LTE public safety technology evolution and testing aspects Reiner Stuhlfauth Technology Management & Marketing
LTE public safety
technology evolution and testing aspects
Reiner StuhlfauthTechnology Management & Marketing
ı There are different standards for commercial and critical communication.� Commercial cellular: vast success, economy of scale, high speed enables multimedia applications,
network capacity.
� Critical Communications: robust, group communication, priority control, direct mode.
� Commitment to LTE by U.S. authorities & industry organizations.
Commercial vs. critical & tactical communication
� not optimized for critical communications, no strong coverage obligations.
� Expensive due to limited volume, slower evolution than commercial cellular
Requirements & Technical InputCellularIndustry LTE enhancements
Source: LTE Standards for Public Safety – 3GPP view , Balazs Bertenyi. Chairman 3GPP TSG SA at Critical Communications World, May 2013
May 2016 LTE public safety: technology & measurement aspects 2
Requirements for public safety in cellular world
Group communication
Video telephony anddatatransfer
Device to devicecommunication, D2D
Define priority rules
3GPP work items:• Direct Mode’ between terminals
(Discovery, Communication).• Group Communication.• Off network communication.• Push-To-Talk (PTT) including
group call / communication withlow call setup time.
May 2016 LTE public safety: technology & measurement aspects 3
Proximity Services ProSe: Direct Discovery, Direct Communication
SynchronizationDiscovery Communication
Align receiver window andfrequency correction whendetecting D2D channels.
Power efficient mechanism fortwo (or multiple) UE’s in
proximity to detect each other
e.g. Group Call (VoIP)
Public Safety use case only
Source: Qualcomm (2012)
May 2016 LTE public safety: technology & measurement aspects 4
PS-LTE is band specific, e.g. possible bands discussed
May 2016 LTE public safety: technology & measurement aspects 5
E-UTRA ProSeBand
E-UTRA Operating
Band
ProSe UE transmit ProSe UE receive ProSeDuplex Mode
ProSe Direct
FUL_low – FUL_high FDL_low – FDL_high Disc. Comm.
2 2 1850 MHz – 1910 MHz 1850 MHz – 1910 MHz HD Yes
3 3 1710 MHz – 1785 MHz 1710 MHz – 1785 MHz HD Yes Yes
4 4 1710 MHz – 1755 MHz 1710 MHz – 1755 MHz HD Yes
7 7 2500 MHz – 2570 MHz 2500 MHz – 2570 MHz HD Yes Yes
14 14 788 MHz – 798 MHz 788 MHz – 798 MHz HD Yes Yes
20 20 832 MHz – 862 MHz 832 MHz – 862 MHz HD Yes Yes
26 26 814 MHz – 849 MHz 814 MHz – 849 MHz HD Yes Yes
28 28 703 MHz – 748 MHz 703 MHz – 748 MHz HD Yes Yes
31 31 452.5 MHz – 457.5 MHz 452.5 MHz – 457.5 MHz HD Yes Yes
41 41 2496 MHz – 2690 MHz 2496 MHz – 2690 MHz HD Yes
Source: 3GPP TS 36.101 V12.7.0 (March 2015)possible bands discussed in some regions
Scenarios for ProSe Direct CommunicationWithin network coverage
(Intra- / Inter-cell)Outside network
coveragePartial network
coverageNon-public
safetyDiscovery - -
Publicsafety
Discovery,Communication
Communication Communication
Sidelink
Downlink
UplinkSidelink
Sidelink
May 2016 LTE public safety: technology & measurement aspects 6
LTE Device-to-Device (D2D) Proximity Services (ProSe)
ı Current communication flow in LTE always involves the corenetwork:� Security reasons.� Policy control (Charging!)
E-UTRAN
EPCUE #1
UE #2
eNodeB
eNodeB UE – User Equipment (LTE-capable terminal)eNode B – evolved Node B (LTE base station)
EUTRAN – Evolved UMTS Terrestrial Radio Access NetworkEPC – Evolved Packet Core (core network)
EPS – Evolved Packet System (= EUTRAN + EPC)
ProSe = End to End communicationSidelink = channel structure
May 2016 LTE public safety: technology & measurement aspects 7
Overall LTE D2D ProSe Network Architecture
ı Network is still in charge!ı New interfaces, new
functional entities.� ProSe function, P3
interface: Authorization/ Provisioning, Request, Response.
� PC5 interface: one to many
8
UE B
ProSe
applicationLTE-Uu
E-UTRAN
UE A
S1
ProSe Function
MME
S/PGW
HSS
ProSe
application
HSS SLP
ProSe
Application
Server
S6a
PC3 PC4a PC4b
PC2
PC1
PC3
LTE-Uu PC5
PC1
Triggers use of Direct Discovery, Direct Communication
Authorizes and provision the device for ProSe
User Equipment (UE)
Mobile Equipment(ME)
UICC with USIM
Request
Response
Provision info can be storedon device (public safety, tactical comm.)
May 2016 LTE public safety: technology & measurement aspects 8
Direct Discovery – General PrincipleDiscovery Request and Response
ı Announcing and monitoring is possible in RRC_IDLE and RRC_CONNECTED state.
UE #2[Monitoring Device]
EPC
ProSeFunction
Discovery Request
DiscoveryResponse
DiscoveryResponse
Discovery Request
Transaction ID, Discovery Filter, Filter ID
Transaction ID, ProSeApplication ID, UE Identity (IMSI),
Command: Announce, Application ID
Transaction IDProSe Application Code,
Validity Timer etc.
Transaction ID, ProSeApplication ID, UE Identity (IMSI),Command: Monitor, Application ID
© Rohde&Schwarz 2015
UE #1[Announcing Device]
May 2016 LTE public safety: technology & measurement aspects 9
What is actually being ‘announced’ or ‘monitored’ by a device? Discovery Message
ı Two types of resource allocation for Direct Discovery: Type 1 and Type 2. � Discovery Message is transmitted on Physical Sidelink Discovery Channel (PSDCH), QPSK
modulation, 2 PRBs.
Message Type ProSe Application Code MIC UTC-based Counter LSB
8 bit 184 bit 32 bit 8 bit
232 bit
Open or Restricted discovery?Discovery Model?
(Rel.12 Model A only)
May 2016 LTE public safety: technology & measurement aspects 10
ProSe Security Parameters
May 2016 LTE public safety: technology & measurement aspects 11
PS-LTE has lots of security aspectscovered in the specification, e.g.
• ciphering & authentication• key handling• key negotiation
Device to device D2D: radio communication aspects
LTE direct communication
1 1 2 2 1 1 1 2 2 1
UE1UE2
Uplink LTE frequency band is used for D2DSC-FDMA scheme is used, Duplex mode is TDD
Normal CP
Extended CPCP CP CP CP CP CPOFDMSymbol
OFDMSymbol
OFDMSymbol
OFDMSymbol
OFDMSymbol
OFDMSymbol
1 2 3 4 5 6 7
1 frame à 10 msec
1 subframe à 1 msec
UE can negociateCP length
Last symbol in subframeIs skipped to enableRx-Tx switching
May 2016 LTE public safety: technology & measurement aspects 12
……
Resource Allocation for Direct Discovery, Direct Communication
ı A device is not required to simultaneously transmit D2D and WAN (generic LTE).
D2D D2D D2D D2D Bitmap Prose-SubframeBitmap-r12, e.g. 8 bit
PUCCH
PUCCH
cellular
cellular
e.g. DirectDiscovery
Resource Block Startprb-Start-r12
Resource Block Endprb-End-r12
Number of Resource Blocksprb-Num-r12
2015
©R
ohde
&S
chw
arz
cellular
e.g. DirectDiscovery
Number of Resource Blocksprb-Num-r12
Information provided bynewly introduced SystemInformation Blocks (SIB)
1 ms
Time
May 2016 LTE public safety: technology & measurement aspects 13
Overall process of Resource Allocation by the networkMode 1, eNB directly assigns transmission resources
UE #1
eNode B, EPC withProSe function
UE #2
DCI Format 5 on (E)PDCCH with CRC scrambled with SL-RNTI
SCI Format 0 on PSCCH
Data on PSSCH according to info in SCI Format 0, scrambled with Group Destination ID
SCI Format 0
Frequency hopping flag 1 bitRB Assignment and
hopping allocation
Num. of bits dependent on hopping active or not
Time Resource Pattern 7 bitModulation and Coding Scheme (MCS) 5 bit
Timing Advanced Indication 6 bitGroup Destination ID 8 bit
SIB Type 18 provides reception resource pool
2x
4x
SIB Type 18 acquisition
SidelinkUEInformation
RRCConnectionReconfiguration
May 2016 LTE public safety: technology & measurement aspects 14
ı For both scenarios, in-coverage (IC) and out-of-coverage (OoC), dependent on certain settings an UE can act as synchronization source transmitting synchronization signals and PBSCH.� Sidelink Synchronization Signal (SLSS) consists of Primary SLSS (PSSS), Secondary SLSS
(SSSS), similar to LTE Rel-8 downlink design. Periodicity is 40 ms.� PSBCH has same periodicity as SLSS. QPSK modulated, TBCC, 16-bit CRC.� Multiplexed into same RB as SLSS; see mapping principle, PSBCH carries Master Information Block
Sidelink (MIB-SL):� D2D System Frame Number (DFN), if UE in-coverage,
than DFN = SFN. DFN is 14 bit (10 bit + 4 bit offset). Subframe number [0…9].
� TDD UL-DL configuration [3 bit]. Reserved in case of FDD. � In-coverage bit [1 bit]. Bandwidth [3 bit]. � Reserved field [20 bit]. Set to a SIB-signaled or
preconfigured value in Rel-12.
1313 1313
Sidelink Synchronization Signals (SLSS), Physical Sidelink
Broadcast Channel (PSBCH) for Direct Communication
131211109876543210
Synchronization Subframe [1 ms], configured by higher layers
PSSS PSBCH SSSS GuardDMRS
6 R
esou
rce
Blo
cks
May 2016 LTE public safety: technology & measurement aspects 15
D2D: transmission of sync signals by a UE, 3 possible scenarios
Way 1: UE is instructed by network
please send syncsignal on allocated
ressources
Way 2: UE decision when in coverage
Way 3: UE decision when out of coverage
1. UE listensfor other UEs sync signals
2. UE transmitssync signals onpredefinedressources
May 2016 LTE public safety: technology & measurement aspects 16
Challenging Sidelink Synchronization Signal characteristicsPAPR, CM of Sidelink Synchronization Signals (SLSS)
May 2016 LTE public safety: technology & measurement aspects 17
CCDF, AM/AM and AM/PM of SLSS ID = 288
ı CCDF of measurement of SLSS ID = 288.
ı SLSS ID = 288 in FSW-K18 Power Amplifier measurement.
May 2016 LTE public safety: technology & measurement aspects 18
Outlook for Rel-13ı Mission Critical Push-To-Talk (MCPTT)
May 2016 LTE public safety: technology & measurement aspects 19
Remote
UERelay UE eNB
Public
Safety
ASPC5 Uu
EPC
SGi
Out- of-network
Always in coverage
in / out of coverage for
discovery and
selection
Discovery and (re-) Selection of Relay
UE
Protocol required
Control whether UE may act as a Relay
UE
ı UE as relay definition
ı Priority handling: group priority definition
ı Inter PLMN D2D communication
Testing of D2D/ProSe UEs
Integrate device emulation into CMW500; act as a network emulator and / or emulate device functionality.
Network link Sidelink (ProSe/D2D)
Testing UE signaling performance, protocol testing & application testing
Testing UE RF performance, e.g. Tx power, Rx sensitivity, modulation quality, throughput
Additional testing like e.g. Audio + video quality, battery drain, carrier acceptance tests, in-device interference aspects etc.
May 2016 LTE public safety: technology & measurement aspects 20
PS-LTE Drive Testing aspectsPosition Estimation of Base Stations
Coverage & Best server versus map
Automaticchannel detection
May 2016 LTE public safety: technology & measurement aspects 21
Drive testing aspects: Network performance analysis – statistic results l Network Performance
Analysisl Coveragel Interferencel Cell Problem Spots
l Neighborhood Analysis
l Handover Analysis
l Quality-of-Servicel Call Problem Spotsl Speech Quality
Analysisl Spectrum Analysis
May 2016 LTE public safety: technology & measurement aspects 22
Drive testing aspects: Network performance analysis – realtime results
May 2016 LTE public safety: technology & measurement aspects 23
LTE detailled analysis, e.g. interference detection & subband analysis
S-Synch (Power/SINR)P-Synch(Power/SINR)
72 SC (PBCH)(NB RSRPNB RSRQNB RS-SINR)
1 MHz = 62 SC
10 ms / 3 MHz FDD
5 ms => 200 Hz
Full Bandwidth e.g. 3 MHz � 180 SC (RSSI, WB RSRP, WB RSRQ, WB RS SINR)
Tx Antenna 1 (R0)Tx Antenna 2 (R1)
Interference canbe detected with WB measurements
Source of LTE grid: http://paul.wad.homepage.dk/LTE/lte_resource_grid.html
Subband
0
Subband
1
Subband
14
WB RS measurementsper subband(WB RS SINR)
All RS measurements (NB and WB) separately for R0 and R1
…
The „Achilless heel“ of LTE: Primary & Secondary Sync channel
should be at good SNR
May 2016 LTE public safety: technology & measurement aspects 24
Rohde & Schwarz LTE Test SolutionsCovering the full range of LTE & InterRAT test requirementsı LTE Device Testing
� R&D, Regression, Conformance, Operator Test Plans� RF, RRM, Protocol, IMS/VoLTE, Location Based Services� Over the Air Antenna Performance (TRP/TIS)� Mission Critical Communications
� High Power UE, Device-to-Device, etc.ı LTE Network Testing
� Installation, Maintenance, Drive Test, Benchmarking, Interference Hunting, Network Optimization, IP Analysis
ı Researching LTE Vulnerabilities� Unintentional / Intentional Jamming� Protocol Stack Manipulation
ı Researching Coexistence between LTE and other technologies� 40+ Bands of LTE FDD/TDD; InterRAT Performance� Radar + GNSS� WLAN, BT, GSM, CDMA, WCDMA, LTE
May 2016 LTE public safety: technology & measurement aspects 25
Rohde&Schwarz LTE/LTE-Advanced test solutions (device)
Signaling Conformance
R&S®CMW500including 3GPP
conformance tests
R&
S®T
S89
80S
yste
m
R&S®CMW500
Testing of- Protocol Layers- Operator Scenarios- E2E Application-Max. Throughput- IP4/6- MIMO- Handover
Signal Generator / Fading Simulator
R&S®FSW/FSQ/FSV(R)
R&S®SMW200A
One box Mobile Radio Tester for
Calibration, Verification and Functional Test
R&S®CMW500
RF, RRM Conformance, AGNSS& Data Performance
R&S®RTO
RF Development Protocol Stack Field Conformanceand Production and IOT Testing Testing
R&S®SMBV100
PowerMeter
R&S®NRP
Signal Analyzer
R&
S®T
S-R
RM
/LB
S/P
QA
S
yste
m
SwissQualFreerider III
R&S TSME Ultra-compact Drive Test Scanner
SwissQualBenchmarker II
Field Test / Benchmark
May 2016 LTE public safety: technology & measurement aspects 26
Summary
ı LTE standard is currently extended to support critical and tactical communication.� “Direct Mode”, group control and out of network communication.
ı Stepwise approach, first features (Direct Discovery, Direct Communication) are added with 3GPP Release 12 and are further enhanced/extended with future release of the standard, e.g. Mission Critical Push To Talk (MCPTT) with Release 13.
ı Complexity of features requires new test strategies to verify conformance and performance of devices supporting Direct Discovery, Direct Communication. � Not only OEM’s are impacted, but also component manufacturers.
ı Rohde&Schwarz is your competent partner in solving these problems while offering adequate test solutions, e.g. R&S®CMW500 Wideband Radio Communication Tester.
May 2016 LTE public safety: technology & measurement aspects 27