RCSP-RDL6000 Complet

RCSP-RDL-6000
Module-1: LTE System and Technology Overview
© Redline Communications Inc. 2021 All rights reserved.

RCSP-RDL-6000: Module-1 Contents*
Module-1.1: LTE Overview, Building Blocks and Operation

Module-1.1.1: LTE Network-Basic Definitions
Module-1.1.2: LTE Core: Evolved Packet Core (EPC)
Module-1.1.3: E-UTRAN Operation and Parameters
Module-1.1.4: LTE UEs and their Capabilities
Module-1.2: LTE QoS and Data Bearers
Module-1.3: E-UTRAN Protocol Stack Overview
Module-1.4: LTE PHY Overview and Basic Parameters
Module-1.4.1: DL/UL Transmission Schemes
Module-1.4.2: Multi-antenna Systems and Transmission Modes
Module-1.4.3: Wireless Frame Structures and Signalling-FDD/TDD
Module-1.5: LTE SON Overview
Module-1.6: LTE Security Framework
Module-1.7: CBRS Overview and Building Blocks
• System features and capabilities referenced in this module are based

on RDL-6000-R1.3. update 2+ and FlexCore version 13.3.0-2
RCSP Certification Programs RCSP-RDL-6000 Module-1: LTE System and Technology Overview R1.3.2-V1.3a Slide-2
Module-1.1: LTE Overview and Building Blocks Operation
Module-1.1.1: LTE Network-Basic Definitions

LTE: QoE Through Enhancing Capacity and QoS Policy Mgmt
Capacity constraint between

MS’ and external networks
(PDNs) is bottleneck
Using more spectrum and
improving spectral efficiency
helps a bit only
QoS and policy mgmt
techniques can streamline
resources usage
To ensure App quality,
allow differentiated
services, manage network
congestion, and monetize
resources usage
LTE Network: Flat Layer-3 and PS Only Network
E-UTRAN
eNB
Users
UE PDN
IMS
Packet processing
Signalling, Database
eNB
IP addressing…
Users
UE Evolved Packet Core (EPC)

eNB
Core Network (CN)
Access Network
EPC: Routing/computing brain of the LTE network - flat IP Platform
Provides IP connectivity between the UE and PDN/IMS networks
E-UTRAN: an interconnected network of eNBs (LTE base station)
E-UTRAN: Evolved Universal Terrestrial Radio Access Network
Functionally, eNB acts as a layer-2 bridge between the UE and EPC
UEs: User Equipment connects to PDN/IMS through EPS with QoS
LTE Releases: Specifying Features and Capabilities
LTE-Advanced
Rel-8: LTE Rel-9: LTE Rel-10 Rel-11 Rel-12
▪ Introduced LTE ▪ SON ▪ Carrier aggregation (CA) ▪ CA enhancements ▪ MTC ecosystem

▪ 1Gbps DL, 500 Mbps ▪ FDD/TDD
▪ All IP core (EPC) ▪ MIMO Beamforming ▪ LTE unlicensed study
in UL with 5 CCs
▪ MIMO/FDD/TDD ▪ eMBMS ▪ CoMP ▪ D2D
▪ Worldwide roaming
▪ New frequency bands ▪ 8x8 MIMO
LTE-Pro
Rel-13 (more Rel-14 (start of 5G) Rel-15 Rel-16 (5G phase -2)
Throughput)
▪ LAA ▪ NB IoT
▪ Up to 32 CC in CA ▪ V2V Redline’s 5G focus
▪ D2D ▪ V2X (voice to
▪ NB IoT everything)
3GPP has a defined set of releases for the new versions of
▪ 64 antenna MIMO its specifications, each introducing new functionalities
▪ eMTC
Rel-8/9 defines the LTE systems (EPS)

Subsequent releases add features, functionalities and enhancements
Rel-15 starts 5G specifications
LTE Rel # vs. Data Rates: Ideal Channel Conditions
Data Flow LTE LTE-A 5G NR

DL data rates assume Rel 8-9 Rel 10-14 Rel 15-16
spatial multiplexing DL 300 Mbps 1 Gbps 20 Gbps
2/4/8 layers MIMO
UL 75 Mbps 500 Mbps 1 Gbps
UL data rates are based
on a single Tx chain Latency (u-plane) 50ms 10ms 1ms
Some UE categories C-plane latency 100 msec
support MIMO for
higher data rates 3G has a peak data rate of 384 kbps
Graceful performance
degradation as UE moves away
from cell center
Techniques for cell edge
performance enhancing
4G Performance Targets Are
Defined By IMT-Advanced
LTE: Aiming for Shannon Limit – Spectral Efficiency Pursuit
Shannon Limit
data rate
The fundamental channel capacity metric is the max

rate for which arbitrarily small Pe can be achieved
Depends channel BW and SNR (noise and interference in the environment)
SNR degrades as BW increase because S is spread over larger BW!
Reliable communication: Pre-Shannon used repetition coding
Shannon introduced “intelligent coding of information” – 1948 paper
What more can be done to increase data rate cost effectively?
Capacity increase by increasing S is not a viable option – multiple constraints
Spatial Multiplexing (2/4/8 layers) – multiple antenna systems
Reduction of latency: 50-100 msec for C-plane (to establish U-plane)
Module-1.1: LTE Overview, Building Blocks Operation
Module-1.1.2: LTE Core: Evolved Packet Core (EPC)

LTE Architecture: Building Blocks
Mobility Management Entity
• Main signaling and control Node
• UE authentication Home Subscriber Server:
UICC: a smart card • Handovers UE security info database
storing personal data, • Session Mgmt and authentication server
security keys and apps • Selecting Other EPC nodes
IMEI- h/w ID Stores UE
IMSI: identifies a
subscription
subscriber globally
profile data
MME HSS SPR
P-GW PDN
UE S-GW
eNB
PCRF
EPC
Packet Data Network Gateway
LTE Base Station Serving Gateway: Policy and Charging • Connects LTE to PDNs
• providing L2 • Main data plane Rules Function • Allocates IP addressing/release
Bridging between element/router • Rules and policies • Enforces OP policies
UE and EPC • Data paths between related to QoS • Filter DL packets
• all wireless/radio eNB and PGW • Charging, and • Interconnects with non-3GPP
related functions • Local mobility anchor access to network Networks
for UEs • IP anchor for bearers
EPC nodes can be co-located/distributed, each has specific tasks

Nodes communicate via 3GPP interfaces
User-plane (U-plane) and control-plane (C-plane)
LTE Network Interfaces: Non-roaming
Gx
PCEF
Interface: conceptual IP-based link connecting functions in different nodes

Each interface is associated with a protocol stack
GPRS Tunneling Protocol (GTP) is the main communications protocol in LTE
General Packet Radio Service
PMIP mobility protocol is also supported as an option
Multi-PDN Connectivity: Non-Roaming
MME SGi
P-GW1 APN1 PDN1
Default bearer for PDN1 S11

SGi
S5
UE eNB S-GW P-GW2 APN2 PDN2
Default bearer for PDN2
S5 to connect S-GW to (non-collocated) P-GW of same operator

A UE can connect with multiple PDNs concurrently-music/web/FTP
USIM must be provisioned for multi-PDN connectivity
UE IP address changes when UE moves from one PGW to another
Concurrent PDN connectivity: one 3GPP access and one non-3GPP access
Traffic streams for a UE from all PDNs go through the same S-GW
A UE can be served only by one SGW at a given time
LTE Roaming Network Architecture: Intra-LTE View
S6a
MME HSS SPR
S9
H-PCRF
S11
Rx
Gx
S8 PDN
SGW PGW
S1-U SGi
S5 V-PCRF HPLMN
Gx Rx
Home Routed Roaming
PGW PDN
SGi PGW is in HPLMN
VPLMN
Local Breakout : PGW is in VPLMN
S8 connects the SGW in the VPLMN to the HPLMN PGW

HSS is always in the HPLMN PMLN: Public Land Mobile Network
VPLMN: Visited PLMN
eNB, MME and S-GW are in the VPLMN HPLMN: Home PLMN
PGW can be HPLMN (home routed) or VPLMN (local breakout)
UE can obtain an IP address from HPLMN or VPLMN based roaming profile
Roaming-out and Roaming-in must be configured in EPC
LTE Network Areas: Signaling Congestion Mitigation
LTE network is divided

into 3 different types
of geographical areas
MME pool area: UE can move around without changing serving MME
A pool area is controlled by one or more MMEs – a UE is associated with one
Each MME is identified by an MME Code within a pool
Reminder: UE are always
SGW service area: area served by one or more SGWs served by one SGW at a time.
UE can move through this area without a change of serving S-GW
An eNB must set up S1 with all MMEs and SGWs in the respective pools
Up to 16 S1 connections (3GPP S1-flex)
The eNB selects the MME to service the UE – 3GPP specifications
Module-1.1.3: E-UTRAN Operation and Parameters

E-UTRAN Architecture: Interconnected Network of eNBs
eNB is the LTE base station

Provides bridging between UE and EPC
Access stratum (AS) functions
RRM (Radio Resource Management)
RoHC/ciphering/scheduling
Mobility control
Paging from MME to UE…..
(paging = waking up idle UE or requesting status)
eNB controls all its cell (manages all functions within a cell)
Neighbor NBs communicate on 3GPP X2 logical interface Multi-cell eNB
X2 is not bandwidth demanding but requires very small latency
E-UTRAN: an interconnected network of eNBs through the X2 Interface
eNB as a critical U-plane element acts like an IP router and switch
eNB C-plane function is to select the MME and route NAS |
signaling to it
Non-Access Stratum
eNB Classification (TS36.141): Determined by eNB Range and Capacity
Min eNB to UE # of Cells

eNB Class Cell Type Max Tx power Cell Radius Antenna type
coupling los (common)
Wide Area Macro FCC/ETSI 70 dB 3-6 > 1 km 1200 Sector

(Operators)
Medium Area Micro ≤38 dBm 53 dB one 250 m ~ 1km Sector/Omni

(dense urban areas)
Local Area Pico ≤24 dBm 45 dB one 100 ~ 300 m Omni

(large indoor areas)
Home eNB
Femto ≤ 20 dBm (low) 45 dB one 10 ~ 50 m Omni
(HeNB)
Based on cell radius and Tx power (single antenna in eNB)

TS36.104 categorizes LTE BS’ using min coupling loss between eNB and UE
Ellipse 4G HP: 39 dBm per RF port in B14 FCC and 39 km
Cells often overlapping- intra/inter-frequency neighbors
An overloaded macro cell can offload to an overlapping micro/pico cell
HetNet: a network of low-power eNBs (small or pico cells) deployed
within the coverage area of high-power (macro) eNBs
E-UTRAN Deployment Architecture: Cells Within eNB
eNB can have 1-256 radio cards (cell)

Lights a sector (1200 typically)
Identified by cell ID (0-255) in the eNB
PCI (physical cell Identity)
Distinguishes a cell from its neighbors on
UE - separating transmitters
Serves as a resource allocator parameter
for DL and UL pilots (Reference Signals)
LTE defines only 504 PCIs (0-503)

PCI reuse is inevitable – proper planning is required
PCI is used to seed many E-UTRAN algorithms
UE must obtain PCI first, so it read other cell parameters
Ellipse-4G eNB has only one cell - supports up to 128 UEs
PCI Planning: Avoiding PCI Collision and Confusion
PCI Collision T-eNB

S-eNB
PCI collision: UE detects two
eNBs having the same PCI
N-eNBs at the same frequency
must not have the same PCI PCI = X PCI = X
No unambiguous way to notify the UE which eNB it must HO to

UE may stay with its S-eNB and eventually lose service
PCI confusion: no eNB has PCI Confusion

two N-eNBs at the same
frequency using the same PCI ??
S-eNB cannot notify UE to
PCI = X PCI = X
N-eNB: Neighbouring eNB which N-eNB it must HO
UE may Ho to wrong eNB
) PCI allocation must pass mod3,

mod6(SISO) and mod30 tests
PCI = Y
(PCI confused eNB)
Grouping eNBs: Tracking Idle-state UE Location
Tracking Area
|
TA is a logical grouping of cells
Managed by MME, TAs can overlap
Typically 100s of eNBs in OP networks
UE moves freely in a TA or a list of TAs
Tracking Areas (TA)
TA List => (TAL) without having to send a TA
update (TAU) to its serving MME

TAL1 = {TA1,TA3} and TAL2 = {TA2,TA3}
UE-A sends TAU on moving to TA2
UE-B must send a TAU at each cell
MME sends to UE TAL and TAU timer (T3412)
eNB broadcasts a TA code (TAC) in SIB1
PLMN + TAC = TA Identity (TAI)
UE is registered at the TAL level not TAC
Idle UE is known to MME at the TA granularity => The MME knows in which TA each UE is located,
even when they are idle.
RRC-connected UL location (cell it is registered with) is known to MME
RRC-Connected (Radio Resource Control Connected): status of a (non-idle) radio fully connected to the LTE system.
Closed Subscriber Group (CSG) and Cell Access Modes
Closed Access
CSG is a set of UEs allowed
to access a CSG cell
CSG Cell allows access only
to CSG UEs
SIM must have the CSG info
SIB1 tells a UE whether cell
is CSG or not
SIB1: System Information Block type 1
SIB1 with the CSG information is broadcast by
Hybrid Access
the eNB; the UE checks the SIM to see if that
CSG is known or not.
Open Access Mode: any UE’s meeting cell selection criteria
All cells are in this mode by default
Closed Access Mode: cell allows only CSG UEs
Hybrid: CSG and non-CSG UE’s are allowed access to the cell
Ellipse-4G controls number of each UE type-16/32/64/128
Active Network Sharing: RAN and Spectrum (TS 22&23.251)
OP-A EPC OP-A EPC

OP-B EPC OP-A EPC
S1-Flex MME (Pool)

S1-Flex
Shared RAN
MOCN (multi-operator CN): each Shared RAN

operator has a dedicated core (EPC) GWCN (Gateway CN): operators
also share the MME node
eNB broadcasts up to 6 PLMN IDs in SIB1
CN: Core Network
eNB selects MME based on PLMN ID from UE RAN: Radio Access Network
PLMN: Public Land Mobile Network
eNBs exchange PLMN info on X2 for HO
Ellipse-4G supports 3GPP RAN sharing
Module-1.1.4: LTE UEs and their Capabilities

UE Categories: UE Radio Access Capabilities (TS36.306 table 4.1-1)
CAT-M NB-IoT
UE Category Cat 1 Cat 2 Cat 3 Cat 4 Cat 5 6 7 8
Cat 0 (CAT-M1) (CAT-M2/NB/NB1)
LTE Release 8-9 10 12 13 13
MIMO DL 1x2 2x2 4x4 2x2 (CA) or 4x4 8x8 1x1
1x1 HD
1x2 FD/HD-FDD
MIMO UL No No 2x2 4x4 (single layer)
TDD
# of CCs (BW) 20 MHz 40 MHz (2 CCs) 100 (5 CCs) 20 MHz 1.4 MHz 200 KHz
••• 800 Kbps
Peak Data DL 10 50 100 150 300 300 300 1200 1 ≈ 200 Kbps
(FD-FDD)
Rate (Mbps)
UL 5 25 50 50 75 50 150 600 1 1 (FD-FDD) ≈ 200 Kbps
Rx Diversity Yes Yes No (1 Rx antenna)
DL Modulation QPSK, 16QAM, 64QAM ( 256QAM in CAT 11 onwards)

16QAM max
64QAM in UL No Yes No No Yes No
UE complexity Example: CAT 4=100 % (complexity increases with UE category, MIMO…) 40% 30% < 15%
Support for 256QAM in UL comes in CAT-16 (Rel 14 specs)+
Category specifies a UE’s DL/UL radio access capabilities- declares it to eNB

Enabling eNB to communicate effectively with its connected UEs
CAT-6 will save half the time compared to CAT-4 for same file size
CAT-M (LTE-MTC, LTE-M) has one oscillator for DL/UL frequency –Half-Duplex Type B
22 different UE categories in Rel-13 with focus on IoT devices
Battery life, low cost, coverage, range and massive device connectivity
LTE-M and NB-IoT are also referred to as Mobile IoT
LTE UE Power Class: LTE Band Specific
Power
Max Output Tolerance
PC2 Class
Power (dBm) (dB)
(PC)
1 31 +1/-3
2 26 ±2
3 23 ±2
4 21 +/-2
5 20 +/-2
6 14 +/-2
Four Power class specifies the max Tx power of a UE in UL

Broadband power (for all RBs)
Max Power Reduction (MPR) defined for each power class and modulation
Min UE power is set to -40 dBm
PC-3 is the main UE power class – single Tx chain and used universally
Backward compatibility with UMTS/GSM systems
PC-1: B14 (public safety with additional requirements)
PC-2: B41(to compensate for higher frequency propagation losses)
Max UE power is modified for MIMO, CA….
LTE Identifiers: Network and eNB (3GPP TS 23.003 )
An LTE entity is assigned one

or more IDs to identify it
locally or globally MCC: Mobile Country Code
MNC: Mobile Network Code
eNB ID: uniquely identifies eNB in a PLMN (20 or 28 bits)

LTE cell IDs
Cell ID: (0-255) uniquely identifies a cell within an eNB
ECI (E-UTRAN Cell ID): identifies a cell within a PLMN
Short eNB: 20 bits allowing 256 cell per eNB – macro/micro base stations
Long eNB: 28 bit, only 1 cell per eNB – pico/nano/femto cells
ECGI (E-UTRAN Cell Global ID): identifies a cell globally = PLMN+ECI
PCI: a number from 0 to 503 identifying a cell at the air interface
Network planning is based on PCI not ECGI (complex detection process)
Radio Network Temporary Identifiers (RNTIs) assigned by eNB
UE specific - used to scramble messages of a channel type (data/control)
LTE Identifiers*: UE and LTE Core
UE Mobile Equipment (ME) UICC (universal integrated circuit card) – h/w token
(hosts the mobile OS (runs Java APP or USIM and contains security
and LTE radio system) Keys. USIM interfaces with eNB and EPC)
IMEI (Int’l ME ID) identifies device to the

LTE network, 8 digits assigned by the IMSI (int’l mobile subscriber (MS) ID)
Manufacturer, stored in operator database Globally and uniquely identifies a user
MSISDN: MS integrated Service Digital
Network number
PLMN ID (6 digits max) MSIN (MS Identity number) 9-10 digits
operator global ID operator assigned, uniquely identifies
an MS in the PLMN
GUTI (temp UE ID by MME – 80 bits): Identifies

HSS ID Subscriber ID
UE to MME and the MME that the UE is parking on
GUMMEI 48 bits or less M-TMSI (32 bits): identifies MS

(Globally Unique MME ID) within its serving MME S-TMSI (SAE -TMSI): 40 bits identifying MS within
an MME group/pool, used for paging
PLMN ID MMEI (MME ID) 24 bits MMEC (MME code) 8 bits M-TMSI (mobile TMSI)
identifying MME within PLMN identifying MME in a group unique within an MME
S-TMSI is the shortened form of the GUTI to enable more efficient

MMEGI (MME group ID-16 bits) MMEC (MME Code): 8 bits radio signalling procedures (paging and Service Request)
16 bits unique MME ID Identifying MME in a pool
in a group TMSI: Temporary Mobile Subscriber Identity
*ITU-T Recommendation E.213
UE IDs: The Big 5
IMSI: permanent, globally unique OP assigned

Stored in UICC and HSS
Valid when UE service is active
M-TMSI: MME assigned to void sending IMSI OTA after first transaction
Local significance only (identifies UE within MME)
(sim)
IMEI: permanent, manufacturer assigned-stored in UICC and HSS
C-RNTI: serving eNB assigns it to a UE-stored in UE and eNB
CRNTI: Cell Radio Network Temporary Identifier
Valid until UE disconnects from the serving eNB
GUTI: dynamically assigned by the MME-stored in UE and MME
One part identifies MME and the other the UE GUTI: Globally Unique Temporary Identity
IP Address: dynamic and assigned by the PGW

Stored in UE and PGW and any other node "north" of the PGW
Valid as long as the UE is Registered with the EPC
UE also gets IDs from S1 (S1AP ID) and X2AP (X2AP ID)
Module-1.2: LTE QoS and Data Bearers
QoS Class Identifier
|
LTE QCI Characteristics
QCI Attributes (QoS Metric)
QCI Resource Type PELR Typical Application (intent)
Priority PDB (msec)
(PER loss rate)
1 2 100 1.00E-02 Conversation voice (such as ViLTE voice and VoLTE)
2 4 150 1.00E-03 Conversational video
3 3 50 1.00E-03 Real-time gaming
4 GBR 5 300 1.00E-06 Non-conversational video (ViLTE video)
65 0.7 75 1.00E-02 MCPTT (user plane voice)
66 2 100 1.00E-02 Non-MC user plane Push To Talk voice
75 2.5 50 1.00E-02 V2X messages
5 1 100 1.00E-06 IMS signalling
6 6 300 1.00E-06 buffered Video, www, email, ftp
NON-GBR
7 7 100 1.00E-03 Voice, live streaming video, Interactive gaming

8 8 300 1.00E-06
Video, www, email, ftp (TCP based traffic) etc.
9 9 300 1.00E-06
69 0.5 200 1.00E-06 MC sensitive signalling ( MCPTT signalling)
70 5.5 60 1.00E-06 MC Data (same as QCI 6/8/9)
79 6.5 50 1.00E-02 V2X messages
QCI identifies resource type, PELR, PDB and packet handling priority
U-plane treatment for IP packets transported on a bearer
QCI priority, PELR and delay (20 msec between PCEF and eNB is assumed)
PELR: % of higher layer packets lost during non-congestion periods
PELR: Packet Error Loss Rate
GBR: resources reservation in every EPS node dealing with GBR packets
GBR: Guaranteed Bit Rate
EPS Bearer: User Traffic Transport PCEF UE
E-UTRAN EPC PDN
UE eNB SGW PGW PS

Network
Data Radio Bearer (DRB) S1 Bearer S5/S8 Bearer External Bearer
E-RAB
EPS Bearer (realizes negotiated Service QoS)
End to End Service
UE S1 S5/S8 SGi
Bearer: Packet flow that receives a common QoS treatment.
Uniquely identifies data flows requiring same QoS on PGWÅÆUE path
Service QoS is attached to a bearer–U-plane path or connection
The “DRB-S1 bearer-S5 bearer” together make the LTE U-plane
UE gets one default bearer from each specified PDN-tied to UE IP
One or multiple dedicated bearers - can be released when not needed
Eleven bearers per UE: 3 SRB and 8 data
SRBs are used to carry RRC and NAS signalling on Uu (SRB0/1/2)
Dedicated Bearers: Providing Service-specific QoS
E-UTRAN EPC PDN
UE eNB SGW PGW

Data Radio Bearer (DRB) S1 Bearer S5/S8 Bearer External Bearer
E-RAB PS
Network
EPS Bearer (realizes negotiated Service QoS)
End to End Service

S1 S5/S8 SGi
Uu
Each dedicated bearer has an associated TFT - tied to UE’s IP add

EPS bearer spans S5/S1/Uu interfaces-cannot be implemented directly
One-to-one mapping between DRB, S1 and S5/S8 bearers EPS bearers are the main data
bearers.
S1 and S5/S8 bearers are implemented using GTP-U tunnels
E-RAB is deactivated when UE has no context in eNB –UE enters Idle mode
E-RAB: E-UTRAN Radio Access Bearer
S5 bearer is always enabled – to maintain UE IP address
Bearer establishment Order: S5ÆDRBÆS1
Bearer Types” GBR and Non-GBR
EPS Bearers
GBR bearers are used for real
time services
Reserve a min amount of BW Dedicated Default
on per bearer basis with an Bearer Bearer
MBR limit (Maximum Bit Rate limit)
Non-GBR
Do not release at any time GBR Non-GBR (best effort)
(even if there is no traffic on the GBR bearers, the
bandwidth is never made available for non-GBR
bearers)
BE: Best Effort
Non-GBR bearers are BE and have no per bearer reserved bit rate
An AMBR is defined per a group of non-GBR bearers of a single user
AMBR: Aggregated Maximum Bit Rate
APN-AMBR - per APN limit-DL/UL – saved in HSS
APN: Access Point Name (identifies the PDN, and can also identify the type of service)
UE-AMBR – for all PDNs UE may connect to – saved in HSS
Each Non-GBR bearer can utilize the entire UE-AMBR when other bearers silent
ARP policy rules applies on per bearer basis
SDF Filters/Templates
IP flows are the network traffic

for a UE
Packets with same IP header
SDF (service data flow): IP
flows to a UE and having the
same QoS attributes
SDF mapping to EPS bearers
uses operator defined filters
called TFTs (Traffic Flow Template)
5-tuple IP header
PGW processes QoS at SDF
level first and then at EPS
bearer level
SDF to Bearer Mapping: DL Example
UE eNB SGW PGW PDN

IP APN IP
Traffic Flow Templates (TFT)

IP flow 1
Dedicated EPS Bearer SDF1 QoS Policy

IP flow 2
E-RAB IP flow 3
IP flow 4
Default EPS Bearer SDF2 QoS Policy
IP flow 5
Dedicated EPS Bearer SDF3 QoS Policy IP flow 6
Data RAB S1 Bearer S5 Bearer SDF
IP flows are classified to SDFs based on applicable TFT

SDF: a group of IP flows associated with a Service that the UE is using
SDFs matching a TFT are mapped to an EPS bearer
Initial bearer-level QoS of the default bearer is assigned by MME
Based on subscription data from HSS PCRF: Policy and Charging Rules Function (one of the EPC blocks)
PCEF: Policy Control Enforcement Function (part of PCRF)
PCEF may change it in interaction with PCRF or based on local configuration
QoS and Policy Mgmt: Per EPS Node View
PCRF: Policy and Charging Rules Function (one of the
EPC blocks) Uses dynamic info and OP-configured
PCEF: Policy Control Enforcement Function (part of PCRF) policies to define PCC rules 1 PCRF 2
PCEF
5 4
3
TFTs are used in DL (PCEF) and UL (UE) to map SDFs to bearers

P-GW maps bearers to underlying transport (e.g., ethernet)
Transport is not aware of the bearer concept and may use IP QoS (DiffServ)
MME sets UE-AMBR = sum of APN-AMBRs up to the subscribed limit
GTP: A 3GPP Protocol Delivering IP packets within EPC
GTP: GPRS Tunneling Protocol
GTP-C to deliver signalling on

S11/S5 and GTP-U to deliver
UE traffic over S1 and S5
The GTP tunnel is identified
in each node with a Tunnel
Endpoint Identifier (TEID),
an IP address and a UDP
port number
TEID (unidirectional) are
assigned to each UE
Generated by each node
during initial UE attach
The receiving side of GTP locally assigns a TEID that the Tx side must use
In DL, eNB assigns the DL TEID that the SGW will use
Packets From UE To Internet (UEÆPGW): An Example
DL
Uu
UE eNB
UL
3. SGW modifies GTP-u header and sends the

1. UE sends a packet to Google
packet to PGW
2. eNB encapsulates it inside GTP-u
4. PGW removes GTP header and shoots the
Sends it to SGW
packet to the internet
QoS Management in LTE: QCI Mapping
|
QoS Class Identifier
QCI to DSCP mapping in eNB (UL traffic) and PGW (DL traffic)
To control the per hop behaviors (PHBs) in the transport network
Queuing and packet dropping/forwarding
eNB: extending LTE QoS to the transport network in UL
PGW: extending LTE QoS to transport in DL
QCI to Media type mapping in PCRF
Module-1.3: E-UTRAN Protocol Stack Overview
LTE Radio Protocol Stack: Resides in eNB and UE
Non-Access Stratum UE
| IP traffic
NAS: UE and MME signalling eNB
NAS NAS
PLMN selection, TAU,
paging, authentication and RRC L3 RRC
MME
EPS bearer control S1-U

PDCP PDCP
Access stratum (AS) SGW PGW
Access Stratum
Signalling on Uu RLC RLC
L2
RRC (L3) procedure OTA
RRC-signaling and MAC MAC
connection
PHY PHY
UEÅÆ EPC NAS signalling L1
U-plane C-plane C-plane U-plane
HO (S1AP, X2AP, SCTP)
SRBs and DRBs
U-plane: uses UDP to carry user traffic – eNB to SGW and eNB to UE
C-plane: handles signaling - TCP or SCTP
LTE security applies to both C-plane and U-plane
E-UTRAN L2 Building Blocks (TS 36.321/322/323)
UE eNB
PDCP: one instance per bearer Uu
NAS NAS
RoHC/Ciphering/duplicate-discard RRC RRC MME
Add a header (2-3 bytes) data PDCP PDCP

Radio
Used in UE for deciphering Bearers
L2
RLC RLC
RLC: one instance per bearer
eNB configures RLC for each QCI MAC MAC
Segmenting and concatenation PHY PHY

RLC Transparent mode (TM) U-plane C-plane C-plane U-plane
Used when PDU sizes are known a priori

Signalling/Broadcasts/paging messages and eeffectively uses no header
RLC Unacknowledged Mode (UM): real time services-unidirectional
RLC header: enables in sequence delivery of data and error detection
Used typically VoLTE (QCI1 and QCI2): delay sensitive but PER tolerant
PER: Packet Error Rate
RLC ACK mode (AM)- suitable for non-real time bidirectional services
ARQ: Automatic Repeat reQuest
Interactive/background services allowing ARQ due to delay tolerance
E-UTRAN L2 Building Blocks: MAC
UE eNB
IP traffic
Multiplexing/demultiplexing of RLC PDUs Uu
NAS NAS
Error correction through HARQ RRC RRC MME
HARQ: Hybrid ARQ
Logical channel prioritization and PDCP PDCP
Radio
Scheduling information reporting Bearers
L2
RLC RLC
Mapping between the logical and the
transport channels MAC MAC
Transport format selection PHY PHY

C-plane U-plane
Once MAC instance per cell/eNB U-plane C-plane
RACH: Random Access CHannel

UL functions include RACH scheduling, and transport format selection
LTE L2 supports two levels of retransmissions for providing reliability
HARQ at the MAC layer and outer ARQ at the RLC layer
Achieving low latency and low overhead without sacrificing reliability
IP packet for UE is encapsulated by an EPC-specific protocol and
tunneled between the P-GW and eNB for transmission to UE
LTE Transport Block (TB): MAC PDU
MAC builds the TB

188 TB sizes (40-6144 bits) depends
on data rate
RLC segments/concatenates RLC
SDUs to fit into TBs
Scheduling decision per TTI (1msec)
TTI: Transmission Time Interval
2 TBs per TTI in all MIMO modes
One for non-MIMO mode
MAC sends TBs to the PHY layer
PHY segments TBs > 6144 bits
Adds a 24 bits CRC to each TB and
performs channel coding
PHY outputs a “codeword”
BLock Error Rate
|
BLER for LTE link (PHY = 10%) - 90% success rate is required
UE-eNB Connectivity: RRC-Modes – AS Parameter
Radio Resource Control

|
RRC-Connected UE
Known to eNB/EPC
Tx/Rx data
Reports CQI (Channel Quality Indicator)
HO: Handover
Can do HO – handled by eNB
DRX: Discontinuous Reception
DRX can be configured to save
batter power
RRC-Idle UE: No NAS connection
A PDN connection exists
Registered with MME - known at TA granularity
Not known to eNB, no RNTI, no RRC -UE does not maintain UL sync
RNTI: Radio Network Temporary Indicator
The only Tx in UL the UE can do is RACH
P-RNTI: Paging RNTI
Monitors PDCCH for paging (P-RNTI) - specific subframe in a specific frame
PDCCH: Physical Downlink Control CHannel
UE handles mobility through Cell reselection
U-plane latency is ≤ 10 msec
LTE Protocol Stack and EPC: Summary
NAS Node Selection Function

|
NNSF is located in the eNB to determine and establish an association between a UE and an MME
node in an MME pool to which the eNB belongs. It enables proper routing via the S1-MME interface
LTE Communication Channels: Inter-Layer Data Flow
DL UL
PBCH
Logical (7 DL, 3 UL): what type of data they carry - traffic/control

Transport (4 DL, 3 UL): how is the data transferred OTA- MCS, MIMO..
Physical (DL/UL): where is data sent OTA – UE is the destination
Defined by the time-frequency resources for actual transmission of data
e.g. first N symbols in the DL frame and where UE must look for data
Physical signals are not physical channels (do not carry MAC PDUs)
eNB uses rate control in DL – different power levels on different channels
LTE Control Signals Overhead
PBCH: vital system parameters - QPSK PBCH: Physical Broadcast CHannel
System BW, PHICH info, SFN and eNB Tx antenna configuration

PDSCH: DL data for multiple UEs from multiple logical channels
QPSK, 16/64QAM/256QAM and all LTE TM modes PDSCH: Physical Downlink Shared CHannel
PDCCH: DL grants data to a UE (C-RNTI)-1st symbol in each subframe
DL: applies to current subframe-26% of total overhead PDCCH: Physical Downlink Control CHannel
UL: applies to the 4th subframe from the one carrying PDCCH
Uses DCI: info about RB allocation and MCS to enable UE decode PDSCH
DCI format (0, 1, 2…) indicates its purpose such as TM mode etc.
PCFICH: symbols used for PDCCH (1-3)-in 1st symbol of each subframe
PCFICH:
PCI is used to calculate PCFICH frequency offset among cells Physical Control Format Indicator CHannel
PHICH: eNB DL ACK/NACK (BPSK) – UL ACK/NACK comes on PUSCH or PUCCH
PHICH: Physical Hybrid-ARQ Indicator CHannel
PRACH: used by UE for RAP to sync with eNB in UL PRACH: Physical Random Access CHannel
PUCCH: Scheduling Requests (SR), DL data ACK/NACK and CQI PUCCH: Physical Uplink Control CHannel
PBCH, PCFICH, PDCCH, and PHICH are Tx diversity coded
Transmi ed at −3 dB compared to the configured value in eNB
System Information (SI): eNB (L3) Sends Control Data to UE
Master Information Block System Information Block
| |
SI consists of fixed part (MIB) and dynamic part (SIB)
MIB carries essential info about the cell, enabling UE to achieve DL sync
SIBs carry information to indicate to UE how the cell is configured
SIB1, SIB2… SIB13… carry specific info from eNB for UEs and sent on DLSCH
SIBs are mapped to the SI - SI size cannot exceed a transport block
|
System Information
DL channel size, timing reference, antenna config (1, 2 or 4), system
MIB frame number (SFN) and PHICH config (duration and resources). Sent
(mandatory) on PBCH with QPSK modulation and has a 40 msec periodicity
SIB1 PLMN, TAC, cell ID, cell baring status, min Rx level for cell selection
Tx time and periodicity of the other SIBs – 80 msec periodicity
(mandatory)
Cell’s radio resources, physical channels, Tx power, UL carrier
SIB2 frequency and channel BW, RACH data, transmit time, UL power
(mandatory) control and UL channel related parameters – 160 msec periodicity
Contains info for intra/inter-frequency, and/or inter-RAT cell
SIB3 reselection –received in Idle mode only
Intra-frequency neighboring cell info for Intra-LTE intra-frequency
SIB4 cell reselection.
Information regarding inter-frequency neighboring cells (E-UTRA) –
SIB5 received in idle mode only
SIBs are sent on the LTE data channel (PDSCH)
LTE C-Plane and U-Plane Protocols
C-Plane: signalling and NAS control

Network attachment, security bearers and
mobility mgmt
S1-AP: directly mapped on SCTP
UE is assigned S1-AP ID at both end
U-Plane: GTP-U on S1/S5
SGi PDN
APP
APN
X2 Functionality (TS36.423): U-plane and C-plane
Radio E-UTRAN
Network
layer
eNB
Transport
X2 X2
layer
eNB
X2
eNB
X2-AP: C-plane signalling between eNBs
HO preparation phase
Mobility load balancing (MLB)
X2 has stringent latency requirements
Using a VLAN, X2 interface can be prioritized over the backhaul
SON enables the eNBs to get each other’s IP address from the EPC
SON: Self-Optimizing Networks
U-plane: S-eNB sends UE data to T-eNB while UE is completing X2 HO
Module-1.4.1: E-UTRAN Transmission Schemes

DL OFDMA and UL SC-FDMA
LTE Spectrum Usage: Sub-6 GHz-Region Specific
Coverage/Capacity/Convergence
Device availability/Roaming
Paired spectrum: FDD bands FDD: Frequency Division Duplex
TDD: Time Division Duplex
High DL and low UL frequencies
Unpaired spectrum: TDD bands
LTE carrier raster is 100 KHz
Carrier frequency = n∗ 100
Two frequencies using BW1 and
BW2 are separated by
(BW1+BW2)/2 MHz
EARFCN: E-UTRAN Absolute Radio Frequency Channel Number
EARFCN designates DL/UL carrier frequency: integer value 0 – 65535
Uniquely identifies the LTE band and carrier frequency (TS36-101, section 5.7.3)
Spectrum allocation and applicable rules are specified by regulatory bodies
LTE Operating Bands: Region Specific Rules
3GPP specifies bands when spectrum becomes available
On each carrier, the UE

must use the entire cell BW
Bands 66-71 as well as B252 and 255 (unlicensed bands)

Some bands have reversed duplexing: B13, B14, B20 and B24
B48: 3550-3700 MHz – CBRS using FCC certified SAS (Spectrum Access System)
Carrier Aggregation (R10): Increasing Channel Size
Intra-band contiguous BW (easiest)

Grouping several LTE ‘‘component
carriers’’ (CCs) – FDD and TDD
Based on R8/9 carriers
To maintain backward compatibility
5 CC (R10) and 32 CC (R12)
CC: Component Carrier
FDD: different number of CCs in DL/UL Intra-band non-contiguous BW
# of UL CCs ≤ # of CCs in DL
Each CC can use different channel BW
TDD: # of UL CCs = # of CCs in DL
All CCs normally have same BW
Inter-band non-contiguous BW
LTE RF Channel Characteristics: Multipath and Doppler Effect
RF Channel
Users
Shadowing
(slow fading)
Path Loss
Fast Fading
Multipath: frequency selective fading – channel coherent BW Maximum coupling loss (LCL)
Loss between eNM and UE before which
Doppler Effect due to mobility – channel coherence time communication is cut off (typically 142 dB)
Causes fast fading and hence needs fast channel estimation capability
Fading, pathloss and signal distortions
LTE uses coherent detection- Rx needs channel amplitude and phase characteristics
Reference signals (pilots) are used in LTE
LTE PHY Air Interface: Enabling Technologies
OFDMA: Orthogonal Frequency Division Multiplexing Access

OFDMA-DL: parallel Tx of data symbols
ISI: Inter-Symbol Interference
Robust against ISI and simple UE Rx design
Single tap equalization at the UE
Efficient eNB resources utilization
PAPR is the main issue
eNB
SC-FDMA: UL SC-FDMA: Single-Carrier Frequency
Division Multiplexing Access
Pre-coded OFDMA UE
Serial transmission of data symbols
No PAPR issue
More efficient use of UE battery power
Multiple channel sizes
Flexible spectrum allocation and data rate
Multiple antenna system in DL and UL
Different antenna configurations
Efficient error handling mechanisms
FEC, ARQ and HARQ
OFDM: Prolonging Data Bit Duration
OFDM
Rb /N bps
f1 ∆f = 15 kHz
Serial to parallel conversion
OFDM
Input Data Stream Signal
(from higher layers)
f2
+
•
• •
•
Rb bps Rb /N bps •
•
fN
A multi-carrier scheme using overlapping orthogonal narrowband

subchannels (subcarriers)
subcarrier
Each subscriber
////////////////////// in LTE is 15 kHz and is fixed for all channel sizes
Input data is divided into N streams, each carried on a subcarrier

Makes the channel flat fading and reduces ISI but does not eliminate it
OFDM subcarriers are generated using FFT technology (pure DSP)
The FFT size varies based on channel size
128, 256, 512, 1024 and 2048 in LTE
Many of the outer subcarriers in a channel are used as guard bands
OFDM Signal: Time and Frequency View
OFDM Symbol Duration (active time + CP)
CP: Cycllic Prefix
≫ Tu = Useful Symbol = 1/∆f = 66.7 μsec
A guard time (CP) eliminates ISI
due to multipath CP Active time = TU = 1/∆f time
Depends on channel delay spread

(≈1000 nsec in urban areas)
Normal CP: 4.7 μs
Max path difference of 1.5 km
Consumes about 7.5% of the PHY capacity
Extended CP: 16.67 μs (path difference of 5 km)
Used large cell ranges, e.g., 100 km
Subcarriers are added to create the OFDM signal
PAPR: Peak to Average Power Ratio
OFDM signal can have high PAPR in time domain
Requires PA power reduction in the Tx
Pilot signals (reference signal): channel estimation
and coherent carrier demodulation at the Rx
LTE PHY: Scalable OFDM (∆f = 15 KHz Fixed)
Channel BW (MHz) 1.4 3 5 10 15 20
FFT Size 128 256 512 1024 1536 2048 FFT size is varied
based on channel
Used Subcarriers +DC 73 181 301 601 901 1201 size to keep ∆f
Guard Subcarriers 55 75 211 423 635 847 fixed = 15 KHz
Subcarrier spacing 15 KHz
Basic time in LTE PHY Ts = 1/(Δfx2048) = 1/(15000*2048) = 32.6 nsec
Active OFDM time 66.7 μsec = 2048 Ts
Frame Structure Frame =10 msec, subframe = 1 msec, slot 0.5 msec
Cyclic Prefix (CP) Normal CP = 144Ts = 4.7 μs, Extended CP = 512 Ts= 16.67 μs
OFDM Symbols/slot 7 with normal CP 6 with extended CP
LTE time parameters are expressed

as multiples of the basic time (Ts)
LTE headline data rates are based
on 20 MHz channel size and normal
CP with DL MIMO
8x8 for UE Cat-8
Data Mapping in OFDM: QPSK Modulation Symbols
Each data symbol occupies 15 KHz

for an OFDM symbol duration
QPSK data symbols
OFDMA transmits the four QPSK data symbols in parallel

One symbol per 15 KHz subcarrier
Allows channel condition-based scheduling
DL OFDMA makes it easy to equalize the channel at the Rx
A single carrier transmission must clock 4 times faster to achieve the
same data rate on the same channel BW
This requires for very complex channel equalization at the Rx
LTE Resource Grid(Time-Frequency) Definition
Resource Element (RE) Short CP
One subcarrier over one OFDM

symbol
Resource block (RB)
12 consecutive subcarriers over
one slot (0.5 msec)
An RB = 180 KHz (12 x 15 KHz)
Each of the 7 OFDM symbols in a
slot has 12 subcarriers
Total of 84 Res within an RB for
normal CP
RB is the min scheduling
resource size for DL and UL
Note: at the PHY level, 3GPP speaks of Physical RB or PRB and some calculations on the web, they use a PRB =
2RB in view of the fact that LTE scheduling is done on a 1 msec basis which covers to 2 RBs
Channel Size Vs. Transmission BW (TS 36.101)
Channel BW (MHz) 1.4 3 5 10 15 20
FFT Size 128 256 512 1024 1536 2048
# of Used Subcarriers (X) 72 180 300 600 900 1200
Number of PRBs = X/12 6 (0-5) 15 (0-14) 25 (0-24) 50 (0-49) 75 (0-74) 100 (0-99)
Transmission BW (MHz) 1.08 2.7 4.5 9.0 13.5 18.0
Sampling Rate (M samples/sec) 1.92 3.84 7.68 15.68 23.03 30.72
MIB: Master Information Block
DL channel size is indicated in

the MIB as “number of PRBs” (Physical Resource Block)
UE gets the MIB by decoding
the PBCH successfully
PRBs are indexed: PRBx
x = 0, 12, ..99 for 20 MHz
0-49 for 10 MHz
LTE UL PHY: SC-FDMA-Extending UE Battery Life
Each data symbol occupies N subcarriers (Nx15 KHz)

for 1/N of the SC-FDMA symbol duration
Transmits data symbols sequentially

PAPR: Peak to Average Power Ratio
Achieves 3-6 dB improvement in PAPR compared to OFDMA
Allows for reduced PA back-off improves coverage
SC-FDMA is OFDM but with-a-twist called DFT pre-coded OFDM
PHY numerology (subcarrier count, CP..) is the same as DL OFDMA
A modulation symbol is carried over a set of subcarriers – frequency diversity
OFDMA carries one symbol per subcarrier
SC-FDMA needs complex channel equalization at eNB – easy to achieve
OFDMA Vs. SC-FDMA: Tx Comparison
|-------Frequency domain-------| |-----------------Time domain-----------------|

FEC
SC-FDMA uses a DFT pre-coder followed by an OFDMA front-end

Data is first modulated on a single carrier in time domain which converted to
frequency domain by the DFT for subcarrier mapping
Each modulation symbol is spread over the entire bandwidth
Channel coding is Turbo coding in LTE with mother code rate of 1/3
Frequency Domain Structure Of DL and UL Waveforms
The extra subcarrier (DC) in DL is not used

Coincides with carrier center frequency
Interference from local oscillator leakage
In UL, center frequency is located between two UL subcarriers
Resource Allocation: Summary
A UE is allocated an
integer number of RBs
Need not be contiguous
in RDL-6000
Scheduling is updated every 1 msec (aka TTI)

Two TBs per TTI in spatial multiplexing transmission mode
Number of UEs scheduled in a TTI is vendor specific
4 in RDL-6000 (DL/UL) in 5/10 MHz and 2 UEs in 15/20 MHz channel size
In UL, only contiguous allocations are allowed
To maintain SC-FDMA properties of the signal
PDCCH BW grant indication applies to the current subframe
The subframe occurring 4 subframes after the one carrying PDCCH
LTE Data Rates: Finding LTE Symbol Transmission Rate
Data rates correspond to:

REs carrying data on
PDSCH and PUSCH
MCS
MSC
///////// used for each RE
Multi-Antenna
configuration in eNB
and UE
LTE overhead as a rule of thumb is 25% of the total data rate

The CP, signaling and PHY layer signals are pure overhead
UpPTS: Uplink Pilot Time Slot
The UpPTS and GP in TDD frame contribute to overhead
GP: Guard Period
Physical channels (PDCCH/PCFICH/PHICH) consume 1, 2 or 3 symbols
Traffic dependent – heavy network loading will use 3 symbols
Redundancy added by PHY (channel coding or FEC): 0.35-0.95 <= coding rate
CR of 0,6 means that 60% of the channel is
used for data, while the rest is for coding/FEC.
LTE Data Rates: Ideal Channel Conditions
BPSK = 1 b/sym
QPSK = 2 b/sym
Data Rate (Rb) = ∗ 64QAM = 6 b/sym
PRB Capacity = 12x7 = 84 symbols in 0.5 msec = (84/500) ∗106 sps

Subframe capacity = 84x2 = 168 symbols/msec = 168x1000 sps
Symbol Rate = (168000) ∗ (NPRB) sps Single Antenna Port

33.6 Mbps for QPSK
Capacity of 20 MHz = 168000 ∗ 100 = 16.8 Msps=X= 67.2 Mbps for 16QAM
Net Data rate = X-25% = 75 Mbps for 64QAM 100.8 Mbps for 64QAM
2x2 DL: Rb = 2x75 = 150 Mbps
(Msps = 1M symbol/second)
UL data rate depends on UE category
For Tx chain, Rb = 50 Mbps (less overhead compare dot DL)
75 Mbps if 64QAM is supported
Alternatively, consider 64QAM case
(14 symbols/msec) ∗ (6) = 84 Kbps/subcarrier = 84 ∗12 = 1.008 Mbps/RB
Module-1.4.2: LTE Multi-antenna Systems and

Transmission Modes
Multiple Antenna Systems: Massive Throughput Gains
MIMO Diversity Processing

Deep Fades Deep Fades
Signals from
M antennas
Freq
Combined SNR
Spatial Diversity: robustness against channel transmission and diversity gain

MISO/SIMO, MIMO STBC/SFBC – increasing SNR, robustness against channel fading/noise
Spatial Multiplexing: multiplexing gain - requires orthogonal transmissions paths
Multiple data streams (layers) on the same frequency/time resource
Beamforming: focuses radiated energy in specific direction – array gain
Basic MIMO Definitions
“h” parameters reflect how signals are

attenuated and phase shifted
SU-MIMO: PTP Multiple antenna link
SU-MIMO
eNB communicates with one UE at a time
MU-MIMO: eNB schedules multiple UEs at the
UE1
same time using same time-frequency resource
eNB
Open Loop: Rx does not report CSI to Tx
CSI: Channel State Information UE2
Closed Loop: Tx gets CSI on a feedback channel
MU-MIMO UE3
Tx can respond to changing channel conditions
Long CDD: precoding scheme- PDSCH only (TM3)
CDD: Cyclic Delay Diversity
Prevents signals from cancelling each other at Rx
Time delay Æ phase shift in frequency
Coordinated MultiPoint (CoMP)- network MIMO
eNBs communicate with the same UE Half symbol time for 2 antenna system (LTE
uses Long CDD) – added before CP insertion)
LTE MIMO Schemes: DL-UL
DL 2x2 MIMO
DL: 2x2 MIMO is mandatory
4x4 (R8) and 8x8 (R10)
Tx diversity (SFBC) (Space-Frequency
Block Code)
2/4/8 layerd spatial multiplexing
UL: 1x2 (R8) - no UL MIMO
Up to 4 Tx chains in R10 UL 1x2 MIMO
4x4 transmission in UL
The “h” parameters reflect the way
the signals are attenuated and
phase shift in the channel
MIMO system performance metrics
Rank Indicator (RI): shows how many layers (streams) can be detected by UE
2 streams in a 2x2 MIMO system
Pre-coding Matrix (PMI): points to use of a pre-defined signal processing
3GPP TS 36.211 table 6.3.4.2.3-1 ……
LTE MIMO Transmission Modes: DL
Tx Mode DL Tx Scheme Remarks
TM-1 Single Antenna Port (SIMO) No MIMO and fairly uncommon across deployments
• SFBC (2 Tx antenna only), Rank 1, fallback for open/closed loop MIMO.
Transmit Diversity
TM-2 • Used for DL control channels (PBCH, PCFICH, PDCCH, and PHICH, they are
(fall back scheme)
transmitted at -3 dB compared to PA configured value because of the 3 dB gain).
UE feedback only indicate rank of the channel, If rank >1, LTE uses CDD (delay is
Open Loop Spatial added before CP) – predominate mode across LTE networks.
TM-3
Multiplexing • no PMI
• Used in high mobility scenarios where it is not possible to get accurate feedback
Closed Loop Pre-coding matrix indicator (PMI) is sent from UE to the eNB which pre-codes the
TM-4
Spatial Multiplexing signal for best reception at the UE
TM-5 Multi-user (MU) MIMO • Direct each layer to a different UE, yet to get traction
Closed Loop Rank 1 Spatial
TM-6 Theoretical – not seen practical deployments, UE signals PMI
Multiplexing
Single Antenna Port Mainly driven by 8TX TD-LTE deployments to support reciprocity based beamforming,
TM-7
Beamforming no dedicated CSI
TM-8 Dual Layer Beamforming Dual-layer transmission,
TM-9 8 Layer Transmission Up to 8 layers, uses DMRS and CSI-RS
TM-10 TM9 enhancements to support CoMP
RDL-6000 supports TM-2 and TM-3

Number of antennas in eNB is conveyed in the MIB CRC
Control channels use Tx diversity, no beamforming
LTE CQI: Channel+UE Rx Qualities
CQI CR
Modulation MCS Efficiency
CQI: DL Channel quality (time/frequency) Index X 1024
0 No Tx
Used for DL link adaptation 1 QPSK 78 (0.076) 0.1523
2 QPSK 120 0.2344
Frequency-dependent scheduling 3 QPSK 193 0.377
0 -- 9
Max MCS UE can handle with BLER of 10% 4 QPSK 308 0.6016
5 QPSK 449 0.877
TB sizes: larger TB size when CR improves 6 QPSK 602 1.1758
MCS: Modulation and Coding Scheme 7 16QAM 378 (0.37) 1.4766
8 16QAM 490 10--16 1.9141
9 16QAM 616 2.4063
10 64QAM 466 2.7305
11 64QAM 567 3.3223
12 64QAM 666 3.9023
17-28
13 64QAM 772 4.5234
14 64QAM 873 5.1152
15 64QAM 948 (0.93) 5.5547
LTE uses Turbo coding with mother CR
= 1/3 and range 0.0762 - 0.9258
PSD: Power Spectral Density

UL channel quality: predicted PSD Tx, pathloss and “N+I” estimates
PHR is used to estimate PSD Tx, and eNB measures PSD Rx
LTE Link Quality Indicators: Summary
eNB does the MCS selection

for DL and UL based channel
quality estimates
DL: eNB uses the CQI sent
by UE in UL
UL: eNB estimates channel
quality using the UL SRS
SRS: Sounding Reference Signal
MCS is constant over the allocated resources (PRBs) of a user
Each TB sent to a UE can use a different MCS in spatial multiplexing case
TB: Transport Block
RI: number of layers that can be used RI: Rank Indicator
PMI: mapping data strams to antennas PMI: Precoding Matrix Indicator
Precoding involves adapting the Tx signal to the current CSI
Open Loop SM: UE sends only CQI and RI
Closed Loop SM: UE has to send CQI, RI and PMI
Not sutiable for high mobility due to time required for PMI calculation
Data Mapping-OFDMA/MIMO: Example
Adjust phase and
amplitude for each
QPSK antenna and adjust
16QAM Antenna Config
total power
SM, Tx diversity,
64QAM (CDD/SFBC)
CW0
CW1
Payload goes through channel coding/rate-matching first

CC for C-plane and Turbo for U-plane data
Codeword: data before it is formatted for transmission - CW0 and CW1
SU
Both sent to one UE in US-MIMO
////// and two different UEs in MU-MIMO
Layer (stream of data)- 2 to 4 layers
Precoding: modifying layer signals before transmission
They be done for diversity, spatial multiplexing or beamforming
Closed MIMO needs precoding of data streams
Module-1.4.3: LTE Wireless Frame Structure and Signaling

LTE Wireless Frame Numerology: FDD/TDD
Frames
Subframes
Slots
Symbols
OFDM symbols are organized in time 0.5 msec slots (15360Ts)

7 symbols for normal CP and 6 for extended CP
Two slots make a subframe (1 msec = 30720Ts)
10 subframes make an LTE wireless frame = 307200 Ts = 10 msec
Each frame has a system frame number (SFN) - 0 to 1023
LTE FDD and TDD frames use subframes and slots differently
LTE Frame Type1: FDD-Concurrent DL/UL Transmission
UL 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
DL
FDD frame exists in DL and UL simultaneously

LTE frame numbering has two components: SFN and subframe number
SFN (0-1023) is specified in MIB - SFN increments by 1 every frame
Subframe number resets to zero every frame (0-9)
UE must be synchronized with eNB at subframe and SFN levels
LTE Frame Structure Type-2: TDD Frame
One Radio Frame, Tf = 307200TS = 10 msec TDD switching
Switching point is eNB: DL Æ UL (TTG)
not mandatory in UE: UL Æ DL (RTG)
1st half frame 2nd half frame 2nd half frame
SSF SSF = 1 msec
This one is not mandatory
10 msec frame is divided into two half frames, each with 5 subframes
Each of the subframes can be used for DL or UL switching
5 msec (half frame switching) and 10 msec (full frame switching) periodicity
SSF allows for DL to UL switching SSF (Special Subframe)
Ensures that DL and UL transmissions do not clash
TDD Frame Usage: Seven DL/UL Profiles
DL/UL Frame SSF/Frame

config Periodicity
(msec) DL UL # of
SSF
0 5 2 6 2
1 5 4 4 2
2 5 6 2 2
3 10 6 3 1
4 10 7 2 1
5 10 8 11
// 1 1
6 5 3 5 2
Seven DL/UL config profiles (RDL-6000)

Subframe 0 and 5 are in DL in all profiles
SSF is followed by an UL subframe
DL/UL configuration and the SSF gap affect cell range
Ellipse-4G supports configuration 1, 2 and 3
CBRS mandates profiles 1 and 2
SSF Types (9 patterns): Coverage-Capacity Trade-off
DwPTS: Downlink Pilot Time Slot

DwPTS: “normal” DL subframe
Can carry RS, control, data or PSS
GP ≥: UL-DL RTD (Round-Trip Delay)
GP: Guard Period
Making sure UL and DL do not clash TDD SSF
OFDM Symbols in SSF (Normal CP)
Config Cell Range
Determines (a factor) max cell range DwPTS GP (km) UpPTS
0 3 10 104
UpPTS: UL signalling only 1 9 4 39.9
Primarily for UE SRS and PRACH 2 10 3 29.14 1
3 11 2 18.42
Number of symbols assigned to 4 12 1 7.71
DwPTS, GP and UpPTS determines 5 3 9 93
6 9 3 29.14
the SSF configuration type 7 10 2 18.42
2
8 11 1 7.71
Ellipse-4G OAM allows only up to 4 symbols for GP – up to 39 Km range

SSF config 0 and 5 are not supported – due to long GP
Guard time specified in preamble signal format applies to TDD and FDD
LTE PHY Level Signals: DL Synchronization Signals
PSS: Primary Synchronization Signal
SSS: Secondary Synchronization Signal
UE must achieve symbol/frame

timing, frequency and clock
synchronization in DL
A cell broadcasts PSS and SSS to
enable the UE achieve DL
synchronization
Every 5 msec (twice in a frame)
UE acquires essential cell parameters from PSS and SSS

PCI, CP, FDD/TDD mode
UE can decode the PBCH and hence can read the MIB
PSS/SSS positions in the frame depend on TDD/FDD frame
Occupy the central 6 RBs (1.08 MHz) irrespective of channel BW in use
Add about 3.5% overhead in FDD and up to 13.5% in TDD
Sync Signals Transmission: Time View – Normal CP
FDD Frame
PSS: 3 sequences corresponding

to values (0, 1, 2)
Identical values in the frame
TDD Frame
PSS in FDD: in the last symbol of
the first and 11 slots
UE gets slot boundary
PSS in TDD: 3rd symbol of the 3rd and 13th slots (subframes 1 and 6)
Cell with same PCImod3 values will experience PSS to PSS interference
SSS (each can take a value 0, 1, 2… 167)
FDD: in the symbol immediately preceding the PSS
TDD: 3 symbols before the PSS
SSS in each half-frame convey same info but are swapped in frequency
This allows UE to differentiate the 1st and 2nd half of the radio frame
UE blindly detects cell CP value by checking for SSS location
PSS and SSS location difference allows duplex (FDD/TDD) detection
UE Extracts Frame Timing and PCI from PSS and SSS
Downlink synchronization
504
SSS
PSS SSS PSS
Physical layer ID Groups

N 3N N
PCI = 3 x Cell ID Group + Sub Cell ID
0 1 ··· 166 167
504 0,1, 2..167 0, 1,2
0 1 2 0 1 2 0 1 2 0 1 2
Physical layer ID ( Cell ID index or Sector ID)
PSS: determines the 5 msec frame timing and position of SSS

SSS: two positions in a frame establishes the frame boundary
On knowing PCI, UE can locate CRS (Common Reference Signal)
PCI value tells the UE about the permutation used in the cell
Frequency domain: PSS/SSS are always carried in the central six RBs
A basic rule of thumb: neighbor cells should not have the same PSS value
LTE PHY Level Signals: References Signals
DL Reference Signal (RS): pilot signals known to the cell and UE

UE generates the RS locally and compares it with the received RS
Retrieves the phase and power information of the signals carried in the channel
RS power level is indicated in ___
SIB2
Cell specific reference signal (CRS) – common to all UEs <= Important
UE specific RS (demod-RS) beamforming support of channel estimation
Positioning RS – UE location measurement – not discussed in this course
CSI-RS (R10 for TM-9): dynamic switching between MU-MIMO and SU-MIMO
UL PHY level signals
Demodulation reference signal (DMRS): phase reference for channel estimation
UE transmits DMRS at the same time as the PUSCH and PUCCH
Sounding reference signal (SRS): power reference
eNB uses SRS to estimate UL channel quality
o Enables frequency-dependent scheduling – not associated with PUSCH or PUCCH
SRS is optional and can be turned off in a cell – it consumes 7% of UL capacity
CRS Time-Frequency Location: Depends on PCI
1 msec subframe
One slot
Frequency
Four cell specific RS (CRS) per PRB
One symbol in every 3rd subcarrier
504 CRS sequences – QPSK modulated
Corresponding to 504 PCI values
RS location on time axis
Determined by max Doppler spread
UE speed and channel coherence time 1st Symbol
3rd last Symbol
In the 1st and 3rd last symbol in each slot

6 subcarriers apart on each symbol
RS location on the frequency axis: channel coherence BW (delay spread)

Two RS symbols are 3 subcarriers apart - one RS every 3 subcarriers in a PRB
PCI is used to determine the first subcarrier on which the RS is mapped
Interference on RS’ between cells having same PCI mod 3 can be very high
Two immediate neighbors of a cell must not have same PCI mod3 value
CRS Transmission in 2x2 Antenna System: An Example
Slot
Tx Ant1
Subframe
Tx Ant2
Slot
RE
In frequency, cell RS has a shift determined by its PCImod3 value

Diagram above: PCImod3 = 0, 1,2 for Cells 1, 2 and 3 respectively
With this PCI allocation, RS of different cells do not overlap in frequency
Resulting in less interference on UE channel estimation
In an unsynchronized deployment, PCI allocation between sites is not possible and
hence inter-RS interference becomes inevitable
RS Received Power: RSRP
Average power of a single

RE carrying the RS S-eNB T-eNB
Power of all RS in the RB

Range: -140 to -44 dBm RSRP2
RSRP1
Mapped to 0 to 97 RSRQ1 RSRQ2
RSSI: total power received including interference

Within channel passband over “N” PRBs (dBm)
UE traffic dependent
RS is power boosted by eNB – for easy decoding
Defines the RS Tx power in SIB2
Enables UE to calculate DL path loss
For 100% DL PRBs (N) active and no noise case
RSSI = RSRPx12xN, for N PRBs
RSRP (dBm)= RSSI (dBm) - 10xlog (12xN)
RSRQ: UE Ranks Detected Cells – HO/Reselection
RSRQ: Reference Signal Received Quality

RSRQ = (wanted signal)/(all received power)
S-eNB T-eNB
RSRQ = RSRP/(RSSI/N) = N*RSRP/RSSI, for N PRB used to measure RSSI
RSRP2
Depends on traffic dependent through RSSI RSRP1
RSRQ1 RSRQ2
Depends on loading of data subcarriers
RSRQ Range: -19.5 dB to -3 dB (dB)
-3 dB (no traffic and no interference in the cell)
- 19.5 dB (high load/high interference)
Mapped to 0-34 with 0.5 dB resolution
SINR = (power of all RS REs)/(I+N) = channel quality
Measured every TTI and averaged per second
Converted to CQI and sent to eNB (MCS selection)
Where x=RE/RB.
Almost a linear relationship with RSRP x = 2RE/RB means empty cell (only
RS power) from S-eNB.
Impacted by network load and N-eNBs load x= 12RE/RB is a fully loaded S-eNB
(all REs are carrying data)
Typical values are -10 to + 30 dB
RSRP and RSRQ Calculation: Example
Assume a measurement bandwidth of 6 RBs (smallest used in LTE)

Let us consider RDL-6000 (single cell) with max Tx power PTX = 39 dBm
RSRP: power of one RE carrying the RS symbol, so RSRP = 1/72 of total power
Assuming all REs experience same pathloss = 100 dB, then
RSRP = 39 -100-10log (72) = -78.6 dB
RSRQ is the ratio of RSRP and RSSI, depending on measurement BW (RBs)
Let us consider 20 MHz channel and an ideal noise/interference free cell with RS and
data subcarriers use equal Tx power over one RB (12 REs)
Then for one symbol with R0 (first RS) RSRQ can be viewed as inter-cell interference
which appears as a wideband RSSI impacting the denominator in RSRQ estimation
RSRQ (dB) = 10log ((100x1RE)/(100x12RE)) = -10.79 dB
PHY Layer Signals: UL
Subframe = 1 msec
Slot1 Slot2 Time
Demodulation reference signal (DM-RS)

Channel estimation for UL coherent
DM-RS
DM-RS
Data
demodulation at eNB
Associated with PUSCH and PUCCH
SRS
Located in 4th symbol in each slot
DM-RS
DM-RS
Sent with user data in same bandwidth
Frequency
Sounding Reference Signal (SRS)-optional
Facilitates frequency dependent scheduling
DMRS cannot be used as it uses same bandwidth as data
Sent in last SC-FDMA symbol of a subframe – no user data in this subframe
Sent at most every two subframes and at least once in 32 frames
Constructed from Zadoff-Chu sequences divided into 3 groups
For a given number of PRBs, there are 30 sequences that can be used as RS
Potentially interfering cells must have different PCImod30 values
PCI mod30 = u = base sequence index, u = 0, …29
PRACH Procedure: UE Synchronizes in UL with eNB
PRACH: Physical Random Access CHannel PRACH Preamble
TSEQ = 800 μsec
UE sends a Preamble
Sequence to eNB to
6 PRBs
achieve UL sync Sequence (TSEQ)
Preambles are
transmitted as 800 μsec
OFDM symbols
CP: Cyclic Prefix
CP areas to accommodate the RTD between eNB and UE GT: Guard Time
RTD: Round-Trip Delay
GT at the of the symbol to avoid interference out the side the frame
CP prevents interference from previous symbol and GT from the one that follows
LTE has specified 839 ZC preamble sequences for PRACH
64 Preambles per cell – each cell consumes 64 sequences
Must be orthogonal codes so multiple UEs can do random access same time
UE generates these based eNB specified PRACH parameters in SIB2
Number of cells within a reuse distance 839/64 ≈ 13
A PRACH sequence burst (time slot) can have a duration of 1, 2 or 3 subframes
Random Access Tx is the only non-synchronized Tx in LTE UL. Although UE achieves DL sync before starting RACH, it cannot determine
its distance from the eNB. Thus, timing uncertainty caused by two-way propagation delay remains on RACH transmissions
PRACH Preamble Formats: Uses Sequence-CP-GT Durations
Preamble Duplex PRACH Sequence Total duration Sub- Max Cell Range
CP (μsec) GT (μsec)
Format (PF) Mode Symbols TSEQ (μsec) (μsec) frames (km)
0 103 1 800 97 1000 1 15

(RTD = 100 μsec)
1 FDD 684 2 800 516 2000 2 77 (M cell)

and
2 TDD 203 2 1600 197 2000 2 30 (L cell)
3 684 3 1600 716 3000 3 103 (XL cell)
4 TDD 15 0.16 133 9 157 0.16 1.4 (small cell)
Basic PRACH (PF0) was defined for 15 km range

To increase cell range, 2 and 3 subframes formats were defined
PF1 sequences are single copies of PRACH converted to time
PF2 and PF3: preamble symbol is repeated twice, to make it easy to detect it
Only certain PFs can be used in TDD
Preamble may not fit in UL in certain DL/UL configs
PF4 PRACH is transmitted on UpPTS
eNB can detect PF0 more easily than PF4 - has higher HO success rate
PRACH ConfigIndex: Time Domain Info Of PRACH (TS36.211)
PRACH Config Index provides the time domain info

of PRACH resources - references a 3GPP table
SFN: System Frame Number
SFN and subframe# in a frame that has PRACH
The # of times PRACH slot is scheduled per frame and
the subframe employed
The preamble format that needs to be used
PRACH Frequency Offset provides frequency
domain info of PRACH
The first RB available for PRACH - set to 3 in Ellipse-4G
Scheduler reserves 6 PRBs for each PRACH instance
FDD: at most one PRACH opportunity in one subframe
TDD: can frequency multiplex up to six PRACH opportunities in a subframe
Using same prachConfIndex to cells in the same site is recommended
Causes inter-cell PRACH interference but is less serious than PRACH-PUSCH
interference (due to different values to cells in same eNB)
PRACH ConfigIndex: Locating PRACH Tx Opportunity
PRACH Config Index PF SFN Subframe # PRACH Config Index PF SFN Subframe #
0 0 Even 1 32 2 Even 1
1 0 Even 4 33 2 Even 4
2 0 Even 7 34 2 Even 7
3 0 Any 1 35 2 Any 1
4 0 Any 4 36 2 Any 4
5 0 Any 7 37 2 Any 7
6 0 Any 1 ,6 38 2 Any 1 ,6
7 0 Any 2,7 39 2 Any 2,7
8 0 Any 3,8 40 2 Any 3,8
9 0 Any 1,4,7 41 2 Any 1,4,7
10 0 Any 2 , 5, 8 42 2 Any 2 , 5, 8
11 0 Any 3, 6 , 9 43 2 Any 3, 6 , 9
12 0 Any 0, 2, 4, 6, 8 44 2 Any 0, 2, 4, 6, 8
13 0 Any 1, 3, 5, 7, 9 45 2 Any 1, 3, 5, 7, 9
14 0 Any 0, 1, 2,….9 46 N/A N/A N/A
15 0 Even 9 47 2 Even 9
16 1 Even 1 48 3 Even 1
17 1 Even 4 49 3 Even 4
18 1 Even 7 50 3 Even 7
19 1 Any 1 51 3 Any 1
20 1 Any 4 52 3 Any 4
21 1 Any 7 53 3 Any 7
22 1 Any 1, 6 54 3 Any 1, 6
23 1 Any 2 ,7 55 3 Any 2 ,7
24 1 Any 3, 8 56 3 Any 3, 8
25 1 Any 1, 4, 7 57 3 Any 1, 4, 7
26 1 Any 2, 5, 8 58 3 Any 2, 5, 8
27 1 Any 3, 6, 9 59 3 Any 3, 6, 9
28 1 Any 0, 2, 4, 6, 8 61 N/A N/A N/A
29 1 Any 1, 3, 5, 7, 9 62 N/A N/A N/A
30 N/A N/A N/A 63 3 Even 9
31 1 Even 9
3-5 and 19-21 are typical for private LTE
PRACH Parameters (SIB2): Definitions
RootSequenceIndex (RSI): sequence UE starts with to generate preambles

UE starts with RSI in SIB2 to generate all or many its 64 preambles
Depends on cell range - 64 for smallest cell and 1 for largest cell
o More than one RSI may be required in a cell
o Use as few as possible to prevent interference between preamble transmissions
Preambles obtained from cyclic shifts of an RSI must have sufficient separation
838 possible root sequences with 839 symbols each (PF 0-3) and 138 for PF4
ZeroCorrelationZone (ZCZ, NCS): cyclic shifts between preamble sequences
The number of shifts from an RSI = 839/NCS
ZCZ planning is based on cell range - requirements of GT
Determines how many RSI are needed per cell for a certain range
16 different cyclic shift separations can be configured for a cell
Providing 1 to 64 preambles from a single root sequence
Power Ramping Step: 0, 2, 4 or 6 dB (in case eNB cannot detect UE PRACH)
UE decides its initial Tx power based on open loop DL pathloss estimate
UE Initial Cell Search: Registering with eNB (getting to RRC-connected mode)
PBCH is time aligned with

the Sync channels and UE can • UE acquired most essential
read it now (UE gets the MIB) system information
PBCH: Physical Broadcast CHannel • UE can read PDCCH/PDSCH and links
up with the eNB
UE attempts to detect SSS UE Knows:
(tries to match 1 out of 168 possible
SSS (Cell ID Group)
• Frame timing (from SSS location)
• Cell ID Group (1 out of 168)
• PCI (1 out of 504)
• C-RS locations knowing PCI
UE looks for the PSS • CP and FDD/TDD mode
(attempts to match 1 out of 3 possible PSS
(cell ID index within a Cell ID Group) UE determined:
• Exact carrier frequency
• Cell ID index within Cell ID Group (1 out of 3)
• Subframe timing (UE learns the timing of
subframes 0 and 5)
UE turns on UE performs a rough frequency synchronization (UE has a

good carrier candidate with the strong 6 RB subcarriers which might carry the PSS and
SSS and PBCH)
Doppler shift due to UE speed causes is the main cause of UE-eNB frequency difference
UE searches for a strong cell in a DL band

(monitors the central 6 RB of the spectrum regardless of the channel size)
Initial Network Attach: Register To Tx/Rx Data
(assigns a bearer ID)
Always-on IP connectivity for UE is enabled by establishing a default EPS

bearer during Network Attachment
LTE Scheduler: Radio Resources Distribution in DL and UL
MCS, QoS, TB size

and PRB selection
CQI from UE
TTI: Transmission Time Interval
Radio resources allocation among the active UEs in a cell on per TTI basis
Uses DL data buffered in eNB and the Buffer Status Report (BSR) from UE
Resides in the eNB – it has component in UE that takes orders!
Dynamic: eNB checks every TTI (1 subframe) if UE needs allocation
Min scheduling in frequency: a pair of time consecutive RBs
Semi-persistent: allocations last many subframes or TTIs - VoIP
Timing and amount of radio resources needed are predictable
LTE Scheduler: Time-Domain and Frequency Domain View
Scheduler algorithms are eNB specific

Signaling is standardized (3GPP)
Scheduling parameters are signalled to
UEs in PDCCH (Physical Downlink Control CHannel)
FDPS tries to improve spectral efficiency TDPS FDPS
Frequency dependent scheduling– if
supported
UL can use distributed or localized PRB
scheduling
C-RNTI: Cell Radio Network Temporary Identifier
C-RNTI is used to identify UE allocations
for dynamic scheduling
An SPS-C-RNTI is used for SPS scheduling
SPS: Semi-Persistent Scheduling
TTI-Bundling: Improving UL Coverage
UE cannot use enough energy in one TTI to successfully send a VoIP packet
TTI bundling is used to improve UL link budget (2-4 dB) TTI: Tranmission Time Interval
TTI bundling uses four consecutive TTIs - helps UEs close to cell edge
A TB is transmitted over a TTI bundle, but with different redundancy versions*
These four transmissions are non-adaptive with identical MCS/RB location but
different redundancy versions – incremental redundancy * Means with different coding
Uses four automatic reTxs in the bundle with a common ACK/NACK for HARQ
eNB activates TTI bundling if UE SINR drops below a specified threshold
BLER increases and link adaptation has no more options for MCS/PRB reduction
VoLTE coverage RSRP threshold improves from −114 dBm to −117 dBm
UE is restricted to PRB < = 3 and use of QPSK
eNB activates/deactivates TTI bundling per UE via RRC messaging
Mobility Mgmt: Maintaining Ongoing Session QoS
Connected mode mobility: HO (HandOut)

UE is always connected to a single cell
__________________________________________
An active UE monitors RSRP of S-eNB

RSRP: Reference Signal Received Power
Measures N-eNBs if it falls below a
threshold and reports to its S-eNB
S-eNB selects a T-eNB to HO UE to
On X2 or S1 – looks the same to UE
Quality/Coverage/MLB based HO
MLB: Mobility Load Balancing
Intra-RAT HO: Intra/inter-frequency
RAT: Radio Access Technology
LTE mobility mgmt is event-based
Idle-Mode mobility: Cell Reselection
eNB provides a list of
cells/frequencies
Specifies priorities via SIB1
The LTE Events: A1-A5
> <
Module-1.5: LTE SON Overview
SON: LTE Network On Auto-Pilot
pre-Operational
state
Operational state
Operational state
SON automates certain tasks
planning, configuration, and optimization Acquisition
Self-optimization: auto-tune the network using

SON
UE and eNB measurements Triangle
Network performance enhancing by optimizing
capacity, coverage, HOs and interference Action Decision
SON Functionality and LTE Stack: Generic View
KPI: Key Performance Indicator
The SON module interacts with the applicable stack modules to read KPIs
X2 (inter-eNB) and Itf-N (NBI connecting EMS and NMS) are important
interfaces for the SON operation
SON Types: Centralized/Distributed/Hybrid
OAM: Operations, Administration and Management
Distributed SON (dSON) Centralized SON (cSON)
cSON algorithms are executed at the

dSON functions are executed at eNBs network mgmt level
eNBs need reliable X2 connectivity Parameter collection is in eNB SON
For dynamic, fast and reliable element managers
parameter adaptation
Issues: longer response, increased
• Concerns: vendor specific backbone traffic and a single point of
• RDL-6000 supports dSON failure
SON: Automating Network Tasks and Self-Optimizing
ANR (automatic neighbor relation): auto-finding N-eNBs

X2 config, neighbor IP discovery and PCI management
MLB (Mobility Load Balancing): load distribution amongst N-eNBs
MRO (Mobility Robustness Optimization): minimizing HO failures
PRACH Optimization: minimizing UE initial network access failure
ES (Energy Saving): turning off booster cells at certain load conditions
May involve moving some UEs to active cells
ANR: Creating NR Tables (NRT) in eNBs
ANR: Automatic Neighbor Relation
NRT: Neighbor Relation Table
Unburdens OPs from manually

managing neighbor relations of
eNBs in a network
Intra-frequency ANR function
relies on cells broadcasting their
ECGI which UEs read and report
EGCI: E-UTRAN Global Cell Identifier
eNB asks for ECGI, TAC and PLMN ID if it cannot recognize reported PCI
TAC: Tracking Area Code
Each eNB creates an NRT for each cell it controls – 3 minutes update
N-eNBs matching PLMN are in a Whitelist, others go to a Foreign List
For co-channel eNBs, NRT contains N-eNB ECGI and PCI
Inter-frequency ANR: eNB specifies search list and schedules gaps
UE reports detected PCIs and other parameters as specified by eNB
eNB can learn IP addresses from MME (on S1) to set up X2 with neighbors
A5 threshold is used for new neighbor detection
MLB-Self-Optimization: Improving PRB Utilization
MLB: Mobility Load Balancing
On detecting overload
and traffic imbalance,
an eNB decides to
move UEs to less Candidates for MLB-based HO
congested N-eNBs Can expedite/delay HO by changing CIO
CIO: Cell Individual Offset
Adjusts mobility parameters to expedite HO
MLB is enabled when X2 is set up with first neighbor detected by ANR
Disabled if there is no X2 link with any neighbor or no valid neighbor
eNBs exchange load conditions on X2 – Client-Server type activity
MLB can be inter-cell within eNB or in a N-eNB
eNB tries to move UEs on detecting overload irrespective of UE location
MLB parameters: start/stop thresholds and cells load difference (% RBs)
RDL-6000 supports intra-LTE MLB
MRO Self-Optimization: RLF and HO
MRO: Mobility Robustness Optimization
Aims at detecting and preventing mobility connection Failures - HO

Too-late HO, leading to a connection failure in the S-eNB
Coverage hole, leading to a connection failure in the S-eNB
Too-early HO, leading to a connection failure in the T-eNB
HO to an inappropriate cell, leading to a connection failure in the wrong T-eNB
HO to an unprepared cell (R10)
MRO step-1: data collection and problem analysis
RLF: Radio Link Failure
RLF reports from UEs using the RRC UE Information procedure
Mobility problem logs from N-eNBs and internal performance metrics
MRO step-2: Problem solution through CIO adaptation
Calculates and applies CIO that solves HO problems towards a given N-eNB
MRO is normally used along with MLB Mn±CIOn > Ms±CIOs +A3 or A5)
MRO parameters are CIO, TTT or TTT+CIO
TTT: Time To Trigger
Module-1.6: LTE Security Framework
LTE Air Interface Security: AS and NAS Layers
AKA: Authentication and Key Agreement NAS Security (EEAx, EIAx)

Mutual authentication
between UE and the
network using AKA
Ciphering of C/U-plane
Main players are UE,
eNB and MME AS Security (EEAx, EIAx)
NAS security (UE ↔MME): integrity protected (mandatory, using EIA)

|
and ciphering (optional, using EEA) of NAS signalling EPS Integrity Algorithm
EEA: EPS Encryption Algorithm
MME selects the EIA and EEA for UE and signals it using SMC
EIA: EPS Integtity Algorithm
AS security (UE ↔ eNB)
Mandatory integrity protection and Ciphering for RRC signalling (C-Plane)
Ciphering of the U-plane data on Uu - integrity protection is not mandatory
PDCP layer encryption (UE and eNB) is optional
S1 interface security through use of Security Gateways (SEGs)
LTE Security Algorithms: Integrity Protection and Ciphering
EPS Encryption Algorithm for Ciphering (EEA) U-plane and C-plane

“0001” 128-EEA1 SNOW 3G (Sweden)-stream cipher
“0010” 128-EEA2 AES (USA) – block cipher
128-EEA3 ZUC stream cipher (China R11 onwards)
EPS Integrity Protection Algorithm (EIA):
Integrity protection uses a 32 bit MAC (MAC-I) like CRC for IP packets
““0001” 128-EIA1 SNOW 3G
“0010” 128-EIA2 AES
128-EIA3 ZUC-based hash function (China R11 onwards)
Null algorithm (no security): allows UEs to make emergency calls
EIA0 for Integrity and EEA0 for ciphering
FlexCore - MME
LTE Security Keys: Mutual Authentication Using AKA
International Mobile Subscriber Identity

|
One way function

Based on IMSI specific master
security key “K”
Lives only in HSS and UICC (UE)
UE stores CK and IK in UICC on
detaching
MME stores KASME
UE and MME agree on KASME
during AKA and identity
confirmation
AKA uses Milenage
MME has UE IMSI or asks for it
AS/NAS keys are different
Separate keys between UE and T-eNB during X2 and S1 handover
Access Security Management Entity receives the top-level keys in an access network from the HSS. MME is ASME for LTE
UE Initial Attach: Security Messaging Sequence
UE eNB
AuC
MME SGW PGW PCRF HSS
EIR
1-RACH/RRC-Conn
2-NAS Attach Request (IMSI or previous GUTI)

3-Verify ID
4-ID Request (MME) and Response (UE)

5-Authentication/Authorization: MME sends IMSI, HSS returns K ….
6-Authentication and NAS Security setup
7-ID Request (UE) Response (MME)
8-Cipher Option Request (MME) Response (UE)
MME is the primary node making LTE access vulnerable to DoS

MME forwards UE requests to HSS before it authenticates the UE (step 5)
Integrity protection is always applied to PDCP Data PDUs of SRBs while it
is optional for DRBs
LTE Security: UE Related Parameters
Security includes seven

key generation functions
f1, f1*, f2, f3, f4, f5, f5*
Their operation falls
within one operator
domain
Not standardized
Security algorithms use of a 128 bits block cipher and 128 bits value OP
Operator Variant Type: OP is a 128 bits value stored in USIM
|
OPc is a 128 bits value derived from OP and K Universal Subscriber Identity Module
User-specific subscriber authentication key (K) is stored in UICC

|
Securely distributed and stored in HSS Universal Integrated Circuit Card
(new generation SIM)
One-to-one mapping between a user’s IMSI and its K - K never leaves USIM
Milenage is a set of AES-128 based functions used in AKA
NAS and AS Security: AKA and SMC Process
Module-1.7: CBRS Overview and Building Blocks
CBRS Band: 150 MHz Spectrum-Technology Agnostic Use
3400 3550 3600 3650 3700 3800
LTE B42 LTE B43

3GPP LTE Band 48
150 MHz
CBSD = CBRS Service Device
CBRS by definition is a 150 MHz of RF spectrum in the 3.5 GHz band

3550-3700 MHz frequency range
Requires SAS based DSA scheme SAS: Spectrum Access System
CBRS deployments are governed by FCC Part-96 rules

CBRS Deployment: Geo-location Based Channel Assignment
A hi-power CBSD ( >23 dBm) has to communicate with the SAS, like an eNB.
Mutual authentication between FCC certified CBSD and SAS

The RAT base station is designated as CBSD (CBRS Service Device)
RAT: Radio Access Technology
CBSDs are fixed stations
Certain categories of RAT SS/UE/RT come under CBSD restrictions
SAS assigns a CBSD geo-location specific RF channels
CBSD updates SAS within 60 secs of changes to the data it had submitted
CBRS: Tiered Access to 150 MHz spectrum in 3.5 GHz Band
Tier-1: Incumbents
Access (IA) -exclusive
Access to the spectrum
Do not go to a SAS
Tier-2: Priority Access
License (PAL)
Must purchase a license
Tier-3: General Authorized Access (GAA)
Opportunistic use of full CBRS spectrum
Tiers 2 & 3 are regulated under the CBRS umbrella – FCC Part-96
SAS manages interference to protect IA from Tiers 2 & 3
Interference among Tier 2 devices and from Tier 3 into Tier 2
PAL: 3550-3650 MHz
Licensed by auction
10-year term
License areas: counties (2017)
Buys logical channels in
auction
SAS does logical to physical
channel mapping
PAL = 10 MHz in one county and up to 7 PAL licenses per county
Max 4 PAL channels per licensee
PAL: contiguous channels in same license area to the extent possible
Can temporarily move to non-contiguous channels to protect Incumbents
PAL can request for spectrum allocated for GAA - to augment capacity
Borrowed GAA channels do not have the same level of priority as PAL
PAL usage designated frequencies not in use may be utilized by GAA users
PAL can lease, partition and disaggregate or outright transfer licenses
CBRS Ecosystem: Device Classification
Device Max EIRP Max PSD Location Antenna

Type dBm/10 MHz (dBm/MHz) (HAAT)
Cat-B 47 (50 W) 37 outdoor fixed >6m
(CPI)
Cat-A 30 (1W) 20 In/outdoor < 6 m in
(24 dBm (fixed) outdoors
conducted)
EUD 23 (0.2W) N/A Mobility allowed
CBSD (CBRS Service Device) is the RAT base station (BTS-CBSD)

CBSD controls the End User Device (EUD)
EUD becomes a CBSD if exceeding 23 dBm/10 MHz EIRP - CPE-CBSD
Must report geo-data and antenna attributes
Location change requires re-registration with SAS
CAT-B CBSD requires CPI Installation CPI: Certified Professional Installer
CBSD measures the RF interference - essential for GAA operation
Co-channel and adjacent channels
CBSD Deployment and Operation: Restrictions
Category A (CBSD and CPE-CBSD): 30 dBm max EIRP

Indoor/outdoor with HAAT <6 m
Lower antenna gain and EIRP allowed compared to CAT-B devices
Category B (CBSD and CPE-CBSD): outdoors only
40 dBm max EIRP non-rural and 47 dBm max EIRP rural
CPI installation
Location Accuracy: ±50 m horizontal and ± 3 m vertical
Changes must be reported to the SAS within 60 secs of moving
Tx power control (TPC) in all CBSDs
EUD complies with TPC commands from CBSD and SAS – 10 secs grace time
TPC must ensure aggregate RSSI within a given PPA for any co-channel PAL shall
not exceed -80 dBm over a 10 MHz BW
Antenna placed at a height of 1.5m AGL
EUD declares FCC compliance to BTS-CBSD
Power reduction for 15 and 20 MHz channel size
EUD and CPE-CBSD: FCC Part-96.41/47
End User Device

|
EUD is a client of a CBSD base station
Fixed or mobile, capped at +23 dBm/10 MHz EIRP
Cell phone/tablets
It is invisible to the SAS
It only transmits if authorized by a CBSD (LTE eNB)
No CPI is involved CPI: Certified Professional Installer
CPE-CBSD is EUD exceeding 23 dBm/10 MHz EIRP
Categorized as Cat-B devices – high antenna gain UE
Must be registered with a SAS
Contacts SAS through the CBSD (eNB) it links up with on the air interface or
Close the loop with SAS using other options such as its Ethernet interface
Requires CPI
Both CBSD AND CPE-CBSD need to be authorized for the same frequency
CPE-CBSD and SAS Interactions
EUD is invisible to SAS: operates under control of a CBSD

CC Part-96 EIRP and emission limits apply
CPE-CBSD is visible to the SAS and is subject to CBSD rules
Links up with BTS-CBSD and contact SAS to obtain a grant
Must declare its current power level
Max time: 1 sec/10-sec period, 10 sec/300-sec period, or 20 sec/3600-sec period
Must use SAS specified operational parameters once it gets a grant
GAA Co-existence: DL/UL Compatibility
Mandatory E-UTRA TDD Configurations

TDD UL/DL Subframe Number
config ratio 0 1 2 3 4 5 6 7 8 9
1 4:4 D S U U D D S U U D
2 2:6 D S U D D D S U D D
FCC Part 96 rules allow multiple operators, different technologies and

unsynchronized transmissions to co-exist in the same frequency band
This makes interference mgmt an important requirement in CBRS deployments
CBRS coexistence focuses mainly co-channel use for TD-LTE
Use the same TDD configuration
CBSDs must align their frame boundaries
The SSF configuration for mandatory options is fixed to be SSF Config-7
The choice of a mandatory config is on first-come-first basis
Any UL/DL config and SSF config may be used provided:
All the TD-LTE CBSDs in a connected set use the same TDD config (UL/DL) and
Same SSF config
RCSP-RDL-6000
Module-2: RDL-6000 System Overview and Configuration
© Redline Communications Inc. 2021. All rights reserved.

RCSP-RDL-6000: Module-2 Contents
Module-2.1: RDL-6000 Building Blocks and System Overview

Module-2.2: Managing RDL-6000 Systems
Module-2.3: RDL-6000 eNB Configuration and Performance Parameters
Module-2.4: RDL-6000 Mobility Management and KPIs
Module-2.5: Interference Management and SON Configuration
Module-2.6: RDL-3000 CBRS Configuration and Parameters
Notes:
1. System features and capabilities referenced in this module are based on RDL-6000-R1.3.021+
2. Module-2.2.4 is a homework and self-paced learning in this module
RCSP Certification Programs RCSP-RDL-6000 Module-2: RDL-6000 System Overview and Configuration R1.3.2-V1.3 Slide-2
Module-2.1: RDL-6000 Building Blocks and
System Overview
RCSP Certification Programs RCSP-RDL-6000 Module-2: RDL-6000 System Overview and Configuration R1.3.1-V1.3
Ellipse 4G eNB: E-UTRAN Base Station
100% 3GPP standards based solution

Supported by any COTS UE
COTS: Commercial Off-The-Shelf
Meets or exceeds 3GPP Wide Area BS eNB specs
Single band and single cell eNB-HP
2x2 MIMO FDD/TDD in licensed 3GPP bands Ellipse-4G-HP
High power SKUs: Ellipse 4G HP
B14 FCC 22W
+39 dBm per RF port in 700 MHz
+38 dBm per RF port in 800 MHz
Max range of 39 km
Low power consumption: 70W for the HP unit
Ellipse 4G eNB: E-UTRAN Base Station
RDL-6000 HP
CBRS and non-CBRS B48 support

FCC (CBRS) and Japan (B41J) certification
39 km range – private LTE
GigE port with T568B pin out
FSP – Band 13 only: MMF up to 3.7Gb
Up to 500 M optical fiber
Multiple timing sources
GPS/Internal/1588
Holdover time of 24 hrs (FDD) and 4 hrs (TDD)
Ellipse-4G eNBs Specs
Ellipse-4G-HP
Feature
All outdoor eNodeB Wide Area BS
3GPP Release 9+ (Features rolled in as required))
700 MHz FDD B12, 13, 14, 17, 28
3GPP Bands 800 MHz FDD B5, B20, B26
900 MHz FDD B8 and TDD B41/B42/B48 (ask Redline)
# of Active UEs 128
Access Scheme DL: OFDMA UL: SC-FDMA
Modulation DL: QPSK, 16QAM, 64QAM UL: QPSK, 16QAM
Antenna Tech DL: 2x2 MIMO UL: 1x2 SIMO
Channel Size 3, 5, 10, 15, 20 MHz
Tx Power B14 FCC 22W; 700 MHz: 2x +39 dBm; 800 MHz: 2x +38 dBm
-118 dBm based on PRB in 5/10/20 MHz for Wide Area BS Dimensions
Rx Sensitivity
defined by 3GPP 505 x 268 x 166 mm
Data Rate (max) DL: 150 Mb/s UL: 50 Mbps (19.878 x 10.563 x 6.537 in)
Interfaces Single 1000Base-T (including S1 & X2) (data, control and Mgmt) Weight: 10.2 Kg (22.5 lb)
Mobility Up to 120 km/h (75 mph)
Range Up to 37 km (23 miles)
Environmental -40 to +60 °C (-40 to 140 °F); IP67, Nickel plated, powder coat
Surge Protection Built-in

Management FlexCore-EPC; Telnet/SSH, SNMP, NetConf; Deployment Profiles
Power 48VDC; <80W
Timing Integrated GNSS receiver & IEEE 1588
Terminations RF: 2x N(f); Data: 1x RJ45; GPS: 1x TNC(f); DC: 1x 4-pin
RDL-6000 Identification and PPP
RDL-6000 is a single band radio

Each band has a different SKU
B48 SKU supports both CBRS (FCC)
and non-CBRS deployments
B13 has FCC/ISED certification
B7 ETSI certification – in progress
Module-2.2: Managing RDL-6000 eNB
Managing RDL-6000 eNB: Lab Setup
Parameter Web Client *

Static and DHCP IP addressing Pentium dual core 1.3 GHz or
CPU equiv.
IP 192.168.25.149 as default Memory 2 GB RAM
Disk 100 MB free disk space
HTTP/HTTPS/Telnet/SSH/SNMPv1/2/3 Ethernet
Operating
100 Mbps
Windows XP / VISTA / 7 / 10 or
LLDP support System MAC OSX 10.5 or higher
Internet Explorer 10+, Firefox
Browser 38.0+, Google Chrome 43.0+
Admin/Op/Obs accounts with RADIUS support
Local Mgmt interface to manage the eNB: Untagged and tagged options
Up to 10 logical interfaces: 802.1Q/p support on S1, eGTPU and X2
1588 module has its own interface to communicate with sync master
Does not use the eNB interfaces
RDL-6000 eNB Mgmt Landing Page
Exposes only mgmt

parameters
requiring minimal
user interaction
Parameters
configured
through the UI
are persistent
Changing certain
parameters triggers
a system reboot
Ellipse-4G Basic Mgmt Parameters and Interfaces
Local mgmt interface

(up to 10): used for
managing the eNB
Ellipse-4G Logical Interfaces
1. Single static IP for all interfaces

Default case (default IP and no VLAN)
2. Single static IP for all interfaces with VLAN tagging
3. Multiple static IPs
4. Multiple static IPs with VLAN tags
5. DHCP, no VLANs
Five use cases: logical interfaces
Cases 2/4 as RDL-3000/3100 backhaul: strict QoS with VLANs and priorities
Case 4 with FlexCore: FlexCore does not allow one IP with multiple VLANs
Case 5 – many operators
Obtain Mgmt IP from DHCP-applies to all other interfaces without 802.1Q tag
VLAN configuration column is shown only if IP+VLAN is selected
Mixed scenario (tagged and untagged interfaces) are not supported now
VLANs and Ellipse-4G Deployments
Allows segregating the logical interfaces of eNB in VLANS

S1, eGTPU and X2
VLAN tagged traffic on these interfaces can then be transported as required
Case-1: no need to send X2 traffic back to EPC
Tag X2 with a VLAN and use that VLAN locally on the tower you want to do X2 HO
Can reuse that VLAN on next tower and so on
Case-2: prioritize S1 over backhaul -S1 must go under all capacity conditions
Tag S1 and eGTPU in separate VLANs, but priority is set for S1 VLAN on backhaul
Case-3: split architecture for EPC with distributed MMEs and SGW/PGW
Separating interfaces will allow to separate the traffic.
Case-4: multiple EPC deployment scenario
Each EPC on its own VLAN and no routing between them
Case-5: multiple EPC in multiple PLMNs
Allowing multiple providers sharing same eNB, but each with its own VLAN
Software and Configuration Mgmt: FTP/TFTP or HTTP/HTTPS
Loading to eNB
URL Path: Enter the server url
(format: <ftp|http|sftp|scp>://<host>[path]
SSL: <file name>.pem
Upload function: s/w image, config file

(cfg) or security certificates
Export: config backed 1 3
2
“activate” function swaps the s/w
eNB Firmware SFTP/FTP/SCP Server SFTP/FTP/SCP Client
banks
RDL-6000 eNB Mgmt: Cell Control
Monitors unit’s running

or
status
Sync and start/stop
Stop unit by orderly
shutdown and
reboot
This means Sync is good
Sync OK: GPS sync ok and eNB has achieved
sync lock with the
All parameters will be selected time source
This button starts the protocol stack (the unit is already started!)
set by Redline and
hence do not change
anything unless there is
an indication from
Redline System or field
teams
Module-2.3: RDL-6000 Configuration and
Performance Parameters
Cell Configuration: System Information
Identifies eNB within the PLMN

(20 or 28 bits)
Identifies a cell (sector)

within the eNB (8 bits)
eNB ID (20)+Cell ID (8) used to
Identify the cell in a PLMN
(Tracking Area Code)
Assigned (16 bits) to one or a
Group of eNBs so that UE can
be paged when in idle mode
Applicable parameters must be identical to those in EPC

Read values shown above are system calculated – ECI, ECGI (= PLMN+ECI)
PCI must be unique within an eNB (Mod3 and Mod30 tests)
The number of active UEs in a cell depends on channel size KPI state
S1-MME Setup and MME Selection
Specify MME and SGW IP adds - up to 16 S1-MME interfaces

SGW IP is not required if co-located with the MME
eNB selects the MME to a serve a UE – using 3GPP NNSF
Round Robin MME section - selects the first available MME
Searches the list from the selected MME onwards for next UE
Weight Factor: MME load balancing based on relative capacity (0-255)
MME communicates is configured weight factor through S1-AP
Radio Parameters: FDD/TDD
UE discovers eNB’s FDD/TDD mode EARFCN: E-UTRAN Absolute Radio Frequency Channel Number
From the PSS and SSS

UE discovers DL channel BW from MIB
Depends on LTE band: B12 (1.4/3/5/10 MHz)
B14 (5/10 MHz), B17 (5/10 MHz)….
Frequency raster is 100 KHz
SSF is automatically fixed
RDL-6000 TDD supports DL/UL config 1-2-3 based on maximum
distance of UE.
SSF config changes with distance – max 4 symbols in the SSF gap
Max range of 40 Km
RDL-6000 PRACH: Different Config In Each Cell (36.211. table 5.7.12 and 3)
PRACH of two cells can be separated by:

Time (prach config index)
Frequency (prach freq offset)
Sequence (rootSeqIndex and cyclic shift)
PRACH cyclic shift (ZCZ) controls # of preambles
from one RSI and is derived from cell range
RDL-6000: single PRACH per frame configIndex
PRACH
To avoid loss of excessive UL throughput
PRACH GT of 1-4 symbols only
Length in
PRACH Config PF SFN Subframe # Range (km) Range GP Range
Subframes ZCZ PF
(km) (symbols) (km)
3 0 1 1
4 0 4 1 14.53125
1.8 1 0 1 7.71
5 0 7 1 4.5 6 0
2 18.42
19 1 1 1 10 10 0
20 1 Any 4 1 77.34375 17 12 1 3 29.14
21 1 7 1 39.9 14 1 4 39.85
35 2 1 1
36 2 4 1 29.53125
37 2 7 1
Module-2.4: RDL-6000 Mobility Management
Module-2.4.1: Connected Mode Mobility Mgmt: HO
Handover (HO): RRC Connected
MME/SGW
UE must be within the
overlapped coverage S1 S1
of S-eNB and a T-eNB

Must send the
required
measurement X2
reports to its S-eNB S-eNB T-eNB
HO is a 3-phased procedure
1. HO Preparation: S-eNB and T-eNB
2. HO Execution: UE detaches from S-eNB and synchronizes to T-eNB
3. HO Completion: T-eNB confirms HO and initiates path switch (telling the MEE to send the UE
information/data to the T-eNB,
HO can take place on X2 or S1 – looks the same to UE therefore using the target's S1)
UE is not aware what type of HO the network had selected

Max HO delay is 65-95 msec (known T-eNB case)
X2-based HO Process: Example
eNBs exchange
HO messages on
X2 (X2-AP)
S-eNB buffers DL
data and sends to
T-eNB during HO
execution phase
UE buffers UL data and sends it in UL once RRC-connected with T-eNB

X2 round-trip delay can lead to HO failure if above a threshold
A high speed UE could lose contact with S-eNB due to RF conditions
S-eNB may fail to send HO commands to UE and possible call drop happens
A one-way delay of up to 50-70 msec is not noticeable for VoIP like traffic
UE sets T304 at (4) - RLF detected if timer expires before HO is done
LTE Hard HO : Power Budget HO Algorithm
HO margin (HOM) - hysteresis T-eNB

Constant variable
RSRP (dBm)

= RSRPS - RSRPT Preparation time
Makes T-eNB to look worse

than its measured RSRP
RSRP: Reference Signal Received Power
Prevents ping-pong effect
TTT HO HO time
(start) Decision Command
Time to Trigger (TTT) timer: to avoid unnecessary HO

Restricts the HO action from being triggered within certain time duration
HO is triggered when RSRPT > RSRPS + HOM and HOTrigger > TTT (Time To Trigger)
Offsets (event specific): used to favor certain events or eNBs
CIO (used to prefer/dislike an individual cell in a HO decision)-cell specific
LTE Mobility Control: Offset, CIO, hysteresis, threshold and TTT
Mobility Control Parameters
The control parameters are first determined during network planning

Thresholds for events A1 to A5
Event A6 for CA scenarios: N-eNB becomes better than Scell (secondary cell)
Triggers change of one of the Scells in CA deployment
Thresholds for events B1, B2 (inter-RAT)
Measurement offsets and hysteresis
TTT (Time to trigger)
L1 filtering parameters
Parameter tuning is done based on driving tests after deployment
The HO metrics
Number of successful HO’s
Number of too early HO’s and Number of too late HO’s
HO rate
These metrics are used during the optimization process as a performance
indicators for continuous mobility parameter tuning and evaluation
HO Measurement Triggering Events: Intra-LTE/Inter-LTE
A1: S-eNB > an absolute Threshold

A1 and A2 are about S-eNB channel quality
A2: S-eNB < an absolute Threshold
N-eNB channel quality

A1 and A2: for inter-frequency and inter-RAT start/stop measurements
A3/A4/A5 are about

A3: N-eNB becomes offset > S-eNB – intra/inter-frequency
Mainly used for intra-frequency HO Mobility Load Balancing
|
A4: N-eNB > an absolute Threshold – mainly inter-frequency for MLB
A5: S-eNB < Threshold1 AND N-eNB > Threshold2 – inter-frequency
B1/B2 for inter-RAT HO >: better, <:worse
HO Triggering and Execution
RSRPS-eNB = RSRPT-eNB +Hyst HO in RDL-6000
Intra-frequency HO
A1
Inter-frequency HO
A2
A3
A4
HO zone
A5
HO zone is T2-T1 which depends on both TTT and Hysteresis

TTT (msec) and Hysteresis ( 0- 15 dBm) values are set per 3GPP specs
HO is initiated at T2 if the specified events prevail for duration of TTT
Hysteresis/offset are also used in Mobility Load Balancing (MLB)
To transfer UEs from an overloaded cell to lightly loaded one
Mobility Parameters: Connected Mode-A1/A2/A3
Mobility Parameters: Connected Mode-A4/A5
RDL-6000 Neighbour Configuration
SON not enabled
Intra/inter-frequency SON enabled

parameters, X2 HO and
N-eNB IP must be
configured
SON enables in eNB
auto-discovery of
neighbor eNBs
HO Process: Preparation to Execution
2
S-eNB (192.168.30.222) initiates 1
HO based on UE RSRP report
UE bearers are moved to T-eNB
MME completes process
HO Over S1
T-eNB is identified by its eNB ID and PLMN ID

In X2 HO both S-eNB and T-eNB IP addresses are used
HO signalling is logged in MME status database as well
Radio Link Failure (RLF): UE Connection Failure
RLF triggers RRC connection reestablishment

On T310 expiry
Max RLC retry exhausted or
HO failure (T304 expiry)
HO too early: RLF occurs
During HO or Soon (<1sec) after HO or
UE attempts to re-establish in the S-eNB
T-eNB SINR is weak when HO execution phase was entered
HO too late: RLF(UE leaves S-eNB too early)
After a long stay (>1sec) in same cell or
If UE re-establishes in a different cell or
S-eNB signal can be too low – causes an abnormal release before HO
HO to wrong cell: RLF occurs in T-eNB after successful HO or during HO
UE attempts to re-establish radio link in a cell other than S-eNB and T-eNB
PC confusion can be a cause
Ping-pong HO (HO Oscillation): two cells have a big overlapped area
Both cells’ signals fluctuate between low and high levels.
LTE Timers – SIB2: Tracking RRC connection and RLF
T300: UE timer starts on sending RRC connection Req/Resp/reject

Increasing T300 values can improve access success rate
T301: used when UE is unable to successfully RACH when trying to send
RRC connection reestablishment
When T301 is at expiration UE will go to RRC idle
T302: UE timer, started on reception of RRC connection reject message
UE is not allowed to send another RRC connection request on the same cell
until the expiry of T302- 5 sec as default
T304 indicates HO failure - UE is unable to RACH to T-eNB at HO
T310 starts upon detecting PHY layer problem
out
On receiving N310 consecutive |of sync indicators and stops after receiving N311 consecutive in
sync indicators – HO procedure related
T311: started when an RLF is declared and initiating the RRC connection
re‐establishment procedure – stops when cell selected
UE uses T310 and T311 to get time to restore the connection with the eNB
T303/T305/T306 are for Access barred related activités
T320 (moving from E-UTRAN to another RAT), and T321 (CGI related) ……T3470!!
Module-2.4.2: Idle-state Mobility Mgmt: Cell Reselection
Initial Cell Selection: First Time Connection
PLMN selection requires interaction

between NAS and AS levels in UE
(1): UE scans frequencies to detect eNBs
UE syncs with strongest cell to read SIB1
SIB: System Information Block
(2): UE finds PLMN ID (IDs) and reports it
to NAS to select a valid PLMN
A cell with RSRP ≥ -110 dBm are reported
directly (PLMN only)
Otherwise, it includes RSRP level as well
(3): after PLMN selection, UE selects a suitable cell on that PLMN
(4): UE SIB1 and SIB2 to check if UE is allowed to in this cell
(5): UE computes Srxlev (cell selection criteria or receive value)
If Srxlev >0, UE camps on the eNB and signals NAS (in UE)
During initial cell selection, UE has no knowledge of RF channels/signal and scans all
bands it supports to find a suitable cell – selects only cells with the strongest RSRP
Cell Selection/Reselection: RRC Idle State
Cell selection/reselection: Srxlev > 0 AND Squal > 0
Min requirements are signalled in SIB1 by eNB

Calculated from configured values (-70 to -22) multiplied by 2
Qrxlevminoffset: used in searching for a high priority PLMN while camped on a VPLMN
To avoid ping-pong between different PLMNs
Is based on IE within SIB1 (1 to 8) and multiplied by a factor 2 in dB
Qqualminoffset: used in Squal evaluation - periodic search for higher priority PLMN
Pcompensation (dB) : = max (PeMAX - Ppowerclass, 0) (dB)

Pemax (dBm): max Tx power the UE may use in UL
Ppowerclass (dBm): max UE Tx power based on UE class
23 dBm for power class 3 (standard UE) with a single antenna
Idle-Mode Mobility Control: Cell Reselection
Discontinuous Reception
|
UE always measures S-eNB RSRP and applies the S criterion once a DRX cycle
UE is also required to always measure intra-frequency N-eNBs
For cell reselection, eNB specifies priorities for different frequencies and
RATs (0-7), thresholds and measurement rules (SIB3) and other SIBs
UE must measure N-eNBs when S-eNB Srxlev falls below a specified threshold
Absolute Priority: 0-7 (SIB4/5/6/7)
Radio Link Quality
Cell Accessibility Absolute Priority: 0-7 (SIB4/5/6/7)
Cell Accessibility
If multiple cells meet the reselection criteria, a ranking criterion is applied
Idle-Mode Mobility: Intra-Frequency Cell Reselection
Multiplied
by 2 (2x)
Min RSRP (2x) used for Srxlev

calculation during cell selection
or min RSRP required for UE to
continue to camp on S-eNB) Applies to Neighbor
cell only
Inter-frequency reselection is abased on absolute priority (SIB5) – up 8 frequencies

If a UE searches for 10 seconds without finding a new suitable cell based criteria communicated
in SIBs (intra/inter-frequency and inter-RAT) UE is considered to be out of service area
Cell Reselection Parameters
UE does Nonintrafrq meas

s-IntraSearchP if either is not specified
Srxlev (dB) for intra-frequency

measurements
s-IntraSearchQ
UE may not do meas if S-eNB
Below these limits, UE does cell
SrxLev > s-IntraSearchP reselection towards a lower
priority cell.
Squal > s-IntraSearchQ
LTE-LTE nonintra-frequency
UE may not do meas if S-eNB
SrxLev > s-NonIntraSearchP
UE does intrafrq meas if
Squal > s-NonIntraSearchQ either is not specified
QHysteresis and Qoffset are applied

before a new cell is selected
Ranking S-eNB (Rs) = Qmeas(s) + Qhysteresis
Ranking N-eNB (Rn) = Qmeas(n)-Qoffset
Module-2.4.3: Mobility Mgmt KPIs
RDL-6000 KPIs and Measurement Counters (3GPP TS 32.425)
KPI’s help to evaluate the eNB

performance in operation
eNB protocol stack provides the
measurement counters-over 1000
OAM maintains a database of
counter values and calculates
applicable KPIs using these
===> KPI and Link Statistics should only be enabled when debugging/looking for issues <===
• Tx/Rx packets/Bytes
• CRC errors
FAPI Sniffer
RDL-6000 KPIs
(How easily a user obtains a requested

service within specified tolerances)
(E-RAB release/drop)
(Network ability to continuously provide
requested service for the desired period of time)
Reminder, QCI1-4 are
reserved for GBR.
(HO Performance related parameters)
Number of simultaneous
E-RABs on a QCI
(% of time the cell is considered available
related to outage, poor network availability)
(simultaneous usage of resources without

affecting the end-user experience.
(excessive impairments, like UL/DL throughput,

latency, packet loss, etc.)
Wireless Link Statistics: DL/UL Resources
If RNTIs are changing constantly, it means that links are flapping (established, stopped, re-established, re-stopped, etc.)
# of RBs
RNTI 65534 For TB0 For TB1 RBG start (S) and 1-15 1 Or 2 For TB0 For TB1
(paging) and end (E) index
65535 (SI)
MCS: value from 0 to 28
PHR: Power HeadRoom: how far is the UE from transmitting at full power
# of RBs
(23 dBm); PHD of 20,3 means that the UE only needs to transmit at 2,7 dBm
NTA += (TA-31)*16 (accumulated TA)
# of RBs
starting
Index
Femto app platform interface (FAPI) to capture L2QL1 Messages in eNB

12 messages covering data-plane activity
Averaging is done in 10000 FAPI messages
Wireless Link Statistics: RACH
RACH comes from the UE, while RAR comes from the ENB
Preamble ID
(Random Access Response)
RNTI =SF+1 (FDD) = 2

|
SFN : System Frame Number
2 = connected
SF: SubFrame number
First RAP ID is 11, corresponding to 1st RACH with ID 11
Came 5 subframes later, temporary RNTI of 133 was assigned to the UE
Connected UE RNTI always starts higher than 50 RNTI: Radio Network Temporary Identifier
In the tables above, if a PMBL (or RAPID) has multiple RAR RNTI, then the connection is flapping.
Alarm Warnings and Status (AWS)
Abnormal system condition and events that require operator action
Non-critical abnormal system conditions not requiring immediate operator actions
Informative: for optimization/debugging
Sync Manager: eNB is unlocked and unsynchronized – GPS/15888/local

Board Monitor – A/W/S: System power rails monitoring
RFFE: power control, calibration
LTE Stack: cell stop condition, S1 related issues with MME,
Module-2.5: Interference Management and SON
Interference Consideration: Noise Floor (UL)
RSRP
CCI: Co-Channel Interference
eNBs experience (per second update)
Power (dBm)
CCI in LTE networks
Due to FR=1
FR: Frequency Reuse
Opt. performance
requires High SINR
Impacted by CCI ····
InterCell Interference PRBs
|
ICI is the main interference in LTE – normal RSRP and low SINR
RSRP determines DL areas with interference – not impacted by load
PCI issues and cell overshooting are primary reasons
UL noise rise (CCI for eNB) is the key resource limiting factor
UL coverage decreases, calls drop, accessibility suffers, throughput is reduced
Can push cell-edge UEs to transmit high power levels –escalating interference
No UL interference if -121 dBm ≤ UL RSSI ≤ −110 dBm
-110 dBm ≤ UL RSSI ≤ −100 dBm indicates medium interference
UL RSSI > −100 dBm indicates high UL interference
PUSCH: Physical Uplink Shared Channel
Counters for interference on PUSCH and PUCCH PUCCH: Physical Uplink Control Channel
ICIC: eNBs Coordinate Cell-edge Allocations
FR
Inter-cell-interference (ICI) is inevitable in LTE due to “RF
///// = 1”(Frequency Reuse = 1, meaning that all
cells are using the same frequencies)
UEs in the ICI regions have poor SINR – same PRBs allocated to UEs by S-eNBs
ICI Coordination (ICIC): uses frequency reuse to improve SINR at cell edge
Dynamic ICIC: eNBs talk on X2 for resource allocation to their cell-edge UEs
PRBs allocated to cell-edge UEs are determined by the schedulers based on network
conditions dynamically-complex and complicated
Extremely low latency on X2 is one of the main issues
Static ICIC: fractional frequency reuse (FFR)
Fractions of channel frequencies are assigned to different sectors for cell-edge use
RDL-6000 implements partial frequency reuse (a variant of FFR)
ICIC: InterCell Interference Coordination
ICIC Config in RDL-6000: Different FR in Inner/Outer Cells
Inner cell
(FR = 1)
Outer cell
Cell Center Power Reduction reduces the
power used to comnunicate with UE at the cell
UL pathloss determines if UE is cell-centre or cell-edge center, to increase power used for those at cell
edge.
RDL-6000 eNB measure UL Pathloss and compares it with the configured value
Number of cell-centre region is always = 1
At least one cell-edge region must be configured when ICIC is enabled
Default cell centre pathloss (UL) = 150 dB
Everyone connected is considered in cell centre PRB: Physical Resource Block
Power reduction makes cell edge PRBs 3 dB stronger than cell-centre PRBs
DL allocation must be multiples of 3 PRBs with min of 15 PRBs
UL allocation is done as multiples of 3, 2 or 5 PRBs
SON: ANR (Automatic Neighbour Relation)
(With ANR Enabled)
(No ANR)
All N-eNBs with same PLMN as broadcast by eNB are in NRT-white listed
Detected N-eNBs which use PLMN IDs not broadcast by eNB are in foreign list
If N-eNB is on same frequency as the eNB, NRT
|
contains N-eNB CGI and PCI
(ECGI)
Neighbour Relation Table
Mn±CIOn > Ms±CIOs +A3 or A5) (A3 for intra and A5 for inter-frequency ANR)
MLB Config: Preventing Cell Congestion-intra/inter-frequency MLB
Connected Mode MLB (preferred): uses HO parameters tuning

Idle Mode MLB: uses cell selection/reselection parameters tuning
Load dimensioning can help MLB to work effectively
Admission control actions are used to assist MLB
The thresholds are indicating the used capacity:
90% = 90% of PRB are used.
The Stop Threshold should actually be LOWER than the start
one. A good value here would be 80 instead of 96.
Disable MLB function when eNB
capacity ≥ this threshold
(PRBs) MLB starts when eNB (PRBs)

capacity drops below this
threshold
(in PRBs) Min difference required in the

available capacities of the S-eNB and
T-eNB to start MLB (HO)
SON Functions: MRO
SON MRO function is to improve HO KPI’s and minimizing RLF

Uses HO Attempt count, HO Failure Count and HO Failure Type
Min # of HO attempts before

the MRO algo is executed (in
5 minutes period)
Begin MRO HO Stop MRO when HO

failure rate failure rate falls
reaches/exceeds below this threshold
Cell Individual Offset Time To Trigger Radio Resource Management

| | |
MRO algorithm generates new CIO and TTT values and notifies RRM
When HO failure rate exceeds the pre-defined limit, mobility parameters are
adjusted/optimized accordingly
SON Functions: MRO
CIO is N-eNB specific

MRO considers HO counters per cell
and optimizes CIO for that cell
TTT is common to all N-eNBs
MRO uses HO counters collectively for
all the neighbors to optimize TTT
Too Late HO Counter RLF: Radio Link Failure
RLF detection in S-eNB -UE initiates a rrc ConnReStb Request with N-eNB
N-eNB rejects UE and send X2AP RFL to S-eNB
Too Early HO Counter
RLF soon after UE connected to T-eNB and UE reestablishes the connection
in the S-eNB
HO To Wrong Cell Counter
RLF occurs soon after the HO trigger to T-eNB
UE re-establishes in a different cell than the source or target
Module-2.6: RDL-6000 CBRS Configuration
RDL-6000: Category B CBRS per FCC Part-96
Can access SAS with or without Domain Proxy (DP) RDL-6000 HP Band 48
Tx-Power settings for FCC
Can work with any standard based SAS certification
Antenna Tx Power
But interoperability tests not done Channel Gain per port
BW [MHz] [dBi] [dBm]
To use DP, its URL must be set in SAS client 10 10 32
10 14 28
Instead of the SAS URL itself 20 10 35
SAS subscription is available from Redline 20 14 31
EUD is invisible to SAS: CBSD controlled EUD: End User Device
FCC Part-96 EIRP and emission limits apply

CPE-CBSD (Higher Power UE)-SAS Interactions
CPE-CBSD SAS
(Registration/Grant)
CPE-CBSD 4
CBRS S1 Setup
2
Uu
S1 PDN/IMS
SGi
CBSD EPC
3
EUDs RRC Setup
SAS IMS
1
Geolocation
Spectrum
Database ESC
EUD
CPE-CBSD is visible to the SAS and is subject to CBSD rules

Link up with BTS-CBSD and contacts SAS in order to obtain a grant
Grant request message must clearly indicate CPE-CBRS Tx power in use
The time should not exceed 1 sec within any 10-sec period
Must use SAS specified operational parameters once it gets a grant
RDL-6000 CBRS Specific Configuration
Issued by SAS provider
ENB is class B (hi-power)
CBSD does not verify SAS Certificates
CBRS State
(eNB ID- FCC ID+S/N)
SAS returns the spectrum available in

the CBSD location. Based on this eNB
requests the use of its configured
EARFCN –if not available, then eNB
must be configured with an available
channel in the indicated range and only
then eNB can complete SAS registration
(-137 is a placeholder)
CBSDs Registered With SAS
Single step registration

CBSD and CPE-CBSD are required to
send all SAS required geo-data and
antenna parameters in the registration
process – spectrum enquiry basically
Must load CPI private key into the
radio – not ideal
Multi-step registration
CPI inputs CBSD/CPE-CBSD geo-data
directly into SAS
Federated supports multi-step
registration only
RDL-6000 supports only multi-step
registration
SAS Frequency Allocation: GAA
Channel units available in CBSD location are returned to the units

Location data sent to SAS by the CBSD/CPE-CBSD or configured by CPI
Invalid if a CBSD/CPE-CBSD is moved from its registered location
Changes in CBSD/CPE-CBSD parameters to SAS within 60 secs
Such as V/H accuracy or geo-data
RDL-6000-CBRS Deployment Architecture
Must obtain SAS

authorization before it
can set up S1
RDL-6000 cell control
page displays
“authorizing” until
successful
RDL-6000 retries
every 2 minutes in
case it cannot access
the SAS
RCSP-RDL-6000
Mod-3: FlexCore Overview and Configuration
© Redline Communications Inc. 2021. All rights reserved.

RCSP-RDL-6000: Module-3 Contents*
Module-3.1: FlexCore Building Blocks and Management

Module-3.2: FlexCore Nodes Configuration
Module-3.3: LTE Network Configuration
Module-3.4: Subscriber Registration and Mgmt in FlexCore
Module-3.5: Monitoring and Troubleshooting
*Content covered in this module is based on FlexCore version 13.3 update-1
RCSP Certification Programs RCSP-RDL-6000 Module-3: FlexCore Overview and Configuration R13.3.1-V1.3 Slide-2
Module-3.1: FlexCore Building Blocks and Management
RCSP Certification Programs RCSP-RDL-6000 Module-3: FlexCore Overview and Configuration R13.3-V1.2
FlexCore EPC Connectivity View
Equipment Identity Register
EIR
S13 Internet
eNB
SGi
S1 IMS
eNB
Gy
Bo Operator
eNB OCS Services
Gx BSS
Bx
OFCS BSS: Business Support System
Supports any 4G eNB OCS: Online Charging Server
OFCS: Offline Charging Server
Interoperates with any LTE EPC
Supports all LTE interfaces - additional licensing may apply
FlexCore nodes can be co-located or distributed – 3 configurations
FlexCore EPC: Fully 3GPP Compliant Solution
EPC elements in a single carrier-class,

high availability platform
Proprietary MME Load balancing
Interfaces for additional FlexCore
to ENB <=
elements to scale up network capacity
Delivers C-plane/U-plane capabilities
necessary to build an LTE network
Support for LTE Rel 15 UEs
(C-Plane U-Plane Separation)
FlexCore Deployment Topologies: Centralized
Ideal configuration for

rapid deployable scenarios
Emergency services and
disaster relief
Can host all EPC nodes and
Apps in one chassis
Deployable within
minutes
Ideal for installation on
car/truck/CoW
Especially when included
in a kit with a co-located
eNB
VoLTE/IMS, NG9-1-1 and
CMAS support
FlexCore Deployment Topologies: Distributed
MME and S-GW are co-located

with the LTE eNB
No S1 backhauling is required
Allows local UE-to-UE traffic to be routed locally

Configured in PGW
Minimizes load on distribution network
Minimizes impact of distribution network on e2e latency
FlexCore Deployment Topologies: Synchronized HSS
Each cell site has a FlexCore EPC

Autonomous operation during distribution
network outage
Slave HSS =>
In case of distributed network

failure, UEs under a same
PGW can still communicate
with each other.
A Master-HSS in the core provides centralized subscriber database

M-HSS and S-HSS synchronization is handled automatically in the background
FlexCore-EPC: NMS (Network Management System)
Browser (FlexCore
FCAPS NMS function for
EPC Nodes
SOAP: Simple Object Access Protocol
SOAP over HTTP/HTTPS
to connect to EPC nodes
Integrated installation
with FlexCore EPC
SQLite database support
HTTPS with TLSv1.2 user
for mgmt interface
Trusted-CA signed device certificates support

SNOW 3G, AES, Kasumi for inter-node security
Server platform health monitoring - On IPMI capable platforms
Configure/view alarms/SNMP-traps/KPIs and UE monitoring/mgmt
FlexCore Installation Options
Carrier-Grade Multi-Blade Chassis
VMWare VM Installation
Each VM in a host operating one or
more FlexCore nodes
The s/w provides the infrastructure
for VMs to inter-communicate (blue
interfaces) and
Communicate with the eNB, PDN
and Mgmt System
Capacity increase on demand
Add more VMs to the host platform
Chassis blades connect to eNB and PDN Deployable Systems- Portable EPC
on network interfaces (NICs) Public safety use emergency use
EPC nodes connect to eNB/IMS/PDN on case – remote EPC in a vehicle
front-plane NICs and and talking to a centralized EPC
Inter-node connectivity via internal switch Cloud-based Installation
Nodes can connect to NMS and external MME/SGW/PGW onsite
SNMP via the Fabric Ethernet Switch Keeping traffic local
FlexCore Server License: Activating Network Functions
Hardware Key (HK): USB-dongle

Only one VM or host OS can
access it at any time
Suitable for demos and trials
due to its portable nature
HK-Bare Metal
EPC locates dongle and
activates the license
HK-VM
Locating the dongle and activating the license requires ESXi login
Software Key: Typical for VM migration (Ex. vMotion)
Requires Customer-to-Vendor (C2V) and V2C files exchange
Based on C2V, Redline generates the V2C file which is installed in FlexCore Server
OFCS, OCS, ePDG and MME Load Balancer are licensed separately
FlexCore Server License Management
Single-License: FlexCore on a single

system using H/w License (HL) Key
License file (*.lic), a license file
checksum (*.sha), and license dongle
Install License and checksum files in
the /opt/rdl-license-server folder
Install the USB dongle on the
FlexCore/NMS system
Site License: multiple-FlexCore
instances
This is a Network License (HL-NET)
Key installed on a license server
This system must be reachable by all
FlexCore EPCs covered by this license
SGW/PCRF: max instances are
specified in the license
License Validity Check and Updating
Update* License when:

The license expires
FlexCore EPC is updated to a new
s/w version
Requires a new V2C file from
Redline
License is based number allowed
active subscribers
Perpetual: On premises
Annual: Cloud hosting
* Refer to the FlexCore installation guide for

the upgrade procedure and steps to follow
Installing Digital Certificates: Enabling Secure Access
Simple Object Access Protocol

|
FlexCore NMS uses SOAP over HTTP or
HTTPS (default) to connect to FlexCore
EPC systems/nodes
Digital certificates are required to
enable secure access to FlexCore EPC
and NMS (using a web browser)
FlexCore EPC and NMS are packaged with default self-signed certificates
Operator can use these certificates or 3rd party trusted SSL certificates
Must come from valid CA (FlexCore user manual gives details on this)
From an NMS perspective, inter-node communication is done via SOAP
This won’t impact how the nodes communicate with each other via the
normal LTE interfaces, which are mode often than not based on Diameter
FlexCore NMS Administration: User Roles
FlexCore Console admin

Username/password: admin/admin by default
Add/delete/modify user role/account/password
Setting up LDAP for user authentication
NMS upgrade/rollback and password policy
SSL certificates for HTTPS – trusted or self-signed
SSH Login: managing the EPC using CLI
Username: root and password: redline
Network Admin
Username: nadmin and password: redline123
Setting up the LTE network functions and Services
Subscriber Admin: adding/registering UEs in HSS
Username: sadmin and password: redline123
Observer: can view status/logs/alarms
Load Control: FlexCore Physical Installation
Select a value between 1 and

10 % . The default value is 5%.
Allows load balancing among multiple SGWs/PGWs

Helping MME select the least loaded SGW/PGW for a new UE Attach request
Requires at least another SGW/PGW in MME neighbor list
Managing the EPC System
Edit EPC System
Add EPC System
FlexCore nodes can be grouped as an EPC System-specific IP address

No two EPC Systems can have the same IP
One EPC system is created by default in the Element Mgmt page
This one cannot be removed
Editing the EPC System: Capacity and Performance
(can be changed)
(cannot be changed if it has nodes in it)
IPMI-based H/w Status Tracking

NMS can monitor system
health –CPU temp, fan speed..
≤ 8xsubscribers
≤ 10xPDN-sessions)
1 SGW and PGW

multi-Gbps
throughput
Module-3.2: FlexCore Nodes Configuration
FlexCore NMS Capabilities
Do 2nd Do 1st!
Network Element Subscriber Network SNMP
Management Monitoring Alarms
Configuration Management Configuration
|
|==> Essential
|
FlexCore Nodes Configuration
Discovering FlexCore
nodes using IP Start/restart a
FlexCore Node
Connecting with
FlexCore Node - IP s/w upgrade a FlexCore
Packet Capture on node or schedule an
FlexCore Interfaces upgrade
Ping a network element
from FlexCore
Each FlexCore node interfaces/capabilities needs to be configured

Changes in Basic Configuration requires a Node restart to activate changes
Multiple FlexCore EPCs are managed within the same FlexCore NMS
MME: LTE Control Node
(S1-MME)
UE session mgmt on S1 Used by eNB to select

an MME to serve a UE
U-plane control on S11
Mobility mgmt on S10
UE mobility/session mgmt
functionalities on NAS
HO support on S1
Integration with 2G/3G via S3
E-UTRAN LTE C-Plane: NAS Signalling
Status of the UE according to the MME
EPS Mobility Mgmt (EMM)

EMM-Deregistered
UE location is not known
at any level
UE detaching enters this
mode as well
EMM-Registered
UE is registered with MME, has IP address and default bearer
UE location is known to MME at the TA level
EPS Connection Mgmt (ECM) Requires RRC-Connected mode
ECM-Idle: UE has no signalling between UE and MME
UE can do PLMN selection and cell selection/reselection
eNB has no knowledge of UE
ECM-Connected: active signalling connection with MME
MME Protocol Stack: S1-AP
S1-MME
eNB
E-RAB mgmt triggered by MME
Setting up, modifying/release
Initial Context Transfer
Default IP connectivity and transfer
of NAS signalling
UE Capability Indication – to MME
Mobility, path switch, paging, load
balancing function – MME pool area
RoHC is not applied to C-plane
GTP-C on S10
S1-U: data between eNB and SGW
UDP on IP and GPT-U
eNB sends CSG IDs as part of the S1
setup request to MME
MME Configuration: Basic Parameters
MME-SGW Interface (0-4095)
MME is selected by eNB for a UE – based on RR or relative capacity

MMEC is used in the eNB NAS function to select an MME
UE connects to one MME in a pool
Changes require node reboot to take effect
MME Status: S1 Setup and Signalling
MME IP add must be

configured in eNB
eNBs successfully
setting up S1 are listed
in MME status page
Signaling
Attach/detach
TAU
S1/X2 HO…….
S1AP: S1 setup, E-RAB, HO commands/request….

NAS: network attach message, TAU accept/reject, success/failure rate
GTPv2-C: session creation/deletion, data notification….
MME Advanced Configuration: Neighbors and Protocols
Adding neighbors to ARP priority level to

the FlexCore MME Paging Priority (PP)
Must be reachable mapping
from MME
Lower PP indicates
higher priority
MME uses this local
policy for UE’s
priority-based paging
NB-IoT control
NAS Security: EEA and EIA
EPS Encryption Algorithm and Integrity Algorithm eDRX
S1AP: MME relative capacity
Diameter/HO/paging/SCTP parameters
A Diameter agent is the only point of contact into or from the operator’s
network at the Diameter level
MME Protocols Configuration: NAS and Interfaces APs
MME and UE negotiate security

Identify procedure specifies how
the MME retrieves UE IMEI
Check if UE was lost/black-listed
Normal: asks IMEI in a separate
Relative MME capacity in a pool, and
message how it is used for load balancing
SMC: MME requests IMEI during

the SMC procedure complete
After AS security is set up on SRB2
To notify MME about DL
UE data , this is how long
the MME instructs an
SGW to wait
Overload Action: MME indicates permitted RRC connections to eNB(s)

eNB ensures to send to the MME
Paging DRX (paging cycle) is in number of frames DRX: Discontinuous Reception
HO Resource Release timeout (secs) for UE connected via the MME
SGW: UE Traffic Routing/Forwarding Between PGW and eNB
U-plane anchor
Forwarding and
buffering Access Point Name
|
UE traffic from all APNs
must go through the
same SGW
Gxc is not actually used

Stores DL date for an Idle UE - while MME pages the UE
Local mobility anchor for inter-eNB/inter-3GPP Hos - data bearers
MME selects the SGW to server a UE-using TAI data on S11 TAI: Tracking Area Identity
SGW IP address is configured in eNB - if SGW is not co-located
SGW handles bearers in PMIP/GRE deployments on S5
Default use is GTP for S5/S8
Mobility anchoring for inter-3GPP mobility on S4
SGW Configuration: U-Plane Forwarding/Buffering
SGW is controlled by MME on S11
PGW Configuration: Connecting EPC to External Networks
PCRF
SGi towards PDN OCS
AAA
S6b Gx Gy
UE IP addressing
PDN/IMS
Mobility anchor for S-GW P-GW
S5 SGi
internetworking with
non-3GPP networks Gz
OFCS
Selected for a UE by S2b S2a
MME using APN data Non-trusteed Trusted
ePDG
Non-3GPP Non-3GPP
DL packet filtering and assignment to EPS bearers (QoS) based on TFTs

QoS enforcement and flow based-charging- PCEF
Lawful Interception
GTP-U and GRE on S5 for U-plane
GTP-C and PMIP on S5 for C-plane
Support for ePDG needs to be licensed separately
PGW Configuration: Interfaces and Traffic Mgmt Functions
S5-c and S5-u can have different IP addresses in the

GTP implementation
PGW Configuration: Traffic Mgmt
• If no SGi backhaul exists (EPC in remote
location), can re-route traffic from one
UE to another from the PGW
• UEs must be served by same PGW
• PGW sends UL traffic from SGi

interface to the specified IP address
• In congestion periods, PGW allocates GBR (on int S5-U)

bearers up to this % of max interface speed
• Preemption based on configured ARP
• Default is 80% of max interface speed
• Show all APNs configured for this (selected) PGW

• Changes made here reflect in the selected PGW
UE IP Addressing: Summary
Typically allocated during the Default Bearer activation (dynamic or static)
Subscription
Co-located PGW DHCPv4 Profile Specific
External DHCPv4
DHCP Server (through PDN) allocates addresses to

the SGW, and SGW allocates addresses to the UE
• Allows UE IP allocation on per subscription
• Main approach-applicable APN-wide
profile basis – different IP on different
for any devices on any subscription
devices using same profile/APN config.
profile that attempt to use it
• This is a local EPC override and will not
• The only method enabling multi-
work in a synchronized SPR solution
EPC synchronized SPR solution
without having to manually edit • This pool provides an override on the APN
the configuration of each EPC configuration – gets used first
independently
• Default gateway for the UE is the other end of the GTP tunnel between UE and PGW
• In (4), the PGW takes the UE IP from HSS and forwards to UE during attach phase
The specified IMSI always get the same specified IP address (fixed reserved IP) <=.Persistent UE IP Addressing
Packets From UE To Internet (UEÆPGW): An Example
UE eNB
3. SGW modifies GTP-u header and sends the

1. UE sends a packet to Google packet to PGW
2. eNB encapsulates it inside GTP-u 4. PGW removes GTP header and shoots the
Sends it to SGW packet to the internet
HSS Configuration: Storing Permanent Type UE Data
IP to IMSI mapping/reservation
Subscriber security information is saved in HSS – security keys

Subscriber profile data is stored in SPR
Replication and automatic sync of subscribers data in multiple SPRs
Geo-redundant backup, high availability to HSS in the network
Indicates whether local breakout is allowed for a User-APN combination
HSS Configuration: SPR Replication and Persistent UE IP
Disables once a slave SPR is added
Subscriber profile data is stored in SPR

Load Balancing and High Availability capabilities
to the HSS in the network
Multiple HSS/SPR: Master/Slaves
Replication via the Master
(UE’s Persistent IP)
the credentials of a user, who

has the permission to copy files
in the /var directory
PCRF Configuration: Monetizing LTE Networks
PCRF (other PCRF)
S9
Service Data Flow

|
Authorizes the treatment that a SDF will receive – through PCEF
SDF detection and gating (start/stop of services based on trigger from AF)
QoS and flow-based charging towards the PCEF
Selected QCI is applied to a media type – receives the info from the AF over Rx
QCI: QoS Class Identifier
Enforces PCEF U-plane traffic treatment to comply with user subscription
PCEF does the bearer binding function (BBF) – SDF to bearer
Mapping an SDF to an existing bearer or creating a new bearer for it
Module-3.3: LTE Network Configuration
FlexCore-EPC Network Configuration Building Blocks
Managing
Network
Config files Access Points: PDN to which a UE
connects - identified by an APN
UE can connect to Multiple APNs
Internet, emergency, IMS…
Active Network
Configuration file External Servers: non-FlexCore nodes
Services: data flow, QoS and charging
Subscription Profiles
UE’s service plans
Roaming: inter-PLMN specifications
CDR: billing data for the UEs
CDR: Charging Data Record
OFCS or OCS and billing system info
(Offline and Online Charging Servers)
Home Network: Home PLMN CS Domain Interworking
TA: UE location Enabling MME to support SMS/voice
& Configuring PLMN, TA and APN is mandatory

Network Configuration: Home Net and TA
TAC is a 16-bits integer between 0-65535 and separated by comma(s)

TAC defines a TA within an operator network – TA specific time Zones
TAC is used to derive TA ID (TAI) = PLMN ID +TAC
TAI identifies a TA Globally
Group ID is defined in the MME configuration module (MME pool ID)
Any modification in home network wipes put
//////// all UE data in HSS
Network Configuration: Access Point Name (APN)
UE connectivity to a
PDN requires an APN Network ID Operator ID
definition
Each PDN is
identified by a
specified APN
Provisioned in HSS
A UE is assigned to a default PGW when it attaches to network
MME selects the PDN first based on APN and the PGW a UE connects to
PGW assigns an always on IP address and a default bearer
Default bearer QoS can be modified within a PDN context
Emergency services require dedicated APN
Does not have APN type
Network Configuration: APN Restrictions (TS 29.303)
(3GPP TS 29.274)
Determines if a UE is allowed to Public-1: allows UE to attach to any other

combination of Public-1, Public-2, and
establish bearers to other APNs
Private-1 APN Types
Comes into play when a UE is to Public-2: only allows Public-1 and Public-2
have multiple APN connectivity APN Types
Restriction value is configured Private-1: allows Public-1
for each APN in the PGW Private-2: doesn't allow UE connections to
any other APN Type
Works on per UE basis
Service Configuration: User Data QoS
Services are sorted into QCI, for which bearers are created.
QoS (QCI) specified for a service is what an EPS bearer gets

QCI selected must support the intended applications AMBR: Aggregate Maximum Bit Rate
(enforced by PGW) (enforced by ENB)
QoS for non-GBR services must conform to APN-AMBR and UE-AMBR
Classification (SDF filters) are applied to dedicated bearers as TFTs (Trafic Flow Template)
(Service Data Flow)
Every dedicated bearer is associated with a TFT
Services QoS: Specifies Transport Channel Characteristics
QCI: GBR and Non-GBR resource types

Priority Level: service ARP policy (1-15)
1 (highest)-----15 (lowest)
Preemption policy is enforced at the eNB to
a bearer using this service
Used during congestion periods only
Default bearer by default uses QCI 9 (1 to 9)
(1,2…15)
Can be changed in PDN context configured in
Subscription profile
Congestion situation:
During congestion, data with Preemption Capability
enabled will cause the PGW to drop data from
Preemption Vulnerable services, starting with the
lower priority ones (lower priority = higher number)
DL/UL Packet Classification: Differentiating Traffic Flows
IPv4 address: traffic end-point

In internet or OP IP services
Protocol Identifier (in IP header)-RFC790
ICMP (1), TCP (6), UDP (17), SCTP (132)
Local Port (Protocol IDs 6, 17 or 132)
Port to which the UE App traffic is bound
Remote Port (Protocol IDs 6, 17 or 132)
Port to which the traffic to the Internet and
OP IP Service application is bound
Security Parameter index: filtering IPSec enabled traffic (0x00-0xFFFFFF)

Type of Service (ToS): enforces PCC rules for DiffServ marked traffic
ToS Mask: logical 'AND' the mask ToS octets and match it to traffic DSCP
or Traffic Class fields for EPS bearer selection (0x01 and 0xFF)
Subscription Profile: Bundling User Services Attributes
Subscriber Profile Repository
|
PCC rules and policies, services and entitlements of a user - saved in SPR(often part of HSS itself)
Specify forbidden access
networks for the UE
Specify PDNs a UE
can connect to and Limit UE’s data usage
APN binding Subscription Profile (policy based)
PDNs
PDN Context (configure for each PDN)
APN-AMBR and
Default bearer
attributes
Static IP4 address for UEs SPRÆ HSSÆ UE roaming

Allowed User MMEÆSGWÆPCEF policy config
(single/multiple) using this profile to
Services in this PDN
override DHCP addressing
Subscription Profile Parameters
Total bandwidth for the

All UE using this profile
PDNs
Subscriber profiles are saved in SPR - co-located with HSS in FlexCore

QoS specified here applies to all applicable non-GBR bearers of a UE
Subscription Profile Configuration: PDN Association
QoS
The maximum uplink/downlink bit rate
aggregated across all non-GBR bearers in
this PDN connection. The PGW uses the
APN-AMBR UL
uplink/downlink APN-AMBR to limit the
APN-AMBR DL
total bandwidth provided to all the non-
GBR Bearers created in this PDN
connection.
The default value is set to 9. Refer to
QoS Class
Services for a detailed description of this
Identifier
parameter.
The default value is set to 9. Refer to
Priority Level Services for a detailed description of this
parameter.
The default value is set to Disabled. Refer
Preemption
to Services for a detailed description of
Vulnerability
this parameter.
The default value is set to Disabled. Refer
Preemption
to Services for a detailed description of
Capability
this parameter.
Subscription Profile Configuration: UE IP Addressing
IP Addressing - Static and assigned by PGW from

the configured pool
Check this box so that the UE is
Static IP allocated an IP address from a
Address static pool. If left unchecked, the
Allocation PGW will obtain an IP address
from a DHCP server.
The address mask of subscriber's
assigned IPv4 address. If the
UE IPv4 default value 32 is used, only one
Address IPv4 address per subscriber per
Mask PDN will be allocated. Use values
16 to 31 to allocate multiple IP
addresses per PDN connection.
UE IPv4 Starting address of the pool of IP
UE IP address is not used anywhere in the EPS Address addresses that is used to allocate
Start to the UE
PGW is the first node to see the UE traffic UE IPv4
Last address in the pool of IP
addresses that is used to allocate
UE subnet should be routable in the PDN Address End static IP addresses to the UE.
Module-3.4: Subscriber Registration and
Management in FlexCore
Subscriber Administration: Registering UEs With HSS
Subscriber Profile Repository

|
Select an SPR – holing a subscription profile
Add Subscribers
One by one or in bulk
Import bulk subscribers in a csv file
One at a time or in bulk
A Subscription Profile must exist FlexCore in order to add a UE
Subscribers cannot be added without being able to select a profile
Adding A Subscriber to FlexCore HSS
PARAMETER DESCRIPTION
Number of The total number of subscribers to be registered
Subscribers together.
Subscription Select a subscription profile from the drop-down
Profile list.
Subscriber
Enter the name of the Subscriber
Name
Subscriber Select either 'Disabled' or 'Active'. A subscriber can
State only attach to the network if the state is 'Active'.
The Mobile Station Identity Number of the UE to
MSIN
be registered.
The Mobile Station ISDN number of the first UE to
MSISDN
be registered.
OP is a 128-bit Operator Variant Algorithm
Operator Configuration field, whereas OPc is a 128-bit key
Variant Type computed from OP and K, known only to the HSS
and the ISIM/USIM application on the UICC.
A 128-bit value for the Operator Variant Algorithm

Configuration, based on 3GPP TS 35.205, Clause
Operator
8.3. Should be a 32-digit hex number. The default
Variant
value is set to
63bfa50ee6523365ff14c1f45f88737d.
The Authentication Key to be used by the UE for
Shared Key (K)
registration.
Show
<= use this This will toggle to 'Hide Advanced Options' and
Advanced
display the following options if you click on it.
Options
Module-3.5: Subscriber Connectivity Monitoring
and Basic Troubleshooting
Network Troubleshooting Tools in EPC
Network Viewing of Subscribers: nadmin account
IMSI is hyperlink in this page

(RRC-connected)
• Check UE connectivity in
E-UTRAN and EPC
• Test idle vs connected
mode for a UE
• View which bearer is
carrying UE traffic
UE States in MME: NAS
EPS Mobility Management (EMM): indicates if UE is registered with MME

EMM-Deregistered -UE is not reachable by a MME and its location is no known
EMM-Registered: UE attaches to E-UTRAN and receives services from EPS
EPS Connection Management (ECM): indicates UE-EPC signalling connectivity
ECM-Idle: no signalling connection between UE and the MME
ECM-Connected: signalling exists between UE and MME
RRC-Connected state and S1-MME connectivity
UE can transition to EMM-Registered only when in EMC-Connected state
Network Monitoring in EPC
View network KPIs
SNMP Configuration
An SNMP access policy is essential to secure

access of the EPC node data
End point IP address needs to be configured
Node which SNMP connects with
Alarms
Periodic collection of KPI metrics is essential-collected every minute

Periodically fetching and displaying statistics for selected nodes.
Monitoring and saving these statistics for critical conditions.
Generating SNMP-trap notification on reaching such critical conditions
Alarms attributes must be configured as applicable
Min time between alarms of same type is 1 hour
Alarm Thresholds (trigger/rearm/clear) Flexcore cannot send emails for alarms by itself. A monitoring
system is required to catch SNMP traps, and act accordingly.

RCSP-RDL6000 Complet

Uploaded by

Copyright:

Available Formats

RCSP-RDL6000 Complet

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

RCSP-RDL6000 Complet

Uploaded by

Copyright:

Available Formats

What are the main components of an LTE network?

What are the main components of an LTE network?

What are the different states a UE can be in within the EPC?

What are the different states a UE can be in within the EPC?

RCSP-RDL-6000

Module-1: LTE System and Technology Overview

© Redline Communications Inc. 2021 All rights reserved.

 Module-1.1: LTE Overview, Building Blocks and Operation

• System features and capabilities referenced in this module are based

Module-1.1.1: LTE Network-Basic Definitions

 Capacity constraint between

UE Evolved Packet Core (EPC)

Rel-8: LTE Rel-9: LTE Rel-10 Rel-11 Rel-12

▪ Introduced LTE ▪ SON ▪ Carrier aggregation (CA) ▪ CA enhancements ▪ MTC ecosystem

 Rel-8/9 defines the LTE systems (EPS)

Data Flow LTE LTE-A 5G NR

 The fundamental channel capacity metric is the max

Module-1.1.2: LTE Core: Evolved Packet Core (EPC)

 EPC nodes can be co-located/distributed, each has specific tasks

 Interface: conceptual IP-based link connecting functions in different nodes

Default bearer for PDN1 S11

Default bearer for PDN2

 S5 to connect S-GW to (non-collocated) P-GW of same operator

 S8 connects the SGW in the VPLMN to the HPLMN PGW

LTE network is divided

Module-1.1.3: E-UTRAN Operation and Parameters

 eNB is the LTE base station

Min eNB to UE # of Cells

Wide Area Macro FCC/ETSI 70 dB 3-6 > 1 km 1200 Sector

Medium Area Micro ≤38 dBm 53 dB one 250 m ~ 1km Sector/Omni

Local Area Pico ≤24 dBm 45 dB one 100 ~ 300 m Omni

 Based on cell radius and Tx power (single antenna in eNB)

 eNB can have 1-256 radio cards (cell)

 LTE defines only 504 PCIs (0-503)

PCI Collision T-eNB

 No unambiguous way to notify the UE which eNB it must HO to

 PCI confusion: no eNB has PCI Confusion

) PCI allocation must pass mod3,

update (TAU) to its serving MME

OP-A EPC OP-A EPC

S1-Flex MME (Pool)

MOCN (multi-operator CN): each Shared RAN

Module-1.1.4: LTE UEs and their Capabilities

Rx Diversity Yes Yes No (1 Rx antenna)

DL Modulation QPSK, 16QAM, 64QAM ( 256QAM in CAT 11 onwards)

 Category specifies a UE’s DL/UL radio access capabilities- declares it to eNB

 Four Power class specifies the max Tx power of a UE in UL

 An LTE entity is assigned one

 eNB ID: uniquely identifies eNB in a PLMN (20 or 28 bits)

IMEI (Int’l ME ID) identifies device to the

GUTI (temp UE ID by MME – 80 bits): Identifies

GUMMEI 48 bits or less M-TMSI (32 bits): identifies MS

S-TMSI is the shortened form of the GUTI to enable more efficient

*ITU-T Recommendation E.213

 IMSI: permanent, globally unique OP assigned

 IP Address: dynamic and assigned by the PGW

7 7 100 1.00E-03 Voice, live streaming video, Interactive gaming

UE eNB SGW PGW PS

End to End Service

E-UTRAN EPC PDN

Module-1.1: LTE Overview, Building Blocks and Operation

Capacity constraint between

Rel-8/9 defines the LTE systems (EPS)

The fundamental channel capacity metric is the max

EPC nodes can be co-located/distributed, each has specific tasks

Interface: conceptual IP-based link connecting functions in different nodes

S5 to connect S-GW to (non-collocated) P-GW of same operator

S8 connects the SGW in the VPLMN to the HPLMN PGW

eNB is the LTE base station

Based on cell radius and Tx power (single antenna in eNB)

eNB can have 1-256 radio cards (cell)

LTE defines only 504 PCIs (0-503)

No unambiguous way to notify the UE which eNB it must HO to

PCI confusion: no eNB has PCI Confusion

Category specifies a UE’s DL/UL radio access capabilities- declares it to eNB

Four Power class specifies the max Tx power of a UE in UL

An LTE entity is assigned one

eNB ID: uniquely identifies eNB in a PLMN (20 or 28 bits)

IMSI: permanent, globally unique OP assigned

IP Address: dynamic and assigned by the PGW

Each dedicated bearer has an associated TFT - tied to UE’s IP add

IP flows are the network traffic

IP flows are classified to SDFs based on applicable TFT

TFTs are used in DL (PCEF) and UL (UE) to map SDFs to bearers

GTP-C to deliver signalling on

Add a header (2-3 bytes) data PDCP PDCP

Segmenting and concatenation PHY PHY

Used when PDU sizes are known a priori

Transport format selection PHY PHY

MAC builds the TB

Logical (7 DL, 3 UL): what type of data they carry - traffic/control

PBCH: vital system parameters - QPSK PBCH: Physical Broadcast CHannel

System BW, PHICH info, SFN and eNB Tx antenna configuration

C-Plane: signalling and NAS control

3GPP specifies bands when spectrum becomes available

Bands 66-71 as well as B252 and 255 (unlicensed bands)

A multi-carrier scheme using overlapping orthogonal narrowband

Input data is divided into N streams, each carried on a subcarrier

Depends on channel delay spread

LTE time parameters are expressed

OFDMA transmits the four QPSK data symbols in parallel

Resource Element (RE) Short CP

One subcarrier over one OFDM

DL channel size is indicated in

Transmits data symbols sequentially

SC-FDMA uses a DFT pre-coder followed by an OFDMA front-end

The extra subcarrier (DC) in DL is not used

Scheduling is updated every 1 msec (aka TTI)

Data rates correspond to:

LTE overhead as a rule of thumb is 25% of the total data rate

PRB Capacity = 12x7 = 84 symbols in 0.5 msec = (84/500) ∗106 sps

Spatial Diversity: robustness against channel transmission and diversity gain

“h” parameters reflect how signals are

RDL-6000 supports TM-2 and TM-3

eNB does the MCS selection

Payload goes through channel coding/rate-matching first

OFDM symbols are organized in time 0.5 msec slots (15360Ts)

FDD frame exists in DL and UL simultaneously

Ensures that DL and UL transmissions do not clash

Seven DL/UL config profiles (RDL-6000)