RCSP-RDL-6000-Mod-1 - LTE System-Tech-Overview-R1.3.2-V1.3a

RCSP-RDL-6000
Module-1: LTE System and Technology Overview
© Redline Communications Inc. 2021 All rights reserved.

RCSP-RDL-6000: Module-1 Contents*
Module-1.1: LTE Overview, Building Blocks and Operation

Module-1.1.1: LTE Network-Basic Definitions
Module-1.1.2: LTE Core: Evolved Packet Core (EPC)
Module-1.1.3: E-UTRAN Operation and Parameters
Module-1.1.4: LTE UEs and their Capabilities
Module-1.2: LTE QoS and Data Bearers
Module-1.3: E-UTRAN Protocol Stack Overview
Module-1.4: LTE PHY Overview and Basic Parameters
Module-1.4.1: DL/UL Transmission Schemes
Module-1.4.2: Multi-antenna Systems and Transmission Modes
Module-1.4.3: Wireless Frame Structures and Signalling-FDD/TDD
Module-1.5: LTE SON Overview
Module-1.6: LTE Security Framework
Module-1.7: CBRS Overview and Building Blocks
• System features and capabilities referenced in this module are based

on RDL-6000-R1.3. update 2+ and FlexCore version 13.3.0-2
RCSP Certification Programs RCSP-RDL-6000 Module-1: LTE System and Technology Overview R1.3.2-V1.3a Slide-2
Module-1.1: LTE Overview and Building Blocks Operation
Module-1.1.1: LTE Network-Basic Definitions

LTE: QoE Through Enhancing Capacity and QoS Policy Mgmt
Capacity constraint between

MS’ and external networks
(PDNs) is bottleneck
Using more spectrum and
improving spectral efficiency
helps a bit only
QoS and policy mgmt
techniques can streamline
resources usage
To ensure App quality,
allow differentiated
services, manage network
congestion, and monetize
resources usage
LTE Network: Flat Layer-3 and PS Only Network
E-UTRAN
eNB
Users
UE PDN
IMS
Packet processing
Signalling, Database
eNB
IP addressing…
Users
UE Evolved Packet Core (EPC)

eNB
Core Network (CN)
Access Network
EPC: Routing/computing brain of the LTE network - flat IP Platform
Provides IP connectivity between the UE and PDN/IMS networks
E-UTRAN: an interconnected network of eNBs (LTE base station)
E-UTRAN: Evolved Universal Terrestrial Radio Access Network
Functionally, eNB acts as a layer-2 bridge between the UE and EPC
UEs: User Equipment connects to PDN/IMS through EPS with QoS
LTE Releases: Specifying Features and Capabilities
LTE-Advanced
Rel-8: LTE Rel-9: LTE Rel-10 Rel-11 Rel-12
▪ Introduced LTE ▪ SON ▪ Carrier aggregation (CA) ▪ CA enhancements ▪ MTC ecosystem

▪ 1Gbps DL, 500 Mbps ▪ FDD/TDD
▪ All IP core (EPC) ▪ MIMO Beamforming ▪ LTE unlicensed study
in UL with 5 CCs
▪ MIMO/FDD/TDD ▪ eMBMS ▪ CoMP ▪ D2D
▪ Worldwide roaming
▪ New frequency bands ▪ 8x8 MIMO
LTE-Pro
Rel-13 (more Rel-14 (start of 5G) Rel-15 Rel-16 (5G phase -2)
Throughput)
▪ LAA ▪ NB IoT
▪ Up to 32 CC in CA ▪ V2V Redline’s 5G focus
▪ D2D ▪ V2X (voice to
▪ NB IoT everything)
3GPP has a defined set of releases for the new versions of
▪ 64 antenna MIMO its specifications, each introducing new functionalities
▪ eMTC
Rel-8/9 defines the LTE systems (EPS)

Subsequent releases add features, functionalities and enhancements
Rel-15 starts 5G specifications
LTE Rel # vs. Data Rates: Ideal Channel Conditions
Data Flow LTE LTE-A 5G NR

DL data rates assume Rel 8-9 Rel 10-14 Rel 15-16
spatial multiplexing DL 300 Mbps 1 Gbps 20 Gbps
2/4/8 layers MIMO
UL 75 Mbps 500 Mbps 1 Gbps
UL data rates are based
on a single Tx chain Latency (u-plane) 50ms 10ms 1ms
Some UE categories C-plane latency 100 msec
support MIMO for
higher data rates 3G has a peak data rate of 384 kbps
Graceful performance
degradation as UE moves away
from cell center
Techniques for cell edge
performance enhancing
4G Performance Targets Are
Defined By IMT-Advanced
LTE: Aiming for Shannon Limit – Spectral Efficiency Pursuit
Shannon Limit
data rate
The fundamental channel capacity metric is the max

rate for which arbitrarily small Pe can be achieved
Depends channel BW and SNR (noise and interference in the environment)
SNR degrades as BW increase because S is spread over larger BW!
Reliable communication: Pre-Shannon used repetition coding
Shannon introduced “intelligent coding of information” – 1948 paper
What more can be done to increase data rate cost effectively?
Capacity increase by increasing S is not a viable option – multiple constraints
Spatial Multiplexing (2/4/8 layers) – multiple antenna systems
Reduction of latency: 50-100 msec for C-plane (to establish U-plane)
Module-1.1: LTE Overview, Building Blocks Operation
Module-1.1.2: LTE Core: Evolved Packet Core (EPC)

LTE Architecture: Building Blocks
Mobility Management Entity
• Main signaling and control Node
• UE authentication Home Subscriber Server:
UICC: a smart card • Handovers UE security info database
storing personal data, • Session Mgmt and authentication server
security keys and apps • Selecting Other EPC nodes
IMEI- h/w ID Stores UE
IMSI: identifies a
subscription
subscriber globally
profile data
MME HSS SPR
P-GW PDN
UE S-GW
eNB
PCRF
EPC
Packet Data Network Gateway
LTE Base Station Serving Gateway: Policy and Charging • Connects LTE to PDNs
• providing L2 • Main data plane Rules Function • Allocates IP addressing/release
Bridging between element/router • Rules and policies • Enforces OP policies
UE and EPC • Data paths between related to QoS • Filter DL packets
• all wireless/radio eNB and PGW • Charging, and • Interconnects with non-3GPP
related functions • Local mobility anchor access to network Networks
for UEs • IP anchor for bearers
EPC nodes can be co-located/distributed, each has specific tasks

Nodes communicate via 3GPP interfaces
User-plane (U-plane) and control-plane (C-plane)
LTE Network Interfaces: Non-roaming
Gx
PCEF
Interface: conceptual IP-based link connecting functions in different nodes

Each interface is associated with a protocol stack
GPRS Tunneling Protocol (GTP) is the main communications protocol in LTE
General Packet Radio Service
PMIP mobility protocol is also supported as an option
Multi-PDN Connectivity: Non-Roaming
MME SGi
P-GW1 APN1 PDN1
Default bearer for PDN1 S11

SGi
S5
UE eNB S-GW P-GW2 APN2 PDN2
Default bearer for PDN2
S5 to connect S-GW to (non-collocated) P-GW of same operator

A UE can connect with multiple PDNs concurrently-music/web/FTP
USIM must be provisioned for multi-PDN connectivity
UE IP address changes when UE moves from one PGW to another
Concurrent PDN connectivity: one 3GPP access and one non-3GPP access
Traffic streams for a UE from all PDNs go through the same S-GW
A UE can be served only by one SGW at a given time
LTE Roaming Network Architecture: Intra-LTE View
S6a
MME HSS SPR
S9
H-PCRF
S11
Rx
Gx
S8 PDN
SGW PGW
S1-U SGi
S5 V-PCRF HPLMN
Gx Rx
Home Routed Roaming
PGW PDN
SGi PGW is in HPLMN
VPLMN
Local Breakout : PGW is in VPLMN
S8 connects the SGW in the VPLMN to the HPLMN PGW

HSS is always in the HPLMN PMLN: Public Land Mobile Network
VPLMN: Visited PLMN
eNB, MME and S-GW are in the VPLMN HPLMN: Home PLMN
PGW can be HPLMN (home routed) or VPLMN (local breakout)
UE can obtain an IP address from HPLMN or VPLMN based roaming profile
Roaming-out and Roaming-in must be configured in EPC
LTE Network Areas: Signaling Congestion Mitigation
LTE network is divided

into 3 different types
of geographical areas
MME pool area: UE can move around without changing serving MME
A pool area is controlled by one or more MMEs – a UE is associated with one
Each MME is identified by an MME Code within a pool
Reminder: UE are always
SGW service area: area served by one or more SGWs served by one SGW at a time.
UE can move through this area without a change of serving S-GW
An eNB must set up S1 with all MMEs and SGWs in the respective pools
Up to 16 S1 connections (3GPP S1-flex)
The eNB selects the MME to service the UE – 3GPP specifications
Module-1.1.3: E-UTRAN Operation and Parameters

E-UTRAN Architecture: Interconnected Network of eNBs
eNB is the LTE base station

Provides bridging between UE and EPC
Access stratum (AS) functions
RRM (Radio Resource Management)
RoHC/ciphering/scheduling
Mobility control
Paging from MME to UE…..
(paging = waking up idle UE or requesting status)
eNB controls all its cell (manages all functions within a cell)
Neighbor NBs communicate on 3GPP X2 logical interface Multi-cell eNB
X2 is not bandwidth demanding but requires very small latency
E-UTRAN: an interconnected network of eNBs through the X2 Interface
eNB as a critical U-plane element acts like an IP router and switch
eNB C-plane function is to select the MME and route NAS |
signaling to it
Non-Access Stratum
eNB Classification (TS36.141): Determined by eNB Range and Capacity
Min eNB to UE # of Cells

eNB Class Cell Type Max Tx power Cell Radius Antenna type
coupling los (common)
Wide Area Macro FCC/ETSI 70 dB 3-6 > 1 km 1200 Sector

(Operators)
Medium Area Micro ≤38 dBm 53 dB one 250 m ~ 1km Sector/Omni

(dense urban areas)
Local Area Pico ≤24 dBm 45 dB one 100 ~ 300 m Omni

(large indoor areas)
Home eNB
Femto ≤ 20 dBm (low) 45 dB one 10 ~ 50 m Omni
(HeNB)
Based on cell radius and Tx power (single antenna in eNB)

TS36.104 categorizes LTE BS’ using min coupling loss between eNB and UE
Ellipse 4G HP: 39 dBm per RF port in B14 FCC and 39 km
Cells often overlapping- intra/inter-frequency neighbors
An overloaded macro cell can offload to an overlapping micro/pico cell
HetNet: a network of low-power eNBs (small or pico cells) deployed
within the coverage area of high-power (macro) eNBs
E-UTRAN Deployment Architecture: Cells Within eNB
eNB can have 1-256 radio cards (cell)

Lights a sector (1200 typically)
Identified by cell ID (0-255) in the eNB
PCI (physical cell Identity)
Distinguishes a cell from its neighbors on
UE - separating transmitters
Serves as a resource allocator parameter
for DL and UL pilots (Reference Signals)
LTE defines only 504 PCIs (0-503)

PCI reuse is inevitable – proper planning is required
PCI is used to seed many E-UTRAN algorithms
UE must obtain PCI first, so it read other cell parameters
Ellipse-4G eNB has only one cell - supports up to 128 UEs
PCI Planning: Avoiding PCI Collision and Confusion
PCI Collision T-eNB

S-eNB
PCI collision: UE detects two
eNBs having the same PCI
N-eNBs at the same frequency
must not have the same PCI PCI = X PCI = X
No unambiguous way to notify the UE which eNB it must HO to

UE may stay with its S-eNB and eventually lose service
PCI confusion: no eNB has PCI Confusion

two N-eNBs at the same
frequency using the same PCI ??
S-eNB cannot notify UE to
PCI = X PCI = X
N-eNB: Neighbouring eNB which N-eNB it must HO
UE may Ho to wrong eNB
) PCI allocation must pass mod3,

mod6(SISO) and mod30 tests
PCI = Y
(PCI confused eNB)
Grouping eNBs: Tracking Idle-state UE Location
Tracking Area
|
TA is a logical grouping of cells
Managed by MME, TAs can overlap
Typically 100s of eNBs in OP networks
UE moves freely in a TA or a list of TAs
Tracking Areas (TA)
TA List => (TAL) without having to send a TA
update (TAU) to its serving MME

TAL1 = {TA1,TA3} and TAL2 = {TA2,TA3}
UE-A sends TAU on moving to TA2
UE-B must send a TAU at each cell
MME sends to UE TAL and TAU timer (T3412)
eNB broadcasts a TA code (TAC) in SIB1
PLMN + TAC = TA Identity (TAI)
UE is registered at the TAL level not TAC
Idle UE is known to MME at the TA granularity => The MME knows in which TA each UE is located,
even when they are idle.
RRC-connected UL location (cell it is registered with) is known to MME
RRC-Connected (Radio Resource Control Connected): status of a (non-idle) radio fully connected to the LTE system.
Closed Subscriber Group (CSG) and Cell Access Modes
Closed Access
CSG is a set of UEs allowed
to access a CSG cell
CSG Cell allows access only
to CSG UEs
SIM must have the CSG info
SIB1 tells a UE whether cell
is CSG or not
SIB1: System Information Block type 1
SIB1 with the CSG information is broadcast by
Hybrid Access
the eNB; the UE checks the SIM to see if that
CSG is known or not.
Open Access Mode: any UE’s meeting cell selection criteria
All cells are in this mode by default
Closed Access Mode: cell allows only CSG UEs
Hybrid: CSG and non-CSG UE’s are allowed access to the cell
Ellipse-4G controls number of each UE type-16/32/64/128
Active Network Sharing: RAN and Spectrum (TS 22&23.251)
OP-A EPC OP-A EPC

OP-B EPC OP-A EPC
S1-Flex MME (Pool)

S1-Flex
Shared RAN
MOCN (multi-operator CN): each Shared RAN

operator has a dedicated core (EPC) GWCN (Gateway CN): operators
also share the MME node
eNB broadcasts up to 6 PLMN IDs in SIB1
CN: Core Network
eNB selects MME based on PLMN ID from UE RAN: Radio Access Network
PLMN: Public Land Mobile Network
eNBs exchange PLMN info on X2 for HO
Ellipse-4G supports 3GPP RAN sharing
Module-1.1.4: LTE UEs and their Capabilities

UE Categories: UE Radio Access Capabilities (TS36.306 table 4.1-1)
CAT-M NB-IoT
UE Category Cat 1 Cat 2 Cat 3 Cat 4 Cat 5 6 7 8
Cat 0 (CAT-M1) (CAT-M2/NB/NB1)
LTE Release 8-9 10 12 13 13
MIMO DL 1x2 2x2 4x4 2x2 (CA) or 4x4 8x8 1x1
1x1 HD
1x2 FD/HD-FDD
MIMO UL No No 2x2 4x4 (single layer)
TDD
# of CCs (BW) 20 MHz 40 MHz (2 CCs) 100 (5 CCs) 20 MHz 1.4 MHz 200 KHz
••• 800 Kbps
Peak Data DL 10 50 100 150 300 300 300 1200 1 ≈ 200 Kbps
(FD-FDD)
Rate (Mbps)
UL 5 25 50 50 75 50 150 600 1 1 (FD-FDD) ≈ 200 Kbps
Rx Diversity Yes Yes No (1 Rx antenna)
DL Modulation QPSK, 16QAM, 64QAM ( 256QAM in CAT 11 onwards)

16QAM max
64QAM in UL No Yes No No Yes No
UE complexity Example: CAT 4=100 % (complexity increases with UE category, MIMO…) 40% 30% < 15%
Support for 256QAM in UL comes in CAT-16 (Rel 14 specs)+
Category specifies a UE’s DL/UL radio access capabilities- declares it to eNB

Enabling eNB to communicate effectively with its connected UEs
CAT-6 will save half the time compared to CAT-4 for same file size
CAT-M (LTE-MTC, LTE-M) has one oscillator for DL/UL frequency –Half-Duplex Type B
22 different UE categories in Rel-13 with focus on IoT devices
Battery life, low cost, coverage, range and massive device connectivity
LTE-M and NB-IoT are also referred to as Mobile IoT
LTE UE Power Class: LTE Band Specific
Power
Max Output Tolerance
PC2 Class
Power (dBm) (dB)
(PC)
1 31 +1/-3
2 26 ±2
3 23 ±2
4 21 +/-2
5 20 +/-2
6 14 +/-2
Four Power class specifies the max Tx power of a UE in UL

Broadband power (for all RBs)
Max Power Reduction (MPR) defined for each power class and modulation
Min UE power is set to -40 dBm
PC-3 is the main UE power class – single Tx chain and used universally
Backward compatibility with UMTS/GSM systems
PC-1: B14 (public safety with additional requirements)
PC-2: B41(to compensate for higher frequency propagation losses)
Max UE power is modified for MIMO, CA….
LTE Identifiers: Network and eNB (3GPP TS 23.003 )
An LTE entity is assigned one

or more IDs to identify it
locally or globally MCC: Mobile Country Code
MNC: Mobile Network Code
eNB ID: uniquely identifies eNB in a PLMN (20 or 28 bits)

LTE cell IDs
Cell ID: (0-255) uniquely identifies a cell within an eNB
ECI (E-UTRAN Cell ID): identifies a cell within a PLMN
Short eNB: 20 bits allowing 256 cell per eNB – macro/micro base stations
Long eNB: 28 bit, only 1 cell per eNB – pico/nano/femto cells
ECGI (E-UTRAN Cell Global ID): identifies a cell globally = PLMN+ECI
PCI: a number from 0 to 503 identifying a cell at the air interface
Network planning is based on PCI not ECGI (complex detection process)
Radio Network Temporary Identifiers (RNTIs) assigned by eNB
UE specific - used to scramble messages of a channel type (data/control)
LTE Identifiers*: UE and LTE Core
UE Mobile Equipment (ME) UICC (universal integrated circuit card) – h/w token
(hosts the mobile OS (runs Java APP or USIM and contains security
and LTE radio system) Keys. USIM interfaces with eNB and EPC)
IMEI (Int’l ME ID) identifies device to the

LTE network, 8 digits assigned by the IMSI (int’l mobile subscriber (MS) ID)
Manufacturer, stored in operator database Globally and uniquely identifies a user
MSISDN: MS integrated Service Digital
Network number
PLMN ID (6 digits max) MSIN (MS Identity number) 9-10 digits
operator global ID operator assigned, uniquely identifies
an MS in the PLMN
GUTI (temp UE ID by MME – 80 bits): Identifies

HSS ID Subscriber ID
UE to MME and the MME that the UE is parking on
GUMMEI 48 bits or less M-TMSI (32 bits): identifies MS

(Globally Unique MME ID) within its serving MME S-TMSI (SAE -TMSI): 40 bits identifying MS within
an MME group/pool, used for paging
PLMN ID MMEI (MME ID) 24 bits MMEC (MME code) 8 bits M-TMSI (mobile TMSI)
identifying MME within PLMN identifying MME in a group unique within an MME
S-TMSI is the shortened form of the GUTI to enable more efficient

MMEGI (MME group ID-16 bits) MMEC (MME Code): 8 bits radio signalling procedures (paging and Service Request)
16 bits unique MME ID Identifying MME in a pool
in a group TMSI: Temporary Mobile Subscriber Identity
*ITU-T Recommendation E.213
UE IDs: The Big 5
IMSI: permanent, globally unique OP assigned

Stored in UICC and HSS
Valid when UE service is active
M-TMSI: MME assigned to void sending IMSI OTA after first transaction
Local significance only (identifies UE within MME)
(sim)
IMEI: permanent, manufacturer assigned-stored in UICC and HSS
C-RNTI: serving eNB assigns it to a UE-stored in UE and eNB
CRNTI: Cell Radio Network Temporary Identifier
Valid until UE disconnects from the serving eNB
GUTI: dynamically assigned by the MME-stored in UE and MME
One part identifies MME and the other the UE GUTI: Globally Unique Temporary Identity
IP Address: dynamic and assigned by the PGW

Stored in UE and PGW and any other node "north" of the PGW
Valid as long as the UE is Registered with the EPC
UE also gets IDs from S1 (S1AP ID) and X2AP (X2AP ID)
Module-1.2: LTE QoS and Data Bearers
QoS Class Identifier
|
LTE QCI Characteristics
QCI Attributes (QoS Metric)
QCI Resource Type PELR Typical Application (intent)
Priority PDB (msec)
(PER loss rate)
1 2 100 1.00E-02 Conversation voice (such as ViLTE voice and VoLTE)
2 4 150 1.00E-03 Conversational video
3 3 50 1.00E-03 Real-time gaming
4 GBR 5 300 1.00E-06 Non-conversational video (ViLTE video)
65 0.7 75 1.00E-02 MCPTT (user plane voice)
66 2 100 1.00E-02 Non-MC user plane Push To Talk voice
75 2.5 50 1.00E-02 V2X messages
5 1 100 1.00E-06 IMS signalling
6 6 300 1.00E-06 buffered Video, www, email, ftp
NON-GBR
7 7 100 1.00E-03 Voice, live streaming video, Interactive gaming

8 8 300 1.00E-06
Video, www, email, ftp (TCP based traffic) etc.
9 9 300 1.00E-06
69 0.5 200 1.00E-06 MC sensitive signalling ( MCPTT signalling)
70 5.5 60 1.00E-06 MC Data (same as QCI 6/8/9)
79 6.5 50 1.00E-02 V2X messages
QCI identifies resource type, PELR, PDB and packet handling priority
U-plane treatment for IP packets transported on a bearer
QCI priority, PELR and delay (20 msec between PCEF and eNB is assumed)
PELR: % of higher layer packets lost during non-congestion periods
PELR: Packet Error Loss Rate
GBR: resources reservation in every EPS node dealing with GBR packets
GBR: Guaranteed Bit Rate
EPS Bearer: User Traffic Transport PCEF UE
E-UTRAN EPC PDN
UE eNB SGW PGW PS

Network
Data Radio Bearer (DRB) S1 Bearer S5/S8 Bearer External Bearer
E-RAB
EPS Bearer (realizes negotiated Service QoS)
End to End Service
UE S1 S5/S8 SGi
Bearer: Packet flow that receives a common QoS treatment.
Uniquely identifies data flows requiring same QoS on PGWÅÆUE path
Service QoS is attached to a bearer–U-plane path or connection
The “DRB-S1 bearer-S5 bearer” together make the LTE U-plane
UE gets one default bearer from each specified PDN-tied to UE IP
One or multiple dedicated bearers - can be released when not needed
Eleven bearers per UE: 3 SRB and 8 data
SRBs are used to carry RRC and NAS signalling on Uu (SRB0/1/2)
Dedicated Bearers: Providing Service-specific QoS
E-UTRAN EPC PDN
UE eNB SGW PGW

Data Radio Bearer (DRB) S1 Bearer S5/S8 Bearer External Bearer
E-RAB PS
Network
EPS Bearer (realizes negotiated Service QoS)
End to End Service

S1 S5/S8 SGi
Uu
Each dedicated bearer has an associated TFT - tied to UE’s IP add

EPS bearer spans S5/S1/Uu interfaces-cannot be implemented directly
One-to-one mapping between DRB, S1 and S5/S8 bearers EPS bearers are the main data
bearers.
S1 and S5/S8 bearers are implemented using GTP-U tunnels
E-RAB is deactivated when UE has no context in eNB –UE enters Idle mode
E-RAB: E-UTRAN Radio Access Bearer
S5 bearer is always enabled – to maintain UE IP address
Bearer establishment Order: S5ÆDRBÆS1
Bearer Types” GBR and Non-GBR
EPS Bearers
GBR bearers are used for real
time services
Reserve a min amount of BW Dedicated Default
on per bearer basis with an Bearer Bearer
MBR limit (Maximum Bit Rate limit)
Non-GBR
Do not release at any time GBR Non-GBR (best effort)
(even if there is no traffic on the GBR bearers, the
bandwidth is never made available for non-GBR
bearers)
BE: Best Effort
Non-GBR bearers are BE and have no per bearer reserved bit rate
An AMBR is defined per a group of non-GBR bearers of a single user
AMBR: Aggregated Maximum Bit Rate
APN-AMBR - per APN limit-DL/UL – saved in HSS
APN: Access Point Name (identifies the PDN, and can also identify the type of service)
UE-AMBR – for all PDNs UE may connect to – saved in HSS
Each Non-GBR bearer can utilize the entire UE-AMBR when other bearers silent
ARP policy rules applies on per bearer basis
SDF Filters/Templates
IP flows are the network traffic

for a UE
Packets with same IP header
SDF (service data flow): IP
flows to a UE and having the
same QoS attributes
SDF mapping to EPS bearers
uses operator defined filters
called TFTs (Traffic Flow Template)
5-tuple IP header
PGW processes QoS at SDF
level first and then at EPS
bearer level
SDF to Bearer Mapping: DL Example
UE eNB SGW PGW PDN

IP APN IP
Traffic Flow Templates (TFT)

IP flow 1
Dedicated EPS Bearer SDF1 QoS Policy

IP flow 2
E-RAB IP flow 3
IP flow 4
Default EPS Bearer SDF2 QoS Policy
IP flow 5
Dedicated EPS Bearer SDF3 QoS Policy IP flow 6
Data RAB S1 Bearer S5 Bearer SDF
IP flows are classified to SDFs based on applicable TFT

SDF: a group of IP flows associated with a Service that the UE is using
SDFs matching a TFT are mapped to an EPS bearer
Initial bearer-level QoS of the default bearer is assigned by MME
Based on subscription data from HSS PCRF: Policy and Charging Rules Function (one of the EPC blocks)
PCEF: Policy Control Enforcement Function (part of PCRF)
PCEF may change it in interaction with PCRF or based on local configuration
QoS and Policy Mgmt: Per EPS Node View
PCRF: Policy and Charging Rules Function (one of the
EPC blocks) Uses dynamic info and OP-configured
PCEF: Policy Control Enforcement Function (part of PCRF) policies to define PCC rules 1 PCRF 2
PCEF
5 4
3
TFTs are used in DL (PCEF) and UL (UE) to map SDFs to bearers

P-GW maps bearers to underlying transport (e.g., ethernet)
Transport is not aware of the bearer concept and may use IP QoS (DiffServ)
MME sets UE-AMBR = sum of APN-AMBRs up to the subscribed limit
GTP: A 3GPP Protocol Delivering IP packets within EPC
GTP: GPRS Tunneling Protocol
GTP-C to deliver signalling on

S11/S5 and GTP-U to deliver
UE traffic over S1 and S5
The GTP tunnel is identified
in each node with a Tunnel
Endpoint Identifier (TEID),
an IP address and a UDP
port number
TEID (unidirectional) are
assigned to each UE
Generated by each node
during initial UE attach
The receiving side of GTP locally assigns a TEID that the Tx side must use
In DL, eNB assigns the DL TEID that the SGW will use
Packets From UE To Internet (UEÆPGW): An Example
DL
Uu
UE eNB
UL
3. SGW modifies GTP-u header and sends the

1. UE sends a packet to Google
packet to PGW
2. eNB encapsulates it inside GTP-u
4. PGW removes GTP header and shoots the
Sends it to SGW
packet to the internet
QoS Management in LTE: QCI Mapping
|
QoS Class Identifier
QCI to DSCP mapping in eNB (UL traffic) and PGW (DL traffic)
To control the per hop behaviors (PHBs) in the transport network
Queuing and packet dropping/forwarding
eNB: extending LTE QoS to the transport network in UL
PGW: extending LTE QoS to transport in DL
QCI to Media type mapping in PCRF
Module-1.3: E-UTRAN Protocol Stack Overview
LTE Radio Protocol Stack: Resides in eNB and UE
Non-Access Stratum UE
| IP traffic
NAS: UE and MME signalling eNB
NAS NAS
PLMN selection, TAU,
paging, authentication and RRC L3 RRC
MME
EPS bearer control S1-U

PDCP PDCP
Access stratum (AS) SGW PGW
Access Stratum
Signalling on Uu RLC RLC
L2
RRC (L3) procedure OTA
RRC-signaling and MAC MAC
connection
PHY PHY
UEÅÆ EPC NAS signalling L1
U-plane C-plane C-plane U-plane
HO (S1AP, X2AP, SCTP)
SRBs and DRBs
U-plane: uses UDP to carry user traffic – eNB to SGW and eNB to UE
C-plane: handles signaling - TCP or SCTP
LTE security applies to both C-plane and U-plane
E-UTRAN L2 Building Blocks (TS 36.321/322/323)
UE eNB
PDCP: one instance per bearer Uu
NAS NAS
RoHC/Ciphering/duplicate-discard RRC RRC MME
Add a header (2-3 bytes) data PDCP PDCP

Radio
Used in UE for deciphering Bearers
L2
RLC RLC
RLC: one instance per bearer
eNB configures RLC for each QCI MAC MAC
Segmenting and concatenation PHY PHY

RLC Transparent mode (TM) U-plane C-plane C-plane U-plane
Used when PDU sizes are known a priori

Signalling/Broadcasts/paging messages and eeffectively uses no header
RLC Unacknowledged Mode (UM): real time services-unidirectional
RLC header: enables in sequence delivery of data and error detection
Used typically VoLTE (QCI1 and QCI2): delay sensitive but PER tolerant
PER: Packet Error Rate
RLC ACK mode (AM)- suitable for non-real time bidirectional services
ARQ: Automatic Repeat reQuest
Interactive/background services allowing ARQ due to delay tolerance
E-UTRAN L2 Building Blocks: MAC
UE eNB
IP traffic
Multiplexing/demultiplexing of RLC PDUs Uu
NAS NAS
Error correction through HARQ RRC RRC MME
HARQ: Hybrid ARQ
Logical channel prioritization and PDCP PDCP
Radio
Scheduling information reporting Bearers
L2
RLC RLC
Mapping between the logical and the
transport channels MAC MAC
Transport format selection PHY PHY

C-plane U-plane
Once MAC instance per cell/eNB U-plane C-plane
RACH: Random Access CHannel

UL functions include RACH scheduling, and transport format selection
LTE L2 supports two levels of retransmissions for providing reliability
HARQ at the MAC layer and outer ARQ at the RLC layer
Achieving low latency and low overhead without sacrificing reliability
IP packet for UE is encapsulated by an EPC-specific protocol and
tunneled between the P-GW and eNB for transmission to UE
LTE Transport Block (TB): MAC PDU
MAC builds the TB

188 TB sizes (40-6144 bits) depends
on data rate
RLC segments/concatenates RLC
SDUs to fit into TBs
Scheduling decision per TTI (1msec)
TTI: Transmission Time Interval
2 TBs per TTI in all MIMO modes
One for non-MIMO mode
MAC sends TBs to the PHY layer
PHY segments TBs > 6144 bits
Adds a 24 bits CRC to each TB and
performs channel coding
PHY outputs a “codeword”
BLock Error Rate
|
BLER for LTE link (PHY = 10%) - 90% success rate is required
UE-eNB Connectivity: RRC-Modes – AS Parameter
Radio Resource Control

|
RRC-Connected UE
Known to eNB/EPC
Tx/Rx data
Reports CQI (Channel Quality Indicator)
HO: Handover
Can do HO – handled by eNB
DRX: Discontinuous Reception
DRX can be configured to save
batter power
RRC-Idle UE: No NAS connection
A PDN connection exists
Registered with MME - known at TA granularity
Not known to eNB, no RNTI, no RRC -UE does not maintain UL sync
RNTI: Radio Network Temporary Indicator
The only Tx in UL the UE can do is RACH
P-RNTI: Paging RNTI
Monitors PDCCH for paging (P-RNTI) - specific subframe in a specific frame
PDCCH: Physical Downlink Control CHannel
UE handles mobility through Cell reselection
U-plane latency is ≤ 10 msec
LTE Protocol Stack and EPC: Summary
NAS Node Selection Function

|
NNSF is located in the eNB to determine and establish an association between a UE and an MME
node in an MME pool to which the eNB belongs. It enables proper routing via the S1-MME interface
LTE Communication Channels: Inter-Layer Data Flow
DL UL
PBCH
Logical (7 DL, 3 UL): what type of data they carry - traffic/control

Transport (4 DL, 3 UL): how is the data transferred OTA- MCS, MIMO..
Physical (DL/UL): where is data sent OTA – UE is the destination
Defined by the time-frequency resources for actual transmission of data
e.g. first N symbols in the DL frame and where UE must look for data
Physical signals are not physical channels (do not carry MAC PDUs)
eNB uses rate control in DL – different power levels on different channels
LTE Control Signals Overhead
PBCH: vital system parameters - QPSK PBCH: Physical Broadcast CHannel
System BW, PHICH info, SFN and eNB Tx antenna configuration

PDSCH: DL data for multiple UEs from multiple logical channels
QPSK, 16/64QAM/256QAM and all LTE TM modes PDSCH: Physical Downlink Shared CHannel
PDCCH: DL grants data to a UE (C-RNTI)-1st symbol in each subframe
DL: applies to current subframe-26% of total overhead PDCCH: Physical Downlink Control CHannel
UL: applies to the 4th subframe from the one carrying PDCCH
Uses DCI: info about RB allocation and MCS to enable UE decode PDSCH
DCI format (0, 1, 2…) indicates its purpose such as TM mode etc.
PCFICH: symbols used for PDCCH (1-3)-in 1st symbol of each subframe
PCFICH:
PCI is used to calculate PCFICH frequency offset among cells Physical Control Format Indicator CHannel
PHICH: eNB DL ACK/NACK (BPSK) – UL ACK/NACK comes on PUSCH or PUCCH
PHICH: Physical Hybrid-ARQ Indicator CHannel
PRACH: used by UE for RAP to sync with eNB in UL PRACH: Physical Random Access CHannel
PUCCH: Scheduling Requests (SR), DL data ACK/NACK and CQI PUCCH: Physical Uplink Control CHannel
PBCH, PCFICH, PDCCH, and PHICH are Tx diversity coded
Transmi ed at −3 dB compared to the configured value in eNB
System Information (SI): eNB (L3) Sends Control Data to UE
Master Information Block System Information Block
| |
SI consists of fixed part (MIB) and dynamic part (SIB)
MIB carries essential info about the cell, enabling UE to achieve DL sync
SIBs carry information to indicate to UE how the cell is configured
SIB1, SIB2… SIB13… carry specific info from eNB for UEs and sent on DLSCH
SIBs are mapped to the SI - SI size cannot exceed a transport block
|
System Information
DL channel size, timing reference, antenna config (1, 2 or 4), system
MIB frame number (SFN) and PHICH config (duration and resources). Sent
(mandatory) on PBCH with QPSK modulation and has a 40 msec periodicity
SIB1 PLMN, TAC, cell ID, cell baring status, min Rx level for cell selection
Tx time and periodicity of the other SIBs – 80 msec periodicity
(mandatory)
Cell’s radio resources, physical channels, Tx power, UL carrier
SIB2 frequency and channel BW, RACH data, transmit time, UL power
(mandatory) control and UL channel related parameters – 160 msec periodicity
Contains info for intra/inter-frequency, and/or inter-RAT cell
SIB3 reselection –received in Idle mode only
Intra-frequency neighboring cell info for Intra-LTE intra-frequency
SIB4 cell reselection.
Information regarding inter-frequency neighboring cells (E-UTRA) –
SIB5 received in idle mode only
SIBs are sent on the LTE data channel (PDSCH)
LTE C-Plane and U-Plane Protocols
C-Plane: signalling and NAS control

Network attachment, security bearers and
mobility mgmt
S1-AP: directly mapped on SCTP
UE is assigned S1-AP ID at both end
U-Plane: GTP-U on S1/S5
SGi PDN
APP
APN
X2 Functionality (TS36.423): U-plane and C-plane
Radio E-UTRAN
Network
layer
eNB
Transport
X2 X2
layer
eNB
X2
eNB
X2-AP: C-plane signalling between eNBs
HO preparation phase
Mobility load balancing (MLB)
X2 has stringent latency requirements
Using a VLAN, X2 interface can be prioritized over the backhaul
SON enables the eNBs to get each other’s IP address from the EPC
SON: Self-Optimizing Networks
U-plane: S-eNB sends UE data to T-eNB while UE is completing X2 HO
Module-1.4.1: E-UTRAN Transmission Schemes

DL OFDMA and UL SC-FDMA
LTE Spectrum Usage: Sub-6 GHz-Region Specific
Coverage/Capacity/Convergence
Device availability/Roaming
Paired spectrum: FDD bands FDD: Frequency Division Duplex
TDD: Time Division Duplex
High DL and low UL frequencies
Unpaired spectrum: TDD bands
LTE carrier raster is 100 KHz
Carrier frequency = n∗ 100
Two frequencies using BW1 and
BW2 are separated by
(BW1+BW2)/2 MHz
EARFCN: E-UTRAN Absolute Radio Frequency Channel Number
EARFCN designates DL/UL carrier frequency: integer value 0 – 65535
Uniquely identifies the LTE band and carrier frequency (TS36-101, section 5.7.3)
Spectrum allocation and applicable rules are specified by regulatory bodies
LTE Operating Bands: Region Specific Rules
3GPP specifies bands when spectrum becomes available
On each carrier, the UE

must use the entire cell BW
Bands 66-71 as well as B252 and 255 (unlicensed bands)

Some bands have reversed duplexing: B13, B14, B20 and B24
B48: 3550-3700 MHz – CBRS using FCC certified SAS (Spectrum Access System)
Carrier Aggregation (R10): Increasing Channel Size
Intra-band contiguous BW (easiest)

Grouping several LTE ‘‘component
carriers’’ (CCs) – FDD and TDD
Based on R8/9 carriers
To maintain backward compatibility
5 CC (R10) and 32 CC (R12)
CC: Component Carrier
FDD: different number of CCs in DL/UL Intra-band non-contiguous BW
# of UL CCs ≤ # of CCs in DL
Each CC can use different channel BW
TDD: # of UL CCs = # of CCs in DL
All CCs normally have same BW
Inter-band non-contiguous BW
LTE RF Channel Characteristics: Multipath and Doppler Effect
RF Channel
Users
Shadowing
(slow fading)
Path Loss
Fast Fading
Multipath: frequency selective fading – channel coherent BW Maximum coupling loss (LCL)
Loss between eNM and UE before which
Doppler Effect due to mobility – channel coherence time communication is cut off (typically 142 dB)
Causes fast fading and hence needs fast channel estimation capability
Fading, pathloss and signal distortions
LTE uses coherent detection- Rx needs channel amplitude and phase characteristics
Reference signals (pilots) are used in LTE
LTE PHY Air Interface: Enabling Technologies
OFDMA: Orthogonal Frequency Division Multiplexing Access

OFDMA-DL: parallel Tx of data symbols
ISI: Inter-Symbol Interference
Robust against ISI and simple UE Rx design
Single tap equalization at the UE
Efficient eNB resources utilization
PAPR is the main issue
eNB
SC-FDMA: UL SC-FDMA: Single-Carrier Frequency
Division Multiplexing Access
Pre-coded OFDMA UE
Serial transmission of data symbols
No PAPR issue
More efficient use of UE battery power
Multiple channel sizes
Flexible spectrum allocation and data rate
Multiple antenna system in DL and UL
Different antenna configurations
Efficient error handling mechanisms
FEC, ARQ and HARQ
OFDM: Prolonging Data Bit Duration
OFDM
Rb /N bps
f1 ∆f = 15 kHz
Serial to parallel conversion
OFDM
Input Data Stream Signal
(from higher layers)
f2
+
•
• •
•
Rb bps Rb /N bps •
•
fN
A multi-carrier scheme using overlapping orthogonal narrowband

subchannels (subcarriers)
subcarrier
Each subscriber
////////////////////// in LTE is 15 kHz and is fixed for all channel sizes
Input data is divided into N streams, each carried on a subcarrier

Makes the channel flat fading and reduces ISI but does not eliminate it
OFDM subcarriers are generated using FFT technology (pure DSP)
The FFT size varies based on channel size
128, 256, 512, 1024 and 2048 in LTE
Many of the outer subcarriers in a channel are used as guard bands
OFDM Signal: Time and Frequency View
OFDM Symbol Duration (active time + CP)
CP: Cycllic Prefix
≫ Tu = Useful Symbol = 1/∆f = 66.7 μsec
A guard time (CP) eliminates ISI
due to multipath CP Active time = TU = 1/∆f time
Depends on channel delay spread

(≈1000 nsec in urban areas)
Normal CP: 4.7 μs
Max path difference of 1.5 km
Consumes about 7.5% of the PHY capacity
Extended CP: 16.67 μs (path difference of 5 km)
Used large cell ranges, e.g., 100 km
Subcarriers are added to create the OFDM signal
PAPR: Peak to Average Power Ratio
OFDM signal can have high PAPR in time domain
Requires PA power reduction in the Tx
Pilot signals (reference signal): channel estimation
and coherent carrier demodulation at the Rx
LTE PHY: Scalable OFDM (∆f = 15 KHz Fixed)
Channel BW (MHz) 1.4 3 5 10 15 20
FFT Size 128 256 512 1024 1536 2048 FFT size is varied
based on channel
Used Subcarriers +DC 73 181 301 601 901 1201 size to keep ∆f
Guard Subcarriers 55 75 211 423 635 847 fixed = 15 KHz
Subcarrier spacing 15 KHz
Basic time in LTE PHY Ts = 1/(Δfx2048) = 1/(15000*2048) = 32.6 nsec
Active OFDM time 66.7 μsec = 2048 Ts
Frame Structure Frame =10 msec, subframe = 1 msec, slot 0.5 msec
Cyclic Prefix (CP) Normal CP = 144Ts = 4.7 μs, Extended CP = 512 Ts= 16.67 μs
OFDM Symbols/slot 7 with normal CP 6 with extended CP
LTE time parameters are expressed

as multiples of the basic time (Ts)
LTE headline data rates are based
on 20 MHz channel size and normal
CP with DL MIMO
8x8 for UE Cat-8
Data Mapping in OFDM: QPSK Modulation Symbols
Each data symbol occupies 15 KHz

for an OFDM symbol duration
QPSK data symbols
OFDMA transmits the four QPSK data symbols in parallel

One symbol per 15 KHz subcarrier
Allows channel condition-based scheduling
DL OFDMA makes it easy to equalize the channel at the Rx
A single carrier transmission must clock 4 times faster to achieve the
same data rate on the same channel BW
This requires for very complex channel equalization at the Rx
LTE Resource Grid(Time-Frequency) Definition
Resource Element (RE) Short CP
One subcarrier over one OFDM

symbol
Resource block (RB)
12 consecutive subcarriers over
one slot (0.5 msec)
An RB = 180 KHz (12 x 15 KHz)
Each of the 7 OFDM symbols in a
slot has 12 subcarriers
Total of 84 Res within an RB for
normal CP
RB is the min scheduling
resource size for DL and UL
Note: at the PHY level, 3GPP speaks of Physical RB or PRB and some calculations on the web, they use a PRB =
2RB in view of the fact that LTE scheduling is done on a 1 msec basis which covers to 2 RBs
Channel Size Vs. Transmission BW (TS 36.101)
Channel BW (MHz) 1.4 3 5 10 15 20
FFT Size 128 256 512 1024 1536 2048
# of Used Subcarriers (X) 72 180 300 600 900 1200
Number of PRBs = X/12 6 (0-5) 15 (0-14) 25 (0-24) 50 (0-49) 75 (0-74) 100 (0-99)
Transmission BW (MHz) 1.08 2.7 4.5 9.0 13.5 18.0
Sampling Rate (M samples/sec) 1.92 3.84 7.68 15.68 23.03 30.72
MIB: Master Information Block
DL channel size is indicated in

the MIB as “number of PRBs” (Physical Resource Block)
UE gets the MIB by decoding
the PBCH successfully
PRBs are indexed: PRBx
x = 0, 12, ..99 for 20 MHz
0-49 for 10 MHz
LTE UL PHY: SC-FDMA-Extending UE Battery Life
Each data symbol occupies N subcarriers (Nx15 KHz)

for 1/N of the SC-FDMA symbol duration
Transmits data symbols sequentially

PAPR: Peak to Average Power Ratio
Achieves 3-6 dB improvement in PAPR compared to OFDMA
Allows for reduced PA back-off improves coverage
SC-FDMA is OFDM but with-a-twist called DFT pre-coded OFDM
PHY numerology (subcarrier count, CP..) is the same as DL OFDMA
A modulation symbol is carried over a set of subcarriers – frequency diversity
OFDMA carries one symbol per subcarrier
SC-FDMA needs complex channel equalization at eNB – easy to achieve
OFDMA Vs. SC-FDMA: Tx Comparison
|-------Frequency domain-------| |-----------------Time domain-----------------|

FEC
SC-FDMA uses a DFT pre-coder followed by an OFDMA front-end

Data is first modulated on a single carrier in time domain which converted to
frequency domain by the DFT for subcarrier mapping
Each modulation symbol is spread over the entire bandwidth
Channel coding is Turbo coding in LTE with mother code rate of 1/3
Frequency Domain Structure Of DL and UL Waveforms
The extra subcarrier (DC) in DL is not used

Coincides with carrier center frequency
Interference from local oscillator leakage
In UL, center frequency is located between two UL subcarriers
Resource Allocation: Summary
A UE is allocated an
integer number of RBs
Need not be contiguous
in RDL-6000
Scheduling is updated every 1 msec (aka TTI)

Two TBs per TTI in spatial multiplexing transmission mode
Number of UEs scheduled in a TTI is vendor specific
4 in RDL-6000 (DL/UL) in 5/10 MHz and 2 UEs in 15/20 MHz channel size
In UL, only contiguous allocations are allowed
To maintain SC-FDMA properties of the signal
PDCCH BW grant indication applies to the current subframe
The subframe occurring 4 subframes after the one carrying PDCCH
LTE Data Rates: Finding LTE Symbol Transmission Rate
Data rates correspond to:

REs carrying data on
PDSCH and PUSCH
MCS
MSC
///////// used for each RE
Multi-Antenna
configuration in eNB
and UE
LTE overhead as a rule of thumb is 25% of the total data rate

The CP, signaling and PHY layer signals are pure overhead
UpPTS: Uplink Pilot Time Slot
The UpPTS and GP in TDD frame contribute to overhead
GP: Guard Period
Physical channels (PDCCH/PCFICH/PHICH) consume 1, 2 or 3 symbols
Traffic dependent – heavy network loading will use 3 symbols
Redundancy added by PHY (channel coding or FEC): 0.35-0.95 <= coding rate
CR of 0,6 means that 60% of the channel is
used for data, while the rest is for coding/FEC.
LTE Data Rates: Ideal Channel Conditions
BPSK = 1 b/sym
QPSK = 2 b/sym
Data Rate (Rb) = ∗ 64QAM = 6 b/sym
PRB Capacity = 12x7 = 84 symbols in 0.5 msec = (84/500) ∗106 sps

Subframe capacity = 84x2 = 168 symbols/msec = 168x1000 sps
Symbol Rate = (168000) ∗ (NPRB) sps Single Antenna Port

33.6 Mbps for QPSK
Capacity of 20 MHz = 168000 ∗ 100 = 16.8 Msps=X= 67.2 Mbps for 16QAM
Net Data rate = X-25% = 75 Mbps for 64QAM 100.8 Mbps for 64QAM
2x2 DL: Rb = 2x75 = 150 Mbps
(Msps = 1M symbol/second)
UL data rate depends on UE category
For Tx chain, Rb = 50 Mbps (less overhead compare dot DL)
75 Mbps if 64QAM is supported
Alternatively, consider 64QAM case
(14 symbols/msec) ∗ (6) = 84 Kbps/subcarrier = 84 ∗12 = 1.008 Mbps/RB
Module-1.4.2: LTE Multi-antenna Systems and

Transmission Modes
Multiple Antenna Systems: Massive Throughput Gains
MIMO Diversity Processing

Deep Fades Deep Fades
Signals from
M antennas
Freq
Combined SNR
Spatial Diversity: robustness against channel transmission and diversity gain

MISO/SIMO, MIMO STBC/SFBC – increasing SNR, robustness against channel fading/noise
Spatial Multiplexing: multiplexing gain - requires orthogonal transmissions paths
Multiple data streams (layers) on the same frequency/time resource
Beamforming: focuses radiated energy in specific direction – array gain
Basic MIMO Definitions
“h” parameters reflect how signals are

attenuated and phase shifted
SU-MIMO: PTP Multiple antenna link
SU-MIMO
eNB communicates with one UE at a time
MU-MIMO: eNB schedules multiple UEs at the
UE1
same time using same time-frequency resource
eNB
Open Loop: Rx does not report CSI to Tx
CSI: Channel State Information UE2
Closed Loop: Tx gets CSI on a feedback channel
MU-MIMO UE3
Tx can respond to changing channel conditions
Long CDD: precoding scheme- PDSCH only (TM3)
CDD: Cyclic Delay Diversity
Prevents signals from cancelling each other at Rx
Time delay Æ phase shift in frequency
Coordinated MultiPoint (CoMP)- network MIMO
eNBs communicate with the same UE Half symbol time for 2 antenna system (LTE
uses Long CDD) – added before CP insertion)
LTE MIMO Schemes: DL-UL
DL 2x2 MIMO
DL: 2x2 MIMO is mandatory
4x4 (R8) and 8x8 (R10)
Tx diversity (SFBC) (Space-Frequency
Block Code)
2/4/8 layerd spatial multiplexing
UL: 1x2 (R8) - no UL MIMO
Up to 4 Tx chains in R10 UL 1x2 MIMO
4x4 transmission in UL
The “h” parameters reflect the way
the signals are attenuated and
phase shift in the channel
MIMO system performance metrics
Rank Indicator (RI): shows how many layers (streams) can be detected by UE
2 streams in a 2x2 MIMO system
Pre-coding Matrix (PMI): points to use of a pre-defined signal processing
3GPP TS 36.211 table 6.3.4.2.3-1 ……
LTE MIMO Transmission Modes: DL
Tx Mode DL Tx Scheme Remarks
TM-1 Single Antenna Port (SIMO) No MIMO and fairly uncommon across deployments
• SFBC (2 Tx antenna only), Rank 1, fallback for open/closed loop MIMO.
Transmit Diversity
TM-2 • Used for DL control channels (PBCH, PCFICH, PDCCH, and PHICH, they are
(fall back scheme)
transmitted at -3 dB compared to PA configured value because of the 3 dB gain).
UE feedback only indicate rank of the channel, If rank >1, LTE uses CDD (delay is
Open Loop Spatial added before CP) – predominate mode across LTE networks.
TM-3
Multiplexing • no PMI
• Used in high mobility scenarios where it is not possible to get accurate feedback
Closed Loop Pre-coding matrix indicator (PMI) is sent from UE to the eNB which pre-codes the
TM-4
Spatial Multiplexing signal for best reception at the UE
TM-5 Multi-user (MU) MIMO • Direct each layer to a different UE, yet to get traction
Closed Loop Rank 1 Spatial
TM-6 Theoretical – not seen practical deployments, UE signals PMI
Multiplexing
Single Antenna Port Mainly driven by 8TX TD-LTE deployments to support reciprocity based beamforming,
TM-7
Beamforming no dedicated CSI
TM-8 Dual Layer Beamforming Dual-layer transmission,
TM-9 8 Layer Transmission Up to 8 layers, uses DMRS and CSI-RS
TM-10 TM9 enhancements to support CoMP
RDL-6000 supports TM-2 and TM-3

Number of antennas in eNB is conveyed in the MIB CRC
Control channels use Tx diversity, no beamforming
LTE CQI: Channel+UE Rx Qualities
CQI CR
Modulation MCS Efficiency
CQI: DL Channel quality (time/frequency) Index X 1024
0 No Tx
Used for DL link adaptation 1 QPSK 78 (0.076) 0.1523
2 QPSK 120 0.2344
Frequency-dependent scheduling 3 QPSK 193 0.377
0 -- 9
Max MCS UE can handle with BLER of 10% 4 QPSK 308 0.6016
5 QPSK 449 0.877
TB sizes: larger TB size when CR improves 6 QPSK 602 1.1758
MCS: Modulation and Coding Scheme 7 16QAM 378 (0.37) 1.4766
8 16QAM 490 10--16 1.9141
9 16QAM 616 2.4063
10 64QAM 466 2.7305
11 64QAM 567 3.3223
12 64QAM 666 3.9023
17-28
13 64QAM 772 4.5234
14 64QAM 873 5.1152
15 64QAM 948 (0.93) 5.5547
LTE uses Turbo coding with mother CR
= 1/3 and range 0.0762 - 0.9258
PSD: Power Spectral Density

UL channel quality: predicted PSD Tx, pathloss and “N+I” estimates
PHR is used to estimate PSD Tx, and eNB measures PSD Rx
LTE Link Quality Indicators: Summary
eNB does the MCS selection

for DL and UL based channel
quality estimates
DL: eNB uses the CQI sent
by UE in UL
UL: eNB estimates channel
quality using the UL SRS
SRS: Sounding Reference Signal
MCS is constant over the allocated resources (PRBs) of a user
Each TB sent to a UE can use a different MCS in spatial multiplexing case
TB: Transport Block
RI: number of layers that can be used RI: Rank Indicator
PMI: mapping data strams to antennas PMI: Precoding Matrix Indicator
Precoding involves adapting the Tx signal to the current CSI
Open Loop SM: UE sends only CQI and RI
Closed Loop SM: UE has to send CQI, RI and PMI
Not sutiable for high mobility due to time required for PMI calculation
Data Mapping-OFDMA/MIMO: Example
Adjust phase and
amplitude for each
QPSK antenna and adjust
16QAM Antenna Config
total power
SM, Tx diversity,
64QAM (CDD/SFBC)
CW0
CW1
Payload goes through channel coding/rate-matching first

CC for C-plane and Turbo for U-plane data
Codeword: data before it is formatted for transmission - CW0 and CW1
SU
Both sent to one UE in US-MIMO
////// and two different UEs in MU-MIMO
Layer (stream of data)- 2 to 4 layers
Precoding: modifying layer signals before transmission
They be done for diversity, spatial multiplexing or beamforming
Closed MIMO needs precoding of data streams
Module-1.4.3: LTE Wireless Frame Structure and Signaling

LTE Wireless Frame Numerology: FDD/TDD
Frames
Subframes
Slots
Symbols
OFDM symbols are organized in time 0.5 msec slots (15360Ts)

7 symbols for normal CP and 6 for extended CP
Two slots make a subframe (1 msec = 30720Ts)
10 subframes make an LTE wireless frame = 307200 Ts = 10 msec
Each frame has a system frame number (SFN) - 0 to 1023
LTE FDD and TDD frames use subframes and slots differently
LTE Frame Type1: FDD-Concurrent DL/UL Transmission
UL 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
DL
FDD frame exists in DL and UL simultaneously

LTE frame numbering has two components: SFN and subframe number
SFN (0-1023) is specified in MIB - SFN increments by 1 every frame
Subframe number resets to zero every frame (0-9)
UE must be synchronized with eNB at subframe and SFN levels
LTE Frame Structure Type-2: TDD Frame
One Radio Frame, Tf = 307200TS = 10 msec TDD switching
Switching point is eNB: DL Æ UL (TTG)
not mandatory in UE: UL Æ DL (RTG)
1st half frame 2nd half frame 2nd half frame
SSF SSF = 1 msec
This one is not mandatory
10 msec frame is divided into two half frames, each with 5 subframes
Each of the subframes can be used for DL or UL switching
5 msec (half frame switching) and 10 msec (full frame switching) periodicity
SSF allows for DL to UL switching SSF (Special Subframe)
Ensures that DL and UL transmissions do not clash
TDD Frame Usage: Seven DL/UL Profiles
DL/UL Frame SSF/Frame

config Periodicity
(msec) DL UL # of
SSF
0 5 2 6 2
1 5 4 4 2
2 5 6 2 2
3 10 6 3 1
4 10 7 2 1
5 10 8 11
// 1 1
6 5 3 5 2
Seven DL/UL config profiles (RDL-6000)

Subframe 0 and 5 are in DL in all profiles
SSF is followed by an UL subframe
DL/UL configuration and the SSF gap affect cell range
Ellipse-4G supports configuration 1, 2 and 3
CBRS mandates profiles 1 and 2
SSF Types (9 patterns): Coverage-Capacity Trade-off
DwPTS: Downlink Pilot Time Slot

DwPTS: “normal” DL subframe
Can carry RS, control, data or PSS
GP ≥: UL-DL RTD (Round-Trip Delay)
GP: Guard Period
Making sure UL and DL do not clash TDD SSF
OFDM Symbols in SSF (Normal CP)
Config Cell Range
Determines (a factor) max cell range DwPTS GP (km) UpPTS
0 3 10 104
UpPTS: UL signalling only 1 9 4 39.9
Primarily for UE SRS and PRACH 2 10 3 29.14 1
3 11 2 18.42
Number of symbols assigned to 4 12 1 7.71
DwPTS, GP and UpPTS determines 5 3 9 93
6 9 3 29.14
the SSF configuration type 7 10 2 18.42
2
8 11 1 7.71
Ellipse-4G OAM allows only up to 4 symbols for GP – up to 39 Km range

SSF config 0 and 5 are not supported – due to long GP
Guard time specified in preamble signal format applies to TDD and FDD
LTE PHY Level Signals: DL Synchronization Signals
PSS: Primary Synchronization Signal
SSS: Secondary Synchronization Signal
UE must achieve symbol/frame

timing, frequency and clock
synchronization in DL
A cell broadcasts PSS and SSS to
enable the UE achieve DL
synchronization
Every 5 msec (twice in a frame)
UE acquires essential cell parameters from PSS and SSS

PCI, CP, FDD/TDD mode
UE can decode the PBCH and hence can read the MIB
PSS/SSS positions in the frame depend on TDD/FDD frame
Occupy the central 6 RBs (1.08 MHz) irrespective of channel BW in use
Add about 3.5% overhead in FDD and up to 13.5% in TDD
Sync Signals Transmission: Time View – Normal CP
FDD Frame
PSS: 3 sequences corresponding

to values (0, 1, 2)
Identical values in the frame
TDD Frame
PSS in FDD: in the last symbol of
the first and 11 slots
UE gets slot boundary
PSS in TDD: 3rd symbol of the 3rd and 13th slots (subframes 1 and 6)
Cell with same PCImod3 values will experience PSS to PSS interference
SSS (each can take a value 0, 1, 2… 167)
FDD: in the symbol immediately preceding the PSS
TDD: 3 symbols before the PSS
SSS in each half-frame convey same info but are swapped in frequency
This allows UE to differentiate the 1st and 2nd half of the radio frame
UE blindly detects cell CP value by checking for SSS location
PSS and SSS location difference allows duplex (FDD/TDD) detection
UE Extracts Frame Timing and PCI from PSS and SSS
Downlink synchronization
504
SSS
PSS SSS PSS
Physical layer ID Groups

N 3N N
PCI = 3 x Cell ID Group + Sub Cell ID
0 1 ··· 166 167
504 0,1, 2..167 0, 1,2
0 1 2 0 1 2 0 1 2 0 1 2
Physical layer ID ( Cell ID index or Sector ID)
PSS: determines the 5 msec frame timing and position of SSS

SSS: two positions in a frame establishes the frame boundary
On knowing PCI, UE can locate CRS (Common Reference Signal)
PCI value tells the UE about the permutation used in the cell
Frequency domain: PSS/SSS are always carried in the central six RBs
A basic rule of thumb: neighbor cells should not have the same PSS value
LTE PHY Level Signals: References Signals
DL Reference Signal (RS): pilot signals known to the cell and UE

UE generates the RS locally and compares it with the received RS
Retrieves the phase and power information of the signals carried in the channel
RS power level is indicated in ___
SIB2
Cell specific reference signal (CRS) – common to all UEs <= Important
UE specific RS (demod-RS) beamforming support of channel estimation
Positioning RS – UE location measurement – not discussed in this course
CSI-RS (R10 for TM-9): dynamic switching between MU-MIMO and SU-MIMO
UL PHY level signals
Demodulation reference signal (DMRS): phase reference for channel estimation
UE transmits DMRS at the same time as the PUSCH and PUCCH
Sounding reference signal (SRS): power reference
eNB uses SRS to estimate UL channel quality
o Enables frequency-dependent scheduling – not associated with PUSCH or PUCCH
SRS is optional and can be turned off in a cell – it consumes 7% of UL capacity
CRS Time-Frequency Location: Depends on PCI
1 msec subframe
One slot
Frequency
Four cell specific RS (CRS) per PRB
One symbol in every 3rd subcarrier
504 CRS sequences – QPSK modulated
Corresponding to 504 PCI values
RS location on time axis
Determined by max Doppler spread
UE speed and channel coherence time 1st Symbol
3rd last Symbol
In the 1st and 3rd last symbol in each slot

6 subcarriers apart on each symbol
RS location on the frequency axis: channel coherence BW (delay spread)

Two RS symbols are 3 subcarriers apart - one RS every 3 subcarriers in a PRB
PCI is used to determine the first subcarrier on which the RS is mapped
Interference on RS’ between cells having same PCI mod 3 can be very high
Two immediate neighbors of a cell must not have same PCI mod3 value
CRS Transmission in 2x2 Antenna System: An Example
Slot
Tx Ant1
Subframe
Tx Ant2
Slot
RE
In frequency, cell RS has a shift determined by its PCImod3 value

Diagram above: PCImod3 = 0, 1,2 for Cells 1, 2 and 3 respectively
With this PCI allocation, RS of different cells do not overlap in frequency
Resulting in less interference on UE channel estimation
In an unsynchronized deployment, PCI allocation between sites is not possible and
hence inter-RS interference becomes inevitable
RS Received Power: RSRP
Average power of a single

RE carrying the RS S-eNB T-eNB
Power of all RS in the RB

Range: -140 to -44 dBm RSRP2
RSRP1
Mapped to 0 to 97 RSRQ1 RSRQ2
RSSI: total power received including interference

Within channel passband over “N” PRBs (dBm)
UE traffic dependent
RS is power boosted by eNB – for easy decoding
Defines the RS Tx power in SIB2
Enables UE to calculate DL path loss
For 100% DL PRBs (N) active and no noise case
RSSI = RSRPx12xN, for N PRBs
RSRP (dBm)= RSSI (dBm) - 10xlog (12xN)
RSRQ: UE Ranks Detected Cells – HO/Reselection
RSRQ: Reference Signal Received Quality

RSRQ = (wanted signal)/(all received power)
S-eNB T-eNB
RSRQ = RSRP/(RSSI/N) = N*RSRP/RSSI, for N PRB used to measure RSSI
RSRP2
Depends on traffic dependent through RSSI RSRP1
RSRQ1 RSRQ2
Depends on loading of data subcarriers
RSRQ Range: -19.5 dB to -3 dB (dB)
-3 dB (no traffic and no interference in the cell)
- 19.5 dB (high load/high interference)
Mapped to 0-34 with 0.5 dB resolution
SINR = (power of all RS REs)/(I+N) = channel quality
Measured every TTI and averaged per second
Converted to CQI and sent to eNB (MCS selection)
Where x=RE/RB.
Almost a linear relationship with RSRP x = 2RE/RB means empty cell (only
RS power) from S-eNB.
Impacted by network load and N-eNBs load x= 12RE/RB is a fully loaded S-eNB
(all REs are carrying data)
Typical values are -10 to + 30 dB
RSRP and RSRQ Calculation: Example
Assume a measurement bandwidth of 6 RBs (smallest used in LTE)

Let us consider RDL-6000 (single cell) with max Tx power PTX = 39 dBm
RSRP: power of one RE carrying the RS symbol, so RSRP = 1/72 of total power
Assuming all REs experience same pathloss = 100 dB, then
RSRP = 39 -100-10log (72) = -78.6 dB
RSRQ is the ratio of RSRP and RSSI, depending on measurement BW (RBs)
Let us consider 20 MHz channel and an ideal noise/interference free cell with RS and
data subcarriers use equal Tx power over one RB (12 REs)
Then for one symbol with R0 (first RS) RSRQ can be viewed as inter-cell interference
which appears as a wideband RSSI impacting the denominator in RSRQ estimation
RSRQ (dB) = 10log ((100x1RE)/(100x12RE)) = -10.79 dB
PHY Layer Signals: UL
Subframe = 1 msec
Slot1 Slot2 Time
Demodulation reference signal (DM-RS)

Channel estimation for UL coherent
DM-RS
DM-RS
Data
demodulation at eNB
Associated with PUSCH and PUCCH
SRS
Located in 4th symbol in each slot
DM-RS
DM-RS
Sent with user data in same bandwidth
Frequency
Sounding Reference Signal (SRS)-optional
Facilitates frequency dependent scheduling
DMRS cannot be used as it uses same bandwidth as data
Sent in last SC-FDMA symbol of a subframe – no user data in this subframe
Sent at most every two subframes and at least once in 32 frames
Constructed from Zadoff-Chu sequences divided into 3 groups
For a given number of PRBs, there are 30 sequences that can be used as RS
Potentially interfering cells must have different PCImod30 values
PCI mod30 = u = base sequence index, u = 0, …29
PRACH Procedure: UE Synchronizes in UL with eNB
PRACH: Physical Random Access CHannel PRACH Preamble
TSEQ = 800 μsec
UE sends a Preamble
Sequence to eNB to
6 PRBs
achieve UL sync Sequence (TSEQ)
Preambles are
transmitted as 800 μsec
OFDM symbols
CP: Cyclic Prefix
CP areas to accommodate the RTD between eNB and UE GT: Guard Time
RTD: Round-Trip Delay
GT at the of the symbol to avoid interference out the side the frame
CP prevents interference from previous symbol and GT from the one that follows
LTE has specified 839 ZC preamble sequences for PRACH
64 Preambles per cell – each cell consumes 64 sequences
Must be orthogonal codes so multiple UEs can do random access same time
UE generates these based eNB specified PRACH parameters in SIB2
Number of cells within a reuse distance 839/64 ≈ 13
A PRACH sequence burst (time slot) can have a duration of 1, 2 or 3 subframes
Random Access Tx is the only non-synchronized Tx in LTE UL. Although UE achieves DL sync before starting RACH, it cannot determine
its distance from the eNB. Thus, timing uncertainty caused by two-way propagation delay remains on RACH transmissions
PRACH Preamble Formats: Uses Sequence-CP-GT Durations
Preamble Duplex PRACH Sequence Total duration Sub- Max Cell Range
CP (μsec) GT (μsec)
Format (PF) Mode Symbols TSEQ (μsec) (μsec) frames (km)
0 103 1 800 97 1000 1 15

(RTD = 100 μsec)
1 FDD 684 2 800 516 2000 2 77 (M cell)

and
2 TDD 203 2 1600 197 2000 2 30 (L cell)
3 684 3 1600 716 3000 3 103 (XL cell)
4 TDD 15 0.16 133 9 157 0.16 1.4 (small cell)
Basic PRACH (PF0) was defined for 15 km range

To increase cell range, 2 and 3 subframes formats were defined
PF1 sequences are single copies of PRACH converted to time
PF2 and PF3: preamble symbol is repeated twice, to make it easy to detect it
Only certain PFs can be used in TDD
Preamble may not fit in UL in certain DL/UL configs
PF4 PRACH is transmitted on UpPTS
eNB can detect PF0 more easily than PF4 - has higher HO success rate
PRACH ConfigIndex: Time Domain Info Of PRACH (TS36.211)
PRACH Config Index provides the time domain info

of PRACH resources - references a 3GPP table
SFN: System Frame Number
SFN and subframe# in a frame that has PRACH
The # of times PRACH slot is scheduled per frame and
the subframe employed
The preamble format that needs to be used
PRACH Frequency Offset provides frequency
domain info of PRACH
The first RB available for PRACH - set to 3 in Ellipse-4G
Scheduler reserves 6 PRBs for each PRACH instance
FDD: at most one PRACH opportunity in one subframe
TDD: can frequency multiplex up to six PRACH opportunities in a subframe
Using same prachConfIndex to cells in the same site is recommended
Causes inter-cell PRACH interference but is less serious than PRACH-PUSCH
interference (due to different values to cells in same eNB)
PRACH ConfigIndex: Locating PRACH Tx Opportunity
PRACH Config Index PF SFN Subframe # PRACH Config Index PF SFN Subframe #
0 0 Even 1 32 2 Even 1
1 0 Even 4 33 2 Even 4
2 0 Even 7 34 2 Even 7
3 0 Any 1 35 2 Any 1
4 0 Any 4 36 2 Any 4
5 0 Any 7 37 2 Any 7
6 0 Any 1 ,6 38 2 Any 1 ,6
7 0 Any 2,7 39 2 Any 2,7
8 0 Any 3,8 40 2 Any 3,8
9 0 Any 1,4,7 41 2 Any 1,4,7
10 0 Any 2 , 5, 8 42 2 Any 2 , 5, 8
11 0 Any 3, 6 , 9 43 2 Any 3, 6 , 9
12 0 Any 0, 2, 4, 6, 8 44 2 Any 0, 2, 4, 6, 8
13 0 Any 1, 3, 5, 7, 9 45 2 Any 1, 3, 5, 7, 9
14 0 Any 0, 1, 2,….9 46 N/A N/A N/A
15 0 Even 9 47 2 Even 9
16 1 Even 1 48 3 Even 1
17 1 Even 4 49 3 Even 4
18 1 Even 7 50 3 Even 7
19 1 Any 1 51 3 Any 1
20 1 Any 4 52 3 Any 4
21 1 Any 7 53 3 Any 7
22 1 Any 1, 6 54 3 Any 1, 6
23 1 Any 2 ,7 55 3 Any 2 ,7
24 1 Any 3, 8 56 3 Any 3, 8
25 1 Any 1, 4, 7 57 3 Any 1, 4, 7
26 1 Any 2, 5, 8 58 3 Any 2, 5, 8
27 1 Any 3, 6, 9 59 3 Any 3, 6, 9
28 1 Any 0, 2, 4, 6, 8 61 N/A N/A N/A
29 1 Any 1, 3, 5, 7, 9 62 N/A N/A N/A
30 N/A N/A N/A 63 3 Even 9
31 1 Even 9
3-5 and 19-21 are typical for private LTE
PRACH Parameters (SIB2): Definitions
RootSequenceIndex (RSI): sequence UE starts with to generate preambles

UE starts with RSI in SIB2 to generate all or many its 64 preambles
Depends on cell range - 64 for smallest cell and 1 for largest cell
o More than one RSI may be required in a cell
o Use as few as possible to prevent interference between preamble transmissions
Preambles obtained from cyclic shifts of an RSI must have sufficient separation
838 possible root sequences with 839 symbols each (PF 0-3) and 138 for PF4
ZeroCorrelationZone (ZCZ, NCS): cyclic shifts between preamble sequences
The number of shifts from an RSI = 839/NCS
ZCZ planning is based on cell range - requirements of GT
Determines how many RSI are needed per cell for a certain range
16 different cyclic shift separations can be configured for a cell
Providing 1 to 64 preambles from a single root sequence
Power Ramping Step: 0, 2, 4 or 6 dB (in case eNB cannot detect UE PRACH)
UE decides its initial Tx power based on open loop DL pathloss estimate
UE Initial Cell Search: Registering with eNB (getting to RRC-connected mode)
PBCH is time aligned with

the Sync channels and UE can • UE acquired most essential
read it now (UE gets the MIB) system information
PBCH: Physical Broadcast CHannel • UE can read PDCCH/PDSCH and links
up with the eNB
UE attempts to detect SSS UE Knows:
(tries to match 1 out of 168 possible
SSS (Cell ID Group)
• Frame timing (from SSS location)
• Cell ID Group (1 out of 168)
• PCI (1 out of 504)
• C-RS locations knowing PCI
UE looks for the PSS • CP and FDD/TDD mode
(attempts to match 1 out of 3 possible PSS
(cell ID index within a Cell ID Group) UE determined:
• Exact carrier frequency
• Cell ID index within Cell ID Group (1 out of 3)
• Subframe timing (UE learns the timing of
subframes 0 and 5)
UE turns on UE performs a rough frequency synchronization (UE has a

good carrier candidate with the strong 6 RB subcarriers which might carry the PSS and
SSS and PBCH)
Doppler shift due to UE speed causes is the main cause of UE-eNB frequency difference
UE searches for a strong cell in a DL band

(monitors the central 6 RB of the spectrum regardless of the channel size)
Initial Network Attach: Register To Tx/Rx Data
(assigns a bearer ID)
Always-on IP connectivity for UE is enabled by establishing a default EPS

bearer during Network Attachment
LTE Scheduler: Radio Resources Distribution in DL and UL
MCS, QoS, TB size

and PRB selection
CQI from UE
TTI: Transmission Time Interval
Radio resources allocation among the active UEs in a cell on per TTI basis
Uses DL data buffered in eNB and the Buffer Status Report (BSR) from UE
Resides in the eNB – it has component in UE that takes orders!
Dynamic: eNB checks every TTI (1 subframe) if UE needs allocation
Min scheduling in frequency: a pair of time consecutive RBs
Semi-persistent: allocations last many subframes or TTIs - VoIP
Timing and amount of radio resources needed are predictable
LTE Scheduler: Time-Domain and Frequency Domain View
Scheduler algorithms are eNB specific

Signaling is standardized (3GPP)
Scheduling parameters are signalled to
UEs in PDCCH (Physical Downlink Control CHannel)
FDPS tries to improve spectral efficiency TDPS FDPS
Frequency dependent scheduling– if
supported
UL can use distributed or localized PRB
scheduling
C-RNTI: Cell Radio Network Temporary Identifier
C-RNTI is used to identify UE allocations
for dynamic scheduling
An SPS-C-RNTI is used for SPS scheduling
SPS: Semi-Persistent Scheduling
TTI-Bundling: Improving UL Coverage
UE cannot use enough energy in one TTI to successfully send a VoIP packet
TTI bundling is used to improve UL link budget (2-4 dB) TTI: Tranmission Time Interval
TTI bundling uses four consecutive TTIs - helps UEs close to cell edge
A TB is transmitted over a TTI bundle, but with different redundancy versions*
These four transmissions are non-adaptive with identical MCS/RB location but
different redundancy versions – incremental redundancy * Means with different coding
Uses four automatic reTxs in the bundle with a common ACK/NACK for HARQ
eNB activates TTI bundling if UE SINR drops below a specified threshold
BLER increases and link adaptation has no more options for MCS/PRB reduction
VoLTE coverage RSRP threshold improves from −114 dBm to −117 dBm
UE is restricted to PRB < = 3 and use of QPSK
eNB activates/deactivates TTI bundling per UE via RRC messaging
Mobility Mgmt: Maintaining Ongoing Session QoS
Connected mode mobility: HO (HandOut)

UE is always connected to a single cell
__________________________________________
An active UE monitors RSRP of S-eNB

RSRP: Reference Signal Received Power
Measures N-eNBs if it falls below a
threshold and reports to its S-eNB
S-eNB selects a T-eNB to HO UE to
On X2 or S1 – looks the same to UE
Quality/Coverage/MLB based HO
MLB: Mobility Load Balancing
Intra-RAT HO: Intra/inter-frequency
RAT: Radio Access Technology
LTE mobility mgmt is event-based
Idle-Mode mobility: Cell Reselection
eNB provides a list of
cells/frequencies
Specifies priorities via SIB1
The LTE Events: A1-A5
> <
Module-1.5: LTE SON Overview
SON: LTE Network On Auto-Pilot
pre-Operational
state
Operational state
Operational state
SON automates certain tasks
planning, configuration, and optimization Acquisition
Self-optimization: auto-tune the network using

SON
UE and eNB measurements Triangle
Network performance enhancing by optimizing
capacity, coverage, HOs and interference Action Decision
SON Functionality and LTE Stack: Generic View
KPI: Key Performance Indicator
The SON module interacts with the applicable stack modules to read KPIs
X2 (inter-eNB) and Itf-N (NBI connecting EMS and NMS) are important
interfaces for the SON operation
SON Types: Centralized/Distributed/Hybrid
OAM: Operations, Administration and Management
Distributed SON (dSON) Centralized SON (cSON)
cSON algorithms are executed at the

dSON functions are executed at eNBs network mgmt level
eNBs need reliable X2 connectivity Parameter collection is in eNB SON
For dynamic, fast and reliable element managers
parameter adaptation
Issues: longer response, increased
• Concerns: vendor specific backbone traffic and a single point of
• RDL-6000 supports dSON failure
SON: Automating Network Tasks and Self-Optimizing
ANR (automatic neighbor relation): auto-finding N-eNBs

X2 config, neighbor IP discovery and PCI management
MLB (Mobility Load Balancing): load distribution amongst N-eNBs
MRO (Mobility Robustness Optimization): minimizing HO failures
PRACH Optimization: minimizing UE initial network access failure
ES (Energy Saving): turning off booster cells at certain load conditions
May involve moving some UEs to active cells
ANR: Creating NR Tables (NRT) in eNBs
ANR: Automatic Neighbor Relation
NRT: Neighbor Relation Table
Unburdens OPs from manually

managing neighbor relations of
eNBs in a network
Intra-frequency ANR function
relies on cells broadcasting their
ECGI which UEs read and report
EGCI: E-UTRAN Global Cell Identifier
eNB asks for ECGI, TAC and PLMN ID if it cannot recognize reported PCI
TAC: Tracking Area Code
Each eNB creates an NRT for each cell it controls – 3 minutes update
N-eNBs matching PLMN are in a Whitelist, others go to a Foreign List
For co-channel eNBs, NRT contains N-eNB ECGI and PCI
Inter-frequency ANR: eNB specifies search list and schedules gaps
UE reports detected PCIs and other parameters as specified by eNB
eNB can learn IP addresses from MME (on S1) to set up X2 with neighbors
A5 threshold is used for new neighbor detection
MLB-Self-Optimization: Improving PRB Utilization
MLB: Mobility Load Balancing
On detecting overload
and traffic imbalance,
an eNB decides to
move UEs to less Candidates for MLB-based HO
congested N-eNBs Can expedite/delay HO by changing CIO
CIO: Cell Individual Offset
Adjusts mobility parameters to expedite HO
MLB is enabled when X2 is set up with first neighbor detected by ANR
Disabled if there is no X2 link with any neighbor or no valid neighbor
eNBs exchange load conditions on X2 – Client-Server type activity
MLB can be inter-cell within eNB or in a N-eNB
eNB tries to move UEs on detecting overload irrespective of UE location
MLB parameters: start/stop thresholds and cells load difference (% RBs)
RDL-6000 supports intra-LTE MLB
MRO Self-Optimization: RLF and HO
MRO: Mobility Robustness Optimization
Aims at detecting and preventing mobility connection Failures - HO

Too-late HO, leading to a connection failure in the S-eNB
Coverage hole, leading to a connection failure in the S-eNB
Too-early HO, leading to a connection failure in the T-eNB
HO to an inappropriate cell, leading to a connection failure in the wrong T-eNB
HO to an unprepared cell (R10)
MRO step-1: data collection and problem analysis
RLF: Radio Link Failure
RLF reports from UEs using the RRC UE Information procedure
Mobility problem logs from N-eNBs and internal performance metrics
MRO step-2: Problem solution through CIO adaptation
Calculates and applies CIO that solves HO problems towards a given N-eNB
MRO is normally used along with MLB Mn±CIOn > Ms±CIOs +A3 or A5)
MRO parameters are CIO, TTT or TTT+CIO
CIO: Cell Individual Offset
TTT: Time To Trigger
Module-1.6: LTE Security Framework
LTE Air Interface Security: AS and NAS Layers
AKA: Authentication and Key Agreement NAS Security (EEAx, EIAx)

Mutual authentication
between UE and the
network using AKA
Ciphering of C/U-plane
Main players are UE,
eNB and MME AS Security (EEAx, EIAx)
NAS security (UE ↔MME): integrity protected (mandatory, using EIA)

|
and ciphering (optional, using EEA) of NAS signalling EPS Integrity Algorithm
EEA: EPS Encryption Algorithm
MME selects the EIA and EEA for UE and signals it using SMC
EIA: EPS Integtity Algorithm
AS security (UE ↔ eNB)
Mandatory integrity protection and Ciphering for RRC signalling (C-Plane)
Ciphering of the U-plane data on Uu - integrity protection is not mandatory
PDCP layer encryption (UE and eNB) is optional
S1 interface security through use of Security Gateways (SEGs)
LTE Security Algorithms: Integrity Protection and Ciphering
EPS Encryption Algorithm for Ciphering (EEA) U-plane and C-plane

“0001” 128-EEA1 SNOW 3G (Sweden)-stream cipher
“0010” 128-EEA2 AES (USA) – block cipher
128-EEA3 ZUC stream cipher (China R11 onwards)
EPS Integrity Protection Algorithm (EIA):
Integrity protection uses a 32 bit MAC (MAC-I) like CRC for IP packets
““0001” 128-EIA1 SNOW 3G
“0010” 128-EIA2 AES
128-EIA3 ZUC-based hash function (China R11 onwards)
Null algorithm (no security): allows UEs to make emergency calls
EIA0 for Integrity and EEA0 for ciphering
FlexCore - MME
LTE Security Keys: Mutual Authentication Using AKA
International Mobile Subscriber Identity

|
One way function

Based on IMSI specific master
security key “K”
Lives only in HSS and UICC (UE)
UE stores CK and IK in UICC on
detaching
MME stores KASME
UE and MME agree on KASME
during AKA and identity
confirmation
AKA uses Milenage
MME has UE IMSI or asks for it
AS/NAS keys are different
Separate keys between UE and T-eNB during X2 and S1 handover
Access Security Management Entity receives the top-level keys in an access network from the HSS. MME is ASME for LTE
UE Initial Attach: Security Messaging Sequence
UE eNB
AuC
MME SGW PGW PCRF HSS
EIR
1-RACH/RRC-Conn
2-NAS Attach Request (IMSI or previous GUTI)

3-Verify ID
4-ID Request (MME) and Response (UE)

5-Authentication/Authorization: MME sends IMSI, HSS returns K ….
6-Authentication and NAS Security setup
7-ID Request (UE) Response (MME)
8-Cipher Option Request (MME) Response (UE)
MME is the primary node making LTE access vulnerable to DoS

MME forwards UE requests to HSS before it authenticates the UE (step 5)
Integrity protection is always applied to PDCP Data PDUs of SRBs while it
is optional for DRBs
LTE Security: UE Related Parameters
Security includes seven

key generation functions
f1, f1*, f2, f3, f4, f5, f5*
Their operation falls
within one operator
domain
Not standardized
Security algorithms use of a 128 bits block cipher and 128 bits value OP
Operator Variant Type: OP is a 128 bits value stored in USIM
|
OPc is a 128 bits value derived from OP and K Universal Subscriber Identity Module
User-specific subscriber authentication key (K) is stored in UICC

|
Securely distributed and stored in HSS Universal Integrated Circuit Card
(new generation SIM)
One-to-one mapping between a user’s IMSI and its K - K never leaves USIM
Milenage is a set of AES-128 based functions used in AKA
NAS and AS Security: AKA and SMC Process
Module-1.7: CBRS Overview and Building Blocks
CBRS Band: 150 MHz Spectrum-Technology Agnostic Use
3400 3550 3600 3650 3700 3800
LTE B42 LTE B43

3GPP LTE Band 48
150 MHz
CBSD = CBRS Service Device
CBRS by definition is a 150 MHz of RF spectrum in the 3.5 GHz band

3550-3700 MHz frequency range
Requires SAS based DSA scheme SAS: Spectrum Access System
CBRS deployments are governed by FCC Part-96 rules

CBRS Deployment: Geo-location Based Channel Assignment
A hi-power CBSD ( >23 dBm) has to communicate with the SAS, like an eNB.
Mutual authentication between FCC certified CBSD and SAS

The RAT base station is designated as CBSD (CBRS Service Device)
RAT: Radio Access Technology
CBSDs are fixed stations
Certain categories of RAT SS/UE/RT come under CBSD restrictions
SAS assigns a CBSD geo-location specific RF channels
CBSD updates SAS within 60 secs of changes to the data it had submitted
CBRS: Tiered Access to 150 MHz spectrum in 3.5 GHz Band
Tier-1: Incumbents
Access (IA) -exclusive
Access to the spectrum
Do not go to a SAS
Tier-2: Priority Access
License (PAL)
Must purchase a license
Tier-3: General Authorized Access (GAA)
Opportunistic use of full CBRS spectrum
Tiers 2 & 3 are regulated under the CBRS umbrella – FCC Part-96
SAS manages interference to protect IA from Tiers 2 & 3
Interference among Tier 2 devices and from Tier 3 into Tier 2
PAL: 3550-3650 MHz
Licensed by auction
10-year term
License areas: counties (2017)
Buys logical channels in
auction
SAS does logical to physical
channel mapping
PAL = 10 MHz in one county and up to 7 PAL licenses per county
Max 4 PAL channels per licensee
PAL: contiguous channels in same license area to the extent possible
Can temporarily move to non-contiguous channels to protect Incumbents
PAL can request for spectrum allocated for GAA - to augment capacity
Borrowed GAA channels do not have the same level of priority as PAL
PAL usage designated frequencies not in use may be utilized by GAA users
PAL can lease, partition and disaggregate or outright transfer licenses
CBRS Ecosystem: Device Classification
Device Max EIRP Max PSD Location Antenna

Type dBm/10 MHz (dBm/MHz) (HAAT)
Cat-B 47 (50 W) 37 outdoor fixed >6m
(CPI)
Cat-A 30 (1W) 20 In/outdoor < 6 m in
(24 dBm (fixed) outdoors
conducted)
EUD 23 (0.2W) N/A Mobility allowed
CBSD (CBRS Service Device) is the RAT base station (BTS-CBSD)

CBSD controls the End User Device (EUD)
EUD becomes a CBSD if exceeding 23 dBm/10 MHz EIRP - CPE-CBSD
Must report geo-data and antenna attributes
Location change requires re-registration with SAS
CAT-B CBSD requires CPI Installation CPI: Certified Professional Installer
CBSD measures the RF interference - essential for GAA operation
Co-channel and adjacent channels
CBSD Deployment and Operation: Restrictions
Category A (CBSD and CPE-CBSD): 30 dBm max EIRP

Indoor/outdoor with HAAT <6 m
Lower antenna gain and EIRP allowed compared to CAT-B devices
Category B (CBSD and CPE-CBSD): outdoors only
40 dBm max EIRP non-rural and 47 dBm max EIRP rural
CPI installation
Location Accuracy: ±50 m horizontal and ± 3 m vertical
Changes must be reported to the SAS within 60 secs of moving
Tx power control (TPC) in all CBSDs
EUD complies with TPC commands from CBSD and SAS – 10 secs grace time
TPC must ensure aggregate RSSI within a given PPA for any co-channel PAL shall
not exceed -80 dBm over a 10 MHz BW
Antenna placed at a height of 1.5m AGL
EUD declares FCC compliance to BTS-CBSD
Power reduction for 15 and 20 MHz channel size
EUD and CPE-CBSD: FCC Part-96.41/47
End User Device

|
EUD is a client of a CBSD base station
Fixed or mobile, capped at +23 dBm/10 MHz EIRP
Cell phone/tablets
It is invisible to the SAS
It only transmits if authorized by a CBSD (LTE eNB)
No CPI is involved CPI: Certified Professional Installer
CPE-CBSD is EUD exceeding 23 dBm/10 MHz EIRP
Categorized as Cat-B devices – high antenna gain UE
Must be registered with a SAS
Contacts SAS through the CBSD (eNB) it links up with on the air interface or
Close the loop with SAS using other options such as its Ethernet interface
Requires CPI
Both CBSD AND CPE-CBSD need to be authorized for the same frequency
CPE-CBSD and SAS Interactions
EUD is invisible to SAS: operates under control of a CBSD

CC Part-96 EIRP and emission limits apply
CPE-CBSD is visible to the SAS and is subject to CBSD rules
Links up with BTS-CBSD and contact SAS to obtain a grant
Must declare its current power level
Max time: 1 sec/10-sec period, 10 sec/300-sec period, or 20 sec/3600-sec period
Must use SAS specified operational parameters once it gets a grant
GAA Co-existence: DL/UL Compatibility
Mandatory E-UTRA TDD Configurations

TDD UL/DL Subframe Number
config ratio 0 1 2 3 4 5 6 7 8 9
1 4:4 D S U U D D S U U D
2 2:6 D S U D D D S U D D
FCC Part 96 rules allow multiple operators, different technologies and

unsynchronized transmissions to co-exist in the same frequency band
This makes interference mgmt an important requirement in CBRS deployments
CBRS coexistence focuses mainly co-channel use for TD-LTE
Use the same TDD configuration
CBSDs must align their frame boundaries
The SSF configuration for mandatory options is fixed to be SSF Config-7
The choice of a mandatory config is on first-come-first basis
Any UL/DL config and SSF config may be used provided:
All the TD-LTE CBSDs in a connected set use the same TDD config (UL/DL) and
Same SSF config

RCSP-RDL-6000-Mod-1 - LTE System-Tech-Overview-R1.3.2-V1.3a

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

RCSP-RDL-6000-Mod-1 - LTE System-Tech-Overview-R1.3.2-V1.3a

Uploaded by

Copyright:

Available Formats

RCSP-RDL-6000

Module-1: LTE System and Technology Overview

© Redline Communications Inc. 2021 All rights reserved.

 Module-1.1: LTE Overview, Building Blocks and Operation

• System features and capabilities referenced in this module are based

Module-1.1.1: LTE Network-Basic Definitions

 Capacity constraint between

UE Evolved Packet Core (EPC)

Rel-8: LTE Rel-9: LTE Rel-10 Rel-11 Rel-12

▪ Introduced LTE ▪ SON ▪ Carrier aggregation (CA) ▪ CA enhancements ▪ MTC ecosystem

 Rel-8/9 defines the LTE systems (EPS)

Data Flow LTE LTE-A 5G NR

 The fundamental channel capacity metric is the max

Module-1.1.2: LTE Core: Evolved Packet Core (EPC)

 EPC nodes can be co-located/distributed, each has specific tasks

 Interface: conceptual IP-based link connecting functions in different nodes

Default bearer for PDN1 S11

Default bearer for PDN2

 S5 to connect S-GW to (non-collocated) P-GW of same operator

 S8 connects the SGW in the VPLMN to the HPLMN PGW

LTE network is divided

Module-1.1.3: E-UTRAN Operation and Parameters

 eNB is the LTE base station

Min eNB to UE # of Cells

Wide Area Macro FCC/ETSI 70 dB 3-6 > 1 km 1200 Sector

Medium Area Micro ≤38 dBm 53 dB one 250 m ~ 1km Sector/Omni

Local Area Pico ≤24 dBm 45 dB one 100 ~ 300 m Omni

 Based on cell radius and Tx power (single antenna in eNB)

 eNB can have 1-256 radio cards (cell)

 LTE defines only 504 PCIs (0-503)

PCI Collision T-eNB

 No unambiguous way to notify the UE which eNB it must HO to

 PCI confusion: no eNB has PCI Confusion

) PCI allocation must pass mod3,

update (TAU) to its serving MME

OP-A EPC OP-A EPC

S1-Flex MME (Pool)

MOCN (multi-operator CN): each Shared RAN

Module-1.1.4: LTE UEs and their Capabilities

Rx Diversity Yes Yes No (1 Rx antenna)

DL Modulation QPSK, 16QAM, 64QAM ( 256QAM in CAT 11 onwards)

 Category specifies a UE’s DL/UL radio access capabilities- declares it to eNB

 Four Power class specifies the max Tx power of a UE in UL

 An LTE entity is assigned one

 eNB ID: uniquely identifies eNB in a PLMN (20 or 28 bits)

IMEI (Int’l ME ID) identifies device to the

GUTI (temp UE ID by MME – 80 bits): Identifies

GUMMEI 48 bits or less M-TMSI (32 bits): identifies MS

S-TMSI is the shortened form of the GUTI to enable more efficient

*ITU-T Recommendation E.213

 IMSI: permanent, globally unique OP assigned

 IP Address: dynamic and assigned by the PGW

7 7 100 1.00E-03 Voice, live streaming video, Interactive gaming

UE eNB SGW PGW PS

End to End Service

E-UTRAN EPC PDN

UE eNB SGW PGW

End to End Service

 Each dedicated bearer has an associated TFT - tied to UE’s IP add

 IP flows are the network traffic

UE eNB SGW PGW PDN

Traffic Flow Templates (TFT)

Dedicated EPS Bearer SDF1 QoS Policy

Module-1.1: LTE Overview, Building Blocks and Operation

Capacity constraint between

Rel-8/9 defines the LTE systems (EPS)

The fundamental channel capacity metric is the max

EPC nodes can be co-located/distributed, each has specific tasks

Interface: conceptual IP-based link connecting functions in different nodes

S5 to connect S-GW to (non-collocated) P-GW of same operator

S8 connects the SGW in the VPLMN to the HPLMN PGW

eNB is the LTE base station

Based on cell radius and Tx power (single antenna in eNB)

eNB can have 1-256 radio cards (cell)

LTE defines only 504 PCIs (0-503)

No unambiguous way to notify the UE which eNB it must HO to

PCI confusion: no eNB has PCI Confusion

Category specifies a UE’s DL/UL radio access capabilities- declares it to eNB

Four Power class specifies the max Tx power of a UE in UL

An LTE entity is assigned one

eNB ID: uniquely identifies eNB in a PLMN (20 or 28 bits)

IMSI: permanent, globally unique OP assigned

IP Address: dynamic and assigned by the PGW

Each dedicated bearer has an associated TFT - tied to UE’s IP add

IP flows are the network traffic

IP flows are classified to SDFs based on applicable TFT

TFTs are used in DL (PCEF) and UL (UE) to map SDFs to bearers

GTP-C to deliver signalling on

Add a header (2-3 bytes) data PDCP PDCP

Segmenting and concatenation PHY PHY

Used when PDU sizes are known a priori

Transport format selection PHY PHY

MAC builds the TB

Logical (7 DL, 3 UL): what type of data they carry - traffic/control

PBCH: vital system parameters - QPSK PBCH: Physical Broadcast CHannel

System BW, PHICH info, SFN and eNB Tx antenna configuration

C-Plane: signalling and NAS control

3GPP specifies bands when spectrum becomes available

Bands 66-71 as well as B252 and 255 (unlicensed bands)

A multi-carrier scheme using overlapping orthogonal narrowband

Input data is divided into N streams, each carried on a subcarrier

Depends on channel delay spread

LTE time parameters are expressed

OFDMA transmits the four QPSK data symbols in parallel

Resource Element (RE) Short CP

One subcarrier over one OFDM

DL channel size is indicated in

Transmits data symbols sequentially

SC-FDMA uses a DFT pre-coder followed by an OFDMA front-end

The extra subcarrier (DC) in DL is not used

Scheduling is updated every 1 msec (aka TTI)

Data rates correspond to:

LTE overhead as a rule of thumb is 25% of the total data rate

PRB Capacity = 12x7 = 84 symbols in 0.5 msec = (84/500) ∗106 sps

Spatial Diversity: robustness against channel transmission and diversity gain

“h” parameters reflect how signals are

RDL-6000 supports TM-2 and TM-3

eNB does the MCS selection

Payload goes through channel coding/rate-matching first

OFDM symbols are organized in time 0.5 msec slots (15360Ts)

FDD frame exists in DL and UL simultaneously

Ensures that DL and UL transmissions do not clash

Seven DL/UL config profiles (RDL-6000)

Ellipse-4G OAM allows only up to 4 symbols for GP – up to 39 Km range

UE must achieve symbol/frame

UE acquires essential cell parameters from PSS and SSS

PSS: 3 sequences corresponding

PSS: determines the 5 msec frame timing and position of SSS

DL Reference Signal (RS): pilot signals known to the cell and UE