Mobile Terminated Roaming Retry for LTE CSFB

One of the many issues with LTE Circuit Switched Fall Back (CSFB) is what happens when the UE falls back on the target RAT (can be 3G or 2G, operator defined) and the LAC is not the same as the one the UE is registered on through the Combined Attach procedure in LTE. This typically occurs on the borders of Location Areas (LA) and Tracking Areas (TA) or when the target layer is 3G and the UE can only acquire 2G (e.g. indoors).

In these cases, a Mobile Originated CS call would experience a delay as the UE would first have to perform a LAU procedure on the target RAT followed by the subsequent call setup procedure.

A Mobile Terminated CS call on the other hand would fail as the call has already been routed to the "old" MSC (i.e. the one the UE registered on though the Combined Attach procedure) but the UE finds itself in the LAC of a different, "new", MSC.

To prevent this happening two 3GPP defined procedures can be re-used. The first one is called Mobile Terminated Roaming Retry (defined in rel.07) and the second one is called Mobile Terminated Roaming Forwarding (defined in rel.10). Both of these require an upgrade to the CN elements involved in the call setup procedure.

It is interesting to note, that both of these procedures were defined originally to handle the (rare) occasion of a UE being paged in one LA but at the same time moving through a LA border and thus performing a LAU procedure on a different MSC than the one being paged on.

For this post we will have a closer look at the Mobile Terminated Roaming Retry (MTRR) procedure.

The signalling flow is shown above (click to enlarge) and can be broken down into 4 distinct phases.

During phase 1, a MT call comes through the GMSC which initiates the MAP procedures to inform the MSC the UE is registered on (through the Combined Attach procedure). The MSC contacts the MME through the SGs interface which pages the UE. The paging action initiates the CSFB procedure and the UE is directed towards the target RAT.

Under normal circumstances the UE would fall back on the LA it registered on and would send a Paging Response. In this case however the UE falls back on a different LA and thus has to perform a LAU procedure. This is shown in phase 2, as is the subsequent procedure to transfer the UE subscription from the "old" MSC to the "new" one.

This is also where the call setup procedure would fail as the "old" MSC would not have the ability to inform the GSMC that the UE has changed MSCs.

With MTRR however the "old" MSC informs the GMSC through the Resume Call Handling procedure that the call setup procedure should be repeated by contacting the HLR once more. This is shown in phase 3 of the signalling flow.

Finally, phase 4 is a repeat of phase 1, but this time the GMSC contacts the correct "new" MSC and the call setup procedure is successful.

It is also important to note that during the LAU procedure in phase 2, the UE populated an IE indicating that a CS MT call was in progress. This ensures the new "MSC" keeps the signalling link towards the HLR for the subsequent signalling exchange in phase 4.

Obviously this whole procedure would also add a couple of seconds more on the overall call setup time, which due to the general CSFB procedure is already longer that a "native" CS call setup in 2G/3G.

In the next few posts I will look at the second option, MTRF, and also at a completely different approach that uses an inter working function between the MME and MSC in order to avoid any upgrades in the legacy CS network.

RRC state machine in Vodafone Greece

As I travel I find it interesting to look at how operators configure their networks. I travel to Greece quite often and have noticed that for quite some time now, Vodafone Greece do not use CELL_FACH or CELL/URA_PCH on their network.

This is illustrated in the log extract above. A PS Radio Bearer is established with no subsequent data transfer. After 20s of inactivity the RRC Connection is released and the UE returns to IDLE. So essentially the RRC state machine that Vodafone Greece use consists of two states only. CELL_DCH and IDLE. This is quite strange as there are a number of advantages in using CELL_FACH and CELL/URA_PCH. Obviously for small amounts of data (keep alive messages etc) CELL_FACH can be used without consuming dedicated resources. When there is no data transfer, CELL_PCH or URA_PCH can be used where no radio resources are consumed, the UE can go into DRX and at the same time allow for a fast transition (i.e. low latency) back to CELL_DCH if data transfer is required.

I find it hard to think of a reason why someone would configure their network this way, as it seems very signalling intensive and high latency. Unfortunately my test device did not support Fast Dormancy rel8 so I could not see how the RNC would react if the UE indicated it had no further data to transfer.

What is 3G?

Ok, so my posts are usually a bit more detailed than this, but I was looking at the Google Search stats for 2012 and it seems the question "What is 3G" was the 3rd most searched "What is..." type question (1st was love and 2nd was iCloud in case you are wondering). So here is my attempt to explain the mysterious 3G..

3G refers to the 3rd Generation mobile technology standard. But if we are talking about the 3rd Generation, what were the 1st and 2nd?

The 1st Generation was based on analogue technology (like your FM radio) and appeared around the 1980's in a few countries. The mobile phones were enormous, the batteries even bigger (sometimes external to the handset) and they were very expensive. I imagine very people reading this post ever used a 1st Generation analogue mobile phone. 1st Generation networks are a thing of the past now and none exist anymore (at least in the so called "developed" countries).

The 2nd Generation was based on digital technology (like your digital TV) and appeared around the beginning of the 1990's. The most popular 2G standard is called GSM (Groupe Speciale Mobile) and is still incredibly popular today. I imagine the vast majority of people reading this post have used and are still using GSM. 2G technology standards were initially developed to support voice calls. The transfer of data was a bit of an after thought and the GSM standard was further enhanced with GPRS (General Packet Radio Service) and then EDGE (Enhanced Data rates for GSM Evolution).

So now we come back to 3G. The 3rd Generation was also based on digital technology and appeared around the beginning of the 2000's. The most popular standard is called UMTS (Universal Mobile Telecommunications System) and it too has proven incredibly popular. The main benefit of UMTS over GSM is that is supports much higher data rates so the web browsing, downloading, tweeting etc happen much faster. The UMTS standard was further enhanced with HSDPA (High Speed Downlink Packet Access) and HSUPA (High Speed Uplink Packet Access) to further increase the data rates possible. Of course if all you are interested is making voice calls and sending some text messages, there is not much benefit in 3G as 2G will do that just fine.

So 1G has disappeared and we are left with 2G and 3G. Most phones today support both standards and most operators, support both networks. These can be thought of as layers, like the graphic above. A dual standard phone will have a preference to camp on the 3G layer (point 1 above). When the 3G layer is not available (typically 3G networks use higher frequencies and thus don't propagate as far) the mobile will transition to the 2G layer. This can happen both in idle and during a voice call or data session (point 2 above). Once 3G coverage improves the mobile will re-select back to the 3G layer.

As an end user you can tell which standard/layer you are using by looking at the icon next to the signal strength bars on your phone. Unfortunately the actual icon itself is not standardised so mobile phone manufacturers usually pick from a collection. The possibilities are:

For 2G it is typically "2G", or sometimes just "G" or sometimes "E" (for EDGE), or "O" if you are using an iPhone (Apple, go figure..)

For 3G it is typically "3G", or sometimes "H" (for HSDPA/HSUPA), or "3G+" (again for HSDPA/HSUPA), or even "H+" (for some further enhancements to HSDPA)

A bit confusing, but you get the idea.

We are now at a time where 4G networks have started appearing. These are based on a standard called LTE (Long Term Evolution) and support even higher data rates. This can be thought of as just another layer on the graphic above, and a 4G capable phone will have a preference to camp on the 4G layer and when that is not available on the 3G layer and when that is not available on the 2G layer.

That is my attempt at answering "What is 3G?". Hopefully it makes some sense!

LTE RF conditions classification

It is common sense that the performance of any wireless system has a direct relationship with the RF conditions at the time. To aid with performance analysis then, we typically define some ranges of RF measurements that correspond to some typical RF conditions one might find themselves in.

When it comes to LTE, I came across the above table that presents a good classification. The source of this table is a EUTRAN vendor and has been complied during the RF tuning process for a major US operator. Of course there are no rules as to how various RF conditions are classified, so different tables will exist but to a great extent you can expect them to align.

In this particular example, three measurement quantities are used. RSRP (Reference Signal Received Power), RSRQ (Reference Signal Received Quality) and SINR (Signal to Interference & Noise Ratio).

RSRP is a measure of signal strength. It is of most importance as it used by the UE for the cell selection and reselection process and is reported to the network to aid in the handover procedure. For those used to working in UMTS WCDMA it is equivalent to CPICH RSCP.

The 3GPP spec description is "The RSRP (Reference Signal Received Power) is determined for a considered cell as the linear average over the power contributions (Watts) of the resource elements that carry cell specific Reference Signals within the considered measurement frequency bandwidth."

In simple terms the Reference Signal (RS) is mapped to Resource Elements (RE). This mapping follows a specific pattern (see below). So at any point in time the UE will measure all the REs that carry the RS and average the measurements to obtain an RSRP reading.

RSRQ is a measure of signal quality. It is measured by the UE and reported back to the network to aid in the handover procedure. For those used to working in UMTS WCDMA is it equivalent to CPICH Ec/N0. Unlike UTMS WCDMA though it is not used for the process of cell selection and reselection (at least in the Rel08 version of the specs).

The 3GPP spec description is "RSRQ (Reference Signal Received Quality) is defined as the ratio: N×RSRP/(E -UTRA carrier RSSI) where N is the number of Resource Blocks of the E-UTRA carrier RSSI measurement bandwidth."

The new term that appears here is RSSI (Received Signal Strength Indicator). RSSI is effectively a measurement of all of the power contained in the applicable spectrum (1.4, 3, 5, 10, 15 or 20MHz). This could be signals, control channels, data channels, adjacent cell power, background noise, everything. As RSSI applies to the whole spectrum we need to multiple the RSRP measurement by N (the number of resource blocks) which effectively applies the RSRP measurement across the whole spectrum and allows us to compare the two.

Finally SINR is a measure of signal quality as well. Unlike RSRQ, it is not defined in the 3GPP specs but defined by the UE vendor. It is not reported to the network. SINR is used a lot by operators, and the LTE industry in general, as it better quantifies the relationship between RF conditions and throughput. UEs typically use SINR to calculate the CQI (Channel Quality Indicator) they report to the network.

The components of the SINR calculation can be defined as:

S: indicates the power of measured usable signals. Reference signals (RS) and physical downlink shared channels (PDSCHs) are mainly involved

I: indicates the power of measured signals or channel interference signals from other cells in the current system

N: indicates background noise, which is related to measurement bandwidths and receiver noise coefficients

So that is it! I have also included a real life measurement from a Sierra Wireless card that includes the above mentioned metrics so you can see what is the typical output from a UE. Using that and the table above you should be able to deduce the RF condition category it is in at the time of measurement.

Category 4 LTE UEs in the market

It is interesting to see that the first category 4 LTE UEs are appearing in the market. Up to now the vast majority (if not all) of LTE devices have been category 3. The device in question is Huawei's E3276 USB dongle. Category 4 LTE UEs can reach theoretical physical layer DL throughputs of up to 150Mbps. The uplink throughput stays the same at 50Mbps.

The E3276 is also LTE penta-band capable (LTE FDD 800/900/1800/2100/2600) which means that it will operate in pretty much every country that has launched LTE.

The complete 3GPP release 8 LTE UE category table can be seen below.

Moving to the next category, 5,  is not going to be that easy as it requires 4x4 MIMO in the DL. This will mean operators will need to deploy an additional 2 antennas on the base station and UE vendors will need to squeeze another 2 antennas in the device. Possible on a tablet but anything smaller is going to be a challenge. In case you are wondering the increase in the uplink performance of a category 5 device is due to the use of 64QAM as opposed to 16QAM.

Unhappy with 4G? Lock to 3G!

For years now buying a 3G handset and locking it to 2G has been quite popular. As reported here this was mainly done to get around poor battery life in 3G. Of course this would have an obvious impact on data performance as GPRS/EDGE networks struggle to deliver anything faster than a couple of hundered of kbps at best. From an operator (carrier for our US readers) point of view this was bad as it meant the legacy 2G network was still seeing quite a lot of traffic.

Considering the above it was interesting to see what the options are for 4G capable devices. A screenshot from the Network Mode menu of a Samsung SIII LTE is shown below.

As you can see gone is the option to lock to 2G and now the two options are either 2G/3G/4G (i.e. auto) or 3G only. I guess the option to disable 4G has to be there, from a battery life point of view, stability of early 4G networks and the problems with support for voice calls. But at least in my opinion the second choice should be 3G/2G as opposed to 3G only. I guess this will change depending on the device manufacturer so it will be interesting to see what others do.

Chance encounter with a femto cell

I was recently performing some drive tests in a busy city centre and came across a femto cell in closed access mode. It was a chance encounter and I was only alerted to its presence by the automated TEMS voice indicating a failed Location Update. The first thing to note as indicated by the map below, is that this location in theory should have perfect coverage. What this shows (perhaps of no surprise) is that even in city centres, coverage holes do exist and people are forced to install femto cells for in-house coverage.

The second thing to note is that this is probably the worst place to install a closed access femto cell. The road is a busy one and to make things even worse there is a bus stop just outside! The amount of failed location updates must be in the in the hundreds if not thousands per day as a continuous stream of cars, buses and pedestrians pass through. A true closed access femto cell nightmare. The signalling trace below, shows the procedures involved as the UE tries to camp on the femto cell and gets rejected (cause code 13).

The time elapsed from reselecting the femto cell, failing to perform a LAU, returning to the macro and performing a further LAU/RAU (not shown in the trace) was approx. 6 seconds. So quite a large "outage" from the customers point of view. From a femto point of view we can expect the LAU attempt to be handled locally (i.e by the femto itself). The subsequent LAU/RAU back on the macro however is handled normally and as such the load on the core network is measurable. So what can be done is cases like this? Femto cells can be installed anywhere so how can the operator protect themselves? A few things come to mind. First detecting the problem. This could be easily solved by looking at failed LAU attemtps counters from the femto (if the manufacturer has implemented them). For an even more obvious detection method an NMC alarm could be created for when the amount of failed LAUs exceed a particular threshold. Once the problem femto is detected its CPICH could be reduced so it is not over-propagating into the street.