4GEE bandwidth @ 10MHz

Back in October 2012 Everything Everywhere a.k.a. EE launched 4G LTE services in the UK. As EE is the merger of T-Mobile UK and Orange UK, it "re-farmed" part of the 1800MHz spectrum these two companies had and used that for it's 4G LTE network.

At the time I wondered how much spectrum they had managed to re-farm for launch and few days back I had some empirical confirmation of how much that is. The log extract below is taken from a WCDMA SIB19 message which is used by the UE for reselection purposes from 3G to 4G.

Part of the information broadcasted in SIB19 is the IE "measurementBandwidth". As LTE allows for flexible bandwidth allocation (1.4, 3, 5, 10, 15 & 20MHz), the UE has to be informed how much bandwidth is used in order to average the RSRP measurements as explained here.

Rather than specifying the bandwidth in MHz, 3GPP uses Resource Blocks (RB) instead. A RB is 180KHz wide, so 50 RBs give us 9MHz. Taking into account the guard bands on each side of the allocated bandwidth we get a total bandwidth of 10MHz.

This means that at least until EE manage to re-farm some additional spectrum they can only offer 50% of the potential maximum LTE throughput. The good thing about EE is that they have quite a lot of 1800MHz spectrum so I imagine they will continuously monitor their 2G traffic (the 1800MHz was originally awarded to T-Mobile and Orange for GSM services) and as soon as possible another 5MHz block can be re-farmed taking the allocated bandwidth to 15MHz and finally 20MHz. As all LTE devices have to support the maximum of 20MHz, this can happen transparently to the end user.

Looking at the additional information in the log extract, we can also see the exact frequency EE are using which is broadcasted as EARFCN 1617. This translates to a centre DL frequency of 1846.7MHz as shown below.

This in turn can be mapped on EEs 1800MHz spectrum holdings (source: OFCOM) as shown below in red.

Taking into account that EE currently use 10MHz for LTE we can also see what is the top theoretical speed their network could achieve. This is shown in the table below.

In the DL using 2x2 MIMO a maximum throughput of 73Mbps is possible. As 4x4 MIMO is not currently implemented by neither operators or UE manufacturers that column is a bit academical. In the UL a maximum throughput of 36Mbps is possible. As a rule of thumb we can say in the best "real life" situation about 2/3 of those speeds is achievable that would make it as DL approx. 50Mbps and UL approx. 24Mbps. Obviously as more users are added to the system the throughput will decrease accordingly.

The final point to note about the log extract is the priority assigned to the LTE layer. This is configured as 6. As the highest priority is 7, EE have left some room for configuring a higher priority layer. This could be a "small cell" layer or if they are feeling confident of obtaining some 800MHz in the upcoming auction they could use that as a "coverage" layer forcing UEs to camp there by assigning it priority 7 and use the current 1800MHz layer as a "capacity" layer.

Mobile Terminated Roaming Forwarding for LTE CSFB

As described in a previous post one of the issues with LTE CSFB is what happens when the UE falls back to the target RAT but the the LA is not same as the one the UE is registered in during the combined attach procedure. This typically occurs on the borders of Location Areas (LA) and Tracking Areas (TA) or when the target layer is 3G and the UE can only acquire 2G (e.g. indoors).

In order to avoid MT call setup failures, operators must implement either MTRR (Mobile Terminating Roaming Retry) described here or MTRF (Mobile Terminating Roaming Forwarding) which will be described in this post.

The signalling flow for MTRF is shown above (click to enlarge) and essentially consists of 3 phases.

Phase 1 and phase 2 are identical to the MTRR signalling flow, with the exception that the network elements involved must support MTRF and signal as such with the applicable IE (MTRF Supported) defined in the specs.

In phase 3 however rather than cancelling the call setup procedure and re-initiating it towards the "new" MSC like MTRR, with MTRF the old MSC is used as a relay and the call setup procedure continues with an additional PRN & IAM procedure. 

So essentially MTRF manages to cut down the signalling flow and the whole MT procedure completes in 3 phases as opposed to 4. This results in a reduced call setup delay and as such better customer experience.

In the final post on the subject I will describe the IWF solution which overcomes the problem of misaligned LA & TA (and a number of other issues) with the inclusion of an additional core network element. 

F-DPCH on a live network (finally)

F-DPCH (Fractional Dedicated Physical CHannel) was first defined in 3GPP rel6 and then further enhanced in rel7 to overcome some soft handover limitations. Once HSDPA is used for the transfer of user data and L3 signalling (RRC & NAS) it allows the multiplexing of up to 10 users on a single SF 256 code for the purposes of sending TPC (Transmit Power Control) commands in the downlink.

As shown in the table below, 3GPP define 10 slot formats which effectively move the position of the TPC bits in the slot.

The obvious benefit in using F-DPCH is the savings in OVSF codes in the DL. Even though the rel99 DPCH uses only a SF256, once the number of simultaneous users increases (it can easily reach 50-60 users in a busy cell) the impact is quite substantial as sixteen SF256 are equal to one SF16. So clearly 50-60 SF256 will block a large portion of SF16 codes that HSDPA requires. With F-DPCH we can multiplex 10 users on one SF256 thus the impact on the OVSF tree is greatly reduced. On top of this there are savings in DL power and DL noise reduction.

It has always struck me as quite strange then, that mobile operators did not embrace the usage of F-DPCH sooner. As I recently discovered though, things are starting to slowly change and F-DPCH is being used by some operators.

This particular one was Wind in Greece and specifically in the area of Athens that has been upgraded due to a swap (to Huawei).

As can been seen from the trace below the UE signals to the RNC its support for F-DPCH in the RRC Connection Request. This allows the RNC to configure SRB over HSPA and F-DPCH from the RRC Connection Setup message if the establishment cause is related to a PS session. In this particular network, this option was not used and the SRB was mapped to DCH channels initially.

The actual F-DPCH configuration is activated in the Radio Bearer Setup phase as shown below. At the same time the SRB is also mapped on HSPA channels as this is a pre-requisite for F-DPCH.

Looking at the IE present we can deduce which slot format is being used (0 in this case) and which OVSF code is being used (256,17 in this case).

Mobile Terminated Roaming Retry for LTE CSFB

One of the many issues with LTE Circuit Switched Fall Back (CSFB) is what happens when the UE falls back on the target RAT (can be 3G or 2G, operator defined) and the LAC is not the same as the one the UE is registered on through the Combined Attach procedure in LTE. This typically occurs on the borders of Location Areas (LA) and Tracking Areas (TA) or when the target layer is 3G and the UE can only acquire 2G (e.g. indoors).

In these cases, a Mobile Originated CS call would experience a delay as the UE would first have to perform a LAU procedure on the target RAT followed by the subsequent call setup procedure.

A Mobile Terminated CS call on the other hand would fail as the call has already been routed to the "old" MSC (i.e. the one the UE registered on though the Combined Attach procedure) but the UE finds itself in the LAC of a different, "new", MSC.

To prevent this happening two 3GPP defined procedures can be re-used. The first one is called Mobile Terminated Roaming Retry (defined in rel.07) and the second one is called Mobile Terminated Roaming Forwarding (defined in rel.10). Both of these require an upgrade to the CN elements involved in the call setup procedure.

It is interesting to note, that both of these procedures were defined originally to handle the (rare) occasion of a UE being paged in one LA but at the same time moving through a LA border and thus performing a LAU procedure on a different MSC than the one being paged on.

For this post we will have a closer look at the Mobile Terminated Roaming Retry (MTRR) procedure.

The signalling flow is shown above (click to enlarge) and can be broken down into 4 distinct phases.

During phase 1, a MT call comes through the GMSC which initiates the MAP procedures to inform the MSC the UE is registered on (through the Combined Attach procedure). The MSC contacts the MME through the SGs interface which pages the UE. The paging action initiates the CSFB procedure and the UE is directed towards the target RAT.

Under normal circumstances the UE would fall back on the LA it registered on and would send a Paging Response. In this case however the UE falls back on a different LA and thus has to perform a LAU procedure. This is shown in phase 2, as is the subsequent procedure to transfer the UE subscription from the "old" MSC to the "new" one.

This is also where the call setup procedure would fail as the "old" MSC would not have the ability to inform the GSMC that the UE has changed MSCs.

With MTRR however the "old" MSC informs the GMSC through the Resume Call Handling procedure that the call setup procedure should be repeated by contacting the HLR once more. This is shown in phase 3 of the signalling flow.

Finally, phase 4 is a repeat of phase 1, but this time the GMSC contacts the correct "new" MSC and the call setup procedure is successful.

It is also important to note that during the LAU procedure in phase 2, the UE populated an IE indicating that a CS MT call was in progress. This ensures the new "MSC" keeps the signalling link towards the HLR for the subsequent signalling exchange in phase 4.

Obviously this whole procedure would also add a couple of seconds more on the overall call setup time, which due to the general CSFB procedure is already longer that a "native" CS call setup in 2G/3G.

In the next few posts I will look at the second option, MTRF, and also at a completely different approach that uses an inter working function between the MME and MSC in order to avoid any upgrades in the legacy CS network.

RRC state machine in Vodafone Greece

As I travel I find it interesting to look at how operators configure their networks. I travel to Greece quite often and have noticed that for quite some time now, Vodafone Greece do not use CELL_FACH or CELL/URA_PCH on their network.

This is illustrated in the log extract above. A PS Radio Bearer is established with no subsequent data transfer. After 20s of inactivity the RRC Connection is released and the UE returns to IDLE. So essentially the RRC state machine that Vodafone Greece use consists of two states only. CELL_DCH and IDLE. This is quite strange as there are a number of advantages in using CELL_FACH and CELL/URA_PCH. Obviously for small amounts of data (keep alive messages etc) CELL_FACH can be used without consuming dedicated resources. When there is no data transfer, CELL_PCH or URA_PCH can be used where no radio resources are consumed, the UE can go into DRX and at the same time allow for a fast transition (i.e. low latency) back to CELL_DCH if data transfer is required.

I find it hard to think of a reason why someone would configure their network this way, as it seems very signalling intensive and high latency. Unfortunately my test device did not support Fast Dormancy rel8 so I could not see how the RNC would react if the UE indicated it had no further data to transfer.

What is 3G?

Ok, so my posts are usually a bit more detailed than this, but I was looking at the Google Search stats for 2012 and it seems the question "What is 3G" was the 3rd most searched "What is..." type question (1st was love and 2nd was iCloud in case you are wondering). So here is my attempt to explain the mysterious 3G..

3G refers to the 3rd Generation mobile technology standard. But if we are talking about the 3rd Generation, what were the 1st and 2nd?

The 1st Generation was based on analogue technology (like your FM radio) and appeared around the 1980's in a few countries. The mobile phones were enormous, the batteries even bigger (sometimes external to the handset) and they were very expensive. I imagine very people reading this post ever used a 1st Generation analogue mobile phone. 1st Generation networks are a thing of the past now and none exist anymore (at least in the so called "developed" countries).

The 2nd Generation was based on digital technology (like your digital TV) and appeared around the beginning of the 1990's. The most popular 2G standard is called GSM (Groupe Speciale Mobile) and is still incredibly popular today. I imagine the vast majority of people reading this post have used and are still using GSM. 2G technology standards were initially developed to support voice calls. The transfer of data was a bit of an after thought and the GSM standard was further enhanced with GPRS (General Packet Radio Service) and then EDGE (Enhanced Data rates for GSM Evolution).

So now we come back to 3G. The 3rd Generation was also based on digital technology and appeared around the beginning of the 2000's. The most popular standard is called UMTS (Universal Mobile Telecommunications System) and it too has proven incredibly popular. The main benefit of UMTS over GSM is that is supports much higher data rates so the web browsing, downloading, tweeting etc happen much faster. The UMTS standard was further enhanced with HSDPA (High Speed Downlink Packet Access) and HSUPA (High Speed Uplink Packet Access) to further increase the data rates possible. Of course if all you are interested is making voice calls and sending some text messages, there is not much benefit in 3G as 2G will do that just fine.

So 1G has disappeared and we are left with 2G and 3G. Most phones today support both standards and most operators, support both networks. These can be thought of as layers, like the graphic above. A dual standard phone will have a preference to camp on the 3G layer (point 1 above). When the 3G layer is not available (typically 3G networks use higher frequencies and thus don't propagate as far) the mobile will transition to the 2G layer. This can happen both in idle and during a voice call or data session (point 2 above). Once 3G coverage improves the mobile will re-select back to the 3G layer.

As an end user you can tell which standard/layer you are using by looking at the icon next to the signal strength bars on your phone. Unfortunately the actual icon itself is not standardised so mobile phone manufacturers usually pick from a collection. The possibilities are:

For 2G it is typically "2G", or sometimes just "G" or sometimes "E" (for EDGE), or "O" if you are using an iPhone (Apple, go figure..)

For 3G it is typically "3G", or sometimes "H" (for HSDPA/HSUPA), or "3G+" (again for HSDPA/HSUPA), or even "H+" (for some further enhancements to HSDPA)

A bit confusing, but you get the idea.

We are now at a time where 4G networks have started appearing. These are based on a standard called LTE (Long Term Evolution) and support even higher data rates. This can be thought of as just another layer on the graphic above, and a 4G capable phone will have a preference to camp on the 4G layer and when that is not available on the 3G layer and when that is not available on the 2G layer.

That is my attempt at answering "What is 3G?". Hopefully it makes some sense!

LTE RF conditions classification

It is common sense that the performance of any wireless system has a direct relationship with the RF conditions at the time. To aid with performance analysis then, we typically define some ranges of RF measurements that correspond to some typical RF conditions one might find themselves in.

When it comes to LTE, I came across the above table that presents a good classification. The source of this table is a EUTRAN vendor and has been complied during the RF tuning process for a major US operator. Of course there are no rules as to how various RF conditions are classified, so different tables will exist but to a great extent you can expect them to align.

In this particular example, three measurement quantities are used. RSRP (Reference Signal Received Power), RSRQ (Reference Signal Received Quality) and SINR (Signal to Interference & Noise Ratio).

RSRP is a measure of signal strength. It is of most importance as it used by the UE for the cell selection and reselection process and is reported to the network to aid in the handover procedure. For those used to working in UMTS WCDMA it is equivalent to CPICH RSCP.

The 3GPP spec description is "The RSRP (Reference Signal Received Power) is determined for a considered cell as the linear average over the power contributions (Watts) of the resource elements that carry cell specific Reference Signals within the considered measurement frequency bandwidth."

In simple terms the Reference Signal (RS) is mapped to Resource Elements (RE). This mapping follows a specific pattern (see below). So at any point in time the UE will measure all the REs that carry the RS and average the measurements to obtain an RSRP reading.

RSRQ is a measure of signal quality. It is measured by the UE and reported back to the network to aid in the handover procedure. For those used to working in UMTS WCDMA is it equivalent to CPICH Ec/N0. Unlike UTMS WCDMA though it is not used for the process of cell selection and reselection (at least in the Rel08 version of the specs).

The 3GPP spec description is "RSRQ (Reference Signal Received Quality) is defined as the ratio: N×RSRP/(E -UTRA carrier RSSI) where N is the number of Resource Blocks of the E-UTRA carrier RSSI measurement bandwidth."

The new term that appears here is RSSI (Received Signal Strength Indicator). RSSI is effectively a measurement of all of the power contained in the applicable spectrum (1.4, 3, 5, 10, 15 or 20MHz). This could be signals, control channels, data channels, adjacent cell power, background noise, everything. As RSSI applies to the whole spectrum we need to multiple the RSRP measurement by N (the number of resource blocks) which effectively applies the RSRP measurement across the whole spectrum and allows us to compare the two.

Finally SINR is a measure of signal quality as well. Unlike RSRQ, it is not defined in the 3GPP specs but defined by the UE vendor. It is not reported to the network. SINR is used a lot by operators, and the LTE industry in general, as it better quantifies the relationship between RF conditions and throughput. UEs typically use SINR to calculate the CQI (Channel Quality Indicator) they report to the network.

The components of the SINR calculation can be defined as:

S: indicates the power of measured usable signals. Reference signals (RS) and physical downlink shared channels (PDSCHs) are mainly involved

I: indicates the power of measured signals or channel interference signals from other cells in the current system

N: indicates background noise, which is related to measurement bandwidths and receiver noise coefficients

So that is it! I have also included a real life measurement from a Sierra Wireless card that includes the above mentioned metrics so you can see what is the typical output from a UE. Using that and the table above you should be able to deduce the RF condition category it is in at the time of measurement.