UL Throughput Troubleshooting in LTE

Several are the conditions that produce low throughput in the uplink. This post shows a simple flowchart that attempts to guide you while troubleshooting cells with poor performance in the uplink. Note that the flowchart is not comprehensive but rather an informative guide for you to start.

Reference: LTEuniversity.com

DL Throughput troubleshooting in LTE

Several are the conditions that produce low throughput in the downlink. This post shows a simple flowchart that attempts to guide you while troubleshooting cells with poor performance in the downlink. Note that the flowchart is not comprehensive but rather an informative guide for you to start.

Reference: LTEuniversity.com

RRC Connection Release Message Causes

Often while doing a drive test the RRC collection released gets logged by our data collection tools and later, while debugging our drive tests we see, RRC connection Release. Many times we wonder why we received that message. Is it because we finished our 500 GB file download? Did we unintentionally press a button and we ended the call? What happened?

There are many cases where and when the UE receives an RRC connection release:

a)     Going to idle mode: In this case, the UE will receive an RRC connection release from the eNodeB due to the expiration of the inactivity timer (in most networks configured to approximately 10 seconds).

Release Cause: User Inactivity

b)    Drop Call: RLC Failure: When the number of retransmissions at the RLC layer in the Downlink direction reaches its maximum value given by the parameter MaxRetxThreshold, the eNodeB releases the context and sends an RRC connection release to the UE.

Release Cause: Other.

c)     Drop Call: RRC Connection Reestablishment Reject: Either because the feature is not adopted or because a race condition occurred in which the case just presented happened first, the eNodeB responds with a RRC connection reestablishment reject to the UE.

Release Cause: Other.

d)    Tracking Area Update: During a successful tracking area update, the eNodeB will send an RRC connection release to the UE after sending a tracking area update message (from the MME) when no new GUTI is allocated or after the tracking area update complete message is received from the UE, if it received a new GUTI.

Release Cause: Other.

e) Redirection or CSFB to UTRAN:

If the UE is performing CSFB, it will fall back to UTRAN after receiving RRC Connection Release message that includes the target frequency of UTRAN.

Release Cause: Other

e)     During Detach: Either during normal detach or abnormal detach, both by an UE initiated detach or network initiated detach, the UE receives an RRC connection Release from the network. Elements in the Network that may cause a detach message sent from the MME to the UE are:

1. Expiration of timers at the P-GW for the last bearer the UE had, capacity issues or errors.
2. Errors or Capacity issues at the S-GW
3. Expiration of timers at the MME (t3412) without TAU, errors at the MME, configuration problems, etc.

Release Cause: Other or Normal.

Given the above, the RRC connection release message is caused by many reasons. Before arriving to a conclusion just by analyzing a simple UE logfile, a cell trace or MME trace analysis is required to arrive to sounded conclusions.

IMSI, TMSI & GUTI definitions in LTE

A unique International Mobile Subscriber Identity (IMSI) shall be allocated to each mobile subscriber in every (GSM, UMTS, and EPS) system. In order to support the subscriber identity confidentiality service the VLRs, SGSNs and MMEs may allocate Temporary Mobile Subscriber Identities (TIMSI) to visiting mobile subscribers. The VLR, SGSN, and MME must be capable of correlating an allocated TIMSI with the IMSI of the Mobile Station (MS) to which it is allocated.

A UE may be allocated three TMSIs, one for services provided through the MSC, one for services provided through the SGSN (P-TIMSI for short) and one for the services provided via the MME (M-TIMSI which is part of GUTI).

Composition of IMSI

IMSI is composed of three parts, as shown in Fig. 1.

Fig. 1. IMSI structure

1. Mobile Country Code (MCC) consisting of three digits. The MSS identifies uniquely the country of domicile of mobile subscriber. 
2. Mobile Network Code (MNC) consisting of two or three digits for GSM/UMTS applications.  That's why, if you are close to your country border UE is still using eNodeBs that belongs/are controled by Mobile Operator from your country. In other words .. the MNC identifies the home PLMN of the mobile subscriber. The length of the MNC (two or three digits) depends on the value of the MCC. A mixture of two and three digit MNC codes within a single MCC area is not recommended according to 3GPP specification.
3. Mobile Subscriber Identification Number (MSIN) identifying the mobile subscriber within a PLMN.

In Fig. 1. there is also shown NMSI entity. The National Mobile Subscriber Identity (NMSI) consists of the MNC and the NMSI.

The 3GPP spec is also saying, that allocation of IMSIs should be such that not more than MCC +MNC number of digits have to be analysed in a foregin PLMN for information transfer. Just to make roaming a little bit more easier.

Temporary Mobile Subscriber Identity (TMSI)

Since the Temporary Mobile Subscriber Identity (TMSI) has only local significance (in VLR/SGSN/MME and area controlled by VLR/SGSN/MME), the structure and coding of it can be chosen by agreement between operator and ME manufacturer in order to meet local needs. The TMSI is used instead of IMSI to protect subscriber from being identified and also make life more difficult to radio interface eavesdroppers.
The TMSI consists of 4 octets. It can be coded using a hexadecimal representation. The network shall not allocate a TMSI with all 32 bits equal to 1, because TMSI must be stored in the SIM, and SIM uses 4 octets with all bits equal to 1 to indicate that no valid TMSI is available.
In order to avoid problems such as double allocation of TMSIs after a restart of an allocationg node, some part of the TMSI may be related to the time when it was allocated or TMSI can contain a bit field which is changed when the allocating node has recovered from the restart.

In other words TMSI is being hold by VLR and is not passed to HLR. The TMSI is used mostly in Paging situations. Where Paging is used by network to request the establishment of NAS signaling connection to UE. The NAS signaling connection after being established can also be used in process of sending signaling messages to UE. Paging procedure can also be used to prompt UE to reattach itself to the network if needed.

Globally Unique Temporary UE Identity (GUTI )
The purporse of the GUTI is to provide an unambiguous identification of the UE that does not reveal the UE or the user's permanent identity in the Evolved Packet System (EPS). It also allows the identification of the MME and network. It can be used by network and the UE to establish UE's identity during signaling between them in EPS.
On GUTI consist two main components:

• GUMMEI - that uniquely identifies the MME which has allocated the GUTI
• M-TMSI - other that uniquely identifies the UE within the MME because of allocated the GUTI

Because of that when UE is contacting the network it sends the GUTI to the eNodeB which then uses the GUTI number to identify to which MME re-establish request will be send. If the UE has moved from UMTS cell to LTE cell, a TAU procedure is made (because UE does not have its GUTI) and P-TMSI is send. By this way MME, which is in control of area to which UE moved to, can contact SGSN, which controlled area where UE was previously, to request the subscribers current profile like IP address and PDP contexts. Situation is similiar when UE has moved from LTE to UMTS cell. GUTI is sent as the P-TMSI parameter and the procedure is reffered as Routing Area Update (RAU).

If there is a situation where eNodeB from new LTE cell is not associated with MME on which GUMMEI is pointing eNodeB simply will select new MME. The new MME could get context information from old MME using same GUTI.

Fig. 2. GUTI structure

Globally Unique MME Identifier (GUMMEI)

The format and size of the GUTI is:

GUTI = GUMMEI + M-TMSI, where

GUMMEI = MCC + MNC + MME Identifier and

MME Identifier = MME Group ID + MME Code

MCC and MNC shall have the same field size as in earlier 3GPP systems.

M-TMSI shall be of 32 bits length.

MME Group ID shall be of 16 bits length.

MME Code shall be of 8 bits length.

What is CQI in LTE?

The Channel Quality Indicator (CQI) contains information sent from a UE to the eNode-B to indicate a suitable downlink transmission data rate, i.e., a Modulation and Coding Scheme (MCS) value. CQI is a 4-bit integer and is based on the observed signal-to-interference-plus-noise ratio (SINR) at the UE. The CQI estimation process takes into account the UE capability such as the number of antennas and the type of receiver used for detection. This is important since for the same SINR value the MCS level that can be supported by a UE depends on these various UE capabilities, which needs to be taken into account in order for the eNode-B to select an optimum MCS level for the transmission. The CQI reported values are used by the eNode-B for downlink scheduling and link adaptation, which are important features of LTE.

CQI reporting can be either periodic or aperiodic. A UE can be configured to have both periodic and aperiodic reporting at the same time.

0. Periodic CQI reporting is defined by the following characteristics:
   
- When the UE is allocated PUSCH resources in a subframe where a periodic CQI report is configured to be sent, the periodic CQI report is transmitted together with uplink data on the PUSCH. Otherwise, the periodic CQI reports are sent on the PUCCH.

Aperiodic CQI reporting is defined by the following characteristics:

• -  The report is scheduled by the eNB via the PDCCH;
  -  Transmitted together with uplink data on PUSCH.
• When a CQI report is transmitted together with uplink data on PUSCH, it is multiplexed with the transport block by L1 (i.e. the CQI report is not part of the uplink the transport block).
  The eNB configures a set of sizes and formats of the reports. Size and format of the report depends on whether it is transmitted over PUCCH or PUSCH and whether it is a periodic or aperiodic CQI report. 
  

  

LTE supports wideband and subband CQI reporting. A wideband CQI value is a single 4-bit integer that represents an effectiveSINR as observed by the UE over the entire channel bandwidth. With wideband CQI, the variation in the SINR across the channel due to frequency selective nature of the channel is masked out. Therefore, frequency selective scheduling where a UE is placed only in resource blocks with high SINR is not possible with wideband CQI reporting. To support frequency selective scheduling, each UE needs to report the CQI with a fine frequency granularity, which is possible with subband CQI reporting. A subband CQI report consists of a vector of CQI values where each CQI value is representative of the SINR observed by the UE over a subband. A subband is a collection of n adjacent Physical Resource Blocks (PRBs) where the value of n can be 2, 3, 4, 6, or 8 depending on the channel bandwidth and the CQI feedback mode.

In the plain words, CQI is an indicator carrying the information on how good/bad the communication channel quality is. 

CQI is the information that UE sends to the network and practically it implies the following two

i) Current Communication Channel Quality is (Value from 1 to 15)

ii) UE wants to get the data with transport block size, which in turn can be directly converted into throughput.

What if network sends a large transport block even though UE reports low CQI, it is highly probable that UE failed to decode it (cause CRC error on UE side) and UE send NACK to network and the network have to retransmit it which in turn cause waste of radio resources.

In LTE, there are 15 different CQI values randing from 1 to 15 and mapping between CQI and modulcation scheme, transport block size is defined as follows (36.213)

Reference: 3GPP TS 36.300 

LTE Radio Protocol Architecture (User plane & Control plane)

User plane
The figure below shows the protocol stack for the user-plane, where PDCP, RLC and MAC sublayers (terminated in eNB on the network side) perform the functions listed for the user plane, e.g. header compression, ciphering, scheduling, ARQ and HARQ;

 Control plane

 The figure below shows the protocol stack for the control-plane, where:

• -  PDCP sublayer (terminated in eNB on the network side) performs the functions like ciphering and integrity protection.
  
• -  RLC and MAC sublayers (terminated in eNB on the network side) perform the same functions as for the user plane.
  
• -  RRC (terminated in eNB on the network side) performs the functions listed below:
  
  • -  Broadcast;
    
  • -  Paging;
    
  • -  RRC connection management;
    
  • -  RB control;
    
  • -  Mobility functions;
    
  • -  UE measurement reporting and control.
    
• -  NAS control protocol (terminated in MME on the network side) performs among other things:
  
  • -  EPS bearer management;
    
  • -  Authentication;
    
  • -  ECM-IDLE mobility handling;
    
  • -  Paging origination in ECM-IDLE;
    
  • -  Security control. 
    
    
    
    
    
    Reference:3GPP TS 36.300
     
    
    
    
    
    

PSS & SSS in LTE for Physical Cell Identification

This post describes Primary Synchronization Signal(P-SS) and Secondary Synchronization Signal(S-SS) sequences used in LTE system.It provides comparison between P-SS and S-SS as per LTE standard.

In LTE, there are two downlink synchronization signals which are used by the UE to obtain the cell identity and frame timing. 

• Primary synchronization signal (PSS)
• Secondary synchronization signal (SSS)

The division into two signals is aimed to reduce the complexity of the cell search process. 

Cell Identity Arrangement

The physical cell identity, NcellID, is defined by the equation: 

NCELLID=3N(1)ID+N(2)ID

• N(1)ID is the physical layer cell identity group (0 to 167).
• N(2)ID is the identity within the group (0 to 2). 

This arrangement creates 504 unique physical cell identities. 

From here we can know that the range of PCI for LTE Cell is from 0 to 503.

Synchronization Signals and Determining Cell Identity

The primary synchronization signal (PSS) is linked to the cell identity within the group (N(2)ID). 

The secondary synchronization signal (SSS) is linked to the cell identity group (N(1)ID) and the cell identity within the group (N(2)ID). 

You can obtain N(2)ID by successfully demodulating the PSS. The SSS can then be demodulated and combined with knowledge of N(2)ID to obtain N(1)ID. Once you establish the values of N(1)ID and N(2)ID, you can determine the cell identity (NcellID).

Primary Synchronization Signal (P-SS) Sequences

•    Three PSS sequences are used in LTE, corresponding to the three physical layer identities within each group of cells.

•    The PSS is constructed from a frequency-domain ZC sequence of length 63.

•    Transmitted on 6th symbol of slot 0 and slot10 of each radio frame on 72 subcarriers centered around DC.

Secondary Synchronization Signal (S-SS) Sequences

•    SSC1 and SSC2 are two different cyclic shifts of a single length-31 M sequence.
•    Each SSS sequence is constructed by interleaving, in the frequency-domain, two length-31 BPSK-modulated secondary synchronization codes

•    Two codes are alternated between the first and second SSS transmissions in each radio frame

•    This enables the UE to determine the 10 ms radio frame timing from a single observation of a SSS

•    Transmitted on 5th symbol of slot 0 and slot10 of each radio frame on 72 subcarriers centered around DC.

Signal	Full Form	Direction	Position	Modulation/ Coding scheme	Function
P-SS	Primary Synchronization Signal	Downlink	6th symbol of slot 0 and slot 10(time axis) mapped on 72 subcarriers centered around DC(frequency axis)	Zadoff Chu sequence of length 63	UE first finds the primary synchronization signal (PSS) which is located in the last OFDM symbol of first time slot of the first and 5th sub-frames This enables UE to be synchronized on sub-frame level Primary Synchronization Signal helps for Slot Timing Detection and Physical Layer ID (0,1,2) detection
S-SS	Secondary Synchronization Signal	Downlink	5th symbol of slot 0 and slot 10(time exis) mapped on 72 subcarriers centered around DC(frequency axis)	BPSK modulated length-31 M sequence	From SSS, UE is able to obtain physical layer cell identity group number (0 to 167) It helps for Radio Frame Timing detection, find Physical Layer Cell ID, cyclic prefix length detection, FDD or TDD detection

Paging procedure in LTE

The LTE paging procedure can be used for the following:

•  To initiate mobile terminated PS call
•  To initiate mobile terminated CS fallback call
•  To trigger LTE UE to re-acquire system informations
•  To provide an Earthquake and Tsunami Warning System(ETWS) indication

As shown in the figure, MME is responsible for the initiation of LTE paging procedure. MME does this by forwarding S1AP paging message to one or more eNodeB. The contents and structure of S1AP paging message is mentioned below in the table-1.

The LTE paging procedure is applicable to UE in ECM IDLE State. UE in this state are in RRC IDLE mode and do not have S1 connectivity with MME.

The location of a UE in ECM IDLE state is known by MME on a per tracking area basis. The MME has to forward S1AP paging message to all eNodeB within the relevant tracking area.

MME forward paging message to multiple eNodeBs as UE can be registered with more than a single tracking area.

•  As mentioned in the figure, MME starts timer T3413 after sending S1AP paging message for PS data call and LTE UE is addressed by S-TMSI instead of IMSI.

•  eNodeB receives S1AP paging message from MME and constructs RRC paging message. Single RRC can carry information from multiple S1AP. Paging message can include multiple paging records to page multiple UE.

•  UE in RRC IDLE mode checks for paging once every DRX cycle. paging occasion within the paging frame defines specific subframe during which a LTE UE checks for paging message.

•  UE searches forP-RNTI within PDCCH of subframe belong to paging occasion. P-RNTI has value of FFFE and indicates that UE may have a paging message on PDSCH.

•  UE finds P-RNTI in PDCCH, it will decode resource allocation information.

•  This information directs UE to PDSCH RB where in paging message has been sent.

•  UE decodes RRC message from PDSCH RBs and checks UE identity in all the records. If UE do not find its identity in paging record then it will return to check PDCCH for P-RNTI at each of the paging occasions.

•  If the UE find its identity, it will trigger random access procedure to establish RRC connection.

•  UE sends RRC connection request message and eNodeB responds with RRC connection setup message.

•  If the LTE paging procedure is for PS data call, UE includes service request NAS message within RRC connection setup complete message.

•  If the paging procedure is for a terminating CS fallback call, UE includes extended service request NAS message within RRC connection setup complete message.

•   The eNodeB forwards NAS message to MME which will stop T3413 if it is running and will proceed to establish connection with UE.

•  A paging retransmission will be triggered if T3413 gets expire prior to MME receiving a NAS message from UE.

•  UE checks for RRC paging message for SI modification flag and ETWS flag. If the former is present UE reacquires BCCH SI. If the later is present, UE reads ETWS notifications in SIB10 and/or SIB11.

REFERENCES: 3GPP TS 36.304, TS36.331, TS24.301