictated by the
frequencies assigned by government
 In FDD, the capacity of uplink and downlink is determined by the
spectrum allocated to each (usually equal)
 In TDD, the relative capacity of uplink and downlink can be adjusted
to most closely match the actual distribution of uplink and downlink
traffic, getting greatest efficiency from available spectrum
 The WiMAX standard was first developed in only a TDD version
 The LTE technology was first developed in only an FDD version
 Today both LTE and WiMAX have FDD and TDD versions
Orthogonal Frequency Division
Multiple Access - OFDMA
Uplink Downlink
Uplink spectrum is empty Downlink spectrum on active system
if no UEs are transmitting usually appears fully occupied
706 716 730 740
1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.
 Whether FDD or TDD is used, transmission in each direction on

each subcarrier is scheduled in units of 1 millisecond (or multiples)
 An LTE system dynamically schedules uplink and downlink
subcarriers based user needs and RF conditions to ensure:
• Efficiency – each user gets their fair share of the resources and
the total resources are used effectively for greatest throughput
• Quality of Service (QOS) – each user’s type of traffic is
considered when assigning resources, to provide acceptable
quality (both in latency and throughput) for the user
The LTE Uplink Signal
 The uplink uses SC-FDMA with some dynamic multiple of 4 15-khz

subcarriers to transmit the user’s information
• Modulation can be QPSK, 16QAM or 64QAM for conditions
• SC-FDMA has a low Peak-to-Average Power Ratio (PAPR)
which provides more transmit power and longer battery life
Current Wireless Spectrum in the US
CELL UPLINK
CELL DNLNK
Proposed AWS-2
PCS AWS
AWS?
AWS PCS Down-
SAT
SAT
IDEN
IDEN
700 MHz. Down-
Uplink Uplink Link
Link
700 MHz 800 900 1700 1800 1900 2000 2100 2200
Frequency, MegaHertz
 Modern wireless began in the 800 MHz. range, when the US FCC
reallocated UHF TV channels 70-83 for wireless use and AT&T’s
proposed analog technology “AMPS” was chosen.
 Nextel bought many existing 800 MHz. Enhanced Specialized Mobile
Radio (ESMR) systems and converted to Motorola’s “IDEN” technology
 The FCC allocated 1900 MHz. spectrum for Personal Communications
Services, “PCS”, auctioning the frequencies for over $20 billion
 With the end of Analog TV broadcasting in 2013, the FCC auctioned
former TV channels 52-69 for wireless use, the “700 MHz.” band
 The FCC also auctioned spectrum near 1700 and 2100 MHz. for
Advanced Wireless Services, “AWS”.
 Technically speaking, any technology can operate in any band. The
choice of technology is largely a business decision by system operators.
The US 700 MHz. Spectrum and Its Blocks
 In the U.S., the former television channels 52-69 have been re-allocated
to wireless operators and public safety entities.
 The “Upper C” block (striped red) is now used by Verizon Wireless in
virtually the entire U.S. with uplink in 776-787 MHz. and downlink in
746-757 MHz. Verizon’s partnership with rural operators has given it a
head-start in completing LTE service along virtually all interstate
highways and many surrounding rural areas.
 AT&T has obtained the lower B and/or lower C block in many areas.
After considerable delay it is now well along in its national rollout.
 Other operators also use lower A, B, and/or C blocks in many areas.
There is controversy over adjacency of lower A to TV channel 51.
LTE Band
Classes
 The LTE Band Classes
are listed in the ETSI
document 36.101 in the
table shown at left
 Blocks 1-26 are for FDD,
Frequency-Division-
Duplex use
 Blocks 33-43 are for
TDD Time-Division-
Duplex use
 As new frequencies are
purposed for LTE around
the world, new band
classes will be added
 VZW US: Bandclass 13
 ATT US: Bandclass 17,
not 12 – controversy!
LTE Subcarriers and Modulation
One LTE Subcarrier: What Can It Do?
Frequency,
KHz
-30 -15 FSC +15 +30
 The LTE radio signal is made up of many individual little signals

called subcarriers, spaced 15 kHz apart in spectrum. A subcarrier
can carry information bits or reference signals.
 Bits are carried by a subcarrier by one of three types of modulation.
The system chooses which type to use, reacting to instantaneous
radio conditions between each specific UE and eNB:
• QPSK – rugged but slow, for bad RF conditions
• 16QAM – faster, but only works in fair conditions
• 64QAM – very fast, but only for great conditions
 The smallest “atom” of an LTE signal is one subcarrier during the
time while it transmits one symbol. This is a “resource element”.
 Normal bursts of user data over LTE occupy many subcarriers for
many symbols; we don’t schedule just one resource element alone.
A Quick Introduction to Digital Modulation
Modulation
Schemes
Modulation Possible Efficiency, SHANNON’S
Scheme States Bits/S/Hz
CAPACITY EQUATION
BPSK 2 1 b/s/hz
QPSK
Q
QPSK *
8PSK
4
8
2 b/s/hz
3 b/s/hz
C = B log2 [ 1+ S
N
]
16 QAM * 16 4 b/s/hz B = bandwidth in Hertz
I 32 QAM 32 5 b/s/hz C = channel capacity in bits/second
64 QAM * 64 6 b/s/hz S = signal power
256 QAM 256 8 b/s/hz N = noise power
Q 16QAM  In digital modulation, the signal’s amplitude and

phase are driven among several pre-defined values.
On a vector diagram, these points look like stars in
I a constellation. Each dot is called a “symbol”.
 Simple modulation schemes have fewer symbols in
their constellations, and are easy to receive even
Q 64QAM through interference and noise. However, each
symbol only carries a few bits of information.
 More complex modulation schemes have more
I
symbols in their constellations and each symbol
carries many bits of information. However, reception
is vulnerable to errors from interference, noise, or
distortion in amplifiers of the transmitter/receiver.
512 - 148 Course 512 v3.0- (c) 2013 Scott Baxter December, 2013
LTE Symbols’ Weapon against
“Multipath” Reflections: The Cyclic Prefix
LTE Symbol LTE Symbol LTE Symbol
UE
eNB
 Radio signals in a mobile environment don’t follow just one direct pathway
from transmitter to receiver. The signal travels over every possible path. The
receiver gets a “jumble” of what was transmitted, “blurred” in time.
 On arrival, the boundary between one symbol and the next is “fuzzy”. A
symbol is sometimes interfered with by overlapping remnants of the symbol
sent just before of it. This is called “intersymbol interference”, ISI.
 LTE exploits Discrete Fourier Transforms to overcome ISI. Each symbol
begins with a preview of its end value, called a “cyclic prefix”.
 If the CP length is longer than the time-blurring of the radio channel, the
Discrete Fourier Transform can eliminate the intersymbol interference.
 LTE systems have a “normal” CP length which nicely fits most situations. The
CP length can also be “extended” to get good performance in very reflective
areas such as big cities and mountain canyons, and in Multicast transmission.
Normal and Extended Cyclic Prefix
The Smallest Assignable Traffic-Carrying
Part of an LTE signal: a Resource Block
A Resource Block is 12 subcarriers
carrying data for one-half millisecond.
LTE Frame Timing Structure
in Frequency Division Duplex (FDD)
 Each LTE downlink subcarrier operates with radio frames 10

milliseconds long.
 Each frame is made up of 10 subframes, each 1 millisecond long.
 Each subframe contains 2 slots, each 512 microseconds long.
 Normally, each slot carries seven modulated symbols, which could
be QPSK, 16QAM, or 64QAM, whatever is most appropriate for
the prevailing radio conditions.
LTE Frame Timing Structure
in Time Division Duplex (TDD)
 When an LTE system has a single block of frequencies to use, it is

not possible to have simultaneous uplink and downlink.
 Instead, Uplink and downlink must take turns using the available
frequency space. This is called Time Division Duplex, TDD
 The frames for TDD LTE are 10 milliseconds long, just like FDD
 Inside a frame, some subframes are used for uplink and some for
downlink. When transmission direction changes, there is a
“transition” subframe with a pilot timeslot for the ending link direction,
a guard period, and a pilot timeslot for the starting link direction.
Possible LTE TDD Time Configurations
MIMO
Multiple Input Multiple Output
SISO, MISO, SIMO, MIMO
 Single-Input Single-Output is the

default mode for radio links over the
years, and the baseline for further
comparisons.
 Multiple-Input Single Output provides
transmit diversity (recall CDMA2000
OTD). It reduces the total transmit
power required, but does not increase
data rate. It’s also a delicious
Japanese soup.
 Single-Input Multiple Output is “receive
diversity”. It reduces the necessary
SNR but does not increase data rate.
It’s rumored to be named in honor of
Dr. Ernest Simo, noted CDMA expert.
 Multiple-Input Multiple Output is highly
effective, using the differences in path
characteristics to provide a new
dimension to hold additional signals
and increase the total data speed.
SU-MIMO, MU-MIMO, Co-MIMO
 Single-User MIMO allows

the single user to gain
throughput by having
multiple essentially
independent paths for data
 Multi-User MIMO allows
multiple users on the
reverse link to transmit
simultaneously to the eNB,
increasing system capacity
 Cooperative MIMO allows a
user to receive its signal
from multiple eNBs in
combination, increasing
reliability and throughput
LTE Channels
Downlink Physical Resources and Mapping
All Resource Blocks
Frequency
A Physical Resource Block
Time
 A complete view of an FDD LTE Downlink Signal several MHz wide.
Frequency Uplink Physical Resources and Mapping
One or more 60-KHz. SC-FDMA carriers

of a UE, as assigned by the system
Time
Types of Channels in LTE
 Logical Channels
• A logical channel carries a specific traffic or control messaging
between the RLC and an upper-level entity
 Transport Channels
• The Transport channels carry information between Medium
Access Control (MAC) and higher layers.
 Physical Channels
• A physical channel holds content with bits mapped into the
appropriate format to be transmitted over the air interface
• In addition to physical channels carrying user and control bits,
there are also physical signals
– PSS: downlink Primary Synchronization Signal
– SSS: downlink Secondary Synchronization Signal
– RS: downlink demodulation Reference Signal
– Uplink demodulation Reference Signal
Control
Shared Shared
Individual
Slide 162
LTE Channels – Logical, Transport, Physical
User
Traffic
Control
Random
Control Access Random Access
Public
Traffic
Multi- Multi-
MultiMedia
Media Media
Course 512 v3.0 (c)2013 Scott Baxter

Control
Control
Format
HARQ
Individual
User
Traffic
Control
Shared Paging
December, 2013
Control
Public
Paging Paging
Overhead Broadcast Broadcast
Overhead Overhead
Downlink Physical Signals and Channels
 Downlink Physical Signals

• Reference Signal (RS)
– Pilot used for DL channel estimation. Derived from cell ID (one of 3x168=504 PN Sequences)
• Primary Synchronization Signal (P-SCH)
– Signal used by UE for initial cell acquisition – codes 0, 1, or 2
• Secondary Synchronization Signal (S-SCH)
– Signal used by UE for initial cell acquisition – 168 different codes
 Downlink Physical Channels
• Physical Broadcast Channel (PBCH)
– Broadcasts system information, including MIB and SIBs
• Physical Downlink Shared Channel (PDSCH)
– Shared channel for user data, radio/core network, System information (BCH), paging messages.
• Physical Downlink Control Channel (PDCCH)
– Shared signaling channel for allocation of resources for the PDSCH.
• Physical Control Format Indicator Channel (PCFICH)
– Defines number of PDCCH OFDMA symbols per Sub-frame (1, 2, or 3)
• Physical Hybrid-ARQ Indicator Channel (PHICH)
– Carries HARQ ACK/NACK
• Physical Multicast Channel (PMCH)
– Carries the MCH Transport channel
Uplink Physical Signals and Channels
 Uplink Physical Signal

• Reference signal (RS)
– Reference signal used for demodulation and sounding
– Used for synchronization to the UE and UL channel estimation
 Uplink Physical Channels
• Physical Uplink Shared Channel (PUSCH)
– Shared channel used to carry user data..
• Physical Uplink Control Channel (PUCCH)
– Shared signaling channel for UE to request PUSCH resources
• Physical Random Access Channel (PRACH)
– Shared channel used for the access procedure, Call setup
Downlink Resource Grid Details
Resource Allocation in LTE
 Resources in LTE
• Resource Element, Resource Block, Slot, Sub-frame
• Resource Grid
 Control Information Resourced Allocation
• Physical Channels, PDCCH, DCI
• REG Resource Element Groups
 Traffic Resource Allocation
• Resource Block Group (RBG) based
• RBG Subset based
• Virtual Resource Block (VRB)-based
 Interactive LTE downlink signal demonstration:
• http://paul.wad.homeSlide.dk/LTE/lte_resource_grid.html
Example of RS Sequences for
1, 2, and 4 Antennas
 Notice when one antenna is transmitting a
reference symbol, the other antennas are silent
How REGs and Reference Signals Fit
 Here’s an example of
how REGs and
Reference Symbols fit
into the resource grid
 The Downlink Control
Indicator (DCI) carries
the information a UE
needs to know
• Which resource
blocks carry my
data?
• What modulation
scheme is used
for my data?
• What’s the
starting resource
block for my
data?
LTE Resource Allocation and PDCCH Support
 There are 10 DCI formats for indicating downlink scheduling, in

three broad types.
 There is one DCI format for assigning uplink scheduling.
 A Control Channel Element (CCE) consists of 9 Resource Element

Groups (REG).
DCI Formats and Resource Allocation
Resource Allocation type 0
 In type 0 resource allocation, a bit map represents a resource

block group (RBG) allocated to a UE.
• The size of RBG is given by P, which can be found in TS
36.213 Table 7.1.6.1-1 for the system bandwidth.
• Each bit in the “Bitmap” indicates a small contiguous group
whose size depends on the bandwidth (RBG: 1…4).
• The maximum resource block (RB) coverage of any type 0
allocation is the whole signal bandwidth. A type 0 allocation
with all the bits in bitmap set to ‘1’ means the whole signal.
 Example
• For 50 RB Bandwidth, the number of bits in “Bitmap” are 17.
• Each bit in the 17 bit bitmap selects a group of 3 RB (apart
from the last group which will only contains 2 RB for this BW).
• Each bit is associated with a group of RE with the same color.
Resource Allocation Type 1
 Type 1 resource allocation uses a bit map to indicate physical resource blocks
inside an RB subset “p”, where 0 ≤ p < P. Even with all the bits in the “Bitmap” set
to ‘1’, it does not span the whole signal bandwidth. Each bit in the bitmap selects a
single RB from ‘islands’ of small contiguous groups whose size (RBG) and
separation depend on the total bandwidth. This allows selecting individual RBs.
 Resource block assignment signaling is split into 3-parts:
• RBSubset, Shift (whether to apply an offset when interpreting), and Bitmap
indicating the specific physical resource block inside the resource block group
subset. This makes Type 1 bitmap sizes smaller by [log2 (P)]+1 than Type 0.
 Example – 50 RB Bandwidth, the number of bits in “Bitmap” are 14. Each bit
selects one RB inside a selected subset. If all bits are set to one, we get:
Resource Allocation type 2
 In Type 2 resource allocation, physical resource blocks are not

directly allocated. Instead, virtual resource blocks are allocated
which are then mapped onto physical resource blocks.
• Type 2 allocation supports both localized and distributed virtual
resource block allocation differentiated by one bit-flag.
• The information regarding the starting point of virtual resource
block and the length in terms of contiguously allocated virtual
resource block can be derived from Resource Indication Value
(RIV) signaled within the DCI.
 Example – 50 RB Bandwidth:
• UE is assigned an allocation of 25 resource blocks (LCRBs =
25), starting from resource block 10 (RBstart = 10) in the
frequency domain.
• To calculate the RIV value see the formula in TS 36.213
Section 7.1.6.3, which yields RIV = 1210. This RIV is signaled
in DCI and the UE can determine the starting resource block
and the number of allocated resource blocks from the RIV.
Non-Hopping and Hopping
Uplink Resource Allocation
 Non-Hopping Uplink Resource Allocation
• Type 2 localized resource allocation rules allow deriving the resource
allocation from the RIV value.
 Uplink Hopping Resource Allocation – two types of hopping exist:
• Type 1 PUSCH Hopping
– Type 1 PUSCH Hopping is calculated using the RIV value and a
number of parameters signaled by higher layers;
• Type 2 PUSCH Hopping (not the same thing as downlink resource
allocation type 1 and type 2 described earlier) is calculated using a
pre-defined pattern (a function of subframe/frame number) defined in
TS36.211 5.3.4.
 The fundamental set of resource blocks is calculated from the rules for
type 2 localized resource allocation from the RIV value, except either 1 or
2 hopping bits deduced from bandwidth and resource allocation bitmap.
– These hopping bits specify whether Type 1 or Type 2 PUSCH
Hopping is to be used, and for the case of 2 bits, variations of the
position of the Type 1 hopping in the frequency domain. The
definition of the hopping bits is in TS 36.213 Table 8.4-2.
Intercell Interference
LTE’s “Achilles Heel”:
Intercell Interference and its Coordination
 LTE signals are unlike CDMA – the traffic channels of different

cells are not coded orthogonally different from each other
 Cochannel interference will result if adjacent cells use adjacent
frequencies to serve distant UEs in the border areas
 The LTE standards provide methods for cells to communicate their
present loading to one another
 LTE manufacturers are allowed to develop their own algorithms for
cells to dynamically coordinate the subcarriers used to serve their
various mobiles to avoid interference as much as possible
Scrambling in LTE
 LTE is conceived assuming a
frequency reuse rate of 1, using all
available frequencies in all cells of
the system.
• Although LTE does not use
CDMA codes to differentiate
cells, it does perform
information scrambling at the bit
level.
 LTE scrambling codes are Pseudo-
random sequences defined by a
length-31 Gold code.
 Each type of physical channel uses
a different scrambling code. The
scrambling code used in the
downlink is not the same all the
time.
 It is determined by UE Identity, and
also related with the channel
type/format associated with service.
 The table at right shows the
scrambling methods by channel.
The LTE Core Network
Circuit-Switched vs. Packet-Switched
MME
HLR BSC
MSC BTS P GW S GW
MS Internet UE
PSTN TRC VPNs
eNB
 For voice calls, the original cellular technologies used circuit-switched connection – a
steady “circuit” as long as the call lasts.
• The voice path from a mobile to a landline phone was steady:
– Continuous radio transmission between phone and BTS
– Continuous bitstream from BTS over backhaul to the BSC
– Continuous trunk: BSC thru Switch to destination phone
– Even during a pause in conversation, the links stayed up
 Data sent over cellular uses “Packet-switched” methods
• The flow of data occurs in instantaneous “spurts” as needed
– No steady signal between phone and BTS; the radio signal in each direction
exists only when a packet is being sent
– Data goes between BTS and BSC intermittently as packets
– Data from the BSC goes through routers to and from the internet
intermittently, as packets
 GPRS, EDGE, 1xRTT, EV-DO, HSPA and LTE systems are all packet-switched
The LTE Evolved Packet Core Network, “EPC”
 In the wireless data technologies
PCR
F
before LTE, there were many
proprietary network elements
“Super HLR”
HSS
Mobility Management Entity,
• Base Station Controllers and

User Plane Entity
Internet
Radio Network Controllers, Evolved
RAN: eNB
MME
UPE
SGW PDN
GW Serving Gateway
which used manufacturer- LTE radio

Networks
Inter Access System Anchor
IASA
Evolved Packet Core

proprietary messages and Uu
link formats The PDN Gateway is also sometimes called the

“System Architecture Evolution” Anchor
• The BSC/RNC had to be the

same brand of equipment as
the BTS
 One of the goals of the LTE standard is to eliminate proprietary devices and
allow different brands of equipment to work together
• The intelligence for scheduling data bursts and arranging handoffs has
been standardized and moved into the eNodeBs
• This means no proprietary BSC or RNC is needed
• Standard TCP/IP techniques are used for all data movement
• A new standardized non-proprietary “Mobility Management Entity” (MME)
is the intelligent “matchmaker” guiding setup of data sessions, handoffs,
and other processing events
EPC Elements Policy and Charging Rules Function
PCR
F

“Super HLR”
Mobility Management Entity,

User Plane Entity
HSS
Internet
Evolved MME SGW PDN
Serving
LTE radio Inter Access System Anchor
IASA
Networks
Uu
Evolved Packet Core
The PDN Gateway is also sometimes called

the “System Architecture Evolution” Anchor
 Serving GW, PDN GW The Serving and PDN gateways transport the IP
data traffic between User Equipment (UE) and external networks.
• The Serving GW connects the radio-side and the EPC.
• The PDN GW connects EPC and external IP networks (PDN).
 MME The Mobility Management Entity handles the control plane, in
particular signaling related to mobility and security for UEs. It handles UE
tracking and paging, and is the termination point of the NAS.
 HSS The HSS (Home Subscriber Server) is a database that contains
user and subscriber information. It provides support functions in mobility
management, call and session setup, user authentication and access
authorization. It’s a combination of Home Location Register (HLR) and
Authentication Center (AuC) functions.
Functions of the Evolved Packet System
and the Evolved Packet Core Elements
E-UTRAN
eNB
Inter-cell RMM
RB Control EPC
Connection Mobility Ctrl
MME
Radio Admission Ctrl.
NAS Security
eNB Measurement
Config. & Provision
Idle State Mobility
Dynamic Resource Handling
Allocation (scheduler)
EPS Bearer
Control
RRC
PDCP
S-GW P-GW
RLC
Mobility UE IP Address
MAC
Anchoring Allocation
Internet
S1
PHY Packet Filtering
Networking Functional Elements
(eNB; MME; Anchors/Gateways, PCRF; HSS)
Legacy GSM radio Networks
GERAN Gb
SGSN GPRS CORE PCRF

UTRAN Iu S7 Rx+
S3 S4
S5b
S5a
Ref Pt.
Mobility Management Entity S6a HSS
User Plane Entity
S1 SGi Outside IP
Evolved MME Serving PDN World: The
RAN: eNB UPE Gateway Gateway
Ref Pt. Internet
Networks

S2a S2b,c
1xRTT, CDMA2000, Non-3GPP WLAN 3GPP
EV-DO networks
IP access IP access
Operator-Specific Core Network Implementation
NETWORK ELEMENT LEGEND
Standards-defined Operator-specific HSS
LTE Elements Elements Amdocs
Real-Time
Operator IT Third Party Vendor Sp (LDAP) Monitoring and Billing
SPR SPML
CAM Netcracker
Sp (LDAP) NSN Sp (LDAP) IT BOPS
S6a
DNS AMM
PCRFSy Sy Sy DRA Sy Sy OCS
Infobox
Opennet ACME Opennet Diameter
MME
ALU, E//, HU Gx
DRA Gy
Oracle(ACME) VO
S1-MME S11 Citrix
Citrix
SGi
eNodeB SGW PGW PCEF Public
S5 SGi Internet
ALU, E//, HU S1-U Cisco Cisco Sandvine
SGi HTTP
HTTP Proxy
Proxy
Uu SGz OFCS SGz Citrix
Citrix
Redknee
Cricket EDM SONAR DNS
User IT TECCO Infobox
Infoblox
x
Key Network Interfaces (1)
 Uu – The LTE physical layer interface connecting the UE with the

eNodeB on both uplink and downlink directions (GTP-U Protocol)
 S1-MME – The Control Plane (command and control) connection
from the eNB to the MME managing user mobility (GTP)
 S1-U – The User Plane (traffic-carrying) connection from the eNB
to the serving gateway (GTP protocol)
 S2a – PDN link to trusted non-3GPP networks (CDMA EVDO)
(based on proxy mobile IP, can use client mobile IP FA mode)
 S2b – PDN link to serving gateway for an untrusted network GTP
(based on proxy mobile IP)
 S2c – PDN link to trusted non-3GPP network (CDMA, EVDO) GTP
(based on client mobile co-location)
 S3 – Connection between 2G/3G SGSN and SAE MME (GTP)
 S4 -- Provides user plane connection and mobility support
between a 2G/3G SGSN and the SGW (based on Gn reference
point defined between SGSN and GGSN) (GTP protocol)
 S5 – Provides user plane tunneling and tunnel management

between SGW and PDN GW. Handles S GW relocation for UE
mobility if the S GW must connect to a non-collocated PDN GW.
S5 is the intra PLMN variant of S8.
 S6a – Carries subscription and authentication data between the
MME and the HSS (often called a ‘super HLR’)
 S7 – Carries policy and charging rules information between the
PDN gateway and the PCRF
 S8 – Inter-PLMN reference point providing user and control plane
between the Serving GW in the VPLMN and the PDN GW in the
HPLMN. S8 is the inter PLMN variant of S5.
 S9 - Transfers (QoS) policy and charging control information
between Home/Visited PCRF to support local breakout function.
 S10 -- Reference point between MMEs for MME relocation and
MME to MME information transfer
 S11 -- Reference point between MME and Serving GW

 S12 – Connection from UTRAN to Serving GW during user plane
Direct Tunnel. Based on Iu-u/Gn-u ref. point and GTP-U protocol
SGSN-to-UTRAN or SGSN-to-GGSN. Optional by Operator.
 S13 – Enables UE identity check between MME and EIR
 SGi -- Reference point between PDN GW and packet data
network. Packet data network can be external public, private, or
intra-operator packet data network, e.g. for provision of IMS.
Corresponds to Gi interface for 3GPP accesses.
 Rx -- The Rx reference point resides between the AF and the
PCRF in the TS 23.203 [6].
 Wn* The reference point between the Untrusted Non-3GPP IP
Access and the ePDG. Traffic on this interface for a UE initiated
tunnel must be forced towards the ePDG.
 X2 -- The X2 interface can provide

• inter-connection of eNBs supplied by different manufacturers;
• support of continuation between eNBs of the E-UTRAN
services offered via the S1 interface;
• separation of X2 interface Radio Network functionality and
Transport Network functionality to facilitate introduction of
future technology.
 SBc:- Reference point between CBC and MME for warning
message delivery and control functions
X1 and S1 Interfaces
 Another advantage with the distributed solution is that the MAC

protocol layer, which is responsible for scheduling, is represented only
in the UE and in the base station leading to fast communication and
decisions between the eNB and the UE.
• In UMTS the MAC protocol, and scheduling, is located in the
controller and when HSDPA was introduced an additional MAC
sub-layer, responsible for HSPA scheduling was added in the NB.
LTE Scheduling
Resource Allocation in LTE
 Resources in LTE
• Resource Grid, Resource Block, Slot, Sub-frame
 Control Information
• Physical Channels, PDCCH, DCI
 Resource Allocation
• Resource Block Group (RBG) based
• RBG Subset based
• Virtual Resource Block (VRB)-based
 Helpful Link: very useful utility showing LTE resource grid
The Downlink Scheduler
 The Downlink Scheduler must manage the assignment of

resource blocks to users for the downlink shared channel, and the
Modulation and Coding Schemes (MCS) to be used on
transmissions to individual UEs.
 The scheduler is ultimately responsible for maximizing the overall
throughput through each EnodeB and the data delivered to the
users.
 In order to correctly manage the air resources, the Downlink
Scheduler must be aware of the data waiting to be sent and
frequently receive channel RF condition details from the UEs.
• Amount and type of data waiting to be sent to each UE
• Channel RF condition (CQI) measurements from each UE
The Uplink Scheduler
 The Uplink Scheduler must manage the assignment of resource

blocks to users for the uplink shared channel
 The mechanism is similar to the Downlink Scheduler but the
directions are reversed
• Uplink Channel quality measurements are made by the
eNodeB
• Mobiles report the data in their buffers ready to be sent and
request authority to begin transmission
• The uplink scheduler applies QOS and throughput
maximization strategies to achieve an optimum user
experience
LTE Scheduling
 The eNodeB allocates physical layer resources for the uplink and
downlink shared channels (UL-SCH and DL-SCH). Resources are
composed of Physical Resource Blocks (PRB) and Modulation
Coding Scheme (MCS). The MCS determines the bit rate, and
thus the capacity, of PRBs. Allocations may be valid for one or
more TTIs; each TTI interval is one subframe (1 ms).
 Semi-persistent scheduling reduces control channel signaling. If
every allocation was individually signaled, the overhead would be
unacceptable. In an application such as voice over IP, for example,
a downlink frame occurs every 10 to 20 milliseconds. If each
downlink frame were signaled individually, it would cause a lot of
traffic on the control channel and the control channel would need a
lot more bandwidth than necessary. Semi-persistent scheduling
lets you set up an ongoing allocation that persists until it is
changed. Semi-persistent schedules can be configured for both
uplink and downlink.
Scheduling: Transmission Time Interval (TTI)
 The scheduler is the main player in rapidly utilizing radio resources. The
smallest Transmission Time Interval (TTI) is only 1 ms.
 During each TTI the eNB scheduler:
• considers the physical radio environment per UE. The UEs report
received radio quality to the scheduler which decides which
Modulation and Coding scheme to use. The scheduler rapidly adapts
to channel variations, using HARQ (Hybrid Automatic Repeat
Request), soft-combining, and rate adaptation.
• prioritizes QoS requirements among the UEs. Both delay sensitive
and rate-sensitive data services are accomodated.
• informs UEs of their allocated downlink and uplink radio resources.
 Each UE scheduled in a TTI gets a Transport Block (TB) carrying its data.
• On downlink there can be a maximum of two TBs generated per UE if
using MIMO. The TBs are delivered over a transport channel.
• The user plane has only one shared channel in each direction. The TB
can contain bits from several services, multiplexed together.
• In theory the highest number of users that can be scheduled during 1
ms is 440, presuming 20 MHz band and 4x4 Multi User MIMO.
Waking Up with a UE:
LTE ‘Call Processing’
System Acquisition
Searching In Frequency Searching In Time
 At power-up, the UE notes its LTE band class capabilities and begins
exploring all the possible center frequencies that might be hold the SCH
 The UE first looks for the primary synchronization signal (P-SCH) in the
last OFDM symbol of the first time slot of the first subframe (subframe 0)
in each radio frame. It reads symbol timing, and learns which of three cell
identities is being transmitted, and locks its frequencies to the eNB.
 The UE next searches for the (S-SCH) secondary synchronization signal,
and learns which of 170 cell identities it carries. From this it decodes the
PCI, physical cell identity, and the frame boundaries
 The UE next finds the RS sequence and learns antenna port configuration
 Now the UE can decode the P-BCH and apply cell selection and
reselection criteria
Cell Reselection (Idle Mode Handover)
 The mobile is in power-conservation mode

• Does not inform network of every cell change; rather, just when
it detects entry into a new Tracking Area
• UE-terminated calls are paged in the UE’s last reported TA
 TA organization and procedures have been widely debated
• Static non-overlapping TAs were used in earlier technologies
• New techniques reduce ping-ponging, distribute TA update
load more evenly across cells, and reduce aggregate TA
update load
• Mechanisms include overlapping TAs, multiple TAs, and
distance-based schemes
Cell Search Measurements
 An LTE UE measures reference signal RSRP (Reference Signal Received

Power) and RSRQ (Reference Signal Received Quality).
 RSRP is a RSSI type of measurement. It measures the average received
power over the resource elements that carry cell-specific reference signals
within certain frequency bandwidth.
 RSRQ is a C/I type of measurement and it indicates the quality of the
received reference signal, defined as (N*RSRP)/(E-UTRA Carrier RSSI),
• N ensures the nominator and denominator are measured over the
same frequency bandwidth;
• carrier RSSI measures the average total received power observed
only in OFDM symbols containing reference symbols for antenna port
0 in the measurement bandwidth over N resource blocks. The total
carrier RSSI includes all incoming RF from all sources.
 RSRP is applicable in both RRC_idle and RRC_connected modes, while
RSRQ is only applicable in RRC_connected mode.
 In the procedure of cell selection and cell reselection in idle mode, RSRP
is used. In the procedure of handover, the LTE specification provides the
flexibility of using RSRP, RSRQ, or both.
Physical Layer Measurements Definition
 Physical layer measurements to support mobility are classified as:

• within E-UTRAN (intra-frequency, inter-frequency);
• between E-UTRAN and GERAN/UTRAN (inter-RAT);
• between E-UTRAN and non-3GPP RAT (Inter 3GPP access
system mobility).
 For measurements within E-UTRAN at least two basic UE
measurement quantities shall be supported:
• Reference symbol received power (RSRP);
• E-UTRA carrier received signal strength indicator (RSSI).
LTE Measurement: RSSI
LTE Carrier Received Signal Strength Indicator (RSSI)

 Definition: The total received wideband power observed by the UE
from all sources, including co-channel serving and non-serving
cells, adjacent channel interference and thermal noise within the
bandwidth of the whole LTE signal.
 Uses: LTE carrier RSSI is not used as a measurement by itself,
but as an input to the LTE RSRQ measurement.
LTE Downlink
LTE Measurement: RSRP
LTE Reference Signal Received

Power (RSRP)
 Definition: RSRP is the linear
average power of the
Resource Elements (REs)
carrying a specific cell’s RS
within the considered
measurement frequency
bandwidth.
 Uses: Rank cells for
reselection and handoff.
 Notes: Normally based on the
RS of the first antenna port, but
the RS on the second antenna
port can also be used if they
are known to be transmitted.
LTE Measurement: RSRQ
RB RB RB RB RB RB RB RB RB RB RB RB
 LTE Reference Signal Received Quality (RSRQ)

 Definition: RSRQ = N · RSRP / RSSI
• N is the number of Resource Blocks (RBs) of the LTE carrier
RSSI measurement bandwidth. Since RSRQ exists in only one
or a few resource blocks, and RSSI is measured over the
whole width of the LTE signal, RSRQ must be “scaled up” for a
fair apples-to-apples comparison with RSSI.
 Uses: Mainly to rank different LTE cells for handover and cell
reselection decisions
 Notes: The reporting range of RSRQ is defined from −19.5 to −3
dB with 0.5 dB resolution. -9 and above are good values.
‘S’ Cell Selection and Reselection criteria
 After finding a cell, the UE may or may not be permitted to use it,
based on various signal quality criteria broadcast by the eNB.
 Here are two procedures for cell qualification:
• In the initial cell selection procedure, no knowledge about RF
channels carrying an E-UTRA signal is available at the UE.
– In that case the UE scans the supported E-UTRA
frequency bands to find a suitable cell. Only the cell with
the strongest signal per carrier will be selected by the UE.
• The second procedure relies on information about carrier
frequencies and optionally cell parameters received and stored
from previously-detected cells.
– If no suitable cell is found using the stored information the
UE starts with the initial cell selection procedure.
 S is the criterion defined to decide if the cell is still suitable . This
criterion is fulfilled when the cell selection receive level is Srxlev >
0. Srxlev is computed based on the following Equation:
‘S’ Cell Selection and Reselection criteria
Srxlev = Qrxlevmeas – (Qrxlevmin + Qrxlevminoffset) – Pcompensation
Where Pcompensation = max (PEMAX – PUMAX, 0)
All in db
 Qrxlevmeas is the UE-measured receive level value for this cell, i.e.
the Reference Signal Received Power (RSRP
 Qrxlevmin is the minimum required receive level in this cell, in dBm.
 Qrxlevminoffset is an offset to Qrxlevmin that is only taken into
account as a result of a periodic search for a higher priority PLMN
while camped normally in a Visitor PLMN (VPLMN).
 PCompensation is a maximum function. PEMAX is maximum power
allowed for a UE in this cell. PUMAX is maximum for power class
 A UE may discover cells from different network operators.
• First the UE will look for the strongest cell per carrier,
• Then the PLMN identity from the SIB Type 1 to see if suitable,
• Then it will compute the S criterion and decide if suitable
Getting Needed Cell Parameters:
Information Blocks
inter
 The Master Information Block (MIB) gives the basic signal configuration
and bandwith
 System Information Block 1 declares what other information blocks exist,
and the mobile goes about collecting all their contents
 The MIB and SIB1 are carried by the BCH channel; all the other SIBS are
carried by the DL-SCH
Special Details for TDD
 In TDD, the Primary synchronization signal (PSS) is placed at the

third symbol in subframes #1 and #6.
 The Secondary Synchronization signal (SSS) is placed at the last
symbol in subframes #0 and #5.
 The S-RACH is transmitted on the UpPTS within the special frame
 The Primary Broadcast Channel (PBCH) and the Dynamic
Broadcast Channel (D-BCH) are located just as in LTE FDD.
UE (Mobile) Categories
December, 2013 Course 512 (c)2013 Scott Baxter Slide 211

LTE UE Categories
Why have Categories for Ues?

 The LTE UE categories or UE classes are needed to ensure that
the base station (eNodeB) and mobiles (UEs) know each others’
capabilities and can communicate correctly. By relaying the LTE
UE category information to the base station, it is able to determine
the performance of the UE and communicate with it accordingly.
 As the LTE category defines the overall performance and the
capabilities of the UE, it is possible for the eNB to communicate
using capabilities that it knows the UE possesses. Accordingly the
eNB will not communicate beyond the performance of the UE.
LTE UE Category Definitions
Data Rates by UE Category
Modulation Types by UE Category
MIMO Capabilities by UE Category
 Five different LTE UE categories are defined with a wide range of

supported parameters and performance.
 Bandwidth for all categories is 20 MHz.
LTE Power Save Operation
 In wireless data communication, the receiver uses significant

power for the RF transceiver, fast A/D converters, wideband signal
processing, etc. As LTE increases data rates by a factor of 50 over
3G, wireless device batteries are still the same size, so substantial
improvements in power use are necessary to operate at these very
high rates and wide bandwidths. Some of that savings comes from
hardware, some from system architecture and some from the
protocol.
 Wireless standards employ power save mechanisms. The
objective is to turn off the radio for the most time possible while
staying connected to the network. The radio modem can be turned
off “most” of the time while the mobile device stays connected to
the network with reduced throughput. The receiver is turned on at
specific times for updates.
 Devices can quickly transition to full power mode for full
performance.
DRX and DTX
 LTE power save protocols include Discontinuous Reception (DRX)

and Discontinuous Transmission (DTX). Both involve reducing
transceiver duty cycle while in active operation. DRX also applies
to the RRC_Idle state with a longer cycle time than active mode.
However, DRX and DTX do not operate without a cost: the UE’s
data throughput capacity is reduced in proportion to power
savings.
 The RRC sets a cycle where the UE is operational for a certain
period of time when all the scheduling and paging information is
transmitted. The eNodeB knows that the UE is completely turned
off and is not able to receive anything.
 Except when in DRX, the UE radio must be active to monitor
PDCCH (to identify DL data). During DRX, the UE radio can be
turned off. This is illustrated in the figure above.
Long and Short DRX
 In active mode, there is dynamic transition between long DRX and short
DRX. Durations for long and short DRX are configured by the RRC. The
transition is determined by the eNodeB (MAC commands) or by the UE
based on an activity timer. The figure shows DRX cycle operation during a
voice over IP example. A lower duty cycle could be used during a pause in
speaking during a voice over IP call; packets are coming at a lower rate,
so the UE can be off for a longer period of time. When speaking resumes,
this results in lower latency. Packets are coming more often, so the DRX
interval is reduced during this period.
UE (Mobile) States

UE States
Idle Mode Operation

Tracking Area Update
 Consider a UE in idle state (RRC idle and ECM idle)

• This UE is free to travel and only do a Tracking Area Update
(TAU) when it discovers it has landed on a cell in a different TA
• If data arrives for the UE, the system must Page the UE
throughout the TA where it last registered
• The mobile responds to the page, implicitly revealing its cell
location and re-establishing its connection to the network
– When a mobile is switched on it always has at least a
default bearer with the IP address that comes with it
 A UE is in ECM-IDLE state when no NAS signaling connection
exists between the UE and the network
• The mobile only performs cell selection and PLMN selection
• There is no UE context, no S1_MME and no S1_U connection
• The UE will perform the TA procedure when the TAI in the
EMM isn’t on the UE’s registered list of Tas
• The UE will then be in ECM-CONNECTED state again
More EMM
 EPS also includes the concept of TAL, the Tracking Area List.
• A uE does not need to initiate a TAU when it enters a new Tracking
Area, if that area is already in its present Tracking Area List
• Provisioning different lists to the UEs can avoid signaling peaks when
a large nujmber of Ues cross a TA border, for example on a train or
other public transport
 EMM Connection Management Procedures
• Service request UE initiates to begin NAS signaling connection
• Network-initiated paging on NAS to UE to send service request
• Transport of NAS messages for SMS (CS fallback)
• Generic transport of NAS messages, various others
Access Barring During System Overload
 Every UE is in one of ten randomly allocated Access Classes (AC) 0 to 9,

stored in the SIM/USIM. A UE can also be in one or more of 5 special
categories (Access Classes 11 to 15), in the SIM/USIM:
• 0-9: Regular users, 10: Users calling emergency numbers
• 11 - For PLMN special use, 12 - Security Services
• 13 - Public Utilities (e.g. water/gas suppliers)
• 14 - Emergency Services, 15 - PLMN Staff
 During overload, the network can cope by changing the SIB2 (System
Information Block Type 2). The UE generates a random number “Rand”
and must pass a “persistence” test before making an access attempt.
• By setting ac-Barring to a lower value, normal UEs are randomly
delayed while priority users with AC11 – 15 have no restriction
• Regular users AC 0 – 9 obey ac-Barring Factor and ac-Barring Time.
• Emergency calls (AC10) use ac-Barring For Emergency – on or off
• UEs of AC11- 15 use ac-Barring For Special AC – on or off
• The eNB transmits ‘mean duration of access control’ and the barring
rate for each type of access attempt (data origination, signaling orig.)
• Service Specific Access Control (SSAC) can restrict attempts by
service type.
Flow Examples
Random Access
What is Random Access?
 An LTE UE uses the random access process to gain access to a

cell for any the following reasons:
• Initial access to the network from the idle state
– For performing an initial attach
– For initiating a new call
– For responding to a Page
• Regaining access to the network after a radio link failure
• During the handover process to gain timing synchronization
with a new cell
• Before uplink data transfers when the UE is not time
synchronized with the network
 The random access process allows multiple user equipment to
gain simultaneous access to a cell by using different random
access preamble sequence codes. User equipment on the uplink
in specific Physical Random Access Channel (PRACH) subframes
transmits these codes.
Contention-Based Random Access (CBRA)
 The UE initiates the Contention Based Random Access (CBRA)

process to gain access to the network. It involves the UE selecting
a random access preamble code from a list of codes available for
selection by all UE in the cell.
 Unfortunately, Contention can occur when multiple UEs just
happen to pick the same PRACH subframe and use the same
preamble code. CBRA additional messaging is required to resolve
such conflicts.
 Random Access is Contention-Based in all of the following
situations: Initial network access, Access following a radio link
failure, Handover between cells, and data transfers on either uplink
or downlink when UE synchronization must be established
 Random Access is NOT Contention-Based during handoffs, since
the system can assign a specific preamble for the UE to use in
accessing the new site and there is no danger another UE will
intrude or compete
The Steps of the Random Access Process
eNB Announces the Rules,
1. UE Transmits the first

Random Access Preamble
 All the UEs learn the necessary details of the Random Access
process before they even need to use it. The network transmits it in
overhead messages. The key details include:
• Which Preamble Format to use
– Usually Preamble Format 0 providing range up to about 14
kM. Other formats are available if greater range is needed.
• When the PRACH occurs, usually once per 10 ms. radio frame
• How the UE should calculate its “open loop” transmit power for its
initial transmissions before the eNB acknowledges it
– When the eNB finally responds, it will take over using “closed
loop” power control
 Step 1: Now the UE transmits its first Random Access Preamble.
 3GPP TS 36.321 contains more information on power control.
2. eNB sends Random Access
Response Message
 When the eNB hears the UE’s random
access preamble, it generates and sends a
Random Access Response Message on the
Physical Downlink Shared Channel (PDSCH)
• It’s addressed to a specific Random Access Radio Network
Temporary Identifier (RA-RNTI) address.
• There’s room in the RARM for multiple RA-RNTI addresses in
case multiple UEs were heard and need to be acknowledged
 The UE watches the PDCCH for its specific RA-RNTI address to
recognize its random access response message, which contains:
• Random access preamble sequence code identifying the
preamble sequence code which has been detected by the eNB
• Initial uplink schedule grant used for transmitting subsequent
data on the uplink channel
• Timing Alignment information so packet collisions won’t occur
• A Cell Radio Network Temporary Identifier (C-RNTI) for the UE
CBRA Contention Resolution:
Steps 3 and 4
 Contention resolution steps (3 and 4) are
used whenever multiple UEs are detected
attempting random access using the same
preamble code sequence.
 Step 3: The UE hears the RARM and makes its first scheduled
uplink transmission on Physical Uplink Shared Channel (PUSCH).
The UE gives the network a unique identifier in this message.
 Step 4: The eNB repeats back the UE identity provided in step 3. A
UE which hears a match with the identity it transmitted now
declares the random access procedure successful. It transmits an
acknowledgment in the uplink.
 UEs which don’t hear a match know they have failed the random
access procedure. They have to start over again at step 1.
 Both step 3 and step 4 use the Hybrid Automatic Repeat Request
(HARQ) process. Further details on the contention resolution
process and the HARQ process are in Chapter 5.1 of 3GPP TS
36.321.
Flow Examples
Initial Attach
 The S1 interface is initialized by request from the eNB to the MME
LTE Initial Attach
 The MME confirms setup of the S1AP interface by sending an S1
Setup Successful Outcome message to the eNB
 S1 Setup: This is where eNB is attached to the network. As long
the eNB is functioning the S1 setup remains.
LTE Initial Attach
 The UE sends an RRC connection request message to the eNB
LTE Initial Attach
 The eNB sends an RRC Connection Setup message to the UE
LTE Initial Attach
 The UE sends an RRC Connection Setup Complete message to
the eNB
LTE Initial Attach
• The message contains an NAS attachment request and a

PDN connectivity request
 RRC Connections: Once UE comes up a RRC connection is
established for communication with the network.
 The eNB sends the requests on to the MME
LTE Initial Attach
• NAS Attach Request

• PDN connectivity request
 NAS: After RRC is established then the NAS signaling begins .
• UE sends Attach request along with PDN connectivity request
to network.
• Attach is for attaching to the network and the other message
are for establishing the bearers.
LTE Initial Attach
 The MME sends an Authentication Info Request to the HSS

 HSS: This is Home Subscriber System and it understands
diameter protocol. Once MME receives Attach Request, it queries
HSS for authentication details. HSS sends the authentication
vectors to MME in Authentication Info Answer
LTE Initial Attach
 The HSS responds to the MME with an Authentication Info Answer
LTE Initial Attach
 The MME now has sufficient information to begin authentiation of

the UE
 The MME sends an S1AP DL NAS Transport and NAS message
containing the Authentication Request
LTE Initial Attach
 The eNB sends a RRC DL info Transfer and NAS message to the
UE, containing the Authentication Request
 Authentication/Security: Networks request Authentication Vectors
from UE. Once UE provides them, MME compares them with what
HSS has sent. If they match UE is authenticated. Next is security.
After the security all the NAS messages are encrypted using the
security algorithms that were exchanged.
LTE Initial Attach
 The UE replies with an RRC UL info transfer and NAS message

including an NAS Authentication Response
LTE Initial Attach
 The eNB sends an S1AP UL NAS transport and NAS message

containing the Authentication Response
LTE Initial Attach
 The MME processes the authentication response and if

successful, sends a DL NAS Transport and NAS message
containing a Security Mode Command to the eNB.
LTE Initial Attach
 The eNB sends a DL Info Transfer and NAS message including

the Security Mode Command to the UE.
LTE Initial Attach
 The UE confirms it has applied the Security Mode Command by

sending to the eNB a UL Info Transfer and NAS message
containing Security Mode Complete
LTE Initial Attach
 The eNB forwards a UL NAS Transport and NAS message to the

MME with the Security Mode Complete details.
LTE Initial Attach
 Now the MME is able to send a Create Session Request to the

SGW.
 After security mode is complete, all the NAS messages are
encrypted using the security algorithms that were exchanged.
LTE Initial Attach
 The PGW sends a Proxy Binding Update/ACK message to the

SGW using PMIP
LTE Initial Attach
 The SGW sends a Create Session Response to the MME using

GTP
LTE Initial Attach
 MME sends eNB the Initial Context Setup Request and NAS
message containing Attach Accept and Activate Default EPS
Bearer Context Request
LTE Initial Attach
 eNB sends RRC Connection Reconfiguration and NAS message

to UE containing Attach Accept, Activate Default EPS Bearer
Context Request.
LTE Initial Attach
 UE sends RRC Configuration Complete message to eNB
LTE Initial Attach
 MME sends Initial Context Setup Response message to the eNB
LTE Initial Attach
 Security: network creates the EPS bearers (GTP messages). Then

radio bearers created, RRC connections modified, radio bearers
created, eNB downlink addresses sent to SGW in GTP messages
LTE Initial Attach
 eNB sends UL NAS transport and NAS Attach Complete message

to MME, and Activate Default EPS Bearer Context Accept
LTE Initial Attach
 MME sends Modify Bearer Request by GTP to the SGW

LTE Initial Attach
 Attach complete
Flow Examples
UE Detach
LTE UE Detach
 The UE is attached to this network. It decides to detach.

 In the following Slides,
• It sends a detach request message to network.
• Network deletes the EPS bearers
• then the radio bearers are torn down.
• Finally RRC connection is released.
LTE UE Detach
 The UE sends an RRC UL Info Transfer + NAS containing a

detach request.
LTE UE Detach
 The eNB sends to the MME an UL NAS Transport + NAS

message containing a Detach request
LTE UE Detach
 The MME sends a Delete Session Request to the SGW using GTP
protocol.
LTE UE Detach
 The SGW sends the PGW a PMIP Proxy Binding Update, deleting
the EPS bearers.
LTE UE Detach
 The PGW sends a PMIP Proxy Binding ACK to the SGW
LTE UE Detach
 The SGW sends a Delete Session Response message by GTP to

the MME.
LTE UE Detach
 The MME updates the HSS on the UE’s detachment with a Notify
Request
LTE UE Detach
 The HSS confirms it has received the notification by sending a

Notify Answer to the MME
LTE UE Detach
 Now the MME sends the eNB a DL NAS Transport + NAS Detach
Accept
LTE UE Detach
 The eNB sends the UE an RRC Connection Reconfiguration

message
LTE UE Detach
 The UE confirms to the eNB by sending an RRC Connection

Reconfiguration Complete message
LTE UE Detach
 The MME sends the eNB a UE Context Release Command
LTE UE Detach
 The eNB responds to the MME with a UE Context Release

Complete message
LTE UE Detach
 The eNB sends the UE an RRC Connection Release message
Radio System Identifiers,
Tunnels, Connections, Bearers
3. Radio System Identifiers and Parameters
 UE Identifiers (IMSI, TMSI, GUTI …) • C-RNTI (Cell Radio Network Temporary
• Random Access Radio Network Identifier)
Temporary Identifier (RA-RNTI) • PCI Physical Cell Identifier
– contained in the MAC sub- • QCI QoS Class Identifier
header of each random access • RNTI Radio Network Temporary
response Identifier
• LCID Logical channel identifier • SystemInformationBlockType9 contains
• RRC layer in the Enb allocates cell- a home eNB identifier (HNBID);
level temporary identifiers • eNB Identifier (eNB ID): used to identify
• S-TMSI SAE Temporary Mobile eNBs within a PLMN.
Station Identifier • Tracking Area identity (TAI): used to
 UTRAN and EPC Identifiers identify tracking areas
• ECGI E-UTRAN Cell Global • NAS UE identifier
Identifier • NAS (EPC/UE) level AKA procedure
• one or multiple 'PLMN identity' in a (KASME) and identified with a key
given cell identifier (KSIASME).
• CSG identity: broadcast by cells in a • MME includes a session identifier
CSG to allow authorized CSG • SI-RNTI System Information RNTI
member UEs to access
• CID Context Identifier
E-UTRAN Network Identities
 PLMN Identity
• A Public Land Mobile Network is uniquely identified by its PLMN Identity.
 Globaly Unique MME Identifier (GUMMEI)
• The Globaly Unique MME Identifier consists of a PLMN Identity, a MME Group
Identity and a MME Code
• An MME logical node may be associated with one or more GUMMEI, but each
GUMMEI uniquely identifies an MME logical node.
 Global eNB ID
• The Global eNB ID is used to globally identify an eNB
 E-UTRAN Cell Global Identifier (ECGI)
• The ECGI is used to globally identify a cell.
 Tracking Area Identity (TAI)
• Each Tracking Area (a defined group of local cells) has an assigned TAI
 E-RAB ID
• An E-RAB uniquely identifies the combination of an S1 bearer and the
corresponding Data Radio Bearer. Under an E-RAB, there is a one-to-one
mapping between this E-RAB and an EPS bearer of the Non Access Stratum.
E-UTRAN UE Identifiers (1)
 RNTI
• Radio Network Temporary Identifiers (RNTI) are used as UE
identifiers within E-UTRAN and in signaling messages between
UE and E-UTRAN. Some types of RNTI exist:
• C-RNTI Connected Radio Network Temporary Identifier
– The C-RNTI provides a unique UE identification at the cell
level identifying RRC Connection
• RA-RNTI Random-Access Ratio Network Temporary Identifier
– The RA-RNTI is used during some transient states, the UE
is temporarily identified with a random value for contention
resolution purposes
• S-TMSI S-Temporary Mobile Subscriber Identity (S-TMSI)
– The S-TMSI is a temporary UE identity in order to support
the subscriber identity confidentiality. This S-TMSI is
allocated by MME.
E-UTRAN UE Identifiers (2)
 Transport Layer Addresses

• The transport layer address parameter is sent in radio signaling
procedures to establish the transport bearer connections.
• The transport layer address parameter is not interpreted in the
radio network application protocols
 An eNB UE context is a block of information about one active UE
held by the eNB.
• The block contains
– UE state information, security information, UE capability
information, identities of the UE’s logical S1-connection
– An eNB UE context is established when the transition to
active state for a UE is completed or in target eNB after
completion of handover resource allocation during
handover preparation.
 LCID Logical channel identifier
 RRC layer in the eNB allocates cell-level temporary identifiers
4. Tunnels, Connections and Bearers
 Default Bearers, Dedicated Bearers

 GPRS Tunneling Protocol (GTP) and Proxy Mobile IP (PMIP)
 Tunnel parameters (TEID; F-TEID …)
LTE Bearers
 In LTE, data plane traffic travels over virtual connections called

service data flows (SDFs).
 SDFs travel over bearers: Virtual containers with unique QoS
characteristics.
 A bearer is a datapath between UE and PDN, in three segments:
• Radio bearer between UE and eNodeB
• Data bearer between eNodeB and SGW (S1 bearer)
• Data bearer between SGW and PGW (S5 bearer)
LTE QoS Architecture
 LTE architecture supports “hard QoS,” with end-to-end quality of

service and guaranteed bit rate (GBR) for radio bearers. Just as
Ethernet and the internet have different types of QoS, for example,
various levels of QoS can be applied to LTE traffic for different
applications. Because the LTE MAC is fully scheduled, QoS is a
natural fit.
 Evolved Packet System (EPS) bearers provide one-to-one
correspondence with RLC radio bearers and provide support for
Traffic Flow Templates (TFT). There are four types of EPS
bearers:
• GBR Bearer – resources permanently allocated by admission
control
• Non-GBR Bearer – no admission control
• Dedicated Bearer – associated with specific TFT (GBR or non-
GBR)
• Default Bearer – Non GBR, “catch-all” for unassigned traffic
QoS Parameters and TFTs (1)
 A Traffic Flow Template (TFT) is all the packet filters associated with an EPS bearer.
• A packet filter may be associated with a protocol.
• Several packet filters can be combined to form a Traffic Flow Template.
• EBI+Packet filter ID gives us a "unique" packet filter Identifier. The following is the
TFT for FTP protocol.
 Bearer level QoS is associated with a bearer and all traffic mapped
to that will receive same bearer level packet forwarding treatment.
 QoS parameter values of the default bearer are assigned by the
network based on the subscription data received from HSS.
 In LTE the decision to establish or modify a dedicated bearer is
taken by EPC and bearer level QoS parameters are assigned by
EPC. These values are not modified by MME but are forwarded
transparently to EUTRAN. However MME may reject the
establishment of dedicated bearer if there is any discrepancy.
 A default bearer may or may not be associated with a TFT. But a

dedicated bearer is always associated with TFT.
• So we have bearers, the QoS values for them and TFT which
indicate what type of application should run over them. This
defines the LTE QoS. We have Uplink TFT and Downlink TFT
which are used by UE and PDN
 The UE routes uplink packets to the different EPS bearers based
on uplink packet filters in the TFT's assigned to those EPS
bearers.
• We have evaluation packet precedence index in packet filter
which is used by UE to search for a match (to map the
application traffic).
• Once the UE finds a match it uses that particular packet filter to
transmit the data.
• If there is no match UE transmits the data on bearer to which
no TFT has been assigned.
Flow Examples
Default Bearer Establishment

Incoming
LTE Default Bearer Establishment, Incoming
 UE is in RRC_IDLE condition
 MME has traffic for specific UE. It sends page messages to all
eNBs in UE’s current tracking area (TA).
 eNB sends Page message over air interface for UE
 UE recognizes the page and responds by sending RRC

Connection Request message to eNB
 eNB sends RRC Connection Setup message to UE
 UE sends eNB a RRC Connection Setup Complete message and

NAS message including Attach Request and PDN Connectivity
Request
 eNB sends Initial UE Message + NAS attach request and PDN

connectivity request to MME
 MME sends Create Session Request to SGW using GTP
 SGW sends PGW a PMIP Proxy Binding Update
 PGW responds to SGW with PMIP Proxy Binding ACK
 SGW sends Create Session Response to MME
 MME sends eNB Initial Context Setup request + NAS Activate

Default EPS Bearer Context Request and Attach Accept
 eNB sends UE an RRC Connection Reconfig and NAS Activate

Default EPS bearer context request and Attach Accept
 UE responds with RRC Connection Reconfiguration Complete
 eNB sends Initial Context Setup Response to MME
 UE sends eNB an RRC UL Info Transfer and NAS Activate Default

EPS bearer context accept and Attach Accept
 eNB sends to MME UL NAS Transport and NAS Activate Default

EPS Bearer Context Accept and Attach Accept
 MME sends Modify Bearer Request to SGW using GTP
 SGW responds to MME with Modify Bearer Response over GTP

Flow Examples
Default Bearer Establishment

Outgoing
LTE Default Bearer Establishment, Outgoing
 UE is in RRC_Idle mode
 UE has data and needs connection to network
 UE sends RRC Connection Request to eNB
 eNB sends RRC Connection Setup to UE
 UE sends RRC Connection Setup Complete and NAS Attach

Request and PDN Connectivity Request to eNB
 eNB sends Initial UE Message and NAS Attach Request and PDN
Connectivity Request to MME
 MME sends Create Session Request to SGW using GTP
 SGW semds PMIP Proxy Binding Update to PGW
 PGW sends PMIP Proxy Binding Ack to SGW
 SGW sends Create Session Response to MME by GTP
 MME sends eNB an Initial Context Setup Request and NAS

Activate Default EPS Bearer Context request and Attach Accept
 eNB sends UE an RRC Connection Reconfiguration and NAS

Activate Default EBS Bearer Context Request and Attach Accept
 UE sends eNB RRC Connection Reconfiguration Complete
 eNB sends MME an Initial Context Setup Response message
 UE sends eNB RRC UL Info Transfer NAS Activate Default EPS

Bearer Context Accept and Attach Accept
 eNB sends MME a UL NAS Transport + NAS Activate Default EPS

Bearer Context Accept and Attach Complete
 MME sends SGW a Modify Bearer request by GTP
 SGW sends MME a Modify Bearer Response message by GTP

LTE Handover and Roaming
Introduction to Handover
 In modern wireless systems, “seamless handover” is expected by

users as they move between sites and networks.
 Handover occurs in the active state; it is controlled by the network
(the eNodeB).The network uses measurements from the UE and
its own knowledge of the network topology to determine when to
handover a UE, and to which eNodeB.
 Don’t confuse handover with the cell re-selection which occurs
when the UE is in the idle state. Reselection is controlled by the
UE using previously received parameters and does not involve
communication between the UE and eNodeB, unless the UE
enters a new tracking area and must do a tracking area update.
Handover Measurement
 In a single-radio architecture it is hard to monitor other networks on
other frequencies while the receiver is active. The radio can only
receive on one frequency at a time, yet needs to listen to other
frequencies to see if a better base station (eNodeB) is available.
 In the active state, the eNB provides measurement gaps in the
scheduling of the UE where no downlink or uplink scheduling
occurs. This gives the UE enough time to change frequency, make
a measurement, and switch back to the active within a few TTIs.
This has to be coordinated with DRX, which also causes the
system to shut off the radio for periods of time to save power.
 The LTE network provides the UE with neighbor lists.
• The eNodeB provides the UE with neighboring eNB’s
identifiers and their frequency.
 During measurement gaps or idle periods, the UE measures the
signal quality of the neighbors it can receive.
 The UE reports results back to the eNodeB and the network
decides the best handover (if any), based on signal quality,
network utilization, etc.
Handover Procedures - Objectives
 Objectives of Handover Procedures

• It is important that QoS is maintained, not just before and after
a handover, but during the handover as well.
• Handover must not unduly drain the UE battery power.
• Service continuity shall be maintained (i.e., minimal handover
latency).
• Seamless handoff is required to 3G / 2G / CDMA technology.
 There are two ways a handoff can be decided:
• Network Evaluated: the network makes the handover decision
• Mobile Evaluated: the UE makes the handoff decision and
informs the network about it.
– In this instance, the final decision will be made by the
network based upon on the Radio Resource Management.
Handover Types
 In 3G and LTE networks, a hybrid approach is used to decide on

the handover.
• The UE will assist in the handoff decision by measuring the
neighboring cells and reporting the measurements to the
network
• The network decides upon the handoff timing and the target
cell/node.
• The parameters to measure and the thresholds for reporting
are decided by the network.
 In LTE there are three types of handovers:
• Intra-LTE: Handover happens within the current LTE nodes
(intra-MME and Intra-SGW)
• Inter-LTE: Handover happens toward the other LTE nodes
(inter-MME and Inter-SGW)
• Inter-RAT: Handover between different radio technology
networks, for example GSM/UMTS and UMTS
Flow Examples
Intra-LTE (Intra-MME / SGW)

Handover
Using the X2 Interface
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface User-Plane Traffic
Radio Interface IP Traffic
 The Data call is already established between the UE, S-eNB and
network elements.
 Data packets are already flowing to/from the UE on both DL & UL.
 The Network sends a MEASUREMENT CONTROL REQ message

to the UE to set the measurement parameters and thresholds.
 The UE is instructed to send measurement report when thresholds
are met.
 The UE sends a MEASUREMENT REPORT to the S-eNB as soon

as thresholds are met.
 The S-eNB decides to hand UE off to a T-eNB using network
operators’ handover algorithm.
 Optionally S-eNB issues RESOURCE STATUS REQUEST

message to determine the load on T-eNB.
 Based on received RESOURCE STATUS RESPONSE, the S-eNB
can decide whether to continue the handover procedure using the
X2 interface.
 The S-eNB issues a HANDOVER REQUEST message to the T-

eNB with UE and RB contexts to prepare handover at the target.
 T-eNB checks availability, reserves resources and sends back

HANDOVER REQUEST ACKNOWLEDGE message including a
transparent container for the UE as an RRC message to perform
the handover.
 The container includes a new C-RNTI, T-eNB security algorithm
identifiers for the selected security algorithms, and may include a
dedicated RACH preamble and possibly some other parameters
(i.e., access parameters, SIBs, etc.).
 The S-eNB generates the RRC message to perform the handover,

i.e, RRCCONNECTION RECONFIGURATION message including
the mobility Control Information. The S-eNB performs the
necessary integrity protection and ciphering of the message and
sends it to the UE.
 The S-eNB sends the eNB STATUS TRANSFER message to the

T-eNB to convey the PDCP and HFN status of the E-RABs.
 The S-eNB starts forwarding the downlink data packets to the T-

eNB for all the data bearers (which are being established in the T-
eNB during the HANDOVER REQ message processing).
 In the meantime, the UE tries to access the T-eNB cell using the
non-contention-based Random Access Procedure.
 If it succeeds in accessing the target cell, it sends the RRC

CONNECTION RECONFIGURATION COMPLETE to the T-eNB.
 The T-eNB sends a PATH SWITCH REQUEST message to the

MME to inform it that the UE has changed cells, including the
TAI+ECGI of the target.
 The MME determines that the SGW can continue to serve the UE.
 The MME sends a MODIFY BEARER REQUEST (eNodeB

address and TEIDs for downlink user plane for the accepted EPS
bearers) message to the SGW. If the PDN GW requested the UE’s
location info, the MME also includes the User Location Information
IE in this message.
 The SGW sends one or more “end marker” packets on the old path
to the S-eNB and then can release any user plane / TNL resources
toward the S-eNB.
 15. The MME responds to the T-eNB with a PATH SWITCH REQ
ACK message to notify the completion of the handover.
 User data packets now flow between the SGW and the UE.
 The T-eNB now requests the S-eNB to release the resources

using the X2 UE CONTEXT RELEASE message. With this, the
handover procedure is complete.
Flow Examples
Intra-LTE (Intra-MME / SGW)

Handover
Using the S1 Interface
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface User-Plane Traffic
 The UE is sending and receiving user data on both the uplink and
downlink.
 The S-eNB sends an RRC: Measurement Control message to the

UE, instructing it to take certain measurements at specific intervals
and to report the results when specific criteria are met.
 The UE sets to work taking the requested measurements and
performing comparisons against the specified criteria.
 The UE notices that measurements have satisfied the specified

criteria. It sends an RRC: Measurement Report to the Currently
Serving eNB.
 The handover procedure in this section is very similar to that in the
previous section (Intra-LTE Handover Using the X2 Interface),
except the involvement of the MME in relaying the handover
signaling between the S-eNB and T-eNB.
 The serving eNB sends a Handover Required message to the

MME
 MME sends Handover Request to Target eNB
 The Target eNB sends a Handover Request Acknowledgment to

the MME
 The MME sends a Handover Command to the serving eNB
 The Serving eNB sends an RRC Connection Reconfiguration

Request to the UE
 The Serving eNB sends an eNB Status Transfer message to the

MME
 The Serving eNB sends a Forward User Data message to the

SGW by GTP protocol
 The MME sends an MME Status Transfer message to the Target

eNB
 The UE performs the Non-Contention RACH Process on the

Target eNB
 The SGW sends Forward User Data to the Target eNB
 The UE sends an RRC Connection Reconfiguration Complete

message to the Target eNB
 The Target eNB sends a Handover Notify message to the MME
 The MME sends a Modify Bearer Request message to the SGW

by GTP
 The SGW sends a Modify Bearer Response to the MME by GTP
 User data packets now flow between the UE and the SGW.
 The T-eNB sends an S1AP UE Context Release Command to the

the S-eNB.
 The S-eNB confirms the requested UE context release by sending

the MME an S1AP UE Context Release Complete message.
Flow Examples
Inter-MME Handover (Intra-SGW)

(no change in Gateway)
Case III. Inter-MME Handover (Intra-SGW)
(no change in Gateway)
 In an inter-MME handover, two MMEs are involved in the

handover, the source MME (S-MME) and target MME (T-MME).
The S-MME controls the S-eNB and the T-MME controls the T-
eNB; both MMEs are connected to the same SGW. This handover
is triggered when the UE moves from one MME area to another
MME area.
User-Plane Traffic
downlink.
User-Plane Traffic
 The Serving eNB sends a Handover Request to the Serving MME
User-Plane Traffic
 The Serving MME sends a Forward Relocation Request to the

Target MME by GTP
User-Plane Traffic
 The Target MME sends a Handover Request to the Target eNB
User-Plane Traffic
 The Target eNB sends a Handover Request Acknowledgment to

the Target MME
User-Plane Traffic
 The Target MME sends a Forward Relocation Response to the

Serving MME
User-Plane Traffic
 The Serving MME sends a Handover Command to the Serving

eNB
User-Plane Traffic
 The Serving eNB sends a RRC Connection Reconfiguration

Request to the UE
User-Plane Traffic
 The Serving eNB sends an eNB Status Transfer to the Serving

MME, which forwards it to the Target MME
 The Target MME sends an eNB Status Transfer to the Target eNB
 The Serving eNB sends Forward User data to the SGW by GTP
 The SGW sends Forward User Data to the Target eNB by GTP
 The UE performs the Non-Contention RACH procedure on the

Target eNB
 The UE sends RRC Connection Reconfiguration Complete to the

Target eNB
 The Target eNB sends a Handover Notify message to the Target

MME
 The Target MME sends a Modify Bearer Request to the SGW by

GTP
 The SGW sends a Modify Bearer Response to the Target MME by

GTP
 The Target MME sends a Forward Relocation Complete message

to the Serving MME
 The Serving MME sends a Forward Relocation Complete

Acknowledgment to the Target MME
 User Packets now flow directly from UE to SGW in both directions
 The S-MME sends a UE Context Release Command to S-eNB

 The S-eNB responds with a UE Context Release Complete

Flow Examples
Inter-MME / SGW Handover

Using the S1 Interface
Case IV. Inter-MME / SGW Handover
downlink.
 The S-eNB sends RRC Measurement Procedures to the UE

 The UE performs the requested measurements
 The S-eNB receives information when specified thresholds are
exceeded, triggering need for a handover
 The Serving eNB sends a Handover Request to the serving MME
 The serving MME sends a Forward Relocation Request to the

target MME
 The Target MME sends a Create Session Request to the Target

SGW by GTP
 The Target SGW sends a Create Session Response to the Target

MME by GTP
 The Target MME sends a Handover Request to the Target eNB
 The Target eNB sends a handover Request Acknowledgment to

the Target MME
 The Target MME sends a Forward Relocation Request to the

Serving MME using GTP
 The Serving MME sends a Handover Command to the Serving

eNB
 The Serving eNB sends an RRC Connection Reconfiguration

Request to the UE
 The Serving eNB sends an eNB Status Transfer to the Target

MME
 The Target MME sends an eNB Status Transfer to the Target eNB
 The Serving eNB sends Forward User Data to the Target eNB
 The UE performs the Non-Contention RACH Procedure on the

Target eNB
 The UE sends an RRC Connection Reconfiguration Complete

message to the Target eNB
 The Target eNB sends a Handover Notify message to the Target

MME
 The Target MME sends a Modify Bearer Request to the Target

SGW using GTP
 The Target SGW sends a Modify Bearer Response to the Target

MME by GTP
 The Target MME sends a Forward Relocation Complete message

to the Serving MME
 The Serving MME sends a UE Context Release Command to the

Serving eNB
 The Serving MME sends a Forward Relocation Completion

acknowledgment to the Target MME
 The Serving eNB sends a UE Context release Complete to the

Serving MME
 The Serving MME sends a Delete Session Request to the Serving

SGW
 The S-SGW sends a Delete Session Response to the S-MME

 User data packets flow from UE to T-SGW in both UL and DL

LTE Security
LTE Security Objectives
 LTE security is extremely important. LTE must required security

without impacting the user experience.
 Users must operate freely and without fear of attack from hackers
and the network must also be secure against a variety of attacks.
 LTE security basics: Requirements for LTE security
• provide at least same level of security as in 3G services.
• LTE security measures must not affect user convenience.
• provide defense from attacks from the Internet.
• LTE security functions should not impede the transition from
existing 3G services to LTE.
• The USIM currently used for 3G services should still be used.
Basic Development of LTE Security
 Additional LTE measures have been implemented in all areas of

the system from the UE through to the core network. In summary:
• A new hierarchical key system has been introduced in which
keys can be changed for different purposes.
• security functions for the Non-Access Stratum, NAS, and
Access Stratum, AS have been separated.
• NAS functions are processed between the core network and
the mobile terminal or UE.
• AS functions encompass communications between the network
edge, i.e. the Evolved Node B, eNB and the UE
• The concept of forward security has been introduced for LTE
security.
• LTE security functions have been introduced between the
existing 3G network and the LTE network.
The LTE USIM
 The Subscriber Identity Module

(SIM) is one of the key security
elements of GSM, UMTS and
now LTE. This card holds identity
of the subscriber in an encrypted
fashion while phone or device.
 In transition from 2G/GSM to
3G/UMTS, the SIM concept was
upgraded and the USIM/UMTS
Subscriber Identity Module is
used. It has more functionality,
larger memory, etc.
 For LTE, only the USIM may be
used - the older SIM cards are not
compatible and may not be used.
Voice over LTE
Why Voice Over LTE?
 Originally LTE was seen as a completely IP cellular system just for

carrying data, and operators would be able to carry voice either by
reverting to 2G / 3G systems or by using VoIP.
 The Voice over LTE, VoLTE scheme was devised by operators
looking for a standardized system for carrying voice over LTE.
 But to Operators, the lack of a defined voice format seemed to be
a major omission for the system.
• lack of standardization may cause problems in roaming.
• SMS is a key requirement since it used to set-up many mobile
broadband connections. Lack of SMS is a show-stopper
 Mobile operators still receive over 80% of their revenues from
voice and SMS traffic. A viable and standardized scheme is
essential to provide these services and protect this revenue.
• LTE can more efficiently deliver these services due to its much
higher spectral efficiency
Options for Voice over LTE
 There are several options for delivering Voice over LTE:

• CSFB, Circuit Switched Fall Back: automatically falling back
the old 2G or 3G system when an LTE UE initiates a call. This
spec also allows SMS to be carried over an interface known as
SGs, so messages to be sent over an LTE channel.
• SV-LTE - simultaneous voice LTE: SV-LTE can run packet
switched LTE services simultaneously with circuit switched
voice service.However,it requires two radios to run at the same
time within the handset, with serious battery drain
• VoLGA, Voice over LTE via GAN: The VoLGA standard is
based on existing 3GPP Generic Access Network (GAN)
standards, aiming to deliver a consistent user services while
the network transitions to LTE (low-risk, popular with operators)
• One Voice / later called Voice over LTE, VoLTE: Provides
voice over the LTE system using IMS as part of a rich media
solution which can handle multimedia as well
Issues for Voice Services over LTE
 Unlike previous standards (GSM, CDMA), LTE does not have

dedicated channels for circuit switched telephony. LTE is an all-IP
system providing an end-to-end IP connection from the mobile
equipment to the core network and out again.
 In order to provide some form of voice connection over a standard
LTE bearer, some form of Voice over IP (VoIP) must be used.
 The aim for any voice service is to exploit the LTE low latency and
QoS features so that any LTE voice service is better than 2G/3G
 However to achieve a full VoIP offering on LTE poses some
significant problems which will take time to resolve. With the first
deployments having taken place in 2010, it is necessary that a
solution for voice is available within a short timescale.
Voice over LTE (VoLTE) Basics
 The One Voice profile for Voice over LTE (VoLTE) was developed
by a collaboration between over forty operators and manufacturers
including AT&T, Verizon Wireless, Nokia and Alcatel-Lucent.
• At the 2010 GSMA Mobile World Congress, GSMA announced
their support for the VoLTE solution to provide Voice over LTE.
• VoLTE, Voice over LTE is an IMS-based specification.
Adopting this approach, it enables the system to be integrated
with the suite of applications that will become available on LTE
 Three interfaces are being defined to provide VoLTE:
• User Network interface, UNI: between the user's equipment
and the operators network.
• Roaming Network Network Interface, R-NNI: located between
the Home and Visited Network.
• Interconnect Network Network Interface, I-NNI: located
between the networks of the two parties making a call.
Continuing Work on LTE
 Work to define Voice over LTE (VoLTE) is ongoing, including the

following elements:
• ensuring continuity of Voice calls as a user moves from an LTE
coverage area to an area where a fallback to another
technology is required. This form of handover will be achieved
using Single Radio Voice Call Continuity, or SR-VCC).
• Providing optimal routing of bearers for voice calls when
customers are roaming.
• establishing commercial frameworks for roaming and
interconnect for services implemented using VoLTE definitions,
necessary to set up roaming agreements
• Providing capabilities ror roaming hubbing
• Providing security and fraud threat measures to prevent
hacking and unauthorized network penetration..
IMS
What is IMS?
IP Multimedia Core Network Subsystem
 The IP Multimedia Subsystem or IP Multimedia Core Network

Subsystem, IMS is an architectural framework for delivering
Internet Protocol, IP multimedia services. It enables a variety of
services to be run seamlessly rather than having independent
applications operating concurrently.
 IMS, or IP Multimedia Subsystem is having a major impact on the
telecommunications industry, both wired and wireless.
 Although IMS was originally created for mobile applications by
3GPP and 3GPP2, its use is more widespread as fixed line
providers are also being forced to find ways of integrating mobile
or mobile associated technologies into their portfolios.
 As a result the use of IMS, IP multimedia subsystem is crossing
the frontiers of mobile, wire-less and fixed line technologies.
Indeed there is very little within IMS that is wireless or mobile
specific, and as a result there are no barriers to its use in any
telecommunications environment.
IMS Basics
 IMS, IP multimedia subsystem is an architecture, not a technology

 Users often need many concurrent simultaneous sessions of different applications
such as Push to talk over Cellular (PoC), gaming, video and more, it is
seamless integration is necessary for users to get the full benefits.
IMS Architecture Basics
 The architecture of an IMS system can be split into a number of

main elements or areas:
• User equipment: As the name implies, the user equipment or
UE is part of the IMS architecture resides with the user - it is
the endpoint.
• Access network: This is the portion of the IMS architecture
through which the overall network is accessed.
• Core network: This is a major element within the IMS
architecture and provides all the core functionality.
• Application layer: The application layer contains the web
portal and the application servers, which provide the end user
with service and enhanced service controls. T
Elements of overall IMS architecture:
 Server CSCF: session control for endpoint
devices; maintains state.
 Proxy CSCF: entry point to IMS for the UE;
forwards SIP messages to user's home S-CSCF;
controls inter-working security; QoS mgt.
devices.
 Home Subscriber Server, HSS: provides
subscriber database for the home network.
 Breakout gateway control function, BGCF: selects
the network in which a PSTN breakout is to occur.
If on in the same network as the BGCF, also
selects a media gateway control function, MGCF
 Media gateway control function, MGCF:
interworks the SIP signalling. manages sessions
across multiple media gateways
 Media server function control, MSCF: manages
the use of resources on media servers.
 SIP applications server, SIP-AS: execution
platform to deploy more services
LTE Advanced
LTE Advanced
 The driving force to further develop LTE towards LTE–Advanced,

LTE R-10 is to provide higher bitrates in a cost efficient way, and
at the same time completely fulfil the requirements set by ITU for
IMT Advanced, also referred to as 4G.
 In LTE-Advanced focus is on higher capacity:
 - increased peak data rate, DL 3 Gbps, UL 1.5 Gbps
 - higher spectral efficiency, from a maximum of 16bps/Hz in R8 to
30 bps/Hz in R10
 - increased number of simultaneously active subscribers
 - improved performance at cell edges, e.g. for DL 2x2 MIMO at
least 2.40 bps/Hz/cell.
 The main new functionalities introduced in LTE-Advanced are
Carrier Aggregation (CA), enhanced use of multi-antenna
techniques and support for Relay Nodes (RN).
LTE Advanced (2)
Carrier Aggregation
 The simplest way to increase
capacity is to add more bandwidth.
 To keep backward compatibility with
R8 and R9 mobiles the increase in
bandwidth in LTE-Advanced is
provided through aggregation of
R8/R9 carriers. Carrier aggregation
can be used for both FDD and TDD.
 Each aggregated carrier is referred
to as a component carrier.
 A component carrier can have a
bandwidth of 1.4, 3, 5, 10, 15 or 20
MHz Up to five component carriers  The maximum aggregate
can be aggregated. bandwidth is 100 MHz.
 R10 UEs can use DL and UL on up  The number of aggregated
to five Component Carriers (CC). carriers can be different in DL
R8/R9 UEs can use any ONE of the and UL, but UL is never larger
CCs. The CCs can be of different than DL. The individual
bandwidths. component carriers can have
different bandwidths.
LTE Advanced (3)
Continuous and Non-Continuous Aggregation
 Contiguous component carriers in the same operating frequency band are called
intra-band contiguous. This simplest arrangement is not always possible..
 Non-contiguous allocation can be intra-band, i.e. the component carriers belong to
the same operating frequency band, but are separated by a gap
 Non-contiguous allocation can be inter-band, in which case the component carriers
belong to different operating frequency bands
 Each component carrier is present on certain cells. Not all cells have all carriers.
The coverage of serving cells may differ due to different frequencies and powers
 RRC connection is handled by one cell, the Primary serving cell, using the Primary
component carrier (DL and UL PCC). The other component carriers are called
Secondary component carriers (DL and UL SCC), on secondary serving cells.
Differing Coverage of Different Carriers
 Different component carriers can have different coverage

 In inter-band carrier aggregation the component carriers will
experience different pathloss, due to different frequencies.
 In the example above, carrier aggregation on all three component
carriers can only be used by the black UE. The white UE is not
within the coverage area of the red component carrier. Note that
for UEs using the same set of CCs, they can have different PCC.
Main Differences in LTE Protocols
to Support Carrier Aggregation
 Introduction of carrier aggregation influences mainly MAC and the

physical layer protocol, but also some new RRC messages are
introduced.
 In order to keep R8/R9 compatibility the protocol changes are kept
to a minimum.
• Basically each component carrier is treated as an R8 carrier.
• However some information is necessary, such as new RRC
messages in order to make SCC and MAC able to handle
scheduling on a number of CCs.
• Major changes on the physical layer are for example that
signaling information about scheduling on CCs as well as
HARQ ACK/NACK per CC must be carried.
Main Differences in LTE Protocols
to Support Carrier Aggregation
Cross-Carrier Scheduling
 Regarding scheduling there are two main alternatives for CA, either
resources are scheduled on the same carrier as the grant is received, or
so called cross-carrier scheduling may be used
 Figure 5. CA scheduling (FDD). Cross- carrier scheduling is only used to
schedule resources on SCC without PDCCH. The CIF (Carrier Indicator
Field) on PDCCH (represented by the red area) indicates on which carrier
the scheduled resource is located
More References on Carrier Aggregation
 TR 36.808 Evolved Universal Terrestrial Radio Access (E-UTRA); Carrier

Aggregation; Base Station (BS) radio transmission and reception
 TR 36.814 Evolved Universal Terrestrial Radio Access (E-UTRA); Further
advancements for E-UTRA physical layer aspects
 TR 36.815 Further Advancements for E-UTRA; LTE-Advanced feasibility studies in
RAN WG4
 TR 36.823 Evolved Universal Terrestrial Radio Access (E-UTRA); Carrier
Aggregation Enhancements; UE and BS radio transmission and reception
 TR 36.912 Feasibility study for Further Advancements for E-UTRA (LTE-Advanced)
 TR 36.913 Requirements for further advancements for Evolved Universal Terrestrial
Radio Access (E-UTRA) (LTE-Advanced)
 TS 36.211 Evolved Universal Terrestrial Radio Access (E-UTRA); Physical channels
and modulation
 TS 36.212 Evolved Universal Terrestrial Radio Access (E-UTRA); Multiplexing and
channel coding
 TS 36.213 Evolved Universal Terrestrial Radio Access (E-UTRA); Physical layer
procedures
 TS 36.300 Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved
Universal Terrestrial Radio Access Network (E-UTRAN); Overall description; Stage 2
LTE SON:
Self Organizing/Optimizing Networks
Major Elements of LTE SON
 LTE has created a lot of interest in Self Optimizing Networks,

although the idea can be applied to other technologies too
 The main elements of SON include:
• Self configuration: to enable new base stations to become
essentially "Plug and Play" items. They need little manual
attention for RF or backhaul configuration
• Self optimization: After setup, the eNodeB will autonomously
optimize its operational characteristics for best performance
• Self-healing: Autonomously detecting network problems and
changing network characteristics to mask the problem until
manual repairs can be made - for example, adjacent cell
boundary manipulation when a cell goes down
 Typically an LTE SON system is a feature and software package
with relevant options that an operator buys from the network
manufacturer
LTE SON Development
 The Next Generation Mobile Networks (NGMN) alliance introduced

the term SON when it became obvious that LTE networks were
going to use large numbers of cells, microcells, and femtocells.
• With revenue per bit falling, deployment costs must be reduced
at the same time network performance demands are increasing
 Third Generation Partnership Program (3GPP) has created the
standards for SON. Since LTE is the first technology to use them,
they are often referred to as LTE SON.
 While 3GPP has generated the standards, they have been based
upon long term objectives for a 'SON-enabled broadband mobile
network' set out by the NGMN.
 NGMN has defined the necessary use cases, measurements,
procedures and open interfaces to ensure that multivendor
offerings are available. 3GPP has incorporated these aspirations
into useable standards.
 Deployment of LTE SON features is in very early stages now
LTE SON and 3GPP Standards
 LTE Son has been standardized in the various 3GPP standards. It

was first incorporated into 3GPP release 8, and further
functionality has been progressively added in the further releases
of the standards.
 One of the major aims of the 3GPP standardization is the support
of SON features is to ensure that multi-vendor network
environments operate correctly with LTE SON. As a result, 3GPP
has defined a set of LTE SON use cases and the associated SON
functions.
 As the functionality of LTE advances, the LTE SON
standardization effectively track the LTE network evolution stages.
In this way SON will be applicable to the LTE networks.
Course 513
LTE Key Design and

Performance Optimization Considerations

Course Outline
 Starting the LTE Planning Process: Collecting basic inputs

 Initial Basic Planning and Exploration
 Heterogeneous Network Details and Critical Considerations
 LTE Backhaul
 Determine User Equipment Requirements and Feasibility
 LTE Network Design Engineering
 LTE Network Design Outputs
 LTE Post-Launch Performance Assessment
 Basic LTE Planning Considerations
 Exploiting Heterogeneous Network Opportunities
 Performance Optimization: Network Statistics and Objectives
 LTE Message and Event Records
 Analytical Techniques for Problem Identification and Solution
LTE Network Planning Overview
Basic Network Objectives
 The basic basic objectives of a wireless system are:

• COVERAGE: provide sufficient cells to deliver RF coverage of the
entire desired area
• BUILDING/VEHICLE PENETRATION: deliver sufficient signal levels
to adequately penetrate buildings and vehicles where appropriate
• TRAFFIC: ensure that no cell captures more traffic than it can handle
at the desired grade of service (i.e., blocking percentage)
• SCHEDULE: construct the network and bring it to successful
commercial launch at a date which will prevent significant loss of
potential customers to competitors
• PERFORMANCE: design, construct, and adjust the network to deliver
reliable service free from excessive origination and call delivery
failures, dropped calls, quality impairments, and service outages
• ECONOMICS: provide return on investment sufficient to support
operating and capital expenses, expand the network to take
advantage of growth opportunities, and retire costs of construction
prior to depreciation of the network equipment
Slide 449 Course 513v3.0- (c) 2013 Scott Baxter December, 2013
The Major Steps in LTE Network Design
Dimensioning
Inputs:
Coverage, Capacity & Service
Requirements
Outputs:
eNodeB coverage radius and site numbers
based on capacity calculation Pre-Planning
Inputs:
Calculated coverage radius, digital
map and subscriber distribution
information
Outputs:
Preliminary eNodeB numbers Detailed Planning
Inputs:
Coverage target and site survey result
Outputs:
Actual site location and engineering
parameters
 Network planning begins with identifying service and coverage

requirements, determines how many cells are necessary to provide
it, and finally where those cells should actually be.
Inputs and Outputs Summary
Inputs Outputs
 Coverage Requirement  Site Types
• Coverage Area  Power/Channels
• Polygon Definition
 eNodeB numbering
• Cell Edge Throughput
• Coverage Probability
 Capacity Requirement
• Frequency & bandwidth  Active Users
• Subscriber forecast  S1 & X2 throughput
• Traffic Model
 Transport Dimensioning
LTE Network Dimensioning:
Coverage
LTE Coverage Dimensioning Flow
LTE Link Budget Procedure – Uplink
LTE Link Budget Procedure – Downlink
Speed Depends on
Signal-to-Noise-and-Interference Ratio
CQI Modula- DL Mb/s Typical Min.
Index tion In 20 Mhz Req C/(I+N)  LTE modulation and coding on downlink
0 Out of Range and uplink are adapted in real-time for best
1 QPSK 2.7 -6 results over the air interface
2 QPSK 4.2 -5  The mobile (UE) reports its Channel Quality
3 QPSK 6.8 -3 Index (“CQI”) frequently to the base station
4 QPSK 10.8 -1 (eNB) which adjusts its downlink rate as
5 QPSK 15.8 +1 shown at left
6 QPSK 21.2 +3  Three types of modulation are available on
7 16QAM 26.6 +5 the downlink: QPSK, 16QAM, and 64QAM.
8 16QAM 34.5 +8 The coding rate can also be adjusted to
9 16QAM 43 +9 produce a total of 16 graded speed levels.
10 64QAM 49 +11  The base station also chooses the
11 64QAM 60 +12 modulation and coding for each burst it
12 64QAM 70 +14 authorizes the mobiles (UEs) to transmit
13 64QAM 81 +16
14 64QAM 92 +18
15 64QAM 100 +20
Typical LTE Link Budget Example
s
Which Link is limiting, Uplink or Downlink?
Link Budgets: What is the Radius of a Cell?
4. Explore propagation model to figure coverage radius of cell.
Frequency, MHz. 870

Subscriber Antenna Height, M 1.5
Dense
Urban Urban Suburban Rural Highway
Base Station Antenna Height, M 20 20 30 50 50
Dense
Urban Urban Suburban Rural Highway
Environmental Correction, dB -2 -5 -10 -17 -17
Coverage Radius, kM 1.30 2.17 6.87 20.86 25.40
Coverage Radius, Miles 0.81 1.35 4.27 12.96 15.78
 This section uses the Okumura-Hata/Cost-231 propagation model

to describe the frequency, antenna heights, and environmental
factors, and their relationship on the cell’s coverage distance
Slide 459 Course 513v3.0- (c) 2013 Scott Baxter December, 2013
LTE Propagation Model and Design Software
 Four of the most popular RF design and

propagation prediction software products
are shown at right.
• Each uses sophisticated propagation
prediction models which can be “tuned”
to match field measurements
• Each allows system coverage and
performance calculations using LTE-
specific link budgets
 Forsk Atoll
 Mentum Planet
 EDX SignalPro
 Siradel Volcano
LTE Network Dimensioning:
Capacity
LTE Capacity Dimensioning Flow
LTE Cell Average Throughput Calculation
A “Monte Carlo” simulation takes predicted signal levels overlaid on a map

with roads and areas of fixed users, and generates simulated mobile activity
based on traffic density inputs and subscriber traffic models. It computes the
amount of traffic intercepted by each cell and predicts the data speeds on
each hypothetical call or call attempt. After running for a large number of
simulated calls, the traffic accumulated by each cell and the data speed,
along with estimates of failed access attempts and drops, are available.
LTE Cell Average Throughput
Practical Estimate of LTE Sector Throughput
 Taking channel size, channel quality/rate vs. distance and
overhead considerations into account, here is typical over-the-air
throughput:
Backhaul Capacity vs. Deployment Area
 LTE handsets are statistically distributed throughout the sectors

and don't download at maximum peak rates all the time.
• Overbooking Factor: also called contention ratio, it indicates
the number of users sharing the same data capacity at the
same time. It is an experience-based value and is sometimes
as high as 20; typically 3 on urban and 5 on lightly loaded sites
 Dense urban sites have higher mean peak data rates for handsets
due to the smaller cell coverage.
 Rural sites cover a much larger area and most handsets transmit
at lower peak rates, farther from the cell center. Figure above
provides an overview of backhaul capacity vs. cell site type.
Traffic Model Analysis
LTE Capacity Dimensioning Case Study
Active User Dimensioning
Active User Dimensioning Case Study
Active User Dimensioning Case Study
S1 & X2 Dimensioning Case Study (1)
S1 & X2 Dimensioning Case Study (2)
 These formulas estimate the additional overhead and control

messaging for the Control Plane, S1 interface, and X2 interface.
 The values shown are for one popular network manufacturer
 Each network manufacturer can provide formulas or rules of thumb
for their own products
LTE CELL SITE BACKHAUL REQUIREMENTS
 Having estimated the LTE

radio cell or sector peak data
throughput, we can look at
realistic cell site backhaul
requirements.
• Each LTE cell site typically
combines three LTE radio
sectors into one macro
site.
• The backhaul network
connects to it via the S1
interface as specified in R8
(Figure 2).
• This is a logical IP
interface split into a user
traffic session (S1-U) and
control part (S1-MME).
Site CoLocation
RF Configuration Considerations
Typical Co-location Scenario
- Separate Antenna & Feeder 1
- Separate Antenna, Shared Feeder 2
- Shared Antenna, Separate Feeder 3
- Shared Antenna & Feeder (1) 4
- Shared Antenna & Feeder (2) 5
Practical LTE Cell ID
And Neighbor List Planning
Cell ID and Neighbor List Planning
 The first release of SON (R8) includes two key 3GPP functions:
• Automatic Neighbor Relation (ANR)
• Automatic Physical Cell ID (PCI) Assignment
 However, most operators don’t use SON ANR and APCI for their
initial configuration. Instead, they prefer to use their RF
propagation prediction tools.
Physical Cell Identity (PCI) Planning
 After cell locations are planned and a radio network planning tool
shows good dominant coverage areas and adequate capacity, the
LTE Physical Cell IDs can be assigned.
 An automatic tool such as Atoll can generate a solid PCI plan
• it takes propagation into consideration to reduce the possibility
of Physical Cell ID conflicts
• Prevents cells with the same Physical Cell ID from overlapping
• Takes into consideration the neighbor cell relationships in the
assignment of Physical Cell IDs
• Can reserve codes for use with at new LTE sites in the network
to avoid the need to totally re-plan Physical Cell IDs
PSS, SSS, and Physical Cell ID Relationship
CELL ID
261
 Cell identity is a global cell ID that is used to
identify the cell from an OA&M perspective. PSS
0
 Primary Synchronization ID (PSS ID) ranges
from 0 to 2 cell by cell PSS 87 PSS
SSS
 Secondary Synchronization ID (SSS ID) ranges 2 1

CELL ID CELL ID
from 0 to 167 site by site 263 262
 Physical Cell ID = PSS ID + (3*SSS ID) (see
NO OVERLAP!
following table)
• can range from 0 to 503 (total of 504 PCIs) CELL ID CELL ID
382 382
• is used to scramble data to help the UE
distinguish and separate information from
different cells. CELL ID
456
 Physical Cell ID planning requirements:
• No cell’s coverage can overlap another cell
with the same ID
• No cell can have two neighbors with the CELL ID
same call ID 456
PSS, SSS, and Physical Cell ID Table
Geographic Depiction of Physical Cell ID Plan
Heterogeneous Networks
Traditional Network Architecture
 Traditional wireless systems were composed mainly of macrocells

• The network structure was homogeneous, composed of many
similar cells in a uniform fabric
• Cells covered large areas of a city or rural area
• Cells used relatively large transmit power and antenna heights
• Cells used conventional backhaul technologies
• Network growth was managed at a high level, with substantial
cost and effort levels involved in adding new or expanded cells
 Construction and Expansion of classical homogeneous networks
faces increasing obstacles
• Addition of new cells is expensive and slow
• major regulatory obstacles and public opposition are often
encountered
• Traffic bottlenecks are difficult to relieve
What’s a Heterogeneous Network?

macro and micro/pico/femtocells, delivering RF where it is needed most in both
outdoor and indoor environments
• Macrocells continue to deliver widespread public coverage
• Distributed antenna systems (“DAS”) serve large public venues where
traditional cells aren’t effective
businesses and problem areas
Heterogeneous Network Details
and Critical Considerations
 Multi-Band Deployment
• Overlay-Underlay, or Segmented?
– non-traditional spectrum strategies
• Micro-Pico-Femtocell on Customer Premises
• Backhaul availability and economics
• Pricing – operator vs. customer contribution, business plan
• Special factors: S1 vs X2? Doppler and other exotic triggers?
• WiFi access/offloading by UE?
• WiFi networks: operator provided, business-hosted, user
premises?
Introduction to
LTE Performance Optimization
Performance Optimization Perspective
 LTE is a complex marriage of advanced radio technology with

high-speed TCP/IP
• The LTE Radio Access Network (RAN), although more resilient
than earlier technologies, is still vulnerable to impairments from
RF causes
• The LTE Core Network, although more effectively structured
than in earlier wireless systems, still requires solid planning
and configuration and is vulnerable to the normal range of
issues faced by all TCP/IP systems
 Performance impairments are normally perceived by the end user
of data services in a TCP/IP data context, whether resulting from
RAN, Core Network, or external TCP/IP factors.
• Many problem symptoms are hard to identify as RAN, Core, or
external in origin
 The monitoring and investigative tools for identifying and resolving
problems are quite different for the RAN and the Core network
Types of LTE Performance Testing
 To most closely understand a user’s experience on the network,

and to benchmark overall performance, end-to-end (“E2E”) testing
is often the initial method used
• Measure data performance from user terminal to test server, or
from user-terminal to user-terminal
• Basic testing of latency and throughput can be performed with
user-level tools readily available on app stores and general
TCP/IP utilities
• More detailed results and organized benchmarking are
available from commercial tools which connect to user
terminals to other-end servers for more advanced test
capabilities
 When problems or performance issues appear in end-to-end
testing, more specific RAN and Core Network tools are then used
to drill down for problem location and root cause analysis
LTE Key Performance Indicators:
Radio Quality Measurements
Radio Quality Measurements
 A set of radio quality

measurements are
specified by 3GPP
36.214, “E-UTRA
Physical Layer
Measurements”
 Some are measured
by the eNB, and
some by the UE
 eNB vendors have some leeway in how they handle these
measurements using their own proprietary implementations, since
measurement reports for the S1 interface are not standardized.
 Usually the E-UTRAN measurement results will be sent to the
OMC via proprietary O&M interfaces.
 Radio quality is measurable on both UL and DL.
 On UL, the only parameter sent by the UE using a RRC
measurement report is the UE Tx power
Radio Quality Measurements (continued)
 The eNodeB can provide these measurements:

• Received Interference Power (RIP): the UL noise floor for a
set of UL resource blocks.
• Thermal noise power: This is the UL receive power for the
entire UL frequency bandwidth without any signals present
• Timing advance: This is the time it takes for the radio signal to
travel from the UE to the eNB’s receiver across the radio
interface. Thus, it is proportional to the distance between the
UE and the eNodeB.
 An scanning receiver or air interface analyzer can also provide:
• Channel baseband power: This is the power of a particular
physical channel in the time domain
• I/Q constellation diagrams: Indicate the quality/accuracy of
the modulated symbols received.
• Error vector magnitude: A measurement of how far “off” the
actual symbols are from their correct positions in the
constellation.
LTE Measurement: RSSI
LTE Carrier Received Signal Strength Indicator (RSSI)

 Definition: The total received wideband power observed by the UE
from all sources, including co-channel serving and non-serving
cells, adjacent channel interference and thermal noise within the
bandwidth of the whole LTE signal.
 Uses: LTE carrier RSSI is not used as a measurement by itself,
but as an input to the LTE RSRQ measurement.
LTE Downlink
LTE Measurement: RSRP
LTE Reference Signal Received

Power (RSRP)
 Definition: RSRP is the linear
average power of the
Resource Elements (REs)
carrying a specific cell’s RS
within the considered
measurement frequency
bandwidth.
 Uses: Ranking cells for
reselection and handoff.
 Notes: Normally based on the
RS of the first antenna port, but
the RS on the second antenna
port can also be used if known
to be transmitted.
RSRP UE Measurements: RSRP
dB
-50 RSRP is a measure of cell
downlink coverage
-60 • When triggered, the
UE sends RRC
-70 measurement reports
including RSRP,
-80 which is defined from
−140 to −44 dBm with
-90 1 dB resolution.
 UEs use RSRP to choose the best cell for access or handover.
-100  RSRP correlates with user plane QoS. Outdoor expectations:
• RSRP > −75 dBm gives excellent QoS.
-110
• RSRP between −75 and −95 dBm gives a slight degradation of the
QoS. Throughput declines by 30–50% between -75 and −95 dBm.
-120
• RSRP < −95 dBm gives unacceptable QoS. Throughput reaches
zero at approximately −108 to −100 dBm. Call drops will occur.
-130
• In-House cells often give usable QoS with RSRP down to
−115dBm, due to lower in-house interference levels
-140
RSSI and RSRP
 RSSI = wideband power= noise + serving cell power + interference

power
 Without noise and interference, 100% DL PRB activity:
RSSI=12*N*RSRP
• RSRP is the received power of 1 RE (3GPP definition) average
of power levels received across all Reference Signal symbols
within the considered measurement frequency bandwidth
• RSSI is measured over the entire bandwidth
• N: number of RBs across the RSSI is measured and depends
on the BW
 Based on the above, under full load and high SNR:
RSRP (dBm)= RSSI (dBm) -10*log (12*N)
LTE Measurement: RSRQ
RB RB RB RB RB RB RB RB RB RB RB RB
 LTE Reference Signal Received Quality (RSRQ)

 Definition: RSRQ = N · RSRP / RSSI
• N is the number of Resource Blocks (RBs) of the LTE carrier
RSSI measurement bandwidth. Since RSRQ exists in only one
or a few resource blocks, and RSSI is measured over the
whole width of the LTE signal, RSRQ must be “scaled up” for a
fair apples-to-apples comparison with RSSI.
 Uses: Mainly to rank different LTE cells for handover and cell
reselection decisions
 Notes: The reporting range of RSRQ is defined from −19.5 to −3
dB with 0.5 dB resolution. -9 and above are good values.
UE Measurements: RSRQ
 Like RSRP, RSRQ is used to determine the best cell for LTE radio
connection at a certain geographic location. However, while RSRP
is the absolute strength of the reference radio signals, RSRQ is the
signal-to-noise ratio. Like RSRP, RSRQ can be used as the
criterion for initial cell selection or handover. RSRQ is calculated by
the formula above.
 The following Slide shows how RSRP and RSRQ vary in the
outdoor environment due to varying propagation loss and
interference of various types.
RSRQ More RSRQ Details
dB -3
-4  The reporting range of RSRQ is defined from −19.5 to −3 dB
-5
with 0.5 dB resolution
-6  Comparing measured values of RSRQ and RSRP at one
-7
location will show whether coverage or interference problems
are present.
-8
-9 • If RSRP remains stable or gets better, but RSRQ is
declining, this indicates rising interference.
-10
-11 • If both RSRP and RSRQ decline, coverage is weak.
-12  This kind of logic helps in finding the root cause of drops due
-13 to radio problems.
-14  Three quality ranges can be defined for RSRQ:
-15 • RSRQ values above −9 dB give the best subscriber
-16 experience.
-17 • RSRQ of −9 to −12 dB degrades QoS, but with fair results.
-18 • RSRQ values of −13 dB and lower give reduced
-19 throughput and a risk of call drops.
SINR: LTE Signal vs. Noise And Interference
 SINR is a more practical measure of signal quality than SNR

 It is not defined in the 3GPP specs but rather by UE vendor. It is
not reported to the network.
 SINR is popular with operators since it better quantifies the
relationship between RF conditions and throughput
• Most UEs use SINR to calculate the CQI (Channel Quality
Indicator) they report to the network
 The components of the SINR calculation are:
• S: the power of measured usable signals, such as Reference
signals (RS) and physical downlink shared channels (PDSCHs)
• I: the power of measured interference from other cells in the
current system
• N: background noise power
 SINR can be defined as Wideband or Narrowband (for specific
subcarriers or a specific resource element)
•
How RSRQ and SINR Relate
 Cell traffic load influences RSRQ, but not SINR
 To “map” RSRQ vs. SINR, RE/RB is an important factor
• Used Resource Elements per Resource Block (in serving cell)
Power Headroom
 Power Headroom (PH), in dB, is the
difference between current UE PUSCH
transmit power and the UE’s maximum
capable power output
• it’s how much extra transmit power the
UE has left in reserve to be used in case
uplink conditions worsen
 PH reports can be sent either event-
triggered or periodically. The most common
trigger is a path loss change higher than a
predefined value when a timer expires.
Otherwise, periodic PH reporting starts when
the PH measurement task is configured or
reconfigured.
 UE PH reports are sent in MAC, not RRC.
 The eNB can set UE’s maximum transmit
power by the P-max parameter in RRC.
• PH runs from −23 to +40 dB. The 64
values correspond to 6 bits of the PH
control element in the MAC.
Maintenance mode in Samsung G3, G4, Note II
 You can put your mobile in

maintenance mode to see
LTE rf conditions wherever
you happen to be.
 For Samsung Galaxy 3
devices, try:
 First open phone dialing
screen
 *#22745927
 Then enable hidden menus
 Then press “back”
 Then *#0011#
 You’ll see the screen at right
Android Phone Software for
Field Performance Observation
 Android Market (Google Play) applications:

• “G-NetTrack”
• “CDMA Field Test”
 Other Interesting Apps:

• GeoCam Free
– Shows coordinates, azimuth, vertical, and pitch angles
• Clinometer
• AudioTool – by Jbunn
– Audio tone generator, spectrum analyzer, spectragram,
pulse reverberation testing in rooms, etc.
• Keyhole Radio – propagation prediction maps on your android
device for any frequency anywhere in the world
“Signatures” of Common LTE Conditions
 In a good LTE call, SIGNATURE:

GOOD CALL
• RSSI and RSRP will be well
above their respective noise RSSI RSRP RSRQ SINR Headroom
-50
floors -30 -3 +40 +40
-40 -60
• RSRQ will be -9 or stronger -50 -70 -6 +30 +30
• SINR will be +20 or stronger -60 -80

-9 +20 +20
-70 --90
• Headroom will be around or -80 -110 -12 +10 +10
better than +10 --90 -120

0 0
-15
-10 -10
-110 -130
-120 -140 -19.5 -23 -23
RSSI RSRP RSRQ SINR Headroom
UE
eNB Messaging
December, 2013 513 v3.0 (c) 2013 Scott Baxter 513 - 509
Signature of LTE Dropped Call in Poor Coverage
SIGNATURE:
 In bad coverage, poor RF DROPPED CALL, BAD COVERAGE
conditions will lead to call drops
 RSSI will be around the noise -30 -50 +40 +40
-3
floor, -115 or weaker -40 -60
 RSRP will be around or below -50 -70 -6 +30 +30
its noise floor, -135 or weaker -60 -80 +20 +20

-9
 RSRQ will be -12 or weaker -70 --90
+10 +10
-110 -12
 SINR will be below 0 -80
0 0
--90 -120
 Headroom will be well below 0 -130
-15
-10 -10
-110
-120 -140 -19.5 -23 -23
BTS Messaging
Signature of LTE Downlink Interference
SIGNATURE:
 In forward link interference, all the
FORWARD LINK INTERFERENCE
forward link indicators will be poor:
• RSSI will be normal, but its RSSI RSRP RSRQ SINR Headroom
-50
strength comes from the strong -30 -3 +40 +40
included interference -40 -60

+30 +30
-70 -6
-50
• RSRP will be lower than
-60 -80 +20
expected compared to RSRP -9 +20
-70 --90
• RSRQ will be lower than -80 -110 -12 +10 +10
normal, well below -9 --90 -120

0 0
-15
• SINR will be lower than normal, -110 -130
-10 -10
around 0 -120 -140 -19.5 -23 -23
 The uplink-related “Headroom” RSSI RSRP RSRQ SINR Headroom

measurement is independent of
downlink conditions; its current BTS Messaging
value isn’t affected by downlink
interference
Signature of LTE Uplink Interference
SIGNATURE:
 In LTE Uplink interference makes
REVERSE LINK INTERFERENCE
the UE transmit at higher power
trying to compensate RSSI RSRP RSRQ SINR Headroom
-50
• UE power Headroom will be -30 -3 +40 +40
driven down, even to 0 or -40 -60

+30 +30
-6
below in serious cases -50 -70
-60 -80 +20

 The Downlink indicators RSSI, -9 +20
-70 --90
RSRP, RSRQ, and SINR aren’t -12 +10 +10
-80 -110
directly affected by Uplink 0 0
-120
interference --90
-15
-10 -10
-110 -130
• Their values will be consistent -140 -19.5 -23 -23
-120
with whatever is happening on
the downlink at that moment
BTS Messaging
LTE Received Channel Quality Indication, CQI
CQI Modula- Code rate Efficiency Typ. Min.
Index tion x 1024 b/s/Hz Req C/(I+N)  LTE modulation is adapted in
0 Out of Range real-time to match existing RF
1 QPSK 78 0.152 -6 conditions reported by the UE.
2 QPSK 120 0.234 -5  Three types of modulation are
3 QPSK 193 0.377 -3 available, QPSK, 16QAM, and
4 QPSK 308 0.601 -1 64QAM. The coding rate can
5 QPSK 449 0.877 +1 also be adjusted through 16
6 QPSK 602 1.176 +3 steps.
7 16QAM 378 1.477 +5  The table at left shows the 16
8 16QAM 490 1.914 +8 CQI indexes, their modulation
9 16QAM 616 2.406 +9 and coding details, and the
10 64QAM 466 2.731 +11 resulting spectral efficiency of
11 64QAM 567 3.322 +12 the LTE signal in bits per
12 64QAM 666 3.902 +14 second per hertz of bandwidth.
13 64QAM 772 4.523 +16
14 64QAM 873 5.115 +18
15 64QAM 948 5.555 +20
General Wireless Key Performance Indicators
Common LTE Key Performance Indicators (1)
Accessibility
 Initial E-RAB Establishment Success Rate
 Add E-RAB Establishment Success Rate
 Retainability
 E-RAB Retainability
Integrity
Mobility
 Downlink Latency (first packet)
 Mobility Success
 Downlink Throughput Rate
 Downlink Packet Loss  Availability
 Uplink Latency  Cell Availability
 Uplink Throughput
 Downlink Packet Error Loss Rate
 Uplink Packet Loss Rate
Specific LTE Key Performance Indicators
The Key Performance Indicators for an LTE system fall into several
major groups:
 The most critical function in the E-UTRAN is the scheduling
algorithm implemented in the eNodeB
• This is the most critical and decisive function affecting the user’s
Quality of Service (QoS) and Quality of Experience (QOE)
• The most critical KPIs are those measuring scheduler
effectiveness
 Radio Quality Measurements
 Control Plane Performance Counters and Delay measurements
 User Plane QoS and QoE Measurements
LTE Troubleshooting
Latency Testing
 On the Android platform, the free

application “TracePing” will perform
multiple pings of any url or IP
address you give it, also locating
every node with an IP address
along the path. It shows packet loss
percentage to/from each node, as
well as the ost recent latency for
each node in the path.
Latency
Testing
 The free windows application WinMTR biy Appnor MSP will perform multiple pings
of any IP address you give it, also locating every node with an IP address along the
path. It shows packet loss percentage to/from each node, as well as the best,
average, worst and most recent latency for each node in the path.
X2 Load Indications
 Load indication messages sent periodically on the X2 interface are

a major input for the scheduler.
 Neighbor cells exchange loading indications to inform each other
about the UL resources are currently used.
• A cell would like ideally to schedule its UL traffic on resource
blocks that are not occupied by neighbor cells.
• However, scheduler works much faster than the information
can be exchanged between the neighbor eNBs. So the
scheduler will change the allocation of radio resources every
millisecond while the best possible time granularity for X2 load
indication reports is limited to 20ms.
• The load indication message – as on the next Slide – does not
contain scheduling information, but rather an abstract of the
overall situation on the UL radio path.
Example: X2 Load Indication Message
+--------------------------------------------------------------+------------------------------------+
|ID Name |Comment or Value |
+--------------------------------------------------------------+------------------------------------+
|X2AP 3GPP TS 36.423 V8.4.0 (2008-12) (X2AP) initiatingMessage (= initiatingMessage) |
|x2apPDU |
|1 initiatingMessage |
|1.1 procedureCode |id-loadIndication |
|1.2 criticality |ignore |
|1.3 value |
|1.3.1 protocolIEs |
|1.3.1.1 sequence |
|1.3.1.1.1 id |id-CellInformation |
|1.3.1.1.2 criticality |ignore |
|1.3.1.1.3 value |
|1.3.1.1.3.1 sequenceOf |
|1.3.1.1.3.1.1 id |id-CellInformation-Item |
|1.3.1.1.3.1.2 criticality |ignore |
|1.3.1.1.3.1.3 value |
|1.3.1.1.3.1.3.1 cell-ID |
|1.3.1.1.3.1.3.1.1 pLMN-Identity |'299000'H |
|1.3.1.1.3.1.3.1.2 eUTRANcellIdentifier |'00fce00'H |
|1.3.1.1.3.1.3.2 ul-InterferenceOverloadIndication |
|1.3.1.1.3.1.3.2.1 uL-InterferenceOverloadIndication-Item |low-interference |
|1.3.1.1.3.1.3.2.3 uL-InterferenceOverloadIndication-Item |high-interference |
|1.3.1.1.3.1.3.2.48 uL-InterferenceOverloadIndication-Item |high-interference |
Load Indication Messages and RNTP
 Besides the identity of the sending cell, the load indication message
contains three different parameters:
• UL Interference Overload Information.
• UL High Interference Indication.
• Relative Narrowband Transmission Power (RNTP).
 For each UL resource block the interference level at the sending cell is
reported as one of three values: high, medium, or low.
 This interference level depends on how many UEs are scheduled on the
reported Physical Resource Block (PRB) and their transmit power.
 Interference power level is measured for each UL transmission block.
 The UL High Interference Indication is encoded as a bit map. Each
position in the bit map represents a PRB (first bit = PRB 0, and so on).
Value “1” indicates “high interference” and value “0” indicates “low
interference.”
 If the LTE signal is 50 resource blocks wide, the bit map would consist of
50 bits. The maximum number of PRBs in an LTE cell is 110.
 In addition to the uplink measurements above, RNTP provides an
indication of downlink DL power restriction per PRB in a cell.
PRB Physical Resource Block Usage
 The eNB can report the usage of PRBs to the OMC, in these 5 ways:
 1. UL/DL total PRB usage: used as the traffic level indicator driving load
balancing information shared across the X2 interface.
 2. UL/DL PRB usage per traffic class: An aggregate for all UEs in a cell,
measuring just Dedicated Traffic Channels (DTCHs). The reference point
is the SAP between MAC and L1. The measurement is done separately
for DL DTCH for each QCI, and UL DTCH for each CQI.
 3. UL/DL PRB usage per Signaling Radio Bearer (SRB): This
measurement is applicable to Dedicated Control Channels (DCCHs). The
reference point is the SAP between MAC and L1. The measurement is
done separately for DL DCCH and UL DCCH.
 4. DL PRB usage for Common Control Channels (CCCHs), including the
Broadcast Control Channel (BCCH) and Paging Control Channel (PCCH).
The reference point is the SAP between MAC and L1.
 5. UL PRB usage for CCCHs: This is the percentage of PRBs used for
CCCHs’ Random Access Channel (RACH) and Physical Uplink Control
Channel (PUCCH). Value range: 0–100%.
Received Random Access Preambles
 The number of received random access preambles is an important

accessibility KPI for a cell.
 The more UE preambles it takes to get RACH resources assigned
by the cell, the longer it takes to set up a call or to complete a
handover.
 The worst cell is the one with the highest number of received
random access preambles.
• Worst case, the UE never gets access to the RACH – an effect
that is known in drive test campaigns as a “sleeping cell.”
Number of Active Users Over Time
 The number of active UEs is a gauge measurement, how many

subscribers on average use the cell over a defined period of time.
This is important for traffic and radio resource planning.
 OMC statistics are typically reported every 15, 30, and 60 minutes.
• However, the figure above shows a much finer time granularity.
This makes it easier to see peaks which could lead to a
shortage of radio resources in the cell.
Uplink Scheduling Requests
 A UE’s UL scheduling request asks for Uplink Shared Channel

(UL-SCH) resources for new transmission.
 This is also not a measurement for statistical purposes, but it is
essential for troubleshooting and optimizing the UL scheduling
function of the eNB.
 UL scheduling requests are sent on the MAC layer and can be
tracked for measurement purposes by an air interface tester and
visually displayed.
 There are no scheduling request statistics provided by the eNB.
Buffer Status Reporting
 Another important input for uplink scheduling sent via the MAC layer
is the UL buffer status report of the UE.
• It tells the serving eNB the amount of data waiting for
transmission at the UE.
 Buffer Status Reports (BSRs) are sent either periodically or event
triggered. Typical event triggers are:
• UL data becomes available for a logical channel in a logical
channel group to be transmitted in the (RLC) or PDCP entity.
• UL resources are allocated and the UE detects that more
padding bits are scheduled than the size of the BSR MAC control
element. This BSR is called a Padding Buffer Status Report.
• A serving cell change occurs or the retransmission timer for
BSRs expires while the UE has data waiting for transmission.
• The 3GPP specs call this a “Regular Buffer Status Report.” This
should trigger an UL scheduling request to be sent in parallel.
Buffer Status Reports and Bins
 Two BSR formats exist, short and long.

• Long format is used if more than one
logical channel group has data available
for UL transmission in the TTI where the
BSR is transmitted.
• Otherwise, the short format is used.
 For the reporting a binned format (index) is
used as shown in the table at right.
 There are no statistics for BSRs from the
eNB defined by 3GPP.
 The availability of measurement results for
troubleshooting and network optimization
depends on proprietary implementations and
the radio interface test equipment.
eNodeB Physical Layer Measurements
Received Interference Power (RIP)
 RIP is the noise floor in the UL
resource blocks.
• includes UL signals of all UEs in
UL resource blocks on one Rx
antenna.
• measured in the eNB, can also be
measured by air interface testers
connected to the eNB’s CPRI.
 runs −126 to −75 dBm, in 0.1 db bins.
 High indications can come from strong
adjacent-frequency external RF
interference sources.
 LTE’s time/frequency resource grid
reduces vulnerability to interference
• Steady interferors affect only a few
subcarriers
• Pulsed interferers like radar impact
only a few time sub-slots
Thermal Noise Power
 This is the UL noise for the entire UL frequency bandwidth of the

receiving cell without the signals received from LTE handsets, i.e.,
no traffic.
• It is measured by the eNB, and/or an air interface tester
 In the absence of any signal, the thermal noise power at room
temperature is approximately -174 dbm/hz. Therefore in typical
LTE bandwidths the noise power is:
• 1.4 MHz. -112.5 dbm
• 1.6 MHz. -111.9 dbm
• 3 MHz. -109.2 dbm
• 5 MHz. -107.0 dbm
• 10 MHz. -104.0 dbm
• 15 MHz. -102.2 dbm
• 20 MHz. -101.0 dbm
Timing Advance
 Timing advance is required to
synchronize the UE uplink
transmissions so they arrive at the eNB
at the correct instant.
• However, it is also a useful statistic
since it is proportional to the
distance from the UE to the eNB
 This figure shows three different UEs scheduled for the same UL sub-slot
on the time domain. Since the distance between each UE and the eNB is
different, signals from the farther UEs must must be sent in order to arrive
at the same time sub-slot at the eNB.
• By sending timing advance commands the eNB adjusts the proper
arrival time of all three UL radio signals individually.
 The initial timing advance command is sent together with the random
access response encoded in an 11-bit timing advance value TA.
• The 11 bits represent a range of timing advance values numbered as
integer index values of TA = 0, 1, 2, . . . , 1282.
• The TA step size is expressed in multiples of 16Ts, where Ts is the
basic time unit of the LTE radio interface, 32.552083 ns.
Timing Advance Calculations
 Ts is the basic time unit of the LTE radio interface:

• Ts = 1/ (15000 × 2048) s = 1/30,720,000 s = 32.552083 ns
 One step of timing advance (TA) is
• TA = 16Ts = 16 × 32.552083 ns = 0.52 μs
 The geographic distance for a single timing advance step is
• r = c × 16Ts = 300m × 0.52 = 156m
 A maximal timing advance index value of 1282 means
• the UE is 1282 × 156m = 199,992 m (~200 km) from the eNB
• After the RRC connection is established, the 6-bit timing
advance updates are sent on the MAC layer over the PDSCH
as needed
• These timing advance command values sent during the active
call are relative to the current UL timing, not absolute.
– They correspond only to the change in distance since the
last timing advance command was sent.
Dynamic Rate of Timing Advance Adjustment
 When a UE receives a timing advance command from the eNB, it

must calculate the new timing advance using the formula
• NTAnew = NTAold + (TA − 31) × 16
 The fastest rate of timing advance commands is 2 per second.
Using the 64 index values, a distance of 64 × 156m = 9984m
(roughly 10 km) is covered.
• Timing advance can be properly adjusted when the UE
changes its position relative to the eNB by ±5 km in as short a
period as within 500 ms.
• Theoretically this would be sufficient to handle mobile speeds
up to 3600 km/h. However sudden changes in path length can
occur in obstructed areas even during slow movement of the
mobile as different reflections come into view.
Modulation Quality:
EVM and Modulation Error Ratio
 The EVM is also called Receive Constellation Error (RCE).
• It reports the difference between measured constellation points
and their ideal positions
– in other words, how far the transmitter “misses” its target.
• Like I/Q constellation diagrams, the EVM can be measured
with radio interface testers but cannot be provided by any drive
test or eNB statistics.
• At right is an error vector diagram
– Notice the vectors:
P reference
P measured
P error
Transmitted Signal Impairments
 For the purpose of analyzing received signal quality, some types of

corruption are very evident in the constellation diagram. Typical
radio transmission problems can be easily recognized as follows:
• Gaussian noise makes the constellation points appear “fuzzy”.
• Non-coherent single frequency interference makes the
constellation points look like rough circles.
• Phase noise makes the constellation points look like stars in a
time exposure, traces not dots.
• Amplitude compression causes the corner points to be
“smushed closer in” than their proper positions at the edge of
the constellation.
 All of these diseases can result in the same problem – the receiver
has trouble properly recognizing the correct values of the symbols
being transmitted, resulting in bit and packet errors in receiving.
I/Q Constellations for Different Channels
 The I/Q constellation diagram can be measured on the transmitter

side showing quality of signal modulation before transmission over
the air interface.
 It’s better to measure the modulation quality of a received signal. A
high-quality air interface tester should provide the particular I/Q
constellation diagrams for the following physical channels:
• Physical Downlink Shard Channel (PDSCH).
• Physical Downlink Control Channel (PDCCH).
• Primary Synchronization Channel (P-SCH).
• Secondary Synchronization Channel (S-SCH).
• Physical Broadcast Channel (PBCH).
• Physical Uplink Shared Channel (PUSCH).
• Physical Uplink Control Channel (PUCCH).
• Sounded Reference Symbols (SRSs) for UL.
Random Access Failures
 Due to radio interface testers and eNB trace ports, it is fairly easy
to monitor the random access procedure.
• Now a random access success ratio KPI can be defined as
follows:
 Low percentage values of this KPI help identify cells with serious
problems on the radio interface
• the message defined for raw counters in this formula are the
first messages sent on the UL-SCH and Downlink Shared
Channel (DL-SCH) of a cell. If there are radio transmission
problems in a cell, the random access procedures will be the
ones most impacted. Failed random access also has the
highest user impact, because missing network access is
immediately recognized by a user.
Call Setup Failures
 If the definition can be agreed that a “call” is a single radio

connection between the UE and the network that is used to
transmit payload using multiple bearers and service flows, then all
failures that prevent a UE from attaching to the network and
enabling Public Data Network (PDN) connectivity can be
summarized by the umbrella term “call setup failures.”
 The strong link between attach to network and PDN connectivity is
also reflected by the standards, especially 3GPP 24.301 “NAS
Protocol for Evolved Packet System (EPS).” Here it is defined that
in case of an unsuccessful attach an explicit PDP connection
reject message should be sent to the UE to ensure proper
transitions of EPS Mobility Management (EMM) and ESM (EPS
Session Management) states in the UE’s NAS signaling entity.
Activate Default EPS Bearer Failure
 Even if the UE can successfully attach to the network, another potential

error could impact on the PDN connectivity: After the successful attach the
activation of the default bearer fails.
• In most cases the origin of this failure is in the UE itself. Although all
handsets undergo various load and stress test scenarios before they
become available on the market, but problems can still exist.
• This is addressed in the new LTE NAS protocol (3GPP 24.301).
 The next Slide shows the signaling in such failures. Activate Default EPS
Bearer Request is sent by the MME to the UE with Attach Accept.
• While Attach Accept is a mobility management (EMM) message,
Activate Default EPS Bearer Request belongs is a session
management (ESM) message.
• If the UE can’t confirm the successful default EPS bearer activation, it
will respond with an activate default EPS bearer failure message.
• This means the UE will remain attached to the network (NAS state:
EMM Registered) while it does not have an active bearer (NAS state
in UE: ESM Bearer Context Inactive).
• The lights are on, but nobody’s home!
Dedicated
Bearer Setup
Failures
 Whenever a
dedicated bearer
cannot be
established, access
to an individual
service and its
contents is blocked
for the subscriber.
 To properly measure user experience, this kind of failure should be aggregated
on a subscriber ID that can later be used to generate customer-centric reports.
 Aggregation of performance counters for dedicated bearer setup on the service
level (defined by the embedded QoS parameters in the bearer setup request
message) and on the location level (defined by tracking area and E-UTRAN cell
ID) is also highly recommended.
 Watch out! The message name for this bearer setup failure is “Successful
Outcome.” This is a carryover from RANAP outcome message in the UTRAN
which confirmed setup and/or failed setup for a list of multiple Radio Access
Bearers. This is why the message name in S1AP is now “Successful Outcome”
even if it reports that the required E-RAB could be established.
Dedicated Bearer Setup Failures (2)
 The most typical reasons for failed E-RAB setup are drops of the
radio connection before RAB establishment is completed.
 The eNB may also reject the setup of a particular bearer, because
it is not able to provide the necessary resources for the requested
service
• for example it can’t support the desired bit rates.
• Often the leak of resources isn’t related to availability of
subcarriers and time slots on the radio interface, but simply to
limited processing power and system memory in the eNB.
• Processors and memory to serve a certain number of
connections are found on so-called “channel cards,” boards
that allow scalability of hardware (and in turn scalability of the
hardware price) according to the amount of expected traffic.
• If the eNB’s hardware is inadequate this will result in error
messages with cause values like “not enough user plane
processing resources,” especially during peak hours of traffic.
Paging Failures
 The analysis of paging failures requires a distinct workflow for the

multi-step paging process, rather than just reacting to one KPI.
 Due to the tracking area concept of the E-UTRAN, the last known
location of a handset that misses a Page sent by the MME is pretty
accurately known.
 In a network where one cell has been assigned as a single
tracking area, the UE will be paged in a few cells only.
• In contrast 2G and 3G RAN paging messages are typically
sent to all cells of a particular Location Area Code (LAC)
– a few hundred cells compared to a few dozen in the E-
UTRAN.
 However, a paging failure ratio KPI on cell aggregation level will
always have a questionable value since a UE can only camp in a
single cell and there will be no paging response from most cells
which transmitted the page.
Paging Failures (2)
 The most common reasons for paging failures are:

• The UE is defective, failed without detaching from the network.
• The UE while in IDLE mode performed a new cell (re)selection
and is camping now on a 3G or 2G cell without informing the
network properly about the new location that is geographically
the same as before, but covered by a different RAT.
 Possible root causes of paging failures to be investigated
according to these symptoms are:
• defective handsets;
• insufficient coverage;
• wrong settings for broadcast cell (re)selection parameters like
S0 criteria.
• UEs “toggling” between 4G and 3G networks
 It makes sense to store the subscriber ID of UEs that do not
respond to pages and investigate the conditions leading up to their
paging failures including where they may have gone
Accessibility Delay Measurements
 Some access problems are due not to hard failures, but unacceptable
delay. The delay measurements are:
• Random Access Time: t MAC Random Access Preamble → RRC Connection
Request.
• RRC Connection Setup Time: t RRC Connection Request→RRC Connection
Setup Complete.
• NAS Attach Delay: t NAS Attach Request → NAS Attach Accept.
• Activate Default EPS Bearer Delay: t NAS Activate Default EPS Bearer
Request → NAS Activate Default EPS Bearer Accept.
• Initial Context Setup Delay: t S1AP Initial Context Setup Request → S1AP
Initial Context Setup Response.
• E-RAB Setup Delay: t S1AP E-RAB Setup Request → S1AP E-RAB Setup
Response.
• Service Request Delay: t S1AP Initial UE Message (NAS Service Request) →
S1AP Initial Context Setup Response.
• Paging Response Time: t S1AP Paging → S1AP Initial UE Message (NAS
Service Request).
 Correlate the observed delays with the handset type and initial timing
advance measurement from the random access response. This will help
recognize problems with different radio environments and handsets.
Network Retainability: Call Drops
 A “call” in the all-IP always-on E-UTRAN is really defined as a single radio

connection between a UE and the network.
 When this connection is suddenly interrupted (e.g., signal lost on the radio
interface), we call it a “dropped call”.
 Drop events can be found in the S1AP UE context release request message sent
by the eNB to the MME
 When this message is sent, the radio connection with the UE is already terminated
on the RRC layer, so UE and eNB go back to the E-UTRA RRC IDLE state.
 However, the PDN connection between the UE and the server hosting application
contents on the IP network is typically left active.
Handover Types
 LTE handovers can be classified by type:

• X2 handover/S1 path switch = Inter-eNB handover with X2.
• S1 handover = Inter-eNB handover without X2. Special cases
of this scenario are the inter-MME handover with/without S-GW
and/or PDN-GW relocation.
• Inter-RAT handover to 3G UTRAN.
• Inter-RAT handover to GERAN.
• Other inter-RAT handover types, for example, to TD-SCDMA
or CDMA2000 radio access technology (not discussed in more
detail in this chapter).
• Inter-RAT handover from 3G UTRAN to E-UTRAN.
• Inter-RAT handover from GERAN to E-UTRAN.
Handover Delay Reporting
 These statistics are:

• X2 Handover Delay = t X2AP Handover Request → X2AP Sequence
Number (SN) Status Transfer.
• S1 Path Switch Delay = t S1AP Path Switch Request → S1AP Path
Switch Request Acknowledge.
• S1 Outgoing Handover Preparation Delay = t S1AP Handover
Required → S1AP Handover Command.
• S1 Outgoing Handover Total Delay = t S1AP Handover Command
→ S1AP UE Context Release (“successful handover”). Although this
delay measurement is not meaningful for the user experience, it is
important to measure how long radio resources in the source eNB are
blocked after a handover command was sent to the UE.
• eNB Handover Command Latency = t S1AP Handover Command →
RRC Handover Command.
• S1 Incoming Handover Total Delay = t S1AP Handover Request
Acknowledge → S1AP Handover Notify.
• eNB Handover Success Latency = t RRC Handover Confirm →
S1AP Handover Notify.
Data Forwarding
 Data forwarding occurs in X2 handover procedures and can start

after the X2AP handover request acknowledge message is
received by the source eNB.
• To assist reordering packets at the target eNB, the S-GW
should send one or more “end marker” packets to the source
eNB using the old S1-U path immediately after switching the
path for each E-RAB of the UE.
• The “end marker” packets do not contain any user data and are
marked with a special flag in the GTP header. After sending
the “end marker” packets, the S-GW should not send any
further user data packets via the old path.
 After receiving the “end marker” packets from the S-GW on the old
S1-U path, the source eNB forwards the packet to the target eNB.
 The PDCP SN of forwarded Service Data Units (SDUs) is carried
in the “PDCP PDU number” field of the GTP-U extension header.
The target eNB should use the PDCP SN if it is available in the
forwarded GTP-U packet.
KPIs for Data Forwarding
 Important KPIs for data forwarding are:

• number of forwarded SDUs;
• number of lost SDUs;
• time difference t X2AP Handover Request Acknowledge → first
UP packet forwarded on X2;
• time difference t first “end marker” packet on old S1-U path →
first UP packet forwarded on X2
IP Throughput
 IP throughput is defined as the data volume of IP frames

transmitted over a specified period in the UL or DL direction.
 There are different versions and derivatives of IP. The protocols
supported include:
• IPv4 – Internet Protocol version 4 (32-bit addresses).
• IPv6 – Internet Protocol version 6 (128-bit addresses).
• PIP – The “P”-Internet Protocol.
• IP/ST – IP in ST datagram mode.
• TP/IX – The “Next” Internet Protocol.
• TUBA – Transmission Control Protocol/User Datagram
Protocol (TCP/UDP) over Connectionless mode Network
Protocol (CLNP).
TCP Startup KPIs
 For non-real-time services such as file transfer, web-browsing, and

e-mail a set of service startup failure ratio, service startup time, IP
service startup failure ratio, and IP service startup time KPIs is
defined in ETSI TS 102.250 together with other QoE KPIs such as
UL/DL throughput for individual services.
 Originally ETSI TS 102.250 was defined to measure QoS and QoE
KPIs with drive test equipment.
• That’s why we have different definitions for service setup time
and IP service setup time.
– service setup time refers to start trigger point of the first
real application frame sent, while
– IP service setup sees the trigger points for the start and
stop of delay measurements in the TCP layer.
TCP Port Numbers for Application Tracking
 Tracking setup times and other measurements for application

processes requires identifying the appropriate events.
 The TCP port numbers used for each application will be useful in
recognizing events involving each application.
TCP Round-trip Time Measurement
 The TCP Round-Trip Time (RTT) is the delay between sending a

TCP packet identified on behalf of an individual TCP SN in a
particular TCP flow and acknowledgment of this packet in the
same TCP flow.
 When implementing this measurement remember TCP has some
options to work with selective acknowledgments per RFC 2018.
• Here the acknowledgment number refers not just to a single
sent SN, but to a set of previously sent packets. The TCP RTT
is heavily influenced by radio quality and radio interface
procedures.
Packet Jitter
 Packet jitter is defined as the average of the deviations from the

network mean latency.
• It is an important QoS parameter for real-time services using
UDP transport due to their delay sensitivity.
• For non-real-time services like web-browsing or e-mail the jitter
has no impact on the user plane QoS.
 Jitter’s impact is easiest to understood thinking about a constant
stream of VoIP packets. Thousands of small voice packets must
be received with high reliability and continuity for reassembly and
smooth playback.
• If the re-assembling entity must wait longer for some individual
packets – even if they are received error-free – this will cause a
delay in the reassembly and conversion back to speech. In the
worst case this can be heard as a gap in the audio signal.
Packet jitter is a simple measurement that allows one to
estimate the risk of experiencing such gaps.
Examining LTE System Statistics
and Operational Measurements
System Statistics
 Optional Exercise:
• Let’s look at available counter and statistical data from your
own network statistics tools
• We can explore the available manufacturer documents to
become more familiar with the statistics and counters available
from your network
LTE RAN Optimization Tools
LTE RAN Testing
 Successful RAN problem resolution focuses especially on the

lower levels of the protocol stack
• RF performance – the Uu interface
– Terminal and eNodeB signal quality tests
– Dynamic field capture of RF indicators
– Field RF environment testing, interference detection
• “Call Processing” Event Capture and Performance Analysis
– MAC layer performance
Process monitoring, parameter capture, and problem
detection for unsuccessful events
Handover monitoring and configuration analysis
– Messaging Capture and Interpretation
Identification of specific failed events and root analysis
LTE RAN Test Tools
Multiple tools are available for RAN testing:

 UE-intrinsic diagnostic and status displays
 Specific UE logging applications for more detailed capture of RF
conditions and “signatures”
 Commercial Off-Air receivers for field signal analysis of both uplink
and downlink conditions
 Commercial “call processing” capture tools logging UE RF
indications, MAC-level and Message-level activity, and state
changes of the UE
 RAN Manufacturer-specific logging/capture and reporting utilities
for eNodeB RF indications and event records
 Post-Processing software tools for merging and analysis of
captured field and RAN-side RF data to support detailed analysis
of performance problems
 The following Slides list many available tools, in alphabetical order
by manufacturer
Agilent RF Tools
 Agilent (formerly Hewlett-

Packard, HP) has a long
history of in RF tools
 A few years ago Agilent
sold its wireless
optimization product line to
another company, JDSU
 However, Agilent continues
to offer its own drive-test
collection solution, the
E6474A and W1314
receiver family (above)
 Agilent also offers spectrum
analyzers for both lab and
field environments such as
the Fieldfox N9912A, below
Anite Field Test Products
Anite in Finland absorbed the former Grayson wireless and Handy
offers its own comprehensive system of optimization tools
 Handy – android-based portable
FSR-1
 NEMO Autonomous
• Unattended/mobile data collection Autonomous
 NEMO CEM customer experience tool Outdoor
• Reporting software on subscriber handsets and
back-end processor
CEM
 NEMO FSR1
• Modular Receiver data collection
 NEMO Outdoor
• Full-featured data collection in portable package
 NEMO Invex Analyze
• Multi-device data collection for benchmarking and in-
depth problem capture
 NEMO Analyze post processor
• Problem analysis, benchmarking Invex
Anritsu RF Tools
 Anritsu’s traditional strength has been in spectrum

analyzers, line testers, and big-ticket testers for
Handset and BTS manufacturing
 Anritsu has boldly entered drive-test and network
performance optimization with two new products:
 Link Master LML – Air Interface Logging Tools
• logs air interface data taken during a drive test
from multiple UEs or receivers on a PC.
 Link Master LMA – Air Interface Analysis Tools
• provides in-depth analysis of the post processed
log data on a PC.
Ascom-TEMS RF Tools
TEMS INVESTIGATION TEMS DISCOVERY
 Ascom acquired the earlier Ericsson TEMS tool

 Ascom-TEMS offers a field data acquisition system called
TEMS Investigation. It collects RF field data from UEs,
scanning receivers, and GPS.
 TEMS Discovery is a post-processing tool which allows root TEMS Pocket
cause analysis of RF environment and event failure problems
captured by TEMS Investigation
 TEMS Pocket is performance data and event capture
software which runs on a UE for collection and display in
almost any conceivable location Scanners
 TEMS Automatic automonously collects field RF and event

data and uploads it to servers without manual intervention. If
mounted in public transport or commercial service vehicles, it
can collect wide-area data without operation intervention. TEMS Automatic
DRT – Digital Receiver Technologies
E-UTRA Carrier RSSI

UTRA FDD Carrier RSSI
GSM Carrier RSSI Carrier Frequency Offset
RS CINR SCH CINR
Reference Signal Received Power PSCH Detection
(RSRP) - Physical Layer Cell Identity
Reference Signal Received Quality - PSCH Power
(RSRQ) - PSCH Quality
Spectral Display SSCH Detection
Channel Response - Physical Layer Cell Identity Group
Delay Spread - SSCH Power
Multipath Count - SSCH Quality
 DRT, owned by Boeing, offers a compact digital receiver/scanner

covering 2-3000 MHz. supporting LTE and most other wireless
technologies in addition to spectrum analysis
 It offers its own windows and android management/analysis
software, or the receiver can be managed by other companies’
software such as Ascom TEMS
JDSU RF Tools
 JDSU purchased the wireless test product line of Agilent and has
expanded it to provide end-to-end testing of LTE systems,
integrating RF field-collected data with messaging captured from
the interfaces between RAN and Core Network for powerful event
and root cause analysis
PCTEL RF Tools
 PCTEL has developed a line of

particularly fast scanning receivers for
all wireless technologies including LTE
 The receivers are substantially faster
than most competitors, allowing much Scanning Receivers
more dense and revealing RF data to
be collected with less time in the field
 Because of their small size, the
receivers are suitable for both indoor
and outdoor surveys
 Advanced signal processing capability
Indoor-Outdoor Measured Propagation
allows evaluation of MIMO
effectiveness and benchmarking
MIMO results against prior results over
time
LTE Speed, Diversity vs 4-branch Mimo

Rohde & Schwarz RF Tools
 The Rohde-Schwarz TSMW scanner provides

very rapid scanning and measurement of LTE
parameters
• RSRP, RSRQ narrow and wideband,
RSSI, Ptot, SINR, RS-SINR, ISI, CIR,
Doppler shift, CP type, MIMO CN
• Available technologies LTE-FDD, LTE-
TDD, GSM, WCDMA, CDMA2000,
1xEVDO 0/A/B, WiMAX
• Also integrates/collects UE data
 Rohde-Schwarz ROMES4 post processing
software analyzes data from all technologies
collected by the TSMW scanner and provides
detailed event-processing and messaging
analysis
 The Rohde-Schwarz PR100 real-time
spectrum analyzer is the most advanced and
sensitive interference detection device
available to civilians in the western countries
Tektronix RF Tools
 Tektronix is a long-established test

equipment manufacturer in both the RF
and network arenas.
 In the RF area, Tektronix does offer
leading-edge spectrum analyzers with
advanced interference detection
capabilities. However, it does not offer a
general field wireless RF optimization
tool to collect messaging and layer-2
data for call processing analysis.
 In the data arena, Tektronix has
developed advanced IP and core network
monitoring tools well-suited to analysis of
LTE systems. These will be described
along with other core-network-centric
tools in the next section.
Transcom Instruments
 Transcom Instruments of Shanghai, China offers a cost-effective

LTE scanning receiver and analysis software
 Eagle: LTE Scanner supports TDD-LTE and FDD-LTE in all band
classes using a DSP-based engine with rapid scanning and high
dynamic range
 EMAS: Eagle Measurement & Analysis System automatic signal
measurement and analysis software can operate multiple Eagle
Scanner Receivers. It includes GPS, displays and is compatible
with a wide variety of available maps for display and analysis
LTE Core Network
Monitoring/Optimization Tools
Core Network Tools
 Core Network Tools monitor the various interfaces within and around the
LTE core network to collect packet and messaging information about
interface and node conditions, failed processing events, traffic levels, and
other network statistics.
 Manufacturers of the core network nodes provide their own generic and
proprietary counters and indicators for the performance of their network
elements and the interfaces they use. These provide the main operational
statistics upon which LTE operators rely on to manage their networks
ordinary operation.
 Test equipment manufacturers provide data monitoring and collection
tools which capture TCP/IP packets and network events. The
manufacturers also provide various software tools for post-analysis of the
collected data, making it possible to zoom in on specific types of packets
and events and drill down to first causes.
 Some tools provide simulation of traffic and simulation of various network
nodes to support core network design and element selection, beyond the
narrower function of optimization.
 Following Slides describe available core network analysis tools.
Agilent Core Network Tools
 In addition to its
LTE RF
optimization tools
and broad line of
spectrum
analyzers and
other RAN-related
equipment, Agilent
also offers a
series of
Distributed
Network
Analyzers and
analysis software
for deep study and
event capture in
the LTE Core
Network
JDSU Core Network Tools
 In addition to its RAN test products, JDSU also offers extensive

core network data collection and analysis tools including special
emphasis on services such as video/TV and IMS for VoLTE.
Tektronix Core Network Tools
 Tektronix provides data probes to monitor all TCP/IP interfaces of an LTE network,
both in the RAN and the Core, along with its IRIS Performance, Traffic and Protocol
analyzers and new Spectra2 XL3 IMS and EP3 test application.
Examining LTE
Message and Event Records
Wireshark
http://www.wireshark.org/download.html
 Wireshark is a free, open-source packet capture and analysis tool

 Wireshark is a “poor man’s friend” tool for high quality (if somewhat
tedious) analysis of packets from any of the LTE RAN and Core
Network interfaces
 The desired packet streams must be captured by other software or
hardware probes
 Many templates for analysis of LTE call processing events are
already available through resource blogs and online collaborations
using Wireshark
cc
Example RRC Traffic: Connection Setup
Example: (MAC) for LTE
MAC-LTE Statistics
 MAC-LTE statistics can be viewed in a window
• see Telephony | LTE | MAC ...
 Also can be viewed in tshark using the -zmac-lte,stats option.
PDCP-LTE Traffic Example
Traffic Example: RLC for LTE
LTE RLC Traffic Statistics Example
Some Useful LTE Links and References
 EARFCN calculator – convert between frequencies/channels

• http://niviuk.free.fr/lte_band.php
 Excellent resource grid visualization and configuration explorer
 A good collection of short explanations on many LTE topics
• http://www.sharetechnote.com/html/Handbook_LTE.html
 Excellent blog from the UK:
• http://radioaccess.blogspot.com/
Course 312
Technical Introduction to GSM,

GPRS/EDGE, and UMTS/WCDMA/HSPA

312 Course Contents
 Introduction
 The “Mother” of 2G Technologies: GSM
• The Air Interface, Core Network and Network Elements
 Data over the 2G GSM Signal? GPRS and EDGE, “2.5G”
• Additional Network Elements; Packet Network Operation
 True 3G, UMTS/WCDMA Basics
• UMTS Core Network, BTS is Node B, mobile is UE
 The WCDMA Air Interface
• CDMA but with some different twists
 Channels and Protocols, Application Parts, Handover
 IMS: The IP Multimedia Subsystem
 Moving UMTS Higher: HSPA – “the EVDO of WCDMA”
 The Upper Limits: HSPA+ MIMO and Carrier Aggregation
 The Final Frontier: Migration to LTE
Introduction
ETSI TIA
Pre-
Cellular
IMTS 1961
1G
9600 b/s
Analog 1983
NMT AMPS
1981, 1986 ETSI TIA
Pre-
Cellular
IMTS 1961
1996
14-304 kb/s
EDGE
1xRTT
GPRS 2G CDMA
GSM
1991 1996
1G
9600 b/s
Analog 1983
NMT AMPS
1981, 1986 ETSI TIA
Pre-
Cellular
IMTS 1961
2009 2006
3-7 Mb/s
HSPA
2003 UMTS 3G EV-DO
WCDMA
2002
1996
14-304 kb/s
EDGE
1xRTT
GPRS 2G CDMA
GSM
1991 1996
1G
9600 b/s
Analog 1983
NMT AMPS
1981, 1986 ETSI TIA
Pre-
Cellular
IMTS 1961
LTE LTE
100 Mb/s +
2010 ETSI 4G TIA 2010
2009 2006
3-7 Mb/s
HSPA
2003 UMTS 3G EV-DO
WCDMA
2002
1996
14-304 kb/s
EDGE
1xRTT
GPRS 2G CDMA
GSM
1991 1996
1G
9600 b/s
Analog 1983
NMT AMPS
1981, 1986 ETSI TIA
Pre-
Cellular
IMTS 1961
The Role of Standards Organizations
 Our modern wireless technologies have been created by many

companies and wireless groups working together under the
leadership of standards organizations
 In the United States, we have a history of individual companies
developing products which became so widely used that they are
regarded as “de facto” standards in an industry
• For example, Motorola, E. F. Johnson, and others developed
individual standards for two-way “trunked radio” used by
individual businesses and law enforcement
• De facto standards usually involve intellectual property and
patents of their developers and hefty licensing fees are
charged for other companies to use the same techniques
 The European way to manage standards is to use standards
organizations to “sponsor” specific standards, and to persuade
developing companies to allow use of their proprietary techniques
at reasonable prices to allow competition and wide adoption
Wireless Families and Standards Organizations
 The ITU (International Telecommunications Union) is the “mother”

umbrella organization for telecommunications standards around the world
• Standardizes radio spectrum assignments around the world, providing
a forum for negotiation between industries and governments
 The ETSI (European Telecommunications Standards Institute) is the
official sponsor of GSM, GPRS, EDGE, UMTS, and HSPA, and a
competitor to CDMA, EVDO, and WiMAX
 ANSI (American National Standards Association) issues voluntary
consensus standards for a wide range of products, from photographic film
speeds to manufacturing processes, alternative fuels, and even WiMAX,
aiming for American products to be usable around the world
 The TIA (Telecommunications Industry Association) is a technical forum
producing standards for North American telecommunications
• It issues wireline and wireless telephone standards, including AMPS,
CDMA, EVDO, WiMAX,
 The EIA (Electronics Industry Association) represents electronics
manufacturers primarily in North America
Largest US Wireless Providers YE 2012
333M total
Subs (M)
MVNOs and
Cellular PCS AWS
800 1900 1700/2100

National
UMTS
103 GSM LTE
HSPA
WiMAX
CDMA
56 LTE-TDD
EVDO
IDEN
GSM
34
HSPA+
CDMA
CDMA
12 EVDO
EVDO
Regional
LTE
CDMA CDMA
11 EVDO EVDO
LTE LTE
CDMA CDMA
8 EVDO EVDO
LTE LTE
The US CDMA Providers
196M total
Subs (M)
MVNOs and
Cellular PCS AWS
800 1900 1700/2100

National
WiMAX
CDMA
56 LTE-TDD
EVDO
IDEN
CDMA
CDMA
12 EVDO
EVDO
Regional
LTE
CDMA CDMA
11 EVDO EVDO
LTE LTE
CDMA CDMA
8 EVDO EVDO
LTE LTE
The US GSM Providers
137M total
Subs (M)
MVNOs and
Cellular PCS AWS
800 1900 1700/2100
National
UMTS
103 GSM LTE
HSPA
GSM
34
HSPA+
Regional
312 - 597 Course 312 v3.0 (c)2013 Scott Baxter December, 2013
with handoffs
Progress in
to
and Frequency Reuse
B D
A C
Progress in TDMA (US)
1xRTT RC4
1xEV-DO
Analog*
Signal
CDMA
GPRS
EDGE
GSM
UMTS HSPA LTE
Technology
Signal Bandwidth, MHz = 0.03 0.03 0.2 0.2 0.2 1.2 1.2 1.2 3.84 3.84 20
User Bits/Second = 9600* 28k 104k 160k 384k 360k 720k 3.1M 2M 8M 100M
Signal Efficiency bits/Hz = 0.3* 0.9 0.5 0.8 1.9 0.3 0.6 2.4 0.5 2.1 5.5
Frequency Reuse N = 7 7 3 3 3 1 1 1 1 1 ~3
MIMO factor = 1 1 1 1 1 1 1 1 1 1 4
Spectral Efficiency bits/Hz/Area = 0.04 0.13 0.17 0.27 0.63 0.3 0.6 2.4 0.5 2.1 7.3
Progress in
Devices

frequency
TDMA: IS-136, GSM
other time slots.
CDMA
of its own
GSM: The “Mother” of
2G Wireless Technologies
The Birth of GSM
 In 1983, The US had just implemented its analog cellular systems,

using the AMPS technology – Advanced Mobile Phone Service
• Developed by AT&T Bell Labs, with Motorola contributions
 Europe preferred to leapfrog to a digital technology, standardized
so it could be implemented internationally on a wide scale
 The ETSI Group Special Mobile (GSM) developed the standard,
which bears its initials, in 1982
• Today marketed as “Global System for Mobile communication”
 GSM was field-tested in 1986, a “memorandum of understanding”
signed in 1988, and commercially launched in 1991
• By 1995 coverage of most of Europe was complete
 Today there are more than 5 billion GSM users in 212 countries
worldwide, about 80% of the global mobile market.
Standards for just Radio,
or the whole Network?
 The American cellular technologies AMPS (TIA-EIA 553), US

TDMA (IS-136) and CDMA (IS-95) all began as radio standards,
specifying the radio signal details without much reference to the
elements of an overall network
• A separate standard, IS-41, had to define how networks would
handle intersystem handoff and roaming call delivery
 The ETSI standards for GSM, GPRS and EDGE in contrast
provide extensive specifications not only for the radio signal but
also for the major functional blocks of the network and the network
functioning as a whole
• This allows much better interworking between networks of
different operators, and even some limited opportunities to
blend equipment from different manufacturers into the same
network, for cost savings and easier expansion
The Frequencies Used by GSM
 GSM operates in a wide variety of frequency bands worldwide
 Spectrum is provided in “blocks” or “bands”
• Base stations transmit in the upper block
• Mobiles transmit in the lower block
 GSM carriers are normally operated 200 KHz. apart but
frequencies are numbered in 100 KHz. Increments within the
operator’s licensed block of spectrum
 GSM/GPRS/EDGE/UMTS-WCDMA/HSPA signals operate on
numbered frequencies.
• The channel numbers are unique, in other words, the same
numbers are not used in more than one band and the uplink
and downlink frequencies have different channel numbers
• Channel numbers are officially called “Absolute Radio
Frequency Channel Numbers (ARFCNs) and there is a handy
lookup utility on the website:
http://niviuk.free.fr/lte_band.php
December, 2013 Course 312v3.0 (c) 2013 Scott Baxter Slide 603
Structure of a GSM Signal
 GSM is a TDMA system with

carriers spaced 200 kHz. apart
 In the BTS downlink signal, different 8 Slots
Required
1
2
C/I 9-12 dB
timeslots belong to different users - 3
4
a mobile listens only to its own
recurring timeslots 200 kHz
Typical Frequency Reuse N=4
• During unused timeslots, a
mobile can measure the signal
strength of surrounding BTSs to
guide the handover process Downlink
 On its uplink, a mobile transmits
3 slots
only during its assigned timeslots
• Mobiles transmit only during BTS
their own timeslots
• Mobile transmit timeslots occur
three timeslots after the Uplink
corresponding BTS transmit
timeslot
– This avoids the need for
simultaneous mobile TX/RX
and a mobile duplexer
GSM On Radio: Time Division Multiple Access:
GSM Uplink and Downlink Frequencies and Timing
Uplink Downlink
D
B H
G
E D
C
F B H
A
G
BCCH C E
Frequency
C – voice user
E – voice user
F – voice user
G – voice user
H – voice user
Multiple Carriers in a GSM Cell
Time
Frequency 6 TS1 TS2 TS3 TS4 TS5 TS6 TS7 TS8
1 timeslot 577 μs
1 frame 4.615 ms
 A GSM base station transceiver makes a signal ~240 kHz. wide
 The signal is time-divided into a repeating pattern of frames
• Each frame is 60/13 = 4.615 ms long, there are ~221.5 frames per second
 Each frame is further subdivided into 8 timeslots, each 15/26 ms = 577 μs long
• A timeslot can hold the bits of a channel of information
– One user’s voice signal, or a signaling/administrative channel
 One GSM base station can have several transceivers, each one producing a
GSM signal on a different frequency - six carriers in the example above
• Various repeating patterns of information can use the timeslots to carry
channels of information
Channels in GSM: Repeating Patterns
 Channels of information in GSM occupy physical timeslots of the GSM

signal in repeating patterns
• Similar to the way that classes and activities of a university occupy the
physical classrooms on a defined schedule
– Some classes meet daily, some only three days a week
– Some labs once or twice a week
– Meals daily in the cafeteria, entertainment at night
– Graduation ceremonies each semester
 Dedicated channels (carrying traffic or control information for individual
users) occur in a repeating 26-multiframe pattern 120 ms long
• 24 frames are used for traffic, one for SACH, one is unused
• Full-rates occur in each traffic frame
• Half-rates (if used) occur in alternating traffic frames
• 1/8 rate dedicated channels are defined for special purposes and are
called SDCHs (Stand-Alone Dedicated Control Channels)
GSM Traffic Channels:
Hyperframes, Superframes, Multiframes, Frames, and Bursts
One Hyperframe
2048 superframes 3h 28m 53.760s
0 1 2 3 4 5 2044 2045 2046 2047
51 multiframes of 26 frames each 6.120 s
One
Superframe 0 1 2 3 4 5 6 47 48 49 50
UNUSED
One 26 s SACH s
Used for traffic channels and
Multiframe
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
0 1 2 3 4 5 6 7 8 9
associated signaling only
26 frames 120 ms
One
Frame BP 0 BP 1 BP 2 BP 3 BP 4 BP 5 BP 6 BP 7
1 frame 60/13 ms ~4.615 ms
Stealing Stealing
Bit Bit
One Burst (156.25 bits)
Tail Bits
Tail Bits
Training Guard
Data Bits Data Bits Bits
Sequence
3 57 bits 1 26 bits 1 57 bits 3 8.25 bits
15/26 ms
Gross Rate 270.833 kbps ~0.577 ms
GSM Control Channels:
Hyperframes, Superframes, Multiframes, Frames, and Bursts
One Hyperframe
2048 superframes 3h 28m 53.760s
0 1 2 3 4 5 2044 2045 2046 2047
26 multiframes of 51frames each 6.120 s
One
Superframe 0 1 2 3 24 25
not used 50
CCH0 or
BCH 1
BCH 2
BCH 3
BCH 4
SYS_INFO CCH3 or CCH4 or CCH5 or CCH5 or CCH6 or CCH7 or

SCH
SCH
SCH 21
SCH 31
SCH 41
FCH
FCH
FCH 20
FCH 30
FCH 40
7&8 CCH 1 CCH 2 SDCH SDCH SDCH SDCH SACH SACH
One 51 0
10
11
12
13
14
15
16
17
18
19
22
23
24
25
26
27
28
29
32
33
34
35
36
37
38
39
42
43
44
45
46
47
48
49
1 2 3 4 5 6 7 8 9
Multiframe
51 frames 235.38 ms
Used for control channels only
One BP 0 BP 1 BP 2 BP 3 BP 4 BP 5 BP 6 BP 7
Frame 1 frame 60/13 ms ~4.615 ms
Stealing Stealing
Bit Bit
One Burst (156.25 bits)
Tail Bits
Tail Bits
Training Guard
Data Bits Data Bits Bits
Sequence
15/26 ms
Gross Rate 270.833 kbps ~0.577 ms
Typical Timeslot Allocation in Multiframe Patterns
on One GSM RF Carrier
TIME
S S
TimeSlot T T T T T T T T T T T T A T T T T T T T T T T T T T T T T T T T T T T T T A T T T T T T T T T T T T
IDLE
IDLE
C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C
7 H H H H H H H H H H H H C H H H H H H H H H H H H H H H H H H H H H H H H C H H H H H H H H H H H H
H H
S S
IDLE
IDLE
H H
S S
IDLE
IDLE
H H
S S
IDLE
IDLE
H H
S S
IDLE
IDLE
H H
S S
IDLE
IDLE
H H
Frame 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
Number
26 Multiframe Pattern for Traffic Channels 26 Multiframe Pattern for Traffic Channels
S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S S
D D D D D D D D D D D D D D D D D D D D D D D D D D D D D D D D A A A A A A A A A A A A A A A A
TimeSlot C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C
IDLE
IDLE
IDLE
C
1 C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C C
H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H H
0 0 0 0 1 1 1 1 2 2 2 2 3 3 3 3 4 4 4 4 5 5 5 5 6 6 6 6 7 7 7 7 0 0 0 0 1 1 1 1 2 2 2 2 3 3 3 3
A A A A A A A A A A A A
B B B B G G G G G G G G G G G G S S S S S S S S S S S S S S S S S S S S
TimeSlot F C C C C F S C C C C C C C C F D D D D D D D D F S C C C C D D D D F S A A A A A A A A
C S C C C C H H H H C C H H H H H H H H C S C C C C C C C C C C B B B B C C C C C C C C C C C C C C
IDLE
0 C C C C C C / / / / C H / / / / / / / / C C C C C C C C C C C H C C C C C C C C C H C C C C C C C C
H H H
1
H
2
H H
4 P P P P H P P P P P P P P H H H H H H H H H H H H H H H H H H H H H H H H H H H H
3 C C C C C C C C C C C C 0 0 0 0 1 1 1 1 3 3 3 3 0 0 0 0 1 1 1 1
H H H H H H H H H H H H
Frame 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3 3 3 3 3 3 3 3 3 4 4 4 4 4 4 4 4 4 4 5
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0
Number
51 Multiframe Pattern for Control Channels

A GSM Uplink Normal Burst
 GSM is a TDMA system and a mobile’s transmission bursts are carefully

constructed so as not to overlap with bursts from other mobiles
 Different propagation delays of mobiles near and far mobiles the BTS are
compensated by automatically advancing mobile transmit timing
 Special training sequences are included in each uplink burst and downlink
timeslot to facilitate demodulation
 During unused timeslots, a mobile measures the strength of surrounding
base stations to guide the handover process (this is called MAHO, Mobile
Assisted Hand Over)
GSM Bursts on the Uplink: 4 Types
Frequency Correction Burst or Dummy Burst

Guard
Tail
Tail
Fixed ‘0’ or Fill-in Bits Bits
3 142 bits 3 8.25 bits
Synchronization Burst
Guard
Data Bits Training Bits
Tail
Tail
Data Bits Bits
3 39 bits 64 bits 39 bits 3 8.25 bits
access Burst
Tail Guard
Tail
Bits
Training Bits Data Bits Bits
8 41 bits 36 bits 3 68.25 bits
Stealing Stealing
Normal Burst Bit Bit
Guard
Tail
Tail
Data Bits Training Bits Data Bits Bits
GSM Channels
DOWNLINK CHANNELS UPLINK CHANNELS
BTS identity, channel allocation,
BCH frequency hopping sequences
Slotted aloha channel used to
FCH Provides frequency reference request network access RACH
Defines burst period boundaries
SCH and time slot numbering
Carries Pages to mobiles,
PCH alerting of incoming calls
Stand Alone Dedicated
AGCH
Allocates SDCH to mobile to
Control Channel SDCH
obtain dedicated channel after
a request on the RACH
Traffic Channel
Fast Associated Control

BTS Channel FACH
Slow Associated Control
Channel SACH
0 to many F-TRAFFIC
Stand Alone Dedicated
SDCH Control Channel
Traffic Channel
Fast Associated Control Channel

FACH
Slow Associated Control Channel
SACH
Basic GSM Network – Voice Only
NSS BSS
HLR BSC
MSC BTS
PSTN MS
TRC
OMC-S OMC-R
 MS – mobile station OSS
 BSS – base station subsystem
• BTS – base transceiver station, BSC – base station controller
 NSS – network subsystem
• MSC – Mobile Switching Center
 PSTN – public switched telephone network
 OSS – Operations Subsystem
• OMC-R – Operation and Maintenance Center – Radio
• OMC-S – Operation and Maintenance Center – System
Compare with
A CDMA Network – Voice Only
HLR BSC
MSC BTS
PSTN MS
V
 The elements in a CDMA voice-only network map almost exactly to

their counterparts in a GSM voice-only network.
 Americans are just a little less formal about the overall architecture of
things, allowing each network manufacturer to implement the
connections between elements and the overall network organization as
they wish

Data over the 2G GSM Signal?
GPRS and EDGE
GSM Evolution: General Packet Radio Service
 GSM was designed for voice calls only, but interest in mobile data
grew and eventually a data service, HSCSD “High Speed Circuit
Switched Data” was implemented at 32 kb/s using the GSM signal
 Around 1994, the GSM phase 2 standards were enhanced to
include a number of new and improved services. These
enhancements became known as GSM Phase 2 Plus.
 One of the new features proposed in 1994 was a new bearer
service, a true IP packet radio service known as GPRS – General
Packet Radio Service
 GPRS allows a user with suitable mobile station to occupy multiple
time slots on a TRX, culminating in the possible occupancy of all 8
timeslots if they are available and the mobile is capable
• Data rates supported per timeslot are 9.06, 13.4, 15.6, and
21.4 kb/s, corresponding to Modulation and Coding Schemes
MCS1, MCS2, MCS3, and MCS4
• When all 8 timeslots are available, throughput can reach 8 x
21.4 kb/s = 171.2 kb/s, although realistic expectations are
around 115 kb/s due to BCH and other requirements
GPRS Timeslot Allocation
 In conventional GSM, a channel is permanently allocated for a particular
user during the entire call period (whether speaking or silent, whether
transmitting data or not)
• In GPRS, the channels are only allocated when data packets are
transmitted or received, and they are released after the transmission
• For bursty traffic this results in much more efficient use of the scarce
radio resources
• Multiple users can share one channel
 GPRS allows a single mobile to
transmit and/or receive on multiple
timeslots of the same frame (this is
called multislot operation)
• One to eight timeslots per frame BTS
can be allocated to a mobile,
depending on its capabilities and
traffic levels
• Uplink and downlink allocations
can be allocated separately, •This GPRS mobile is in “3+1” timeslot mode
•3 timeslots assigned on downlink
which efficiently supports •1 timeslot assigned on uplink
asymmetric data traffic (suitable
for web browsing, for example)
Allocation of GPRS Channels
 A cell supporting GPRS can allocate Packet Data Channels (PDCHs) for
GPRS traffic
• The PDCHs are taken dynamically from the common pool of all
channels available in the cell
• The radio resources of a cell are shared by all GPRS and all non-
GPRS mobiles in the cell
• The mapping of physical channels to either GPRS or GSM usage can
be performed dynamically, based on:
– Capacity on demand principle
– Depending on the current traffic load, priority of service, and the
multislot classes of the individual mobiles
 A load supervision procedure monitors the PDCHs in the cell
 The number of channels allocated to GPRS can be changed according to
current demand
• Physical channels not currently in use by conventional GSM can be
allocated as PDCHs to increase the GPRS quality of service
• When there is a resource demand for services with higher priority,
PDCHs can be de-allocated
Channel Coding Implemented at the BTS
GPRS Coding Schemes
Pre- Infobits Parity Tail Output Punct Code Data
Coding Cod. Without Bits Bits Conv. ured Rate Rate
Scheme USF USF BC encoder Bits Kbit/s
CS-1 3 181 40 4 456 0 1/2 9.05
CS-2 6 268 16 4 588 132 ~2/3 13.4
CS-3 6 312 16 4 676 220 ~3/4 15.6
CS-4 12 428 16 456 1 21.4
 Channel coding is used to protect the transmitted GPRS data

packets against errors
• The channel coding in GPRS is very similar to that of GSM
– An outer block coding, an inner block coding, and an
interleaving scheme are used
 Four different coding schemes are defined in the table above
Coding of the
Physical Downlink Traffic Channel
 One of the four coding schemes is chosen for the PDTCH, depending on
the quality of the channel
• Under bad conditions, use CS-1 and obtain a data rate of 9.05 kbit/s
per GSM time slot, but with very reliable coding
• Under good conditions, we may transmit without convolutional
encoding and achieve a data rate of 21.4 kbit/s per time slot
• With eight time slots we would obtain a data rate of 171.4 kbit/s
• In practice, multiple users share the time slots, and a much lower rate
is available to the individual user
– About 40 kbit/s per user if three users share the slots and CS-3 is
employed
 CS-1 is used for coding the signaling channels
 After encoding, the codewords are input to a block interleaver of depth 4
• On the receiver side, the codewords are de-interleaved
• The decoding is performed using the well-known Viterbi Algorithm
Application of Channel Coding: Example
Block Pre-coding Add Convolut’l

Puncturing
Encoder Of USF Tail bits encoder
 Suppose that coding scheme CS-2 is being used

• The coding steps are shown in functional block form above
 First, 271 information bits (including the 3-bit uplink state flag USF)
are mapped to 287 bits using a systematic block encoder
• In other words, 16 parity bits are added
• The USF pre-encoding maps the first three bits of the
information block (the USF) to six bits in a systematic way
• Four zero tail bits are added at the end of the block
– The tail bits are needed for termination of the subsequent
convolutional coding
• For the convolutional coding, a non-systematic rate-1/2
encoder of constraint length 4 is used
A GSM/GPRS Network – Voice and Data
Internet NSS
VPNs
BSS
GGSN SGSN BSC
HLR
MSC BTS
PSTN MS
TRC
OMC-S OMC-R
OSS
 Adding GPRS packet services to a GSM network requires two new network
elements, the GGSN and the SGSN
 GGSN Gateway GPRS Support Node
• Hosts IP addresses, routes data packets into and out of the radio network;
acts as a router for packets within the network
 SGSN Serving GPRS Support Node
• Maintains packet delivery connection with mobiles in its area
 Data is “tunneled” from the GGSN to the SGSN using GTP, GPRS Tunneling
Protocol, carrying packets between mobile and GGSN
 PCU Packet Controller Unit manages RF timeslots for packets

Compare with
A CDMA/1xRTT Network – Voice and Data
Internet
VPNs
AAA
PDSN PDSN BSC
HLR BTS
MSC MS
PSTN
V
 The network elements of GSM/GPRS/EDGE networks have direct counterparts

in CDMA/1xRTT networks
• It routes packets to and from the GGSN to actual users no matter where
they are in the network
 The HLR function in CDMA networks applies only to voice calls. A separate
function “AAA” serves as the data “HLR”.
 The MSC and BSC administrative functions are handled by separate terminals,
like the OMC-S and OMC-R, but with proprietary mfr’s. names
How can a User get packets wherever they are?
Through Tunnels between the SGSN and GGSN
Just like SGSN GGSN
Home! 158766 158774 158782
GRAND 158767 158775 158783
HOTEL 158768 158776 158784
158769 158785
Encapsulation 158770 158778 158786 Internet

158771 158779 158787
158772 158780 158788
158773 158781 158789

FedEx
FedEx
Secure Tunneling
Forward and Reverse IP Address
Mobile Assigned
User To User
The GPRS-EDGE (and even UMTS/HSPA) packet networks rely on

secure tunneling to forward packets in both directions between a User,
the SGSN, and the GGSN which actually “owns” the internet IP address
assigned to the User in that data session

GSM and GPRS Radio Operations Together
A Mix of Voice and Data Users on Different Timeslots
Uplink Downlink
D
B H
G
E D
C
F B H
A
G
BCCH C E
Frequency
C – data user
E – voice user
F – data user
G – data user
H – voice user
Fully Detailed GPRS Network Architecture
VLR
PLMN LEGEND
PSTN MSC
Existing GSM Core Network elements
ISDN A New GPRS elements and interfaces
User data & signaling
Gs Signaling only
SGSN
of a HLR EIR SMSC
different SIM
PLMN Gp Ater Mobile
Gc Gr Gf TCU BSC BTS Station
Gd Base Abis Base
Station Transceiver Mobile
Controller Station Eqpm’t
PSPDN PCUSN
GGSN Gn SGSN Gb Agprs
Gi
Um
Interface
 Additional elements in the GPRS network and their functions
• HLR – home location register – master database of customers and authorizations
• EIR – equipment identity register – can whitelist or blacklist specific mobiles
• SMSC – the short message service center, storing, routing, delivering SMS
• TCU – transcoder unit, converts 64 kb/s DS-0 speech into GSM coded voice
• PCUSN – the packet control unit support node – schedules packets over the air
interface and manages radio resource allocation to carry packets
 Data is “tunneled” from the GGSN to the SGSN using GTP, GPRS Tunneling Protocol,
encapsulating packets de-encapsulating on delivery
GPRS Backbone Networks
 Two kinds of GPRS
backbones exist:
• Intra-PLMN among
GSNs of same PLMN
(private, IP-based)
• Inter-PLMN among
GSNs of different
PLMNs (roaming
agreements)
 Gateways between the
PLMNs and the external
inter-PLMN backbone are
called Border Gateways
• Border Gateways perform security functions to prevent unauthorized
access and attacks
 The Gn and GP interfaces are also defined between two SGSNs
• This allows exchange of user profiles as mobiles move around
 The Gf interface allows a SGSN to query the IMEI of a registering mobile
 The Gi interface connects the PLMN to external public or private PDNs
• Interfaces to IPv4, IPv6, and X.25 networks are supported
 The Gr interface allows an SGSN to communicate with an HLR
GPRS-GSM Coordination
 The MSC/VLR may be

extended with functions
and register entries for
efficient coordination
between GPRS packet
switched and GSM
circuit-switched services
• Combined GPRS
and non-GPRS
location updates
 Paging requests for circuit-switched GSM calls can be performed via
the SGSN
• The Gs interface connects the databases of SGSN and MSC/VLR
 The Gd interface allows short message exchanges via GPRS
• Gd interconnects the SMS gateway MSC (SMS-GMSC) with the
SGSN
GPRS Features
 All network manufacturers support IP and interworking with both

internet and intranet
 To provide this functionality, some form of server functionality is
required
– Domain Name Server (DNS) is required to translate
between domain names and IP addresses
– Dynamic Host Configuration Protocol (DHCP) is required
for automatic reassignment of addresses for mobile hosts
 In early networks, a single SGSN was sufficient due to the gradual
growth of users and traffic as mobiles become available
 The connection between the GGSN and the MSC/VLR, HLR, and
SMSC require a gateway using SS7/IP or SIG to link the IP
backbone with the interfaces to these network elements
Quality of Service
Reliability
Probability of
Service Precedence Lost Dupli- Out-of Corrupt-
Class Packet cated Sequence ed
High Packet Packets Packets
Medium 1 109 109 109 109
2 104 105 105 106
Low 3 102 105 105 102
 Mobile packet applications have a wide range of reliability expectations --

real-time multimedia, Web browsing, email transfer
 QoS Classes settable per session are a very important feature
• Service Precedence
– Priority of a service in relation to other services
• Reliability
– Required transmission characteristics (3 classes defined)
• Delay
– Maximum values for mean delay and 95-percentile delay
• Throughput
– Maximum-Peak bit rate and the mean bit rate
Quality of Service: the Delay Parameter
Delay
128 byte packet 1024 byte packet
Class Mean 95% Mean 95%
Delay Delay Delay Delay
1 <0.5s <1.5s <2s <7s
2 <5s <25s <15s <75s
3 <50s <250s <75s <375s
4 Best Effort Best Effort Best Effort Best Effort
 Using these QoS Classes, QoS profiles can be negotiated

between the user and the network for each session, depending
on QoS demand and currently available resources.
• Billing is based on data volume, type of service, and QoS
profile
Starting Data Connections in GPRS
December,
Course2013
312 v3.0 (c)2013 Scott BaxterTechnical Introduction to Wireless -- 1997 Scott Baxter - V0.0 633
Attachment and Detachment Procedure
 Before a mobile station can use GPRS services, it must register

with an SGSN of the GPRS network
• The network checks to see if the user is authorized
• copies the user profile from the HLR to the SGSN
• assigns a packet temporary mobile subscriber identity (P-
TMSI) to the user
• This procedure is called GPRS attach
 For mobile stations with both circuit-switched and packet-switched
services it is possible to perform combined GPRS/IMSI attach
procedures
 Disconnection from the GPRS network is called GPRS detach
• can be initiated by the mobile station
• Can be initiated by the network (SGSN or HLR)
Session Management - PDP Context
 Suppose a mobile has successfully completed GPRS attach

 To exchange data packets with external PDNs such as the internet, the
mobile must request an IP addresses
• This is called a Packet Data Protocol Address (PDP address)
 For each session, a PDP context must be created. It contains:
• PDP type (IPv4, etc)
• PDP address (129.187.222.10)
• The requested QoS
• The address of the GGSN that serves as the access point to the PDN
 The PDP context is stored in the MS, the SGSN, and the GGSN
 With an active PDP context, the mobile is “visible” to the external PDN
and can send and receive packets
• Mapping between the PDP and IMSI enables the GGSN to transfer
data packets between the PDN and the MS
• A user can have one or even several simultaneous PDP contexts
active at once
Allocation of PDP Addresses
 PDP address allocations can be static or dynamic

• Static: User’s Home-PLMN network operator assigns a
permanent PDP address to the user
• Dynamic: A PDP address is assigned to the user upon
activation of a PDP context
– Can be assigned by the home PLMN (dynamic home-
PLMN PDP address)
– Can be assigned by the visited PLMN (dynamic visited-
PLMN PDP address)
• The home PLMN operator decides which alternative is used
• In case of dynamic PDP addresses, the GGSN is responsible
for the allocation and the activation/deactivitation of PDP
addresses
PDP Context Activation Procedure
MS SGSN GGSN
Activate PDP context request
[PDP type, PDP address,
QoS requested, access point…]
Security functions
Create PDP context request

Create PDP context response

Activate PDP context aCept [PDP type, QoS negotiated…]
QoS negotiated…]
 The mobile station requests a PDP context from the SGSN

• If dynamic PDP address assignment is requested, the parameter PDP
address will be left empty
 Security functions (authentication) will be performed
 SGSN will ask for a PDP context from the GGSN
 The GGSN will create a new entry in its PDP context table
 GGSN sends confirmation to the SGSN including address if dynamic
 SGSN updates its PDP context table and confirms to the mobile
Anonymous PDP Context Activation
MS SGSN GGSN
Activate PDP context request
Security functions
Create PDP context request

Create PDP context response

Activate PDP context aCept [PDP type, QoS negotiated…]
QoS negotiated…]
 GPRS also supports anonymous PDP context activation

• In this case, security functions are skipped
• The user (IMSI) using the PDP context is not known to the
network
 Anonymous context activation can be used for prepaid services,
where the user does not want to be identified
• Only dynamic address allocation is possible in this case
Routing - An Example
Routing Example:
 A GPRS mobile in
PLMN1 sends IP
packets to a web
server
 The mobile’s
SGSN
encapsulates the
IP packets,
examines PDP
context, and routes
them through the
intra-PLMN GPRS
backbone to the
appropriate GGSN
 The GGSN decapsulates the packets, sends them onto the IP network
• IP routing mechanisms transfer the packets to the the access router
of the destination network
• The destination network access router delivers the packets to the host
Routing - Another Example
 Suppose the home-

PLMN of the mobile
station is PLMN2
 An IP address has
been assigned to the
mobile by the GGSN
of PLMN2
• Mobile’s IP
address has
same network
prefix as the IP
address of the
GGSN in PLMN2
 Packets enter the IP network, are routed to the GGSN of PLMN2
• This is the home-GGSN of the mobile
 The GGSN queries the HLR, finds the mobile currently in PLMN1
• It encapsulates the incoming IP packets and tunnels them through the
inter-PLMN GPRS backbone to the appropriate SGSN in PLMN1
 The SGSN decapsulates the packets and delivers them to the MS
Location Management
 Location management is the task of continually knowing the MS

location in the network, so packets can be routed to the MS
 The MS frequently sends location update messages to its SGSN
• If the mobile sends updates infrequently, its location is not
known and paging is necessary for each downlink packet
(adding considerable delay)
• If the mobile sends updates frequently, its location is well
known and data packets can be delivered with no paging delay
• Location updates consume battery power and uplink radio
capacity, so a balance is required to optimize resource usage
 GSM/GPRS location updates are very similar to CDMA registration
and a CDMA mobile reports when they enter a new paging zone
 To optimize the location management function in GPRS, a state
model has been created and applied
The GPRS Location Management State Model
 A mobile can be in any of three states

IDLE
depending on its current traffic level
STANDBY Timer Expired

• Location update frequency is dependent GPRS GPRS
on the MS state attach detach
 In IDLE state, the mobile is not reachable READY

 Performing a GPRS attach, the mobile
READY Trans-
enters the READY state timer mission
Expired or of a
 With a GPRS detach the mobile may Forced to packet
disconnect from the network and fall back Standby
into the IDLE state STANDBY
• all PDP contexts will be deleted
 The STANDBY state is reached when a MS
does not send any packets for a long period
• The READY timer expires
Mobile Action based on GPRS Location State
 In IDLE state, no location updating is performed

• The current location of the mobile is unknown to the network
 An MS in READY state informs its SGSN of every movement to a
new cell
 A GSM Location Area is divided into several Routing Areas (RAs)
• An RA can consist of one or several cells
 A MS in STANDBY state will inform its SGSN only when it moves
into a new RA
• Cell changes are not disclosed
 To find out the current cell of a MS in STANDBY, the mobile is
Slided throughout the current RA
 For MS in READY state, no paging is necessary
 Whenever a mobile moves to a new RA, it sends a “routing area
update request” to its assigned SGSN
• Message contains the routing area identity (RAI) of its old RA
• The BSS adds the cell identifier of the new cell, from which the
SGSN can derive the new RAI
Intra-SGSN Routing Area Updates
MS BSS SGSN
Routing area update request Routing area update request

[Old RAI, old P-TMSI signature, [Old RAI, old P-TMSI signature,
Update type] Update type, CI]
Security functions
Routing area update aCept

[P-TMSI, PTMSI signature)
Routing area update complete

[P-TMSI] (optional)
 The mobile has moved into an RA that is assigned to the same

SGSN as the old RA
• The SGSN already has the necessary user profile
• SGSN can assign a new packet temporary mobile subscriber
identity (P-TMSI)
 Since the routing context does not change, there is no need to
inform other network elements, such as the GGSN or the HLR
Inter-SGSN Routing Area Updates
MS BSS SGSN
Routing area update request Routing area update request

[Old RAI, old P-TMSI signature, [Old RAI, old P-TMSI signature,
Update type] Update type, CI]
Security functions
Routing area update aCept

[P-TMSI, PTMSI signature)
Routing area update complete

[P-TMSI] (optional)
 The new RA is administered by a different SGSN than the old RA

 The new SGSN realizes that the MS has changed to its area and
requests the old SGSN to send the PDP contexts of the user
 The new SGSN informs the involved GGSNs of the users new
routing context
 The HLR (and if needed, the MSC/VLR) are informed about the
user’s new SGSN
GPRS Logical Channels

Packet Broadcast
PBCH Control Channel
Packet Common Packet Common
PCCH Control Channel Control Channel PCCH
Packet access Packet Random
PAGCH Grant Channel access Channel PRACH
Packet Paging
PPCH Channel
Packet Associated
PACH Control Channel
BTS PTCCH
Packet Timing Advance
Control Channel
Packet Notification
PNCH Channel
Packet Data Packet Data
PDTCH/D Traffic Channel Traffic Channel PDTCH/U
Functions of the Logical Channels
 The packet data traffic channel (PDTCH) carries a mobile’s user data
 The packet broadcast control channel (PBCH) transmits overhead
configuration information from the BSS to all listening mobile stations
 The packet common control channel (PCCH) carries signaling information
and can include up to five different subchannels when needed:
• UL: Packet random access channel (PRACH) for mobile PD requests
• DL: Packet access grant channel (PAGCH) assigns PDs to mobiles
• DL: Packet paging channel (PPCH) to find mobile location
• DL: Packet timing advance control channel (PTCCH) instructs mobiles
for adaptive frame synchronization
• DL: The packet notification channel (PNCH) informs a mobile station
of incoming PTM messages (multicast or group call)
 The Dedicated Control Channel carries the packet associated control
channel (PACH) for one mobile’s PD, including power control information
 Some Special Provisions:
• If the PCCH is not available in a cell, the mobile can use the CCH of
conventional GSM to initiate a packet transfer
• If the PBCH is not available, it will listen to the GSM broadcast control
channel (BCH) to get info on network configuration
Mapping Packet Data Logical Channels
onto Physical Channels
 Mapping of logical channels onto physical channels has two components:

• Mapping in frequency based on the TDMA frame number and the
frequencies allocated to the BTS and the mobile station
• Mapping in time based on the definition of complex multiframe
structures on top of the TDMA frames
 A multiframe structure for PDCHs consisting of 52 TDMA frames is shown
in the next slide
• Four consecutive TDMA frames form one block (12 blocks, B011),
Two TDMA frames are reserved for transmission of the P, and the
remaining two frames are idle frames
 The mapping of logical channels into blocks B0-B11 of the multiframe can
vary from block to block and is controlled by parameters broadcast on the
PBCH
 Besides the 52-multiframe, which can be used by all logical GPRS
channels, a 51-multiframe structure is defined. It is used for PDCHs
carrying only the logical channels PCCH and PBCH and no other logical
channels
Taking GPRS to the next level:
EDGE
Enhanced Data Rates for GPRS Evolution
The EDGE Air Interface
Scheme Modulation Maximum Code Rate Header Code Blocks Family
rate [kb/s] Rate per 20 ms
M CS-9 8PSK 59.2 1.0 0.36 2 A

M CS-8 54.4 0.92 0.36 2 A
M CS-7 44.8 0.76 0.36 2 B
M CS-6 29.6 / 27.2 0.49 1/3 1 A
M CS-5 22.4 0.37 1/3 1 B
M CS-4 GM SK 17.6 1.0 0.53 1 C
M CS-3 14.8 / 13.6 0.80 0.53 1 A
M CS-2 11.2 0.66 0.53 1 B
M CS-1 8.8 0.53 0.53 1 C
 Extends GPRS packet data speeds using adaptive higher order

modulation and coding schemes
 Using 8-state phase shift keying allows three times the data speeds
available with the original modulation of GPRS, GMSK
• 8.2 to 59.2 kbps per time slot
• Supports peak rates over 384 kbps when all timeslots are available
 However, the new modulation requires linear amplifiers with < 3 dB peak
to average power ratio using linearized GMSK pulses
EDGE Payload Format
M CS -3
Fa mily A 37 octets 37 octets 37 octets 37 octets
M CS -6
M CS -9
M CS -3
34+3 octets 34+3 octets

Fa mily A
M CS -6
padding
34 octets 34 octets 34 octets 34 octets
M CS -8
M CS -2
Fa mily B 28 octets 28 octets 28 octets 28 octets
M CS -5
M CS -7
M CS -1
Fa mily C 22 octets 22 octets
M CS -4
GSM/GPRS Terminology:
Cells and Sectors
 Some terms have different

meanings when used in GSM
Sector or North American practice! Cell
α α
CELL Cell BTS Cell

Sector Sector
γ β γ β
It’s a Sector! It’s a Cell!
Sector Sector Cell Cell

γ β γ β
That was a Handoff! That was a Handover!

The frequencies used The frequencies used
by each sector are by each cell are
its channel set. its allocation.
Correct Formal Names
;-)
for use around Educated People (!)
4G UE eNb, eNodeB
LTE User Equipment Enhanced Node B
3G UE
Node B
UMTS User Equipment
HSPA
2G Mobile Cell Site, BTS

GSM Handset, Terminal Base Station
GPRS/EDGE

Analog
TIA
Pre-
True 3G:
UMTS - WCDMA
Higher Speeds: UMTS / WCDMA
 Even the best speeds of EDGE are still far below the data speeds
of DSL and Cable Modems for users in homes and businesses
 The ETSI combined the GSM, GPRS, and EDGE standards and
added a new wideband technology for even higher data rates
 The new overall family is called UMTS (Universal Mobile
Telecommunications Services) and that is the name normally used
for the new technology, based on wideband CDMA (WCDMA)
• Different and not directly compatible with US CDMA
• The UMTS/WCDMA signal can carry up to roughly 200 voice
calls as well as data bursts up to as much as 2 Mb/s overall
• One UMTS signal occupies about 3.84 MHz. of radio spectrum,
and can fit within a licensed spectrum block 5 MHz. wide
– This is about 3-times wider than a US CDMA signal
 A UMTS base station is called a “Node B”
The UMTS / WCDMA Radio Signal
At left, four UMTS/WCDMA carriers
stand side by side in 20 MHz. of
spectrum. Each of the carriers can
handle in excess of 200 voice calls as
well as numerous data connections
with peak rates up to 1 Mb/s each.
As we’ll see in the next section, one
or more of the carriers can also
handle HSPA fast data too.
 The UMTS signal uses wideband CDMA

• RF bandwidth is 3.84 MHz., 3x wider than US CDMA signals
• UMTS uses up to 256 codes, same as US CDMA Walsh codes
but called “OVSF” Orthogonal Variable Spreading Factor
• UMTS establishes timeslots for use of the OVSF codes,
creating “TDMA in a WCDMA shell” for operational flexibility
• Up to two 1 Mb/s data channels can exist at any instant
• Instead of a PN “short code” with timing offsets to distinguish
sectors, UMTS uses 512 different Gold Codes as carriers
A UMTS Network
Internet NSS BSS
VPNs
RNC
GGSN SGSN
HLR
MSC
PSTN UE
Node B
OMC-S OMC-R
OSS BTS
 The core voice and packet network in UMTS is the same as in

GSM/GPRS, but the BSS Base Station Subsystem is changed a lot
 Radio Resource Control for packet and voice and the packet control
function uses a new element, the RNC Radio Network Controller
 Each base station is now called a “Node B”
 A customer mobile is now called a UE, User Equipment
 The required SIM card is special, including UMTS features

Compare with
An EV-DO Network
Internet
VPNs
RNC
AAA
PDSN PDSN
HLR
PSTN MSC BTS UE
 The network elements of UMTS networks have direct counterparts in

CDMA/EV-DO networks
separate function “AAA” serves as the data “HLR” for EV-DO.
WCDMA Principles
Wireless Multiple Access Methods
FDMA
Power Frequency Division Multiple Access

•A user’s channel is a private frequency
Time Division Multiple Access

TDMA •A user’s channel is a specific frequency, but it
Power
only belongs to the user during certain time
slots in a repeating sequence
Code Division Multiple Access
•Each user’s signal is a continuous unique
WCDMA code pattern buried within a shared signal,
mingled with other users’ code patterns. If a
Power user’s code pattern is known, the presence or
absence of their signal can be detected, thus
conveying information.
Steps in WCDMA Signal Generation
SYM-
User BITS Convolutional Symbol BOLS
CRC Block Baseband
Voice Vocoder Addition Or Turbo Repetition Interleaving Filtering To RF
Coding
CHIPS modulator
Scrambling
OVSF Code
Function What Does It Do? Why Do We Do It?

VocodingPhysical Layer
Encodes functions
user voice or data For digitization and compression. The main goal is
to have fewer bits to transmit, maximizing capacity..
Convolutional Encode information bit Add calculated redundancy in the bit stream to allow
Coding stream before transmission error correction at reception after noisy radio link.
Symbol Repeat information symbols Increase redundancy in the bitstream even further
Repetition before transmission when bit rates are low enough to allow it
Block Disperse redundant bits Ensures symbols representing an information bit are
distributed throughout the 10 ms. frame, ensuring no
Interleaving away from each other error burst wipes out all symbols of a specific bit..
Orthogonal Create a Spread-Spectrum Spreading user bitstream into spread-spectrum
chipstream for gain advantage; the specific OVSF
Spreading Signal; make User channel code is the user’s “channel” in the cell
Scrambling Scramble user chipstreams This makes the DL signal of each cell unique from
in a cell (DL) or UE (UL) other cells and each UE (UL) from other UEs.
Quadrature Add additional phase Increases the bandwidth-density of transmitted
Spreading dimensions to RF signal information for maximum system capacity
Power Control Node B adjusts UE’s transmit So each UE transmits enough power to achieve
power desired S/N, without causing excessive interference
Baseband Restrict and shape signal Eliminate outer sidebands of the baseband signal to
Filtering bandwidth meet bandwith requirements
Codes Used in UMTS
DSSS Spreading: Time-Domain View
Input A: User’s Data Originating Site
At Originating Site: 1
 Input A: User’s Data @ Input B: Spreading Code
XOR
19,200 bits/second Exclusive-OR
Gate
 Input B: OVSF Code #23
@ 3.84 Mcps
 Output: Spread Spread Spectrum Signal
spectrum signal
via air interface

Input A: Received Signal Destination Site
At Destination Site:
 Input A: Received XOR
Input B: Spreading Code Exclusive-OR
spread spectrum signal Gate
 Input B: OVSF Code #23

@ 3.84 Mcps
Output: User’s Original Data
 Output: User’s Data @
19,200 bits/second just 1
as originally sent
Drawn to actual scale and time alignment
Spreading from a Frequency-Domain View
TRADITIONAL COMMUNICATIONS SYSTEM

Spread Spectrum
Narrowband
 Traditional technologies try Slow Signal Slow
to squeeze signal into Information
Sent
Information
Recovered
minimum required TX RX
bandwidth
 WCDMA uses larger SPREAD-SPECTRUM SYSTEM
bandwidth but uses Wideband
resulting processing gain to Slow
Signal
Slow
increase capacity Information
Sent
Information
Recovered
TX RX
Fast Fast
Spreading Spreading
Sequence Sequence
Spread Spectrum Payoff:

Processing Gain
Terminology: All “Bits” Are Not Created Equal
 Units of information in binary form are called “bits” Building a

WCDMA Signal
 In WCDMA, there are streams of information at
three distinct levels of importance; we call their
individual information elements by different names Bits
from User’s Vocoder
 BITS are the 1’s and 0’s in the stream of raw
information to be transmitted – the “payload”
Forward Error
 SYMBOLS are redundantly-encoded 1’s and 0’s Correction
output from a convolutional or turbo coder
Symbols
 CHIPS are the 1’s and 0’s in the fast spread
spectrum signal, and the 1’s and 0’s in the codes
which make the signal Coding and
OVSF Spreading
BITS Convolutional
Chips
CRC Block To
Information
Or Turbo
Addition Interleaving
SYMBOLS
Coding modulator
CHIPS
Scrambling
Code
The WCDMA Spreading and Channelization Sequence:
Orthogonal Variable Spreading Factor (OVSF)
Orthogonal Variable Spreading Factor
 These are the same Walsh codes familiar to US #
0
---------------------------------- 64-Chip Sequence ------------------------------------------
0000000000000000000000000000000000000000000000000000000000000000
CDMA personnel, just with a different name

1 0101010101010101010101010101010101010101010101010101010101010101
2 0011001100110011001100110011001100110011001100110011001100110011
3 0110011001100110011001100110011001100110011001100110011001100110
4 0000111100001111000011110000111100001111000011110000111100001111
 64 “Magic” Sequences, each 64 chips long

5 0101101001011010010110100101101001011010010110100101101001011010
6 0011110000111100001111000011110000111100001111000011110000111100
7 0110100101101001011010010110100101101001011010010110100101101001
8 0000000011111111000000001111111100000000111111110000000011111111
 Each OVSF is precisely Orthogonal with

9 0101010110101010010101011010101001010101101010100101010110101010
10 0011001111001100001100111100110000110011110011000011001111001100
11 0110011010011001011001101001100101100110100110010110011010011001
respect to all other OVSF Codes in its family

12 0000111111110000000011111111000000001111111100000000111111110000
13 0101101010100101010110101010010101011010101001010101101010100101
14 0011110011000011001111001100001100111100110000110011110011000011
15 0110100110010110011010011001011001101001100101100110100110010110
• it’s simple to generate the codes, or

16 0000000000000000111111111111111100000000000000001111111111111111
17 0101010101010101101010101010101001010101010101011010101010101010
18 0011001100110011110011001100110000110011001100111100110011001100
19 0110011001100110100110011001100101100110011001101001100110011001
• they’re small enough to use from ROM

20 0000111100001111111100001111000000001111000011111111000011110000
21 0101101001011010101001011010010101011010010110101010010110100101
22 0011110000111100110000111100001100111100001111001100001111000011
23 0110100101101001100101101001011001101001011010011001011010010110
24 0000000011111111111111110000000000000000111111111111111100000000
25 0101010110101010101010100101010101010101101010101010101001010101
26 0011001111001100110011000011001100110011110011001100110000110011
27 0110011010011001100110010110011001100110100110011001100101100110
28 0000111111110000111100000000111100001111111100001111000000001111
29 0101101010100101101001010101101001011010101001011010010101011010
Unique Properties: 30
31
32
0011110011000011110000110011110000111100110000111100001100111100
0110100110010110100101100110100101101001100101101001011001101001
0000000000000000000000000000000011111111111111111111111111111111
Mutual Orthogonality
33 0101010101010101010101010101010110101010101010101010101010101010
34 0011001100110011001100110011001111001100110011001100110011001100
35 0110011001100110011001100110011010011001100110011001100110011001
36 0000111100001111000011110000111111110000111100001111000011110000
37 0101101001011010010110100101101010100101101001011010010110100101
38 0011110000111100001111000011110011000011110000111100001111000011
39 0110100101101001011010010110100110010110100101101001011010010110
40 0000000011111111000000001111111111111111000000001111111100000000
41 0101010110101010010101011010101010101010010101011010101001010101
42 0011001111001100001100111100110011001100001100111100110000110011
EXAMPLE: 43
44
45
0110011010011001011001101001100110011001011001101001100101100110
0000111111110000000011111111000011110000000011111111000000001111
0101101010100101010110101010010110100101010110101010010101011010
46 0011110011000011001111001100001111000011001111001100001100111100
47 0110100110010110011010011001011010010110011010011001011001101001
Correlation of OVSF #23 with OVSF #59 48

49
50
0000000000000000111111111111111111111111111111110000000000000000
0101010101010101101010101010101010101010101010100101010101010101
0011001100110011110011001100110011001100110011000011001100110011
51 0110011001100110100110011001100110011001100110010110011001100110
52 0000111100001111111100001111000011110000111100000000111100001111
#23 0110100101101001100101101001011001101001011010011001011010010110 53 0101101001011010101001011010010110100101101001010101101001011010
54 0011110000111100110000111100001111000011110000110011110000111100
#59 0110011010011001100110010110011010011001011001100110011010011001 55 0110100101101001100101101001011010010110100101100110100101101001
56 0000000011111111111111110000000011111111000000000000000011111111
Sum 0000111111110000000011111111000011110000000011111111000000001111 57 0101010110101010101010100101010110101010010101010101010110101010
58 0011001111001100110011000011001111001100001100110011001111001100
59 0110011010011001100110010110011010011001011001100110011010011001
60 0000111111110000111100000000111111110000000011110000111111110000
Correlation Results: 32 1’s, 32 0’s: Orthogonal!! 61

62
0101101010100101101001010101101010100101010110100101101010100101
0011110011000011110000110011110011000011001111000011110011000011
63 0110100110010110100101100110100110010110011010010110100110010110
Families of OVSF
OVSF OVSF OVSF OVSF OVSF OVSF Orthogonal Variable Spreading Factor
# 1-Chip # 2-Chips # 4-Chips # 8-Chips # ---- 16-Chips ------- # ----------- 32-Chip Sequence ------------- # ---------------------------------- 64-Chip Sequence ------------------------------------------
0 0 0 00 0 0000 0 00000000 0 0000000000000000 0 00000000000000000000000000000000 0 0000000000000000000000000000000000000000000000000000000000000000
1 01 1 0101 1 01010101 1 0101010101010101 1 01010101010101010101010101010101 1 0101010101010101010101010101010101010101010101010101010101010101
2 0011 2 00110011 2 0011001100110011 2 00110011001100110011001100110011 2 0011001100110011001100110011001100110011001100110011001100110011
3 0110 3 01100110 3 0110011001100110 3 01100110011001100110011001100110 3 0110011001100110011001100110011001100110011001100110011001100110
4 00001111 4 0000111100001111 4 00001111000011110000111100001111 4 0000111100001111000011110000111100001111000011110000111100001111
2x2 5 01011010 5 0101101001011010 5 01011010010110100101101001011010 5 0101101001011010010110100101101001011010010110100101101001011010
4x4 6 00111100 6 0011110000111100 6 00111100001111000011110000111100 6 0011110000111100001111000011110000111100001111000011110000111100
7 01101001 7 0110100101101001 7 01101001011010010110100101101001 7 0110100101101001011010010110100101101001011010010110100101101001
8 0000000011111111 8 00000000111111110000000011111111 8 0000000011111111000000001111111100000000111111110000000011111111
9 0101010110101010 9 01010101101010100101010110101010 9 0101010110101010010101011010101001010101101010100101010110101010
8x8 10
11
0011001111001100
0110011010011001
10
11
00110011110011000011001111001100
01100110100110010110011010011001
10
11
0011001111001100001100111100110000110011110011000011001111001100
0110011010011001011001101001100101100110100110010110011010011001
12 0000111111110000 12 00001111111100000000111111110000 12 0000111111110000000011111111000000001111111100000000111111110000
13 0101101010100101 13 01011010101001010101101010100101 13 0101101010100101010110101010010101011010101001010101101010100101
14 0011110011000011 14 00111100110000110011110011000011 14 0011110011000011001111001100001100111100110000110011110011000011
15 0110100110010110 15 01101001100101100110100110010110 15 0110100110010110011010011001011001101001100101100110100110010110
16 00000000000000001111111111111111 16 0000000000000000111111111111111100000000000000001111111111111111
17 01010101010101011010101010101010 17 0101010101010101101010101010101001010101010101011010101010101010
16x16 18 00110011001100111100110011001100 18 0011001100110011110011001100110000110011001100111100110011001100
19 01100110011001101001100110011001 19 0110011001100110100110011001100101100110011001101001100110011001
20 00001111000011111111000011110000 20 0000111100001111111100001111000000001111000011111111000011110000
21 01011010010110101010010110100101 21 0101101001011010101001011010010101011010010110101010010110100101
OVSF Names
22 00111100001111001100001111000011 22 0011110000111100110000111100001100111100001111001100001111000011
23 01101001011010011001011010010110 23 0110100101101001100101101001011001101001011010011001011010010110
24 00000000111111111111111100000000 24 0000000011111111111111110000000000000000111111111111111100000000
25 01010101101010101010101001010101 25 0101010110101010101010100101010101010101101010101010101001010101
Cch1232 = “OVSF #12, 32 chips long.” 26

27
28
00110011110011001100110000110011
01100110100110011001100101100110
00001111111100001111000000001111
26
27
28
0011001111001100110011000011001100110011110011001100110000110011
0110011010011001100110010110011001100110100110011001100101100110
0000111111110000111100000000111100001111111100001111000000001111
29 01011010101001011010010101011010 29 0101101010100101101001010101101001011010101001011010010101011010
30 00111100110000111100001100111100 30 0011110011000011110000110011110000111100110000111100001100111100
31 01101001100101101001011001101001 31 0110100110010110100101100110100101101001100101101001011001101001
OVSF Level Mapping 32x32

32
33
34
35
0000000000000000000000000000000011111111111111111111111111111111
0101010101010101010101010101010110101010101010101010101010101010
0011001100110011001100110011001111001100110011001100110011001100
0110011001100110011001100110011010011001100110011001100110011001
The OVSF shown here are in logical state 36

37
0000111100001111000011110000111111110000111100001111000011110000
0101101001011010010110100101101010100101101001011010010110100101
38 0011110000111100001111000011110011000011110000111100001111000011
values 0 and 1. 39
40
0110100101101001011010010110100110010110100101101001011010010110
0000000011111111000000001111111111111111000000001111111100000000
OVSF also can exist as physical bipolar

41 0101010110101010010101011010101010101010010101011010101001010101
42 0011001111001100001100111100110011001100001100111100110000110011
43 0110011010011001011001101001100110011001011001101001100101100110
signals. Logical zero is the signal value +1 44

45
46
0000111111110000000011111111000011110000000011111111000000001111
0101101010100101010110101010010110100101010110101010010101011010
0011110011000011001111001100001111000011001111001100001100111100
and Logical 1 is the signal value -1. 47

48
49
0110100110010110011010011001011010010110011010011001011001101001
0000000000000000111111111111111111111111111111110000000000000000
0101010101010101101010101010101010101010101010100101010101010101
Mapping: Logical 0,1 > +1, -1 Physical 50

51
0011001100110011110011001100110011001100110011000011001100110011
0110011001100110100110011001100110011001100110010110011001100110
52 0000111100001111111100001111000011110000111100000000111100001111
53 0101101001011010101001011010010110100101101001010101101001011010
54 0011110000111100110000111100001111000011110000110011110000111100
 OVSF can be built to any size from a single zero

55 0110100101101001100101101001011010010110100101100110100101101001
56 0000000011111111111111110000000011111111000000000000000011111111
57 0101010110101010101010100101010110101010010101010101010110101010
by replicating and inverting

58 0011001111001100110011000011001111001100001100110011001111001100
59 0110011010011001100110010110011010011001011001100110011010011001
60 0000111111110000111100000000111111110000000011110000111111110000
61 0101101010100101101001010101101010100101010110100101101010100101
 All OVSF matrixes are square -- same number

62 0011110011000011110000110011110011000011001111000011110011000011
63 0110100110010110100101100110100110010110011010010110100110010110
of codes and number of chips per code 64x64

OVSF Trees and Interdependencies
Cch364
Cch3320110 0110 0110 0110 0110 0110 0110 0110 Cch3564
Cch3160110 0110 0110 0110 Cch1964
Cch190110
32 0110 0110 0110 1001 1001 1001 1001
Cch164
Cch38 0110 0110
Cch1164
Cch110110
32 0110 1001 1001 0110 0110 1001 1001
Cch4364
Cch1116
0110 0110 1001 1001
Cch2764
Cch270110
32 0110 1001 1001 1001 1001 0110 0110
Cch5964
Cch34 0110
Cch764
Cch7320110 1001 0110 1001 0110 1001 0110 1001 Cch3964
Cch7160110 1001 0110 1001 Cch2364
Cch230110
32 1001 0110 1001 1001 0110 1001 0110
Cch5564
Cch78 0110 1001
Cch1564
Cch150110
32 1001 1001 0110 0110 1001 1001 0110
Cch4764
Cch150110
16 1001 1001 0110
Cch3164
Cch310110
32 1001 1001 0110 1001 0110 0110 1001
Cch6364
 Entire OVSF matrices can be built by replicating and inverting -- Individual

OVSF sequences can also be expanded in the same way.
 WCDMA adds each symbol of information to one complete OVSF code
 Faster symbol rates therefore require shorter OVSF codes
 If a short OVSF is chosen to carry a fast data channel, that OVSF and all
its replicative descendants are compromised and cannot be reused to
carry other signals
 Therefore, the supply of available OVSF codes on a sector diminishes
greatly while a fast data channel is being transmitted!
OVSF Code “Trees”
This way of displaying OVSF codes is called “bit reversal order”. It shows
each OVSF code’s parents and children. Remember, we cannot use any
OVSF code if another OVSF code directly above it or below it is in use.
Code# 0 2 1 3 Code#
4 chips
Code# 0 4 2 6 1 5 3 7 Code#
8 chips
Code# 0 8 4 12 2 10 6 14 1 9 5 13 3 11 7 15 Code#
16 chips
Code# 0 16 8 24 4 20 12 28 2 18 10 26 6 22 14 30 1 17 9 25 5 21 13 29 3 19 11 27 7 23 15 31 Code#
32 chips
Code# Code#
32
16
48
40
24
56
36
20
52
12
44
28
60
34
18
50
10
42
26
58
38
22
54
14
46
30
62
33
17
49
41
25
57
37
21
53
13
45
29
61
35
19
51
11
43
27
59
39
23
55
15
47
31
63
0
7
64 chips
112
104
120
100
116
108
124
114
106
122
102
118
110
126
113
105
121
101
117
109
125
115
107
123
103
119
111
127
Code# Code#
64
32
96
16
80
48
72
40
24
88
56
68
36
20
84
52
12
76
44
28
92
60
66
34
98
18
82
50
10
74
42
26
90
58
70
38
22
86
54
14
78
46
30
94
62
65
33
97
18
81
49
73
41
25
89
57
69
37
21
85
53
13
77
45
29
93
61
67
35
99
19
83
51
11
75
43
27
91
59
71
39
23
87
55
15
79
47
31
95
63
0
7
128 chips
M-Sequences:
Purpose and How They’re Generated
An Ordinary Shift Register
 Maximal-length sequences used
in W-CDMA are generated in
linear shift registers Sequence repeats every N chips,
 In a simple shift register, the where N is number of cells in register
sequence length is the same as A Tapped, Summing Shift Register
the length of the register itself
 Tapped shift registers generate a
wild, self-mutating sequence 2N-1 Sequence repeats every 2N-1 chips,
chips long (N=register length) where N is number of cells in register
• Such sequences match if
compared in step (no-brainer, A Special Characteristic of Sequences
any sequence matches itself) Generated in Tapped Shift Registers
• Such sequences appear Compared In-Step: Matches Itself

Sequence:
approximately orthogonal if Self, in sync:
compared with themselves not Sum: Complete Correlation: All 0’s
exactly matched in time Compared Shifted: Little Correlation
• Cross-correlation typically <2% Sequence:
Self, Shifted:
Sum: Practically Orthogonal: Half 1’s, Half 0’s
PN Sequences: Gold Codes
GOLD-CODE GENERATION If the starting
state for either of
M-Sequence 1 the M-Sequence
generators is
+ Gold
Code
altered, a
different Gold
M-Sequence 2 code will be
produced.
 Gold Codes were first described by R. Gold in a paper in 1967

• Gold described a method for generating a PN sequence from a
pair of primitive polynomials
 Gold Codes have defined and bounded cross-correlation
• The cross-correlation can be much less than that achieved
from M-sequences alone
 Gold Codes also provide a larger number of available codes than
can be achieved using M-sequences alone
Downlink Spreading and Modulation
I
Serial-to-
Complex QPSK
Data Parallel
Scrambling Modulation
Converter
Q
1-of-512
Primary 3.84 MCPS
OVSF
Node Generator Scrambling
B Code
1-of-512 Secondary
Scrambling Code
 Data modulation is QPSK
 Each pair of two bits are serial-parallel converted and mapped to the I and
Q branches
• I and Q are then spread to chip rate with an OVSF unique for the
specific channel
 Complex spreading uses one of 512 primary scrambling codes
• the primary CCPCH is scrambled this way
• Other downlink physical channels are scrambled using the primary
scrambling code or a secondary scrambling code from the set of the
chosen 1-of-512 primary scrambling code
Uplink Spreading and Modulation
OVSF
Generator
I
DPDCH1
Complex QPSK
Scrambling Modulation
DPCCH
Q
OVSF UE-Specific
Generator Channelization 3.84 MCPS
Code
*Short S(2) code
Or long Gold Code
 Dual-channel QPSK is used

 DPCCH channel mapped to Q, first DPDCH mapped to I
• Subsequently-mapped DPDCHs can be mapped to I or Q
 I and Q are then spread to chip rate with two different OVSF codes
 In an ordinary Node B, a 38.4K-long Gold Code is used for
complex scrambling
• If transmitting to a Node B with advanced receiver for multi-
user detection, a 256 code from the S(2) family is used instead
Channels and Protocols,
Application Parts, Handover
Introduction to WCDMA Channels
 Like other wireless technologies, WCDMA uses various types of channels

to carry the actual information to and from users, and to manage the
connections between users and the system
 The channels break down cleanly into several categories:
 In terms of ownership or control:
• COMMON channels are public places, much like a hotel lobby
• DEDICATED channels are private for one user, much like a guest
room in a hotel
• SHARED channels can momentarily serve one user, much like a
meeting room in a hotel
 In terms of direction:
• DOWNLINK channels are transmitted by Node B, received by UE
• UPLINK channels are transmitted by UE, received by Node B
 In terms of purpose:
• DATA
• CONTROL (includes PRIMARY and SECONDARY subchannels)
• SYNC (includes PRIMARY and SECONDARY subchannels)
The W-CDMA Physical Channels
P-CPICH Common Pilot
CPICH Channel
S-CPICH Physical Random Access
Channel PRACH
Primary Common Control
P-CCPCH Physical Channel Physical Common
Packet Channel PCPCH
Secondary Common Control
S-CCPCH Physical Channel
P-SCH
SCH S-SCH Synchronization Channel
PICH Slide Indication Channel
Node AICH Acquisition Indication Channel

B
Access Preamble Acquisition
AP-AICH Indicator Channel
CPCH Status Indicator
CSICH Channel
Collision Detection/Channel
CD/CA-ICH Assignment Indicator Channel
Dedicated Physical
Data Channel DPDCH
Dedicated Physical
DPDCH Data Channel Dedicated Physical
Control Channel DPCCH
Dedicated Physical
DPCCH Control Channel
Physical Downlink
PDSCH Shared Channel
Downlink W-CDMA Physical Channel Functions
DOWNLINK CHANNELS
UEs monitor as 1) phase reference for SCH, P- CCPCH, AICH,
P-CPICH Common Pilot PICH and 2) to measure signal strength for cell
CPICH Channel
selection/Handover
S-CPICH Primary is uncoded and uses main scrambling pattern of the cell.
Secondary can use other scrambling pattern and beam-forming.
Primary Common Control BCH cell configuration information. Same OVSF in every cell. Not
P-CCPCH Physical Channel transmitted in first 256 chips of every slot (90% duty factor).
Secondary Common Control Contains Paging Channel PCH and Forward Access Channel
S-CCPCH Physical Channel FACH time-multiplexed. OVSF is announced on the P-CCPCH.
P-SCH In PCCPCH idle period. Two subchannels, Unmodulated P-SCH
SCH S-SCH Synchronization Channel gives S-SCH timing. S-SCH gives long code group.
Idle mobiles sleep deeply to save battery power, only looking at

PICH Slide Indication Channel this channel to see if they need to wake up and hear a Slide.
Node AICH A mobile sending a random access preamble watches AICH to

Acquisition Indication Channelsee when it may end the preamble and transmit its request.
B
Access Preamble Acquisition A mobile sending a CPCH preamble watches AICH to see when
AP-AICH Indicator Channel it may end the preamble and transmit its request.
CPCH Status Indicator Fixed-rate downlink channel carries CPCH status information.
CSICH Channel Paired with CPCH AP-AICH, uses same ch. and scr. codes
Collision Detection/Channel Fixed-rate common DL channel carries CD indicator only if CA is
CD/CA-ICH Assignment Indicator Channel not active, or both CD/CA indicators if CA is active
Dedicated Physical
DPDCH Data Channel
Dedicated Physical Carries user or control information to a UE wherever it may be in
DPCCH Control Channel the cell.
Physical Downlink Downlink channel used to carry fast user data (the DSCH
PDSCH Shared Channel transport channel). Much like “supplemental channel” in IS-2000.
Synchronization Channel
(P-SCH, S-SCH) Coding
 The Primary SCH consists of an unmodulated code 256 chips long

• Transmitted once every slot
• The same code is used for every base station in the system
– Transmitted time-aligned with the slot boundary
 The Secondary SCH consists of one modulated code 256 chips long,
transmitted in parallel with the Primary SCH
• The code is one of 8, determined by the code group set to which the
base station’s downlink scrambling code belongs
• S-SCH is modulated by a binary sequence 16 bits long, repeated
each frame
• The same sequence is used for each Node B and has good cyclic
autocorrelation
 The SCH is transmitted intermittently (one codeword per slot)
• Multiplexed with DPDCH/DPCCH and CCPCH after long code
scrambling
• So SCH is non-orthogonal to the other downlink physical channels
Reverse W-CDMA Physical Channel Functions
UPLINK CHANNELS
A common uplink physical channel used to carry control Physical Random Access
information or short user packets from the UE Channel PRACH
A common uplink physical channel used to carry short and Physical Common
medium- sized user packets. It’s always associated with a
downlink channel for power control Packet Channel PCPCH
Carries user data from a UE anywhere in the cell. Usually only Dedicated Physical
one DPDCH allocated per connection, services interleaved on it. Data Channel DPDCH
Carries user or control information from a UE wherever it may be Dedicated Physical
in the cell. Pilot symbols, Pwr ctrl bits, reverse rate indication. Can Control Channel DPCCH
be continuous (code multiplexed) or time-multiplexed.
Channels at Three Functional Levels
 Thus far we’ve considered only RLC (Radio Link Control)

channels physically identifiable in the
WCDMA signal. However, the flow of
information can be defined as channels LOGICAL
at three distinct levels: CHANNELS
 Logical Channels
• These are the aggregated broad MAC (Media Access Control)
conceptual flows of information
generated by software at the TRANSPORT
signaling and application levels
CHANNELS
 Transport Channels
• These are the internally-bundled Transport Sublayer
flows of information between the
packet controller function in the
system and the actual Node B PHYSICAL PHYSICAL
LAYER CHANNELS
 Physical Channels
• These are the actual, tangible
channels on specific frequencies Physical Sublayer
and timeslots you could receive off-
air and analyze
W-CDMA Logical Channels
DOWNLINK UPLINK
BROADCAST CONTROL CHANNEL
BCH System Control Information for all users
Configuration and Parameters
DEDICATED CONTROL CHANNEL

DCCH A private channel carrying control information DCCH
between one user and the network
COMMON CONTROL CHANNEL

CCCH A shared channel carrying control information CCCH
Between many users and the network
PAGING CONTROL CHANNEL

PCCH A shared channel carrying paging information
Between the network and many users
Node
B
DEDICATED TRAFFIC CHANNEL
DTCH A private bi-directional channel carrying DTCH
traffic between one user and the network
COMMON TRAFFIC CHANNEL

CTCH A shared channel carrying traffic from the
network to many users or to groups of users
W-CDMA Transport Channels
DOWNLINK UPLINK
BROADCAST CHANNEL Configuration
BCH Low fixed bit rate, transmitted over the
information
Entire sector coverage area
PAGING CHANNEL Slides,
PCH Uses efficient sleep/slotted-mode procedures
Notifications
Transmitted over entire sector coverage area
Contention-based, RANDOM ACCESS CHANNEL

Limited data fields, risk of collisions, RACH
Access, SMS
Power control is open loop
FORWARD ACCESS CHANNEL Common downlink
FACH Data rate can change each frame (10 ms)
For small bursts
No fast power control; can use beam-forming
DEDICATED CHANNEL
DCH Data rate can change each frame (10 ms) DCH
Node Fast power control; can use beam-forming
B
Contention-based, COMMON PACKET CHANNEL
Bursty traffic Change data rates fast; Open-loop ramp-up CPCH
Fast power control; beam-forming, collision detection
DOWNLINK SHARED CHANNEL Shared control or
DSCH Fast data and fast power control;
Bursty traffic
can use beam-forming. Paired with one DCH
Logical, Transport, Physical Channel Mapping
LOGICAL TRANSPORT PHYSICAL
CHANNELS CHANNELS CHANNELS
BCH P-CCPCH
BCCH
FACH
S-CCPCH
PCCH PCH
RACH PRACH
CCCH
FACH
CTCH FACH
S-CCPCH
RACH
FACH
DCCH
DCH DPDCH
DTCH
CPCH PCPCH
DSCH PDSCH
Timing Structure of WCDMA Channels
WCDMA Physical Channel Details
 A physical channel corresponds to a specific

• Carrier frequency
• Code
• and in the case of uplink channels, I or Q phase (0 or pi/2)
 W-CDMA physical channels typically consist of a three-layer structure of
superframes, radio frames, and time slots
• Depending on the symbol rate of the physical channel, the configuration
of the radio frames or time slots varies
 A Superframe is 720 ms. long and consists of 72 radio frames
• boundaries are determined by its System Frame Number SFN
 A Radio Frame is a processing unit with 15 time slots
• one slot includes 2560 chips
 A time slot is a unit containing information symbols
• number of symbols per time slot depends on physical channel
 Uplink dedicated channels can use multicode transmission
• up to six parallel DPDCH transmitted on different channelization codes
Dedicated Physical Channel Frame Structure
Superframe (720 ms)
Frame #1 Frame #2 Frame #i Frame #72
Radio Frame (10 ms)
Slot #1 Slot #2 Slot #i Slot #15
Tslot = 2560 chips, 10*2k bits ( k = 0-7 )
Downlink TFCI Data 1 TPC Data 2 Pilot
DPCCH DPDCH DPCCH DPDCH DPCCH
Uplink Data DPDCH
Pilot TFCI FBI TPC DPCCH
Physical Frame Structure
Uplink Data DPDCH
 Each radio frame of 10 ms is split into 15 slots

 Uplink Physical Channels DPDCH and DPCCH are I/Q multiplexed
 Downlink Physical Channels are time-multiplexed within each slot
• A DPCH is always paired with a DPCCH containing layer 1 information
• The Transport Format Combination Indicator field (TFCI) tells how to
demultiplex the data stream
• The TFCI field doesn’t exist for static rates or blind format detection
• The Feedback Information (FBI) field is used for diversity functions
• The Transmit Power Control bits are used for power control
• On the downlink, a number of dedicated pilot bits may be included
Physical Channel Bit Rates
Uplink Data DPDCH

 Uplink
• Max. physical channel bit rate 960 kb/s with spreading factor of 4
• A user may use several physical channels to obtain higher bit rates
• The channel bit rate of the DPCCH is fixed at 15 kb/s
• The maximum uplink spreading factor is 256
 Downlink
• Maximum channel bit rate is 1920 kb/s with a spreading factor of 4
• The maximum downlink spreading factor is 512
Common Pilot Channel CPICH
P-CPICH PRIMARY COMMON PILOT CHANNEL
 There is one and only one P-CPICH per cell
• P-CPICH uses same channelization code and primary scrambling
code of the cell, transmitted over the entire cell area
• It’s the phase reference for the SCH, P-CCPCH, AICH, PICH AP-
AICH, CD/CA-ICH, CSICH and S-CCPCH, and default phase
reference for the downlink DPCH unless signaling otherwise indicates
S-CPICH SECONDARY COMMON PILOT CHANNEL
 An OVSF SF=256 is arbitrarily used as the S-CPICH channelization code
 S-CPICH is scrambled by the primary OR a secondary scrambling code
 There may be zero, one, or several S-CPICH per cell;
 An S-CPICH may be transmitted over the entire cell or on a narrow beam
 S-CPICH may be the phase reference for a downlink DPCH.
• If this occurs, the UE is informed by higher-layer signaling.
• it is possible that an entirely different non-CPICH phase reference can
be used for a downlink DPCH.
Differences between Primary and Secondary CCPCH
 P-CCPCH Primary
• transport channel can use only a fixed predefined transport
format combination
• is transmitted over the entire cell
 S-CCPCH Secondary
• can support multiple transport format combinations using TFCI
• can be transmitted over the entire cell or on narrow beams if
desired
– this is only valid for an S-CCPCH carrying the FACH
Physical Downlink Shared Channel (PDSCH)
 The Physical Downlink Shared Channel (PDSCH) is
used to carry the Downlink Shared Channel (DSCH) Code#
0 2 1 3 Code#
4 chips
• it is a fast data channel assigned frame-by-frame
to just one UE at a time
 A PDSCH uses a channelization code derived from a Code#
0 4 2 6 1 5 3 Code#
7
8 chips
PDSCH root channelization code
• the PDSCH code must not conflict with other
codes in use in the cell Code#
0 8 4 12 2 10 6 14 1 9 5 13 3 11Code#
7 15
16 chips
 During one radio frame, UTRAN may allocate
different PDSCHs under the same PDSCH root
channelization code to different UEs so long as they Code#
0 168 244 2012282 1810266 2214301 179 255 2113293 191127
Code#
7 231531
do not interfere
32 chips
 Within the same radio frame, multiple parallel
PDSCHs, with the same spreading factor, may be Code# Code#
32
16
48
40
24
56
36
20
52
12
44
28
60
34
18
50
10
42
26
58
38
22
54
14
46
30
62
33
17
49
41
25
57
37
21
53
13
45
29
61
35
19
51
11
43
27
59
39
23
55
15
47
31
63
allocated to a single UE. This is a special case of
0 64 chips
8
4
1
9
5
7
multicode transmission.
 All the PDSCHs under the same PDSCH root
channelization code are operated with radio frame
112
104
120
100
116
108
124
114
106
122
102
118
110
126
113
105
121
101
117
109
125
115
107
123
103
119
111
127
Code# Code#
64
32
96
16
80
48
72
40
24
88
56
68
36
20
84
52
12
76
44
28
92
60
66
34
98
18
82
50
10
74
42
26
90
58
70
38
22
86
54
14
78
46
30
94
62
65
33
97
18
81
49
73
41
25
89
57
69
37
21
85
53
13
77
45
29
93
61
67
35
99
19
83
51
11
75
43
27
91
59
71
39
23
87
55
15
79
47
31
95
63
0
8
4
1
9
5
7
synchronization.
128 chips
 PDSCHs allocated to the same UE on different radio
frames may have different spreading factors.
PCPCH – Physical Common Packet Channel
 A PCPCH access transmission includes:
• one or several Access Preambles [A-P] of length 4096 chips
• one Collision Detection Preamble (CD-P) of length 4096 chips
• DPCCH Power Control Preamble (PC-P) either 0 slots or 8 slots long
• message of variable length Nx10 ms.
CPCH ACCESS PREAMBLE PART
 4096 chips long: 256 repetitions of one of 16 signatures 16-chips long
 RACH preamble signature sequences are used.
CPCH COLLISION DETECTION PREAMBLE PART
 Scrambling code is chosen to be a different code segment of the Gold
code than for the RACH or CPCH preambles.
 The RACH preamble signature sequences are used.
CPCH POWER CONTROL PREAMBLE PART
 The slot format for CPCH PC-P part is same as for the message part
 PC-P length is upper-layer parameter Lpc-preamble. Value: 0 or 8 slots
• When Lpc-preamble > 0, pilot bits extend from:
• slot# (15-Lpc-preamble) to slot #14
User Equipment Architecture
What’s In a WCDMA UE?
Digital
Rake Receiver Symbols
summing
Chips Rake Finger
Scrambling Channelization
bits
Rake Finger
t 
control
Symbols
time-aligned
Receiver Rake Finger Viterbi Decoder,
RF Section Convl. Decoder,
Scrambling Channelization Demultiplexer
IF, Detector
power
AGC Rake Finger Packets
RF Audio
Open Loop
Messages
Duplexer Pilot Searcher
CPU Vocoder
RF Closed Loop Pwr. Ctrl. Audio

Messages
Transmitter
Transmitter Digital Section
RF Section UIM
Scrambling Gen.
Power Control
WCDMA POWER CONTROL
OPEN LOOP
 When coming from an idle state into an
access transmission, the mobile uses
open loop power control
• mobile initial transmit power
adjusted inversely to receive power
• Open loop control is used only to
set the initial power, and is not used
during further transmission (unlike
IS-95/IS-2000)
WCDMA FAST CLOSED LOOP
 During a call or data session, WCDMA
applies power control to both Uplink
and Downlink with 1500 corrections per
second
• correction step size is nominally 1
db but can be adjusted
• up/down decisions on each link use
SIR at the receiver
Basic Call Processing
Cell Search Procedure
 Background:
• each cell uses the same 256-chip primary synchronization code
 1. The UE searches the 256-chip primary synchronization code
• the detected correlation peak corresponds to the slot boundary
• chip, symbol, and slot synchronization are obtained
 2. Using the peaks detected in 1, the UE seeks the largest peak from the
Secondary SCH code word
• there are 64 possible values for this code word
• the UE must check all 15 possible delay positions since the frame
boundary isn’t available until this word is found
• from the strongest Secondary SCH code word, Frame synchronization
and the code group of the cell can be obtained
 3. The UE now has the Secondary SCH code word and frame timing is
known
• The UE now seeks the primary scrambling codes belonging to this
code group
– each group has 8 primary scrambling codes which must be tested
but only at the starting position of relative timing -- the starting
point is known already
• Scrambling code of the cell is then obtained
Types of Handovers in WCDMA
 Intra-Mode
• soft handover
• softer handover
• hard handover
 Inter-Mode
• UMTS WCDMA to/from UTRA TDD mode
 Inter-system Handover
• UMTS WCDMA to GSM
• UMTS WCDMA to CDMA2000
Soft Handover
 Before entering soft handover, the mobile

• Measures the observed timing differences of the downlink SCHs from
the involved base stations
• Reports the timing differences back to the serving base station
 Trigger Parameters
• RSCP Received Signal Code Power
• RSSI Received Signal Strength Indicator
• Ec/No = RSCP/RSSI
• other parameters are being discussed
 The timing of the new downlink soft handover connection is adjusted with
a resolution of one symbol
• This enables the rake receiver in the mobile to collect the
macrodiversity energy from the two base stations
• Timing adjustments of dedicated downlink channels is carried out with
a resolution of one symbol without losing orthogonality of the downlink
codes
Interfrequency Handovers
 Interfrequency handovers arise during utilization of heirarchical cell

structures (macro, micro, indoor cells)
• Several carriers and interfrequency handovers may also be used for
taking care of high capacity needs in hot spots
• Interfrequency handovers are also needed to second-generation
systems such as GSM or IS-95
• An efficient method is needed for making measurements on other
frequencies while still having the connection running on the current
frequency
 Two methods are available to do interfrequency measurements in
WCDMA: Dual Receiver and Slotted Mode
• Dual receiver is considered feasible especially if the mobile uses
antenna diversity
– One receiver branch can be switched to the other frequency
• Slotted Mode is necessary if the receiver has no diversity
– The information transmitted during a 10 ms frame is compressed
by puncturing or changing the FEC rate and the mobile is free to
make a quick measurement on the other frequency
Modes and States - RRC Modes
UTRAN Connected Mode GSM Handover
URA PCH CELL_PCH GSM

Connected
UTRAN Inter-System Handover
Mode
Release
RR
CELL_DCH CELL_FACH Connection
Establish
GPRS Packet
RR
Transfer Mode Connection
Establish
Release Release Initiate
RRC Cell Release
RRC Temp
RRC Connection Establish Reselection Temp
Connection Block
Connection RRC Block
Connection Flow
Flow
GPRS Packet Idle Mode

Camping on a UTRAN cell
Camping on a GSM/GPRS cell
Idle Mode
WCDMA-GSM Handovers Measurement Process
 Since GSM use is so widespread, W-CDMA--GSM handovers are

quite important
• The GSM compatible multiframe structure allows similar timing
for intersystem measurements as in the GSM system itself
• The needed measurement interval is not as frequent as for
GSM terminals operating in a GSM system
In this frame, change coding or puncturing to In this frame, change coding or puncturing to
allow payload bits to finish early so mobile allow payload bits to finish early so mobile
receiver is free during part of the frame. receiver is free during part of the frame.
WCDMA
UMTS
Frames
12 frames 120 ms 12 frames 120 ms
Measure GSM Measure GSM

FCCH and SCH FCCH and SCH
TIME
IMS
What is IMS?
IP Multimedia Core Network Subsystem
 The IP Multimedia Subsystem or IP Multimedia Core Network

Subsystem, IMS is an architectural framework for delivering
Internet Protocol, IP multimedia services. It enables a variety of
services to be run seamlessly rather than having independent
applications operating concurrently.
 IMS, or IP Multimedia Subsystem is having a major impact on the
telecommunications industry, both wired and wire-less.
 Although IMS was originally created for mobile applications by
3GPP and 3GPP2, its use is more widespread as fixed line
providers are also being forced to find ways of integrating mobile
or mobile associated technologies into their portfolios.
 As a result the use of IMS, IP multimedia subsystem is crossing
the frontiers of mobile, wire-less and fixed line technologies.
Indeed there is very little within IMS that is wireless or mobile
specific, and as a result there are no barriers to its use in any
telecommunications environment.
IMS Basics
 IMS, IP multimedia subsystem is an architecture, not a technology

 Users often need many concurrent simultaneous sessions of different applications
such as Push to talk over Cellular (PoC), gaming, video and more, it is
seamless integration is necessary for users to get the full benefits.
IMS Architecture Basics
 The architecture of an IMS system can be split into a number of

main elements or areas:
• User equipment: As the name implies, the user equipment or
UE is part of the IMS architecture resides with the user - it is
the endpoint.
• Access network: This is the portion of the IMS architecture
through which the overall network is accessed.
• Core network: This is a major element within the IMS
architecture and provides all the core functionality.
• Application layer: The application layer contains the web
portal and the application servers, which provide the end user
with service and enhanced service controls. T
Elements of overall IMS architecture:
 Server CSCF: session control for endpoint
devices; maintains state.
 Proxy CSCF: entry point to IMS for the UE;
forwards SIP messages to user's home S-CSCF;
controls inter-working security; QoS mgt.
devices.
 Home Subscriber Server, HSS: provides
subscriber database for the home network.
 Breakout gateway control function, BGCF: selects
the network in which a PSTN breakout is to occur.
If on in the same network as the BGCF, also
selects a media gateway control function, MGCF
 Media gateway control function, MGCF:
interworks the SIP signalling. manages sessions
across multiple media gateways
 Media server function control, MSCF: manages
the use of resources on media servers.
 SIP applications server, SIP-AS: execution
platform to deploy more services
IMS Core Network
 The IMS core network handles the main features of the network as
a whole. The main entities are:
• P-CSCF Proxy Call Session Control Function
– first point of contact for the IMS terminal
• I-CSCF Interrogating Call Session Control Function
• S-CSCF Serving Call Session Control Function
• HSS Home Subscriber Server
 These elements are usually co-located, although they can be
distributed around the network if desired for more capacity.
 Geographic distribution of network elements can provide benefits if
the network is distributed over a wide area
• Traffic reduction as fewer nodes are accessed; lower latency
• redundancy against power outage, etc. One S-CSCF could
take over user registration dynamically from another, etc. This
approach adds significant resilience to the network and
considerably increases the reliability.
CAMEL 3G Services over IMS
 Customized Application for the Mobile network Enhanced Logic

(CAMEL for short) is a standard for intelligent mobile
communications over 3G networks.
 CAMEL is to Circuit-Switched domain what IMS is to IP domain.
• As the world moves towards IMS, CAMEL will eventually
become obsolete.
• IMS is access independent, defined for wireless and wireline.
 IMS will take time for implementation.
• Meanwhile, operators can still use CAMEL to control IMS,
taking advantage of their CAMEL investment.
 CAMEL control of IP multimedia calls is a bridge between the CS
mobile network and the IP multimedia network.
 The currently favored VOLTE technology for VOIP on LTE
networks uses IMS.
Moving UMTS Higher:
HSPA – “the EVDO of WCDMA”
HSPA is the High School Proficiency Assessment mandated by the state

of New Jersey as a graduation requirement for all public school students.
Even Higher Speeds – HSPA and HSPA+
 As UMTS was born, Qualcomm and American operators had

applied the newest principles to its CDMA technology, producing a
hybrid variation called EVDO (Evolved, Data Optimized).
• Adding higher order modulation to the basic CDMA signal,
EVDO offered data speeds of up to 3.1 Mb/s downlink, 1.8
Mb/s up on a single CDMA-like signal just 1.2 MHz. wide
 The ETSI community wasted no time doing the same to its UMTS
/WCDMA signal, achieving speeds of up to 7 Mb/s downlink, 3.5
Mb/s uplink on a single UMTS-like signal just 3.8 MHz. wide
• This signal was called HSPA, High Speed Packet Access
• Downlink and uplink versions were call HSDPA and HSUPA
 If multiple HSPA signals are harnessed together for even greater
speed, this is called HSPA+
• The most advanced HSPA+ multicarrier arrangements offer up
to 44 Mb/s downlink, 22 Mb/s uplink
 AT&T and T-Mobile have advertised HSPA+ as a “4G technology”
HSPA = HSDPA + HSUPA
 The HSPA downlink and uplink specifications were released at

different times through 3GPP. They have different properties
resulting from the different modes of operation that are required,
and are often regarded as almost separate entities.
 HSDPA - High Speed Downlink Packet Access:
• packet data support, reduced delays, peak data rate 14 Mbps
• around three times the capacity of the 3G UMTS
 HSUPA - High Speed Uplink Packet Access:
• improved uplink packet support, reduced delays and a peak
raw data rate of 5.74 Mbps.
• a capacity increase of around twice compared to Release 99
services.
HSPA Speeds under 3GPP Releases
 cc
HSPA Benefits for Two Types of Traffic
The Upper Limits: HSPA+ MIMO
and Carrier Aggregation
HSPA+ Advantages
 Five features of HSPA+ substantially improve both network

performance and user experience
LTE Momentum Slows
Further HSPA+ Feature Development
 The additional three features described above have not reached

widespread deployment
 Strong interest in LTE has removed much of the drive for further
enhancements to HSPA+
Carrier Aggregation for HSPA+
 Multiple HSPA carriers can be combined for even greater capacity

and throughput
 HSPA+ relies on both multiple carriers and higher order
modulation schemes to achieve data rates as high as 44 Mb/s
downlink, 22 Mb/s uplink
The Final (for now) Frontier:
LTE
Where do we go from here?
 The whole telecommunications world is converging on the next

ETSI standard, LTE Long Term Evolution. LTE offers
• Higher data speeds and lower packet latency than any
previous radio technology
• A streamlined packet core network
• A non-proprietary method for providing mobility and roaming
• A better user experience through Quality of Service (QOS)
• Lower costs through widespread use and economies of scale
• A vehicle for handling voice calls with much greater spectral
efficiency, offloading most voice traffic from 2G/3G networks
within five years
 LTE is described in companion course 512
 What comes after LTE?
• More advanced signal, smaller cells, higher speeds
• Call it “5G” for now and look for it in 10 years!

Scott Baxter Total

Uploaded by

Copyright:

Available Formats

Scott Baxter Total

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Scott Baxter Total

Uploaded by

Copyright:

Available Formats

Welcome!

2013 Course Series

To download this entire course series:

December, 2013 (c)2013 Scott Baxter Slide 1

LTE Long Term Evolution

To download this course only:

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 2

 Introduction to all the Wireless Techologies

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 3

Bands and Technologies

109 CDMA EVDO LTE LTE

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter 511 - 9

Bands and Technologies

109 CDMA EVDO LTE LTE

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter 511 - 10

Bands and Technologies

511 - 11 Course 511 v3.0 (c)2013 Scott Baxter December, 2013

December, 2013 Course 311 v3.0 (c)2013 Scott Baxter Slide 12

FDMA FDMA: AMPS & NAMPS

Slide 13 Course 511 v3.0 (c)2013 Scott Baxter December, 2013

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 15

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 16

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 18

15 MHz. 75 Mb/s 37.5 Mb/s > 400

5 MHz. 25 Mb/s 12.5 Mb/s > 200

3.2 MHz. 16 Mb/s 8 Mb/s > 200

3.0 MHz. 15 Mb/s 7.5 Mb/s > 200

1.6 MHz. 7 Mb/s 3.5 Mb/s > 200

1.4 MHz. 6 Mb/s 3 Mb/s > 200

Characteristic LTE LTE Advanced

 Many features of LTE-Advanced are already implemented in

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 20

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 21

Mobile Cell Site, BTS

1G Mobile Cell Site,

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 23

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 24

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 25

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 26

 An LTE signal is made up of many

706 716 730 740

VOIP VOIP Messaging Email Data Video Video Multimedia

 Uplink and downlink are dynamically scheduled taking into account

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 29

706 716 730 740

VOIP VOIP Messaging Email Data Video Video Multimedia

 Uplink and downlink are dynamically scheduled taking into account

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 30

706 716 730 740

VOIP VOIP Messaging Email Data Video Video Multimedia

 Uplink and downlink are dynamically scheduled taking into account

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 31

706 716 730 740

VOIP VOIP Messaging Email Data Video Video Multimedia

 Uplink and downlink are dynamically scheduled taking into account

December, 2013 Course 511 v3.0 (c)2013 Scott Baxter Slide 32

706 716 730 740

VOIP VOIP Messaging Email Data Video Video Multimedia

 Uplink and downlink are dynamically scheduled taking into account