Monitoring and Analysis of 4G Mobile Networks: A Practical Guide for Telecommunications Engineering Training 9788418177101

Citation preview

Moni t or i ngandAnal ysi sof4G Mobi l eNet wor ks: APr act i cal Gui def orTel ecommuni cat i ons Engi neer i ngTr ai ni ng Aut or es/ as: Bal domer oCol l Per al es Al ej andr oMol i naGal an J avi erGoz al vezSemper e Mi guelSepul cr eRi bes I SBN: 9788418177101 Fechadeedi ci ón: 10/ 06/ 2021 Edi t or i al : Uni ver s i dadMi guelHer nándezdeEl c he Maquet aci ón: Ser vi c i odeI nnovac i ónyPl ani fic ac i ónTec nol ógi c a ( SI PT)UMH Not adel aedi t or i al : Lost ext osdees t apubl i c ac i ónys ur evi s i ónor t ogr áfic a s onr es pons abi l i daddel os / asaut or es / as

Contents Contents Figure List Table List Acronyms 1. Introduction 2. QualiPoc 2.1. Appearance and workspace 2.1.1. Cell info banner 2.1.2. Monitor section 2.1.3. Main toolbar 2.2. Settings 2.2.1. Map settings 2.2.2. BTS information 2.2.3. Signaling 2.2.4. IP Monitor 2.2.5. Customization 2.2.6. Notifications 2.2.7. Forcing 2.2.8. Unit configuration 2.2.9. Advanced Analysis Settings 2.2.10. Appearance 2.2.11. Import/Export Configuration 2.2.12. Update QualiPoc 2.2.13. Text markers 2.3. Jobs 2.3.1. Single Call Tests 2.3.2. Single Data Tests 2.3.3. Multiple Tests 2.3.4. Job Sequence 2.3.5. Idle 2.3.6. Upload 2.4. Results Manager 2.5. QualiPoc monitors 2.5.1. General monitors 2.5.2. LTE monitors 2.6. Conducting measurements with QualiPoc 2.6.1. Starting the measurements 2.6.2. During the measurements 2.6.3. Finishing jobs and measurements 3. NQView 3.1. Initiating a new session 3.2. User interface 3.2.1. Menu bar 3.2.2. Navigation panel 3.2.3. Main toolbar buttons

3.3. NQView monitors 3.3.1. General monitors 3.3.2. Device monitors 3.3.3. Monitor title pop-up menu 3.4. NQView pages 3.4.1. Device pages 3.4.2. Page pop-up menu 3.5. NQView events 4. Measurements and Analysis 4.1. Analysis of cellular signaling processes 4.1.1. Testing environment 4.1.2. Conducting the measurements 4.1.3. Analysis of the obtained results 4.1.4. Voice call establishment and ending 4.1.5. Broadcast information 4.2. Cell selection and reselection 4.2.1. Testing environment and QualiPoc configuration 4.2.2. Analysis of the obtained results 4.3. Handover 4.3.1. Testing environment and QualiPoc configuration 4.3.2. Analysis of the obtained results 4.4. Variation of LTE parameters during data download 4.4.1. Testing environment and QualiPoc configuration 4.4.2. Analysis of the obtained results Appendix I. Quick guide to launch/use QualiPoc Appendix II. Terms Index Appendix III. CQI table Appendix IV. NQView: Import BTS List

Figure List Figure 2-1. Samsung Galaxy S5 and Samsung Galaxy Note 3 running the QualiPoc APP Figure 2-2. Executing QualiPoc (a), and welcome screen (b) Figure 2-3. QualiPoc’s workspace Figure 2-4. Examples of three different cell info banner Figure 2-5. Customization of the Cell info banner’s parameters Figure 2-6. Monitor section and details of specific parameters (e.g., RSRP) listed on it Figure 2-7. QualiPoc’s main toolbar Figure 2-8. QualiPoc’s Settings Figure 2-9. QualiPoc’s map settings Figure 2-10. BTS information (a), Map monitor view showing the BTS (b), and information about the BTS (c). Figure 2-11. LTE BTS info file Figure 2-12. Signaling setting for LTE Figure 2-13. QualiPoc’s IP Monitor Figure 2-14. Customization’s workspaces (a), current workspace (b), predefined monitors (c), and LTE parameters in the LTE monitor Figure 2-15. Notifications settings: Monitored parameters Figure 2-16. Notifications settings: Layer 3 message Figure 2-17. Notifications at the Android notification bar (a),and the QualiPoc Monitor’s Notifications window Figure 2-18. Basic forcing features for LTE Figure 2-19. Advanced forcing features for LTE Figure 2-20. QualiPoc’s unit configuration Figure 2-21. QualiPoc’s advanced analysis settings Figure 2-22. QualiPoc’s appearance Figure 2-23. QualiPoc’s import/export configuration Figure 2-24. QualiPoc’s update settings Figure 2-25. Text markers Figure 2-26. Creating a new job Figure 2-27. Configuration of the Single Call Tests – Call to any Number Figure 2-28. Single Data Tests menu Figure 2-29. FTP DL job type Figure 2-30. FTP UL job type Figure 2-31. HTTP Browser job type Figure 2-32. HTTP transfer DL job type Figure 2-33. Ping job type Figure 2-34. Multiple tests menu Figure 2-35. Multi-DATA configuration (a), and editing of the script (b) Figure 2-36. Multi-Mix configuration (a), and editing of the script (b) Figure 2-37. Multi-RAB configuration Figure 2-38. Parallel job type Figure 2-39. Job Sequence menu Figure 2-40. Idle job type

Figure 2-41. Upload Figure 2-42. Opening Results window Figure 2-43. Results Manager Figure 2-44. File manager Figure 2-45. Results’ replay Figure 2-46. QualiPoc general monitors and LTE monitors Figure 2-47. Customizing the content of the monitors: Status (a) & Log (b) Figure 2-48. Status content customization Figure 2-49. Network Info parameters available for the Status monitor Figure 2-50. Service Test parameters available for the Status monitor1 Figure 2-51. LTE cell parameters available for the Status monitor Figure 2-52. LTE PDSCH parameters available for the Status monitor Figure 2-53. LTE PUCCH parameters available for the Status monitor Figure 2-54. LTE PUSCH parameters available for the Status monitor Figure 2-55. GPS Position parameters available for the Status monitor Figure 2-56. Voice parameters available for the Status monitor Figure 2-57. WiFi parameters available for the Status monitor Figure 2-58. Log monitor Figure 2-59. Test monitor for jobs Call Tests – Call to any number (a), Data Tests – HTTP Browser (b) Figure 2-60. Signaling monitor list and configuration (a), and detailed content (b) Figure 2-61. IP monitor list and configuration (a), and detailed information (b) Figure 2-62. Event monitor list and configuration (a), and detailed information (b) Figure 2-63. Map monitor main window Figure 2-64. Map monitor configuration of location features Figure 2-65. Map monitor’s main menu options: layers (a), tile cache manager (b), additional settings (c) Figure 2-66. Notifications monitor (a) and configuration of notifications (b) Figure 2-67. LTE monitor Figure 2-68. LTE DL monitor Figure 2-69. LTE UL monitor Figure 2-70. Cells (LTE) monitor Figure 2-71. Coverage (LTE) monitor Figure 2-72. Useful tips - Start logging Figure 2-73. Recording status Figure 2-74. Useful tips - Freeze display, screenshots and photos Figure 2-75. Useful tips - Add marker Figure 2-76. Stopping a job Figure 2-77. Saving the measurements Figure 3-1. Device Manager to enable the USB copy protection dongle Figure 3-2. NQView icon on Windows desktop Figure 3-3. NQView empty user interface Figure 3-4. NQView Workspace with multiple Pages Figure 3-5. NQView Pages bar Figure 3-6. NQView LTE ready-made Page Figure 3-7. File menu Figure 3-8. Settings menu Figure 3-9. View menu

Figure 3-10. Replay menu Figure 3-11. Data Export Figure 3-12. Data presentation menu Figure 3-13. Workspace menu Figure 3-14. Window menu Figure 3-15. Help menu Figure 3-16. Pages and Monitors panel Figure 3-17. Types of Pages (a), and Monitors (b) Figure 3-18. Values panel Figure 3-19. Events panel Figure 3-20. NQView General monitors (a) and Device monitors (b) Figure 3-21. NQView Customized monitors Figure 3-22. Line chart monitor Figure 3-23. Line char monitor pop-up menu Figure 3-24. Bar chart monitor Figure 3-25. Bar chart monitor pop-up menu Figure 3-26. Pie chart monitor Figure 3-27. List monitor Figure 3-28. List monitor pop-up menu Figure 3-29. Table monitor Figure 3-30. Table monitor pop-up menu Figure 3-31. Map monitor (MapX view) Figure 3-32. Loading a new map model (Geoset) Figure 3-33. Spain Geoset Figure 3-34. Map monitor (Open street map view) Figure 3-35. Map monitor pop-up menu Figure 3-36. Left-side panel of the Map monitor Figure 3-37. Map checkbox pop-up menu Figure 3-38. Path checkbox pop-up menu Figure 3-39. Drive path or Walk path checkboxes pop-up menu Figure 3-40. Measure values checkbox pop-up menu Figure 3-41. RSSI legend Figure 3-42. Shade Editor Figure 3-43. Color legend edition: range selection with double-click (a) and Shade Style window (b) Figure 3-44. Devices monitor Figure 3-45. NQView events monitor Figure 3-46. GPS monitor Figure 3-47. Available Device monitors for (a) GSM, (b) HSDPA, (c) HSUPA and (d) LTE technologies Figure 3-48. Two examples of LTE Device monitors: (a) LTE PUSCH Throughput Line Chart, and (b) LTE PUSCH Info Figure 3-49. Layer 3 monitor Figure 3-50. Exporting Layer 3 messages Figure 3-51. Monitor title pop-up menu Figure 3-52. Pages bar Figure 3-53. Page example Figure 3-54. Device pages available in NQView Figure 3-55. Device page LTE UL Data

Figure 3-56. Page pop-up menu Figure 3-57. Create a new event Figure 3-58. Event window Figure 3-59. Event definition window Figure 3-60. Event notification window Figure 3-61. New created event Figure 3-62. Created event pop-up window Figure 4-1. Area of Elche where the https://geoportal.minetur.gob.es/VCTEL/vcne.do)

field

tests

are

conducted

(source:

Figure 4-2. Testing environment for the analysis of the cellular signaling processes Figure 4-3. Creating a Single Call Test job Figure 4-4. Open a measurement file in NQView Figure 4-5. Layer 3 Monitor in NQView Figure 4-6. Part of a LTE EPS LTE EMM Extended service request message decoded in NQView Figure 4-7. Part of a LTE RRC Connection Request message decoded in NQView Figure 4-8. Part of a LTE RRC Connection Setup Complete message decoded in NQView Figure 4-9. Part of a LTE RRC Connection Relese message decoded in NQView Figure 4-10. Technology history monitor Figure 4-11. Part of a RRC Connection Request message decoded in NQView Figure 4-12. Part of an RRC Connection Setup message decoded in NQView Figure 4-13. Part of a CM Service Request message decoded in Nemo Outdoor Figure 4-14. Part of an RRC Connection Setup Complete message decoded in NQView Figure 4-15. Initial Direct Transfer message decoded in NQView Figure 4-16. Part of a Route Area Update Request message decoded in NQView Figure 4-17. Part of a Security Mode Command Message decoded in NQView Figure 4-18. Security Mode Command Complete Message decoded in NQView Figure 4-19. Setup layer 3 message decoded in Nemo Outdoor Figure 4-20. Identity Request message decoded in NQView Figure 4-21. Idendity Response layer 3 message decoded in NQView Figure 4-22. Call Proceeding layer 3 message decoded in NQView Figure 4-23. Part of a Radio Bearer Setup message decoded in NQView Figure 4-24. Radio Bearer Setup Complete message decoded in NQView Figure 4-25. Alerting layer 3 message decoded in NQView Figure 4-26. Connect layer 3 message decoded in NQView Figure 4-27. Connect Acknowledge layer 3 message decoded in NQView Figure 4-28. Example 1 of Paging message decoded in NQView Figure 4-29. Example 2 of Paging message decoded in NQView Figure 4-30. Example 3 of Paging message decoded in NQView Figure 4-31. Part of a LTE EPS LTE EMM Extended service request message decoded in NQView Figure 4-32. Part of a RRC Connection Request message decoded in NQView Figure 4-33. Paging Response message decoded in NQView Figure 4-34. Disconnect layer 3 message decoded in NQView Figure 4-35. Release layer 3 message decoded in NQView Figure 4-36. Release Complete layer 3 message decoded in NQView Figure 4-37. RRC Connection Release message decoded in NQView Figure 4-38. RRC Connection Release Complete message decoded in NQView Figure 4-39. Master Information Block message decoded in NQView Figure 4-40. System Information Block Type 1 message decoded in NQView

Figure 4-41. System Information Block Type 2 message decoded in NQView Figure 4-42. System Information Block Type 3 message decoded in NQView Figure 4-43. Part of a System Information Block Type 5 message decoded in NQView Figure 4-44. System Information Block Type 7 message decoded in NQView Figure 4-45. System Information Block Type 1 message decoded in NQView Figure 4-46. Graph diagram defined in 3GPP TS 36.304 of the cell selection and reselection8 Figure 4-47. Idle job type Figure 4-47. Testing environement for the cell selection and reselection test Figure 4-48. Load measurements to analyze the cell reselection process Figure 4-49. Open Device monitor with LTE serving and neighbors’s RF measurements Figure 4-50. Filter out Values parameters to select the desired metric Figure 4-51. Line chart with RSRP and RSRQ of serving cell (red line) and 1st neighbour cell (green line) during a reselection process Figure 4-52. LTE serving and neighbors. Values reported in the table correspond to the time instant marked in Figure 4-51 with the vertical yellow line Figure 4-53. LTE cell information for the different cells the mobile station connects to Figure 4-54. Geo-positioned route colored with the scrambling code of the active cell Figure 4-55. Cell identity information reported in the System Information Block Type 1 for the different cells the mobile station connect to alongh the route Figure 4-57. HTTP transfer DL job type Figure 4-56. Testing environment for the handover test Figure 4-57. Illustration of the possible A1-A6 events and conditions that trigger them Figure 4-58. Part of a RRC Connection Reconfiguration message that includes the measurement configuration information decoded in NQView Figure 4-59. Part of a RRC Connection Reconfiguration message that includes the mobility control information decoded in NQView Figure 4-60. Part of a RRC Connection Reconfiguration Complete message decoded in NQView Figure 4-61. Part of a Measurement Report message decoded in NQView Figure 4-62. LTE Serving and Neighbors monitor available in NQView (1) Figure 4-63. LTE Serving and Neighbors monitor available in NQView (2) Figure 4-64. Part of a Measurement Report message decoded in NQView Figure 4-65. Part of a Measurement Report message decoded in NQView Figure 4-66. LTE DL Data Device page: LTE Cell Monitor Figure 4-67. LTE DL Data Device page: LTE DL Harq Info Monitor Figure 4-68. LTE DL Data Device page: LTE PDSCH Monitor Figure 4-69. LTE DL Data Device page: LTE PDSCH Throughput Monitor Figure 4-70. LTE DL Data Device page: LTE PDSCH Scheduling chart Monitor Figure 4-71. LTE DL Data Device page: LTE PDSCH Throughput Line chart Monitor Figure 4-72. LTE Avg MCS Index: not forced Figure 4-73. LTE Avg MCS Index: forced Figure 4-74. PCI: (a) not forced, (b) forced Figure 4-75. HARQ process when the mobile station is not forced Figure 4-76. HARQ process when the mobile station is forced Figure 4-77. Rate of QPSK,.16QAM and 64QAM when the mobile station is not forced Figure 4-78. Rate of QPSK,.16QAM and 64QAM when the mobile station is forced Figure 4-79. BLER and PDSCH Throughput when the mobile station is not forced Figure 4-80. BLER and PDSCH Throughput when the mobile station is forced Figure 4-81. Num RBs when the mobile station is not forced Figure 4-82. Num RBs when the mobile station is forced

Figure IV-1. Base stations data to be imported Figure IV-2. LTE BTS List window Figure IV-3. Import BTS window Figure IV-4. Open BTS file Figure IV-5. Delimited ASCII information Figure IV-6. Field Assignment dialog box Figure IV-7. Importing base station data in the Import BTS window

Table List Table 2-1. E-UTRA channel numbers Table 2-2. Cell selection parameters (definitions extracted from 3GPP TS 36.304) Table 2-3. Map monitor’s top bar symbols Table 2-4. Map monitor’s route symbols Table 2-5. Tracking lines and BTS symbols Table 3-1. Main toolbar buttons Table 3-2. Map monitor toolbar buttons Table 4-1. Signaling messages to move the call from 4G to 3G network Table 4-2. Signaling messages establish the voice call in the 3G network Table 4-3. Signaling messages for the establishment of a network originated voice call Table 4-4. Summary of layer 3 messages needed to establish a voice call between a calling and a called mobile station Table 4-5. Signaling messages for the release of a user terminated voice call Table 4-6. Signaling messages for the release of a network terminated voice call Table 4-7. Information contained in the system information blocks Table 4-8. Definition of the cell selection criterion’s parameters (3GPP TS 36.304)8 Table 4-9. Time instants when the cell relections take place Table 4-10. Messages that are exchanged in the LTE handover process

Acronyms AICH AM AMR ARFCN BCCH BLER BTS CC CCCH CPICH CQI DCCH DL DPCH EARFCN EDGE GPRS GSM HARQ HSPA IMEI KPI LAC LTE MCC MCS MNC PCCH PDV PICH PSDSCH PUCCH PUSCH RAC RACH RRC RSCP RSRQ RSSI RTP STTD TAC TMSI UL UM UMTS UTRAN WCDMA

Acquisition Indicator Channel Acknowledge Mode Adaptive Multi-Rate Absolute Radio Frequency Channel Number Broadcast Control Channel Block Error Rate Base Transceiver Stations Call Control Common Control Channel Common Pilot Channel Channel Quality Indicator Dedicated Control Channel Downlink Dedicated Physical Channel E-UTRA Absolute Radio Frequency Channel Number Enhanced Data rate for GSM Evolution General Packet Radio Service Global System for Mobile communications Hybrid Automatic Repeat Request High-Speed Packet Access International Mobile Equipment Identity Key Performance Indicator Location Area Code Long Term Evolution Mobile Country Code Modulation and Coding Scheme Mobile Network Code Physical Control Channel Packet Delay Variation Pilot Channel Physical Downlink Shared Channel Physical Uplink Control Channel Physical Uplink Shared Channel Routing Area Code Random Access Channel Radio Resource Control Received Signal Code Power Reference Signal Received Quality Received Signal Strength Indicator Real-Time Protocol Space-Time block coding based Transmit Diversity Tracking Area Code Temporary Mobile Subscriber Identity Uplink Un-acknowledge Mode Universal Mobile Telecommunications System Universal Terrestrial Radio Access Network Wideband Code Division Multiple Access

1. Introduction The Universidad Miguel Hernández (UMH)’s Telecommunications Technology Engineering undergraduate program includes an elective course on Mobile and Wireless Communications. This course covers fundamentals and detailed explanations of the operation of the main mobile and wireless communication systems, in order to provide the students with the necessary knowledge and skills for designing, dimensioning, and deploying them. In the units dedicated to the mobile communications systems, the course includes the study of the cellular standards from 2G to 5G1, 2. The course’ lectures focus on explaining the basic elements that integrate the mobile communication systems (mobile station, radio access network and core network), and the way they interact. The course complements these theoretical knowledges with laboratory sessions where the students can actively analyze a live cellular network using professional mobile network testing equipment. The course started this innovative teaching laboratory by analyzing 3G cellular networks using Anite’s products Nemo Handy and Nemo Outdoor. A detailed description of these network testing tools and the laboratory activities conducted by the students over 3G is presented in 3,4,5. Through these laboratory activities, the students showed a better understanding and assimilation of the 3G technical concepts taught in lectures. This has motivated the course lecturers to evolve the laboratory material for the study of 4G (Long Term Evolution -LTE1) using the SwissQual’s renewed mobile network testing tools QualiPoc and NQView. Following the philosophy of the book presented by the authors in 5, this book follows a tutorial style to clearly guide the students towards the understanding on how to use these professional mobile network testing tools used to monitor, collect measurements, post-process and analyze the performance of 4G cellular networks. In this context, the book first includes a manual to show the students how to configure and use the professional network testing tools utilized in the laboratory of the UMH’s Mobile and Wireless Communications course. The explanations focus on the operation of the testing tools to monitor the performance of 4G, although they can be also used to perform tests over 2G and 3G. First, this book introduces in Chapter 2 the SwissQual’s QualiPoc professional mobile network testing tool that runs on Android smartphones. The QualiPoc APP displays in real-time the cellular network performance and can be also configured to log specific voice and data measurements collected in field tests. The collected measurements are then postprocessed using the NQView software in a PC. The NQView allows to replay the collected measurements in order to jointly analyze the interaction and dependencies of multiple mobile network parameters. Since the measurements are first collected using the QualiPoc tool and then post-processed using the NQView software, the mobile network parameters that can be analyzed are primarily related to the radio interface. Then, Chapter 3 describes how to use and configure the most relevant features of NQView to analyze the logged measurements. Finally, this book includes in Chapter 4 a set of measurements conducted over a live 4G cellular network in Elche (Alicante, Spain). Chapter 4 describes the planning and reasoning behind the conducted measurements, the necessary configuration of the QualiPoc testing tool to realize such measurements and to collect the mobile network data, and finally the post-processing done using NQView to analyze the operation and performance of 4G.

1

Note that in 3GPP notation it is used the term E-UTRA (Evolved Universal Terrestrial Radio Access) to refer to the LTE air interface.

2. QualiPoc QualiPoc is a professional software tool developed by the Rohde & Schwarz’s company SwissQual AG, a Telecommunications company specialized in mobile and wireless network service quality benchmarking and network optimization. QualiPoc runs on Android smartphones with modified firmware and operative system that allows monitoring and testing in real-time the operation of cellular networks. QualiPoc is available for several smartphones and tablet models. At UMH, QualiPoc is installed on Samsung Galaxy S5 (SM-G900F) and Samsung Galaxy Note 3 (SM-N9005) handset devices. Both devices support GSM, GPRS, EDGE, UMTS/WCDMA, HSPA and LTE cellular technologies. Over these technologies, QualiPoc performs extensive network measurements and presents detailed network parameters captured over voice calls, data connections (FTP UL/DL, HTTP browser, HTTP transfer UL/DL, etc.), SMS/MMS messaging and specific applications. QualiPoc has been designed for indoor and outdoor use powered with indoor maps and GPS data. It allows to time- and geo-reference all captured measurements. These features make QualiPoc a proven valuable tool to assist field engineers in network planning, rollout, optimization, tuning, verification, maintenance and troubleshooting of cellular networks. As useful as the monitoring of the mobile network parameters for real-time testing, QualiPoc is also able to log all the measurements taken during the field tests. This also includes the signaling messages transmitted by the mobile device and those received from the serving base station. The logged measurements are saved in a measurement file that can be post-processed using PC-based software tools like NQView and NQDI.

Figure 2-1. Samsung Galaxy S5 and Samsung Galaxy Note 3 running the QualiPoc APP.

The rest of this chapter provides a detailed, manual-style description of QualiPoc. In particular, Section 2.1 describes the appearance and workspace available in QualiPoc. Section 2.2 shows the QualiPoc configuration possibilities that are available in the Settings tab of the main Menu (top right ⋮ button). Then, Section 2.3 describes how QualiPoc can be configured to perform Jobs that are sequences of voice/data tests. QualiPoc measurement results are saved on the phone, and Section 2.4 shows the available options to manage the obtained results. Section 2.5 describes the set of screens/views or monitors that QualiPoc uses to represent in real-time the network performance and it introduces in detail the parameters that are displayed in the QualiPoc’s monitor views. These parameters are described for the case in which QualiPoc is monitoring LTE (alternative views are enabled when QualiPoc monitors other technologies like UMTS/HSPA). Finally, Section 2.6 summarizes the main indications to perform measurements with QualiPoc.

2.1. Appearance and workspace The QualiPoc software is installed as other Android applications and hence can be easily executed using the QualiPoc icon available on the mobile phone’s desktop (Figure 2-2.a)). Press the QualiPoc icon to execute QualiPoc. While the QualiPoc application is loading, it will show the welcome screen that is depicted in Figure 2-2.b). Alternatively, the QualiPoc icon can be found in the Apps menu that is available when you tap the menu button ( ) on the mobile phone display.

(a)

(b)

Figure 2-2. Executing QualiPoc (a), and welcome screen (b).

Once the QualiPoc application is executed, it shows the main display or workspace that is depicted in Figure 2-3. The workspace includes the Cell info banner at the top, the Monitor section in the middle, and the Main toolbar at the bottom of the display. Note that the Main toolbar slides in and out of the display screen. Cell info banner

Monitor section

Main toolbar

Main toolbar

Figure 2-3. QualiPoc’s workspace.

2.1.1. Cell info banner The Cell info banner is divided into two parts (Figure 2-4). At the top it shows the status of QualiPoc. As shown in the three different images of Figure 2-4, some of the status options are ‘Idle’, ‘Recording’ and ‘Replay’. By default, QualiPoc is in ‘Idle’ status and it shows the network parameters and their values which are measured by the mobile device in the background. When a Job (name given by QualiPoc for the applications that are tested) is being executed and QualiPoc is logging the network parameters and signaling, its status changes to ‘Recording’. Finally, QualiPoc can reproduce saved measurement files as it will be detailed in Section 2.4. In this case, the QualiPoc status changes to ‘Replay’. Additional details about how to activate each of these statuses are provided later in this book.

In addition to the QualiPoc status, the Cell info banner also shows up to two parameters in the Title section and up to ten parameters in the Banner section. For example, for the images presented in Figure 2-4 the Title section shows the operator (e.g., Orange, Vodafone or Telefonica) and network (e.g., Home network or LTE) parameters, and the Banner section the cell Id, channel number, cell signal level, cell signal quality and forcing option. The parameters to be displayed in the Cell info banner can be customized. To this aim, press and hold the Cell info banner section. This opens the pop-up menu displayed in Figure 2-5. The Title and Banner parameters can then be selected using the new window. The potential parameters to be added to the Cell info banner are grouped in tabs. There are multiple tabs available that group related parameters including Freerider, Network Info, Service Test, GSM Cell, GSM Channel, GSM Data, WCDMA Cell, WCDMA Channel, WCDMA HSDPA, WCDMA HSUPA, LTE Cell, LTE PDSCH, LTE PUCCH, LTE PUSCH, CDMA, EVDO, GPS Position, Voice, WiFi.

Figure 2-4. Examples of three different cell info banner.

Figure 2-5. Customization of the Cell info banner’s parameters.

Figure 2-6. Monitor section and details of specific parameters (e.g., RSRP) listed on it.

2.1.2. Monitor section QualiPoc’s Monitor section is the main space of the workspace. It includes multiple tabs that become active when the parameters listed under this tab are accessible. As it is described in Section 2.5, QualiPoc’s monitors are grouped into status, log, test, signaling, IP, events, map, notifications, and LTE. You can navigate through all the tabs by sliding the top banner right and left. In each of the tabs, additional information can be obtained for each of the parameters listed. For example, as shown in Figure 2-6, when the bar graph of the RSRP parameter is pressed, a

new window opens that shows statistical information about this parameter since QualiPoc started (current, minimum, maximum, average values), and its evolution with time in a line graph. Section 2.5 reviews and describes all available monitors, and the parameters that are listed under each of these tabs’ windows or monitors.

2.1.3. Main toolbar The Main toolbar is located at the bottom of the QualiPoc workspace and it includes four different icons/options that allow you to perform the following actions (Figure 2-7): • Freezing ( ): it freezes the status of the Monitor section and hence all parameters listed show the same value until the freezing button is pressed again. While the Monitor section is frozen, a text indicating “Freezing” blinks in the Cell Info banner section. It is important to highlight that when QualiPoc is recording and the freezing option is used, the data that is not displayed is not lost since QualiPoc continues recording in the background. Then, this freezing option is valid when the user wants to pay a close look to some parameters for a while, but without stopping the measurements. •

•

•

Screenshot ( ): it captures the current handset screen and saves the image in PNG format. Images are saved in the phone in the following path ‘...\Phone\QualiPoc\Results’ and it is labeled following the format ‘screenshot_YearMonthDay_HourMinuteSecon.png’. The screenshot option is then also valid when the user wants to pay a close look to some parameters available in the monitor, but it wants to do that later on. Photo ( ): it takes a photo using the phone’s camera and saves it in JPG format. Photos are saved in the phone in the following path ‘...\Phone\QualiPoc\Results’ and it is labeled following the format ‘photo_YearMonthDay_HourMinuteSecon.png’. This option is useful when the user wants to complement the logged measurements with a photo of, e.g., the conditions where the measurements are conducted. Monitor’s settings ( ): QualiPoc is highly configurable. The monitor’s settings button opens a settings window for the monitor view that is currently visible on the phone’s screen. In the settings window that opens, it is possible to select the parameters to be displayed in this monitor view.

Figure 2-7. QualiPoc’s main toolbar.

2.2. Settings The QualiPoc’s Settings are accessed using Menu that is located at the top right and that is represented by the ⋮ button (see Figure 2-8). The Settings allow to configure: Map settings, BTS information, Signaling, IP monitor, Customization, Notifications, Forcing, Unit configuration, Advanced Analysis Settings, Appearance, Import/Export Configuration, Update QualiPoc and Text markers.

Figure 2-8. QualiPoc’s Settings.

2.2.1. Map settings The Map settings allow to configure the Map monitor view and it is also used to indicate the GPS options. Alternatively, the Map settings can be accessed using the Monitor’s settings ( of the Main toolbar when the user is at the Map monitor window.

) button

Figure 2-9. QualiPoc’s map settings.

The flowing parameters can be configured: • Unit of measurement: it defines whether the map use Metric or Imperial units. • Online mode: when QualiPoc is in Idle state, it indicates whether the missing map tiles are downloaded or not from the Internet. Note that the downloads of the missing map tiles only happen when QualiPoc does not have any active connection. This is to avoid that QualiPoc performs some data downloads while some other jobs are running. • Offline mode on job start: this option disables the previous online mode when a job/test starts in order to avoid that the map tiles downloads are mixed with the traffic of the test. • BTS monitor: when this checkbox is enabled, the map shows the Base Transceiver Stations (BTS) or base stations. Note that base stations can only be represented in the map if the user introduces a text file that includes the identifiers of the base stations and their locations (see Section 2.2.2). Then, QualiPoc uses this text file to locate in the map the user’s introduced information. • Show inactive cells: if the BTS monitor is enabled, this option displays the inactive cells on the map. • GPS device: it allows to configure what GPS device is used to get the handset localization data. The internal GPS device or an external device connected via Bluetooth can be utilized.

The Map settings can be also used to indicate when to reset the tracking of the handset device’s location. The options available are: • On job start: when this option is enabled, QualiPoc clears all previous tracked locations when a new job/test is started. • On floor plan change: previous tracked locations are also cleared when the floor plan is changed (new building plan/map is loaded) or when you stop using floor plans. The floor plans’ type can also be configured using the following options: • Ask: it will ask what floor plan’s type is being used before start recording. • Simple: simple floor plan is created from an image or iBwave file. • Geo-referenced: floor plan that is accurately positioned and aligned on an outdoor map. Finally, the Map settings allows to indicate whether the phone’s volume keys are used to introduce waypoints or not when in manual location mode. Waypoints are the typical way to introduce reference points in indoor measurements that can be later used during the post-processing to identify an indoor location. To enable it, the Map settings include a checkbox defined as ‘Volume keys to set waypoint’.

2.2.2. BTS information QualiPoc uses the BTS information for multiple purposes. For example, it can be used (see Figure 2-10.b)): 1) to display the BTS icon at its corresponding location on the Map monitor view; 2) to show the angle or bearing between the QualiPoc handset device and the BTS; and 3) to indicate the distance from the QualiPoc handset device to the monitored BTS. Note that in Figure 2-10.b) the BTS cell marker is semi-transparent and that QualiPoc uses a color code to show the active service cell (violet), neighbor cell (pink) and inactive cell (blue). The BTS information can be also displayed as shown in Figure 2-10.c). To this aim, tap the cell icon and then tap the information balloon that shows up above the cell. It should be noted that QualiPoc cannot know the location of the BTSs and their unique identifiers. Through the BTS information menu (see Figure 2-10.a)), you can make this information available to QualiPoc. First, the BTS information checkbox needs be enabled. Then, you can load a BTS info file for each radio access technology: GSM, WCDMA, LTE. The BTS info file must follow a specific format that is different for each radio access technology (details are indicated below). The BTS info file has to be saved in CSV format. The files can be copied at any location on the phone. Based on the radio access technology of the BTS included in the file, it has to be used one of the different options that are shown in Figure 2-10.a) (i.e., BTS info file GSM, BTS info file WCDMA, BTS info file LTE) to load them.

(a)

(b)

(c)

Figure 2-10. BTS information (a), Map monitor view showing the BTS (b), and information about the BTS (c).

2.2.2.1. LTE BTS info file The BTS info file is formatted as shown in Figure 2-11. First row indicates the labels for each column and then the next rows represent different cells. The LTE format is as follows: • Name: alphanumeric name used to identify the cell. • Technology: it is used to show the technology and band of the cell (e.g., LTE1800, LTE800, …). • EARFCN: E-UTRA Absolute Radio Frequency Channel Number. • Phy-CID: Physical Cell Id. • Lat: latitude • Lon: longitude. • MCC: Mobile Country Code • MNC: Mobile Network Code • TAC: Tracking Area Code • CellId: Cell Id. • Direction: angle of the cell or sector. For the case of LTE, the eNB or Cell Id can be used as identifiers. This is specified in the BTS LTE cell identifier option shown in Figure 2-10.a). Once this has been decided, the LTE BTS info file must follow this format, i.e., if the eNB is selected, it substitutes the CellId column in Figure 2-11.

Figure 2-11. LTE BTS info file.

Figure 2-12. Signaling setting for LTE.

2.2.3. Signaling QualiPoc does not only saves all transmitted and received signaling messages. It also shows them in real-time in the Signaling monitor (see Section 2.5.1.4). The Signaling settings allows to configure the message filtering options for the different radio access technologies in case the user wants to check when specific signaling messages are transmitted or received. Alternatively, the

Signaling settings can be accessed using the Monitor’s settings ( ) button of the Main toolbar when you are at the Signaling monitor window. Figure 2-12 shows the configuration options available in the Signaling settings menu. First, it is possible to enable a filter text box in the Monitor’s Signaling view by activating the “Enable Text Filter” option (when you are in the Monitor’s signaling window, it is also possible to activate this filter box by double taping on the text field. To hide the filter box, double tap on the filter box). For LTE, the messages filters are shown when you tap the “LTE Messages Filters” (see Figure 2-12). This allows to indicate what LTE messages are displayed in the Monitor’s signaling window. For example, it can be selected what RRC messages are displayed by activating the check box next to the available messages: BCCH DL SCH, PCCH, DL CCCH, DL DCCH, UL CCCH, UL DCCH. In addition, session management (ESM) and mobility management (EMM) messages can be also filtered. It is important to note that all messages are logged in the measurement files when QualiPoc is recording, even though some messages are not displayed in the Monitor’s Signaling window because they have been filtered out.

2.2.4. IP Monitor QualiPoc also monitors the IP packets and it allows to configure the IP packet’s filters. Alternatively, the IP Monitor settings can be accesses using the Monitor’s settings ( ) button of the Main toolbar when the user is at the IP monitor window. Figure 2-13 shows the configuration options available in the IP Monitor settings menu. First, it is possible to enable a filter text box in the Monitor’s IP view by activating the “Enable Text Filter” option (when you are in the Monitor’s IP window, it is also possible to activate this filter box by double taping on the text field. To hide the filter box, double tap on the filter box). Then, it is possible to filter packets by protocol: HTTP, FTP, DNS, ICMP, POP3, IMAP, SMTP, TLS, TCP, HTTP-Data (only header data available; logging each 100ms, displayed each second), FTP-Data (only header data available; logging each 100ms, displayed each second), RTP. It is important to note that all IP packets are logged in the measurement files when the QualiPoc is recording, even though some IP packets are not displayed in the Monitor’s IP window because they have been filtered out.

Figure 2-13. QualiPoc’s IP Monitor.

2.2.5. Customization The Customization menu allows to configure the QualiPoc workspace to display your preferred monitors, and in the order you want to show them. QualiPoc has a default workspace that includes 12 tabs (see Figure 2-14.a)). The current workspace tab in the Customization menu shows the tabs

of the loaded workspace. For the default workspace the available monitors are: Status, Log, Test, Technology, Data, Cells, Coverage, Signaling, IP, Events, Map, Notifications. The order in which each of them are displayed in the QualiPoc’s Monitor section can be adjusted using the arrows highlighted with the red circle in Figure 2-14.b). All these monitors are predefined although their content depends on the radio access technology the mobile device is connected to. The content of the predefined monitors can be selected in the Predefined Monitors tab of the Customization menu. To this aim, you have to tap on the predefined monitor you want to configure. Figure 2-14.d) shows the case for the LTE monitor.

(a)

(b)

(c)

(d)

Figure 2-14. Customization’s workspaces (a), current workspace (b), predefined monitors (c), and LTE parameters in the LTE monitor.

Figure 2-15. Notifications settings: Monitored parameters.

2.2.6. Notifications QualiPoc uses the standard Android notifications to inform the user of particular signaling or measurement events. This avoids that the user is paying attention to e.g., the evolution of a particular parameter’s value and that it is notified when this parameter’s value meets a condition. To add a monitored parameter or Layer 3 message notification, you have to follow the steps shown in Figure 2-15 and Figure 2-16, respectively. First tap on the “Add Notification” and then tap on the Event box. The third step is to select the event type to add the notification upon: Layer 3 message or Monitored parameter. The fourth step is to select the parameter or Layer 3 message you want to be notified when a condition happens. For example, the first image of Figure 2-15 shows that two notifications have been created to inform the user when the Carrier RSSI is below 60 dBm, and the RSRP is below -90 dBm. Notifications can be configured to be sound or

vibration, and it can be also selected to notify on all event, on first occurrence of the event only, or on first N (configurable) occurrences.

Figure 2-16. Notifications settings: Layer 3 message.

When the configured conditions are met, QualiPoc informs the user via the Android notification bar (Figure 2-17.a)). In addition, the Monitor’s Notifications tab includes all occurrence of the events as it is shown in Figure 2-17.b). To view the event history of a notification, tap on the notification in the list.

(a)

(b)

Figure 2-17. Notifications at the Android notification bar (a),and the QualiPoc Monitor’s Notifications window.

2.2.7. Forcing QualiPoc allows to select the technology, bands, cells, etc. that you want to force the phone to use. This feature is of particular interest when a specific technology, band or cell needs to be tested and handovers to other cells, technologies or bands wants to be avoided. Note that the forcing options depend on the radio access technology. To enable the forcing feature, the “Technology forcing” check box has to be activated (see Figure 2-18). Then, it has to be specified the Network type among GSM, WCDMA, LTE or GSM+WCDMA+LTE. This last option would show all bands available for all technologies, while the previous options would show only the bands available for a particular radio access technology. When LTE is selected, a set of bands where the phone can be forced appear: LTE Band I – 2100, LTE Band II – 1900, LTE Band III – 1800, LTE Band V – 850, LTE Band VII – 2600, LTE Band VIII – 900, LTE Band XX – 800. Note that it is possible to select more than one band at the same time. The phone will be one allowed to operate in the selected bands.

Figure 2-18. Basic forcing features for LTE.

There are also some advance forcing features that are enabled when the “Technology forcing” feature is unchecked (see Figure 2-19). Through this advanced forcing, it would be possible to force the LTE EARFCN (i.e. specific channel number) or PCI (i.e. specific cell) the phone is locked to. As a result, if for example the mobile station is forced to a specific LTE EARFCN, it cannot select another one even if the performance in the current LTE EARFCN degrades. Note that some of these advanced forcing features might not be supported by the device. It is also important to note that when the forcing feature is utilized, the phone automatically restarts.

Figure 2-19. Advanced forcing features for LTE.

2.2.8. Unit configuration The Unit configuration menu (see Figure 2-20) allows to configure the QualiPoc’s operation mode. When QualiPoc is using on its own to perform measurements, the handheld operation mode is selected. However, QualiPoc can be also remotely controlled using the PC software NQView (‘Remote Controlled’) or managed by a master freerider (Freerider Slave). These last two options are out of the scope of this book. Other features available in the Unit configuration menu is the selection of the unit’s name (i.e., the name of the QualiPoc device), and the unit/device’s ID (see Figure 2-20). These names are used to create unique labels that are used to save the measurement files. In this menu it is also possible to indicate whether a time synchronization is performed when a new job/test is executed (see Figure 2-20). To this aim, the “Do Time Synch by Job Start” checkbox needs to be activated. The time synchronization uses the GPS time in this case. It can be also used a Network Time Protocol (NTP) server to perform the time synchronization using the “Use NTP Server for Time Synch” checkbox. In this case, the address of the NTP server has to be introduced.

Finally, the Unit configuration menu also allows to configure how and where the results files are saved. Result files can be compressed automatically into *.sqz archives if the “Auto Compression” checkbox is activated. Otherwise, the measurement file format is *.mf. In the “Results Files Tagging/Upload” menu it can be selected whether the user will be asked or not to tag the result files after the job/test is finished. This is indicated via the “AutoTag” checkbox. Results files could be also automatically uploaded to an FTP, HTTP or HTTPs server if the “Auto Upload” checkbox is activated. The host name and credentials need to be specified in these cases. Finally, it can be configured whether results files are saved in a specific results folder or not. The folder structure can be flat (i.e., Date_Device_Tag) or hierarchical (i.e., Date/Device/Tag). The folder name can include the date, system (i.e., QualiPoc), device (e.g., Samsung Galaxy S5 (SMG900F)) and task/job labels (e.g., CallToAnyNumber). Results files are stored in the phone’s path: “*\Phone\QualiPoc\Results”.

Figure 2-20. QualiPoc’s unit configuration.

2.2.9. Advanced Analysis Settings Through the Advanced Analysis Settings, it can be set the maximum throughput (in Kbps) for different radio access technologies. This does not limit the performance of the radio access technology since it is mostly used for charts and color coding. This menu also allows to log raw data that can be post processed using professional network tools such as ROMES (this is an alternative PC software for post-processing). For debugging purposes and troubleshooting a QualiPoc problem, in this menu can be also logged the raw traces captured by the Qualcomm chipset. Due to the massive amount of data that this option logs, this option can degrade the measurement performance of the phone, and then it is only used for the above indicated purposes.

Figure 2-21. QualiPoc’s advanced analysis settings.

2.2.10.

Appearance

In the Appearance menu it can be selected the QualiPoc’s theme. Available options are Dark and Light. Another feature that can be configured in this menu is the possibility to keep the screen always on. When this option is used, the screen timeout is disabled, and it is impossible to switch off the screen manually when a job is running. This option uses additional battery. However, it should be noted that when the screen is off, the CPU performance may be reduced and this might impact the test results.

Figure 2-22. QualiPoc’s appearance.

2.2.11.

Import/Export Configuration

The Import/Export Configuration can be used to import or export configuration files like job settings (all, or individual HttpTransferUl, Ping, Upload, ...), workspaces, custom monitors, predefined monitors, signaling settings, BTS settings, notification settings, tile caches, map providers, tag setups and text markers. QualiPoc can only import configuration files from the phone’s SD card. On the other hand, the configuration files can be exported to an external storage unit, or they can be sent via Dropbox, Bluetooth, email, Gmail, Drive or Wi-Fi Direct. Figure 2-23 shows the steps to follow to export the configuration files.

Figure 2-23. QualiPoc’s import/export configuration.

2.2.12.

Update QualiPoc

QualiPoc can be updated from the Update settings menu (see Figure 2-24). In addition, it can be asked to QualiPoc to warn the user when there are updates available.

Figure 2-24. QualiPoc’s update settings.

2.2.13.

Text markers

The Text markers menu allows to create, export, and import custom text marker that can be added to the file measurement during a test or job. To create a new text marker simply tap the plus sign (+) at the top of the screen and type the name of the marker.

Figure 2-25. Text markers.

2.3. Jobs Jobs is the tool used by QualiPoc to run tests. To create a new job, tap the menu button ⋮ that is available at the at the main window. Then tap Jobs. Then press the Job Settings menu button ⋮ | Create new job. There are multiple job types like single call tests, or single data test. These jobs execute a single test type. QualiPoc Jobs feature also allows to create multiple tests at once that can be executed sequentially (multi-data, multi-mix and multi-RAB) or in parallel. QualiPoc can also be used to start recording without indicating a specific job using the Idle option. Under this option QualiPoc logs all messages and network parameters. This feature can be used to log the signaling the mobile device exchanges in idle sate, or it can be used to execute other Android applications and record all signaling and network parameters in the background.

The remaining of this section describes how to create, save and execute each of these job types. Common features for all the Jobs are the possibility to save, load, duplicate, or delete jobs. To access these features, tap ⋮ | Jobs to access the menu button, and then press the Job Settings menu button (⋮).

Figure 2-26. Creating a new job.

(a)

(b) Figure 2-27. Configuration of the Single Call Tests – Call to any Number.

2.3.1. Single Call Tests The Single Call Tests include the “Call to any Number” job type that is used to set up a voice call test. To open the Call to any Number menu, tap Single Call Tests | Call to any Number. In this

menu, there are quick start settings to configure the job including the phone number to be called, the duration of the call (in seconds), and the number of cycles or repetitions that the call is executed before the job finishes (see Figure 2-27.a)). More advanced settings are also available for this job (see Figure 2-27.b)). To access the advanced job settings, tap Single Call Tests | Call to any Number | Advanced job settings. In this menu it can be indicated the name of the job. On the Timing and scheduling menu, it is possible to configure the duration of the call (in seconds), the number of cycles or repetitions, and the duration of the pause between cycles. In addition, it is also possible to schedule when the job is executed by indicating the date, time, and whether the task is repeated once or multiple times. On the Test settings menu, it can be defined the phone number to be called, the duration of the call, and the maximum allowed time to setup the call. The advanced settings also include the “Packet capture” and “Forcing” features. The Packet Capture option saves the transmitted and received (IP) packets in .pcap format to be processed with software like Wireshark. The Forcing option allows to specify the radio access network and band at which the job is executed. The Forcing menu also allows to enable or disable the PDP context. By default, QualiPoc disables the “Mobile data” flag to force the PDP context detachment before running a job/test and reenables the flag after the test to attach the PDP context activation.

2.3.2. Single Data Tests The Single Data Tests menu includes a set of job types including FTP DL/UL, HTTP Browser, HTTP Transfer DL/UL and Ping (see Figure 2-28).

Figure 2-28. Single Data Tests menu.

2.3.2.1. FTP DL/UL The FTP DL job type establishes a data connection to a server to download a file via FTP protocol. To open the FTP DL menu, tap Single Data Tests | FTP DL. As shown in Figure 2-29, the quick start configuration of the FTP DL job type includes the Host address where the file is located, the name of the file to download and the credentials (Username and Password), if they are necessary. As part of the job quick start settings, it can be also configured the number of times or cycles that the job will be executed before the job finishes. More advanced settings are also available for this job type. To access them, tap Single Data Tests | FTP DL | Advanced job settings. In this menu it can be indicated the name of the job. On the Timing and scheduling menu, it is possible to configure the duration of the FTP DL (in seconds), the number of cycles or repetitions before the job finishes and the pause between cycles. It is also possible to schedule when (date and time) to execute the FTP DL job. On the Test settings menu, it can be defined the Host address, the name of the file to download, and whether an active or passive mode FTP connection is established. The test settings can be also used to indicate the

username and password of the server where the file is hosted and the maximum duration of the test and maximum setup time. For the case that multiple FTP DL had been programmed (cycles > 1, or 0 that represents infinite), the test settings menu allows to configure whether the pause between tests is deterministic or random. As it has been described in Section 2.3.1 for the Single Call Tests job type, the advanced settings also include the “Packet capture” and “Forcing” features. The Forcing allows to specify the radio access network and band at which the job is executed.

Figure 2-29. FTP DL job type.

The FTP UL job type follows a similar configuration than the FTP DL job type (see Figure 2-30). The job quick start settings include the address of the server where the file is uploaded, the name of the file to upload and the credentials of the server. In addition, it can be also specified the number of times or cycles the test is repeated before it finishes. Similar advanced options as in the FTP DL job type can be also configured including those related with timings and scheduling, test settings and forcing.

Figure 2-30. FTP UL job type.

2.3.2.2. HTTP Browser The HTTP job type loads the content of an HTTP web site. To open the HTTP Browser menu, tap Single Data Tests | HTTP Browser. As shown in Figure 2-31, the quick start configuration of the HTTP Browser job type includes the URL of the site, and the number of times or cycles that the job will be executed before the job finishes. Through the advanced job settings, it can be configured timings and scheduling options like job duration, cycles or number of times the job repeats, the pause between cycles and schedule when the job is executed. Advanced job settings also include the URL of the site, the maximum test

duration, and the pause (in seconds) after each cycle which can be deterministic or random. Forcing options as described above can be also configured through the advanced job settings.

Figure 2-31. HTTP Browser job type.

2.3.2.3. HTTP Transfer DL/UL The HTTP transfer job type performs a data connection to upload or download a file from a server via HTTP protocol. The configuration options are the same than for the FTP DL/UL (see Section 2.3.2.1). The HTTP browser quick start settings for the HTTP transfer DL job type are shown in Figure 2-32.

Figure 2-32. HTTP transfer DL job type.

2.3.2.4. Ping QualiPoc offers support for creating Internet Control Message Protocol (ICMP) ping job types. The ICMP ping tests whether a particular host is reachable across an IP network. In addition, it measures the time it takes for a message sent from the mobile device to reach a destination server plus the time it takes for its acknowledgement to be received at the source. To open the Ping menu, tap Single Data Tests | Ping. As shown in Figure 2-33, the ping quick start settings include the address of the destination server/host, the number of ping messages and time (in milliseconds) between two consecutive pings, the size of the ping message (in bytes) and the time the job will try to send a ping to the server (in seconds), and the number of cycles or times the job is executed before the test finishes. The ping job type also includes advanced job settings to setup timing and scheduling options and more detailed options. The timing and scheduling menu allows to configure the duration of the test, the number of cycles the job is repeated before it finishes, and the pause between cycles. This

menu can also be used to schedule when (date and time) the job is executed. Then, the test settings menu is used to configure the address of the destination server/host, the number of ping messages and the interval between them, the size of the message (in bytes) and the maximum time the job will try to send a ping to the server. The overall maximum test duration can be also specified in this menu, as well as the pause duration between cycles and whether this pause is deterministic or random. Forcing options as described above can be also configured through the advanced job settings.

Figure 2-33. Ping job type.

2.3.3. Multiple Tests The Multiple Tests option is used to combine data and voice jobs into a single job. This option supports all single call and data tests. The available job types include Multi-Data and Multi-Mix to create sequences of tests, and Multi-RAB and Parallel to create parallel execution of tests.

Figure 2-34. Multiple tests menu.

2.3.3.1. Multi-Data Multi-Data allows to create multiple data tests that occur in one session. To open the Multi-Data menu, tap Multiple Tests | Multi-Data. The quick start settings of the Multi-Data job type are used to define a sequence of data tests as shown in Figure 2-35.a). To add additional data tests, tap the menu ⋮ button of the job settings window. Each of these data tests can be configured following the steps shown in Section 2.3.2. When a set of data tests are selected, the job settings window will show the numbered tests in order as shown in Figure 2-35.b). To delete or move up/down any of the added data tests, tap and hold in one of the tests.

The advanced job settings menu allows to configure the timing and scheduling options for the Multi-Data job type. It also allows to configure the cycles or number of times the Multi-Data job is repeated before it finishes, as well as forcing options.

(a)

(b) Figure 2-35. Multi-DATA configuration (a), and editing of the script (b).

2.3.3.2. Multi-Mix Multi-Mix allows to create a sequence of call and data tests. Unlike the Multi-Data job type where all data tests occur in one session, in the Multi-Mix job type a new session starts for each test. To open the Multi-Mix menu, tap Multiple Tests | Multi-Mix. The quick start settings of the MultiMix job type are used to define the sequence of call and data tests as shown in Figure 2-36.a). To add additional data or call tests, tap the menu ⋮ button of the job settings window and select the test. Each of these call and data tests can be configured following the steps shown in Sections 2.3.1 and 2.3.2, respectively. When a set of call and data tests are selected, the job settings window will show the numbered tests in order as shown in Figure 2-36.b). To delete or move up/down any of the added call or data tests, tap and hold in one of the tests. The advanced job settings menu allows to configure the timing and scheduling options for the Multi-Mix job type. It also allows to configure the cycles or number of times the Multi-Mix job is repeated before it finishes, as well as forcing options.

(a)

(b) Figure 2-36. Multi-Mix configuration (a), and editing of the script (b).

Figure 2-37. Multi-RAB configuration.

2.3.3.3. Multi-RAB Multi-RAB is used to create parallel executions of call and (multi-)data tests. To open the MultiRAB menu, tap Multiple Tests | Multi-RAB. The quick start settings of the Multi-RAB job type allow to define the speech (CS, Circuit Switch) and (multi-)data (PS, Packet Switch) tests that will be executed in parallel (see Figure 2-37). New and saved speech and data tests can be loaded in this Multi-RAB job type. The “Multi-RAB PS Execution” option is used to define what cycles include PS and CS executions, and what cycles only CS executions. Starting from the cycle x indicated in the “Fist PS execution”, then the next y cycles indicated in the “Cycles with PS

execution” include both CS and PS executions, and the next z cycles indicated in the “Cycles without PS execution ” include only CS executions. The Multi-RAB job type also supports advanced job settings to configure the timing and scheduling options. It also allows to configure the cycles or number of times the Multi-RAB job is repeated before it finishes, as well as forcing options.

2.3.3.4. Parallel Finally, the Parallel job type of the Multiple Tests menu allows the execution of up to 3 parallel jobs independent from each other. To open the Parallel job type, tap Multiple Tests | Parallel. The quick start settings of the Parallel job type are used to define the parallel tests as shown in Figure 2-38. Only one call job type can be selected, and data tests can be single or multi-data jobs. The quick start settings are also used to define the cycles or number of times the Parallel job is repeated before it finishes. The Parallel job type also supports advanced job settings to configure the timing and scheduling options. It also allows to configure the cycles or number of times the Parallel job is repeated before it finishes.

Figure 2-38. Parallel job type.

Figure 2-39. Job Sequence menu.

2.3.4. Job Sequence The Job Sequence type is used to create sequences of different jobs. This is equivalent to creating a script with multiple different jobs. For each of the selected jobs, QualiPoc creates a separate measurement file. The Job Sequence quick start settings menu includes the “Jobs” option to add the sequence of jobs as shown in Figure 2-39. Jobs are numbered sequentially, and new ones are

added by tapping ⋮ | Add Job. Tap and hold any of the added jobs if you want to delete it, or if you want to move it down/up. The quick start settings are also used to define the cycles or number of times the Job Sequence job is repeated before it finishes. The Job Sequence job type also supports advanced job settings to configure the timing and scheduling options. It also allows to configure the cycles or number of times the Job Sequence job is repeated before it finishes, as well as the forcing configuration.

2.3.5. Idle The Idle job type does not specify any call or data test and simply records all messages and network parameters. In principle, it can be used to log what the mobile device is doing while in Idle state such as signaling messages received from the serving base station. However, QualiPoc can be running on the background while the Idle job is recording. Using this option, any of the Android applications can be executed and QualiPoc will log the generated signaling messages and network parameters. As shown in Figure 2-40, the Idle job type configuration also defines advanced job settings that include the timing and scheduling options, as well as the forcing and packet capture options.

Figure 2-40. Idle job type.

Figure 2-41. Upload.

2.3.6. Upload The Upload job is used to upload measurement files to an specified server. The Upload job quick settings (see Figure 2-41) are linked to the Unit configuration settings that are accessed through

the main menu ⋮ | Settings | Unit configuration (see Section 2.2.8). In this menu, it can be specified the connection type to be used for the upload, the host URL, credentials, etc.

2.4. Results Manager QualiPoc’s Result tool, that can be accessed by tapping ⋮ | Results (see Figure 2-42), allows to check the measurement files saved on the phone path “*\Phone\QualiPoc\Results”. As shown in Figure 2-43, the Results window includes a banner through which it is possible to see how the files are organized, search for a specific file, filter out by measurements and crash dumps files or by date, and indicate whether the view of the file names is flat, include the task ID, custom ID, Device ID, Tags and Tag labels.

Figure 2-42. Opening Results window.

Figure 2-43. Results Manager.

To select a file or a set of them, tap on them and hold. The selected files are highlighted in blue. This enables additional options for the selected file(s) as shown in Figure 2-44. The available options include editing the tags of the selected file(s), deleting the selecting file(s), or uploading, sharing, compressing, iBwave exporting, selecting similar files with the same timestamp, task ID, custom ID, device ID, select all files, or invert the current selection. QualiPoc’s Result tool also allows playing saved measurement files. This feature is useful for troubleshooting a specific problem and obtaining quick answers in situ. To replay a measurement file there are two options as shown in Figure 2-45. First, it can be done by tapping the file name which opens the measurement file details including the name, its location path, size, timestamp, indicates whether the file is compressed or not, and task, custom and Device IDs. At the bottom of the measurement file details’ pop-up window, it appears the Replay button to replay the measurement file. The second option is tapping the play icon that appears next to the file name. Through any of the two options, the QualiPoc main window is activated showing a slightly

different appearance. For example, it shows a blue “Q” icon in the Android’s notification banner that indicates QualiPoc is running in Replay Mode. This is also visible in the Cell info banner area. The Main Toolbar shows then the replay control buttons to reproduce the saved file measurement, move forward or backward and pause. It is important to note that while the file measurement is playing, all monitors will show the logged network parameters and signaling messages. To return to the real-time views, tap the three dots of the main view ⋮ | live.

Figure 2-44. File manager.

Figure 2-45. Results’ replay.

Figure 2-46. QualiPoc general monitors and LTE monitors.

2.5. QualiPoc monitors QualiPoc offers a completely configurable Monitor section with multiple network parameters and signaling messages represented in text, bar and line graphs, maps, etc. The monitored network parameters are displayed in different views or windows that are called monitors. To change between monitors, you simply need to swipe the screen or tap the monitor tab name. Monitors might occupy more than the screen size, and to access the bottom part of the monitor you simply need to scroll down.

Figure 2-46 shows the QualiPoc general monitors including the Status, Log, Test, Signaling, IP, Events, Map and Notifications. There are also some other monitors that are technology specific and that are visible depending on the radio access technology the phone is connected to. Figure 2-46 shows the monitors for LTE that include LTE, LTE DL, LTE UL, Cells (LTE) and Coverage (LTE). In general, monitors’ content can be customized using the Main toolbar’s monitor settings button ( ). The degree of customization depends on the monitor window you are viewing. For example, Figure 2-47 shows the customization options for the Status monitor (Figure 2-47.a)) and the Log monitor (Figure 2-47.b)). While the Status monitor opens a new screen where up to 32 parameters can be selected to be displayed in the monitor window, the Log monitor customization is linked to the main QualiPoc settings that can be also accessed from ⋮ | Settings (see Section 2.2). This Section describes the content and customization capabilities of the monitors available in the QualiPoc’s Monitor section. This includes the General monitors and technology-dependent monitors. In both cases, this section will focus on the case the phone is connected to LTE.

(a)

(b) Figure 2-47. Customizing the content of the monitors: Status (a) & Log (b).

2.5.1. General monitors 2.5.1.1. Status monitor The Status monitor displays important information regarding the status of QualiPoc including the network in use, forcing status and the GPS status, among others (Figure 2-47.a)). To customize

the content of the Status monitor, slide up the Main toolbar and tap the settings button ( ). The selected parameters that are displayed in the Status monitor appears in the Selected tab as shown in Figure 2-48. The order in which these parameters are displayed in the Status monitor can be modified using the doble up-down arrow. Tap the up-down arrow and move the parameter to the desired position. Horizontal separators can be added to group the parameters as desired. To this aim, use the + icon inserted in the dotted square box at the top right on the screen.

Figure 2-48. Status content customization.

Parameters to be added are grouped into tabs including Freerider (out of the scope of this book), Network Info, Service Test, LTE cell, LTE PDSCH, LTE PUCCH, LTE PUSCH, GPS Position, Voice, WiFi. These parameters are analized below. 2.5.1.1.1

Network Info

This monitor shows general network information: Network displays the state of the network (e.g., home network, roaming). Operator displays the actual operator (e.g., Orange, Vodafone.de, etc.). Technology displays the technology the phone is currently using (e.g., LTE). Forcing shows the current forcing features the phone is locked to (e.g., technology, band, LTE EARFCN, LTE PCI). Cell Id displays the cell identity that is a 28-bit length identifier so it could take values from 0 to 536870911. Table 2-1. E-UTRA channel numbers6 E-UTRA Operating Band 1 2 3 5 7 8 20

FDL_low (MHz) 2110 1930 1805 869 2620 925 791

Downlink NOffs-DL 0 600 1200 2400 2750 3450 6150

Range of NDL

FUL_low (MHz)

0 – 599 600 - 1199 1200 – 1949 2400 – 2649 2750 – 3449 3450 – 3799 6150 – 6449

1920 1850 1710 824 2500 880 832

Uplink NOffs-UL

Range of NUL

18000 18600 19200 20400 20750 21450 24150

18000 – 18599 18600 – 19199 19200 – 19949 20400 – 20649 20750 – 21449 21450 – 21799 24150 – 24449

Channel nr shows for the case of LTE the DL EARFCN (E-UTRA Absolute Radio Frequency Channel Number). It ranges between 0 and 262143. Its value depends on the carrier frequency or band the network is operating. The relation between the EARFCN (NDL) and the carrier frequency (FDL) in MHz for the downlink is given by the expression FDL = FDL_low + 0.1(NDL – NOffs-DL), where FDL_low and NOffs-DL are the lowest frequency of the downlink operating band, and the offset used

for calculating downlink EARFCN, respectively. Table 2-1 shows the range of the NDL for a set of LTE (a.k.a. E-UTRA) bands. Channel signal level shows for the case of LTE the RSSI (Received Signal Strength Indicator) in dBm. The E-UTRA RSSI comprises the linear average of the total received power (in [W]) observed only in the configured OFDM symbol and in the measurement bandwidth over N number of resource blocks by the UE from all sources, including co-channel serving and nonserving cells, adjacent channel interference, thermal noise, etc. The RSSI is measured only from OFDM symbols containing reference symbols7. Cell Identifier shows for the case of LTE the PCI (Physical layer Cell ID). It ranges from 0 to 503 and it is calculated as PCI = 3(CellIDGroup) + CellIDSector. CellIDGroup is the physical layer cell identity group ([0,167]), and CellIDSector is the identity of the sector within the group ([0,2]). Cell signal level shows for the case of LTE the RSRP (Reference Signal Received Power) in dBm. The E-UTRA RSRP is defined as the linear average over the power contributions (in [W]) of the resource elements that carry cell-specific reference signals within the considered measurement frequency bandwidth7. Cell signal quality shows for the case of LTE the RSRQ (Reference Signal Received Quality) in dB. The E-UTRA RSRQ is defined as the ratio N×RSRP/(E-UTRA carrier RSSI), where N is the number of RB of the E-UTRA carrier RSSI measurement bandwidth. The measurements in the numerator and denominator shall be made over the same set of resource blocks7. Phone Tx power displays the transmission power level in dBm. The UE maximum output power depends on the UE Power Class and the transmission bandwidth. The default power class for an operating band is Power Class 3 which is characterized by a maximum output power of 23 dBm ( 2 dB tolerance). MCC displays the mobile country code2. The mobile country code consists of three decimal digits. The first digit identifies the geographic region as follows (the digits 1 and 8 are not used): 0: Test networks; 2: Europe; 3: North America and the Caribbean; 4: Asia and the Middle East; 5: Australia and Oceania; 6: Africa; 7: South and Central America. Examples of MCC: 214-Spain, 208-France, 244-Finland, 222-Italy, 604-Morocco, 212-Monaco, 505-Australia. MNC displays the mobile network code. Examples of MNC for Spain are: 01-Vodafone España; 02-Alta Technología en Comunicacions; 03-France Telecom España; 04-Xfera Móviles; 05Telefónica Móviles España; 25-Lycamobile; 34-Aire Networks del Mediterraneo. MCC/MNC displays in the same row the MCC and the MNC. An MCC is used in combination with an MNC (a combination known as an "MCC/MNC tuple") to uniquely identify a mobile network operator. LAC displays the location area code. This is a unique identifier that represents an area that comprises a set of base stations and that is used for location updating of the mobile subscribers. The LAC is a 16-bit number thereby allowing 655534 (there are two special values) location areas within one operator’s network (PLMN-Public Land Mobile Network). The location of the mobile subscriber is determined using the [MCC | MNC | LAC]. The LAC is broadcasted regularly by the base station using broadcast channels. The mobile station stores the LAC in the SIM card and if detects a change of the LAC, it will trigger a location update request to inform the mobile operator of its new LAC. This allows the mobile operator to track the location (at LAC level, i.e., comprising a set of base stations) of the mobile station in case of an incoming call. LAC/CID displays in the same row the LAC and the Cell ID. BTS Cell Name displays the cell name included in the BTS file (see Section 2.2.2) for the base station and sector the phone is connected to. BTS Cell Name 2 displays the cell name included in the BTS file (see Section 2.2.2) for the second-best base station and sector the phone is connected to. BTS Cell Name 3 displays the cell name included in the BTS file (see Section 2.2.2) for the thirdbest base station and sector the phone is connected to.

2

ITU’s release of mobile country codes: http://www.itu.int/pub/T-SP-E.212B

Figure 2-49. Network Info parameters available for the Status monitor.

2.5.1.1.2

Service Test

This monitor shows information to analyse the evolution of the test that is running: IP address displays the IP address of the server that is used in the test. APN displays the Access Point Name to connect to Internet (e.g., Orangeworld for Orange Internet). Battery level [%] shows the level of the battery using a bar graph. Battery temperature [C] shows the temperature of the battery using a bar graph. CPU frequency [GHz] displays the CPU use for the different cores. CPU temperature [C] shows the temperature of the CPU using a bar graph. CPU total [%] shows the ratio of the utilization of the CPU using a bar graph. Last started test displays the last job type executed. Job name displays the name of the last job executed. Cycles displays the number of cycles executed and the total number of cycles included in the job test. Job success rate [%] shows the success rate of the test that is being executed using a bar graph. Test KPI type displays the KPI that characterizes the job that is being executed (e.g., RTT, call setup time, etc.). Test KPI avg displays the average value of the KPI for the finished jobs. Test KPI worst displays the worst measured value of the KPI for the finished jobs. Test KPI best displays the best measured value of the KPI for the finished jobs. Test KPI last displays the last measured value of the KPI for the finished jobs. IP Thrpt DL [Kbps] displays the current IP throughput measured in the downlink. IP Thrpt UL [Kbps] displays the current IP throughput measured in the uplink.

Figure 2-50. Service Test parameters available for the Status monitor.

2.5.1.1.3

LTE cell

This monitor shows information that is related to the LTE cell or eNB the mobile station is connected to: RSRP [dBm] see Cell signal level in Section 2.5.1.1.1. RSRQ [dB] see Cell signal quality in Section 2.5.1.1.1. RSSI [dBm] see Channel signal level in Section 2.5.1.1.1. SINR0 [dB] displays the signal to noise and interference ratio on the Rx antenna branch 0. The SINR is defined as the linear average over the power contribution (in [W]) of the resource elements carrying cell-specific reference signals divided by the linear average of the noise and interference power contribution (in [W]) over the resource elements carrying cell-specific reference signals within the same frequency bandwidth. SINR1 [dB] displays the signal to noise and interference ratio on the Rx antenna branch 1. PCI see Cell Identifier in Section 2.5.1.1.1. DL EARFCN see Channel nr in Section 2.5.1.1.1. Bandwidth [MHz] displays the LTE downlink bandwidth. TAC displays the Tracking Area Code. The TAC is a concept newly introduced in the LTE system that is equivalent to the LAC (see LAC in Section 2.5.1.1.1). Detected Antennas displays the number of Tx antennas detected. QRxLevMin [dBm] displays the minimum required received level in the cell (QRxLevMin) value that is received in the SIB1 (System Information Block type 1). This value is used in the cell selection criterion. The cell selection criterion is fulfilled when SRxLev > 0 and SQual > 0, where SRxLev = QRxLevMeas – (QRxLevMin + QRxLevMinOffset) – Pcompensation and SQual = QQualMeas – (QQualMin + QQualMinOffset). Definition of these parameters are reported in Table 2-2. Table 2-2. Cell selection parameters (definitions extracted from 3GPP TS 36.3048) Parameter SrxLev SQual QRxLevMeas QQualMeas QRxLevMin QQualMin QRxLevMinOffset

QQualMinOffset Pcompensation PEMAX PPowerClass

Description Cell selection RX level value (dB) Cell selection quality value (dB) Measured cell RX level value (RSRP) Measured cell quality value (RSRQ) Minimum required RX level in the cell (dBm) Minimum required quality level in the cell (dB) Offset to the signalled QRxLevMin taken into account in the SRxLev evaluation as a result of a periodic search for a higher priority PLMN while camped normally in a VPLMN Offset to the signalled QQualMin taken into account in the SQual evaluation as a result of a periodic search for a higher priority PLMN while camped normally in a VPLMN max(PEMAX – PPowerClass, 0) Maximum TX power level a UE may use when transmitting on the uplink in the cell (dBm) defined as PEMAX in 3GPP TS 36.1016 Maximum RF output power of the UE (dBm) according to the UE power class as defined in 3GPP TS 36.1016

Pmax [dBm] displays maximum TX power a UE is allowed to use in the cell (equivalent to PEMAX in Table 2-2). Received by the UE in SIB1 and SIB2. MaxTxPower [dBm] displays maximum TX power of the UE according to the power class (equivalent to PPowerClass in Table 2-2). SRxLev displays the cell selection criterion S. Criterion fulfilled when SrxLev > 0. SIntraSearch displays the threshold for intra-frequency measurements. SNonIntraSearch displays the threshold for E-UTRAN inter-frequency and inter-RAT measurements. Intra PCI displays the list of physical layer cell ids (PCI) of the intra-frequency neighbor cells. Inter Freq./PCI displays the list of frequencies and physical layer cell ids (PCI) of the interfrequency neighbor cells.

PLMNID (MCC/MNC) displays the ID of the PLMN that is made of the [MCC | MNC]. eNB/Sector ID displays the eNB (evolved Node B) and Sector IDs which are obtained from the Cell ID. eNB displays the eNB ID which is obtained from the Cell ID. RF Band (LTE) displays the LTE RF Band (e.g., LTE Band I – 2100, LTE Band II – 1900, LTE Band III – 1800, LTE Band V – 850, LTE Band VII – 2600, LTE Band VIII – 900, LTE Band XX – 800) CP distribution displays the distribution of the Cyclic Prefix (CP) between CP normal and CP extended.

Figure 2-51. LTE cell parameters available for the Status monitor.

2.5.1.1.4

LTE PDSCH

This monitor shows specific information about the LTE Physical Downlink Shared Channel (PSDSCH): Num of subframes displays the number of read PDSCH records which correspond to the number of Radio sub frames. This represents the reporting period for the rest of parameters. Max Num of Layers displays the maximum number of layers which correspond to the number of antenna ports in transmit diversity. Avg RB count shows the average number of Resource Blocks (RB) per subframe in a bar graph. Bytes Transferred displays the sum of the total transport block data transferred in the downlink. Sched Thrpt [Kbps] shows in a bar graph the scheduled throughput on the PDSCH which is defined as the sum of transport block data over the reported time period. PDSCH Thrpt [Kbps] shows in a bar graph the net throughput on the PDSCH which is defined as the sum of transport block data with passed CRC over the reported time period . BLER [%] shows the ratio of transport blocks with CRC error over all transport blocks in a bar graph. Average TB Size [bytes] displays the average transport block size. Num of TBs displays the number of transport blocks over the reported time period. Num of New TBs displays the number of new transport blocks over the reported time period. Num Pass 1st Attempt displays the number of transport blocks with passed CRC in the first attempt. Num of Recombined displays the number of transport blocks that required recombination. Average MCS index displays the average of Modulation and Coding Scheme (MCS) index over the reported period. The standardized MCS index are reported in the 3GPP TS 36.213-Clause 79. The MCS index is utilized by the receiving mobile station to determine the modulation order (i.e., 2 or QPSK, 4 or 16QAM, 6 or 64QAM, 8 or 256QAM) and transport block size that is used in the downlink transmissions. The MCS indexes vary between 0 and 31. The higher the MCS index

value, the higher the modulation order and transport block size. Then, the MCS indexes can be utilized to identify the quality of the downlink transmissions. Transmission Mode displays the downlink MIMO transmission mode9. LTE usually uses multiple antennas for transmission and reception. The multiple antennas can be utilized in different ways which result in different transmission modes. For example, the transmission mode 1 uses a single antenna at the transmitter and the receiver (SISO – Single Input Single Output). The transmission mode 2 uses the multiple antennas in diversity configuration (i.e., the same information is transmitted through the different antennas). The transmission mode 3 uses the multiple antennas as MIMO (Multiple Input Multiple Output) configuration (i.e., different streams are transmitted in parallel) but there is no feedback from the receiver to the transmitter. The transmission mode 4 is also a MIMO configuration that also uses feedback from the receiver. This mode 4 is also known as close-loop spatial multiplexing that is the mode shown in the image below for the transmission mode parameter. Num QPSK (LTE DL) displays the number of transport blocks using QPSK over the reported period. Num 16QAM (LTE DL) displays the number of transport blocks using 16QAM over the reported period. Num 64QAM (LTE DL) displays the number of transport blocks using 64QAM over the reported period. Num ACKs displays the number of reported ACKs over the reported period. Num NACKs displays the number of reported NACKs over the reported period. QPSK Rate [%] shows the percentage of transport blocks using QPSK modulation to the total number of transport blocks over the reported period in a bar graph. 16-QAM Rate [%] shows the percentage of transport blocks using 16QAM modulation to the total number of transport blocks over the reported period in a bar graph. 64-QAM Rate [%] shows the percentage of transport blocks using 64QAM modulation to the total number of transport blocks over the reported period in a bar graph. TM mode distribution shows the distribution (in %) of the transmission mode of the actual connection.

Figure 2-52. LTE PDSCH parameters available for the Status monitor.

2.5.1.1.5

LTE PUCCH

This monitor shows specific information about the LTE Physical Uplink Control Channel (PUCCH): Reporting Mode PUCCH reporting modes for CQI (Channel Quality Indicator) and PMI (Precoding Matrix Indicator) feedback. This parameter shows the mode used by the mobile station to report channel state information to the network. There are different modes (0-2) that show whether

the reported information correspond to a wideband measurement or a sub-band. Modes 0 (a.k.a. Mode 1-0#2C) and 1 (a.k.a. Mode 1-1#2C) report about wideband measurements, and mode 2 (a.k.a. Mode 2-0#2C) reports about a sub-band. CQI0/CQI1 shows the reported CQI. The standardized CQI index are reported in the 3GPP TS 36.213-Clause 7.2.39. The CQI ranges from 0 to 15 and it is used by the mobile station to indicate to the network what is the quality of the downlink transmissions. The higher the CQI, the better channel state conditions are measured and reported by the mobile station to the network. The reported CQI indicates to the network the modulation order it should use and the size of the transport blocks so that they are received with a transport block error probability not exceeding 0.1. PUCCH Tx power [dBm] is Tx power in the Physical Uplink Control Channel.

Figure 2-53. LTE PUCCH parameters available for the Status monitor.

2.5.1.1.6

LTE PUSCH

This monitor shows specific information about the Physical Uplink Shared Channel (PUSCH): Bytes Transferred displays the sum of transport block data transmitted on the PUSCH. Sched Thrpt [Kbps] shows in a bar graph the scheduled throughput on the PUSCH which is defined as the sum of transport block data transmitted over the reported time period. PUSCH Thrpt [Kbps] shows in a bar graph the net throughput on the PUSCH which is defined as the sum of transport block data on first transmission over the reported time period. Retransmission Rate [%] displays the ratio of retransmitted transport blocks over all transmitted blocks in the reported time period. Average TB Size [bytes] displays the average transport block size over the reported time period. Number of TBs displays the number of transport blocks over the reported time period. TxPower [dBm] displays the average PUSCH transmit power over the reported time period. Num BPSK (LTE UL) displays the number of transport blocks using BPSK. Num QPSK (LTE UL) displays the number of transport blocks using QPSK. Num 16QAM (LTE UL) displays the number of transport blocks using 16QAM. Num 64QAM (LTE UL) displays the number of transport blocks using 64QAM. Num ACKs displays the number of received ACKs. Num NACKs displays the number of received NACKs. BPSK Rate [%] shows the percentage of transport blocks using BPSK modulation to the total number of transport blocks over the reported period in a bar graph. QPSK Rate [%] shows the percentage of transport blocks using QPSK modulation to the total number of transport blocks over the reported period in a bar graph. 16-QAM Rate [%] shows the percentage of transport blocks using 16QAM modulation to the total number of transport blocks over the reported period in a bar graph.

64-QAM Rate [%] shows the percentage of transport blocks using 64QAM modulation to the total number of transport blocks over the reported period in a bar graph.

Figure 2-54. LTE PUSCH parameters available for the Status monitor.

2.5.1.1.7

GPS Position

This monitor shows specific Global Position System (GPS) information: Lat displays the latitude coordinates. Lon displays the longitude coordinates. Sats used shows the number of satellites currently visible in a bar graph. Speed o.g. [km/h] displays the current speed. Altitude [m] displays the current elevation. GPS status displays whether the GPS receiver receives enough signals to calculate a valid position or not. Last location update displays the time elapse since the last location update. Accuracy [m] displays the accuracy of the obtained metrics.

Figure 2-55. GPS Position parameters available for the Status monitor.

2.5.1.1.8

Voice

This monitor is specific for voice tests: SSRC displays the Real-Time Protocol (RTP) receiver synchronization source. Payload Length displays the RTP receiver average payload length. Num. of Packets displays the RTP receiver average number of packets.

Lost Packets displays the TRP receiver total lost packets (packet received up to 3 frames delayed are not counted). IPDV [ms] displays the RTP receiver’s Inter Packet Delay Variation (RFC 5481) RTP Jitter [ms] shows in a bar graph the RTP receiver’s jitter that is defined as the statistical variance of the Inter Packet Delay Variation. PDV [ms] shows in a bar graph the RTP receiver’s Packet Delay Variation. JBQ Length [ms] shows in a bar graph the De-Jitter Buffer Queue Length. OoO Packets displays the RTP packets out of order (received up to 3 frames delayed). Packet Loss [%] shows in a bar graph the TRP receiver packet loss (percentage of received and lost packets) Call – RTP Jitter [ms] displays the RTP receiver average RTP jitter over the whole call. Call – Packet Loss [%] displays the RTP receiver packet loss (percentage of received and lost packets) over the whole call. AMR Rate DL/UL displays Adaptive Multi-Rate in the downlink and uplink. Codec DL/UL displays the codec used in the uplink and downlink. SIP – Post Dial Delay [ms] displays the KPI 11000: SIP – Post Dial Delay (Active State) SIP – Call Access [ms] displays the KPI 11010: SIP – Call Access.

Figure 2-56. Voice parameters available for the Status monitor.

2.5.1.1.9

WiFi

This monitor shows specific information about the WiFi network the mobile station is connected to, and the link status between the mobile station and the Access Point (AP):

Figure 2-57. WiFi parameters available for the Status monitor.

SSID displays the Service Set Identifier that is a case sensitive, 32-alphanumeric-character unique identifier for the WiFi network.

BSSID displays the Basic Service Set Identifier that is a 46-bit MAC (Media Access Control) address used to identify a particular BSS (Basic Service Set). RSSI [dBm] shows the measured Received Signal Strength Indicator in a bar graph. Frequency [MHz] displays the frequency of the channel over which the client is communicating with the WiFi AP. Capabilities displays the authentication, key management, and encryption schemes supported by the WiFi AP. Link speed [Mbps] displays the link speed. Connection status displays the state of the supplicant’s negotiation with a WiFi AP. IP address displays the IP address allocated to the client.

2.5.1.2. Log monitor The Log monitor keeps track of all (test) events that occurred since QualiPoc started. Figure 2-58 shows the Log monitor after some commands have been executed. It can be appreciated that this monitor shows the time at which the event happened, and a description of the event. For example, for the case of the “Call to any number” job type, it first shows that QualiPoc is synchronized using the GPS time when the job starts. Then it shows the time that is set. When QualiPoc is synchronized, it checks whether the phone is ready for logging and then starts the test. The events logged in this monitor for the “Call to any number” job type include calling, dialing and system release. Once the job is stopped/aborted, the Log monitor indicates that the job is stopped, and that the file measurement is saved in the database. The Main toolbar settings button in the Log monitor is linked to the main QualiPoc Settings (that are also accessible via ⋮ | Settings) to configure, for instance, the time synchronization options in the Unit configuration menu.

Figure 2-58. Log monitor.

2.5.1.3. Test monitor QualiPoc includes a monitor that includes results in the form of KPIs and statistics of the job that is being executed. This monitor is updated in real-time showing the evolution of the tests. For example, Figure 2-59.a) shows the progress of a Test monitor for the case of a Call Test – Call to any number that is configured with a number of cycles equal to three. On the top part of the monitor window, the Test monitor shows a banner that includes the test type in a colored square (Call for this example). The color indicates whether the test is running (pink), or it is on pause between cycles (violet), or it is idle when the test has finished (grey). While the test is running, this is shown in a pink bar graph. When the test in on pause or idle, this bar shows the success ratio of the test. This success ratio can change with the number of cycles done. In addition, the banner displays the test’s KPI that for the case of the Call Test is the call setup time. For this KPI,

the banner also displays statistics such as the current measured value, and the average, best and worst values. The current value of the success ratio for the job that is being executed is also displayed in this banner. On the bottom part of the Test monitor window QualiPoc shows using a graph the evolution of the measured KPI. Figure 2-59.b) shows the Test monitor window for the case of a Data Test – Http Browser to highlight the differences with Figure 2-59.a). First, it can be appreciated that the banner on the top part of the monitor shows in a square that the test type is Data. The banner and the graph also show that for this job the identified KPI is the Application Throughput. The Main toolbar settings button in the Test monitor is linked to the main QualiPoc Settings (that are also accessible via ⋮ | Settings).

(a)

(b) Figure 2-59. Test monitor for jobs Call Tests – Call to any number (a), Data Tests – HTTP Browser (b).

2.5.1.4. Signaling monitor The Signaling monitor displays a list of Layer3 and RRC signaling message’s headers that are retrieved from the network. As shown in Figure 2-60.a), the messages to be displayed can be configured using the Main toolbar’s setting button that is linked to the Signaling settings that is also accessible through the ⋮ | Signaling. In this menu, and for the case of LTE messages, it can be filtered out the LTE RRC, session management (ESM) and mobility management (EMM) messages. See Section 2.2.3 for detailed information about the Signaling settings menu. The Signaling monitor displays the list of signaling messages, and for each of the messages it shows the header indicating the message type (e.g. channel type – CCCH, DCCHPCCH, etc.), the direction of the message (U – uplink –, D – downlink) and the time it was logged. To see detailed information about a particular message, tap on a message and see its content in a pop-up window

as shown in Figure 2-60.b) for the case of the PCCH: Paging message. QualiPoc decodes and shows the message’s content on this pop-up window. This content can be saved in a text file. To do so, tap and hold on the window with the message content and edit the name of the txt file. The content of the signaling message is saved to the path “*\Phone\QualiPoc\Layer3 messages”.

(a)

(b) Figure 2-60. Signaling monitor list and configuration (a), and detailed content (b).

2.5.1.5. IP monitor The IP monitor window displays in real time IP messages that belong to the HTTP, FTP, DNS, ICMP, POP3, IMAP, SMTP, TLS, TCP, HTTP-Data, FTP-Data, and RTP protocols. The messages are displayed in a list and for each of the messages it is shown the time the message was logged, the source and destination IP addresses, and the message type. As shown in Figure 2-61.a), the IP messages to be displayed can be configured using the Main toolbar’s setting button that is linked to the IP Monitor settings that is also accessible through the ⋮ | IP Monitor. In this menu, it can be filtered out the IP messages to be displayed in the IP monitor window. See Section 2.2.4 for detailed information about the IP Monitor settings menu. The IP monitor also shows detailed information about the logged IP messages as shown in Figure 2-61.b). To see the message’s content, tap and hold on a message. Depending on the message that is decoded, its content shows different fields such as frame information (number, timestamp, length), IP fields (version, header length, fragment information, checksum, source IP and destination IP), UDP fields (source, destination, length, checksum), etc.

(a)

(b) Figure 2-61. IP monitor list and configuration (a), and detailed information (b).

2.5.1.6. Events monitor QualiPoc’s Events monitor displays in real time a list of high-level events that occurs while the application is running (see Figure 2-62.a)). The types of events logged include DATA activity, CALL state, Current network type, WiFi scan and WiFi state, among others. The Events monitor settings’ options can be accessed using the Main toolbar’s setting button. In this menu it is only possible to select the “Enable Text Filter” option that shows in the Event monitor a text box that can be used to filter among the logged events. This text box can also be enabled double-tapping on the Event monitor window. To disable the text box, double-tap on the text box. The Event monitor also allows to show the content of the logged events (see Figure 2-62.b)). To show their content, tap on one of the events.

(a)

(b) Figure 2-62. Event monitor list and configuration (a), and detailed information (b).

2.5.1.7. Map monitor The Map monitor shows the location of the mobile device and some measurements on outdoor maps or indoor floor plans. The monitor main window shown in Figure 2-63 is made of a top bar with different symbols and the map area. The description of the top bar’s symbols is reported in Table 2-3.

Figure 2-63. Map monitor main window.

2.5.1.7.1

Top bar

In the top bar, the left-most symbol displays the current zoom factor and allows to configure several location features (see Figure 2-64): Follow location is a checkbox that when enabled automatically centers the map on the current location of the mobile device’s location. A green circle is displayed in the Map monitor next to the mobile station’s icon when this feature is active. GPS location mode is used to indicate to QualiPoc that the current location is determined using GPS. Either this mode or the manual location mode can be active at a time. Manual location mode (indoor) is used to indicate to QualiPoc that the location is indicated manually. This mode is used for indoor maps. To set the current location on the map, touch and hold on the map location. Reset tracking deletes the current tracked route. The tracking markers are not enabled when the zoom level is above 16x. Go to location opens a new pop-up window where the user can introduce an address or coordinates. The map will focus on the introduced location. This feature saves a history of the locations introduced before. Navigation shows the track from your current location to the selected origin on the floor plan or the outdoor route’s origin point.

Figure 2-64. Map monitor configuration of location features. Table 2-3. Map monitor’s top bar symbols. Map symbols Symbol Description

Symbol

Description

The location in unavailable.

The current altitude.

Searching for location.

The time of the last update.

The location is available.

The accuracy of the current location. The accuracy is also shown as a light blue circle on the map itself.

Manual location mode (for indoor use). Long-tap the map or tap on indoor route markers to set your current location.

Current rotation of the map in degrees (0º is north). The dark end always points north. Tap to reset the rotation to north.

The current speed.

Map monitor main menu

Through the Map monitor main menu, it can be accessed further configuration options. These options are shown in Figure 2-65.

Layers is a menu dedicated to select the floor plan, to create outdoor routes, and select the Map provider (see Figure 2-65.a)). • Floor plan editor allows to create simple and geo-referenced floor plans. A simple floor plan is not geo-referenced and can be setup quickly. It is used for indoor measurements that do not require absolute locations. Geo-referenced floor plans are positioned and aligned on a map. QualiPoc provides tools to line up floor plans with satellite imagery. This is typically used for combined outdoor and indoor measurements, or tests that require absolute locations. • Outdoor route editor is used to specify a route to the measurements. The route is created using waypoints that can be added directly to the map or entering an address/coordinate location. Table 2-4 shows the symbols and the description of each of the different waypoints added to create an outdoor route. • Map provider editor allows to select a Map provider and introduce new ones. Examples of Map providers include Google Maps, Open Street Map, HERE Maps, Bing, etc. Tile cache manager allows to download a particular map or route to have the information available when QualiPoc is not running the Map monitor in online mode (see Figure 2-65.b)). The number of tiles to download depends on the zoom level of the selected area. Online mode is a checkbox that when active automatically downloads map tiles for the current view (some tile providers only partially download tiles though). If the online mode is not active, only cached map tiles are shown. Show cached areas displays over the map using a green box the tiles that are available on the loaded tile cache file. Map settings are linked to the ⋮ | Settings | Map settings. See Section 2.2.1 for additional details. BTS settings are linked to the ⋮ | Settings | BTS settings. See Section 2.2.2 for additional details. Location services option opens the Android’s location menu to check that the host system allows the use of the location information.

(a)

(b)

(c) Figure 2-65. Map monitor’s main menu options: layers (a), tile cache manager (b), additional settings (c). Table 2-4. Map monitor’s route symbols. Map symbols Symbol Description

Symbol

Description

Selected route (floor plan routes may use various colors)

Route waypoint

Route to selected route’s origin point (navigation mode)

Route destination

Route origin

2.5.1.7.2

Map area

The map area shows the selected map provider and BTS information if it has been selected. The symbols that can be displayed on the map are summarized in Table 2-5 including the tracking lines and the BTS symbols. Zooming in and out is possible in the map using to fingers or the +/– buttons that are displayed on the bottom right-hand side of the map. The icons that show information about the active cell can be disabled by touching the bottom left-hand side of the map area. Table 2-5. Tracking lines and BTS symbols. Tracking lines Symbol Description The tracked values is available and is color-mapped according to the value’s thresholds. The tracked value is not available. The tracked value does not have a color mapping. Alternating blue/cyan patters indicate changing values. BTS symbols Symbol Description Allows enabling/disabling the BTS monitor (only shown if BTS information is enabled in BTS settings) Active cell name and identifier. Tap to enable/disable whether inactive cells are shown or not. Bearing/angle to the active cell in degrees.

Distance to the active cell. Active cell. Neighbor cell. Inactive cell. Selected cell. Overlapping active and inactive cells. Omnidirectional cell (inactive due to the color of the symbol)

2.5.1.8. Notifications monitor QualiPoc can be configured to inform the user when an event (signaling message or monitored parameter) happens. Notifications are displayed on the Notifications monitor using a list of events as shown in Figure 2-66.a). Each notification includes the time the notification took place, the event/value that triggered the notification, and the configured notification. For example, in Figure 2-66.a) a notification occurred at 09:12.26.692, the notification was caused because the 4G RSRP value measured was -109.2 dBm, and the configured notification is that the RSRP is lower than 90 dBm. To see the history of the notified event, tap on one of the notifications of the Notifications monitor. To configure a new notification, follow the steps shown in Figure 2-66.b). Slide up the Main toolbar and tap the settings button. This opens the Notifications Settings window. To add a new notification, tap on “Add Notification”. On the Edit Notification window, tap on Event and select whether you want to configure a Layer 3 message or Monitored parameter event. In both cases, a list of possible events to be selected are displayed. For each of the selected events, it is necessary to configure the condition that triggers the notification. The condition could be, for example, that the selected monitored parameter is equal/not equal/greater/less to/…than a specified argument value. For each of the selected events, it can be decided how the user is notified: sound, vibration or both. In addition, the Edit Notification window allows to configure how many times the user is notified of the configured event. The options are: notify on all event occurrences, notify on first event occurrence only, or notify on the first N (configurable) event occurrences. The configured notifications appear on the Notification Settings window where they can be activated or deactivated using the checkbox.

(a)

(b) Figure 2-66. Notifications monitor (a) and configuration of notifications (b).

2.5.2. LTE monitors QualiPoc offers a set of monitors that depend on the cellular technology that is active. When LTE is active the following five monitors are displayed: LTE, LTE DL, LTE UL, Cells (LTE), Coverage (LTE).

Figure 2-67. LTE monitor.

2.5.2.1. LTE monitor The LTE monitor can be configured to show all information related to the LTE technology. To modify the parameters that are displayed in the LTE monitor, slide up the Main toolbar and tap the settings button. The parameters that can be added to the LTE monitor appear on the “Selected” tab. Up to 32 parameters can be added. Parameters listed under the Freerider, Network Info, Service Test, LTE cell, LTE PDSCH, LTE PUCCH, LTE PUSCH, GPS Position, Voice and WiFi could be added to the LTE monitor. Note that these are the same tabs available to in the settings of the Status monitor. A detailed description of the parameters listed under these tabs can be found in Section 2.5.1.1.

2.5.2.2. LTE DL monitor QualiPoc’s LTE DL monitor (Figure 2-68) can be used to group together useful parameters to assess the performance of the LTE downlink. To modify the parameters that are displayed in the LTE DL monitor, slide up the Main toolbar and tap the settings button. Note that the parameters that are related to the LTE DL appear under the LTE PDSCH tab (see Section 2.5.1.1.4). However, it is possible to also add parameters listed under the Freerider, Network Info, Service Test, LTE cell, LTE PUCCH, LTE PUSCH, GPS Position, Voice and WiFi tabs. A detailed description of the parameters listed under these tabs can be found in Section 2.5.1.1.

Figure 2-68. LTE DL monitor.

Figure 2-69. LTE UL monitor.

2.5.2.3. LTE UL monitor QualiPoc’s LTE UL monitor (Figure 2-69) can be used to group together useful parameters to assess the performance of the LTE uplink. To modify the parameters that are displayed in the LTE UL monitor, slide up the Main toolbar and tap the settings button. Note that the parameters that are related to the LTE UL appear under the LTE PUCCH and LTE PUSCH tabs (see Sections 2.5.1.1.5 and 2.5.1.1.6, respectively). However, it is possible to also add parameters listed under the Freerider, Network Info, Service Test, LTE cell, LTE PDSCH, GPS Position, Voice and WiFi tabs. A detailed description of the parameters listed under these tabs can be found in Section 2.5.1.1.

2.5.2.4. Cells (LTE) monitor QualiPoc Cells (LTE) monitor (Figure 2-70) shows the channel signal and cell signal levels as well as cell signal quality parameters measured by the UE for each of the monitored cells. The window’s table format includes different cells in each row, and the PhyCellID, RSRP, RSRQ, RSSI and Antennas parameters as columns. The description of these parameters can be found in Section 2.5.1.1.1. The Cell (LTE) monitor window shows as the first row the information related to the cell to which the mobile station is connected to (serving cell).

Figure 2-70. Cells (LTE) monitor.

Figure 2-71. Coverage (LTE) monitor.

2.5.2.5. Coverage (LTE) monitor QualiPoc Coverage (LTE) monitor (Figure 2-71) shows information about the serving cell (SC) and the three best neighbor cell signal levels. The information is reported using a line graph that stores the last 60 seconds. For the serving cell, the graph shows the RSRQ (in grey) and RSRP (in red); note that the graph has two vertical axes at both sides with the scales of the RSRP (left y-axis) and RSRQ (right y-axis).

2.6. Conducting measurements with QualiPoc 2.6.1. Starting the measurements Before starting to log the measurements with QualiPoc, the mobile terminal should be in idle mode, i.e., without any active data connection or call ongoing. If there is a call active when the user starts logging, it will affect the logged measurement events, and the signaling will not be logged at the beginning of the log file. QualiPoc starts logging automatically when a job is started. Therefore, the first mandatory step to start the measurements is to create the desired job that includes the tests to be performed. See the job options and a detailed description about how to create/save/load jobs in Section 2.3. It is also recommended to properly setup the QualiPoc application in order to be able to monitor in real time important parameters that can be used to assess whether the test is being conducted as desired. To see the QualiPoc settings, tap ⋮ | Settings. Pay special attention to the “Unit configuration” menu that is used to configure the identifiers for the QualiPoc device, as well as the folder where the measurement files will be saved. This will allow to easily identify the measurements in the folder. Before starting the measurements, it is also important to check whether the GPS is properly configured and whether a valid position is correctly received. The GPS information can be accessed through the ⋮ | Settings | Map settings | GPS device (see Section 2.2.1). To start a job and log the measurements, tap ⋮ | Jobs to open the Job Settings menu, and then tap ⋮ | [Create new job | Load job] to create a new job or load a job. These steps are shown in Figure 2-72.

Figure 2-72. Useful tips - Start logging.

2.6.2. During the measurements When QualiPoc is executing a job and is logging the measurements, it changes its appearance and highlights in red the Android’s notification area (see Figure 2-73). In addition, the QualiPoc’s

Cell info banner shows the recording status. The Cell info banner is also always visible in any monitor to show information about the cell (Cell Id, DL EARFCN), the link quality (RSRP, RSRQ), and the forcing features. See Section 2.1.1 to change the parameters that are displayed on the Cell info banner.

Figure 2-73. Recording status.

During the measurements, the mobile terminal can be used as an active measurement tool with real-time monitor windows. In addition, the mobile terminal can be used as a regular smartphone with the QualiPoc application running and logging in the background. To use the mobile terminal as a regular smartphone just touch the terminal “Home” button to go to the Android’s desktop window. Once in the Android’s desktop window, it is possible to test and log the mobile terminal applications such as voice call, SMS and Internet navigation, to name a few. To avoid any interference with other jobs configured in QualiPoc, it is preferable to monitor the Android applications only when an Idle job is configured (see Section 2.3.5). To return to the QualiPoc application, touch the “Recents” button that shows a list of the applications that are running in the background and choose the QualiPoc application. The measurement process can be followed in a number of textual, bar and line monitors. Browse through these monitors available in the QualiPoc’s Monitor Section by touching the monitor tab or sliding up/down/right/left through the windows.

Figure 2-74. Useful tips - Freeze display, screenshots and photos.

At any time during the measurements, the QualiPoc display can be frozen. Side up the Main toolbar at any monitor, and touch the freeze icon (see Figure 2-74). The text Freezing is displayed at the top right corner of the QualiPoc’s Cell info banner. QualiPoc continues logging in the background even though the monitored network parameters are frozen. To continue viewing the data in real time, touch again the freeze icon on the Main toolbar. In addition to freezing the display, it is also possible to take screenshots of the QualiPoc’s monitors at any time during the measurements. The screenshots are saved in the phone’s path “*\Phone\QualiPoc\Results” using a name format that includes the data and time to easily recognize them. The Main toolbar also

offers the option to make photos using the mobile terminal camera. The photos are saved in the phone path ‘...\Phone\QualiPoc\Results’ and are labeled following the format ‘photo_YearMonthDay_HourMinuteSecon.png’. During measurements, the user can also add markers in the measurement file to identify points of interest. To add a Marker, tap ⋮ | Add text marker (Figure 2-75). The markers will appear if the measurement file is played back in QualiPoc or in NQDI/NQView.

Figure 2-75. Useful tips - Add marker.

2.6.3. Finishing jobs and measurements Even though it is not recommended if the voice/data connection has not finished, since this might cause a corrupted measurement file, QualiPoc jobs can be stopped at any time during the measurements. To do so, tap ⋮ | Stop Job, as shown in Figure 2-76, and QualiPoc will stop recording.

Figure 2-76. Stopping a job.

QualiPoc will also automatically stop recording once the steps included in the job that is being executed are completed. In this moment, a pop-up window will inform the user that the measurement file is being saved. This pop-up window vanishes in a few moments. Then, QualiPoc offers the user the option to add tags to the measurement file to easily recognize the file. Tags can be edited, and new ones can be created on the fly as shown in Figure 2-77.

Figure 2-77. Saving the measurements.

QualiPoc produces measurement files with an extension *.mf. When QualiPoc is configured to compress the measurement files, the extension changes to *.sqz. Measurement files are saved on the phone memory path ‘*\Phone\QualiPoc\Results’ and they are labeled as configured in the Unit configuration menu that is accessible in ⋮ | Settings | Unit configuration. See Section 2.2.8 for details. After that, the files can be extracted from QualiPoc using a data cable connected to the miniUSB port of the smartphone. As an alternative, it is also possible to configure QualiPoc to automatically upload the measurement files via FTP, HTTP or HTTPs connection. See Section 2.2.8 for details. The obtained measurement files can be post-processed and played back using the PC-based analysis tools NQDI or NQView.

3. NQView As it has been described in Section 2, QualiPoc can be used to reproduce the measurement test files just after they have been logged. However, the handset displaying capabilities cannot be compared with the use of a post-processing software in a PC. Therefore, SwissQual incorporates the NQView post-processing tool that provides a more powerful and user-friendly environment than Qualipoc. Under a license upgrade, NQView with a connected QualiPoc device can also be used to conduct measurements and monitoring the air interface of cellular and wireless networks. This section is focused on the features available in NQView for the post-processing and analysis of the network measurements collected with QualiPoc. Based on these measurements, NQView can be used to perform benchmarking, troubleshooting, and statistical reporting. This analysis is based on a set of Key Performance Indicators (KPIs) that NQView offers and that are defined for each wireless technology that it supports. NQView also incorporates a set of technology- and mechanism-specific windows that facilitate the analysis, and therefore are very useful for purposes like network maintenance, optimization, and verification. The following requirements (hardware and software) must be satisfied to run NQView: at least a dual-core or faster processor, a minimum of 2 GB RAM, a hard disk with NTFS format and one USB port for the license. The rest of this chapter introduces in a manual style how to use NQView v14.1.0.23 in Windows® 7 Professional. In particular, Section 3.1 illustrates how to initiate a session in NQView. Then, Section 3.2 presents the user interface of NQView and explains the available options and menus. Sections 3.3 and 3.4 present the NQView Monitors and NQView Pages, respectively. Monitors and pages are the views that NQView includes to display the measurement data by means of charts, tables and maps among others. Finally, Section 3.5 presents the NQView events, their functionality as well as their configuration.

Figure 3-1. Device Manager to enable the USB copy protection dongle.

3.1. Initiating a new session The license or Key of NQView is provided in a USB dongle. Therefore, before starting NQView, the user needs to connect a valid dongle in an USB port of the PC where NQView is installed. The dongle might not load automatically, and it is necessary to activate it through the Device Manager’s menu. This menu is available in the Control Panel of the PC. As shown in Figure 3-1, the USB dongle is recognized as “SafeNet Inc. HASP Key” in the USB controller’s section of the

Device Manager. To enable it, right-click on it and press “Enable”. Once the “SafeNet Inc. HASP Key” is enabled, NQView can be executed. Select the Windows button( ) | All Programs | SwissQual | NQView to open NQView. Alternatively, NQView can be opened from the desktop if there is a shortcut available. Look for an icon like the one shown in Figure 3-2.

Figure 3-2. NQView icon on Windows desktop

3.2. User interface The NQView user interface changes based on the selected mode or console when the program is executed. The following 3 consoles are available in NQView: Control, Realtime and Replay. The Control and Realtime consoles are used to configure NQView to perform real-time measurements. These two consoles are out of the scope of this Section that focuses on the features available in NQView when it is used to replay measurements collected using the QualiPoc tool. Under the Replay console it is possible to reproduce existing measurement files, analyse simultaneously multiple KPIs, and skip to the time instant of interest. The rest of this Section assumes the Replay console is selected. The NQView user interface is depicted in Figure 3-3. Figure 3-3 is empty since measurements are not loaded yet. This view allows to see the the menu bar, the main toolbar, the navigation panel, the device toolbar, and the status bar. These menus are highlighted in Figure 3-3. A detailed description of the menu bar, the navigation panel and the main toolbar is presented in Sections 3.2.1, 3.2.2 and 3.2.3, respectively. The device toolbar shows information about the device(s) used to perform the measurements that are being analysed. The status bar shows the name of the loaded measurement file and information about the CPU and RAM usage. The CPU value shows the processor usage of the main core that NQView is running on, while the RAM value shows the RAM usage of the system, including the amount of RAM that NQView uses. The empty Workspace can be configured based on the user needs and the analyzed radio technology to display a flexible set of windows using charts, tables and individual parameters. In NQView each window that appears in the Workspace is called monitor. The Workspace in NQView is highly user configurable. For example, the user can opt for adding basic monitors to the workspace where individual network parameters and events can be inserted and viewed. This option is referred as General monitor. This option requires that the user knows what network parameters (and in what format: chart, table, etc.) need to be evaluated to analyze a particular effect of a radio access technology. NQView also offers the option to use ready-made monitors that include predefined parameters for different technologies and network functions. These are referred to as Device monitors. Both General and Device monitors can be edited and modified based on the needs of the user and the requirements of the analysis that the user is performing. These edited monitors that the user has created can be saved with a customized name to be used later. Multiple monitors, including general, device and customized, can be opened at the same time and they are all visible (General and/or Device monitors) at the same time, in the same or in different pages of the Workspace. Like any other Windows’ program, the monitors can be minimized, maximized, or closed using the icons available on the top-right part of the monitor.

Menu bar

Device toolbar

Main toolbar

Empty Workspace

Navigation panel

Status bar

Figure 3-3. NQView empty user interface

Figure 3-4 shows an example of a Workspace with multiple Pages: Page 1, Page 2, Page 3 and LTE DL Data. To add a new empty Page right-click on the Pages bar and select Add (see Figure 3-5). The Workspace can be modified by the user by adding, removing, or modifying any monitor. To save the current Workspace, use the Workspace menu available in the menu bar. Select the Save as option and chose a name for the workspace. The next time you chose this workspace, it will include all monitors, pages, parameters, etc.

Pages bar

Figure 3-4. NQView Workspace with multiple Pages

Figure 3-5. NQView Pages bar

NQView also offers some ready-made Pages that include different kind of Device monitors for different technologies (e.g., GSM, WCDMA, HSDPA or LTE). As an example, Figure 3-6 shows a Page offered by NQView for the analysis of LTE Downlink (DL) Data measurements. It includes Device monitors representing LTE values or parameters such as the Transport Block Size or PDSCH Throughput.

Figure 3-6. NQView LTE ready-made Page

Figure 3-7. File menu.

Figure 3-8. Settings menu.

3.2.1. Menu bar 3.2.1.1. File menu The File menu (see Figure 3-7) mainly allows the user to configure NQView. The Settings option allows to check and modify the settings of the different components and functionalities of the program. Figure 3-8 shows the settings menu. In the ‘General’ tab it allows to indicate whether

the start-up dialog is displayed or not, and whether the last workspace used should be loaded. It also allows to indicate the measurement time that is buffered or that the NQView software manages. Other tab of interest is the ‘Map’ that allows to configure the colour that is used to represent sectors, serving cell or neighboring cells. The ‘Open street map’ sub tab is used to indicate the server from where the map tiles are downloaded (e.g., http://tile.openstreetmap.org). In the Settings menu, the Floating license option is used to manage the NQView license. The Import/Export settings option allows to import the NQView configuration (e.g., from another computer) as well as exporting the current program configuration.

3.2.1.2. View menu In the View menu (Figure 3-9), the user can show (or hide) several items from the user interface, such as the navigation panel, toolbar, devices bar, log output and grid. When the grid is enabled (i.e., a grid of points showed in the workspace window) using the ‘Set grid size’ option, the user can configure the size of the grid (in points) which is behind the Workspace. The higher the value used, the more space between the grid of points. Using ‘Customize Toolbar’ option, it is possible to customize the buttons that appear in the main toolbar as well as their position. By clicking ‘Reset toolbar’, the toolbar returns to its default aspect.

Figure 3-9. View menu.

3.2.1.3. Replay menu The Replay menu (Figure 3-10) offers the user a set of options for the post-processing of measurement files. Some of these options are also available in the main toolbar buttons (see Figure 3-3). The ‘Load file(s)...’ option is used to load the measurement files logged with QualiPoc. The ‘Export Data...’ option allows to export to .csv format the measurement file that has been loaded. This option is of great value to post-process the measurements using third-party software. For example, Figure 3-11 shows an example to export the metrics RSRP and RSRQ. The ‘Export Data…’ option creates a table that shows the time and location together with the metrics’ values. The export button at the bottom of the window is used to open the wizard that guides the user to select the folder where the csv file is saved. The ‘Open Pages and Monitors’, ‘Open Values’ and ‘Open Events’ options open the corresponding panels in the navigation panel (more details about Pages and Monitors panel, Values panel and Events panel in Section 3.2.2). The ‘Open Devices’ option opens a Devices monitor in the workspace that shows general information about the device that was used to conduct the measurements. Finally, with the Play, Pause, Stop and Speed options the user can control the playback of the loaded measurements.

Figure 3-10. Replay menu.

Figure 3-11. Data Export.

3.2.1.4. Data presentation menu Through the Data presentation menu (Figure 3-12), the user can open different views to display and analyze the measurement files. There are two types of views: Pages (‘Add Page’) and Monitors (‘Add Monitor’). A monitor is a view or window where the measurement data can be represented. A page is a group of monitors. There are different types of monitors available: List, Table, Map, Bar chart, Line chart, Pie chart, Ranger Battery, Devices, NQView events and GPS. The user can find a selection of pre-established monitors and pages associated to different technologies. However, if the user selects AddMonitor | General, the user can open an empty

monitor of the selected type. For instance, AddMonitor | General | Line Chart would open an empty line chart monitor. Given the importance of the different types of monitors and pages, a detailed description is presented in Sections 3.3 and 3.4, respectively. With the ‘Change Monitors source device’ option, the user can change the device from which the measurements are loaded. This option is useful in the case that the measurements are conducted using more than one device. The ‘Define Values filter…’ option allows the user to select the Values3 or network parameters to be shown or hidden in the Values panel (within the Navigation panel). The main function of the ‘Configure value shades…’ option is to set the default aspect (e.g., colour or background colour) of each Value. For instance, it is possible to specify a colour for a Value when it is within a range. The ‘Configure Operators…’ option allows the user to check the available operators as well as to add, edit or delete some of them. Finally, the ‘Configure BTS lists…’ option is used to import information about the base stations (e.g., location and technology) to locate them within a map Monitor.

Figure 3-12. Data presentation menu.

3.2.1.5. Workspace The Workspace menu (Figure 3-13) is used to manage the workspaces. The Workspace dropdown submenu can be used to load one of the previously saved workspaces. The ‘Save’ option allows saving the current workspace by overwriting the previously saved workspace with the same name. With the ‘Save as’ option it is possible to save the current workspace as a new workspace and with a different name. Finally, the ‘Delete Workspace’ option deletes the currently loaded workspace.

Figure 3-13. Workspace menu.

3

A value refers to a parameter in NQView. For example a Value can be a performance parameter such as the PDSCH Throughput. More details about Values and Values panel in Section 3.2.2.2.

3.2.1.6. Window menu The Window menu (Figure 3-14) is used to organize the monitors within the current Page of the Workspace. The user can display the monitors in different rows by selecting the ‘Tile horizontal’ option, in columns with the ‘Tile vertical’ option and in matrix with ‘Tile side-by-side’ option. Note that it is also possible to perform these actions using the short-cuts Ctrl+Alt+H, Ctrl+Alt+V and Ctrl+Alt+S, respectively.

Figure 3-14. Window menu.

3.2.1.7. Help menu The user has access to some important help topics in the Help menu (Figure 3-15). In the ‘Help’ option, click on the Search tab and type what you are looking for. The ‘Help’ option automatically shows topics related to the ones that you are searching. The ‘Message counter statistics…’ shows a table with statistics (e.g., counter, messages received/sec, last time it is received) about the messages included in the last loaded measurement file. In addition, through this menu the user has access to a guide of shortcuts in the ‘Shortcut keys index...’ option. Finally, the ‘About’ option opens a dialog that the user can use to know further information about the NQView application, including the current license status and the application version number.

Figure 3-15. Help menu.

3.2.2. Navigation panel The Navigation (see Figure 3-3) is located on the left-hand side of the user interface and contains 3 panels: 1) Pages and Monitors panel, 2) Values panel and 3) Events panel. The Navigation panel only shows the panel that is selected, and each of these panels has different functionalities that are described below.

3.2.2.1. Pages and Monitors Panel The Pages and Monitors panel (Figure 3-16) provides a tree-like view of the available pages and monitors. This view changes depending on the device that is selected (in case there is more than one) in the device toolbar. To display this panel in the Navigation panel the user can click on (see in Figure 3-16 that when it is displayed, the Pages and Monitors option

is highlighted in bright orange). As an alternative, this panel can be also displayed by clicking on the button

that is available in the main toolbar. To add a page or monitor to your workspace,

double click on an item of the tree, or press the main toolbar button

to add a pre-defined or

customized page, or press the main toolbar button to add a monitor. NQView includes two basic types of pages: Device pages and Customized pages4 (Figure 3-17.a). In addition, NQView includes four basic types of monitors: General monitors, Device monitors, Scanner monitors5, and Customized monitors6 (see Figure 3-17.b) By clicking on the symbol the user can access all type of pages (Figure 3-17.a) and monitors (Figure 3-17.b) that include each of the basic types of pages and monitors, respectively. For a detailed description of the available monitors in NQView, see Section 3.3.

Figure 3-16. Pages and Monitors panel.

4

The Customized pages item only appears in the panel if there is at least one customized page saved by the user. 5 Scanner monitors are only enabled if the loaded measurements are taken with a special device that can scan the spectrum. 6 The Customized monitors item only appears in the panel if there is at least one customized monitor saved by the user.

(a)

(b) Figure 3-17. Types of Pages (a), and Monitors (b).

3.2.2.2. Values Panel The Values panel (Figure 3-18) shows the network parameters/values that the user can monitor in NQView. To display this panel in the Navigation panel the user can click on or on the button in the main toolbar. There are different types of values such as numerical values (e.g., RSRP) or string values (e.g., Transmission Mode). The values are displayed in a tree-like view and classified by groups according to their relations. For example, under LTE there are several groups such as EMM State (for mobility management values), NAS QoS (for non-access stratum QoS), Neighbour Cell, etc. In the LTE | Serving Cell Meas group there are values such as frame number, EARFCN, PCI (see Figure 3-18). When the user selects a particular value (by doing click on it), a definition of the value is shown in the lower part of the panel. To add a value to a monitor, select a device in the device toolbar, select a value in the tree, and then drag and drop the value to the monitor. It should be noted that a type of monitor only can admit and show compatible values (i.e., there are some incompatible values for each type of monitor).

Figure 3-18. Values panel.

3.2.2.3. Events Panel You can use the Events panel (Figure 3-19) to enable or disable events during playback. Events are special triggers that can be configured to alert the user when something specific during a measurement occurs, for example, a dropped call. To display this panel in the Navigation panel the user can click on or click on the button information about Events, see Section 3.5.

of the main toolbar. For more

Figure 3-19. Events panel.

3.2.3. Main toolbar buttons The NQView’s main toolbar is at the top of the workspace and includes a set of buttons that are described in the following table. Table 3-1. Main toolbar buttons Button Description Shows the Pages and Monitors panel in the Navigation panel. Shows the Values panel in the Navigation panel. Shows the Events panel in the Navigation panel. Open a Devices monitor in the selected page of the Workspaces with information about the device that has taken the loaded measurements. Add a new Monitor to the workspace. Add a new pre-defined or customized Page to the workspace. Rewind the playback/recording with the loaded measurements file. Button enabled only after pressing the pause button (

).

Go back step by step in the playback/recording. Button enabled only after pressing the pause button (

).

Starts the playback/recording with the loaded measurements file. Pauses the playback/recording. Stops the playback/recording. Advance step by step in the playback/recording. Button enabled only after pressing the pause button (

).

Fast forward the playback/recording. Button enabled only after pressing the pause button (

).

Additionally, there are other important commands in the main toolbar: •

: selects the active Workspace among all the saved Workspaces.

•

: selects a particular time for the playback/recording of loaded measurements.

•

: modifies the speed of the playback/recording.

3.3. NQView monitors A monitor is a view or window utilized by NQView to display the measurement data. NQView includes four basic types of monitors: General monitors, Device monitors, Scanner monitors7, and Customized monitors. General monitors (Figure 3-20.a) are empty monitors with a default format where you can add the different Values or network parameters that you want to analyse. On the other hand, Device monitors (Figure 3-20.b) already have some relevant values added for a specific technology (e.g., LTE) and have a pre-defined format adapted to the added values. Scanner monitors are monitors only available with special devices that are able to scan the spectrum among other things. Customized monitors (Figure 3-21) are monitors that have been modified by the user (e.g., new added values or format change) and then saved as new monitors. The different types of General monitors are presented in Section 3.3.1. The Devices monitors are presented in Section 3.3.2. In Section 3.3.3 the options available in the monitors tile pop-up menu are analysed.

7

Scanner monitors are not detailed in this section since they are out of the scope of this book. Scanner monitors require a special device that can scan the cellular radio interface.

(a)

(b)

Figure 3-20. NQView General monitors (a) and Device monitors (b).

Figure 3-21. NQView Customized monitors.

3.3.1. General monitors 3.3.1.1. Line chart monitor The Line chart monitor plots a value or several values as a function of the elapsed time (see Figure 3-22). A Line chart monitor is made of a main window where the corresponding lines are displayed in a chart. The vertical axis (or axes) associated with the plotted values is (are) shown to the right of the chart. The horizontal axis represents the time and the vertical yellow line represents the current playback time of the loaded measurements. The legend of the plotted values is at the bottom of the monitor8. It includes the names of the values represented and their associated line format. As an example, Figure 3-22 shows a Line chart monitor that displays the RSSI and RSRP measured by a terminal/device (Samsung Galaxy Note 3) in its serving LTE cell. As it can be observed, multiple values can be plotted on the same Line chart at the same time. Using the legend’s check boxes, each of the plotted values can be shown or hidden from the Line chart. To open an empty Line chart monitor, select | General | Line Chart in the Main toolbar menu or double-click in Monitors | General monitors | Line Chart within the Pages and Monitors panel. To add a value to a line chart monitor, drag and drop any value (compatible with the Line chart monitor, i.e., that is a numeric value) from the Values panel. To do this, the user can search the value using the filter tool in the upper part of the Values panel. Once the value is found, click on it and drag it to the chart, as it is illustrated in Figure 3-22.

8

If the size of the Line chart monitor window is too small, the legend may not appear. In that case you can adjust the size of the window manually or maximize the window to see the legend.

It is possible to zoom in and out in a line chart monitor. This can be done with the mouse scroll wheel or selecting an area within the lien chart monitor.

Drag and drop to add new Values

Legend

Figure 3-22. Line chart monitor.

3.3.1.1.1

Line chart monitor pop-up menu

The format of the Line chart can be modified as well as the format of plotted lines. These changes can be made for any of the values that are displayed in the Line chart, and different formats can be applied to each of them. To see the options that are available to modify the format of the values, right-click on the title of the value that appears in the legend. Note that if there is more than one value in the legend, the format that is being edited is only the one selected. However, if the requested format change cannot be only applied to a particular value, then the change applies to all values. The pop-up menu shown in Figure 3-23 appears when the user right-clicks on the title of any value that is in the legend.

Figure 3-23. Line char monitor pop-up menu

• •

The Order command puts the line in front of others or send it to the back. The Plot type command allows you to configure the following plot options (note that these changes would apply to all values): o Plot type | Add area brush fills the area under the line with color. o Plot type | Switch to bar presentation displays values as bars instead of lines. o Plot type | Switch to line presentation displays values as lines instead of bars.

•

• •

• •

o Plot type | 3D view displays chart in 3D or 2D. The Remove command is used to remove any of the values that is displayed in the monitor. If you want to remove the value that was used to open the pop-up menu, use the command that appears below Remove. For the example shown in Figure 3-23: ‘Remove Samsung Galaxy Note 3 (SM-N9005): RSRP’. The Set buffer length command is utilized to specify the time window that is displayed in the horizontal axis. The default value is set to 600s. The Shade command allows to change the format of the line as follows: o Shade | Shading type allows to configure the colour of the line: ▪ 1) Shade | Shading type | None uses always black as the default colour. ▪ 2) Shade | Shading type | By default colour specifies the displayed colour as the default colour for each value. ▪ 3) Shade | Shading type | By value specifies the displayed colour of the value according to its current colour configuration. ▪ 4) Shade | Shading type | By unit specifies the displayed colour depending on the units/terminals used to perform the measurements9. ▪ 5) Shade | Shading type | By device number specifies the displayed colour depending on the number of the device that was utilized to perform the measurements10. o Shade | Line command allows to set the colour and width of the plotted line with the following two commands: ▪ 1) Shade | Line | Edit width specifies the width of the line in pixels. ▪ 2) Shade | Line | Edit colour specifies the colour of the line. The Value titles command is used to modify the title that appears in the legend. You can add or remove from the tile the name of the Value (e.g. RSSI), the Device (e.g. Samsung Galaxy Note 3) and/or the Unit (e.g. slot 1). The Vertical axis | Boundaries command allows to set the range of the vertical axis.

3.3.1.2. Bar chart monitor Unlike the line chart monitor that shows the evolution of the represented values along the time axis, the Bar chart monitor displays a value or several ones at a given point in time. A Bar chart monitor has a main window where the corresponding bars are shown in a chart. The vertical axis (axes) associated with the plotted values is (are) shown to the right of the chart. Below each bar (in the horizontal axis) the title/name of each value appears along with the numeric measurement of the value. As an example, Figure 3-24 shows a Bar chart monitor that displays the RSSI and RSRP measured by a device in its serving LTE cell. The RSSI and RSRP values are reported in the Bar chart monitor at the same time instant than the vertical yellow line showed in the Line chart monitor of the Figure 3-22. As it can be observed in Figure 3-24, multiple values can be plotted on the same Bar chart. To open an empty Bar chart monitor, select | General | Bar Chart in the Main toolbar menu or double-click in Monitors | General monitors | Bar Chart within the Pages and Monitors panel. To add a value to a Bar chart monitor, drag and drop any value compatible with the Bar chart monitor from the Values panel as illustrated in Figure 3-24.

9

There can be devices with multiple measurement hardware units. Useful if we load measurements taken by several devices.

10

Drag and drop to add new Values

Figure 3-24. Bar chart monitor

3.3.1.2.1

Bar chart monitor pop-up menu

Like it has been presented in Section 3.3.1.1.1 for the case of the Line chart monitor, it is also possible to configure the format of the Bar chart monitors and the way to represent the bars. To do this, right-click on the device name that appears at the bottom part of the Bar chart monitor (see “Samsung Galaxy Note 3…” in Figure 3-24). Right clicking on the device name opens the pop-up menu showed in Figure 3-25.

Figure 3-25. Bar chart monitor pop-up menu

• • • • •

The 3D view option changes the Bar chart display between 3D and 2D. The Clear all content command removes all content (i.e., values displayed) from the Bar chart monitor. The Remove command is used to remove specific values from the Bar chart monitor. The Remove selected command removes the selected value from the Bar chart monitor. The Shade command allows to change the format of the bars as follows: o Shade | Shading type allows you to configure the colour of the bars: ▪ 1) Shade | Shading type | None uses always black as the default colour. ▪ 2) Shade | Shading type | By default color specifies the displayed colour as the default colour for each value. ▪ 3) Shade | Shading type | By value specifies the displayed colour of the values according to their current colour configuration. ▪ 4) Shade | Shading type | By unit specifies the displayed colour depending on the units used to perform the measurements.

▪

• •

5) Shade | Shading type | By device number specifies the displayed colour depending on the number of the device that was utilized to perform the measurements. The Show axes option shows or hides the vertical axis. The Value titles command is used to modify the title that appears at the bottom of each bar. You can add or remove from the tile the name of the Value (e.g. RSSI), the Device (e.g. Samsung Galaxy Note 3) and/or the Unit (e.g. slot 1).

3.3.1.3. Pie chart monitor Network measurements can be also displayed in NQView using pie charts. The Pie chart monitor (see Figure 3-26) is specially indicated to show ratios. For example, in Figure 3-26 the pie chart shows the ratio of utilized modulation schemes: BPSK, QPSK or 64QAM. To open an empty Pie chart monitor, select | General | Pie Chart in the Main toolbar menu or double-click in Monitors | General monitors | Pie Chart within the Pages and Monitors panel. To add a value to a Pie chart monitor, drag and drop any of the value that is compatible with the Pie chart monitor from the Values panel as illustrated in Figure 3-26.

Drag and drop to add new Values

Figure 3-26. Pie chart monitor

3.3.1.4. List monitor Previous monitors are utilized to represent network parameters in charts: line, bar, pie. With the List monitor, NQview also allows to display values as a list. The List monitor has two columns: the name of the Value, and its numeric value. See for example Figure 3-27 where the list includes the Values: RSSI, RSCP, PUSCH Throughput and PDSCH Throughput, and their corresponding numerical values at a specific point in time: -66.5 dBm, -104.6 dBm, 3070 kbps, and 100 kbps, respectively. Multiple Values can be added to the same List monitor. To open an empty List monitor, select | General | List in the Main toolbar menu or doubleclick in Monitors | General Monitor | List within the Pages and Monitors panel. To add a value to a List monitor, drag and drop any value compatible with the List monitor from the Values panel as illustrated in Figure 3-27.

Drag and drop to add new Values

Figure 3-27. List monitor

3.3.1.4.1

List monitor popup menu

As it has been described for the case of the Line char (Section 3.3.1.1.1) and the Bar char (Section 3.3.1.2.1), it is also possible to configure the format of the List monitor. To do this, right-click on any part within the List monitor. This opens the pop-up menu showed in Figure 3-28.

Figure 3-28. List monitor pop-up menu

▪ ▪ ▪ ▪

▪ ▪ ▪ ▪ ▪

The Clear all content command removes all content from the List monitor. With Font Size command, it can be adjusted the font size of the elements in the list. The Remove command is used to remove any Value from the list. The Shade command allows to change the format of the list as follows: o Shade | Shading type allows to configure the colour of the elements in the list: ▪ 1) Shade | Shading type | None uses always black as the default colour. ▪ 2) Shade | Shading type | By default color specifies the displayed colour as the default colour for each element in the list. ▪ 3) Shade | Shading type | By value specifies the displayed colour of the Values according to their current colour configuration. ▪ 4) Shade | Shading type | By unit specifies the displayed colour depending on the units used to perform the measurements. ▪ 5) Shade | Shading type | By device number specifies the displayed colour depending on the number of the device that has performed the measurements. The Show background shade command is used to show or hide a background colour of Values in the list. The Show empty values command is used to show or hide the empty Values. With the Show progress bar command it is possible to display a progress bar instead of a numeric value. The Value alignment option adjusts the alignment of the elements of the list. Available options are: align left or center. The Value titles command is used to modify the title of the elements that appears in the List monitor. You can add or remove from the title the name of the Value (e.g. RSSI), the Device (e.g. Samsung Galaxy Note 3) and/or the Unit (e.g. slot 1).

3.3.1.5. Table monitor While the List monitor displays the numeric value of the elements of the list at a point in time, the Table monitor shows all numeric values with the time in a tabular form (see Figure 3-29). In this context, the first column of the table is reserved for the Time instant, and it cannot be changed. The user can select what Values to show in the other columns. Values displayed in the table might be recorded at a different rate. Therefore, the table shows a row for each time instant there is a numeric value for any element included in the table’s columns. If for that time instant, other columns have not recorded a numeric value, the cell will be empty (see Figure 3-29). The Table monitor reported in Figure 3-29 includes the following Values: RSSI, RSRP, PUSCH Throughput and PDSCH Throughput. Figure 3-29 shows that the RSSI and RSRP measurements are reported with the same rate and at the same time instants. For the time instants that the RSSI and RSRP are reported, the PUSCH Throughput and PDSCH Throughput As it can be observed, multiple values can be added to the same Table monitor and some cells remain empty. To open an empty Table monitor, select | General | Table in the Main toolbar menu or double-click in Monitors | General Monitor | Table within the Pages and Monitors panel. To add a value to a Table monitor, drag and drop some value compatible with the Table monitor from the Values panel as illustrated in Figure 3-29. Each value that you add creates a new column in the Table monitor; however, you cannot insert a new value between two existing columns.

Drag and drop to add new Values

Figure 3-29. Table monitor

3.3.1.5.1

Table monitor popup menu

It is also possible configure the format of the Table monitor. To do this, right-click on any part within the Table monitor. This opens the pop-up menu showed in Figure 3-30.

Figure 3-30. Table monitor pop-up menu

• • • • • • •

• • •

The Autoscroll option allows to select whether the Table monitor view moves automatically with the playback time or not. The Buffer alive time option allows to set the time window that is displayed in the Table monitor. The default amount is five minutes. With the Copy to clipboard option it is possible to copy the data from the table in a comma separated text format. With the Export to csv, instead of copying the information to the clipboard, the data from the Table monitor is exported to a .csv file. The Remove command is used to remove Values (i.e. columns) from the Table monitor. The Value selected to open the pop-up menu can be removed directly. For the example displayed in Figure 3-30, the ‘Remove Samsung Galaxy Note 3 (SM-N9005): RSRP’ option is available. The Shade command allows to change the format of the table with the Shade | Shading type command. o Shade | Shading type allows to configure the colour of the numeric values in the cells: ▪ 1) Shade | Shading type | None uses always black as the default colour. ▪ 2) Shade | Shading type | By default color specifies the displayed colour as the default colour for each element in the table. ▪ 3) Shade | Shading type | By value specifies the displayed colour of the Values according to their current colour configuration. ▪ 4) Shade | Shading type | By unit specifies the displayed colour depending on the units used to perform the measurements. ▪ 5) Shade | Shading type | By device number specifies the displayed colour depending on the number of the device that has performed the measurements. The Show empty values command is used to show or hide the empty Values. With Tile columns width command the user can adjust each column to equal widths. The Value titles command allows to modify the title of the Values that are displayed in the Table monitor. You can add or remove from the title the name of the Value (e.g. RSSI), the Device (e.g. Samsung Galaxy Note 3) and/or the Unit (e.g. slot 1).

3.3.1.6. Map monitor When the QualiPoc measurements are geo-referenced (i.e., if a GPS receiver was used to track the location of the terminal during the measurements), NQView can display the measurement results in a Map monitor. In particular, the path followed during the measurements can be shown in a coloured map. Different paths can be shown in the Map monitor simultaneously, with each of them representing a network measurement or Value. For example, different paths could show the measured RSRP, RSSI, PUSCH Throughput or PDSCH Throughput at a specific geographic position. In addition, for each of the paths, it is possible to configure different ranges of colours to easily identify a problem on a map. These colour ranges can be defined by the user with the Data Presentation | Configure value shades dialog accessible from the Main Toolbar. The Map monitor is made of two windows (see Figure 3-31). In the main window is where the map and coloured paths are shown. There is also a left-side panel or window with different checkboxes to configure what information is shown on the map (more details about the left-side panel are provided in Sections and 3.3.1.6.3). These two windows are accompanied at the top with a toolbar. This toolbar includes the different icons that can be used to configure the Map monitor. It shows, for example, icons to load map models, move through the loaded map, and calculate distances among other things (more details about Map monitor toolbar are provided in Section 3.3.1.6.4). Finally, there is a bar at the bottom that shows information about the coordinates of the map and the operative system’s directory that contains the current loaded map model. The Map monitor reported in Figure 3-31 shows the path coloured for the measured

RSSI. Note that in the main window it is not displayed yet the map layer with buildings and streets, and therefore the path is shown over a white map.

Active base station with four sectors

User position

Path

Figure 3-31. Map monitor (MapX view)

Two map layers can be displayed on the Map monitor: MapX and Open street map. These two options can be selected from the menu available at the top bar. MapX is based on the Geoset models. To load a new Geoset model, press the icon to open a new dialog and then press Load Geoset button (see Figure 3-32.a) to load the SPAIN.GST file (see Figure 3-32.b). Once this has been loaded, the Map monitor displays the map of Spain as shown in Figure 3-33.

(a)

(b) Figure 3-32. Loading a new map model (Geoset)

Figure 3-33. Spain Geoset

Drag and drop to add a new Value

Figure 3-34. Map monitor (Open street map view)

The Map monitor can also be used to display information about the base stations. To do that, a BTS file similar to the one created for QualiPoc (see Section 2.2.2) has to be loaded in NQView. The procedure to import BTS files in NQView is described in Appendix IV. Once the BTS file is loaded, a base station is displayed on the Map monitor as shown in Figure 3-31. A thin red line is used to show the base station at which the mobile terminal is connected to (i.e. the active base station). The BTS icons display the antennas, ids of each of the antenna’s sector, and directions that the antennas/sectors point to. In contrast, Open street map11 includes much more details about the streets and places than MapX as shown in Figure 3-34. When the Open street map is loaded, the view also displays the coloured path of the Values, as well as the red thin line that links the location of the terminal with the active base station (see Figure 3-34). However, this view does not show the BTS icons on the map. To switch between MapX and Open street map, use the button the Map monitor toolbar.

that is available in

To open an empty Map monitor, select | General | Map in the Main toolbar menu or doubleclick in Monitors | General monitors | Map within the Pages and Monitors panel. To add a value to a Map monitor, drag and drop some network parameters compatible with the Map monitor from the Values panel as illustrated in Figure 3-34. Values can be added in both MapX and Open street map. Each Value added to the Map monitor creates a new layer that can be displayed or not simply using the check-box. As it has been described above, the colours of the paths can be configured, and ranges with different colours can be set (see the case in Figure 3-34 for the RSSI). Note that it might be difficult to identify what path is displayed on the map if several Values are active at a time. 3.3.1.6.1

Map monitor pop-up menu

The format in which the Map monitor is displayed can also be configured. To do this, the user has to right-click on any part within the Map monitor. This opens the pop-up menu showed in Figure 3-35.

Figure 3-35. Map monitor pop-up menu

• • •

11

The Export value data option is used to export the Values data in .csv format. This csv includes the time, longitude, latitude, and measurements of each Value added to the map. With the Remove command it is possible to remove some Values that are displayed in the Map monitor. The Shade command allows to change the format of the map with the Shade | Shading type command. o Shade | Shading type allows to configure the colour of the network parameters (Values) represented in the path: ▪ 1) Shade | Shading type | None uses always black as the default colour. ▪ 2) Shade | Shading type | By default color specifies the displayed colour as the default colour for each Value.

To load properly the map with Open street map view you should ensure that the checkbox Use open street maps offline is checked. You can find this checkbox in Main toolbar: File | Settings | Map | Open street map.

▪

•

3) Shade | Shading type | By value specifies the displayed colour of the Values according to the current colour configuration. ▪ 4) Shade | Shading type | By unit specifies the displayed colour depending on the units used to perform the measurements. ▪ 5) Shade | Shading type | By device number specifies the displayed colour depending on the number of the device that has performed the measurements. The Value titles command allows to modify the title of the Value that appears in the leftside panel. You can add or remove from the title the name of the Value (e.g. RSSI), the Device (e.g. Samsung Galaxy Note 3) and/or the Unit (e.g. slot 0).

Figure 3-36. Left-side panel of the Map monitor

3.3.1.6.2

Map monitor side panel

The left-side panel follows a tree structure with groups of checkboxes. As it is shown in Figure 3-36, there are 3 main groups of checkboxes within the Map checkbox: 1) Paths, 2) Measure values, and 3) BTS lists. With Paths the user can modify the format of the path that appears on the map and (the path is represented by a black line that appears in the map if the checkbox of the Measure values group is unchecked). With Measure values the user can show or hide the coloured paths associated to each of the Values. Each Value can be shown or hidden with the Measure values | [Value] checkbox. With BTS lists the user can show or hide icons and text of the base stations. This information follows the BTS List that has been imported into NQView following Appendix IV. In particular, with BTS lists | LTE the user can show/hide icons and text of LTE base stations. The Active BTS line shows a thin red line from the current position of the device to the active base station (i.e., the one at which the device is connected to).

Figure 3-37. Map checkbox pop-up menu

3.3.1.6.3

Map monitor side panel configuration

Map checkbox Right clicking on the Map checkbox opens the pop-up menu showed in Figure 3-37. • Select the Unload geoset command to unload the current loaded geoset file. • Choose the Save map to bmp command to save the map as a bitmap image file. Path checkbox Right clicking on the Path checkbox opens the pop-up menu showed in Figure 3-38.

Figure 3-38. Path checkbox pop-up menu

• • •

Select the Load gps path(s) command to load one or more GPS paths to the map. Choose the Remove all loaded paths command to remove the paths that you loaded into the map. Select the Set width for all paths command to configure the width of the lines shown in the map associated to all the loaded paths.

Right clicking on the Drive path or Walk path checkboxes opens the pop-up menu showed in Figure 3-39.

Figure 3-39. Drive path or Walk path checkboxes pop-up menu

• • • • •

With the View entire layer command you can adjust the zoom to view the entire layer that you have selected. Choose the Color command to change the color of the current path. Choose the Width command to change the width of the current path. Select the Save command to save the current path to a file. Select Clear to clear the current path.

Figure 3-40. Measure values checkbox pop-up menu

Measure values checkbox Right clicking on the Measure values checkbox opens the pop-up menu showed in Figure 3-40. • With the Export values command you can export values to a comma-separated (csv) file, a Google Earth kmz file, or a MapInfo tab file. • Choose the Remove all values command to remove all of the previously added Values. • Choose the Show unit command to show the unit name for each value. • Select the Value shade type command to select the shading type for the Values on the monitor. • With the Value titles command the user can configure the title of the Values. • Select the Radial value offset | Offset enabled command to automatically arrange the values along the path to avoid overlapping values. • Select Radial value offset | Radial orientation command to change the orientation of the values on the path to left or right. Following the tree structure of the Measure values, it is possible to see that different Values hang form the Measure values checkbox. If we expand the content of a Value, we can see the legend of colours associated with different numerical ranges. These colours are the ones displayed in the path depending on measured performance at each position. Figure 3-41 shows an example of this legend for the RSSI Value. NQView provides pre-defined ranges with different colours to represent the Values. The user can modify these ranges and colours as describe below.

Figure 3-41. RSSI legend

Figure 3-42. Shade Editor

Modifying the colour ranges of Values The colour associated with each of the ranges specified for a measure Value can be modified. It is also possible to configure the number of ranges and the lower and upper limits of each of them. This configuration is available from the main toolbar: Data Presentation | Configure value shades | Values | LTE | [Value]. At this location, all LTE Values that can be represented using ranges are visible. In the example shown in Figure 3-42, the Serving Cell Meas | RSSI is being configured. The figure shows the pre-defined format for the RSSI as it appears in Figure 3-41. Figure 3-42 shows a button Add range that is available on top of the table. This button is used to create a new numerical range. The range is specified with the Minimum and Maximum fields. It is also possible to update a range that already exists in the table by right-clicking on it. Then, new Minimum and Maximum ranges can be defined. Once the range is inserted, use the UpdateRange button to validate the changes. At the bottom of the window shown in Figure 3-42, there is also the Copy shade of option that allows you to copy a legend’s format to be used for another Value. At the bottom of the window, there is also a button named Spread color that is used to created gradient ranges from an initial colour defined in Start pos to a final colour defined in End pos. The colour of the ranges already defined can be manually modified. To do this, simply doubleclick on any of the ranges defined in the table (Figure 3-43.a). This action opens the window shown in Figure 3-43.b where it can be edited the colour and/or other formatting aspects like the size of effects.

Doubleclick

(a)

(b)

Figure 3-43. Color legend edition: range selection with double-click (a) and Shade Style window (b).

3.3.1.6.4

Map monitor toolbar buttons

The Map monitor toolbar includes a set of buttons that are described below. Table 3-2. Map monitor toolbar buttons

Button

Description This is used to change the view from MapX to Open Street Map. Opens a geoset for the current map monitor. Opens the MapX geoset manager to customize your geosets. The Map monitor can also be used to show display indoor measurements. In this case, a plan (blueprint) of the room can be loaded to reference the measurements. This option is mainly used when NQView is utilized as a monitoring tool. . Related to indoor measurements, this button enables the PC’s camera to take a photo and save images of the environment where indoor measurements are performed.

The Map monitor display multiple layers including BTS, Value colour paths, etc. This button turns the cursor into a selector, which you can use to select items on the map and get information about them. This button is used to zoom in into a particular area of the map. The cursor becomes a magnifying glass to select the area where to zoom in. . This button is used to zoom out. Like the previous button, the cursor becomes a magnifying glass to do this action. This button turns the cursor icon into a hand that can used to move the map around. This button turns the cursor into a triangle that can be used to measure distances between two points on the map. The measured distance is displayed in the status bar of the Map monitor. With this button (“set new walk position”) it is possible to add manually a mark on a map. This is useful when NQView is being used as a monitoring tool for indoor measurements where GPS is not available. This button deletes the most recent position added with the previous button. This command also deletes the point from the measurement file. When NQView is being used as a monitoring tool, it is possible to indicate whether the points on the map are added automatically by the GPS or manually: • Drive: this mode records and displays the GPS points on the Map monitor. • Walk (Live mode only): this mode ignores the GPS information so that the user manually specifies the current position with the "Set new walk position" button. This mode is mainly for indoor mapping measurements. With this button, the NQView Map monitor can automatically center the view. The following options are available: • Auto center: this mode centres the Map monitor to the last GPS available. • Center if not visible: this mode does not move the Map monitor view until a GPS point leaves the visible map area. • Do not center: this mode disables the option to automatically follow the GPS points. To move through the map, it needs to be used the hand cursor (see above). This button allows to select whether the distance unit is represented in Kilometres (km) or Miles (miles). This button shows or hides the box where the scale for the distances is displayed on the map.

3.3.1.7. Devices monitor The Devices monitor (Figure 3-44) is a General monitor that shows information about the devices that have been used to perform the measurements. This Device monitor shows the device name (e.g. Samsung Galaxy Note 3 (SM-N9005)), GPS that has been utilized (e.g. internal), and the jobs or tests performed (e.g. Data/HTTPTransfer). Please note that this Devices monitor (i.e., part of the General monitor) is different from the pre-defined Device monitor that is presented in Section 3.3.2. To open a Device monitor, select | General | Devices in the Main toolbar menu or doubleclick in Monitors | General monitors | Devices within the Pages and Monitors panel.

Figure 3-44. Devices monitor

3.3.1.8. NQView events monitor The NQView events monitor (Figure 3-45) is a General Monitor that shows in a table format information about events that occurred during the measurements. For each of the events it shows Time, Name, Description, Device name and Unit name. To open an NQView events monitor, select | General | NQView events in the Main toolbar menu or double-click in Monitors | General monitors | NQView events within the Pages and Monitors panel.

Figure 3-45. NQView events monitor

3.3.1.9. GPS monitor The GPS monitor (Figure 3-46) shows the recorded GPS information. The reported data is synchronized with the playback time of the measurement file that is being analyzed. In particular,

this monitor displays the Longitude, Latitude, Altitude, Speed and Satellite count following a list monitor fashion. To open a GPS monitor, select | General | GPS in the Main toolbar menu or double-click in Monitors | General monitors | GPS within the Pages and Monitors panel.

Figure 3-46. GPS monitor

3.3.2. Device monitors The monitors described in Section 3.3.1 are the General monitors. General monitors are empty monitors where the user has to add the Values to be displayed. On the other hand, there are some pre-defined monitors called Device monitors. Device monitors already have some relevant Values added for a specific technology (e.g. LTE) and have a pre-defined format adapted to the added Values. The Device monitors can be accessed through the Pages and Monitors panel or by selecting | Device in the main toolbar menu. Figure 3-47 shows the Device monitors available for the following technologies: GSM, HSDPA, HSUPA and LTE.

(a)

(b)

(c)

(d)

Figure 3-47. Available Device monitors for (a) GSM, (b) HSDPA, (c) HSUPA and (d) LTE technologies.

Two examples of Device monitors associated to the LTE technology are the LTE PUSCH Throughput Line Chart (Figure 3-48.a) and LTE PUSCH Info (Figure 3-48.b). The Device monitor reported in Figure 3-48.a is based on a Line Chart monitor and the Device monitor reported in Figure 3-48.b is based on a List monitor. Although these Device monitors are predefined, it is also possible to modify them, for instance, adding new Values. To modify the Device monitor, follow the instructions shown in Section 3.3.1 depending on the General monitor that fits the displayed features of the Device monitor.

(a)

(b)

Figure 3-48. Two examples of LTE Device monitors: (a) LTE PUSCH Throughput Line Chart, and (b) LTE PUSCH Info.

To open a Device monitor (e.g. for the LTE technology), select | Device | LTE | [Device monitor type] in the Main toolbar menu or double-click in Monitors | Device Monitor | LTE | [Device monitor type] within the Pages and Monitors panel. To add a new Value to a Device monitor, simply drag and drop a network parameter compatible with a Device monitor from the Values panel. The compatible values for a Device monitor depend on the General Monitor on which it is based (see Section 3.3.1). A useful option is to take a Device Monitor as basis, and then edit it and create a customized monitor that best fits to the necessities of the network measurements that are being analyzed (see Section 3.3.3 for details on how to customize a Device monitor)

3.3.2.1. Layer 3 monitor A special type of Device monitor is the Layer 3 monitor (Figure 3-49). The Layer 3 monitor shows the Layer 3 (RRC) signaling messages captured in the loaded measurements file (left part of Figure 3-49). This monitor can decode the Layer 3 messages and show the content as a human readable text (right part of Figure 3-49).

Figure 3-49. Layer 3 monitor

With this monitor, the user can also export Layer 3 messages as text files. To do this, follow these steps: 1. Open a Layer 3 Monitor. To open a Layer 3 monitor, select | Device | Layer 3 Monitor in the Main toolbar menu or double-click in Monitors | Device monitors | Layer 3 Monitor within the Pages and Monitors panel. 2. Click on any of the Layer 3 messages listed on the left part of the Layer 3 Monitor (Figure 3-49). 3. Right-click in the Message details panel (right part of Figure 3-49) and click Export L3 messages to text file. 4. Choose the directory to save the file that includes the Layer 3 messages (Figure 3-50).

Figure 3-50. Exporting Layer 3 messages

3.3.3. Monitor title pop-up menu All monitors, including the General monitors and the Device monitors, own a common set of useful commands that are available in the monitor title pop-up menu. This pop-up menu opens with a right-click on the window title of a monitor and is shown in Figure 3-51.

Figure 3-51. Monitor title pop-up menu.

• • • • •

•

The Move to page command is used to move the monitor to another Page (see Section 3.4 for details about NQView’s pages). The Clear all content command removes all content (i.e., the displayed Values) from the monitor. The Customize monitor command allows to customize the monitor settings. The Rename monitor command allows to assign a custom name to the monitor. This is useful when you have spend significant efforts on creating your own monitor and can save it for a later use with a custom name. Following the previous example, you can save the current monitor as a Customized monitor using the Save as new monitor. The Customized monitor will include all added Values, their formats, names and settings. After using this command, the user will be able to assign a name to the new Customized monitor. The Customized monitor will appear with the assigned name in the Navigation panel within Pages and Monitors | Monitors | Customized monitors. In case more than one mobile device is used to perform the measurements, the Change value source allows to specify from what device the measurements are displayed in the monitors.

•

With the Save as Qualipoc monitor command it is possible to save the NQView monitor as a Qualipoc monitor. This command is only available for some types of monitor such as Line chart monitor or List monitor. The saved monitors are later available as customized monitors to be used at any time.

3.4. NQView pages The analysis of the performance of a cellular network is a complex task that might require displaying multiple network parameters. We have seen in Section 3.3 how to display the network parameters or Values using monitors as a line chart, bar chart, pie chart, list, table and map. Different monitors, including General monitors and Device monitors, can be grouped together in a mosaic style. This group of monitors form what NQView refers to as a page. In addition, NQView allows to have multiple pages. In each of these pages, you can group the NQView monitors as you like. The pages you create are available in the pages bar at the bottom of the workspace as shown in Figure 3-52. To add a new Page, simply right-click at any point of the pages bar and select the Add command (see Figure 3-52). Note that you can browse through the different pages by clicking on the page tab, or by pressing F1, F2, F3, etc. Once the new Page is created, you can add the monitors you like on it using the Pages and Monitors panel or from in the main toolbar. On a Page, the monitors can be organized in 2 ways: 1) manually, 2) automatically using the commands available in the Window menu (see Section 3.2.1.6 for details).

Figure 3-52. Pages bar

As an example of the possibilities to organize different monitors on a NQView Page, Figure 3-53 shows a Page that includes 2 General Monitors (a Line Chart monitor and a Bar chart monitor) and 2 Device Monitors (an LTE PUSCH Modulation Chart monitor and an LTE UL HARQ Info monitor). These monitors have been organized using the Window | Tile side-by-side command. Check-out Section 3.2.1.6 for others automatic options that can be used to organize the monitors on a Page.

Figure 3-53. Page example

3.4.1. Device pages As it is shown in Section 3.3.2 for the case of the Device monitors, NQView also provides the user with a set of pre-defined pages associated with different technologies (e.g., LTE or HSDPA). These pre-defined pages are called Device pages. A Device page contains a set of Device monitors that are carefully selected to analyze a particular procedure or mechanism (e.g. UL Data). To open a new Device page, select | Device | [Device page type] in the Main toolbar menu or double-click on Pages | Device pages | [Device page type] within the Pages and Monitors panel. Figure 3-54 shows the Device pages available in NQView.

Figure 3-54. Device pages available in NQView

Figure 3-55. Device page LTE UL Data

For example, Figure 3-55 shows the Device page LTE UL Data that includes a set of Device monitors that are useful to analyze the LTE uplink data transmissions. The displayed Device monitors show information about the LTE cell (e.g. EARFCN, bandwidth and PhyCellID), LTE Channel (band), HARQ mechanism (e.g. percentage of transmissions that required 1, 2 or 3 retransmissions), UL transport blocks (e.g. number of transport blocks, the transport block rate, min/avg/max size of the transport block), modulation (e.g. percentage of transmissions using

QPSK, 16QAM, 64QAM – note that this is reported using both a Bar chart monitor and a List monitor), PUSCH throughput (reported both using a List monitor and a Line chart monitor). The Device page can be modified based on the needs of the user to create a customized page that fits better to the required analysis. These modifications could include, for example, adding or removing monitors, adding or removing Values to the existing monitors, etc. The customized pages can also be saved to be used at a later time. Details about how to save the customized page are presented in the next section together with other available options for pages.

3.4.2. Page pop-up menu Right-clicking on any of the pages of the pages bar (Figure 3-52) opens the pop-up menu that is reported in Figure 3-56. This menu includes a set of useful commands for a Page. Note that the commands shown in Figure 3-56 apply to the page that has been right-clicked.

Figure 3-56. Page pop-up menu

• • • • • • • •

Select the Add command to add a new page. Choose the Rename command to rename the page using a custom name. The Delete command deletes the page. The Delete all monitors command is used to delete all monitors that are on the page. Note that the page will not be deleted. The Save page as template command allows to save the current page as a Customized page. The user is requested to choose a name to the Customized page. This page will be available in Navigation panel within Pages and Monitors | Pages | Customized pages. Select Lock page to selected device command to lock the current selected page to the selected device. Choose Unlock page to unlock the current selected page to the selected device. In case more than one handheld devices were used to perform the measurements, the Change value source allows to specify the device to be used to display the measurements on the monitors of the current page.

3.5. NQView events Events are used in NQView to notify the user when a configured condition is fulfilled. For example, an event can indicate that a measured Value overpasses a particular threshold, or that a dropped call has occurred. During the playback of the loaded measurements, when an event is triggered, a pop-up window appears showing information related to the event that has occurred. There is a set of pre-defined events in NQView, which are grouped in a tree-like hierarchy within the Events panel (see section 3.2.2.3). Likewise, the user can create new events from scratch (i.e.

from an empty event) or create a new one by customizing a pre-defined event in NQView. Below are shown the steps to create a new event in NQView. This example focuses a case to create a new event for the LTE technology. The purpose of this LTE event is to warn the user during the playback when the RSRP value exceeds a certain defined threshold. 1. Click to open the Events panel in the Navigation panel. 2. Right-click the event category LTE | Radio Channel, and then click Create (Figure 3-57).

Figure 3-57. Create a new event.

3. In the Event window (Figure 3-58), specify the trigger settings for the event. a. Type a Name for the event as well as the Group, Subgroup, and Result text as shown in Figure 3-58.

Figure 3-58. Event window.

b. Click the green plus sign ( ) that is next to Event 1 to open the Event definition window (Figure 3-59). c. Select Value as the Event type and RSRP in the Value list. Then specify the conditions as shown in Figure 3-59. Finally, click Save.

Figure 3-59. Event definition window.

Click the pencil icon (see Figure 3-58) and add a notification for the event in the Event notification window (Figure 3-60). i. Click the message box type that you want in the list. ii. To play a sound when the event occurs, click the green plus sign ( ), select the audio file, and then click Save.

Figure 3-60. Event notification window.

d. Finally, click Save in the Event window (Figure 3-58). Once this process to create the event is completed12, the newly created event will appear in the corresponding group and subgroup of the tree with the configured name (see Figure 3-61).

12

You can also use a predefined NQView event as a starting point to create a customized event. Right-click in some pre-defined event in the tree and click Edit event. Then you can follow the described procedure to change all or some features of the pre-defined event.

Figure 3-61. New created event.

This new event, as well as the others, can be enabled or disabled by right clicking on the event name and selecting Enable or Disable depending on the current status of the event. Figure 3-62 shows the pop-up window generated when the created event is triggered during playback.

Figure 3-62. Created event pop-up window.

4. Measurements and Analysis This chapter shows how to use the two professional tools QualiPoc and NQView to conduct measurements in real-live 4G LTE networks and how to post-process them to analyze the performance and operation of cellular radio interfaces. The measurements that are presented in this chapter have been conducted in the city of Elche (Spain) over the Orange 4G cellular network. These measurements are a representation of the laboratory activities that are conducted by the students of the Mobile Communications course at the Miguel Hernandez University of Elche (UMH). In previous courses the laboratory activities have been also based on a similar set of measurements over 3G UMTS and 3.5 HSPA networks. These laboratory activities are reported in the book “Monitoring the Performance and Operation of Cellular Radio Interfaces using Professional Measurement Tools”5.

Figure 4-1. Area of Elche where the field tests are conducted (source: https://geoportal.minetur.gob.es/VCTEL/vcne.do).

The field tests reported in this chapter are conducted in a specific area of the city of Elche. For an adequate planning of the field tests to be conducted, it is highly recommended to have a prior knowledge of the base stations that are deployed in this area. In Spain, this information is available online and facilitated by the Spanish Ministry of Economic Affairs and Digital Transformation13. Figure 4-1 shows the specific area where the field tests reported in this chapter are conducted. This is the Elche’s suburb of Altabix which is in front of the UMH’s campus. In the figure, the blue circles represent the base stations. By clicking on them, it is possible to identify the mobile network operator that has base station(s) at this location, the base station’s identifier, the supported technologies and operation frequency bands, and the measured radiated power 13

https://geoportal.minetur.gob.es/VCTEL/vcne.do

(μW/cm2) at different distances from the base station. For example, Figure 4-1 shows information for the VAL5713C base station that is located at the Avenida de la Universidad de Elche, 46. This base station is managed by Orange and it operates in 3 different bands: 925-935 MHz, 18601880MHz, 1900-2140 MHz. The measured radiated power is out of the scope of this book. Once the location of the base stations is known, it is also highly recommended to plan in advance what measurements are to be conducted and at which locations. Then, those who are not familiar with the area where the tests are conducted should first check it using online maps. The measurements are conducted using the QualiPoc tool which has to be configured to perform the required jobs. It is also very important to configure properly QualiPoc to save the measured data. Chapter 2 provides all the details that are needed to gain the sufficient training background to successfully conduct the measurements. It is also important to recall that measurements can be geo-referenced using the GPS (either the internal one or one connected via Bluetooth). Make sure the GPS is enabled, and that it is correctly receiving the GPS signal. Otherwise, the location data will not be logged. A quick guide for QualiPoc is also provided in ‘Appendix I. Quick guide to launch and use QualiPoc’. An important feature of QualiPoc is that it shows in real time the network state, including the most relevant parameters and key performance indicators of the radio interface. It can also be used to replay the saved measurements. These features allow to get a first impression on whether the measurement has been correctly conducted or it should be repeated. Even though the tests can be planned in advance, unexpected events might occur during the measurements due the actual operation of the cellular networks and the fact that some events are out of the user’s control. Therefore, it is recommended to take notes during the measurements that can help latter to better understand the analysis of the results when they are post-processed. .

BS MS

Figure 4-2. Testing environment for the analysis of the cellular signaling processes.

4.1. Analysis of cellular signaling processes This section is focused first on the analysis of the signaling messages that the mobile station and the base station exchange in the establishment, maintenance, and closure of a voice call. We should note at this point that voice calls in 4G networks are supported following two different procedures that depend on the capabilities of the mobile station and the 4G network itself. Voice calls that are supported over the LTE network are known as VoLTE (Voice over LTE). VoLTE is based on the all-IP architectural framework of LTE. Therefore, VoLTE’s voice services are delivered as data flows over the packet-switched 4G network. When VoLTE is not supported in a specific area (due to incompatibility of the mobile station or the network itself), a fallback process is initiated and the 4G voice call can connect to the 2G/3G network that is circuit-switched (CS). The mobile station that runs the QualiPoc measurement tool does not support VoLTE, so the signaling messages shown in this section correspond to the case where the voice call switches from LTE to 3G.

4.1.1. Testing environment The voice call measurements do not require a specific testing environment since the main goal is to log the signaling messages exchange between the mobile station and the base station. Anyway, the scenario shown in Figure 4-2 is chosen to perform these measurements, which is in front of the ‘Rectorado y Consejo Social’ building of the Universidad Miguel Hernandez de Elche. In this scenario, the base station (BS) that provides service to the mobile station (MS) is located in the opposite building. In this same location, the base station supports 3G and 4G services.

4.1.2. Conducting the measurements The analysis of the cellular signalling processes has been conducted using two mobile devices. One of the two devices is equipped with the QualiPoc tool and is used to log all the signalling messages. The other mobile device is used as the called or calling mobile station depending on the test. When the QualiPoc terminal is the one that performs the voice call, it has to be configured following the steps shown in Section 2.3.1 for Single Call Tests. Figure 4-3 summarizes the steps that are needed to create a new Single Call Tests. The Single Call Tests menu can be configured to indicate the duration of the voice call (in seconds). Note that in this case, the QualiPoc tool will hang up the voice call automatically and therefore the user loses the control of this process. As an alternative, the duration of the voice call can be set to 0s (i.e., infinite) and then the tests will be running until the calling or the called mobile station hangs up.

Figure 4-3. Creating a Single Call Test job.

When the QualiPoc terminal is the called mobile device, then it has to be configured using the Idle job (see Section 2.3.5). Under this job, the QualiPoc terminal does not perform any voice or data job but it logs all signalling messages. Once that QualiPoc is configured with the proper job type, the next step is to start the job. The job automatically starts when the Single Call Tests type is used. When the Idle job type is configured, QualiPoc is also automatically logging but the voice call has to be started from the other mobile station that is calling the QualiPoc terminal. When the QualiPoc terminal receives the voice call, the regular Android menu will pop up to accept the voice call. The voice call can be finished either at the side of the QualiPoc terminal or at the side of the other mobile terminal. QualiPoc will pop up a window to indicate how to save the logged measurements when the Single Call Tests job type is used. When the Idle job type is used, the user has to manually stop the job to save the logged measurements. To do so, tap ⋮ | Stop Job.

4.1.3. Analysis of the obtained results Once the QualiPoc’s logged measurements are saved in the PC where NQView is installed, use the Replay tab in NQView to load the file to be analyzed. Then, use the wizard to browse and select the desired file as it is shown in Figure 4-4. Note that QualiPoc organizes the logged measurements based on the “Unit configuration” options available in the Settings menu (see Section 2.2.8 for details).

Figure 4-4. Open a measurement file in NQView.

The rest of this section shows and analyzes the signaling involved in a voice call. These signaling messages are displayed in NQView using the Layer 3 Monitor (see an example of this monitor in Figure 4-5). As it has been indicated above, the voice call is finally performed using the 3G network since VoLTE is not supported. Then, most of the procedures and signaling involved in the voice call are those that a UMTS call establishes. However, the mobile station is initially connected to 4G (LTE) when the voice call is initiated, and then the connection needs to be switched to 3G. In 3GPP standards this process is referred to as Circuit-Switched (CS) fallback (CSFB). A detailed description of architecture and specification for the CSFB is reported in 3GPP TS 23.27210.

Figure 4-5. Layer 3 Monitor in NQView.

In what follows, this section presents the signaling messages that are exchanged between the base station and the mobile station. The following subsections show different situations where either the mobile station or the network initiate the voice call, and so for the close of the voice call. All signaling messages are logged with the QualiPoc tool and are later decoded with the NQView

post-processing software. In NQView the signaling messages are displayed using the Layer 3 Monitor that is available under Device monitors (see Section 3.3.2.1). See in in Figure 4-5 a screenshot of the Layer 3 Monitor.

4.1.4. Voice call establishment and ending 4.1.4.1. Voice call establishment: mobile originated voice call This section analyzes the signaling messages involved in a voice call when the QualiPoc terminal initiates or is the origin of the connection. Table 4-1 and Table 4-2 present the signaling messages that are exchanged between the mobile station and the network for the establishment of a user originated voice call. These signaling messages have been obtained using the Layer 3 Monitor (Figure 4-5). The table shows the time instant the message is transmitted (‘Time’), the direction of the message (‘Dir’) which shows D for downlink and U for uplink, the protocol or layer that is responsible of the message (‘Layer’), and the identification of the message (‘Info’). Message details are also available in NQView and will be shown below as the analysis progresses. Table 4-1. Signaling messages to move the call from 4G to 3G network. Time

Dir

Layer

Info

12:52:45.511 U LTE EMM Extended Service Request 12:52:45.511 U

LTE RRC RRC Connection Request

12:52:45.588 D

LTE RRC RRC Connection Setup

12:52:45.589 U

LTE RRC RRC Connection Setup Complete

12:52:45.621 D

LTE RRC RRC Connection Release

First, Table 4-1 shows the messages that the mobile station and the base station exchange over LTE. The mobile station first transmits in the uplink an Extended Service Request message to request to the network that it wants to perform a CS fallback which is necessary to establish a voice call in the 3G network. The decoded message is shown in Figure 4-6. The most important information of the decoded messages is highlighted in order to facilitate the understanding; explanations are based on the highlighted information. This message is addressed to the MME (Mobility Management Entity) at the network side. In addition to the request to perform a CS fallback, the mobile station indicates its identity to the network which at this stage is based on the TMSI. The Extended service request message is encapsulated in an RRC message in the uplink as it can be shown in Table 4-1 since they both are transmitted at the same time. Details about the RRC Connection are specified in 3GPP TS 25.331 and TS 38.331. This RRC connection is needed in order to facilitate that the Extended Service Request is conveyed or transferred to the MME. This is performed when the mobile station initiated this procedure from an RRC IDLE state (i.e., without an active connection to the LTE base station). Then, the mobile station first requests to the network the establishment of an RRC connection via the RRC Connection Request message (Figure 4-7). Note that this RRC Connection Request message is transmitted in the Common Control Channel (CCCH) in the uplink since it is part of a random-access procedure (the mobile station is in RRC IDLE state). This RRC Connection Request message also indicates that the reason for establishing this RRC connection is ‘mo_Data’ (mobile originating call) which is an encrypted way to indicate the “Extended Service Request”. This triggers the RRC Connection Setup message in the downlink and the RRC Connection Setup Complete in the uplink in order to establish the connection. Note that the RRC Connection Setup Complete message indicates that the reason for the connection establishment is to connect to the EPS mobility management (EMM) entity in order to inform about the mobile originating CS fallback that requires that the mobile

station is transferred to 3G; i.e., it has to switch off its connection to the 4G network (see Figure 4-8). Then, the network sends in the downlink the RRC Connection Release to finalize the RRC connection to the LTE network and to redirect the connection to 3G or UTRA (UMTS Terrestrial Radio Access) as it is shown in Figure 4-9. Figure 4-9 shows that the mobile station is redirected to the UTRA-FDD Absolute Radio Frequency Channel Number (ARFCN) 2959 that represents the Band 8 at 900 MHz. To keep track of the different technologies the mobile station is connected to, NQView provides a Technology history monitor that is available in Device Monitor | Network. Figure 4-10 shows that at the time instant that the RRC Connection Release is received (i.e., 12:52:45.621), the mobile starts its connection to UMTS 900. 08.09.2020 12:52:45.511 U LTE EPS LTE EMM Extended service request LTE NAS Message : Security header type : Plain NAS message, not security protected Protocol discriminator : EPS mobility management messages NAS EPS Mobility Management Message Type : Extended service request NAS Key Set Identifier : Type of security context flag (TSC): : native security context (for KSIASME) NAS Key Set Identifier : 1 Switch off : mobile originating CS fallback or 1xCS fallback mobile identity : Mobile Identity : Length : 5 Odd/Even indication : Even number of identity digits and also when the TMSI/P-TMSI is used Type of Identity : TMSI/P-TMSI Identity digits : DA92B7DD Optional Elements : (…) Figure 4-6. Part of a LTE EPS LTE EMM Extended service request message decoded in NQView. 08.09.2020 12:52:45.511 U LTE UL_CCCH_Message : message : c1 RRCConnectionRequest : Critical extensions : rrcConnectionRequest_r8 rrcConnectionRequest_r8 : Initial UE-identity : S-TMSI : MMEC Length : 8 MMEC : 40 M-TMSI Length : 32 M-TMSI : DA92B7DD Establishment cause : mo_Data

LTE RRC

RRCConnectionRequest

Figure 4-7. Part of a LTE RRC Connection Request message decoded in NQView. 08.09.2020 12:52:45.589 U LTE RRC RRCConnectionSetupComplete UL_DCCH_Message : Message : c1 rrcConnectionSetupComplete : RRC transaction identifier : 1 Critical extensions : c1 rrcConnectionSetupComplete_r8 : selectedPLMN_Identity : 1 registeredMME : [Optional] : ABSENT dedicatedInfoNAS : DedicatedInfoNAS Length : 152 DedicatedInfoNAS DATA : 17FF60D40235074C1005F4DA92B7DD57022000 Decoded : LTE NAS Message :

Security header type : Integrity protected Protocol discriminator : EPS mobility management messages Message authentication code : FF60D402 Sequence number : 53 Security header type : Plain NAS message, not security protected Protocol discriminator : EPS mobility management messages NAS EPS Mobility Management Message Type : Extended service request NAS Key Set Identifier : Type of security context flag (TSC): : native security context (for KSIASME) NAS Key Set Identifier : 1 Switch off : mobile originating CS fallback or 1xCS fallback mobile identity : Mobile Identity : Length : 5 Odd/Even indication : Even number of identity digits and also when the TMSI/P-TMSI is used Type of Identity : TMSI/P-TMSI Identity digits : DA92B7DD Optional Elements : (…) Figure 4-8. Part of a LTE RRC Connection Setup Complete message decoded in NQView. 08.09.2020 12:52:45.621 D LTE DL_DCCH_Message : Message : c1 RRCConnectionRelease : RRC transaction identifier : 0 Critical extensions : c1 rrcConnectionRelease_r8 : releaseCause : other redirectedCarrierInfo : utra_FDD utra_FDD : 2959 (…)

LTE RRC

RRCConnectionRelease

Figure 4-9. Part of a LTE RRC Connection Relese message decoded in NQView.

Figure 4-10. Technology history monitor.

Once the mobile station has been redirected to UMTS, the connection establishment follows the 3G procedure that the authors described in their previous laboratory book for 3G5. For completeness, this book also describes the signaling process followed in 3G to establish the connection when the mobile station is originating the voice call. Table 4-2 list the messages that are exchanged between the mobile station and the network in this case. Table 4-2. Signaling messages establish the voice call in the 3G network. Time

Dir Layer

Info

12:52:46.001 U

RRC

RRC Connection Request

12:52:46.195 D

RRC

RRC Connection Setup

12:52:46.258 U

MM

CM Service Request

12:52:46.258 U

RRC

RRC Connection Setup Complete

12:52:46.258 U

RRC

Initial Direct Transfer

12:52:46:259 U

GMM Routing Area Update Request

12:52:46:259 U

RRC

Initial Direct Transfer

12:52:46.569 D

RRC

Security Mode Command

12:52:46.569 U

RRC

Security Mode Complete

12:52:46.649 U

CC

Setup

12:52:46.649 U

RRC

Uplink Direct Transfer

12:52:46.688 D

MM

Identity Request

12:52:46.688 U

MM

Identity Response

12:52:46.688 D

RRC

Downlink Direct Transfer

12:52:46.688 U

RRC

Uplink Direct Transfer

12:52:46.891 D

CC

Call Proceeding

12:52:46.891 D

RRC

Downlink Direct Transfer

12:52:47.203 D

RRC

Radio Bearer Setup

12:52:47.301 U

RRC

Radio Bearer Setup Complete

12:52:48.090 D

CC

Alerting

12:52:47.717 D

RRC

Downlink Direct Transfer

12:52:47.817 U

GMM Routing Area Update Complete

12:52:47.817 U

RRC

Uplink Direct Transfer

12:52:48.090 D

CC

Connect

12:52:48.090 U

CC

Connect Acknowledgement

12:52:48.090 D

RRC

Downlink Direct Transfer

12:52:48.090 U

RRC

Uplink Direct Transfer

Before the mobile station can connect with the 3G network in order to initiate the voice call, it has to first establish an RRC connection with this network. This is a similar process than the one shown above for LTE that includes the RRC Connection Request, RRC Connection Setup, and RRC Connection Setup Complete messages. Details about the RRC Connection are specified in 3GPP TS 25.331. Part of the RRC Connection Request message that is decoded with NQView is shown in Figure 4-11. The decoded information shows the RRC Connection Request is transmitted over an CCCH (Common Control Channel) in the uplink which is mapped to Random Access Channel (RACH) since the mobile station has not yet dedicated channels to communicate with the network. The RRC Connection Request also shows the Location Area Information (LAI) such as the Mobile Country Code (MCC) that is 214 for Spain, and the Mobile Network Code (MNC) that is 03 for Orange. This RRC Connection Request also indicates that the mobile station is identified with a different TMSI in 3G (i.e., 263E8AC3, see Figure 4-11) than in 4G (i.e., DA92B7DD, see Figure 4-6 - Figure 4-8), and that the reason to setup the RRC connection is that the mobile station is originating a speech conversational call. There may be other reasons why an RRC connection is established including: originating streaming call, originating interactive call, originating background call, terminating conversational call, terminating streaming call,

terminating interactive call, terminating background call, emergency call, high priority signalling, low priority signalling, call re-establishment, etc. 08.09.2020 12:52:46.001 U WCDMA RRC UL_CCCH_Message : Integrity check info [Optional] : ABSENT message : rrcConnectionRequest RRCConnectionRequest : initialUE_Identity : tmsi_and_LAI tmsi_and_LAI : tmsi Length : 32 tmsi DATA : 263E8AC3 lai : MCC MNC : mcc : MCC : 2 MCC : 1 MCC : 4 mnc : MNC : 0 MNC : 3 lac Length : 16 lac DATA : 46BC LAC : 18108 Establishment cause : originatingConversationalCall protocolErrorIndicator : noError (…) domainIndicator : cs_domain cs_domain : csCallType : speech (…)

RRC

RRCConnectionRequest

Figure 4-11. Part of a RRC Connection Request message decoded in NQView.

Once the RRC Connection Request message is received by the network (in particular the RNC), and depending on the request reason, the mobile station is configured with common or dedicated resources to perform its request. This is indicated in the RRC Connection Setup message that is addressed to the mobile station using an CCCH channel (in this case FACH in downlink). As it is shown in Figure 4-12, the RRC Connection Setup message is addressed to the mobile station that is recognized using the TMSI (i.e., 263E8AC3) and it indicates that the transactions will follow in a cell_DCH state. This means the mobile station location is known at cell level while a dedicated channel is used to communicate with the network. There is also information about the capabilities of the mobile station or UE, including the support for FDD and that it is not required the support TDD. Specific information about the RLC’s transfer mode is also given, and it shows that in the uplink the Un-acknowledge mode (UM) is used (this is for particular channels while others might use Acknowledge Mode (AM)). Information related to logical channels mapping to transport channels is also reported, as well as scrambling code and spreading factor that the cell is using in the downlink and in the uplink. As shown in Figure 4-12, the spreading factor in this case was set to 128 and 64 in the downlink and uplink directions, respectively. The scrambling code was set to 8623617 and 438 in the uplink and downlink directions, respectively. The identity of the cell is also reported. Note that the RNC could also reply to the RRC Connection Request message with RRC Connection Reject message to the mobile terminal when the requested RRC connection cannot be accepted. This message would include the rejection cause (congestion or unspecified) and redirection information to another carrier or to another system. 08.09.2020 12:52:46.195 D DL_CCCH_Message : Message : rrcConnectionSetup

WCDMA RRC

RRC

RRCConnectionSetup

RRCConnectionSetup : later_than_r3 later_than_r3 : initialUE_Identity : tmsi_and_LAI tmsi_and_LAI : tmsi Length : 32 tmsi DATA : 263E8AC3 (...) RRC transaction identifier : 0 (...) rrc_StateIndicator : cell_DCH (...) capabilityUpdateRequirement : [Optional] : ue_RadioCapabilityFDDUpdateRequirement_FDD : TRUE ue_RadioCapabilityTDDUpdateRequirement_TDD384 : FALSE (...) ul_RLC_Mode : ul_UM_RLC_Mode (...) ul_LogicalChannelMappings : oneLogicalChannel [Optional] : oneLogicalChannel : ul_TrCH_Type : dch_rach_usch dch_rach_usch : ul_TransportChannelType : dch dch : 32 (...) dl_LogicalChannelMappingList : 1 [Optional] : [0] dl_LogicalChannelMappingList : element : dl_TransportChannelType : fach (...) ul_DPCH_Info : [Optional] : PRESENT Mode specific information : fdd [Optional] : FDD : scramblingCodeType : longSC scramblingCode : 8623617 spreadingFactor : sf64 (...) dl_InformationPerRL_List : 1 [Optional] : PRESENT [0] dl_InformationPerRL_List : element : Mode specific information : fdd FDD : Primary CPICH info : Primary scrambling code : 438 (...) dl_DPCH_InfoPerRL : fdd fdd : (...) dl_ChannelisationCodeList : 1 (...) sf_AndCodeNumber : sfd128 sfd128 : 32 (...) modeSpecificInfo2 : fdd (...) cell_id Length : 28 cell_id DATA : CE67D5B (...) Figure 4-12. Part of an RRC Connection Setup message decoded in NQView.

The mobile station then completes the RRC connection setup with the RRC Connection Setup Complete message that reports the capabilities of the mobile station (see Figure 4-14): RLC, transport channel, physical channel, multi-Mode multi-RAT or positioning. This message encapsulates the CM Service Request message (3GPP TS 24.008) where the mobile station indicates the service type it is requesting. Since the mobile station has originated the voice call, this first L3 message that reports about the voice call is in the uplink. This message is addressed to the Connection Management (CM) sublayer entity. Some of the main fields included in the CM Service Request message are: • Message Type, i.e., CM SERVICE REQUEST, encoded in hex as type 24. • CM Service Type identifying the requested type of connection (e.g., mobile originating call establishment, emergency call establishment, short message service, supplementary service activation, location services). In this case, the CM service type is hex 1, i.e., a mobile originating call establishment or packet mode connection establishment. • Ciphering Key Sequence Number, which is an information element used by the network to identify the ciphering key which is stored in the mobile station without invoking the authentication procedure. • The Mobile Station Classmark, which provides the network with information concerning aspects of both high and low priority of the mobile station equipment. In particular, it includes parameters such as the RF power capability of the terminal, GSM capability, encryption algorithms available, etc. • The Mobile Identity (TMSI, temporal mobile subscriber identity). 08.09.2020 12:52:46.258 U GSM MM CM Service Request Protocol Discriminator : MM Skip Indicator : 0 Message Type : 24 CM SERVICE REQUEST Ciphering key sequence number Ciphering Key Sequence Number : Possible values for the ciphering key 0 (0) CM service type Service type : Mobile originating call establishment or packet mode connection establishment (1) Mobile station classmark Length : 3 Revision level : Used by mobile stations supporting R99 or later versions of the protocol (2) ES Indication : 'Controlled Early Classmark Sending' option is implemented in the MS (1) A5/1 : Encryption algorithm A5/1 available (0) RF power capability : RF Power capability is irrelevant in this IE (7) PS capability : PS capability present (1) SS Screen Indicator : Capability of handling of ellipsis notation and phase 2 error handling (1) SM capability : Mobile station supports mobile terminated point to point SMS (1) (…) SoLSA : The ME does not support SoLSA (0) CMSP : 'Network initiated MO CM connection request' supported for at least one CM protocol (1) A5/3 : Encryption algorithm A5/3 available (1) A5/2 : Encryption algorithm A5/2 not available (0) Mobile identity Length : 5 Odd/Even indication : Even number of identity digits and also when the TMSI/P-TMSI is used Type of Identity : TMSI/P-TMSI Identity digits : 263E8AC3

Figure 4-13. Part of a CM Service Request message decoded in Nemo Outdoor.

08.09.2020 12:52:46.258 U WCDMA RRC RRC RRCConnectionSetupComplete UL_DCCH_Message : Message : rrcConnectionSetupComplete rlc_Capability : (…) transportChannelCapability : (…) physicalChannelCapability : (…) ue_MultiModeRAT_Capability : multiRAT_CapabilityList : supportOfGSM : TRUE supportOfMulticarrier : FALSE multiModeCapability : fdd securityCapability : cipheringAlgorithmCap : [uea1, uea0] integrityProtectionAlgorithmCap : [uia1] ue_positioning_Capability : standaloneLocMethodsSupported : TRUE ue_BasedOTDOA_Supported : FALSE networkAssistedGPS_Supported : noNetworkAssistedGPS supportForUE_GPS_TimingOfCellFrames : FALSE supportForIPDL : FALSE measurementCapability : [Optional] : ABSENT ue_RATSpecificCapability : 1 [Optional] : PRESENT (…) Figure 4-14. Part of an RRC Connection Setup Complete message decoded in NQView.

The RRC Connection Setup Complete message also encapsulates the Initial Direct Transfer message that is part of the Connection Reasoning process. The Initial Direct Transfer message is addressed to the RNC which adds some additional information and forwards it to appropriate core network domain (in this case the Circuit Switched domain; alternative is the Packet Switched domain). As it is shown in Figure 4-15, this message includes in its payload the CM Service Request that has been described above, and it also includes information about the mobile terminal identity. The network uses this information to decide how to proceed with the connection request. 08.09.2020 12:52:46.258 U WCDMA RRC RRC UL_DCCH_Message : Message : initialDirectTransfer CN Domain Identity : CS Domain intraDomainNasNodeSelector : version : release99 release99 : CN Type : gsm_Map_IDNNS gsm_Map_IDNNS : routingbasis : localPTMSI localPTMSI : routingparameter Length : 10 routingparameter DATA : 0FA nas_Message Length : 112 nas_Message DATA : 0524010357588605F4263E8AC3C2

InitialDirectTransfer

Decoded : GSM : Protocol Discriminator : MM Skip Indicator : 0 Message Type : 24 CM SERVICE REQUEST : Ciphering key sequence number : Ciphering Key Sequence Number : Possible values for the ciphering key 0 CM service type : Service type : Mobile originating call establishment or packet mode connection establishment Mobile station classmark : (…) Mobile identity : Length : 5 Odd/Even indication : Even number of identity digits and also when the TMSI/P-TMSI is used Type of Identity : TMSI/P-TMSI Identity digits : 263E8AC3 (…) v3a0NonCriticalExtensions : [Optional] : initialDirectTransfer_v3a0ext : start_Value Length : 20 start_Value DATA : 00038 [Optional] : Figure 4-15. Initial Direct Transfer message decoded in NQView.

If the location area information that has received the mobile station when it has been redirected to 3G is different than the one stored in the mobile station, the mobile station initiates a location area update request that is done with the Routing Area Update Request message. The mobile station reports in this message to the Mobility Management entity the message‘old Location Area Code (LAC)’ and Routing Area Code (RAC). Since the TMSI is related to the location area and this is going to be updated, the mobile station also updates the TMSI. The Routing Area Update Request Message is encapsulated in another Initial Direct Transfer message in the uplink. 08.09.2020 12:52:46.259 U GMM/SM Protocol Discriminator : GPRS MM Skip Indicator : 0 Message Type : 08 ROUTING AREA UPDATE REQUEST Update type Follow on request : No follow-on request pending (0) Update type : Combined RA/LA updating (1) (…) Old routing area identification MCC/MNC MCC : 214 MNC : 03 LAC : 32768 RAC : 64 MS Radio Access capability (…) Old P-TMSI signature P-TMSI signature value Length : 24 P-TMSI signature value DATA : 92C5A4

GMM

Routing area update request

Requested READY timer value Unit : Value is incremented in multiples of 2 seconds (0) Timer value : 5 P-TMSI Mobile Identity Length : 5 Odd/Even indication : Even number of identity digits and also when the TMSI/P-TMSI is used Type of Identity : TMSI/P-TMSI Identity digits : DA40B7DD MS network capability (…) UE Network Capability (…) Figure 4-16. Part of a Route Area Update Request message decoded in NQView.

The reception of the Initial Direct Transferer message at the network side triggers the execution of the Authentication and Security process. This is initiated with the generation of the Security Mode Command message that is transmitted in the DL in the DCCH channel. The Security Mode Command message is generated at the core network and is addressed towards the RNC that forwards it to the mobile station. With this message, the network is indicating to the mobile station what ciphering and/or integrity protection parameters it has to use. To this aim, the network takes into account the capabilities of the mobile station (e.g., classmark) that it reported in the RRC connection establishment. In particular, one of the reported capabilities by the mobile station to the network are the security algorithms it supports. Then, the Security Mode Command message includes the selected security algorithm to be used and delivers the integrity and encryption keys. 08.09.2020 12:52:46.569 D WCDMA RRC RRC DL_DCCH_Message : Integrity check info : [Optional] : PRESENT Message authentication code Length : 32 Message authentication code : [A6C5F426h] A6C5F426 RRC Message sequence number : [1d] 1 Message : securityModeCommand securityModeCommand : r3 RRC transaction identifier : 2 securityCapability : cipheringAlgorithmCap : [uea1, uea0] integrityProtectionAlgorithmCap : [uia1] cipheringModeInfo : cipheringModeCommand : startRestart startRestart : uea1 (…) rb_DL_CiphActivationTimeInfo : 4 [0] rb_DL_CiphActivationTimeInfo : (…) integrityProtectionModeInfo : integrityProtectionModeCommand : startIntegrityProtection startIntegrityProtection : integrityProtInitNumber Length : 32 integrityProtInitNumber DATA : C6850550 integrityProtectionAlgorithm : uia1 CN Domain Identity : CS Domain

SecurityModeCommand

[0] ue_SystemSpecificSecurityCap : element : gsm gsmSecurityCapability : [a5_3, a5_1] Figure 4-17. Part of a Security Mode Command Message decoded in NQView.

When the mobile station receives the Security Mode Command message, it checks whether it can enable the integrity protection and encryption algorithms that the network requests. If this is the case, it replies in the uplink with the Security Mode Command Complete message. This message confirms, for instance, the activation time info or time (measured in terms of RLC sequence number) when a particular configuration or algorithm shall be activated. This is reported for a set of active radio bearers (RB). As it is shown in Figure 4-18, the ciphering of the radio bearer with identity 1 would be activated in the next RLC sequence number, the activation of the RB with identify 2 would start in 13 sequence numbers, etc. From now on the communication between the mobile station and the network is considered to be protected by this security and ciphering algorithms. 08.09.2020 12:52:46.569 U WCDMA RRC UL_DCCH_Message : Integrity check info : [Optional] : PRESENT Message authentication code Length : 32 Message authentication code : [92854D2Dh] 92854D2D RRC Message sequence number : [1d] 1 Message : securityModeComplete securityModeComplete : RRC transaction identifier : 2 ul_IntegProtActivationInfo : (…) rb_UL_CiphActivationTimeInfo : 4 [0] rb_UL_CiphActivationTimeInfo : RB Identity : [1d] 1 rlc_SequenceNumber : 0 [1] rb_UL_CiphActivationTimeInfo : RB Identity : [2d] 2 rlc_SequenceNumber : 13 [2] rb_UL_CiphActivationTimeInfo : (…)

RRC

SecurityModeComplete

Figure 4-18. Security Mode Command Complete Message decoded in NQView.

When the security process is completed, the mobile station initiates what is call the Connection Setup and Radio Access Bearer Allocation. This process begins with the Setup message that is transmitted by the mobile station and that is encapsulated in an Uplink Direct Transfer message. The Setup message initiates the mobile originating call establishment, and includes information related to: • Transaction Identifier (TI): this information element differentiates calls from each other. Each call has its own TI value. • Bearer capability: this information element describes the bearer service required, including the radio channel direction (Dual rate support MS/full rate preferred in Figure 4-19), coding standard (GSM standardized coding in Figure 4-19), transfer mode (circuit mode in Figure 4-19) and information transfer capability (speech in Figure 4-19), and additional information not included in the figure such as the acceptable channel coding formats, or the maximum number of traffic channels. • Called Party BCD Number: this information element corresponds to the destination phone number of the voice call (1234567 in Figure 4-19).

• CC capabilities (Call Control capabilities): this information element identifies the call control capabilities of the mobile station, and indicates if the mobile station supports DTMF (Dual-Tone Multi-Frequency signaling), PCP (Prolonged Clearing Procedure), and the maximum number of supported bearers and speech bearers. • Supported Codecs: this information element is included in speech calls and lists the supported codecs (UMTS AMR, UMTS AMR 2 and UMTS AMR-WB in Figure 4-19). 08.09.2020 12:52:46.649 U GSM CC Setup Protocol Discriminator : CC Transaction Identifier : Sent from TI originator, ID=0 Message Type : 05 SETUP Bearer capability 1 Bearer capability Length : 6 Radio Channel Requirement : Dual rate support MS/full rate preferred Coding Standard : GSM standardized coding Transfer mode : Circuit mode Information transfer capability : Speech Coding : Octet used for extension of information transfer capability CTM : CTM text telephony is not supported (...) Called party BCD number Called party BCD number Length : 6 Type of number : Unknown Number plan identification : ISDN/telephony numbering plan (Rec. E.164/E.163) Number : 1234567 CC capabilities Length : 2 Max nr of supported bearers : 0 PCP : The mobile station does not support the Prolonged Clearing Procedure (0) DTMF : The mobile station supports DTMF (1) Max nr of speech bearers : 0 Supported codec list Supported codec list Length : 2 CodecList CodecList [0] SysID : UMTS (4) Length of codec bitmap : 2 Codec [0] : UMTS Adaptive Multi-Rate WideBand Codec [1] : UMTS Adaptive Multi-Rate 2 Codec [2] : UMTS Adaptive Multi-Rate CodecList [1] SysID : GSM (0) Length of codec bitmap : 2 Codec [0] : Half Rate Adaptive Multi-Rate Codec [1] : Full Rate Adaptive Multi-Rate Codec [2] : GSM Enhanced Full Rate (12.2 kBit/s) Codec [3] : GSM Half Rate (5.6 kBit/s) Codec [4] : GSM Full Rate (13.0 kBit/s) Figure 4-19. Setup layer 3 message decoded in Nemo Outdoor.

The network initiates then the identification procedure by issuing the Identity Request message which is encapsulated in the Downlink Direct Transfer message. The Identity Request message is used by the network to request the mobile station a specific identify (other than the TMSI). In particular, Figure 4-20 shows that the identity that the network is requesting to the mobile station is the IMEISV that is the IMEI (International Mobile Equipment Identity) and the software

version number of the terminal. The mobile station replies to this message with the Identify Response message in the uplink that is encapsulated in an Uplink Direct Transfer message. The reported Identify Response message, shown in Figure 4-21, indicates the IMEISV to the network (i.e., 3528280636690001). With this message ends the identification procedure. It should be noted that when this procedure is initiated by the network, a timer (T3270) is started and if the procedure is not completed before the timer is consumed then the procedure would fail. A possible reason for that is that the mobile station is using a not valid SIM. 08.09.2020 12:52:46.688 Protocol Discriminator : MM Skip Indicator : 0 Message Type : 18 IDENTITY REQUEST Spare half octet Identity type Length : IMEISV (3)

D

GSM

MM

Identity Request

Figure 4-20. Identity Request message decoded in NQView. 08.09.2020 12:52:46.688 U GSM MM Identity Response Protocol Discriminator : MM Skip Indicator : 0 Message Type : 19 IDENTITY RESPONSE Mobile identity Length : 9 Odd/Even indication : Even number of identity digits and also when the TMSI/P-TMSI is used Type of Identity : IMEISV Identity digits : 3528280636690001 Figure 4-21. Idendity Response layer 3 message decoded in NQView.

At this point in time, the network has configured what is needed at the side of the mobile station that has originated the voice call and has checked that the mobile station is allowed to perform the requested operation (i.e., voice call). Then, the network starts this process with the destination terminal and informs about this to the mobile station that originated the voice call with the Call Proceeding message (see Figure 4-22) which is encapsulated in a downlink direct transfer message. LAYER 3 08.09.2020 12:52:46.891 D GSM CC Protocol Discriminator : CC Transaction Identifier : Sent to TI originator, ID=0 Message Type : 02 CALL PROCEEDING Facility Facility Information Facility content length : 16 Invoke Invoke ID : 1 Choice : NotifySS Ss_Code : 40 Ss_Status : 7

Call Proceeding

Figure 4-22. Call Proceeding layer 3 message decoded in NQView

The Radio Bearer Allocation process follows with the Radio Bearer Setup message in the downlink. This message is sent by the network to the mobile station to indicate the radio access bearer allocated for the transmission. Additionally, it can include modifications to the

configurations of transport channels and/or physical channels. When the mobile terminal receives this message, it is able to combine the information it originally sent to the network in the Setup message with the received radio bearer identifier. After this, the mobile terminal can route the user data traffic to the correct radio bearer. Some of the most significant information elements included in the Radio Bearer Setup message are (Figure 4-23): • RRC State Indicator: this element indicates to a mobile terminal the RRC state to be entered. In this case, it indicates to enter in the cell-DCH state. Other options available are cell-FACH, cell-PCH and URA-PCH. • Transport Channel Type/Identity: this information includes parameters related to the transport format set, coding type, CRC size, etc. for uplink and downlink transmissions. • Uplink/downlink DPCH Information: this is information related to the scrambling codes to be used (6241659 in uplink in the example of Figure 4-23), and the spreading factor (64/128 in uplink/downlink as shown in Figure 4-23), among others. 08.09.2020 12:52:47.203 D WCDMA RRC RRC DL_DCCH_Message : Integrity check info : Message authentication code Length : 32 Message authentication code : [EF5BFDD7h] EF5BFDD7 RRC Message sequence number : [4d] 4 Message : radioBearerSetup radioBearerSetup : later_than_r3 later_than_r3 : RRC transaction identifier : 2 radioBearerSetup_r8 : rrc_StateIndicator : cell_DCH utran_DRX_CycleLengthCoeff : drx_CycleLengthCoefficient : 6 (…) rab_InformationSetupList : 1 [0] rab_InformationSetupList : rb_InformationReconfigList : 3 (…) [0] ul_AddReconfTransChInfoList : dedicatedTransChTFS : tti : tti40 tti40 : 1 [0] tti40 : element : rlc_Size : octetModeType1 octetModeType1 : sizeType1 sizeType1 : 16 numberOfTbSizeList : 2 [0] numberOfTbSizeList : element : zero [1] numberOfTbSizeList : element : one logicalChannelList : allSizes semistaticTF_Information : channelCodingType : convolutional

RadioBearerSetup

convolutional : third rateMatchingAttribute : 180 crc_Size : crc16 (…) Maximum allowed UL TX power : [24d] 24 dBm [Optional] : PRESENT ul_DPCH_Info : ul_DPCH_PowerControlInfo : Mode specific information : fdd FDD : scramblingCodeType : longSC scramblingCode : 6241659 dpdchPresence : present present : numberOfDPDCH : 1 spreadingFactor : sf64 tfci_Existence : TRUE (…) puncturingLimit : pl0_96 (…) dl_InformationPerRL_List : 2 [0] dl_InformationPerRL_List : element : Mode specific information : fdd FDD : Primary CPICH info : Primary scrambling code : 438 servingHSDSCH_RL_indicator : FALSE servingEDCH_RL_indicator : FALSE dl_dpchInfo : dl_DPCH_InfoPerRL dl_DPCH_InfoPerRL : fdd fdd : pCPICH_UsageForChannelEst : mayBeUsed dpch_FrameOffset : [76d] 19456 dl_ChannelisationCodeList : 1 [0] dl_ChannelisationCodeList : element : sf_AndCodeNumber : sfd128 sfd128 : 44 (…) [1] dl_InformationPerRL_List : element : Mode specific information : fdd FDD : Primary CPICH info : Primary scrambling code : 206 servingHSDSCH_RL_indicator : FALSE servingEDCH_RL_indicator : FALSE dl_dpchInfo : dl_DPCH_InfoPerRL dl_DPCH_InfoPerRL : fdd fdd : pCPICH_UsageForChannelEst : mayBeUsed dpch_FrameOffset : [77d] 19712

dl_ChannelisationCodeList : 1 [0] dl_ChannelisationCodeList : element : sf_AndCodeNumber : sfd128 sfd128 : 30 (…) Figure 4-23. Part of a Radio Bearer Setup message decoded in NQView.

The radio bearer establishment is confirmed by the mobile station by sending the Radio Bearer Setup Complete message in the uplink through the DCCH (Figure 4-24). 08.09.2020 12:52:47.301 U WCDMA RRC RRC UL_DCCH_Message : Integrity check info : Message authentication code Length : 32 Message authentication code : [EED13C0Ch] EED13C0C RRC Message sequence number : [4d] 4 Message : radioBearerSetupComplete radioBearerSetupComplete : RRC transaction identifier : 2 ul_IntegProtActivationInfo : ul_TimingAdvance : ABSENT start_Value Length : 20 start_Value DATA : 0003A count_C_ActivationTime : 32 (…)

RadioBearerSetupComplete

Figure 4-24. Radio Bearer Setup Complete message decoded in NQView.

As it is described in Section 4.1.4.2, the network and the destination mobile station follows a similar process to establish the communication (i.e., RRC connection setup, authentication and security and connection setup and radio access bearer allocation). Once the network has also completed the establishment of the communication with the destination mobile station, the network transmits in the downlink the Alerting message (Figure 4-25) to the mobile station that has originated the call to inform it that the destination terminal is ringing. The Alerting message is part of the Call Control (CC) protocol. Looking at the time stamps of the logged messages it is possible to see that it took to the network less than a second to contact the destination mobile station and establish the communication. This Alerting message is also encapsulated in a DownlinkDirectTransfer message. 08.09.2020 12:52:48.090 D GSM CC Alerting Protocol Discriminator : CC Transaction Identifier : Sent to TI originator, ID=0 Message Type : 01 ALERTING Facility Facility Information Facility content length : 15 Invoke Invoke ID : 1 Choice : NotifySS Ss_Code : 65 CallIsWaiting_Indicator Progress indicator Length : 2 Coding standard : Standard defined for the GSM PLMNS (3) Location : Public network serving the local user (2)

Progress description Progress description : In-band information or appropriate pattern now available Figure 4-25. Alerting layer 3 message decoded in NQView.

If we consider that at some point in time the called mobile station accepts the call, the network will inform about this using the Connect message in the downlink (3GPP TS 24.008) (Figure 4-26). The mobile station that originated the voice call transmits in the uplink the Connect Acknowledge message to acknowledge the offered connection (Figure 4-27). These Call Control protocol messages are also encapsulated in Downlink and Uplink Direct Transfer messages, respectively. The communication between the two mobile stations take place after the Connect Acknowledge message is correctly received by the network. NQView does not show the voice data messages that are exchanged between the two devices and only the signaling information that is exchanged to support the call is logged. 08.09.2020 12:52:48.090 D GSM CC Connect Protocol Discriminator : CC Transaction Identifier : Sent to TI originator, ID=0 Message Type : 07 CONNECT Progress indicator Length : 2 Coding standard : Standard defined for the GSM PLMNS (3) Location : Public network serving the local user (2) Progress description Progress description : Queueing Figure 4-26. Connect layer 3 message decoded in NQView. 26.07.2001 15:43:55.429 U GSM CC Protocol Discriminator : CC Transaction Identifier : Sent from TI originator, ID=0 Message Type : 0F CONNECT ACKNOWLEDGE

Connect Acknowledge

Figure 4-27. Connect Acknowledge layer 3 message decoded in NQView.

4.1.4.2. Voice call establishment: network originated voice call This section shows the signaling messages that are exchanged between the network and the QualiPoc terminal when the voice call is initiated by the network (i.e., the QualiPoc terminal is the receiver of the voice call). This is also referred to as mobile terminating call. The procedure in this case is very similar to the one analyzed in the previous subsection. The main difference is that a paging procedure is needed to identify where the QualiPoc terminal is located (in what cell) and to inform it that the network is requesting this service. After that, the signaling messages exchanged between the network and the mobile station follows the analysis shown in Section 4.1.4.1. Table 4-3 lists a subset of the messages exchanged between the network and the QualiPoc terminal during this test. As it was shown in the previous subsection, these messages are displayed in NQView using the Layer 3 Monitor that is available under Device monitors (see Section 3.3.2.1). The first part of the messages shown in Table 4-3 correspond to the paging procedure. These messages are analysed in more detail below. After the paging response message at 08:18:27.314, the exchanged messages are the same as those shown when the QualiPoc terminal initiates the voice call. However, note that some of these messages are now transmitted in the opposite direction. This is the case of the Alerting, Connect and Connect Acknowledge messages. This is also the case of the Setup message that in this test is transmitted in the downlink and that shows the number of the phone that is calling the QualiPoc terminal.

Table 4-3. Signaling messages for the establishment of a network originated voice call. Time

Dir

Layer

Info

08:18:14.103 D

LTE RRC

Paging

08:18:14.349 D

LTE RRC

Paging

…

…

…

08:18:26.532 D

LTE RRC

Paging

08:18:26.532 U

LTE EMM Extended service request

08:18:26.532 U

LTE RRC

RRC Connection Request

08:18:26.624 D

LTE RRC

RRC Connection Setup

08:18:26.627 U

LTE RRC

RRC Connection Setup Complete

08:18:26.661 D

LTE RRC

RRC Connection Release

08:18:26.989 D

RRC

PagingType1

08:18:27.047 U

RRC

RRC Connection Request

08:18:27.256 D

RRC

RRC Connection Setup

08:18:27.314 U

RR

Paging Response

08:18:27.314 U

GMM

Routing area update request

08:18:27.314 U

RRC

RRC Connection Setup Complete

08:18:27.314 U

RRC

Initial Direct Transfer

08:18:27.721 D

MM

Authentication Request

08:18:27.721 D

RRC

Downlink Direct Transfer

08:18:27.887 U

MM

Authentication Response

08:18:27.887 U

RRC

Uplink Direct Transfer

08:18:28.124 D

RRC

Security Mode Command

08:18:28.124 U

RRC

Security Mode Complete

08:18:28.254 D

RRC

Identity Request

08:18:28.254 U

RRC

Identity Response

08:18:28.344 D

CC

Setup

08:18:28.344 U

CC

Call Confirmed

08:18:28.344 U

CC

Alerting

…

…

…

08:18:34.360 U

CC

Connect

08:18:34.360 U

RRC

Uplink Direct Transfer

08:18:34.630 D

CC

Connect Acknowledge

08:18:34.630 D

RRCC

Downlink Direct Transfer

…

…

When the voice service is initiated at the network side, the paging procedure is utilized to reach the mobile station this connection is addressed to. Figure 4-28, Figure 4-29, and Figure 4-30 show three different examples of the paging messages that are transmitted by the network in the downlink as part of the paging procedure. These messages are transmitted using the Paging Control Channel (PCCH) and are transmitted in the location area at which the addressed mobile station has last reported its location. In these three paging messages it is included the temporal identification of the mobile station (M-TMSI) and the type of connection that the network is requesting for the mobile station (packet switched -ps- or circuit switched -cs). Note that these three paging messages have been received by the QualiPoc terminal, although it will only reply to the one that includes its M-TMSI. In this case, this happens for the M-TMSI included in Figure 4-30 (i.e., EB49B5CC). Figure 4-30 also shows that in this case the requested connection is a voice call or circuit switched connection. 26.04.2021 08:18:04.766 PCCH_Message : message : c1 paging : pagingRecordList : 1 [0] pagingRecordList : element : Initial UE-identity : S-TMSI : MMEC Length : 8 MMEC : 30 M-TMSI Length : 32 M-TMSI : CB203466 cn_Domain : ps

D

LTE

LTE RRC

Paging

Figure 4-28. Example 1 of Paging message decoded in NQView. 26.04.2021 08:18:14.998 PCCH_Message : message : c1 paging : (…) M-TMSI : EB49B5CC cn_Domain : cs

D

LTE

LTE RRC

Paging

Figure 4-29. Example 2 of Paging message decoded in NQView. 26.04.2021 08:18:26.532 PCCH_Message : message : c1 paging : pagingRecordList : 1 [0] pagingRecordList : element : Initial UE-identity : S-TMSI : MMEC Length : 8 MMEC : 30 M-TMSI Length : 32 M-TMSI : E6EBB77C cn_Domain : cs

D

LTE

LTE RRC

Paging

Figure 4-30. Example 3 of Paging message decoded in NQView.

Once the mobile station has identified that one of the received paging messages is addressed to its P-TIMSI, it starts the process to establish the connection. As it has been shown in Section 4.1.4.1, the mobile station does not support voice calls over LTE, so it has to first switch to 3G to

continue with the signaling processes that is needed to establish the voice call. Then, the mobile station sends in the uplink the Extended Service Request message that is needed to perform the CS fallback. Note that the identifier (P-TIMSI) included in the Extended Service Request message by the mobile station matches the M-TIMSI of the last received paging message (i.e., E6EBB77C). Once the network receives this message, it triggers the process to release the LTE RRC resources which is completed when the mobile station receives the RRC Connection Release message. 26.04.2021 08:18:26.532 U LTE EPS LTE EMM Extended service request LTE NAS Message : Security header type : Plain NAS message, not security protected Protocol discriminator : EPS mobility management messages NAS EPS Mobility Management Message Type : Extended service request NAS Key Set Identifier : Type of security context flag (TSC): : native security context (for KSIASME) NAS Key Set Identifier : 0 Switch off : mobile terminating CS fallback or 1xCS fallback mobile identity : Mobile Identity : Length : 5 Odd/Even indication : Even number of identity digits and also when the TMSI/P-TMSI is used Type of Identity : TMSI/P-TMSI Identity digits : E6EBB77C Optional Elements : CSFB response value : CS fallback accepted by the UE (…) Figure 4-31. Part of a LTE EPS LTE EMM Extended service request message decoded in NQView.

When the mobile station is already switched to 3G, it first establishes an RRC connection in which it is shown the TMSI identifier of the mobile station in the 3G network, and the reason for establishing this RRC connection: terminatingConversationalCall (i.e., the network has originated a voice call that is addressed to this mobile station). The network replies to this RRC Connection request message with a RRC Connection Setup message that, as shown in Section 4.1.4.1, is used to indicate to the mobile station the type and configuration of the signaling and traffic channels. Then, the mobile station uses the Paging response message to indicate the network that the Paging message transmitted over 4G/LTE has reached the intended receiver in 3G. This Paging Response message is also used by the mobile station to show the network what are its capabilities (i.e., classmark) and what security algorithms it supports since the network will utilize them to secure the connection. Then, the voice call establishment follows a similar process than the one analyzed in Section 4.1.4.1 taking into account the different direction that some messages follow as it has been introduced above. 26.04.2021 08:18:27.047 U UL_CCCH_Message : message : rrcConnectionRequest RRCConnectionRequest : initialUE_Identity : tmsi_and_LAI tmsi_and_LAI : tmsi Length : 32 tmsi DATA : 163A9ABF lai : MCC MNC : mcc : MCC : 2 MCC : 1 MCC : 4 mnc : MNC : 0

WCDMA RRC

RRC

RRCConnectionRequest

MNC : 3 lac Length : 16 lac DATA : 46BC LAC : 18108 Establishment cause : terminatingConversationalCall protocolErrorIndicator : noError (…) Figure 4-32. Part of a RRC Connection Request message decoded in NQView. 26.04.2021 08:18:27.314 U GSM RR Paging Response Protocol Discriminator : RR Skip Indicator : 0 Message Type : 27 PAGING RESPONSE Spare Half Octet Ciphering Key Sequence Number Ciphering Key Sequence Number : Possible values for the ciphering key 1 (1) Mobile Station Classmark Length : 3 Revision level : Used by mobile stations supporting R99 or later versions of the protocol (2) ES Indication : 'Controlled Early Classmark Sending' option is implemented in the MS (1) A5/1 : Encryption algorithm A5/1 available (0) RF power capability : RF Power capability is irrelevant in this IE (7) PS capability : PS capability present (1) SS Screen Indicator : Capability of handling of ellipsis notation and phase 2 error handling (1) SM capability : Mobile station supports mobile terminated point to point SMS (1) VBS : no VBS capability or no notifications wanted (0) VGCS : no VGCS capability or no notifications wanted (0) FC : The MS does not support the E-GSM or R-GSM band (0) CM3 : The MS supports options that are indicated in classmark 3 IE (1) LCSVA Capability : LCS value added location request notification capability not supported (0) UCS2 : The ME has a preference for the default alphabet (0) SoLSA : The ME does not support SoLSA (0) CMSP : 'Network initiated MO CM connection request' supported for at least one CM protocol (1) A5/3 : Encryption algorithm A5/3 available (1) A5/2 : Encryption algorithm A5/2 not available (0) Mobile Identity Length : 5 Odd/Even indication : Even number of identity digits and also when the TMSI/P-TMSI is used Type of Identity : TMSI/P-TMSI Identity digits : 163A9ABF

Figure 4-33. Paging Response message decoded in NQView.

4.1.4.3. Voice call establishment: summary This subsection shows the messages that are exchanged between the calling and the called mobile station in the network and the direction that they follow. These messages are summarized in Table 4-4. The table shows the flow that some messages follow and what they trigger on the other side of the connection. For example, the Call Proceeding that the calling mobile station receives in the downlink is generated once the called mobile station replies to the network with the Paging response message. Also note that the Alerting message that the called mobile station generates in the uplink triggers the transmission in the downlink of another Alerting message that is addressed towards the calling mobile station. The same happens with the Connect message when the called mobile station “press the green button” and accepts the voice call. This connect message is received in the downlink by the calling mobile station that sends in the uplink a Connect Acknowledgement message that is finally received by the called mobile station.

Table 4-4. Summary of layer 3 messages needed to establish a voice call between a calling and a called mobile station. Calling mobile station Direction

Message

Uplink

CM Service Request

Uplink

Setup

Downlink

Identity Request

Uplink

Identity Response

Downlink

Call Proceeding

Called mobile station Direction

Message

Uplink

Paging Response

Downlink

Identity Request

Uplink

Identity Response

Downlink

Setup

Uplink

Call Confirmed

Downlink

Alerting

Uplink

Alerting

Downlink

Connect

Uplink

Connect

Uplink

Connect Acknowledge

Downlink

Connect Acknowledge

4.1.4.4. Voice call ending: user clears the call The signaling messages exchanged between the mobile station and the network, and their direction, depend on who closes the call. This section shows the messages that are exchanged when the mobile station that originated the voice call (i.e., QualiPoc) is also the one that closes the call. Table 4-5 summarizes the messages that are exchanged between the mobile station and the network in this case. These messages are part of the Connection Clearing and Radio access Bearer Release processes that terminate a voice call. Table 4-5. Signaling messages for the release of a user terminated voice call. Time

Dir Layer Info

15:48:48.512 U

CC

Disconnect

15:48:48.512 U

RRC

Uplink Direct Transfer

15:48:48.729 D

CC

Release

15:48:48.729 U

CC

Release Complete

15:48:48.729 D

RRC

Downlink Direct Transfer

15:48:48.729 U

RRC

Uplink Direct Transfer

15:48:48.968 D

RRC

RRC Connection Release

15:48:49.008 U

RRC

RRC Connection Release Complete

First, the mobile station transmits in the uplink the Disconnect message (3GPP TS 24.008) to inform the network that the call is being closed. This message is triggered when the user that is

calling press the key/button that hands up the call. This message (see Figure 4-34) identifies the voice call that is going to be terminated with the Transaction Identifier (TI), and it also indicates the cause of the disconnection. In this case, the cause of the disconnection is a normal call clearing. Other causes might be (3GPP TS 24.008): unassigned (unallocated) number, no route to destination, channel unacceptable, operator determined barring, user busy, no user responding, user alerting no answer, call rejected, number changed, etc. The disconnect message is encapsulated in the Uplink Direct Transfer as shown in Table 4-5. 26.07.2001 15:48:48.512 U GSM CC Disconnect Protocol Discriminator : CC Transaction Identifier : Sent from TI originator, ID=0 Message Type : 25 DISCONNECT Cause Cause Length : 2 Coding standard : Standard defined for the GSM PLMNS Location : User Cause value Class : Normal event Value : Normal call clearing

Figure 4-34. Disconnect layer 3 message decoded in NQView.

The Disconnect message is processed at the network side which result in that all running call control timers and procedures are stopped. Then, the procedures to clear the call begin. The network first transmits in the downlink a Release message (encapsulated in a Downlink Direct Transfer message) that acts as a kind of acknowledgement for the Disconnect message transmitted by the mobile station. It then includes the Transaction Identifier (TI) and the cause why the call is cleared. Once the Release message is received by the mobile station, it transmits a Release Complete message in the uplink to acknowledge it. As shown in Table 4-5, both the Release and Release complete messages are encapsulated in Downlink and Uplink Direct Transfer messages, respectively. 26.07.2001 15:48:48.729 D GSM CC Release Protocol Discriminator : CC Transaction Identifier : Sent to TI originator, ID=0 Message Type : 2D RELEASE Cause Cause Length : 2 Coding standard : Standard defined for the GSM PLMNS Location : User Cause value Class : Normal event Value : Normal call clearing Figure 4-35. Release layer 3 message decoded in NQView. 26.07.2001 15:48:48.729 U GSM CC Protocol Discriminator : CC Transaction Identifier : Sent from TI originator, ID=0 Message Type : 2A RELEASE COMPLETE

Release Complete

Figure 4-36. Release Complete layer 3 message decoded in NQView.

Finally, when the Connection Clearing process is completed, the Radio access Bearer Release process is started. This process starts with the transmission from the network to the mobile station of the RRC Connection Release message (3GPP TS 25.331) over the DCCH channel. The purpose of this process is to release the RRC connection including all radio bearers and all signaling radio bearers (including the radio resources) between the mobile station and the network. As it is shown in Figure 4-37, the RRC Connection Release message shows that this process is performed as a result of a normal event. In addition, since the call was started in LTE and redirected to 3G/UMTS, with this message the network is informing the mobile station that it is redirected back to LTE/EUTRA and it facilitates the list of downlink frequencies available which are represented by 3400, 3050, 1849 and 6200. 26.07.2001 15:48:48.968 D WCDMA RRC RRC RRCConnectionRelease DL_DCCH_Message : Integrity check info : Message authentication code Length : 32 Message authentication code : [ADAD0DB9h] ADAD0DB9 RRC Message sequence number : [1d] 1 Message : rrcConnectionRelease RRCConnectionRelease : later_than_r3 later_than_r3 : RRC transaction identifier : 1 Critical extensions : r4 r4 : rrcConnectionRelease_r4 : n_308 : 1 releaseCause : normalEvent v4d0NonCriticalExtensions : rrcConnectionRelease_r4_add_ext : Protocol extension not supported rrcConnectionRelease_v690ext : v770NonCriticalExtensions : rrcConnectionRelease_v770ext : v860NonCriticalExtensions : rrcConnectionRelease_v860ext : redirectionInfo : interRATInfo interRATInfo : eutra eutra : eutra_TargetFreqInfoList : 4 [0] eutra_TargetFreqInfoList : element : dlEUTRACarrierFreq : 3400 [1] eutra_TargetFreqInfoList : element : dlEUTRACarrierFreq : 3050 [2] eutra_TargetFreqInfoList : element : dlEUTRACarrierFreq : 1849 [3] eutra_TargetFreqInfoList : element : dlEUTRACarrierFreq : 6200 Figure 4-37. RRC Connection Release message decoded in NQView.

After the mobile station receives the RRC Connection Release message, the mobile station replies with the RRC Connection Release Complete message to the network to confirm that the RRC connection has been released. The mobile station then releases all its 3G radio resources and it starts listening to the 4G signaling messages that it can listen to in 4G’s RRC disconnected state. 26.07.2001 15:48:49.008 U RRCConnectionReleaseComplete

WCDMA RRC

RRC

UL_DCCH_Message : Integrity check info : Message authentication code Length : 32 Message authentication code : [08B052A0h] 08B052A0 RRC Message sequence number : [6d] 6 Message : rrcConnectionReleaseComplete rrcConnectionReleaseComplete : RRC transaction identifier : 1 Figure 4-38. RRC Connection Release Complete message decoded in NQView.

4.1.4.5. Voice call ending: network clears the call It may also happen that the voice call is terminated by the mobile station that is not the QualiPoc terminal. Then, the QualiPoc terminal receives messages from the network to clear the call which are actually similar to the ones analyzed in Section 4.1.4.4 but with different directions. The logged messages are summarized in Table 4-6. In this case, the Disconnect (encapsulated in a Downlink Direct Transfer) message is transmitted in the downlink, while the Release message is transmitted in the uplink. The acknowledgement from the network to the received Release message, i.e., Release Complete, is transmitted in the downlink. What it does not change is the direction of the messages that intervene in the Radio access Bearer Release process. As it can be seen in Table 4-6, the RRC Connection Release and RRC Connection Release Complete messages are transmitted in the downlink and uplink, respectively, as it was the case in Table 4-5. Table 4-6. Signaling messages for the release of a network terminated voice call. Time

Dir Layer

Info

15:29:07.608 D

CC

Disconnect

15:29:07.608 D

RRC Downlink Direct Transfer

15:29:07.608 U

CC

15:29:07.608 U

RRC Uplink Direct Transfer

15:29:07.608 D

CC

15:29:07.608 D

RRC Downlink Direct Transfer

15:29:07.608 D

RRC RRC Connection Release

15:29:07.608 U

RRC RRC Connection Release Complete

Release

Release Complete

4.1.5. Broadcast information The network periodically transmits broadcast information that is referred to as system information. The system information is transmitted by each base station and provides useful information for the mobile stations to operate properly within a specific cell. In LTE, the system information is transmitted using two different transport channels. On one hand, part of the system information is transmitted using the Broadcast Channel. This information is known as Master Information Block (MIB). On the other hand, most of the system information is transmitted using the Downlink Shared Channel (DL-SCH). This system information is transmitted in several System Information Blocks (SIBs) and each of them transmit different information. In NQView, the System Information messages can also be found in the Layer 3 Monitor (see Section 3.3.2.1).

Although this book focuses in 4G networks, this section also includes the system information of 3G networks. This is the case because the conducted measurements have shown that the QualiPoc terminal does not support voice over LTE (VoLTE) and then the call is switched to 3G. Then, for completeness, this book also includes the system information messages that are broadcasted in 3G and that are of interest when the QualiPoc terminal is performing a voice service.

4.1.5.1. 3G system information The Master Information Block (see Figure 4-39) includes information about the PLMN (Public Land Mobile Network) such as the mobile country code and the mobile network code, and information about when others System Information Blocks are transmitted. The Master Information Block decoded in NQView and shown in Figure 4-39 reports a PLMN characterized by the Mobile Country Code (214, Spain) and Mobile Network Code (03, Orange). The logged message also includes scheduling information for 6 different System Information Blocks – SIB(only two are reported in Figure 4-39) 08.09.2020 12:52:51.443 D WCDMA RRC MasterInformationBlock : MIB Value tag : [4d] 4 PLMN Type : gsm_MAP GSM-MAP : MCC MNC : mcc : MCC : 2 MCC : 1 MCC : 4 mnc : MNC : 0 MNC : 3 SIB and SB Reference List : 6 SIB and SB Item : SIB and SB type : Scheduling Block 1 CellValueTag : 2 SEG_COUNT : 1 SIB_REP : 32 SIB_POS : [10d] 20 frames SIB and SB Item : SIB and SB type : System Information Type 1 PLMN-ValueTag : 5 SEG_COUNT : 1 SIB_REP : 32 SIB_POS : [6d] 12 frames (…)

BCCH:BCH-MasterInformationBlock

Figure 4-39. Master Information Block message decoded in NQView.

The System Information Block Type 1 (Figure 4-40) contains NAS (non-access stratum) system information including the Location Area Code (LAC) and Routing Area Code (RAC), as well as timers and counters to be used in idle mode and in connected mode. 08.09.2020 12:52:51.403 D WCDMA RRC System Information Type 1 : CN common GSM NAS System Information Length : 16 CN common GSM NAS System Information : LAC : 18108 CN Domain System Information list : 2 CN Domain System Information :

RRC

BCCH:BCH-SysInfoType1

CN Domain Identity : CS Domain CN Type : GSM-MAP GSM-MAP Length : 16 GSM-MAP : T3212 : (20) 2.0 hours Attach-detach allowed (ATT) : MSs shall apply IMSI attach and detach procedure CN domain specific DRX cycle length coefficient : [6d] 6 CN Domain System Information : CN Domain Identity : PS Domain CN Type : GSM-MAP GSM-MAP Length : 16 GSM-MAP : Routing Area Code (RAC) : 137 Network Mode of Operation (NMO) : Network Mode of Operation II CN domain specific DRX cycle length coefficient : [6d] 6 UE Timers and constants in Connected mode : T301 : 2000 ms N301 : 2 T302 : 1200 ms N302 : 5 T304 : 2000 ms N304 : 3 T305 : 30 min T307 : 30 seconds T308 : 40 milliseconds T309 : 5 seconds T310 : 40 milliseconds N310 : 0 T311 : 250 milliseconds T312 : 6 seconds N312 : 1 T313 : 3 seconds N313 : 100 T314 : 6 seconds T315 : 10 seconds N315 : 1 T316 : 30 seconds T317 : infinity2 UE Timers and constants in Idle mode : T300 : 2000 ms N300 : 3 T312 : 6 seconds N312 : 1 (…) Figure 4-40. System Information Block Type 1 message decoded in NQView.

The System Information Block Type 2 (Figure 4-41) includes the identity of the registration area that for 3G is known as URA (UTRAN Registration Area). The URA is made of a number of cells and it is used to track the location of the mobile station with a lower granularity (not at cell level) when the mobile station has not active connections. In the example shown in Figure 4-41, the URA identity reported in the System Information Block Type 2 is 5713. 08.09.2020 12:52:51.731 System Information Type 2 : URA Identity List : URA Identity Length : 16 URA Identity : URA Identity : 5713

D

WCDMA RRC

RRC

BCCH:BCH-SysInfoType2

Figure 4-41. System Information Block Type 2 message decoded in NQView.

The System Information Block Type 3 (Figure 4-42) contains specific information related to the cell that has transmitted this message and that is used in procedures such as the cell selection and reselection. The message first shows the radio network controller and cell id (3302 and 30886 in the example below) and then what metric is used to execute the cell selection and reselection procedures (cpich_Ec_N0 in the example shown in Figure 4-42). Other parameters included in this message are: • QHyst2S specifies the hysteresis value to be used if quality measure is cpich_Ec_N0. QHyst1S is indicated when the quality measure is CPICH RSCP. • SIntraSearch (10 dB in Figure 4-42) controls whether the mobile station has to do measurements of intra-frequency cells. If the quality of the serving cell is above SIntrasearch dB, then the mobile station will not measure other intra-frequency cells. • SInterSearch (8 dB in Figure 4-42) is similar to SIntrasearch but for inter-frequency cells. • QQualMin is the minimum required quality level in the cell in dB. Since quality measure is set to cpich_Ec_N0 in this case, the mobile station compares Ec/N0 it measures for the cell with QQualMin to determine if it may select another cell. • QRxlevMin is the minimum required RSCP reception level in the cell in dBm. • TReselectionS states the time interval during which a neighboring cell should fulfill the requirements to do the reselection. • Maximum allowed UL TX power is the maximum allowed transmission power in dBm that can be used in the uplink. • Cell Access Restriction indicates whether the cell is barred. A barred cell is a cell where the mobile station is not allowed to camp. If a cell becomes barred, the mobile station has to reselect another one. 08.09.2020 12:52:51.651 D WCDMA RRC RRC System Information Type 3 : Cell identity Length : 28 Cell identity : RNC ID : 3302 Cell ID : 30886 Cell selection and re-selection info : Cell selection and reselection quality measure : cpich_Ec_N0 CPICH Ec/No : QHyst2S : [1d] 2 dB Mode specific information : fdd FDD : SIntraSearch : [5d] 10 dB SInterSearch : [4d] 8 dB RAT List : 1 RAT Item : RAT identifier : gsm SSearch,RAT : [0d] 0 dB SLimit,SearchRAT : [0d] 0 dB QQualMin : [-18d] -18 dB QRxlevMin : [-57d] -113 dBm QHyst1S : [2d] 4 dB TReselectionS : [3d] 3 s Maximum allowed UL TX power : [24d] 24 dBm Cell access restriction : Cell Barred : notBarred (…)

BCCH:BCH-SysInfoType3

Figure 4-42. System Information Block Type 3 message decoded in NQView.

The System Information Block Type 5 (Figure 4-43) contains parameters for the configuration of the common physical channels in the cell. Some of them are: • PICH (Pilot Channel) Power Offset is the power transmitted on the PICH minus the power of the Primary CPICH. • AICH (Acquisition Indicator Channel) Power Offset is used to indicate the power level of AICH, AP-AICH and CD/CA-ICH channels. This is the power per transmitted Acquisition Indicator, AP Acquisition Indicator or CD/CA Indicator minus power of the Primary CPICH. • PRACH System Information List includes the RACH transport format set and transport format combination set, the Primary CPICH TX power (used to calculate the initial power to be used in the PRACH), the PRACH power offset (power steps in power control) or the RACH transmission parameters (maximum number of preamble cycles, sets lower bound for random back-off and sets upper bound for random back-off). • AICH info includes channelization code (spreading factor is fixed and equal to 256), STTD (Space-Time block coding based Transmit Diversity) indicator and AICH transmission timing. 08.09.2020 12:52:51.731 D WCDMA RRC SysInfoType5 : SIB6 Indicator : FALSE PICH Power offset : [-7d] -7 dB Mode specific information : fdd FDD : AICH Power offset : [-6d] -6 dB Primary CCPCH info : fdd FDD : TX Diversity indicator : FALSE Prach System Information List : 1 PRACH Item : Prach rach information : Mode specific information : fdd FDD : (…) Available Spreading Factor : 32 chips/symbol Preamble scrambling code number : 0 Puncturing Limit : 1 RACH Transport Format Set : Common transport channels : Transmission Time Interval : 20 ms Transmission Time Interval Count : 2 TTI Item : RLC Size : FDD : Size : [15d] 168 bits Number of TBs and TTI List : 1 Item : element : one Logical channel list : configured TTI Item : RLC Size : FDD : Size : [3d] 360 bits Number of TBs and TTI List : 1 Item : element : one Logical channel list : configured Semi-static Transport Format Information :

RRC

BCCH:BCH-SysInfoType5

Type of channel coding : Convolutional : half Rate matching attribute : 1 CRC size : 16 bits RACH Transport Format Combination Set : (…) Mode specific information : fdd FDD : Primary CPICH TX power : [36d] 36 dBm Constant Value : -20 dB PRACH power offset : Power Ramp Step : 2 dB Preamble Retrans Max : 20 RACH transmission parameters : Mmax : 8 NB01min : 0 NB01max : 0 AICH info : Spreading Factor : 256 Channelisation code : 2 STTD indicator : FALSE AICH transmission timing : 1 (…) Figure 4-43. Part of a System Information Block Type 5 message decoded in NQView..

The System Information Block Type 7 (Figure 4-44) complements the information available in the System Information Block Type 5 with additional information about the PRACH. 08.09.2020 12:52:51.463 D SysInfoType7 : Mode specific information : fdd FDD : UL Interference : [-102d] -102 dBm PRACHs System Information 5 List : Dynamic Persistence Level : [1d] 1

WCDMA RRC

RRC

BCCH:BCH-SysInfoType7

Figure 4-44. System Information Block Type 7 message decoded in NQView..

A summary of the information contained in all the system information blocks is included in Table 4-7. Table 4-7. Information contained in the system information blocks. Information Block Master Information Block System Information Block 1

System Information Block 2 System Information Block 3 System Information Block 4 System Information Block 5 System Information Block 6 System Information Block 7

Information contained in the Block PLMN Identity References to other System Information and Scheduling Blocks NAS System Information Core Network Domain System Information UE-specific Timers and Constants in ‘idle mode’ UE-specific Timers and Constants in ‘connected mode’ URA Identity Cell Identity Parameters for cell selection and reselection Cell Access Restriction Similar to SIB 3, but used in connected mode only Parameters for configuration of common physical channels in the cell Parameters for configuration of common and shared physical channels. To be used in connected mode only. UL Interference and Dynamic Persistence Level

System Information Block 8 System Information Block 9 System Information Block 10 System Information Block 11 System Information Block 12 System Information Block 13 System Information Block 14 System Information Block 15 System Information Block 16 System Information Block 17 System Information Block 18

Static information for Common Packet Channel (CPCH). Used for FDD mode only. Dynamic information for Common Packet Channel (CPCH). Used for FDD mode only. Information used by the UEs that have DCH controlled by a ‘Dynamic Resource Allocation Control’ procedure. Used for FDD mode only. Measurement control Information to be used in the cell Similar to SIB 11, but used only in connected mode ANSI-41 system information. Used only when the Core Network is ANSI-41. Parameters for common and dedicated physical channel uplink ‘outer-loop power control’. Used only in TDD mode. Information for UE-based or UE-assisted positioning methods for locations services (LCS) Parameters for radio bearer, transport channel and physical channel to be used by UE at the time of handover to UTRAN Fast changing information for the configuration of the shared physical channels. Used only in ‘connected mode’ and for TDD mode only. PLMN Identities of neighboring cells

4.1.5.2. 4G system information (The QualiPoc terminal has not collected (almost any) 4G system information message in the conducted field tests. The information shown below is reported for completeness11) The Master Information Block contains information such as the downlink cell bandwidth, PHICH configuration of the cell, the System Frame Number (SFN). The main part of the system information is included in the System Information Blocks: • System Information Block Type 1 includes information about the identify of the PLMN (i.e., MCC and MNC), and shows whether the cell is barred or not (i.e., whether it is reserved for operator use). It also shows tracking area code and cell identity as well as eNB and sectors IDs. For cell selection purposes, it also includes minimum quality level of the current cell using the parameter QRxLevMin. Finally, it also includes information about the scheduling of the remaining system information blocks. 26.04.2021 08:18:51.315 D LTE RRC SystemInformationBlockType1 BCCH_DL_SCH_Message : Message : c1 System Information Block Type 1 (SIB1) : Cell access info : PLMN identity list : 1 PLMN identity : MCC MNC : MCC : MCC : 2 MCC : 1 MCC : 4 MNC : MNC : 0 MNC : 3 Cell Reserved for operator use : notReserved Tracking Area Code (TAC) Length : 16 Tracking Area Code (TAC) : [4784h] 4784 cellIdentity : CI : 219062541

Macro eNB ID : 855713 Sector ID : 13 Cell Barred : notBarred Intra frequency reselection : allowed CSG-indication : FALSE Cell selection info : QRxLevMin : [-62d] -124 dBm Frequency band indicator : 3 Scheduling info list : 3 Schedule : SIB periodicity : 16 radio frames Mapped SIBs : Message : sibType3 Schedule : SIB periodicity : 32 radio frames Mapped SIBs : Message : sibType5 Schedule : SIB periodicity : 64 radio frames Mapped SIBs : Message : sibType6 SIB window length : 40 ms System info value tag : 20 Figure 4-45. System Information Block Type 1 message decoded in NQView.

• • • • • • • • •

System Information Block Type 2 contains information that is needed to access the cell such as the uplink cell bandwidth, random-access parameters, and parameters related to uplink power control. System Information Block Type 3 contains information related to cell reselection. From System Information Block Type 4 to System Information Block Type 8, they contain information related to neighboring cells. System Information Block Type 9 shows the name of the home-eNodeB. The especial System Information Block Type 10–System Information Block Type 12 contain public warning messages such as earthquake information. System Information Block Type 13 includes information that is needed to correctly receive necessary for Multimedia Broadcast Multicast Service. System Information Block Type 14 provides control information that can be used to access barred cells. System Information Block Type 15 includes also information related to the Multimedia Broadcast Multicast Service, but in this case this information is related to neighboring carrier frequencies. Finally, the System Information Block Type 16 includes synchronization information such as GPS time and Coordinated Universal Time (UTC).

4.2. Cell selection and reselection This test is aimed at showing the process by which a mobile station that has no active connections (i.e., in idle mode) selects a cell to camp on or changes the serving cell. These processes are known as cell selection and reselection. The selection of a cell is based on a set of radio parameters and conditions that are broadcasted by the current serving cell. Then, this process guarantees that the mobile station is connected to the most suitable cell in terms of Radio Frequency (RF) conditions among the set of cells the mobile station would be allowed to camp on. A detailed description and specification of the cell (selection and) reselection process is presented in 3GPP TS 36.304 (v15.0.0; clause 5.2 Cell selection and reselection). Figure 4-46 illustrates a graph diagram reported in 3GPP TS 36.304 that shows the different states mobile stations pass through

during the cell selection and reselection processes and that begin when a new PLMN (Public Land Mobile Network) or operator is selected. go here whenever a new PLMN is selected

cell information stored for the PLMN

Stored information Cell Selection no suitable cell found

no cell information stored for the PLMN

1

Initial Cell Selection

no suitable cell found

2

suitable cell found

suitable cell found no suitable cell found

Cell Selection when leaving connected mode

return to idle mode

suitable cell found

leave idle mode

Connected mode

Camped normally

NAS indicates that registration on selected PLMN is rejected (except with cause #12, #14 , #15 or #25 [5][16])

trigger suitable cell found

Cell Reselection Evaluation Process

no suitable cell found

Any Cell Selection

no acceptable cell found

go here when no USIM in the UE

USIM inserted acceptable cell found

Cell Selection when leaving connected mode

return to idle mode

Connected mode (Emergency calls only)

acceptable cell found

leave idle mode

Camped on any cell

suitable cell found

1

2

trigger acceptable cell found

Cell Reselection Evaluation Process

no acceptable cell found

Figure 4-46. Graph diagram defined in 3GPP TS 36.304 of the cell selection and reselection8.

For LTE, the cell selection criterion is fulfilled when Squal > 0 and Srxlev > 0, where: Srxlev = Qrxlevmeas – (Qrxlevmin + Qrxlevminoffset) – Pcompensation - Qoffsettemp Squal = Qqualmeas – (Qqualmin + Qqualminoffset) - Qoffsettemp See the definition of all these parameters in

Table 4-8. The mobile station should only reselect to a cell if it is better ranked than the serving cell and the previous criteria are fulfilled. The reselection does not require any specific message from the mobile station to the base station. The mobile station just camp on the new selected cell and listen to the broadcast messages that are received from the base station in this cell.

Table 4-8. Definition of the cell selection criterion’s parameters (3GPP TS 36.304)8. Srxlev Squal Qoffsettemp Qrxlevmeas Qqualmeas Qrxlevmin Qqualmin Qrxlevminoffset Qqualminoffset Pcompensation

PEMAX1, PEMAX2 PPowerClass

Cell selection RX level value (dB) Cell selection quality value (dB) Offset temporarily applied to a cell (dB). This specifies the additional offset to be used for cell selection and re-selection. It is temporarily used in case the RRC Connection Establishment fails on the cell. Measured cell RX level value (RSRP) Measured cell quality value (RSRQ) Minimum required RX level in the cell (dBm) Minimum required quality level in the cell (dB) Offset to the signalled Qrxlevmin taken into account in the Srxlev evaluation as a result of a periodic search for a higher priority PLMN while camped normally in a VPLMN. Offset to the signalled Qqualmin taken into account in the Squal evaluation as a result of a periodic search for a higher priority PLMN while camped normally in a VPLMN. If the UE supports the additionalPmax in the NS-PmaxList, if present, in SIB1, SIB3 and SIB5: max(PEMAX1 –PPowerClass, 0) – (min(PEMAX2, PPowerClass) – min(PEMAX1, PPowerClass)) (dB); else: if PPowerClass is 14 dBm: max(PEMAX1 –(PPowerClass – Poffset), 0) (dB); else: max(PEMAX1 –PPowerClass, 0) (dB) Maximum TX power level an UE may use when transmitting on the uplink in the cell (dBm) defined as PEMAX in TS 36.101. PEMAX1 and PEMAX2 are obtained from the p-Max and the NSPmaxList respectively in SIB1, SIB3 and SIB5 as specified in TS 36.331. Maximum RF output power of the UE (dBm) according to the UE power class as defined in TS 36.101.

4.2.1. Testing environment and QualiPoc configuration Based on the above theoretical explanation, the cell reselection process has been tested using the QualiPoc tool in the scenario that is shown in Figure 4-48 and that is in front of the ‘Rectorado y Consejo Social’ building of the Universidad Miguel Hernandez de Elche. The figure shows with a red dotted line the route followed around a building where there is a base station on the roof. This route forces the reselection between the different sectors of the base station. The cell reselection does not require any active connection, then QualiPoc is configured to perform an Idle Monitoring (see Section 2.3.5 and Figure 4-47). This way QualiPoc is not forced to perform any connection, but it logs the signaling messages received from the base station and it performs and logs RF measurements.

Figure 4-47. Idle job type.

In this test it is important to geo-reference the logged measurements. To do so, QualiPoc has to be configured to use the GPS and the test cannot start until a fix location is displayed in the GPS information. The GPS configuration in QualiPoc is available in the Map settings menu (see Section 2.2.1). This menu allows to configure, for instance, whether QualiPoc uses an internal or external GPS. The user can check whether QualiPoc is getting a proper GPS signal using the GPS position monitor that is available under the Status monitor (see Section 2.5.1.1). Once the test is completed, the measurements are saved in a log file when the Idle job is stopped manually. To do so, press ⋮ | Stop job and save the file.

BS

Figure 4-48. Testing environement for the cell selection and reselection test.

4.2.2. Analysis of the obtained results To open the logged measurements in NQView, select Replay | Load file(s)… and then select the measurement file that wants to be loaded using the wizard (see Figure 4-49). In this case, the measurements are saved in an IdleMonitoring folder that is created automatically by QualiPoc.

Once the measurements are loaded in NQView, the analysis of the cell reselection is based on the monitored RF parameters (RSRP and RSRQ) of the serving and neighboring cells. NQView has a Device monitor that shows RF parameters measured of the serving cell (SC) and neighboring cells (NC) in a table format. To open it, follow the steps shown in Figure 4-50. In particular, this Device monitor shows in a table the parameters: Type (i.e., SC or NC), EARFCN, PCI, RSRP, RSRQ and RSSI parameters (Figure 4-50). Line charts are useful to see the evolution of the RF parameters. To open an empty line chart monitor, select | General | Line Chart in the Main toolbar menu or click in Monitors | General monitors | Line Chart within the Pages and Monitors panel. Then, RF parameters can be added to the line chart. To this aim, use the Values panel of the navigation panel, and drag and drop the desired Value into the empty line chart monitor (see in Figure 4-51 an example to filter out RSR* parameters of the Value panel). Figure 4-52 shows an example in which the RSRP and RSRQ of the serving cell and 1st neighbour cell are included. Figure 4-53 shows the LTE serving and neighbours monitor for the time instant marked in Figure 4-52 with the vertical yellow line. This time instant is actually the moment before a cell reselection takes place.

Figure 4-49. Load measurements to analyze the cell reselection process.

Figure 4-50. Open Device monitor with LTE serving and neighbors’s RF measurements.

Figure 4-51. Filter out Values parameters to select the desired metric.

Figure 4-52. Line chart with RSRP and RSRQ of serving cell (red line) and 1st neighbour cell (green line) during a reselection process.

Figure 4-53. LTE serving and neighbors. Values reported in the table correspond to the time instant marked in Figure 4-52 with the vertical yellow line.

Figure 4-52 shows the RSRP and RSRQ levels experienced by the mobile station in a section of the route. The figures include the RSRP and RSRQ levels of the serving cell and one neighboring cell. The cursor (yellow vertical line) represents the time instant at which the reselection process takes place. The figure shows that just after this time instant the RSRP and RSRQ of the service cell (red line) significantly grows. This is the case because the mobile station has performed the reselection to the new cell. Cell reselection parameters are broadcasted in system information (SIB) as it has been presented in Section 4.1.5. The LTE Cell monitor available in NQView displays these parameters as it can be shown in Figure 4-54. In particular, the LTE Cell monitor displays: • QRxLevMin: this specifies the minimum required Rx level -RSRP- in the cell in dBm. • SIntraSearch: this specifies the Srxlev or Squal threshold (in dB) for intra-frequency measurements. • SNonIntraSearch: this specifies the Srxlev or Squal threshold (in dB) for E-UTRAN interfrequency and inter-RAT measurements. • SRxLev: this shows the current SRxLev for the serving cell. Figure 4-54 shows that QRxlevMin is -124 dBm and the maximum power allowed is 23dBm. Based on these parameters and the levels observed in Figure 4-52, both cells (SC and NC) can be active cells during the time interval shown in the figures because the conditions previously exposed are fulfilled. The mobile terminal needs then to determine the best cell. To this aim, it has to take into account the hysteresis levels (e.g., threshServingLow included in SIB messages or based on UE implementation and is compared against the SRxLev; it can take values from 0 to 31 dB) and a timer (e.g., TreselectionEUTRA included in SIB messages or based on UE implementation; it can take values from 0s to 7s). These hysteresis levels and timer are not available in the conducted measurements, and then the mobile station performed the cell reselection based on UE implementation values. As it is shown in Figure 4-53, the RSRP and RSRQ for the serving cell is lower (-95 dBm and -24.4 dB, respectively) than what the mobile station measures in the neighboring cells (-88.6 dBm and -12.2 dB, respectively). LTE also introduces parameters that take into account the priority of the serving and neighboring cells that might influence the cell selection and reselection process. These parameters that depends on the priority were not present in the logged measurements.

Figure 4-54. LTE cell information for the different cells the mobile station connects to.

It is also possible to show the cell selection and reselection processes in a map if QualiPoc was configured to log the GPS location. To represent the QualiPoc measurement in a map, use the NQview Map monitor (see Section 3.3.1.6 for details). Figure 4-55 shows the Map monitor with the route followed by the mobile station during the measurement using QualiPoc. The route shows the different PCI (Physical Cell ID) of the serving cells with different colors. Therefore, the color changes when a cell reselection takes place. As it can be appreciated in the figure, there are in total 4 different colors (213 in green, 214 in red, 215 in blue and 340 in yellow). Table 4-9 shows the time instants when the cell reselections take place and the PCI and CId (Cell Id) identifiers of the different cells. These cells may belong to the same or different base stations. In order to identify that, we can use the cell identify information that is reported in the SIB1. Figure 4-56 shows that the 4 different CId (i.e., 219062538, 219062539, 219062540, 219062541) actually belong to the same base station (macro eNB ID 855713) which has 4 sectors with sector ID: 10, 11, 12 and 13.

Figure 4-55. Geo-positioned route colored with the scrambling code of the active cell. Table 4-9. Time instants when the cell relections take place. Time

PCI

CId

13:24:29.282

340

219062541

13:24:39.501

340

219062541

13:24:41.313

213

219062538

13:24:48.447

214

219062539

13:26:11.660

214

219062539

13:26:14.837

215

219062540

13:26:59.111

215

219062540

13:26:59.512

340

219062541

Figure 4-56. Cell identity information reported in the System Information Block Type 1 for the different cells the mobile station connect to alongh the route.

4.3. Handover The previous section has shown the procedure that happen in LTE when the mobile station is in idle state and that aim to select and reselect the cell the mobile station camps to. The cell selection and reselection criteria are determined by the System Information Blocks (SIB) which are broadcast messages that the mobile station receives in idle state (see Section 4.1.5). When the mobile station is in connected state, the measurement processes aim to ensure the mobile station is connected to the base station that shows the best link quality conditions. The process by which the mobile station selects a new cell when it is in connected state is called handover. In this case, the measurement criteria to execute a handover are provided individually to the mobile station via specific RRC messages. There are different types of handovers that differ on whether the connection to the base station is released or not before establishing a new one. Soft handover allows that a new connection is established before the old connection is released. Then, the mobile station can be connected simultaneously to different base station (or different sectors of the same base station; referred to as softer handover). The different base stations/sectors the mobile station is connected to is called the active set. Soft(er) handover allows then that the mobile station’s connection is not interrupted. Soft(er) handover requires that adjacent cells operate on the same frequency. This is the case of 3G/UMTS where neighboring cells operate on the same frequency and differentiate by the used scrambling codes. Unlike 3G/UMTS, 4G LTE is based on OFDMA which is a frequency division method. Then, the connection to different base stations/cells might operate at different frequencies. Then, the mobile station needs to resync to a different set of frequency subcarriers when it moves between cells. Then, unlink 3G/UMTS, LTE does not support soft handover and only hard handover is allowed. There are additional reasons why soft handover is not possible in LTE. For example, the 3G/UMTS’s architecture exploits the presence of a central node (RNC) that combines the signals received from different base stations. The flat LTE architecture does not use this central node anymore and then it cannot sum up multiple active signals from different base stations.

Figure 4-57. HTTP transfer DL job type.

4.3.1. Testing environment and QualiPoc configuration The handover test is conducted in the Avenida de la Universidad as shown in Figure 4-58. In this case, a long path that starts next to the Vinalopó river and ends at the University campus has been chosen with the aim to experience several handover processes during the same test. As it has been shown in Section 4.1.4 for the voice call establishment and ending, the mobile station is redirected to 3G when it performs a voice call. Then, this section analyzes the handover process using a 4G data connection to the LTE network. The QualiPoc terminal is then configured to do a Data Test job type. In particular, for this test the QualiPoc tool is configured to perform an HTTP DL data transfer (see Section 2.3.2.3 and Figure 4-57). Since the walk path is quite long,

the Data Test job is configured to repeat the HTTP DL data transfer an unlimited number of times. Note that in between consecutive downloads, there will be a pause where the QualiPoc terminal is not performing any data download. As it has been also shown in the previous test configuration, it could be convenient to geo-localize the logged measurements in QualiPoc. To this aim, double-check the GPS configuration (see Section 2.2.1) is correct and that the GPS is fixed when the test starts (see Section 2.5.1.1). Finally stop the job and save the measurements once the test is completed. To do so, press ⋮ | Stop job.

Figure 4-58. Testing environment for the handover test.

4.3.2. Analysis of the obtained results Table 4-10 shows the 3 main messages that are exchanged between the mobile station and the network to execute the handover in LTE. These messages are displayed in the NQView L3 Monitor (see Section 3.3.2.1). This monitor shows all messages that are exchanged between the mobile station and the network. These 3 messages come together so they can be easily identified. Note that the Measurement Report message can appear multiple times. Table 4-10. Messages that are exchanged in the LTE handover process. Dir

Layer

Info

D

Downlink RRC Connection Reconfiguration

U

Uplink

U

Downlink Measurement Report

RRC Connection Reconfiguration Complete

The RRC Connection Reconfiguration message has different formats (3GPP TS 36.331). In one of its formats, it includes the measurement configuration (see Figure 4-60). With this message the network configures the mobile station to perform measurement reporting. The measurement configuration includes the following information: • Measurement object list: this indicates the objects on which the mobile station shall perform the measurements. • Report configuration list: this shows a list of report configurations which consists of: o Trigger type: this indicates the criteria that trigger the mobile station to transmit a measurement report. This could be periodical or event-based. See below a list of events that trigger the transmissions of a measurement report.

Trigger/Report quantity: this indicates the metric the mobile station includes in the measurement report (e.g., RSRP) and the number of cells that are reported (e.g., 4). Measurement identity list: this links the measurement objects with a report configuration. By defining multiple measurement identities, it is possible to link the same measurement object with more than one report configuration or to link different measurement object with the same report configuration. Measurement gap configuration: this defines the periods that the mobile station dedicates to perform measurements (e.g., when no UL and DL transmissions are scheduled). o

•

•

Possible measurement events are as follows (3GPP TS 36.331 - subclause 5.5.4) and they are illustrated in Figure 4-59: • Event A1: serving cell becomes better than a threshold. • Event A2: serving cell becomes worse than a threshold. • Event A3: a neighboring cell becomes better than the serving cell by an offset. • Event A4: a neighboring cell becomes better than a threshold. • Event A5: serving cell becomes worse than threshold-1 and neighboring cell becomes better than threshold-2. • Event A6: the Intra Frequency Neighbor becomes offset better than Secondary (S) Cell (introduced in Release 10 for Carrier Aggregation). • Event B1: a neighboring inter-RAT cell becomes better than a threshold. • Event B2: serving cell becomes worse than threshold-1 and neighboring inter-RAT cell becomes better than threshold-2.

Figure 4-59. Illustration of the possible A1-A6 events and conditions that trigger them14.

26.07.2001 16:03:25.492 D LTE DL_DCCH_Message : Message : c1 rrcConnectionReconfiguration : RRC transaction identifier : 2 Critical extensions : c1 RRCConnectionReconfiguration R8 : Measurement configuration :

14

RRCConnectionReconfiguration

https://www.sharetechnote.com/html/Handbook_LTE_MultiCell_Measurement_LTE.html#Example2

Measurement object list : 1 element : Measurement object ID : 1 Measurement object : measObjectEUTRA Measurement object E-UTRA : Carrier Frequency (EARFCN) : 1849 Allowed measurement bandwidth : [75d] 75 RB Presence of antenna port 1 : FALSE Neighbor Cell Configuration Length : 2 Neighbor Cell Configuration : [1h] 1 Carrier offset : 0 dB cellsToAddModList : 11 [0] cellsToAddModList : element : cellIndex : 1 Physical cell ID : 246 Cell individual offset : 0 dB (…) Report configuration list : 7 element : Report configuration ID : 1 Report configuration : reportConfigEUTRA Report configuration EUTRA : Trigger type : event Event : Measurement event identity : A3 Event A3 : Offset event A3 : [6d] 3 dB Report on leave : FALSE Hysteresis : [2d] 1 dB Time to trigger : ms320 ms Trigger quantity : rsrp Report quantity : sameAsTriggerQuantity Maximum of Reported Cells : 4 Report interval : 240 ms Report Amount : infinity element : Report configuration ID : 2 Report configuration : reportConfigEUTRA Report configuration EUTRA : Trigger type : event Event : Measurement event identity : A3 Event A3 : Offset event A3 : [-20d] -10 dB Report on leave : TRUE Hysteresis : [4d] 2 dB Time to trigger : ms640 ms Trigger quantity : rsrp Report quantity : both Maximum of Reported Cells : 8 Report interval : 5120 ms

Report Amount : r1 (…) Measurement identity list : 7 Measurement ID : 1 Measurement object ID : 1 Report configuration ID : 1 Measurement ID : 2 Measurement object ID : 1 Report configuration ID : 2 (…) Measurement gap configuration : setup setup : Gap offset : gp0 gp0 : 17 Figure 4-60. Part of a RRC Connection Reconfiguration message that includes the measurement configuration information decoded in NQView.

Another format of the RRC Connection Reconfiguration message includes the mobility control information (see Figure 4-61). The mobility control information informs the mobile station about the frequency of the target cell and various physical channel configuration of common (e.g., RACH, PUSCH and PUCCH) and dedicated channels of the target cell. 26.07.2001 16:03:26.555 D LTE DL_DCCH_Message : Message : c1 rrcConnectionReconfiguration : RRC transaction identifier : 1 Critical extensions : c1 RRCConnectionReconfiguration R8 : Mobility Control Info : Target Physical Cell ID : 237 Carrier Frequency (EARFCN) : DL EARFCN : 1849 UL EARFCN : 19849 T304 : 1000 ms New UE identity Length : 16 New UE identity : 2A29 Radio resource configuration common : PRACH configuration : RACH_ROOT_SEQUENCE : 210 PRACH configuration information : PRACH configuration index : 3 High speed flag : Unrestricted set Ncs configuration : 11 PRACH frequency offset : 8 PUSCH configuration common : PUSCH basic configuration : Number of sub-bands Nsb : 4 Hopping-mode : inter sub-frame PUSCH hopping offset : 22 64 QAM enabled : TRUE UL reference signals PUSCH : Group-hopping-enabled : FALSE

RRCConnectionReconfiguration

Group assignment PUSCH : 0 Sequence-hopping-enabled : FALSE Cyclic shift : 0 PUCCH configuration common : Delta PUCCH-shift : 1 Nrb : 4 Ncs : 0 Npucch : 54 UL cyclic prefix length : normal CP rach_ConfigDedicated : ra_PreambleIndex : 63 ra_PRACH_MaskIndex : 0 Radio resource configuration dedicated : MAC main configuration : explicitValue explicitValue : DRX configuration : release Time alignment timer : 10240 sub frames PHR configuration : setup setup : Periodic PHR timer : 100 sub frames Prohibit PHR timer : 100 sub frames DL pathloss change : 1 dB Physical configuration dedicated : CQI report configuration : Aperiodic reporting mode : Mode 3-0 Nominal PDSCH-to-RS-EPRE-offset : 0 dB Periodic CQI reporting : release Antenna information : explicitValue explicitValue : Transmission mode : 2 UE transmit antenna selection : release Scheduling request configuration : setup setup : SR PUCCH resource index : 4 SR configuration index : 15 Maximum SR transmissions : 64 Security configuration HO : Handover type : Intra LTE Intra LTE : securityAlgorithmConfig : cipheringAlgorithm : eea2 integrityProtAlgorithm : eia2 Key change indicator : FALSE Next hop chaining count : 0 Figure 4-61. Part of a RRC Connection Reconfiguration message that includes the mobility control information decoded in NQView.

Upon the reception of the RRC Connection Reconfiguration message, the mobile station replies with the RRC Connection Reconfiguration Complete message (see Figure 4-62). This message is used to confirm the successful completion of an RRC connection reconfiguration.

26.07.2001 16:03:25.459 U LTE RRCConnectionReconfigurationComplete UL_DCCH_Message : Message : c1 rrcConnectionReconfigurationComplete : RRC transaction identifier : 1 Critical extensions : rrcConnectionReconfigurationComplete_r8 rrcConnectionReconfigurationComplete_r8 : Figure 4-62. Part of a RRC Connection Reconfiguration Complete message decoded in NQView.

Then, the mobile station reports the conducted measurements to the network using the Measurement Report message (see Figure 4-63). The reported measurements are determined by the information received in the RRC Connection Reconfiguration message. The measurement reports are identified by the measurement ID indicated in the RRC Connection Reconfiguration (see Figure 4-60) that for the message shown in Figure 4-63 is the “Measurement ID 2”. As it can be appreciated in Figure 4-60, this measurement ID is associated to the ‘Measurement object ID : 1’ and ‘Report configuration ID : 2’. The measurement object ID 1 is associated to the serving cell that at this point in time is the PCI 246 (EARFCN = 1849). The Report configuration ID 2 is associated to the Event A3 (i.e., a neighboring cell becomes better than the serving cell by an offset) with the offset being configured to -10 dB. There is a hysteresis level of 2dB and time to trigger of 640ms. This means the offset + hysteresis needs to be maintained by more than these 640ms. If these conditions are met, the mobile station generates a measurement report with the RSRP and RSRQ measurements of both cells so that the network can decide whether to execute the handover or not. Figure 4-64 and Figure 4-65 show a bar graph with the RSRP levels of the service cell (SC) and neighboring cells (NC); this graph is available as a LTE Serving and Neighbors monitor in NQView (see Section 3.3) and let us see that the mobile station has changed the serving cell as a result of the transmitted Measurement Report message. 26.07.2001 16:03:26.155 U LTE LTE RRC UL_DCCH_Message : Message : c1 Measurement Report : Critical extensions : c1 Measurement Report R8 : Measurement results : Measurement ID : 2 Measurement results serving cell : RSRP : [44d] -96 dBm RSRQ : [7d] -16 dB Measurement results neighbor cells : measResultListEUTRA Measurement results list E-UTRA : 1 Measurement : Physical cell ID : 237 Measurement result : RSRP : [45d] -95 dBm RSRQ : [13d] -13 dB

MeasurementReport

-------------------------------------------------------------------------------------------------------------------------26.07.2001 16:03:26.500 U UL_DCCH_Message : Message : c1 Measurement Report : Critical extensions : c1 Measurement Report R8 : Measurement results : Measurement ID : 1 Measurement results serving cell : RSRP : [41d] -99 dBm

LTE

LTE RRC

MeasurementReport

RSRQ : [2d] -18.5 dB Measurement results neighbor cells : measResultListEUTRA Measurement results list E-UTRA : 1 Measurement : Physical cell ID : 237 Measurement result : RSRP : [47d] -93 dBm

Figure 4-63. Part of a Measurement Report message decoded in NQView.

Figure 4-64. LTE Serving and Neighbors monitor available in NQView (1).

Figure 4-65. LTE Serving and Neighbors monitor available in NQView (2).

The mobile station is informed about the performed handover via the RRC Connection Reconfiguration message (see Figure 4-66). Note that in this message the cell with PCI 237 is reported in the first index while the PCI 246 is reported as the fourth index. This is the case in intra LTE handovers where the RRC Connection Reconfiguration message acts as a handover command. At the network side, the X2 interface between the two base stations/cells is used to send a handover request message from the source base station (PCI 246) to the target cell (PCI 237) in order to make it ready for the coming handover. 26.07.2001 16:03:26.751 D LTE LTE RRCConnectionReconfiguration DL_DCCH_Message : Message : c1 rrcConnectionReconfiguration : RRC transaction identifier : 3 Critical extensions : c1 RRCConnectionReconfiguration R8 : Measurement configuration : measObjectToRemoveList : MeasObjectId [0] : 1 Measurement object list : 1 element : Measurement object ID : 2 Measurement object : measObjectEUTRA Measurement object E-UTRA : Carrier Frequency (EARFCN) : 1849 Allowed measurement bandwidth : [75d] 75 RB Presence of antenna port 1 : FALSE Neighbor Cell Configuration Length : 2 Neighbor Cell Configuration : [1h] 1 Carrier offset : 0 dB cellsToAddModList : 7 [0] cellsToAddModList : element : cellIndex : 1 Physical cell ID : 237 Cell individual offset : 0 dB [1] cellsToAddModList : element : cellIndex : 2 Physical cell ID : 239 Cell individual offset : 0 dB [2] cellsToAddModList : element : cellIndex : 3 Physical cell ID : 238 Cell individual offset : 0 dB [3] cellsToAddModList : element : cellIndex : 4 Physical cell ID : 246 Cell individual offset : 0 dB Figure 4-66. Part of a Measurement Report message decoded in NQView.

RRC

4.4. Variation of LTE parameters during data download 4.4.1. Testing environment and QualiPoc configuration The field tests to analyze the variation of LTE parameters in a data connection (DL connection in this case) are conducted in the scenario shown in Figure 4-67. The mobile station is located close to the base station with identifier VAL5716 at the beginning of the tests. At this point in time, it is detected that the LTE’s base station information is EARFCN/PCI = 1849/264. This EARFCN corresponds to the LTE FDD Band 3 at 1.8GHz. When the tests start, the mobile station moves towards the Avenida de la Universidad through Carrer Cayetano Martinez. The test ends when the mobile station reaches the Altabix square. These tests are then aimed at analyzing the impact of the distance on the LTE performance. It should be noted that the mobile station could hand the data connection over to a neighboring base station when the performance with the VAL5716 base station degrades. To avoid that, additional tests are also conducted in which the mobile station is locked to the VAL5716 base station. To this aim, the QualiPoc terminal is configured to be always connected to the EARFCN/PCI = 1849/264 regardless of the signal quality of this and surrounding base stations.

VAL5716

Figure 4-67. Part of a Measurement Report message decoded in NQView.

4.4.2. Analysis of the obtained results The LTE achievable performance in DL data connections can be analyzed in NQView using the predefined Pages | Device Pages | LTE DL Data (see Section 3.4.1). This Device Page includes a set of list and chart monitors that report the suitable metrics to analyze the LTE DL performance. First, the LTE Cell Monitor (Figure 4-68) shows information about the LTE cell the mobile station is connected to: • EARFCN (E-UTRA Absolute Radio Frequency Channel Number) for the DL and UL connection. See Table 2-1 to identify how the channel number is mapped to the E-UTRA operating band and frequency band. For the case shown in Figure 4-68, both the DL and UL operates in the Band 3 where the DL frequency starts at 1805 MHz and the UL frequency at 1710 MHz. • Bandwidth (in MHz) shown the spectrum allocated for the LTEDL and UL transmissions. Figure 4-68 shows that 20 MHz are allocated in this case for both DL and UL. • PhyCellId is the physical layer cell id or PCI. and the LTE Channel: • 3GPP Band, which as shown above is the Band 3 for these EARFCNs. • Num Tx Antennas refers to the number of antennas that are used to transmit different data streams. LTE can use 2x2 MIMO technology which indicates that two different data streams are transmitted on the two Tx antennas and received by the two Rx antennas. This increases the overall throughput/bitrate. These multiple antennas can also be used to increase the spatial diversity. • QRxLevMin (in dBm) is the minimum required received level in the cell and that is reported by the SIB1. The mobile station uses this value for the cell selection/reselection criterion as it has been shown in Section 4.2 and Section 2.5.1.1.3. • P Max displays maximum TX power a UE is allowed to use in the cell. • SIntraSearch displays the threshold for intra-frequency measurements. • SNonIntraSearch displays the threshold for E-UTRAN inter-frequency and inter-RAT measurements. • SRxLev displays the cell selection criterion S (see Section 4.2 and Section 2.5.1.1.3). • Max UE Tx Pwr displays maximum TX power of the UE according to the power class.

Figure 4-68. LTE DL Data Device page: LTE Cell Monitor.

The predefined Pages | Device Pages | LTE DL Data also includes an LTE DL HARQ Info Monitor (Figure 4-69) that reports statistics about the DL HARQ process. In particular, this monitor shows over the reporting period (see Num Records below):

• • • • • • •

Num TBs or the number of Transport Blocks that have been transmitted in the DL. New Data indicates the percentage of the downloaded TBs which are newly TBs, i.e., that are not retransmitted. Passed First shows the percentage of TBs that are correctly received in the first transmission. {1, 2, 3} ReTx show the percentage of TBs that required 1, 2 or 3 retransmissions. BLER shows the percentage (rounded integer part) of TBs that are reported with a Non ACK to the total amount of transmitted TBs. Note that the BLER is the complementary part of the New Data percentage. Residual BLER is the percentage of TBs that are not correctly received after the 3 HARQ retransmissions. FER shows at the link level the percentage of frames that are received with error.

Figure 4-69. LTE DL Data Device page: LTE DL Harq Info Monitor.

Then, the LTE PDSCH Info Monitor shows information related to the Physical Downlink Shared Channel (PDSCH) which carriers the user data (Figure 4-70). This monitor shows, for each reporting period, DL Resource Blocks Allocation Info: • Num Records shows the number of read PDSCH records with correspond to the number of radio sub frames. Note that each LTE subframe has a length of 1ms. • Num RBs shows the number of RBs that are used for the DL transmission over the read Num Records. • Max RBs SubFrame indicates what is the maximum number of RBs available in a subframe. This depends on the available BW. In particular, the Max RBs SubFrame is {6, 12, 25, 50, 75, 100} when the available BW is {1.25, 2.5, 5, 10, 15, 20} MHz. Since the LTE cell the mobile station is connected to has 20 MHz bandwidth, the Max RBs SubFrame is 100. • Min RBs SubFrame indicates what is the minimum number of RBs that the mobile station could be allocated in a subframe. • Avg RBs SubFrame shows what is the average number of RBs that are allocated to the mobile station over the Num Records. DL Transport Blocks Info: • Num TBs indicates the number of downloaded transport blocks over the reporting period. Note that as reported in 3GPP TS 36.213, Table 7.1.7.2.*, a TB can occupy multiple RBs. The number of needed RBs to transmit a TB is determined by the Transport Block Size Index (ITBS) which is related to the Modulation and Coding Scheme Index (IMCS), and therefor to the link quality between the mobile station and the base station. • TB Rate (in TB/sec) is the rate of Transport Blocks received by the MAC layer over the last second. • Max TB Size (in Bits) shows the largest TB transmitted over the reporting period. • Min TB Size (in Bits) shows the smallest TB transmitted over the reporting period.

•

Avg TB Size (in Bits) shows the average size of the TBs transmitted over the reporting period. • Sum TB Data is the accumulative sum (in Bits) of the Num TBs transmitted over the reporting period. DL MIMO and Modulation Info: • Transmission Mode shows the LTE DL MIMO transmission mode which for this case is Close Loop Spatial Multiplexing (CL SM). • Max Num Layers shows the number of MIMO layers used in the downlink transmissions. In the end, this shows the number of spatial streams that are simultaneously transmitted in the downlink. • Avg MCS Index indicates what is the average IMCS that the mobile station reports to the base station. The IMCS varies between 0 and 31 with the highest index being related to the highest modulation order. Then, the mobile station reports highest IMCS to the base station when it identifies good channel conditions with the base station. • QPSK, 16QAM, 64QAM Rates indicate the percentage of DL transmissions that are performed using QPSK, 16QAM and 64QAM over the reporting period.

Figure 4-70. LTE DL Data Device page: LTE PDSCH Monitor.

In addition, the predefined Pages | Device Pages | LTE DL Data also includes a monitor with information about the LTE PDSCH Throughput (Figure 4-71). This monitor shows: • CQI 0 and 1 that are the downlink SNR to CQI mapping over the antennas 0 and 1. • Transport Block Size is the average size (in Bits) of the transport block over the last reported period. • Scheduled Throughput (in Kbps) that is the sum of transport block data over the reported time period. • PDSCH Throughput (in Kbps) is the sum of transport block data that are correctly received over the reported time period.

Figure 4-71. LTE DL Data Device page: LTE PDSCH Throughput Monitor.

Finally, Figure 4-72 and Figure 4-73 reports a set of the previously defined parameters using a line chart. In particular, Figure 4-72 shows the Max RBs SubFrame, TB Rate, Avg RBs SubFrame, BLER and Avg MCS Index, and Figure 4-73 reports the Sched PDSCH Throughput, PDSCH Throughput, and CQI0 and CQI1.

Figure 4-72. LTE DL Data Device page: LTE PDSCH Scheduling chart Monitor.

Figure 4-73. LTE DL Data Device page: LTE PDSCH Throughput Line chart Monitor.

The previously introduced predefined parameters that appear in the Pages | Device Pages | LTE DL Data are good Key Performance Indicators (KPIs) to analyze the LTE DL performance. It is

possible to represent these parameters using a different format though. For example, the following two figures (i.e., Figure 4-74 and Figure 4-75) have been created using an empty line chart (Monitors | General Monitors | Line chart) and adding the Avg MCS Index value to it. Note that each of the line graphs is created using the logged data of the two different tests when the mobile station is not forced and forced to the LTE base station (EARFCN/PCI = 1849/264). Once all parameters have been introduced, let’s start the analysis of the LTE DL performance by comparing Figure 4-74 and Figure 4-75. These figures show the Avg MCS Index that varies between 0 and 31 for LTE. The two figures show group of approx. 50 seconds measurements and sudden drop of the values (e.g., first group from approx. 13:03:30 to 13:04:20 in Figure 4-74, and from 13:10:20 to 13:11:10 in Figure 4-75). This is because the QualiPoc job completes the download of the selected file and then it stops for 15 seconds and performs a new download of the same file (see the QualiPoc configuration in Section 2.3.2). For the first group of measurements we can only see slight differences between the Avg MCS Index of the two tests. This makes sense since the mobile station is initially connected to the base station that is most suitable to perform the download. This can be appreciated in Figure 4-76 that shows the PCI the mobile station is connect to during the tests. Figure 4-76.a) shows that the mobile station is mostly connected to the PCI 264 util time instant 13:04:30. Then, it continues the download from the base station with PCI 70 most of the time. On the other hand, Figure 4-76.b) shows that when the mobile station is forced to the base station it performs all the download from the same base station (PCI 264 in this case). Then, the differences between Figure 4-74 and Figure 4-75 start in the second group of values (i.e., when the mobile station that is not forced has handed over to the base station with PCI 70). The mobile station keeps reporting similar Avg MCS Index values to the base station when it is not forced (Figure 4-74). On the other hand, when the mobile station is forced to the base station it starts reporting lower MCS Index values because the link quality is getting worse, and it cannot hand the connection over to a neighboring base station (Figure 4-75). In addition, it should be noted that the Figure 4-74 shows a third set of measurements that start approx. at 13:05:50. This set is not present in Figure 4-75 because the mobile station is already experiencing bad signal connection to the base station and then it reports very low Avg MCS Index values.

Figure 4-74. LTE Avg MCS Index: not forced.

Figure 4-75. LTE Avg MCS Index: forced.

(a)

(b)

Figure 4-76. PCI: (a) not forced, (b) forced .

Figure 4-77 and Figure 4-78 show the HARQ performance when the mobile station is not forced and when it is forced to the base station, respectively. Each figure includes the ratio of packets that are correctly received without retransmissions (i.e., ‘passed first’), and those that needed 1, 2

and 3 retransmissions. At this point in time, it is important to note that LTE generally seeks obtaining a 10% BLER, which can be appreciated in both figures with the plot of the 1 ReTx. This should be taken as a normal operation of LTE that has shown to improve its performance. Note that Figure 4-77 shows that this happens during the complete test when the mobile station is not forced to the mobile station. Higher peaks of 1 ReTx are appreciated in Figure 4-78 at the end of the second group of measurements. As it has been explained above, this is the case because from this time instant on the mobile station is connected to a base station (PCI 264) that is not the most suitable to perform the download and then it cannot provide normal LTE performance. Also note that from time instant 13:12:15 the HARQ process requires to perform more retransmissions. On the other hand, when the mobile station is not forced to the base station (Figure 4-77), the download is performed from the best base station at each point in time, and then the HARQ process looks similar from the start to the end of the test.

Figure 4-77. HARQ process when the mobile station is not forced.

Figure 4-78. HARQ process when the mobile station is forced.

Other interesting metrics that can help understanding the performance of the LTE download are the utilized modulation schemes. Figure 4-79 and Figure 4-80 show the rate of QPSK, 16QAM and 64QAM utilized in the download transmissions when the mobile station is not forced to the base station and when it is forced to the base station, respectively. 64QAM is the highest modulation scheme available (for this LTE release) and then the one that is expected to be used when the DL link experiences better signal conditions. In fact, both figures show that the downloads use most of the time this modulation scheme during the first group of measurements. Then, there are again differences between the two figures in the second group of measurements. While Figure 4-79 shows that the download uses most of the time the 64QAM modulation scheme

(there is a period between 13:04:50 and 13:05 when 16QAM is mostly used), Figure 4-80 shows that in this second group the data download performed using 16QAM most of the time. Then, the third group of measurements show that when the mobile station was not forced to the base station the download transmissions were mostly performed using 16QAM. This is because of the lower link quality (or MCS Index) the mobile station reported to the base station as it can be appreciated in Figure 4-74. On the other hand, Figure 4-80 shows that the bad connection between the mobile station and the base station (PCI 264) results in that the download transmissions are mostly performed using QPSK.

Figure 4-79. Rate of QPSK,.16QAM and 64QAM when the mobile station is not forced.

Figure 4-80. Rate of QPSK,.16QAM and 64QAM when the mobile station is forced.

All previous metrics can be utilized to identify the obtained LTE DL performance which is measured in terms of the throughput. Figure 4-81 and Figure 4-82 show the scheduled and net throughput measured in the PDSCH when the mobile station is not forced to the base station and when it is forced, respectively. Based on the previous analysis, one could expect a better LTE DL performance in the test conducted when the mobile station in not forced to the mobile station. However, if we compare Figure 4-81 and Figure 4-82, we can see that for the first two groups of measurements that higher throughput values are experienced in Figure 4-82. Of course, Figure 4-81 shows a third set of throughput measurements that is not present in Figure 4-82 because at this point the link quality between the base station (PCI 264) and the mobile was very low. A thorough analysis of additional parameters can also help understanding the obtained throughput measurements of the two first groups of measurements. To this aim, we need to take into account an additional element that can highly impact the LTE DL performance and that is the number of allocated resources (i.e., RBs) to perform the downlink transmissions. This is represented in Figure 4-83 and Figure 4-84 for the tests conducted when the mobile station is nor forced and when it is forced to the base station. The allocation of RBs to perform the downlink transmission is determined by the scheduling policy that is implemented by the operator and it is usually not publicly released. This policy may take into account the link quality reported by the mobile

station, but it could also consider other factors like the network load (i.e., whether there are other users in the cell that are also requesting resources), and it could also seek compensate users that are experiencing lower link quality levels. Operators (usually) do not provide information about their scheduling policies, but the logged measurements in Figure 4-83 and Figure 4-84 clearly show that the DL transmissions to the mobile station that was forced to the mobile station have received a higher number of RBs than the DL transmissions to the mobile station that was not forced to the base station. This justifies why Figure 4-82 shows higher throughput levels for this DL transmissions.

Figure 4-81. BLER and PDSCH Throughput when the mobile station is not forced.

Figure 4-82. BLER and PDSCH Throughput when the mobile station is forced.

Figure 4-83. Num RBs when the mobile station is not forced.

Figure 4-84. Num RBs when the mobile station is forced.

.

Appendix I. QualiPoc

Quick guide to launch/use

• Select the QualiPoc icon from the Android’s desktop or Menu window. If the location service is not enabled on the host smartphone, QualiPoc will prompt a message in case the information is necessary for the tests to be conducted. When the location service is enabled, QualiPoc detects automatically the internal GPS (if it is configured to use it). • Check that the connections (e.g., mobile data) that are going to be tested are enabled on the host smartphone. • To use a Job, load or create a new job by selecting ⋮ | Jobs. In the Job Settings menu select ⋮ | [Create new job | Load job]. Start a job by touching the big green button at the bottom of the screen “”Start job”. • Navigate through the different monitors by sliding up/down/left/right through the different windows. Touch the value of a network parameter to see its history or evolution, or a signaling message to decode its content. • While QualiPoc is recording, the smartphone can be used to make voice/video calls, send SMS/MMS messages, etc. Use the smartphone ‘Home’ and ‘Recents’ buttons to switch between different Android’s applications. • QualiPoc finishes automatically the job when all the programmed tests are completed. The user can also stop the job by selecting ⋮ | Stop Job. The measurement file is automatically saved on the phone memory. • Extract the measurement file for post-processing and analysis, or play it back with NQDI or NQView.

Appendix II.

Terms Index

BLER .................... 33, 151, 154, 156, 159 BTS6, 7, 8, 9, 15, 30, 44, 45, 60, 79, 80, 84, 166, 167, 168, 169 CCCH (Common Control Channel) .... 105 Ciphering key ...................................... 107 DPCH (Dedicated Physical Channel) .. 114 EARFCN9, 13, 29, 32, 51, 63, 91, 136, 143, 144, 146, 148, 149, 150, 154 E-UTRA (Evolved Universal Terrestrial Radio Access) .................................................... 1 FTP ................ 3, 10, 14, 18, 19, 20, 40, 53 GPS3, 5, 7, 13, 28, 29, 36, 38, 43, 48, 49, 50, 59, 76, 81, 84, 85, 86, 98, 108, 132, 135, 139, 141, 161 HSPA ......................................... 3, 97, 170 KPI (Key Performance Indicator).......... 54 LTE1, 3, 5, 8, 9, 10, 11, 12, 13, 27, 28, 29, 30, 32, 33, 34, 35, 36, 39, 47, 48, 49, 50, 56, 57, 63, 66, 68, 70, 80, 83, 86, 87, 88, 90, 91, 93, 97, 98, 100, 101, 102, 103, 104, 118, 119, 120, 124, 125, 126, 131, 133, 136, 137, 138, 140, 141, 142, 143, 144,145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 166, 170 Mobile station classmark ..................... 107 Modulation and Coding Scheme ... 33, 152 NAS (Non-Access Stratum) ................ 126 NQView1, 3, 13, 52, 53, 54, 55, 56, 57, 59, 60, 61, 62, 63, 65, 66, 67, 68, 72, 76, 79, 80, 82, 83,

84, 85, 89, 90, 91, 92, 94, 97, 100, 101, 102, 103, 104, 105, 106, 108, 109, 110, 111, 113, 116, 117, 119, 120, 121, 123, 124, 125, 126, 127, 128, 130, 132, 135,136, 138, 141, 144, 146, 147, 148, 149, 150, 161, 166, 168 PDSCH5, 29, 33, 34, 48, 49, 56, 60, 72, 74, 76, 145, 152, 153, 154, 158, 159 PICH (Pilot Channel) .......................... 129 QualiPoc1, 3, 4, 5, 6, 7, 8, 10, 11, 12, 13, 14, 15, 16, 18, 20, 24, 25, 26, 27, 28, 38, 39, 40, 41, 43, 44, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 58, 76, 79, 97, 98, 99, 100, 101, 117, 119, 122, 125, 126, 131, 134, 135, 139, 140, 141, 149, 154, 161 RB ............................30, 33, 111, 143, 148 Rohde & Schwarz ................................... 3 RSRP5, 11, 30, 32, 46, 49, 50, 51, 58, 63, 68, 70, 74, 76, 93, 134, 136, 137, 138, 142, 146, 147 SF (Spreading Factor) ......................... 105 SIB (System Information Block) ........ 130 TB ................................... 33, 35, 152, 153 TBs ..........................33, 35, 129, 151, 152 TI (Transaction Identifier) .................. 111 TMSI (Temporal Mobile Subscriber Identity) ............................................................ 107 UMTS3, 97, 100, 102, 103, 112, 124, 140, 170 Universidad Miguel Hernandez (UMH) . 1 URA (UTRAN Registration Area)...... 127 Workspace ............................................ 55

Appendix III.

CQI table

LTE CQI tables9: CQI Table 1 CQI index 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

modulation QPSK QPSK QPSK QPSK QPSK QPSK 16QAM 16QAM 16QAM 64QAM 64QAM 64QAM 64QAM 64QAM 64QAM

code rate x 1024 out of range 78 120 193 308 449 602 378 490 616 466 567 666 772 873 948

efficiency 0.1523 0.2344 0.3770 0.6016 0.8770 1.1758 1.4766 1.9141 2.4063 2.7305 3.3223 3.9023 4.5234 5.1152 5.5547

CQI Table 2 CQI index 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

modulation QPSK QPSK QPSK 16QAM 16QAM 16QAM 64QAM 64QAM 64QAM 64QAM 64QAM 256QAM 256QAM 256QAM 256QAM

code rate x 1024 out of range 78 193 449 378 490 616 466 567 666 772 873 711 797 885 948

efficiency 0.1523 0.3770 0.8770 1.4766 1.9141 2.4063 2.7305 3.3223 3.9023 4.5234 5.1152 5.5547 6.2266 6.9141 7.4063

Appendix IV. NQView: Import BTS List To show the base stations on a Map monitor, it is first needed to import the base station information to NQView. This Appendix shows the procedure to do that. The example used in this Appendix consists of importing a list of LTE base stations located in Elche, whose data is shown in Figure IV-1.

Figure IV-1. Base stations data to be imported.

1. Select a technology for the base station in Data Presentation | Configure BTS list | [Technology]. In our example [Technology] is equal to LTE in order to open LTE BTS List window (Figure IV-2).

Figure IV-2. LTE BTS List window.

2. Click Import to open the Import BTS window (Figure IV-3) 3. (Optional) Select an Operator in the list. 4. In the Coordinate source format area, click the format of the BTS file. a. X99-99-99: Where X is North (N), South (S), East (E), or West (W) and 99-9999 is degrees-minutes-seconds, for example, LON = W0.42.45 and LAT N38.16.12

b. 99.9999: Longitude and latitude in positive or negative numeric values, for example, LON = 38.27 and LAT = -0.68. This one is our case for the example.

Figure IV-3. Import BTS window.

5. Click Open BTS File to locate the file with the BTS information (see Figure IV-4), and then click Open.

Figure IV-4. Open BTS file.

6. In the Delimited ASCII Information dialog box (Figure IV-5), click the options that apply to the format of the BTS list data in the file (in our example is Comma), and then click Ok.

Figure IV-5. Delimited ASCII information.

7. Match the fields in the file to the corresponding NQView fields. a. In the Import BTS window (Figure IV-3), click Assign Fields. b. In the Field Assignment dialog box (Figure IV-6), match each empty NQView field (in our example CID and PhyCID fields) on the right with the corresponding field in the BTS list. Drag the corresponding field from the left to the empty field on the right (see Figure IV-6).

Figure IV-6. Field Assignment dialog box.

8. Click Ok in the Field Assignment dialog box and finally click Import in the Import BTS window (Figure IV-7).

Figure IV-7. Importing base station data in the Import BTS window

1

H. Holma and A. Toskala, “WCDMA for UMTS: HSPA Evolution and LTE”, Ed. John Wiley and Sons, 2010. 2 H. Kaaranen, A. Ahtiainen, L. Laitinen, S. Naghian and V. Niemi, “UMTS Networks: Architecture, Mobility and Services”, Ed. Wiley, 2nd edition, 2005. 3

B. Coll-Perales, M. Sepulcre and J. Gozalvez, "Uso de Herramientas Profesionales para una Docencia Práctica de Sistemas de Ingeniería de Telecomunicación", Libro de Actas del XX Congreso Universitario de Innovación Educativa en las Enseñanzas Técnicas (CUIEET), 18-20 july 2012, Las Palmas de Gran Canaria. 4 B. Coll-Perales, M. Sepulcre and J. Gozalvez, “Innovative Mobile Communications Engineering Teaching Laboratory using Professional Network Testing Tools”, Proceedings of the 3rd Annual International Conference on Education and New Learning Technologies (EDULEARN’11), 4-6 July 2011, Barcelona (Spain). 5 B. Coll-Perales, M. Sepulcre and J. Gozalvez, “Monitoring the Performance and Operation of Cellular Radio Interfaces using Professional Measurement Tools”, Ed. Universidad Miguel Hernandez de Elche, 2014. 6 3rd Generation Partnership Project;Technical Specification Group Radio Access Network; Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) radio transmission and reception; (3GPP TS 36.101 V16.6.0; Extract from Table 5.7.3-1: E-UTRA channel numbers) 7 3rd Generation Partnership Project; Technical Specification Group Radio Access Network; Evolved Universal Terrestrial Radio Access (E-UTRA); Physical layer; Measurements (3GPP TS 36.214 V16.0.0) 8 3rd Generation Partnership Project; Technical Specification Group Radio Access Network; Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode (3GPP TS 36.304) 9 3rd Generation Partnership Project; Technical Specification Group Radio Access Network; Evolved Universal Terrestrial Radio Access (E-UTRA); Physical layer procedures (3GPP TS 36.213 V12.13.0 Release 12) 10 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Circuit Switched (CS) fallback in Evolved Packet System (EPS); (3GPP TS 23.272 V16.0.0 Release 16) 11 E. Dahlman, S. Parkvall and J. Sköld, “4G: LTE/LTE-Advanced for Mobile Broadband”, Ed. Elsevier, 2014.