Sie sind auf Seite 1von 341

Course 512

LTE Long Term Evolution


Introduction, Air Interface, Core Network, Operation

To download this course only:


http://scottbaxter.com/512.pdf

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 120
512 Course Contents
Introduction to LTE
LTEs place in the family of wireless technologies
LTE Features, Advantages, Comparison to prior wireless technologies
The LTE Air Interface
Basic signal structure, OFDM details, Downlink and Uplink structure
MIMO, Scheduling, Link Adaptation, Multicast MGSFN, MCH
LTE Core Network Architecture
SAE: The Evolved Packet Core Network Architecture
Network Functional Elements and Standard Interfaces
The Protocol Stack/Layers: Physical, MAC, RLC, PDCP, RRC, NAS
LTE Advanced
Carrier Aggregation, Multi-antenna solutions, relay technology
Current Hot Topics in LTE
Voice-over-IP: LTE voice techniques and legacy fallback
HetNets, Home eNBs, advanced integration

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 121
Introduction to LTE

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 122
Wireless Generations and Sector Data Speeds

EARLY ANALOG MTS, IMTS AutoTel

In the days before analog cellular, various wide-area mobile


telecommunications systems were used
They covered wide areas with only a few channels available
Voice calls only - the internet didn't even exist
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 123
Wireless Generations and Sector Data Speeds

1G AMPS: Analog Cellular NMT450, NMT900 LMR, SMR

EARLY ANALOG MTS, IMTS AutoTel

1G: When the first cellular systems launched, even though data
wasn't offered by the carriers, a few hardy users provided their own
(MNP10) modems for haphazard, slow data via dialup access
The internet wasn't a big factor yet!

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 124
Wireless Generations and Sector Data Speeds

2G CDMA IS-95, J-Std 008 TDMA: NADC, IS-136 TDMA: GSM, HSCSD TDMA: IDEN

1G AMPS: Analog Cellular NMT450, NMT900 LMR, SMR

EARLY ANALOG MTS, IMTS AutoTel

2G provided digital data but at low bit rates -- 9600 - 32k bps
Downloading a 2MB file took an hour or more (if it didn't drop in
the middle and require manually re-starting)
Travel agents with telephones were still faster than online res.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 125
Wireless Generations and Sector Data Speeds

153 200+
153 200+

2.5 G CDMA-2000, 1xRTT GPRS, EDGE

2G CDMA IS-95, J-Std 008 TDMA: NADC, IS-136 TDMA: GSM, HSCSD TDMA: IDEN

1G AMPS: Analog Cellular NMT450, NMT900 LMR, SMR

EARLY ANALOG MTS, IMTS AutoTel

When 1xRTT, GPRS, and EDGE became available, suddenly it


was possible to do direct IP web access at speeds of 150 kbps or
higher. This was better than dial-up speeds, especially via hotel
switchboards. Nerds and even some normal people on the road
were finally free to stay connected on-line
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 126
Wireless Generations and Sector Data Speeds

3.1M
1.8M 7M+
153 200+
3M+
153 200+

3G 1xEV-DO UMTS WCDMA HSPA

2.5 G CDMA-2000, 1xRTT GPRS, EDGE

2G CDMA IS-95, J-Std 008 TDMA: NADC, IS-136 TDMA: GSM, HSCSD TDMA: IDEN

1G AMPS: Analog Cellular NMT450, NMT900 LMR, SMR

EARLY ANALOG MTS, IMTS AutoTel

When the true 3G services 1xEV-DO and WCDMA/UMTS/HSPA


became available, wireless speeds were boosted into the Mb/s
range for downloading and approaching 1 Mb/s for uploading
Now mobile users had almost normal internet access, although
many networks had heavy congestion in dense usage areas
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 127
Wireless Generations and Sector Data Speeds
100M 100M
50M 50M
44M
22M
HSPA+
3.1M
1.8M 7M+
153 200+
3M+
153 200+

4G WiMAX LTE

3G 1xEV-DO UMTS WCDMA HSPA

2.5 G CDMA-2000, 1xRTT GPRS, EDGE

2G CDMA IS-95, J-Std 008 TDMA: NADC, IS-136 TDMA: GSM, HSCSD TDMA: IDEN

1G AMPS: Analog Cellular NMT450, NMT900 LMR, SMR

EARLY ANALOG MTS, IMTS AutoTel

The first WiMAX and LTE networks brought user speeds of up to


12 Mb/s and even 3G HSPA was enhanced to HSPA+, providing
nearly transparent internet usage for the first time.
4G Network buildouts were slow, with some carriers still building
only trial networks even in late 2011
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 128
Wireless Generations and Sector Data Speeds
1000M
100M 100M 500M
50M 50M
44M
22M
HSPA+
3.1M
1.8M 7M+
153 200+
3M+
153 200+

4G WiMAX LTE LTE adv.

3G 1xEV-DO UMTS WCDMA HSPA

2.5 G CDMA-2000, 1xRTT GPRS, EDGE

2G CDMA IS-95, J-Std 008 TDMA: NADC, IS-136 TDMA: GSM, HSCSD TDMA: IDEN

1G AMPS: Analog Cellular NMT450, NMT900 LMR, SMR

EARLY ANALOG MTS, IMTS AutoTel

Within 2 years of initial LTE buildouts,


Widespread use of MIMO is expected to boost speed 3-4x
LTE-Advanced technology is expected to boost speeds to 500-
1000 Mb/s for stationary downlink users
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 129
Wireless Generations and Sector Data Speeds
1000M
100M 100M 500M
50M 50M
44M
22M
HSPA+
3.1M

VOIP?

VOIP

VOIP
1.8M 7M+
153 200+
3M+
153 200+

4G WiMAX LTE LTE adv.

3G 1xEV-DO UMTS WCDMA HSPA

2.5 G CDMA-2000, 1xRTT GPRS, EDGE

2G CDMA IS-95, J-Std 008 TDMA: NADC, IS-136 TDMA: GSM, HSCSD TDMA: IDEN

1G AMPS: Analog Cellular NMT450, NMT900 LMR, SMR

EARLY ANALOG MTS, IMTS AutoTel

Finally the industry will settle on one or two VOIP standards for
LTE, voice traffic of legacy CDMA and GSM will finally go to LTE
Nearly all WiMax networks will finally convert to LTE
CDMA and LTE voice networks won't die until 2017 or even later!
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 130
Wireless Generations and Sector Data Speeds
1000M
100M 100M 500M
50M 50M
44M
22M
HSPA+
3.1M

VOIP?

VOIP

VOIP
1.8M 7M+
153 200+
3M+
153 200+

4G WiMAX LTE LTE adv.

3G 1xEV-DO UMTS WCDMA HSPA

2.5 G CDMA-2000, 1xRTT GPRS, EDGE

2G CDMA IS-95, J-Std 008 TDMA: NADC, IS-136 TDMA: GSM, HSCSD TDMA: IDEN

1G AMPS: Analog Cellular NMT450, NMT900 LMR, SMR

EARLY ANALOG MTS, IMTS AutoTel

1G: Users provided their own modems for haphazard, slow data
2G provided digital data but at low bit rates -- 9600 - 32k bps
3G data users finally passed 1 Mb/s in EV-DO and HSPA
4G users finally get10 Mb/s+
Page 131 Course 512 v3.0 (c)2013 Scott Baxter November, 2013
LTE Design Objectives

LTE was intended to be a major leap forward in performance compared to


the 3G technologies HSPA and EV-DO
LTE objectives as expressed in the early document TR25.913:
Gross data rate100 Mb/s in 20 MHz. for uplink, 50 Mb/s in 20 MHz. for
downlink, where separate uplink and downlink frequencies are used,
not taking into account multiplying effects available using MIMO
Control Plane (setup) Latency: camped to active <100 ms., dormant
to active <50 ms.
User Plane (data) Latency: 5 ms 1-way on unloaded network
# Active Users: >200 in 5 MHz., >400 in wider than 5 MHz. block
Distance: Full performance to 5 km, good to 30 km, up 100 km. is not
specified but to be substantially better than 3G technologies
Handoff Delay: negligible LTE-LTE, less than 512 ms LTE>GSM
Bandwidth scalable for incremental transition in existing spectrum
MBMS (Multimedia Broadcast Multicast Service) to allow about 16 TV
channels simultaneously in 5 MHz. at efficiency of about 1 b/s/hz

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 132
LTE
The Evolved Packet System (EPS) is purely IP based. Both real time
services and datacom services are carried by the IP protocol.
The outside IP address is allocated when the mobile is switched on
and released when it has been switched off for some time.
The new LTE radio signal uses OFDMA (Orthogonal Frequency
Division Multiple Access) to handle high data rates and volumes.
High order modulation (up to 64QAM), large bandwidth (up to 20
MHz) and MIMO transmission on the downlink (up to 4x4) is also
available. Up to 170 Mbps on uplink and 300 Mbps on the downlink!
The EPC core network can inter-work with Non-3GPP access such as
WiMAX, WiFi, CDMA and EV-DO.
Non 3GPP access solutions can be treated as trusted or non-trusted
(using independent security) based on operator requirements.
The LTE access network (RAN) is simply a network of base stations
(eNodeBs) in a flat architecture. There is no centralized intelligent
controller, and the eNBs are normally inter-connected by the X2-interface
and connected towards the core network by the S1-interface.
Distributing intelligence among eNodeBs speeds up connection set-up
and handovers, especially critical for some types of user traffic.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 133
LTE vs. LTE Advanced

Characteristic LTE LTE Advanced


DL: 100 Mbps DL: 1 Gbps
Peak Data Rate
UL: 50 Mbps UL: 512 Mbps
C-Plane: <100 ms C-Plane: <50 ms
Latency:
U-Plane: <5 ms usually U-plane: <5 ms always
Multiple Blocks,
Spectral Width One Block, up to 20 MHz
up to 100 MHz. +
DL: ~5 b/s/Hz DL: up to ~30 b/s/hz
Peak Spectral Efficiency
UL: ~2.5 b/s/Hz UL: up to ~15 b/s/Hz
Control-Plane At least 200 active in 5 >300 active in 5 MHz.
User Capacity MHz., 400 in > 5 MHz. without DRX, >600 in 5+

Many features of LTE-Advanced are already implemented in


current commercial-production network equipment
Data rate figures above do not include benefits of MIMO

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 134
Multiple Access Methods

FDMA FDMA: AMPS & NAMPS


Each user occupies a private Frequency,
Power protected from interference through physical
separation from other users on the same
frequency
TDMA: IS-136, GSM
Each user occupies a specific frequency but
TDMA only during an assigned time slot. The
Power frequency is used by other users during
other time slots.
CDMA
CDMA Each user uses a signal on a particular
frequency at the same time as many other
users, but it can be separated out when
Power receiving because it contains a special code
of its own

Page 135 512 v3.0 (c) 2013 Scott Baxter November, 2013
Highly Advanced Multiple Access Methods
OFDM OFDM, OFDMA
Orthogonal Frequency Division Multiplexing;
Orthogonal Frequency Division Multiple Access

Power
The signal consists of many (from dozens to
Frequency
thousands) of thin carriers carrying symbols
In OFDMA, the symbols are for multiple users
OFDM provides dense spectral efficiency and robust
resistance to fading, with great flexibility of use
Multiple-Antenna Techniques to Multiply Radio Throughput
MIMO MIMO
Multiple Input Multiple Output
An ideal companion to OFDM, MIMO allows
exploitation of multiple antennas at the base station
and the mobile to effectively multiply the throughput
for the base station and users
SMART ANTENNAS
Beam forming for C/I improvement and
interference reduction
Page 136 Course 512 v3.0 (c)2013 Scott Baxter November, 2013
Summary of Major Progress
in Wireless Communications
Cellular Frequency Reuse Concept
From No Frequency Reuse
with handoffs
Progress in
Network Configuration
to
and Frequency Reuse
B D
A C

Progress in TDMA (US)

1xRTT RC4

1xEV-DO
Analog*

CDMA
GPRS

EDGE
Signal GSM
UMTS HSPA LTE
Technology

Signal Bandwidth, MHz = 0.03 0.03 0.2 0.2 0.2 1.2 1.2 1.2 3.84 3.84 20
User Bits/Second = 9600* 28k 104k 160k 384k 360k 720k 3.1M 2M 8M 100M
Signal Efficiency bits/Hz = 0.3* 0.9 0.5 0.8 1.9 0.3 0.6 2.4 0.5 2.1 5.5
Frequency Reuse N = 7 7 3 3 3 1 1 1 1 1 ~3
MIMO factor = 1 1 1 1 1 1 1 1 1 1 4
Spectral Efficiency bits/Hz/Area = 0.04 0.13 0.17 0.27 0.63 0.3 0.6 2.4 0.5 2.1 7.3

Progress in
Devices

November, 2013 Course 512 v3.0.1 (c)2013 Scott Baxter Page 137
Introducing The LTE Air Interface

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 138
LTE Uses OFDM
Orthogonal Frequency Division Multiplexing

An LTE signal is made up of many


small ordinary radio signals
(subcarriers) standing together
The bundle could be from a few
dozen to over 1000 subcarriers,
whatever your spectrum can hold
subcarriers are on 15 kHz. steps
Each subcarrier can carry whatever bits we put on it
We can send a large amount of data very fast by splitting it up and
sending over a large number of subcarriers in parallel
Subcarriers are created and received using Discrete Fourier
Transforms, so they dont interfere (are orthogonal)
1980s technology would have needed an individual transmitter and
receiver for each subcarrier mobiles bigger than suitcases with
car batteries strapped on outside but modern LTE chipsets keep
a users equipment (UE) small and compatible with small batteries
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 139
FDD LTE: Frequency Division Duplex

Uplink Downlink eNodeB

706 716 730 740


1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.
The width of the LTE signal can be set to fill any authorized frequency block

UE When an operators licensed spectrum includes separate frequency


blocks for uplink and downlink, this is called Frequency Division
Duplex operation
The LTE standard contains a list of several dozen band classes,
different arrangements of the uplink and downlink blocks and their
frequencies as used in different countries around the world
Downlink is sometimes called Forward Link, and uplink called
Reverse Link
LTE mobiles are called User Equipment (UE)
LTE base stations are Enhanced Node-Bs (eNodeB, or eNB)

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 140
TDD LTE: Time Division Duplex
Downlink

Frequency

Uplink
In TDD, uplink and downlink take turns transmitting in a single block
of spectrum.
Operators choice of FDD or TDD operation is usually dictated by the
frequencies assigned by government
In FDD, the capacity of uplink and downlink is determined by the
spectrum allocated to each (usually equal)
In TDD, the relative capacity of uplink and downlink can be adjusted
to most closely match the actual distribution of uplink and downlink
traffic, getting greatest efficiency from available spectrum
The WiMAX standard was first developed in only a TDD version
The LTE technology was first developed in only an FDD version
Today both LTE and WiMAX have FDD and TDD versions
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 141
Orthogonal Frequency Division
Multiple Access - OFDMA

Uplink Downlink
Uplink spectrum is empty Downlink spectrum on active system
if no UEs are transmitting usually appears fully occupied
706 716 730 740
1.4, 3, 5, 10, 15 or 20 MHz. 1.4, 3, 5, 10, 15 or 20 MHz.

Whether FDD or TDD is used, transmission in each direction on


each subcarrier is scheduled in units of 1 millisecond (or multiples)
An LTE system dynamically schedules uplink and downlink
subcarriers based user needs and RF conditions to ensure
Efficiency each user gets their fair share of the resources and
the total resources are used effectively for greatest throughput
Quality of Service (QOS) each users type of traffic is
considered when assigning resources, to provide acceptable
quality (both in latency and throughput) for the user
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 142
The LTE Uplink Signal

The uplink uses SC-FDMA with some dynamic multiple of 4 15-khz


subcarriers to transmit the users information
Modulation can be QPSK, 16QAM or 64QAM for conditions
SC-FDMA has a low Peak-to-Average Power Ratio (PAPR)
which provides more transmit power and longer battery life
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 143
Current Wireless Spectrum in the US

CELL UPLINK

CELL DNLNK
Proposed AWS-2

AWS

AWS?
PCS
AWS PCS

SAT

SAT
IDEN

IDEN
700 MHz. Down- Down-
Uplink Uplink Link
Link

700 MHz 800 900 1700 1800 1900 2000 2100 2200
Frequency, MegaHertz
Modern wireless began in the 800 MHz. range, when the US FCC
reallocated UHF TV channels 70-83 for wireless use and AT&Ts
proposed analog technology AMPS was chosen.
Nextel bought many existing 800 MHz. Enhanced Specialized Mobile
Radio (ESMR) systems and converted to Motorolas IDEN technology
The FCC allocated 1900 MHz. spectrum for Personal Communications
Services, PCS, auctioning the frequencies for over $20 billion
With the end of Analog TV broadcasting in 2013, the FCC auctioned
former TV channels 52-69 for wireless use, the 700 MHz. band
The FCC also auctioned spectrum near 1700 and 2100 MHz. for
Advanced Wireless Services, AWS.
Technically speaking, any technology can operate in any band. The
choice of technology is largely a business decision by system operators.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 144
The US 700 MHz. Spectrum and Its Blocks

In the U.S., the former television channels 52-69 have been re-allocated
to wireless operators and public safety entities.
The Upper C block (striped red) is now used by Verizon Wireless in
virtually the entire U.S. with uplink in 776-787 MHz. and downlink in
746-757 MHz. Verizons partnership with rural operators has given it a
head-start in completing LTE service along virtually all interstate
highways and many surrounding rural areas.
AT&T has obtained the lower B and/or lower C block in many areas.
After considerable delay it is now well along in its national rollout.
Other operators also use lower A, B, and/or C blocks in many areas.
There is controversy over adjacency of lower A to TV channel 51.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 145
LTE Band
Classes

The LTE Band Classes


are listed in the ETSI
document 36.101 in the
table shown at left
Blocks 1-26 are for FDD,
Frequency-Division-
Duplex use
Blocks 33-43 are for
TDD Time-Division-
Duplex use
As new frequencies are
purposed for LTE around
the world, new band
classes will be added
VZW US: Bandclass 14
ATT US: Bandclass 17

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 146
LTE Subcarriers and Modulation

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 147
One LTE Subcarrier: What Can It Do?

Frequency,
KHz
-30 -15 FSC +15 +30

The LTE radio signal is made up of many individual little signals


called subcarriers, spaced 15 kHz apart in spectrum. A subcarrier
can carry information bits or reference signals.
Bits are carried by a subcarrier by one of three types of modulation.
The system chooses which type to use, reacting to instantaneous
radio conditions between each specific UE and eNB:
QPSK rugged but slow, for bad RF conditions
16QAM faster, but only works in fair conditions
64QAM very fast, but only for great conditions
The smallest atom of an LTE signal is one subcarrier during the
time while it transmits one symbol. This is a resource element.
Normal bursts of user data over LTE occupy many subcarriers for
many symbols; we dont schedule just one resource element alone.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 148
A Quick Introduction to Digital Modulation
Modulation
Modulation Possible Efficiency, SHANNONS
Schemes Scheme States Bits/S/Hz
CAPACITY EQUATION
BPSK 2 1 b/s/hz
Q QPSK S
QPSK *
8PSK
4
8
2 b/s/hz
3 b/s/hz
C = B log2 [ 1+ N
]
16 QAM * 16 4 b/s/hz B = bandwidth in Hertz
I 32 QAM 64 5 b/s/hz C = channel capacity in bits/second
64 QAM * 128 6 b/s/hz S = signal power
256 QAM 256 8 b/s/hz N = noise power

Q 16QAM In digital modulation, the signals amplitude and


phase are driven among several pre-defined values.
On a vector diagram, these points look like stars in
I a constellation. Each dot is called a symbol.
Simple modulation schemes have fewer symbols in
their constellations, and are easy to receive even
Q 64QAM through interference and noise. However, each
symbol only carries a few bits of information.
More complex modulation schemes have more
I
symbols in their constellations and each symbol
carries many bits of information. However, reception
is vulnerable to errors from interference, noise, or
distortion in amplifiers of the transmitter/receiver.
512 - 149 Course 512 v3.0- (c) 2013 Scott Baxter November, 2013
LTE Symbols Weapon against
Multipath Reflections: The Cyclic Prefix

LTE Symbol LTE Symbol LTE Symbol

UE
eNB

Radio signals in a mobile environment dont follow just one direct pathway
from transmitter to receiver. The signal travels over every possible path. The
receiver gets a jumble of what was transmitted, blurred in time.
On arrival, the boundary between one symbol and the next is fuzzy. A
symbol is sometimes interfered with by overlapping remnants of the symbol
sent just before of it. This is called intersymbol interference, ISI.
LTE exploits Discrete Fourier Transforms to overcome ISI. Each symbol
begins with a preview of its end value, called a cyclic prefix.
If the CP length is longer than the time-blurring of the radio channel, the
Discrete Fourier Transform can eliminate the intersymbol interference.
LTE systems have a normal CP length which nicely fits most situations. The
CP length can also be extended to get good performance in very reflective
areas such as big cities and mountain canyons, and in Multicast transmission.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 150
Normal and Extended Cyclic Prefix

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 151
The Smallest Assignable Traffic-Carrying
Part of an LTE signal: a Resource Block
A Resource Block is 12 subcarriers
carrying data for one-half millisecond.

Page 152 512 v3.0 (c) 2013 Scott Baxter November, 2013
LTE Frame Timing Structure
in Frequency Division Duplex (FDD)

Each LTE downlink subcarrier operates with radio frames 10


milliseconds long.
Each frame is made up of 10 subframes, each 1 millisecond long.
Each subframe contains 2 slots, each 512 microseconds long.
Normally, each slot carries seven modulated symbols, which could
be QPSK, 16QAM, or 64QAM, whatever is most appropriate for
the prevailing radio conditions.

Page 153 512 v3.0 (c) 2013 Scott Baxter November, 2013
LTE Frame Timing Structure
in Time Division Duplex (TDD)

When an LTE system has a single block of frequencies to use, it is


not possible to have simultaneous uplink and downlink.
Instead, Uplink and downlink must take turns using the available
frequency space. This is called Time Division Duplex, TDD
The frames for TDD LTE are 10 milliseconds long, just like FDD
Inside a frame, some subframes are used for uplink and some for
downlink. When transmission direction changes, there is a
transition subframe with a pilot timeslot for the ending link direction,
a guard period, and a pilot timeslot for the starting link direction.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 154
Possible LTE TDD Time Configurations

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 155
MIMO
Multiple Input Multiple Output

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 156
SISO, MISO, SIMO, MIMO

Single-Input Single-Output is the


default mode for radio links over the
years, and the baseline for further
comparisons.
Multiple-Input Single Output provides
transmit diversity (recall CDMA2000
OTD). It reduces the total transmit
power required, but does not increase
data rate. Its also a delicious
Japanese soup.
Single-Input Multiple Output is receive
diversity. It reduces the necessary
SNR but does not increase data rate.
Its rumored to be named in honor of
Dr. Ernest Simo, noted CDMA expert.
Multiple-Input Multiple Output is highly
effective, using the differences in path
characteristics to provide a new
dimension to hold additional signals
and increase the total data speed.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 157
SU-MIMO, MU-MIMO, Co-MIMO

Single-User MIMO allows


the single user to gain
throughput by having
multiple essentially
independent paths for data
Multi-User MIMO allows
multiple users on the
reverse link to transmit
simultaneously to the eNB,
increasing system capacity
Cooperative MIMO allows a
user to receive its signal
from multiple eNBs in
combination, increasing
reliability and throughput

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 158
LTE Channels

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 159
Downlink Physical Resources and Mapping
All Resource Blocks
Frequency

A Physical Resource Block

Time

A complete view of an FDD LTE Downlink Signal several MHz wide.

Page 160 512 v3.0 (c) 2013 Scott Baxter November, 2013
Frequency Uplink Physical Resources and Mapping

One or more 60-KHz. SC-FDMA carriers


of a UE, as assigned by the system

Time

Page 161 512 v3.0 (c) 2013 Scott Baxter November, 2013
Types of Channels in LTE

Logical Channels
A logical channel carries a specific traffic or control messaging
between the RLC and an upper-level entity
Transport Channels
The Transport channels carry information between Medium
Access Control (MAC) and higher layers.
Physical Channels
A physical channel holds content with bits mapped into the
appropriate format to be transmitted over the air interface
In addition to physical channels carrying user and control bits,
there are also physical signals
PSS: downlink Primary Synchronization Signal
SSS: downlink Secondary Synchronization Signal
RS: downlink demodulation Reference Signal
Uplink demodulation Reference Signal

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 162
Control
Shared Shared
Individual

Page 163
LTE Channels Logical, Transport, Physical

User

Traffic
Control
Random
Control Access Random Access
Public

Traffic
Multi- Multi-
MultiMedia

Media Media

Course 512 v3.0 (c)2013 Scott Baxter


Control
Control
Format
HARQ
Individual
User

Traffic
Control
Shared Paging

November, 2013
Control

Public
Paging Paging
Overhead Broadcast Broadcast
Overhead Overhead
Downlink Physical Signals and Channels

Downlink Physical Signals


Reference Signal (RS)
Pilot used for DL channel estimation. Derived from cell ID (one of 3x168=504 PN Sequences)
Primary Synchronization Signal (P-SCH)
Signal used by UE for initial cell acquisition codes 0, 1, or 2
Secondary Synchronization Signal (S-SCH)
Signal used by UE for initial cell acquisition 168 different codes
Downlink Physical Channels
Physical Broadcast Channel (PBCH)
Broadcasts system information, including MIB and SIBs
Physical Downlink Shared Channel (PDSCH)
Shared channel for user data, radio/core network, System information (BCH), paging messages.
Physical Downlink Control Channel (PDCCH)
Shared signaling channel for allocation of resources for the PDSCH.
Physical Control Format Indicator Channel (PCFICH)
Defines number of PDCCH OFDMA symbols per Sub-frame (1, 2, or 3)
Physical Hybrid-ARQ Indicator Channel (PHICH)
Carries HARQ ACK/NACK
Physical Multicast Channel (PMCH)
Carries the MCH Transport channel

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 164
Uplink Physical Signals and Channels

Uplink Physical Signal


Reference signal (RS)
Reference signal used for demodulation and sounding
Used for synchronization to the UE and UL channel estimation
Uplink Physical Channels
Physical Uplink Shared Channel (PUSCH)
Shared channel used to carry user data..
Physical Uplink Control Channel (PUCCH)
Shared signaling channel for UE to request PUSCH resources
Physical Random Access Channel (PRACH)
Shared channel used for the access procedure, Call setup
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 165
Downlink Resource Grid Details

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 166
Resource Allocation in LTE

Resources in LTE
Resource Element, Resource Block, Slot, Sub-frame
Resource Grid
Control Information Resourced Allocation
Physical Channels, PDCCH, DCI
REG Resource Element Groups
Traffic Resource Allocation
Resource Block Group (RBG) based
RBG Subset based
Virtual Resource Block (VRB)-based
Interactive LTE downlink signal demonstration:
http://paul.wad.homepage.dk/LTE/lte_resource_grid.html

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 167
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 168
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 169
Example of RS Sequences for
1, 2, and 4 Antennas
Notice when one antenna is transmitting a
reference symbol, the other antennas are silent

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 170
How REGs and Reference Signals Fit
Heres an example of
how REGs and
Reference Symbols fit
into the resource grid
The Downlink Control
Indicator (DCI) carries
the information a UE
needs to know
Which resource
blocks carry my
data?
What modulation
scheme is used
for my data?
Whats the
starting resource
block for my
data?

Page 171 512 v3.0 (c) 2013 Scott Baxter November, 2013
Whats a DCI?

The Downlink Control Indicator (DCI), carried in one or more REG


resource element groups, carries the information a specific UE
needs to know:
Which resource blocks carry my data?
What modulation scheme is used for my data?
Whats the starting resource block for my data?

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 172
LTE Resource Allocation and PDCCH Support

There are 10 DCI formats for indicating downlink scheduling, in


three broad types.
There is one DCI format for assigning uplink scheduling.

A Control Channel Element (CCE) consists of 9 Resource Element


Groups (REG).

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 173
DCI Formats and Resource Allocation

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 174
Resource Allocation type 0

In type 0 resource allocation, a bit map represents a resource


block group (RBG) allocated to a UE.
The size of RBG is given by P, which can be found in TS
36.213 Table 7.1.6.1-1 for the system bandwidth.
Each bit in the Bitmap indicates a small contiguous group
whose size depends on the bandwidth (RBG: 14).
The maximum resource block (RB) coverage of any type 0
allocation is the whole signal bandwidth. A type 0 allocation
with all the bits in bitmap set to 1 means the whole signal.
Example
For 50 RB Bandwidth, the number of bits in Bitmap are 17.
Each bit in the 17 bit bitmap selects a group of 3 RB (apart
from the last group which will only contains 2 RB for this BW).
Each bit is associated with a group of RE with the same color.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 175
Resource Allocation Type 1
Type 1 resource allocation uses a bit map to indicate physical resource blocks
inside an RB subset p, where 0 p < P. Even with all the bits in the Bitmap set
to 1, it does not span the whole signal bandwidth. Each bit in the bitmap selects a
single RB from islands of small contiguous groups whose size (RBG) and
separation depend on the total bandwidth. This allows selecting individual RBs.
Resource block assignment signaling is split into 3-parts:
RBSubset, Shift (whether to apply an offset when interpreting), and Bitmap
indicating the specific physical resource block inside the resource block group
subset. This makes Type 1 bitmap sizes smaller by [log2 (P)]+1 than Type 0.
Example 50 RB Bandwidth, the number of bits in Bitmap are 14. Each bit
selects one RB inside a selected subset. If all bits are set to one, we get:

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 176
Resource Allocation type 2

In Type 2 resource allocation, physical resource blocks are not


directly allocated. Instead, virtual resource blocks are allocated
which are then mapped onto physical resource blocks.
Type 2 allocation supports both localized and distributed virtual
resource block allocation differentiated by one bit-flag.
The information regarding the starting point of virtual resource
block and the length in terms of contiguously allocated virtual
resource block can be derived from Resource Indication Value
(RIV) signaled within the DCI.
Example 50 RB Bandwidth:
UE is assigned an allocation of 25 resource blocks (LCRBs =
25), starting from resource block 10 (RBstart = 10) in the
frequency domain.
To calculate the RIV value see the formula in TS 36.213
Section 7.1.6.3, which yields RIV = 1210. This RIV is signaled
in DCI and the UE can determine the starting resource block
and the number of allocated resource blocks from the RIV.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 177
Non-Hopping and Hopping
Uplink Resource Allocation
Non-Hopping Uplink Resource Allocation
Type 2 localized resource allocation rules allow deriving the resource
allocation from the RIV value.
Uplink Hopping Resource Allocation two types of hopping exist:
Type 1 PUSCH Hopping
Type 1 PUSCH Hopping is calculated using the RIV value and a
number of parameters signaled by higher layers;
Type 2 PUSCH Hopping (not the same thing as downlink resource
allocation type 1 and type 2 described earlier) is calculated using a
pre-defined pattern (a function of subframe/frame number) defined in
TS36.211 5.3.4.
The fundamental set of resource blocks is calculated from the rules for
type 2 localized resource allocation from the RIV value, except either 1 or
2 hopping bits deduced from bandwidth and resource allocation bitmap.
These hopping bits specify whether Type 1 or Type 2 PUSCH
Hopping is to be used, and for the case of 2 bits, variations of the
position of the Type 1 hopping in the frequency domain. The
definition of the hopping bits is in TS 36.213 Table 8.4-2.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 178
Intercell Interference

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 179
LTEs Achilles Heel:
Intercell Interference and its Coordination

LTE signals are unlike CDMA the traffic channels of different


cells are not coded orthogonally different from each other
Cochannel interference will result if adjacent cells use adjacent
frequncies to serve distant UEs in the border areas
The LTE standards provide methods for cells to communicate their
present loading to one another
LTE manufacturers are allowed to develop their own algorithms for
cells to dynamically coordinate the subcarriers used to serve their
various mobiles to avoid interference as much as possible
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 180
Scrambling in LTE
LTE is conceived assuming a
frequency reuse rate of 1, using all
available frequencies in all cells of
the system.
Although LTE does not use
CDMA codes to differentiate
cells, it does perform
information scrambling at the bit
level.
LTE scrambling codes are Pseudo-
random sequences defined by a
length-31 Gold code.
Each type of physical channel uses
a different scrambling code. The
scrambling code used in the
downlink is not the same all the
time.
It is determined by UE Identity, and
also related with the channel
type/format associated with service.
The table at right shows the
scrambling methods by channel.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 181
The LTE Core Network

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 182
Circuit-Switched vs. Packet-Switched
MME
HLR BSC
MSC BTS P GW S GW
MS Internet UE
PSTN TRC VPNs
eNB
For voice calls, the original cellular technologies used circuit-switched connection a
steady circuit as long as the call lasts.
The voice path from a mobile to a landline phone was steady:
Continuous radio transmission between phone and BTS
Continuous bitstream from BTS over backhaul to the BSC
Continuous trunk: BSC thru Switch to destination phone
Even during a pause in conversation, the links stayed up
Data sent over cellular uses Packet-switched methods
The flow of data occurs in instantaneous spurts as needed
No steady signal between phone and BTS; the radio signal in each direction
exists only when a packet is being sent
Data goes between BTS and BSC intermittently as packets
Data from the BSC goes through routers to and from the internet
intermittently, as packets
GPRS, EDGE, 1xRTT, EV-DO, HSPA and LTE systems are all packet-switched
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 183
The LTE Evolved Packet Core Network, EPC
In the wireless data technologies
before LTE, there were many
proprietary network elements
Especially the Base Station
Controllers and Radio Network
Controllers, which used
manufacturer-proprietary
messages and link formats to
reach the base stations
The BSC/RNC had to be the same
brand of equipment as the BTS
One of the goals of the LTE standard is to eliminate proprietary devices and
allow different brands of equipment to work together
The intelligence for scheduling data bursts and arranging handoffs has
been standardized and moved into the eNodeBs
This means no proprietary BSC or RNC is needed
Standard TCP/IP techniques are used for all data movement
A new standardized non-proprietary Mobility Management Entity (MME)
is the intelligent matchmaker guiding setup of data sessions, handoffs,
and other processing events
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 184
EPC Elements

Serving GW, PDN GW The Serving and PDN gateways transport the IP
data traffic between User Equipment (UE) and external networks.
The Serving GW connects the radio-side and the EPC.
The PDN GW connects EPC and external IP networks (PDN).
MME The Mobility Management Entity handles the control plane, in
particular signaling related to mobility and security for UEs. It handles UE
tracking and paging, and is the termination point of the NAS.
HSS The HSS (Home Subscriber Server) is a database that contains
user and subscriber information. It provides support functions in mobility
management, call and session setup, user authentication and access
authorization. Its a combination of Home Location Register (HLR) and
Authentication Center (AuC) functions.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 185
Functions of the Evolved Packet System
and the Evolved Packet Core Elements
E-UTRAN
eNB
Inter-cell RMM

RB Control EPC
Connection Mobility Ctrl
MME
Radio Admission Ctrl.
NAS Security
eNB Measurement
Config. & Provision
Idle State Mobility
Dynamic Resource Handling
Allocation (scheduler)
EPS Bearer
Control
RRC

PDCP
S-GW P-GW
RLC
Mobility UE IP Address
Anchoring Allocation
MAC Internet
S1
PHY Packet Filtering

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 186
Networking Functional Elements
(eNB; MME; Anchors/Gateways, PCRF; HSS)
Legacy GSM radio Networks

GERAN Gb
Policy and Charging Rules Function

SGSN GPRS CORE PCRF


UTRAN Iu S7 Rx+
S3 S4

S5b
Home Subscriber Server

S5a
WCDMA /HSPA radio Networks Super HLR
Ref Pt.
Mobility Management Entity S6a HSS
User Plane Entity

S1 SGi Outside IP
Evolved MME Serving PDN World: The
RAN: eNB UPE Gateway Gateway
Ref Pt. Internet
LTE radio Inter Access System Anchor IASA
Networks

Uu Evolved Packet Core


S2a S2b,c
1xRTT, CDMA2000, Non-3GPP WLAN 3GPP
EV-DO networks
IP access IP access

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 187
Key Network Interfaces (1)

Uu The LTE physical layer interface connecting the UE with the


eNodeB on both uplink and downlink directions (GTP-U Protocol)
S1-MME The Control Plane (command and control) connection
from the eNB to the MME managing user mobility (GTP)
S1-U The User Plane (traffic-carrying) connection from the eNB
to the serving gateway (GTP protocol)
S2a PDN link to trusted non-3GPP networks (CDMA EVDO)
(based on proxy mobile IP, can use client mobile IP FA mode)
S2b PDN link to serving gateway for an untrusted network GTP
(based on proxy mobile IP)
S2c PDN link to trusted non-3GPP network (CDMA, EVDO) GTP
(based on client mobile co-location)
S3 Connection between 2G/3G SGSN and SAE MME (GTP)
S4 -- Provides user plane connection and mobility support
between a 2G/3G SGSN and the SGW (based on Gn reference
point defined between SGSN and GGSN) (GTP protocol)

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 188
Key Network Interfaces (2)

S5 Provides user plane tunneling and tunnel management


between SGW and PDN GW. Handles S GW relocation for UE
mobility if the S GW must connect to a non-collocated PDN GW.
S5 is the intra PLMN variant of S8.
S6a Carries subscription and authentication data between the
MME and the HSS (often called a super HLR)
S7 Carries policy and charging rules information between the
PDN gateway and the PCRF
S8 Inter-PLMN reference point providing user and control plane
between the Serving GW in the VPLMN and the PDN GW in the
HPLMN. S8 is the inter PLMN variant of S5.
S9 - Transfers (QoS) policy and charging control information
between Home/Visited PCRF to support local breakout function.
S10 -- Reference point between MMEs for MME relocation and
MME to MME information transfer

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 189
Key Network Interfaces (3)

S11 -- Reference point between MME and Serving GW


S12 Connection from UTRAN to Serving GW during user plane
Direct Tunnel. Based on Iu-u/Gn-u ref. point and GTP-U protocol
SGSN-to-UTRAN or SGSN-to-GGSN. Optional by Operator.
S13 Enables UE identity check between MME and EIR
SGi -- Reference point between PDN GW and packet data
network. Packet data network can be external public, private, or
intra-operator packet data network, e.g. for provision of IMS.
Corresponds to Gi interface for 3GPP accesses.
Rx -- The Rx reference point resides between the AF and the
PCRF in the TS 23.203 [6].
Wn* The reference point between the Untrusted Non-3GPP IP
Access and the ePDG. Traffic on this interface for a UE initiated
tunnel must be forced towards the ePDG.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 190
Key Network Interfaces (4)

X2 -- The X2 interface can provide


inter-connection of eNBs supplied by different manufacturers;
support of continuation between eNBs of the E-UTRAN
services offered via the S1 interface;
separation of X2 interface Radio Network functionality and
Transport Network functionality to facilitate introduction of
future technology.
SBc:- Reference point between CBC and MME for warning
message delivery and control functions

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 191
X1 and S1 Interfaces

Another advantage with the distributed solution is that the MAC


protocol layer, which is responsible for scheduling, is represented only
in the UE and in the base station leading to fast communication and
decisions between the eNB and the UE.
In UMTS the MAC protocol, and scheduling, is located in the
controller and when HSDPA was introduced an additional MAC
sub-layer, responsible for HSPA scheduling was added in the NB.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 192
LTE Scheduling

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 193
Resource Allocation in LTE

Resources in LTE
Resource Grid, Resource Block, Slot, Sub-frame
Control Information
Physical Channels, PDCCH, DCI
Resource Allocation
Resource Block Group (RBG) based
RBG Subset based
Virtual Resource Block (VRB)-based
Helpful Link: very useful utility showing LTE resource grid
http://paul.wad.homepage.dk/LTE/lte_resource_grid.html

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 194
The Downlink Scheduler

The Downlink Scheduler must manage the assignment of


resource blocks to users for the downlink shared channel, and the
Modulation and Coding Schemes (MCS) to be used on
transmissions to individual UEs.
The scheduler is ultimately responsible for maximizing the overall
throughput through each EnodeB and the data delivered to the
users.
In order to correctly manage the air resources, the Downlink
Scheduler must be aware of the data waiting to be sent and
frequently receive channel RF condition details from the UEs.
Amount and type of data waiting to be sent to each UE
Channel RF condition (CQI) measurements from each UE

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 195
The Uplink Scheduler

The Uplink Scheduler must manage the assignment of resource


blocks to users for the uplink shared channel
The mechanism is similar to the Downlink Scheduler but the
directions are reversed
Uplink Channel quality measurements are made by the
eNodeB
Mobiles report the data in their buffers ready to be sent and
request authority to begin transmission
The uplink scheduler applies QOS and throughput
maximization strategies to achieve an optimum user
experience

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 196
LTE Scheduling

The eNodeB allocates physical layer resources for the uplink and
downlink shared channels (UL-SCH and DL-SCH). Resources are
composed of Physical Resource Blocks (PRB) and Modulation
Coding Scheme (MCS). The MCS determines the bit rate, and
thus the capacity, of PRBs. Allocations may be valid for one or
more TTIs; each TTI interval is one subframe (1 ms).
Semi-persistent scheduling reduces control channel signaling. If
every allocation was individually signaled, the overhead would be
unacceptable. In an application such as voice over IP, for example,
a downlink frame occurs every 10 to 20 milliseconds. If each
downlink frame were signaled individually, it would cause a lot of
traffic on the control channel and the control channel would need a
lot more bandwidth than necessary. Semi-persistent scheduling
lets you set up an ongoing allocation that persists until it is
changed. Semi-persistent schedules can be configured for both
uplink and downlink.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 197
Scheduling: Transmission Time Interval (TTI)

The scheduler is the main player in rapidly utilized radio resource. The
smallest Transmission Time Interval (TTI) is only 1 ms.
During each TTI the eNB scheduler:
considers the physical radio environment per UE. The UEs report
received radio quality to the scheduler which decides which
Modulation and Coding scheme to use. The scheduler rapidly adapts
to channel variations, using HARQ (Hybrid Automatic Repeat
Request), soft-combining, and rate adaptation.
prioritizes QoS requirements among the UEs. Both delay sensitive
and rate-sensitive data services are accomodated.
informs UEs of their allocated downlink and uplink radio resources.
Each UE scheduled in a TTI gets a Transport Block (TB) carrying its data.
On downlink there can be a maximum of two TBs generated per UE if
using MIMO. The TBs are delivered over a transport channel.
The user plane has only one shared channel in each direction. The TB
can contain bits from several services, multiplexed together.
In theory the highest number of users that can be scheduled during 1
ms is 440, presuming 20 MHz band and 4x4 Multi User MIMO.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 198
Downlink: Dynamic Scheduling

The PDCCH carries the Cell Radio Network Temporary Identifier


(C-RNTI), the dynamic UE identifier. The CRNTI indicates that an
upcoming downlink resource has been demultiplexed by the MAC,
passed on to higher layers and is now scheduled for this UE.
Semi-persistent scheduling periodicity is configured by RRC.
Whether scheduling is dynamic or semi-persistent is indicated by
using different scrambling codes for the C-RNTI on PDCCH. The
PDCCH is a very low-bandwidth channel; it does not carry a lot of
information compared to the downlink shared channel.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 199
Downlink Semi-Persistent
and Dynamic Scheduling

This figure adds semipersistent scheduling information to the


information already presented. Here, the RRC configures some of
the semipersistent scheduling. This shows a four-TTI example.
The first time it actually occurs there is signaling on the PDCCH.
After that, every four TTIs there is a transmission which occurs
without any signaling on the control channel. You can still use
dynamic scheduling at the same time for other purposes if
necessary; this carries on until changed by another indication on
the control channel.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 200
Downlink Scheduling with HARQ

Again, the C-RNTI is found on the PDCCH, indicating that an upcoming


downlink resource is scheduled for this UE.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 201
Downlink Scheduling with HARQ

This figure shows the ACK/NACK process. HARQ generates an ACK or


NACK, sent on L1/L2 control channel (PUCCH) on subframe n+4, for
each downlink transport block. Here there is a negative
acknowledgement, so a subframe needs to be retransmitted using HARQ.
The retransmission is signaled dynamically and downlinked, then decoded
and sent up to higher layers. Finally the subframe has to be
acknowledged again. The process can become fairly complicated when
both acknowledgements and semipersistent scheduling are involved.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 202
Uplink Scheduling with HARQ

As with the downlink, uplink scheduling information is found on the


PDCCH. The C-RNTI indicates that an upcoming uplink resource
is scheduled for this UE in 4 TTI. The 4 TTI delay gives the UE
time to dequeue, determine the proper priority and determine the
best way to pack that transport block with information based on the
QoS requirements of the scheduler that its running locally.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 203
ACK/NACK Process in Uplink Scheduling

This figures shows the ACK/NACK process. The Physical HARQ Indicator Channel
(PHICH) is a special channel for providing feedback from the eNodeB back to the
UE on the uplink HARQ process. It carries ACK/NACK messages for uplink data
transport blocks. HARQ is synchronous, with a fixed time of 4 TTI from uplink to
ACK/NACK on the downlink from the eNodeB. The eNodeB responds back with an
opportunity to retransmit which is then scheduled and retransmitted. Although this
illustration does not show the positive acknowledgement after that, it would occur.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 204
Waking Up with a UE:
LTE Call Processing

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 205
System Acquisition
Searching In Frequency Searching In Time

At power-up, the UE notes its LTE band class capabilities and begins
exploring all the possible center frequencies that might be hold the SCH
The UE first looks for the primary synchronization signal (P-SCH) in the
last OFDM symbol of the first time slot of the first subframe (subframe 0)
in each radio frame. It reads symbol timing, and learns which of three cell
identities is being transmitted, and locks its frequencies to the eNB.
The UE next searches for the (S-SCH) secondary synchronization signal,
and learns which of 170 cell identities it carries. From this it decodes the
PCI, physical cell identity, and the frame boundaries
The UE next finds the RS sequence and learns antenna port configuration
Now the UE can decode the P-BCH and apply cell selection and
reselection criteria

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 206
Cell Reselection (Idle Mode Handover)

The mobile is in power-conservation mode


Does not inform network of every cell change; rather, just when
it detects entry into a new Tracking Area
UE-terminated calls are paged in the UEs last reported TA
TA organization and procedures have been widely debated
Static non-overlapping TAs were used in earlier technologies
New techniques reduce ping-ponging, distribute TA update
load more evenly across cells, and reduce aggregate TA
update load
Mechanisms include overlapping TAs, multiple TAs, and
distance-based schemes

November, 2013 Course 502 v3.0.1 (c)2013 Scott Baxter Page 207
Cell Search Measurements

An LTE UE measures reference signal RSRP (Reference Signal Received


Power) and RSRQ (Reference Signal Received Quality).
RSRP is a RSSI type of measurement. It measures the average received
power over the resource elements that carry cell-specific reference signals
within certain frequency bandwidth.
RSRQ is a C/I type of measurement and it indicates the quality of the
received reference signal, defined as (N*RSRP)/(E-UTRA Carrier RSSI),
N ensures the nominator and denominator are measured over the
same frequency bandwidth;
carrier RSSI measures the average total received power observed
only in OFDM symbols containing reference symbols for antenna port
0 in the measurement bandwidth over N resource blocks. The total
carrier RSSI includes all incoming RF from all sources.
RSRP is applicable in both RRC_idle and RRC_connected modes, while
RSRQ is only applicable in RRC_connected mode.
In the procedure of cell selection and cell reselection in idle mode, RSRP
is used. In the procedure of handover, the LTE specification provides the
flexibility of using RSRP, RSRQ, or both.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 208
Physical Layer Measurements Definition

Physical layer measurements to support mobility are classified as:


within E-UTRAN (intra-frequency, inter-frequency);
between E-UTRAN and GERAN/UTRAN (inter-RAT);
between E-UTRAN and non-3GPP RAT (Inter 3GPP access
system mobility).
For measurements within E-UTRAN at least two basic UE
measurement quantities shall be supported:
Reference symbol received power (RSRP);
E-UTRA carrier received signal strength indicator (RSSI).

November, 2013 Course 502 v3.0.1 (c)2013 Scott Baxter Page 209
LTE Measurement: RSSI

LTE Carrier Received Signal Strength Indicator (RSSI)


Definition: The total received wideband power observed by the UE
from all sources, including co-channel serving and non-serving
cells, adjacent channel interference and thermal noise within the
bandwidth of the whole LTE signal.
Uses: LTE carrier RSSI is not used as a measurement by itself,
but as an input to the LTE RSRQ measurement.

LTE Downlink

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 210
LTE Measurement: RSRP

LTE Reference Signal Received


Power (RSRP)
Definition: RSRP is the linear
average power of the
Resource Elements (REs)
carrying a specific cells RS
within the considered
measurement frequency
bandwidth.
Uses: Rank cells for
reselection and handoff.
Notes: Normally based on the
RS of the first antenna port, but
the RS on the second antenna
port can also be used if they
are known to be transmitted.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 211
LTE Measurement: RSRQ

RB RB RB RB RB RB RB RB RB RB RB RB

LTE Reference Signal Received Quality (RSRQ)


Definition: RSRQ = N RSRP / RSSI
N is the number of Resource Blocks (RBs) of the LTE carrier
RSSI measurement bandwidth. Since RSRQ exists in only one
or a few resource blocks, and RSSI is measured over the
whole width of the LTE signal, RSRQ must be scaled up for a
fair apples-to-apples comparison with RSSI.
Uses: Mainly to rank different LTE cells for handover and cell
reselection decisions
Notes: The reporting range of RSRQ is defined from 19.5 to 3
dB with 0.5 dB resolution. -9 and above are good values.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 212
S Cell Selection and Reselection criteria

After finding a cell, the UE may or may not be permitted to use it,
based on various signal quality criteria broadcast by the eNB.
Here are two procedures for cell qualification:
In the initial cell selection procedure, no knowledge about RF
channels carrying an E-UTRA signal is available at the UE.
In that case the UE scans the supported E-UTRA
frequency bands to find a suitable cell. Only the cell with
the strongest signal per carrier will be selected by the UE.
The second procedure relies on information about carrier
frequencies and optionally cell parameters received and stored
from previously-detected cells.
If no suitable cell is found using the stored information the
UE starts with the initial cell selection procedure.
S is the criterion defined to decide if the cell is still suitable . This
criterion is fulfilled when the cell selection receive level is Srxlev >
0. Srxlev is computed based on the following Equation:
November, 2013 Course 502 v3.0.1 (c)2013 Scott Baxter Page 213
S Cell Selection and Reselection criteria
Srxlev = Qrxlevmeas (Qrxlevmin + Qrxlevminoffset) Pcompensation
Where Pcompensation = max (PEMAX PUMAX, 0)
All in db

Qrxlevmeas is the UE-measured receive level value for this cell, i.e.
the Reference Signal Received Power (RSRP
Qrxlevmin is the minimum required receive level in this cell, in dBm.
Qrxlevminoffset is an offset to Qrxlevmin that is only taken into
account as a result of a periodic search for a higher priority PLMN
while camped normally in a Visitor PLMN (VPLMN).
PCompensation is a maximum function. PEMAX is maximum power
allowed for a UE in this cell. PUMAX is maximum for power class
A UE may discover cells from different network operators.
First the UE will look for the strongest cell per carrier,
Then the PLMN identity from the SIB Type 1 to see if suitable,
Then it will compute the S criterion and decide if suitable

November, 2013 Course 502 v3.0.1 (c)2013 Scott Baxter Page 214
Getting Needed Cell Parameters:
Information Blocks

inter

The Master Information Block (MIB) gives the basic signal configuration
and bandwith
System Information Block 1 declares what other information blocks exist,
and the mobile goes about collecting all their contents
The MIB and SIB1 are carried by the BCH channel; all the other SIBS are
carried by the DL-SCH
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 215
Special Details for TDD

In TDD, the Primary synchronization signal (PSS) is placed at the


third symbol in subframes #1 and #6.
The Secondary Synchronization signal (SSS) is placed at the last
symbol in subframes #0 and #5.
The S-RACH is transmitted on the UpPTS within the special frame
The Primary Broadcast Channel (PBCH) and the Dynamic
Broadcast Channel (D-BCH) are located just as in LTE FDD.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 216
UE (Mobile) Categories

November, 2013 Course 512 (c)2013 Scott Baxter Page 217


LTE UE Categories

Why have Categories for Ues?


The LTE UE categories or UE classes are needed to ensure that
the base station (eNodeB) and mobiles (UEs) know each others
capabilities and can communicate correctly. By relaying the LTE
UE category information to the base station, it is able to determine
the performance of the UE and communicate with it accordingly.
As the LTE category defines the overall performance and the
capabilities of the UE, it is possible for the eNB to communicate
using capabilities that it knows the UE possesses. Accordingly the
eNB will not communicate beyond the performance of the UE.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 218
LTE UE Category Definitions
Data Rates by UE Category

Modulation Types by UE Category

MIMO Capabilities by UE Category

Five different LTE UE categories are defined with a wide range of


supported parameters and performance.
Bandwidth for all categories is 20 MHz.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 219
LTE Power Save Operation

In wireless data communication, the receiver uses significant


power for the RF transceiver, fast A/D converters, wideband signal
processing, etc. As LTE increases data rates by a factor of 50 over
3G, wireless device batteries are still the same size, so substantial
improvements in power use are necessary to operate at these very
high rates and wide bandwidths. Some of that savings comes from
hardware, some from system architecture and some from the
protocol.
Wireless standards employ power save mechanisms. The
objective is to turn off the radio for the most time possible while
staying connected to the network. The radio modem can be turned
off most of the time while the mobile device stays connected to
the network with reduced throughput. The receiver is turned on at
specific times for updates.
Devices can quickly transition to full power mode for full
performance.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 220
DRX and DTX

LTE power save protocols include Discontinuous Reception (DRX)


and Discontinuous Transmission (DTX). Both involve reducing
transceiver duty cycle while in active operation. DRX also applies
to the RRC_Idle state with a longer cycle time than active mode.
However, DRX and DTX do not operate without a cost: the UEs
data throughput capacity is reduced in proportion to power
savings.
The RRC sets a cycle where the UE is operational for a certain
period of time when all the scheduling and paging information is
transmitted. The eNodeB knows that the UE is completely turned
off and is not able to receive anything.
Except when in DRX, the UE radio must be active to monitor
PDCCH (to identify DL data). During DRX, the UE radio can be
turned off. This is illustrated in the figure above.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 221
Long and Short DRX

In active mode, there is dynamic transition between long DRX and short
DRX. Durations for long and short DRX are configured by the RRC. The
transition is determined by the eNodeB (MAC commands) or by the UE
based on an activity timer. The figure shows DRX cycle operation during a
voice over IP example. A lower duty cycle could be used during a pause in
speaking during a voice over IP call; packets are coming at a lower rate,
so the UE can be off for a longer period of time. When speaking resumes,
this results in lower latency. Packets are coming more often, so the DRX
interval is reduced during this period.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 222
UE (Mobile) States

November, 2013 Course 512 (c)2013 Scott Baxter Page 223


UE States

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 224
Idle Mode Operation

November, 2013 Course 512 (c)2013 Scott Baxter Page 225


Tracking Area Update

Consider a UE in idle state (RRC idle and ECM idle)


This UE is free to travel and only do a Tracking Area Update
(TAU) when it discovers it has landed on a cell in a different TA
If data arrives for the UE, the system must page the UE
throughout the TA where it last registered
The mobile responds to the page, implicitly revealing its cell
location and re-establishing its connection to the network
When a mobile is switched on it always has at least a
default bearer with the IP address that comes with it
A UE is in ECM-IDLE state when no NAS signaling connection
exists between the UE and the network
The mobile only performs cell selection and PLMN selection
There is no UE context, no S1_MME and no S1_U connection
The UE will perform the TA procedure when the TAI in the
EMM isnt on the UEs registered list of Tas
The UE will then be in ECM-CONNECTED state again
November, 2013 Course 502 v3.0.1 (c)2013 Scott Baxter Page 226
More EMM

EPS also includes the concept of TAL, the Tracking Area List.
A uE does not need to initiate a TAU when it enters a new Tracking
Area, if that area is already in its present Tracking Area List
Provisioning different lists to the UEs can avoid signaling peaks when
a large nujmber of Ues cross a TA border, for example on a train or
other public transport
EMM Connection Management Procedures
Service request UE initiates to begin NAS signaling connection
Network-initiated paging on NAS to UE to send service request
Transport of NAS messages for SMS (CS fallback)
Generic transport of NAS messages, various others
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 227
Management and Control Functions
UE management and control is handled in Radio Resource Control
(RRC). Functions handled by RRC include:
Processing broadcast system information, so a device can decide to
connect to the network from access stratum (AS) and/or non access
stratum (NAS)
The access stratum is the functional grouping of the parts in the
infrastructure and the UE, and protocols between them, for
access. The access stratum provides transmission of data over
the radio interface and management of the radio interface to the
other parts of UMTS
Paging, indicating to an idle device that it may have an incoming call
RRC connection management between the UE and the eNodeB
Protection/ciphering RRC messages (different keys than user plane)
Radio Bearer control (logical channels at the top of the PDCP)
Mobility functions (handover when active, cell reselection when idle)
UE measurement reporting and control of signal quality, both for the
current base station and other base stations that the UE can hear
QoS management maintains the uplink scheduling to maintain QoS
requirements for different active radio bearers
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 228
EPS Session Management

EPS Session Management Protocol establishes and handles user data in the NAS
Two EPS concepts define IP connectivity between UE and packet data network:
PDN connection
EPS bearer
A PDN connection includes a default EPS bearer and possibly additional dedicated
bearers to give specific QoS handling for the traffic data flows
A UE can have multiple simultaneous PDN connections (one for web, one IMS, etc)
EPS procedure Categories:
Network-initiated EPS procedures to activate, deactivate or modify bearers
Transaction-related procedures initiated by the UE for
PDN connection establishment and disconnection
Requests for bearer resource allocation and modification
Release requests

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 229
Access Barring During System Overload

Every UE is in one of ten randomly allocated Access Classes (AC) 0 to 9,


stored in the SIM/USIM. A UE can also be in one or more of 5 special
categories (Access Classes 11 to 15), in the SIM/USIM:
0-9: Regular users, 10: Users calling emergency numbers
11 - For PLMN special use, 12 - Security Services
13 - Public Utilities (e.g. water/gas suppliers)
14 - Emergency Services, 15 - PLMN Staff

During overload, the network can cope by changing the SIB2 (System
Information Block Type 2). The UE generates a random number Rand
and must pass a persistence test before making an access attempt.
By setting ac-Barring to a lower value, normal UEs are randomly
delayed while priority users with AC11 15 have no restriction
Regular users AC 0 9 obey ac-Barring Factor and ac-Barring Time.
Emergency calls (AC10) use ac-Barring For Emergency on or off
UEs of AC11- 15 use ac-Barring For Special AC on or off
The eNB transmits mean duration of access control and the barring
rate for each type of access attempt (data origination, signaling orig.)
Service Specific Access Control (SSAC) can restrict attempts by
service type.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 230
Flow Examples

Random Access

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 231
What is Random Access?

An LTE UE uses the random access process to gain access to a


cell for any the following reasons:
Initial access to the network from the idle state
For performing an initial attach
For initiating a new call
For responding to a page
Regaining access to the network after a radio link failure
During the handover process to gain timing synchronization
with a new cell
Before uplink data transfers when the UE is not time
synchronized with the network
The random access process allows multiple user equipment to
gain simultaneous access to a cell by using different random
access preamble sequence codes. User equipment on the uplink
in specific Physical Random Access Channel (PRACH) subframes
transmits these codes.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 232
Contention-Based Random Access (CBRA)

The UE initiates the Contention Based Random Access (CBRA)


process to gain access to the network. It involves the UE selecting
a random access preamble code from a list of codes available for
selection by all UE in the cell.
Unfortunately, Contention can occur when multiple UEs just
happen to pick the same PRACH subframe and use the same
preamble code. CBRA additional messaging is required to resolve
such conflicts.
Random Access is Contention-Based in all of the following
situations: Initial network access, Access following a radio link
failure, Handover between cells, and data transfers on either uplink
or downlink when UE synchronization must be established
Random Access is NOT Contention-Based during handoffs, since
the system can assign a specific preamble for the UE to use in
accessing the new site and there is no danger another UE will
intrude or compete

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 233
The Steps of the Random Access Process

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 234
eNB Announces the Rules,

1. UE Transmits the first


Random Access Preamble

All the UEs learn the necessary details of the Random Access
process before they even need to use it. The network transmits it in
overhead messages. The key details include:
Which Preamble Format to use
Usually Preamble Format 0 providing range up to about 14
kM. Other formats are available if greater range is needed.
When the PRACH occurs, usually once per 10 ms. radio frame
How the UE should calculate its open loop transmit power for its
initial transmissions before the eNB acknowledges it
When the eNB finally responds, it will take over using closed
loop power control
Step 1: Now the UE transmits its first Random Access Preamble.
3GPP TS 36.321 contains more information on power control.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 235
2. eNB sends Random Access
Response Message
When the eNB hears the UEs random
access preamble, it generates and sends a
Random Access Response Message on the
Physical Downlink Shared Channel (PDSCH)
Its addressed to a specific Random Access Radio Network
Temporary Identifier (RA-RNTI) address.
Theres room in the RARM for multiple RA-RNTI addresses in
case multiple UEs were heard and need to be acknowledged
The UE watches the PDCCH for its specific RA-RNTI address to
recognize its random access response message, which contains:
Random access preamble sequence code identifying the
preamble sequence code which has been detected by the eNB
Initial uplink schedule grant used for transmitting subsequent
data on the uplink channel
Timing Alignment information so packet collisions wont occur
A Cell Radio Network Temporary Identifier (C-RNTI) for the UE

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 236
CBRA Contention Resolution:
Steps 3 and 4
Contention resolution steps (3 and 4) are
used whenever multiple UEs are detected
attempting random access using the same
preamble code sequence.
Step 3: The UE hears the RARM and makes its first scheduled
uplink transmission on Physical Uplink Shared Channel (PUSCH).
The UE gives the network a unique identifier in this message.
Step 4: The eNB repeats back the UE identity provided in step 3. A
UE which hears a match with the identity it transmitted now
declares the random access procedure successful. It transmits an
acknowledgment in the uplink.
UEs which dont hear a match know they have failed the random
access procedure. They have to start over again at step 1.
Both step 3 and step 4 use the Hybrid Automatic Repeat Request
(HARQ) process. Further details on the contention resolution
process and the HARQ process are in Chapter 5.1 of 3GPP TS
36.321.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 237
Flow Examples

Initial Attach

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 238
The S1 interface is initialized by request from the eNB to the MME
LTE Initial Attach

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 239
The MME confirms setup of the S1AP interface by sending an S1
Setup Successful Outcome message to the eNB
S1 Setup: This is where eNB is attached to the network. As long
LTE Initial Attach

the eNB is functioning the S1 setup remains.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 240
The UE sends an RRC connection request message to the eNB
LTE Initial Attach

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 241
The eNB sends an RRC Connection Setup message to the UE
LTE Initial Attach

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 242
The UE sends an RRC Connection Setup Complete message to
LTE Initial Attach

the eNB
The message contains an NAS attachment request and a
PDN connectivity request
RRC Connections: Once UE comes up a RRC connection is
established for communication with the network.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 243
The eNB sends the requests on to the MME
LTE Initial Attach

NAS Attach Request


PDN connectivity request
NAS: After RRC is established then the NAS signaling begins .
UE sends Attach request along with PDN connectivity request
to network.
Attach is for attaching to the network and the other message
are for establishing the bearers.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 244
LTE Initial Attach

The MME sends an Authentication Info Request to the HSS


HSS: This is Home Subscriber System and it understands
diameter protocol. Once MME receives Attach Request, it queries
HSS for authentication details. HSS sends the authentication
vectors to MME in Authentication Info Answer

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 245
LTE Initial Attach

The HSS responds to the MME with an Authentication Info Answer

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 246
LTE Initial Attach

The MME now has sufficient information to begin authentiation of


the UE
The MME sends an S1AP DL NAS Transport and NAS message
containing the Authentication Request

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 247
LTE Initial Attach

The eNB sends a RRC DL info Transfer and NAS message to the
UE, containing the Authentication Request
Authentication/Security: Networks request Authentication Vectors
from UE. Once UE provides them, MME compares them with what
HSS has sent. If they match UE is authenticated. Next is security.
After the security all the NAS messages are encrypted using the
security algorithms that were exchanged.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 248
LTE Initial Attach

The UE replies with an RRC UL info transfer and NAS message


including an NAS Authentication Response

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 249
LTE Initial Attach

The eNB sends an S1AP UL NAS transport and NAS message


containing the Authentication Response

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 250
LTE Initial Attach

The MME processes the authentication response and if


successful, sends a DL NAS Transport and NAS message
containing a Security Mode Command to the eNB.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 251
LTE Initial Attach

The eNB sends a DL Info Transfer and NAS message including


the Security Mode Command to the UE.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 252
LTE Initial Attach

The UE confirms it has applied the Security Mode Command by


sending to the eNB a UL Info Transfer and NAS message
containing Security Mode Complete

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 253
LTE Initial Attach

The eNB forwards a UL NAS Transport and NAS message to the


MME with the Security Mode Complete details.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 254
LTE Initial Attach

Now the MME is able to send a Create Session Request to the


SGW.
After security mode is complete, all the NAS messages are
encrypted using the security algorithms that were exchanged.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 255
LTE Initial Attach

The PGW sends a Proxy Binding Update/ACK message to the


SGW using PMIP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 256
LTE Initial Attach

The SGW sends a Create Session Response to the MME using


GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 257
LTE Initial Attach

MME sends eNB the Initial Context Setup Request and NAS
message containing Attach Accept and Activate Default EPS
Bearer Context Request

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 258
LTE Initial Attach

eNB sends RRC Connection Reconfiguration and NAS message


to UE containing Attach Accept, Activate Default EPS Bearer
Context Request.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 259
LTE Initial Attach

UE sends RRC Configuration Complete message to eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 260
LTE Initial Attach

MME sends Initial Context Setup Response message to the eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 261
LTE Initial Attach

Security: network creates the EPS bearers (GTP messages). Then


radio bearers created, RRC connections modified, radio bearers
created, eNB downlink addresses sent to SGW in GTP messages
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 262
LTE Initial Attach

eNB sends UL NAS transport and NAS Attach Complete message


to MME, and Activate Default EPS Bearer Context Accept
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 263
LTE Initial Attach

MME sends Modify Bearer Request by GTP to the SGW


November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 264
LTE Initial Attach

Attach complete
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 265
Flow Examples

UE Detach

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 266
LTE UE Detach

The UE is attached to this network. It decides to detach.


In the following pages,
It sends a detach request message to network.
Network deletes the EPS bearers
then the radio bearers are torn down.
Finally RRC connection is released.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 267
LTE UE Detach

The UE sends an RRC UL Info Transfer + NAS containing a


detach request.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 268
LTE UE Detach

The eNB sends to the MME an UL NAS Transport + NAS


message containing a Detach request

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 269
LTE UE Detach

The MME sends a Delete Session Request to the SGW using GTP
protocol.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 270
LTE UE Detach

The SGW sends the PGW a PMIP Proxy Binding Update, deleting
the EPS bearers.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 271
LTE UE Detach

The PGW sends a PMIP Proxy Binding ACK to the SGW

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 272
LTE UE Detach

The SGW sends a Delete Session Response message by GTP to


the MME.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 273
LTE UE Detach

The MME updates the HSS on the UEs detachment with a Notify
Request

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 274
LTE UE Detach

The HSS confirms it has received the notification by sending a


Notify Answer to the MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 275
LTE UE Detach

Now the MME sends the eNB a DL NAS Transport + NAS Detach
Accept

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 276
LTE UE Detach

The eNB sends the UE an RRC Connection Reconfiguration


message

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 277
LTE UE Detach

The UE confirms to the eNB by sending an RRC Connection


Reconfiguration Complete message

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 278
LTE UE Detach

The MME sends the eNB a UE Context Release Command

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 279
LTE UE Detach

The eNB responds to the MME with a UE Context Release


Complete message

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 280
LTE UE Detach

The eNB sends the UE an RRC Connection Release message

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 281
Radio System Identifiers,
Tunnels, Connections, Bearers

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 282
3. Radio System Identifiers and Parameters
UE Identifiers (IMSI, TMSI, GUTI ) C-RNTI (Cell Radio Network Temporary
Random Access Radio Network Identifier)
Temporary Identifier (RA-RNTI) PCI Physical Cell Identifier
contained in the MAC sub- QCI QoS Class Identifier
header of each random access RNTI Radio Network Temporary
response Identifier
LCID Logical channel identifier SystemInformationBlockType9 contains
RRC layer in the Enb allocates cell- a home eNB identifier (HNBID);
level temporary identifiers eNB Identifier (eNB ID): used to identify
S-TMSI SAE Temporary Mobile eNBs within a PLMN.
Station Identifier Tracking Area identity (TAI): used to
UTRAN and EPC Identifiers identify tracking areas
ECGI E-UTRAN Cell Global NAS UE identifier
Identifier NAS (EPC/UE) level AKA procedure
one or multiple 'PLMN identity' in a (KASME) and identified with a key
given cell identifier (KSIASME).
CSG identity: broadcast by cells in a MME includes a session identifier
CSG to allow authorized CSG SI-RNTI System Information RNTI
member UEs to access
CID Context Identifier

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 283
E-UTRAN Network Identities

PLMN Identity
A Public Land Mobile Network is uniquely identified by its PLMN Identity.
Globally Unique MME Identifier (GUMMEI)
The Globally Unique MME Identifier consists of a PLMN Identity, a MME Group
Identity and a MME Code
An MME logical node may be associated with one or more GUMMEI, but each
GUMMEI uniquely identifies an MME logical node.
Global eNB ID
The Global eNB ID is used to globally identify an eNB
E-UTRAN Cell Global Identifier (ECGI)
The ECGI is used to globally identify a cell.
Tracking Area Identity (TAI)
Each Tracking Area (a defined group of local cells) has an assigned TAI
E-RAB ID
An E-RAB uniquely identifies the combination of an S1 bearer and the
corresponding Data Radio Bearer. Under an E-RAB, there is a one-to-one
mapping between this E-RAB and an EPS bearer of the Non Access Stratum.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 284
E-UTRAN UE Identifiers (1)

RNTI
Radio Network Temporary Identifiers (RNTI) are used as UE
identifiers within E-UTRAN and in signaling messages between
UE and E-UTRAN. Some types of RNTI exist:
C-RNTI Connected Radio Network Temporary Identifier
The C-RNTI provides a unique UE identification at the cell
level identifying RRC Connection
RA-RNTI Random-Access Ratio Network Temporary Identifier
The RA-RNTI is used during some transient states, the UE
is temporarily identified with a random value for contention
resolution purposes
S-TMSI S-Temporary Mobile Subscriber Identity (S-TMSI)
The S-TMSI is a temporary UE identity in order to support
the subscriber identity confidentiality. This S-TMSI is
allocated by MME.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 285
E-UTRAN UE Identifiers (2)

Transport Layer Addresses


The transport layer address parameter is sent in radio signaling
procedures to establish the transport bearer connections.
The transport layer address parameter is not interpreted in the
radio network application protocols
An eNB UE context is a block of information about one active UE
held by the eNB.
The block contains
UE state information, security information, UE capability
information, identities of the UEs logical S1-connection
An eNB UE context is established when the transition to
active state for a UE is completed or in target eNB after
completion of handover resource allocation during
handover preparation.
LCID Logical channel identifier
RRC layer in the eNB allocates cell-level temporary identifiers
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 286
4. Tunnels, Connections and Bearers

Default Bearers, Dedicated Bearers


GPRS Tunneling Protocol (GTP) and Proxy Mobile IP (PMIP)
Tunnel parameters (TEID; F-TEID )

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 287
LTE Bearers

In LTE, data plane traffic travels over virtual connections called


service data flows (SDFs).
SDFs travel over bearers: Virtual containers with unique QoS
characteristics.
A bearer is a datapath between UE and PDN, in three segments:
Radio bearer between UE and eNodeB
Data bearer between eNodeB and SGW (S1 bearer)
Data bearer between SGW and PGW (S5 bearer)
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 288
LTE QoS Architecture

LTE architecture supports hard QoS, with end-to-end quality of


service and guaranteed bit rate (GBR) for radio bearers. Just as
Ethernet and the internet have different types of QoS, for example,
various levels of QoS can be applied to LTE traffic for different
applications. Because the LTE MAC is fully scheduled, QoS is a
natural fit.
Evolved Packet System (EPS) bearers provide one-to-one
correspondence with RLC radio bearers and provide support for
Traffic Flow Templates (TFT). There are four types of EPS
bearers:
GBR Bearer resources permanently allocated by admission
control
Non-GBR Bearer no admission control
Dedicated Bearer associated with specific TFT (GBR or non-
GBR)
Default Bearer Non GBR, catch-all for unassigned traffic

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 289
QoS Parameters and TFTs (1)

A Traffic Flow Template (TFT) is all the packet filters associated with an EPS bearer.
A packet filter may be associated with a protocol.
Several packet filters can be combined to form a Traffic Flow Template.
EBI+Packet filter ID gives us a "unique" packet filter Identifier. The following is the
TFT for FTP protocol.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 290
QoS Parameters and TFTs (2)
Bearer level QoS is associated with a bearer and all traffic mapped
to that will receive same bearer level packet forwarding treatment.
QoS parameter values of the default bearer are assigned by the
network based on the subscription data received from HSS.
In LTE the decision to establish or modify a dedicated bearer is
taken by EPC and bearer level QoS parameters are assigned by
EPC. These values are not modified by MME but are forwarded
transparently to EUTRAN. However MME may reject the
establishment of dedicated bearer if there is any discrepancy.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 291
QoS Parameters and TFTs (2)

A default bearer may or may not be associated with a TFT. But a


dedicated bearer is always associated with TFT.
So we have bearers, the QoS values for them and TFT which
indicate what type of application should run over them. This
defines the LTE QoS. We have Uplink TFT and Downlink TFT
which are used by UE and PDN
The UE routes uplink packets to the different EPS bearers based
on uplink packet filters in the TFT's assigned to those EPS
bearers.
We have evaluation packet precedence index in packet filter
which is used by UE to search for a match (to map the
application traffic).
Once the UE finds a match it uses that particular packet filter to
transmit the data.
If there is no match UE transmits the data on bearer to which
no TFT has been assigned.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 292
Flow Examples

Default Bearer Establishment


Incoming

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 293
LTE Default Bearer Establishment,
Incoming (1)

UE is in RRC_IDLE condition
MME has traffic for specific UE. It sends Page message to all
eNBs in UEs current tracking area (TA).
eNB sends page message over air interface for UE
UE recognizes the page and responds by sending RRC
Connection Request message to eNB
eNB sends RRC Connection Setup message to UE
UE sends eNB a RRC Connection Setup Complete message and
NAS message including Attach Request and PDN Connectivity
Request
eNB sends Initial UE Message + NAS attach request and PDN
connectivity request to MME
eNB sends Initial UE Message + NAS attach request and PDN
connectivity request to MME
MME sends Create Session Request to SGW using GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 294
LTE Default Bearer Establishment, Incoming

UE is in RRC_IDLE condition

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 295
LTE Default Bearer Establishment, Incoming

MME has traffic for specific UE. It sends Page message to all
eNBs in UEs current tracking area (TA).

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 296
LTE Default Bearer Establishment, Incoming

eNB sends page message over air interface for UE

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 297
LTE Default Bearer Establishment, Incoming

UE recognizes the page and responds by sending RRC


Connection Request message to eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 298
LTE Default Bearer Establishment, Incoming

eNB sends RRC Connection Setup message to UE

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 299
LTE Default Bearer Establishment, Incoming

UE sends eNB a RRC Connection Setup Complete message and


NAS message including Attach Request and PDN Connectivity
Request

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 300
LTE Default Bearer Establishment, Incoming

eNB sends Initial UE Message + NAS attach request and PDN


connectivity request to MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 301
LTE Default Bearer Establishment, Incoming

MME sends Create Session Request to SGW using GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 302
LTE Default Bearer Establishment, Incoming

SGW sends PGW a PMIP Proxy Binding Update

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 303
LTE Default Bearer Establishment, Incoming

PGW responds to SGW with PMIP Proxy Binding ACK

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 304
LTE Default Bearer Establishment, Incoming

SGW sends Create Session Response to MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 305
LTE Default Bearer Establishment, Incoming

MME sends eNB Initial Context Setup request + NAS Activate


Default EPS Bearer Context Request and Attach Accept

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 306
LTE Default Bearer Establishment, Incoming

eNB sends UE an RRC Connection Reconfig and NAS Activate


Default EPS bearer context request and Attach Accept

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 307
LTE Default Bearer Establishment, Incoming

UE responds with RRC Connection Reconfiguration Complete

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 308
LTE Default Bearer Establishment, Incoming

eNB sends Initial Context Setup Response to MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 309
LTE Default Bearer Establishment, Incoming

UE sends eNB an RRC UL Info Transfer and NAS Activate Default


EPS bearer context accept and Attach Accept

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 310
LTE Default Bearer Establishment, Incoming

eNB sends to MME UL NAS Transport and NAS Activate Default


EPS Bearer Context Accept and Attach Accept

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 311
LTE Default Bearer Establishment, Incoming

MME sends Modify Bearer Request to SGW using GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 312
LTE Default Bearer Establishment, Incoming

SGW responds to MME with Modify Bearer Response over GTP


November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 313
Flow Examples

Default Bearer Establishment


Outgoing

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 314
LTE Default Bearer Establishment, Outgoing

UE is in RRC_Idle mode
UE has data and needs connection to network
UE sends RRC Connection Request to eNB
eNB sends RRC Connection Setup to UE
UE sends RRC Connection Setup Complete and NAS Attach
Request and PDN Connectivity Request to eNB
eNB sends Initial UE Message and NAS Attach Request and PDN
Connectivity Request to MME
MME sends Create Session Request to SGW using GTP
SGW sends PMIP Proxy Binding Update to PGW
PGW sends PMIP Proxy Binding Ack to SGW
SGW sends Create Session Response to MME by GTP
MME sends eNB an Initial Context Setup Request and NAS
Activate Default EPS Bearer Context request and Attach Accept

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 315
LTE Default Bearer Establishment, Outgoing

UE is in RRC_Idle mode
UE has data and needs connection to network

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 316
LTE Default Bearer Establishment, Outgoing

UE sends RRC Connection Request to eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 317
LTE Default Bearer Establishment, Outgoing

eNB sends RRC Connection Setup to UE

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 318
LTE Default Bearer Establishment, Outgoing

UE sends RRC Connection Setup Complete and NAS Attach


Request and PDN Connectivity Request to eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 319
LTE Default Bearer Establishment, Outgoing

eNB sends Initial UE Message and NAS Attach Request and PDN
Connectivity Request to MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 320
LTE Default Bearer Establishment, Outgoing

MME sends Create Session Request to SGW using GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 321
LTE Default Bearer Establishment, Outgoing

SGW semds PMIP Proxy Binding Update to PGW

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 322
LTE Default Bearer Establishment, Outgoing

PGW sends PMIP Proxy Binding Ack to SGW

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 323
LTE Default Bearer Establishment, Outgoing

SGW sends Create Session Response to MME by GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 324
LTE Default Bearer Establishment, Outgoing

MME sends eNB an Initial Context Setup Request and NAS


Activate Default EPS Bearer Context request and Attach Accept

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 325
LTE Default Bearer Establishment, Outgoing

eNB sends UE an RRC Connection Reconfiguration and NAS


Activate Default EBS Bearer Context Request and Attach Accept

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 326
LTE Default Bearer Establishment, Outgoing

UE sends eNB RRC Connection Reconfiguration Complete

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 327
LTE Default Bearer Establishment, Outgoing

eNB sends MME an Initial Context Setup Response message

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 328
LTE Default Bearer Establishment, Outgoing

UE sends eNB RRC UL Info Transfer NAS Activate Default EPS


Bearer Context Accept and Attach Accept

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 329
LTE Default Bearer Establishment, Outgoing

eNB sends MME a UL NAS Transport + NAS Activate Default EPS


Bearer Context Accept and Attach Complete

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 330
LTE Default Bearer Establishment, Outgoing

MME sends SGW a Modify Bearer request by GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 331
LTE Default Bearer Establishment, Outgoing

SGW sends MME a Modify Bearer Response message by GTP


November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 332
LTE Handover and Roaming

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 333
Introduction to Handover

In modern wireless systems, seamless handover is expected by


users as they move between sites and networks.
Handover occurs in the active state; it is controlled by the network
(the eNodeB).The network uses measurements from the UE and
its own knowledge of the network topology to determine when to
handover a UE, and to which eNodeB.
Dont confuse handover with the cell re-selection which occurs
when the UE is in the idle state. Reselection is controlled by the
UE using previously received parameters and does not involve
communication between the UE and eNodeB, unless the UE
enters a new tracking area and must do a tracking area update.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 334
Handover Measurement
In a single-radio architecture it is hard to monitor other networks on
other frequencies while the receiver is active. The radio can only
receive on one frequency at a time, yet needs to listen to other
frequencies to see if a better base station (eNodeB) is available.
In the active state, the eNB provides measurement gaps in the
scheduling of the UE where no downlink or uplink scheduling
occurs. This gives the UE enough time to change frequency, make
a measurement, and switch back to the active within a few TTIs.
This has to be coordinated with DRX, which also causes the
system to shut off the radio for periods of time to save power.
The LTE network provides the UE with neighbor lists.
The eNodeB provides the UE with neighboring eNBs
identifiers and their frequency.
During measurement gaps or idle periods, the UE measures the
signal quality of the neighbors it can receive.
The UE reports results back to the eNodeB and the network
decides the best handover (if any), based on signal quality,
network utilization, etc.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 335
Handover Procedures - Objectives

Objectives of Handover Procedures


It is important that QoS is maintained, not just before and after
a handover, but during the handover as well.
Handover must not unduly drain the UE battery power.
Service continuity shall be maintained (i.e., minimal handover
latency).
Seamless handoff is required to 3G / 2G / CDMA technology.
There are two ways a handoff can be decided:
Network Evaluated: the network makes the handover decision
Mobile Evaluated: the UE makes the handoff decision and
informs the network about it.
In this instance, the final decision will be made by the
network based upon on the Radio Resource Management.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 336
Handover Types

In 3G and LTE networks, a hybrid approach is used to decide on


the handover.
The UE will assist in the handoff decision by measuring the
neighboring cells and reporting the measurements to the
network
The network decides upon the handoff timing and the target
cell/node.
The parameters to measure and the thresholds for reporting
are decided by the network.
In LTE there are three types of handovers:
Intra-LTE: Handover happens within the current LTE nodes
(intra-MME and Intra-SGW)
Inter-LTE: Handover happens toward the other LTE nodes
(inter-MME and Inter-SGW)
Inter-RAT: Handover between different radio technology
networks, for example GSM/UMTS and UMTS

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 337
Flow Examples

Intra-LTE (Intra-MME / SGW)


Handover
Using the X2 Interface

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 338
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

Consider Intra-LTE handovers with X2AP signaling and S1AP


signaling first, then Inter-RAT handovers in LTE (i.e., handover
between LTE and UMTS).
Intra-LTE (Intra-MME / SGW) Handover Using the X2 Interface:
This procedure is used to handover a UE from a source eNodeB
(S-eNB) to a target eNodeB (T-eNB) using the X2 interface when
the Mobility Management Entity (MME) and Serving Gateway
(SGW) are unchanged. It is possible only if direct connectivity
exists between the source and target eNodeBs with the X2
interface.
The X2 handover procedure is performed without Evolved Packet
Core (EPC) involvement, i.e. preparation messages are directly
exchanged between the S-eNB and T-eNB. The release of the
resources at the source side during the handover completion
phase is triggered by the T-eNB. The message flow is shown in
Figure 1 followed by the description

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 339
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

The Data call is already established between the UE, S-eNB and
network elements.
Data packets are already flowing to/from the UE on both DL & UL.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 340
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

The Network sends a MEASUREMENT CONTROL REQ message


to the UE to set the measurement parameters and thresholds.
The UE is instructed to send measurement report when thresholds
are met.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 341
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

The UE sends a MEASUREMENT REPORT to the S-eNB as soon


as thresholds are met.
The S-eNB decides to hand UE off to a T-eNB using network
operators handover algorithm.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 342
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

Optionally S-eNB issues RESOURCE STATUS REQUEST


message to determine the load on T-eNB.
Based on received RESOURCE STATUS RESPONSE, the S-eNB
can decide whether to continue the handover procedure using the
X2 interface.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 343
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

The S-eNB issues a HANDOVER REQUEST message to the T-


eNB with UE and RB contexts to prepare handover at the target.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 344
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

T-eNB checks availability, reserves resources and sends back


HANDOVER REQUEST ACKNOWLEDGE message including a
transparent container for the UE as an RRC message to perform
the handover.
The container includes a new C-RNTI, T-eNB security algorithm
identifiers for the selected security algorithms, and may include a
dedicated RACH preamble and possibly some other parameters
(i.e., access parameters, SIBs, etc.).

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 345
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

The S-eNB generates the RRC message to perform the handover,


i.e, RRCCONNECTION RECONFIGURATION message including
the mobility Control Information. The S-eNB performs the
necessary integrity protection and ciphering of the message and
sends it to the UE.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 346
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

The S-eNB sends the eNB STATUS TRANSFER message to the


T-eNB to convey the PDCP and HFN status of the E-RABs.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 347
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

The S-eNB starts forwarding the downlink data packets to the T-


eNB for all the data bearers (which are being established in the T-
eNB during the HANDOVER REQ message processing).

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 348
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

In the meantime, the UE tries to access the T-eNB cell using the
non-contention-based Random Access Procedure.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 349
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

If it succeeds in accessing the target cell, it sends the RRC


CONNECTION RECONFIGURATION COMPLETE to the T-eNB.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 350
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

The T-eNB sends a PATH SWITCH REQUEST message to the


MME to inform it that the UE has changed cells, including the
TAI+ECGI of the target.
The MME determines that the SGW can continue to serve the UE.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 351
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

The MME sends a MODIFY BEARER REQUEST (eNodeB


address and TEIDs for downlink user plane for the accepted EPS
bearers) message to the SGW. If the PDN GW requested the UEs
location info, the MME also includes the User Location Information
IE in this message.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 352
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

The SGW sends one or more end marker packets on the old path
to the S-eNB and then can release any user plane / TNL resources
toward the S-eNB.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 353
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

15. The MME responds to the T-eNB with a PATH SWITCH REQ
ACK message to notify the completion of the handover.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 354
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

User data packets now flow between the SGW and the UE.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 355
Case I. Intra-LTE (Intra-MME / SGW) Handover
Using the X2 Interface

The T-eNB now requests the S-eNB to release the resources


using the X2 UE CONTEXT RELEASE message. With this, the
handover procedure is complete.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 356
Flow Examples

Intra-LTE (Intra-MME / SGW)


Handover
Using the S1 Interface

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 357
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface
An S1-based handover procedure is used when the X2-based
handover cannot be used
no X2 connectivity to the target eNodeB;
by an error indication from the T-eNB after an unsuccessful X2-
based handover
by dynamic information learned by the S-eNB using the
STATUS TRANSFER procedure.
The S-eNB initiates the handover by sending a Handover required
message over the S1-MME reference point. The EPC does not
change the decisions taken by the S-eNB.
The availability of a direct forwarding path is determined in the S-
eNB (based on the X2 connectivity with the T-eNB) and indicated
to the source MME.
If a direct forwarding path is not available, indirect forwarding
will be used. The source MME uses the indication from the S-
eNB to determine whether to apply indirect forwarding or not.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 358
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

Based on the MEASUREMENT REPORT from the UE, the S-eNB


decides to Handover the UE to another eNodeB (T-eNB). The
handover procedure in this section is very similar to that in the
previous section (Intra-LTE Handover Using the X2 Interface),
except the involvement of the MME in relaying the handover
signaling between the S-eNB and T-eNB.
There are two differences here:
No need for the PATH SWITCH Procedure between the T-eNB
and MME, as MME is aware of the Handover.
The SGW is involved in the DL data forwarding if there is no
direct forwarding path available between the S-eNB and T-
eNB.
Once the Handover is complete, the MME clears the logical S1
connection with the S-eNB by initiating the UE CONTEXT
RELEASE procedure.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 359
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The UE is sending and receiving user data on both the uplink and
downlink.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 360
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The S-eNB sends an RRC: Measurement Control message to the


UE, instructing it to take certain measurements at specific intervals
and to report the results when specific criteria are met.
The UE sets to work taking the requested measurements and
performing comparisons against the specified criteria.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 361
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The UE notices that measurements have satisfied the specified


criteria. It sends an RRC: Measurement Report to the Currently
Serving eNB.
The handover procedure in this section is very similar to that in the
previous section (Intra-LTE Handover Using the X2 Interface),
except the involvement of the MME in relaying the handover
signaling between the S-eNB and T-eNB.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 362
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The serving eNB sends a Handover Required message to the


MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 363
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

MME sends Handover Request to Target eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 364
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The Target eNB sends a Handover Request Acknowledgment to


the MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 365
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The MME sends a Handover Command to the serving eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 366
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The Serving eNB sends an RRC Connection Reconfiguration


Request to the UE

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 367
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The Serving eNB sends an eNB Status Transfer message to the


MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 368
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The Serving eNB sends a Forward User Data message to the


SGW by GTP protocol

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 369
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The MME sends an MME Status Transfer message to the Target


eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 370
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The UE performs the Non-Contention RACH Process on the


Target eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 371
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The SGW sends Forward User Data to the Target eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 372
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The UE sends an RRC Connection Reconfiguration Complete


message to the Target eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 373
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The Target eNB sends a Handover Notify message to the MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 374
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The MME sends a Modify Bearer Request message to the SGW


by GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 375
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The SGW sends a Modify Bearer Response to the MME by GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 376
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

User data packets now flow between the UE and the SGW.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 377
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The T-eNB sends an S1AP UE Context Release Command to the


the S-eNB.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 378
Case II. Intra-LTE (Intra-MME / SGW) Handover
Using the S1 Interface

The S-eNB confirms the requested UE context release by sending


the MME an S1AP UE Context Release Complete message.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 379
Flow Examples

Inter-MME Handover (Intra-SGW)


(no change in Gateway)

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 380
Case III. Inter-MME Handover (Intra-SGW)
(no change in Gateway)

In an inter-MME handover, two MMEs are involved in the


handover, the source MME (S-MME) and target MME (T-MME).
The S-MME controls the S-eNB and the T-MME controls the T-
eNB; both MMEs are connected to the same SGW. This handover
is triggered when the UE moves from one MME area to another
MME area.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 381
Case III. Inter-MME Handover (Intra-SGW)

The UE is sending and receiving user data on both the uplink and
downlink.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 382
Case III. Inter-MME Handover (Intra-SGW)

The Serving eNB sends a Handover Request to the Serving MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 383
Case III. Inter-MME Handover (Intra-SGW)

The Serving MME sends a Forward Relocation Request to the


Target MME by GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 384
Case III. Inter-MME Handover (Intra-SGW)

The Target MME sends a Handover Request to the Target eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 385
Case III. Inter-MME Handover (Intra-SGW)

The Target eNB sends a Handover Request Acknowledgment to


the Target MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 386
Case III. Inter-MME Handover (Intra-SGW)

The Target MME sends a Forward Relocation Response to the


Serving MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 387
Case III. Inter-MME Handover (Intra-SGW)

The Serving MME sends a Handover Command to the Serving


eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 388
Case III. Inter-MME Handover (Intra-SGW)

The Serving eNB sends a RRC Connection Reconfiguration


Request to the UE

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 389
Case III. Inter-MME Handover (Intra-SGW)

The Serving eNB sends an eNB Status Transfer to the Serving


MME, which forwards it to the Target MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 390
Case III. Inter-MME Handover (Intra-SGW)

The Target MME sends an eNB Status Transfer to the Target eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 391
Case III. Inter-MME Handover (Intra-SGW)

The Serving eNB sends Forward User data to the SGW by GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 392
Case III. Inter-MME Handover (Intra-SGW)

The SGW sends Forward User Data to the Target eNB by GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 393
Case III. Inter-MME Handover (Intra-SGW)

The UE performs the Non-Contention RACH procedure on the


Target eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 394
Case III. Inter-MME Handover (Intra-SGW)

The UE sends RRC Connection Reconfiguration Complete to the


Target eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 395
Case III. Inter-MME Handover (Intra-SGW)

The Target eNB sends a Handover Notify message to the Target


MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 396
Case III. Inter-MME Handover (Intra-SGW)

The Target MME sends a Modify Bearer Request to the SGW by


GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 397
Case III. Inter-MME Handover (Intra-SGW)

The SGW sends a Modify Bearer Response to the Target MME by


GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 398
Case III. Inter-MME Handover (Intra-SGW)

The Target MME sends a Forward Relocation Complete message


to the Serving MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 399
Case III. Inter-MME Handover (Intra-SGW)

The Serving MME sends a Forward Relocation Complete


Acknowledgment to the Target MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 400
Case III. Inter-MME Handover (Intra-SGW)

User Packets now flow directly from UE to SGW in both directions

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 401
Case III. Inter-MME Handover (Intra-SGW)

The S-MME sends a UE Context Release Command to S-eNB


November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 402
Case III. Inter-MME Handover (Intra-SGW)

The S-eNB responds with a UE Context Release Complete


November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 403
Flow Examples

Inter-MME / SGW Handover


Using the S1 Interface

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 404
Case IV. Inter-MME / SGW Handover
Using the S1 Interface

Inter-MME / SGW Handover Using the S1 Interface


This scenario is similar to the previous section with the difference
being the Source and Target eNodeBs are served by different
MME / SGW nodes. Figure 4 depicts the procedures and is
followed by the explanation.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 405
Case IV. Inter-MME / SGW Handover
Using the S1 Interface

1 Based on the MEASUREMENT REPORT from the UE, the S-eNB


decides to handover the UE to another eNodeB (T-eNB). The procedure is
like earlier ones except for involvement of two SGWs (S-SGW and T-
SGW) to transfer data packets during handover.
2. After receiving GTP: FORWARD RELOCATION REQ from S-MME, T-
MME detects SGW change, starts bearer creation toward target T-SGW
using GTP: CREATE SESSION REQ message.
3. After creation of requested bearers, T-SGW responds back to MME
with a GTP: CREATE SESSION RESPONSE message.
4. From here on, message flow is very similar to Inter-MME, Intra- SGW
handover except for these differences:
While processing the S1 HANDOVER NOTIFY message from the T-
eNB, the T-MME updates the T-eNB endpoint information to the T-
SGW using GTP: MODIFY BEARER REQ.
After updating T-eNB information in the bearers T-SGW sends GTP:
MODIFY BEARER RESPONSE message to the T-MME.
When Handover Complete, S-MME releases bearer resources with the S-
SGW for this UE by GTP: DELETE SESSION procedure
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 406
Case IV. Inter-MME / SGW Handover

The UE is sending and receiving user data on both the uplink and
downlink.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 407
Case IV. Inter-MME / SGW Handover

The S-eNB sends RRC Measurement Procedures to the UE


The UE performs the requested measurements
The S-eNB receives information when specified thresholds are
exceeded, triggering need for a handover

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 408
Case IV. Inter-MME / SGW Handover

The Serving eNB sends a Handover Request to the serving MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 409
Case IV. Inter-MME / SGW Handover

The serving MME sends a Forward Relocation Request to the


target MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 410
Case IV. Inter-MME / SGW Handover

The Target MME sends a Create Session Request to the Target


SGW by GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 411
Case IV. Inter-MME / SGW Handover

The Target SGW sends a Create Session Request to the Target


MME by GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 412
Case IV. Inter-MME / SGW Handover

The Target MME sends a Handover Request to the Target eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 413
Case IV. Inter-MME / SGW Handover

The Target eNB sends a handover Request Acknowledgment to


the Target MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 414
Case IV. Inter-MME / SGW Handover

The Target MME sends a Forward Relocation Request to the


Serving MME using GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 415
Case IV. Inter-MME / SGW Handover

The Serving MME sends a Handover Command to the Serving


eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 416
Case IV. Inter-MME / SGW Handover

The Serving eNB sends an RRC Connection Reconfiguration


Request to the UE

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 417
Case IV. Inter-MME / SGW Handover

The Serving eNB sends an eNB Status Transfer to the Target


MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 418
Case IV. Inter-MME / SGW Handover

The Target MME sends an eNB Status Transfer to the Target eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 419
Case IV. Inter-MME / SGW Handover

The Serving eNB sends Forward User Data to the Target eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 420
Case IV. Inter-MME / SGW Handover

The UE performs the Non-Contention RACH Procedure on the


Target eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 421
Case IV. Inter-MME / SGW Handover

The UE sends an RRC Connection Reconfiguration Complete


message to the Target eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 422
Case IV. Inter-MME / SGW Handover

The Target eNB sends a Handover Notify message to the Target


MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 423
Case IV. Inter-MME / SGW Handover

The Target MME sends a Modify Bearer Request to the Target


SGW using GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 424
Case IV. Inter-MME / SGW Handover

The Target SGW sends a Modify Bearer Response to the Target


MME by GTP

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 425
Case IV. Inter-MME / SGW Handover

The Target MME sends a Forward Relocation Complete message


to the Serving MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 426
Case IV. Inter-MME / SGW Handover

The Serving MME sends a UE Context Release Command to the


Serving eNB

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 427
Case IV. Inter-MME / SGW Handover

The Serving MME sends a Forward Relocation Completion


acknowledgment to the Target MME

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 428
Case IV. Inter-MME / SGW Handover

The Serving eNB sends a UE Context release Complete to the


Serving MME
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 429
Case IV. Inter-MME / SGW Handover

The Serving MME sends a Delete Session Request to the Serving


SGW
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 430
Case IV. Inter-MME / SGW Handover

The S-SGW sends a Delete Session Response to the S-MME


November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 431
Case IV. Inter-MME / SGW Handover

User data packets flow from UE to T-SGW in both UL and DL


November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 432
LTE Security

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 433
LTE Security Objectives

LTE security is extremely important. LTE must required security


without impacting the user experience.
Users must operate freely and without fear of attack from hackers
and the network must also be secure against a variety of attacks.
LTE security basics: Requirements for LTE security
provide at least same level of security as in 3G services.
LTE security measures must not affect user convenience.
provide defense from attacks from the Internet.
LTE security functions should not impede the transition from
existing 3G services to LTE.
The USIM currently used for 3G services should still be used.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 434
Basic Development of LTE Security

Additional LTE measures have been implemented in all areas of


the system from the UE through to the core network. In summary:
A new hierarchical key system has been introduced in which
keys can be changed for different purposes.
security functions for the Non-Access Stratum, NAS, and
Access Stratum, AS have been separated.
NAS functions are processed between the core network and
the mobile terminal or UE.
AS functions encompass communications between the network
edge, i.e. the Evolved Node B, eNB and the UE
The concept of forward security has been introduced for LTE
security.
LTE security functions have been introduced between the
existing 3G network and the LTE network.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 435
The LTE USIM

The Subscriber Identity Module


(SIM) is one of the key security
elements of GSM, UMTS and
now LTE. This card holds identity
of the subscriber in an encrypted
fashion while phone or device.
In transition from 2G/GSM to
3G/UMTS, the SIM concept was
upgraded and the USIM/UMTS
Subscriber Identity Module is
used. It has more functionality,
larger memory, etc.
For LTE, only the USIM may be
used - the older SIM cards are not
compatible and may not be used.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 436
Voice over LTE

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 437
Why Voice Over LTE?

Originally LTE was seen as a completely IP cellular system just for


carrying data, and operators would be able to carry voice either by
reverting to 2G / 3G systems or by using VoIP.
The Voice over LTE, VoLTE scheme was devised by operators
looking for a standardized system for carrying voice over LTE.
But to Operators, the lack of a defined voice format seemed to be
a major omission for the system.
lack of standardization may cause problems in roaming.
SMS is a key requirement since it used to set-up many mobile
broadband connections. Lack of SMS is a show-stopper
Mobile operators still receive over 80% of their revenues from
voice and SMS traffic. A viable and standardized scheme is
essential to provide these services and protect this revenue.
LTE can more efficiently deliver these services due to its much
higher spectral efficiency

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 438
Options for Voice over LTE

There are several options for delivering Voice over LTE:


CSFB, Circuit Switched Fall Back: automatically falling back
the old 2G or 3G system when an LTE UE initiates a call. This
spec also allows SMS to be carried over an interface known as
SGs, so messages to be sent over an LTE channel.
SV-LTE - simultaneous voice LTE: SV-LTE can run packet
switched LTE services simultaneously with circuit switched
voice service.However,it requires two radios to run at the same
time within the handset, with serious battery drain
VoLGA, Voice over LTE via GAN: The VoLGA standard is
based on existing 3GPP Generic Access Network (GAN)
standards, aiming to deliver a consistent user services while
the network transitions to LTE (low-risk, popular with operators)
One Voice / later called Voice over LTE, VoLTE: Provides
voice over the LTE system using IMS as part of a rich media
solution which can handle multimedia as well

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 439
Issues for Voice Services over LTE

Unlike previous standards (GSM, CDMA), LTE does not have


dedicated channels for circuit switched telephony. LTE is an all-IP
system providing an end-to-end IP connection from the mobile
equipment to the core network and out again.
In order to provide some form of voice connection over a standard
LTE bearer, some form of Voice over IP (VoIP) must be used.
The aim for any voice service is to exploit the LTE low latency and
QoS features so that any LTE voice service is better than 2G/3G
However to achieve a full VoIP offering on LTE poses some
significant problems which will take time to resolve. With the first
deployments having taken place in 2010, it is necessary that a
solution for voice is available within a short timescale.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 440
Voice over LTE (VoLTE) Basics

The One Voice profile for Voice over LTE (VoLTE) was developed
by a collaboration between over forty operators and manufacturers
including AT&T, Verizon Wireless, Nokia and Alcatel-Lucent.
At the 2010 GSMA Mobile World Congress, GSMA announced
their support for the VoLTE solution to provide Voice over LTE.
VoLTE, Voice over LTE is an IMS-based specification.
Adopting this approach, it enables the system to be integrated
with the suite of applications that will become available on LTE
Three interfaces are being defined to provide VoLTE:
User Network interface, UNI: between the user's equipment
and the operators network.
Roaming Network Network Interface, R-NNI: located between
the Home and Visited Network.
Interconnect Network Network Interface, I-NNI: located
between the networks of the two parties making a call.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 441
Continuing Work on LTE

Work to define Voice over LTE (VoLTE) is ongoing, including the


following elements:
ensuring continuity of Voice calls as a user moves from an LTE
coverage area to an area where a fallback to another
technology is required. This form of handover will be achieved
using Single Radio Voice Call Continuity, or SR-VCC).
Providing optimal routing of bearers for voice calls when
customers are roaming.
establishing commercial frameworks for roaming and
interconnect for services implemented using VoLTE definitions,
necessary to set up roaming agreements
Providing capabilities ror roaming hubbing
Providing security and fraud threat measures to prevent
hacking and unauthorized network penetration..

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 442
IMS
IP Multimedia Subsystem

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 443
What is IMS?
IP Multimedia Core Network Subsystem

The IP Multimedia Subsystem or IP Multimedia Core Network


Subsystem, IMS is an architectural framework for delivering
Internet Protocol, IP multimedia services. It enables a variety of
services to be run seamlessly rather than having independent
applications operating concurrently.
IMS, or IP Multimedia Subsystem is having a major impact on the
telecommunications industry, both wired and wireless.
Although IMS was originally created for mobile applications by
3GPP and 3GPP2, its use is more widespread as fixed line
providers are also being forced to find ways of integrating mobile
or mobile associated technologies into their portfolios.
As a result the use of IMS, IP multimedia subsystem is crossing
the frontiers of mobile, wire-less and fixed line technologies.
Indeed there is very little within IMS that is wireless or mobile
specific, and as a result there are no barriers to its use in any
telecommunications environment.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 444
IMS Basics

IMS, IP multimedia subsystem is an architecture, not a technology


It uses Internet standards to deliver services on new networks.
It uses Session Initiation Protocol (SIP) for establishing, managing and
terminating sessions on IP networks.
The overall IMS architecture uses several components to enable multimedia
sessions between two or more end devices.
One element is a presence server to handle user status
a key element in Push to talk over Cellular (PoC) where the presence, or
user status is key to enabling one user to be able to talk to another.
Users often need many concurrent simultaneous sessions of different applications
IMS provides a common IP interface for simplified signaling, traffic, and
application development
In addition, under IMS architecture subscribers can connect to a network using
multiple mobile and fixed devices and technologies. With new applications
such as Push to talk over Cellular (PoC), gaming, video and more, it is
seamless integration is necessary for users to get the full benefits.
IMS has advantages for operators too. In addition to maximum services for
maximum revenues, functions like billing, and "access approval" can be unified
across network applications, greatly simplifying deployment and management

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 445
IMS Architecture Basics

The architecture of an IMS system can be split into a number of


main elements or areas:
User equipment: As the name implies, the user equipment or
UE is part of the IMS architecture resides with the user - it is
the endpoint.
Access network: This is the portion of the IMS architecture
through which the overall network is accessed.
Core network: This is a major element within the IMS
architecture and provides all the core functionality.
Application layer: The application layer contains the web
portal and the application servers, which provide the end user
with service and enhanced service controls. T

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 446
IMS Architecture Functional View
Elements of overall IMS architecture:
Server CSCF: session control for endpoint
devices; maintains state.
Proxy CSCF: entry point to IMS for the UE;
forwards SIP messages to user's home S-CSCF;
controls inter-working security; QoS mgt.
Interrogating CSCF: a session control for endpoint
devices.
Home Subscriber Server, HSS: provides
subscriber database for the home network.
Breakout gateway control function, BGCF: selects
the network in which a PSTN breakout is to occur.
If on in the same network as the BGCF, also
selects a media gateway control function, MGCF
Media gateway control function, MGCF:
interworks the SIP signalling. manages sessions
across multiple media gateways
Media server function control, MSCF: manages
the use of resources on media servers.
SIP applications server, SIP-AS: execution
platform to deploy more services

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 447
LTE Advanced

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 448
LTE Advanced

The driving force to further develop LTE towards LTEAdvanced,


LTE R-10 is to provide higher bitrates in a cost efficient way, and
at the same time completely fulfil the requirements set by ITU for
IMT Advanced, also referred to as 4G.
In LTE-Advanced focus is on higher capacity:
- increased peak data rate, DL 3 Gbps, UL 1.5 Gbps
- higher spectral efficiency, from a maximum of 16bps/Hz in R8 to
30 bps/Hz in R10
- increased number of simultaneously active subscribers
- improved performance at cell edges, e.g. for DL 2x2 MIMO at
least 2.40 bps/Hz/cell.
The main new functionalities introduced in LTE-Advanced are
Carrier Aggregation (CA), enhanced use of multi-antenna
techniques and support for Relay Nodes (RN).

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 449
LTE Advanced (2)
Carrier Aggregation
The simplest way to increase
capacity is to add more bandwidth.
To keep backward compatibility with
R8 and R9 mobiles the increase in
bandwidth in LTE-Advanced is
provided through aggregation of
R8/R9 carriers. Carrier aggregation
can be used for both FDD and TDD.
Each aggregated carrier is referred
to as a component carrier.
A component carrier can have a
bandwidth of 1.4, 3, 5, 10, 15 or 20
MHz Up to five component carriers The maximum aggregate
can be aggregated. bandwidth is 100 MHz.
R10 UEs can use DL and UL on up The number of aggregated
to five Component Carriers (CC). carriers can be different in DL
R8/R9 UEs can use any ONE of the and UL, but UL is never larger
CCs. The CCs can be of different than DL. The individual
bandwidths. component carriers can have
different bandwidths.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 450
LTE Advanced (3)
Continuous and Non-Continuous Aggregation

Contiguous component carriers in the same operating frequency band are called
intra-band contiguous. This simplest arrangement is not always possible..
Non-contiguous allocation can be intra-band, i.e. the component carriers belong to
the same operating frequency band, but are separated by a gap
Non-contiguous allocation can be inter-band, in which case the component carriers
belong to different operating frequency bands
Each component carrier is present on certain cells. Not all cells have all carriers.
The coverage of serving cells may differ due to different frequencies and powers
RRC connection is handled by one cell, the Primary serving cell, using the Primary
component carrier (DL and UL PCC). The other component carriers are called
Secondary component carriers (DL and UL SCC), on secondary serving cells.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 451
Differing Coverage of Different Carriers

Different component carriers can have different coverage


In inter-band carrier aggregation the component carriers will
experience different pathloss, due to different frequencies.
In the example above, carrier aggregation on all three component
carriers can only be used by the black UE. The white UE is not
within the coverage area of the red component carrier. Note that
for UEs using the same set of CCs, they can have different PCC.
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 452
Main Differences in LTE Protocols
to Support Carrier Aggregation

Introduction of carrier aggregation influences mainly MAC and the


physical layer protocol, but also some new RRC messages are
introduced.
In order to keep R8/R9 compatibility the protocol changes are kept
to a minimum.
Basically each component carrier is treated as an R8 carrier.
However some information is necessary, such as new RRC
messages in order to make SCC and MAC able to handle
scheduling on a number of CCs.
Major changes on the physical layer are for example that
signaling information about scheduling on CCs as well as
HARQ ACK/NACK per CC must be carried.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 453
Main Differences in LTE Protocols
to Support Carrier Aggregation

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 454
Cross-Carrier Scheduling

Regarding scheduling there are two main alternatives for CA, either
resources are scheduled on the same carrier as the grant is received, or
so called cross-carrier scheduling may be used
Figure 5. CA scheduling (FDD). Cross- carrier scheduling is only used to
schedule resources on SCC without PDCCH. The CIF (Carrier Indicator
Field) on PDCCH (represented by the red area) indicates on which carrier
the scheduled resource is located
November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 455
More References on Carrier Aggregation

TR 36.808 Evolved Universal Terrestrial Radio Access (E-UTRA); Carrier


Aggregation; Base Station (BS) radio transmission and reception
TR 36.814 Evolved Universal Terrestrial Radio Access (E-UTRA); Further
advancements for E-UTRA physical layer aspects
TR 36.815 Further Advancements for E-UTRA; LTE-Advanced feasibility studies in
RAN WG4
TR 36.823 Evolved Universal Terrestrial Radio Access (E-UTRA); Carrier
Aggregation Enhancements; UE and BS radio transmission and reception
TR 36.912 Feasibility study for Further Advancements for E-UTRA (LTE-Advanced)
TR 36.913 Requirements for further advancements for Evolved Universal Terrestrial
Radio Access (E-UTRA) (LTE-Advanced)
TS 36.211 Evolved Universal Terrestrial Radio Access (E-UTRA); Physical channels
and modulation
TS 36.212 Evolved Universal Terrestrial Radio Access (E-UTRA); Multiplexing and
channel coding
TS 36.213 Evolved Universal Terrestrial Radio Access (E-UTRA); Physical layer
procedures
TS 36.300 Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved
Universal Terrestrial Radio Access Network (E-UTRAN); Overall description; Stage 2

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 456
LTE SON:
Self Organizing/Optimizing Networks

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 457
Major Elements of LTE SON

LTE has created a lot of interest in Self Optimizing Networks,


although the idea can be applied to other technologies too
The main elements of SON include:
Self configuration: to enable new base stations to become
essentially "Plug and Play" items. They need little manual
attention for RF or backhaul configuration
Self optimization: After setup, the eNodeB will autonomously
optimize its operational characteristics for best performance
Self-healing: Autonomously detecting network problems and
changing network characteristics to mask the problem until
manual repairs can be made - for example, adjacent cell
boundary manipulation when a cell goes down
Typically an LTE SON system is a feature and software package
with relevant options that an operator buys from the network
manufacturer

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 458
LTE SON Development

The Next Generation Mobile Networks (NGMN) alliance introduced


the term SON when it became obvious that LTE networks were
going to use large numbers of cells, microcells, and femtocells.
With revenue per bit falling, deployment costs must be reduced
at the same time network performance demands are increasing
Third Generation Partnership Program (3GPP) has created the
standards for SON. Since LTE is the first technology to use them,
they are often referred to as LTE SON.
While 3GPP has generated the standards, they have been based
upon long term objectives for a 'SON-enabled broadband mobile
network' set out by the NGMN.
NGMN has defined the necessary use cases, measurements,
procedures and open interfaces to ensure that multivendor
offerings are available. 3GPP has incorporated these aspirations
into useable standards.
Deployment of LTE SON features is in very early stages now

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 459
LTE SON and 3GPP Standards

LTE Son has been standardized in the various 3GPP standards. It


was first incorporated into 3GPP release 8, and further
functionality has been progressively added in the further releases
of the standards.
One of the major aims of the 3GPP standardization is the support
of SON features is to ensure that multi-vendor network
environments operate correctly with LTE SON. As a result, 3GPP
has defined a set of LTE SON use cases and the associated SON
functions.
As the functionality of LTE advances, the LTE SON
standardization effectively track the LTE network evolution stages.
In this way SON will be applicable to the LTE networks.

November, 2013 Course 512 v3.0 (c)2013 Scott Baxter Page 460