IoT LTE Cat - M1 - 2 Coverage Level -UEsim
The purpose of this tutorial is to show you how to do configure multiple coverage level for Cat-M1 and how to force UEsim to attach with a specified coverage level. The way to configure muliple coverage level (CE level) is done through SIB2 and overall structure of SIB2 IE(information elements) structure related to CE level configuration is as follows. Amarisoft Callbox does not provide any set of individual configuration parameters. It would be too complicated to support this as individual configuration parameters. So for now, you need to edit the SIB2 ASN.1 file manually and call the asn from callbox configuration file. It would be good to have a big picture shown below in your mind to edit the sib2 asn meaningfully.
Source : Sharetechnote
Table of Contents
- IoT LTE Cat - M1 - 2 Coverage Level -UEsim
Introduction
The evolution of cellular IoT technologies, particularly LTE Cat-M1 (also known as eMTC), has introduced sophisticated mechanisms to optimize connectivity and coverage for low-power, wide-area devices. Central to this optimization is the concept of Coverage Enhancement (CE) levels, which categorize user equipment (UE) based on their radio conditions to ensure reliable network access even in challenging environments. The configuration of multiple CE levels is primarily managed through System Information Block Type 2 (SIB2), a critical information element broadcast by the eNodeB that defines essential radio resource parameters, including those governing random access and coverage enhancements. In practical test and simulation environments, such as with the Amarisoft Callbox and UEsim, direct parameterization of CE levels via intuitive GUIs is often not supported due to the complexity of the underlying ASN.1 structures. Instead, practitioners must manually edit the SIB2 ASN.1 files to tailor CE-level parameters and incorporate these configurations into the callbox setup. This approach requires a strong understanding of the SIB2 information element architecture and ASN.1 encoding, as well as how these parameters influence UE behavior during the attach procedure. Mastery of these concepts is crucial for network engineers, testers, and researchers aiming to validate coverage strategies and optimize IoT device performance in diverse deployment scenarios, thereby ensuring robust and adaptive network behavior in the broader LTE ecosystem.
-
Context of the Technology
- LTE Cat-M1 is designed for low-power, wide-area applications, supporting IoT devices that require extended coverage and energy efficiency.
- Coverage Enhancement (CE) levels in LTE enable devices located in poor radio environments to maintain connectivity by adapting access and scheduling parameters.
- SIB2 is a core broadcast message in LTE, responsible for disseminating critical radio resource parameters, including those for CE level configuration.
- ASN.1 (Abstract Syntax Notation One) is a standardized data representation protocol used to encode SIB2, requiring manual editing for advanced configurations in certain test environments.
-
Relevance and Importance of the Tutorial Topic
- Configuring multiple CE levels is essential for simulating real-world IoT scenarios, ensuring that devices under various coverage conditions are properly supported.
- The Amarisoft Callbox, widely used for LTE testing, does not provide granular CE-level configuration via its interface, making manual SIB2 ASN.1 editing an essential skill.
- Understanding the relationship between SIB2 configuration and UE attach behavior is critical for network optimization and troubleshooting.
-
Learner Outcomes
- Gain a comprehensive understanding of SIB2 structure, focusing on coverage enhancement parameters.
- Acquire practical skills in editing ASN.1 files to configure CE levels for LTE Cat-M1.
- Learn how to force UEsim to attach with a specified coverage level by referencing customized SIB2 configurations.
- Develop the ability to map abstract coverage concepts to real-world network simulation and testing scenarios.
-
Prerequisite Knowledge and Skills
- Basic understanding of LTE network architecture and signaling procedures, specifically SIB messages and attach process.
- Familiarity with ASN.1 syntax and encoding principles.
- Experience with Amarisoft Callbox configuration files and general test environment setup.
- Ability to use text editors and interpret protocol specifications for SIB2 and RACH parameters.
Summary of the Tutorial
This tutorial details the procedures for setting up and testing UE simulation (UEsim) with a call box for Cat-M1 LTE, including initial configuration, service checks, attach procedures, and log analysis. The methodology emphasizes ensuring proper configuration matching between the UE simulator and the call box, executing test commands, and analyzing signaling messages during the attach process.
-
Test Setup and Configuration:
- Ensure matching configurations between UEsim and the call box using ue-catm1.cfg and enb-catm1.cfg files.
- Verify SIM information and network-side configuration settings are consistent across UEsim and call box (refer to respective configuration files such as ims-ims.cfg, enb-catm1-2cl.cfg, and ue-catm1-2cl.cfg).
-
LTE Service Status Check:
- Verify that the LTE service is running on the call box by executing service lte status.
- If issues arise, restart the service using service lte restart.
-
Screen Mode Operation:
- Enter screen mode using screen -r for separate UEsim and call box sessions.
- Familiarize with the command-line interface for both UEsim and call box to facilitate test operations.
-
UE Attach Procedure:
- Start tracing on the call box and power on the UE in UEsim.
- Monitor messages indicating cell detection and SIB decoding on UEsim.
- Upon successful SIB decoding and initial attach, observe corresponding traces on the call box.
- Check registration status and connection information using cells and ue commands on the call box (in both enb and mme screens).
- During attach, UEsim sends PRACH with a specific coverage level index, which can be controlled via configuration file settings.
-
Log Analysis and Message Inspection:
- Examine log messages for:
- RRC/NAS signaling exchanges, including SIB1 and SIB2 broadcasts from eNB for Cat-M1 configuration.
- Attach Request from UE, detailing EPS Mobility Management parameters and capabilities.
- RrcConnectionSetup and UE Capability Information for Cat-M1.
- Attach Accept message from the network, including EPS bearer establishment and feature support.
- Verify that all configuration parameters and feature indicators match the intended test scenario.
- For log analysis, confirm that PRACH indices and message contents correspond to the configured coverage level.
- Examine log messages for:
-
Coverage Level Testing:
- To attach with a specific coverage level, set the desired level in the UEsim configuration file, as UEsim does not dynamically select based on RSRP.
- Validate from logs that PRACH and attach messages use the correct coverage level as specified.
In summary, the tutorial guides users through a systematic approach to configure, execute, and analyze UE attach tests in a Cat-M1 LTE simulation environment, with particular attention to signaling message verification and coverage level control via configuration.
Test Setup
Test setup for this tutorial is as shown below.
Configuration
An important thing in using UE sim is to do proper matching between UE sim configuration and Call box configuration In this tutorial, I used the ue-catm1.cfg and and enb-catm1.cfg without any change
If you use other Network (e.g, other network simulator or real network), you have to make it sure to configure UE sim according to the settings on network side
You would see following in /root/mme/config/ims-ims.cfg file on Callbox
In this tutorial, following SIM information will be used. this is the configuration in ue-catm1.cfg on UEsim.
Following is the configuration on Callbox (enb-catm1-2cl.cfg)
Following is the configuration on UEsim (ue-catm1-2cl.cfg)
Check if LTE service is Running
Whatever you want to test, the first thing you need to do is that call box program (LTE Service) is running. You can check on the execution status of the call box program by running following command and you should get the result as shown below
# service lte status
NOTE : Getting this result is pre-requisite for Call Box Operation, but this result itself does not guarantee the normal operation. If you see some unexpected issues. You may restart the call box with following command
# service lte restart
Getting into Screen Mode
If it is confirmed that the lte service is running, go to screen mode by running 'screen -r' and follow through the steps as shown below. The steps shown here is the procedure that you would use for almost every test and it is highly recommended to get familiar with these steps. For further commands you can use in this screen mode, refer to the tutorial : Command Line Command
Run following command on UE sim
You will get the screen as shown below
Run following command on Callbox
You will get the screen as shown below
Attach UE
Now perform UE attach procedure. This would be a little bit busy process since you need to switch back and forth between Callbox screen and UEsim screen.
Start tracing on Callbox
power_on UE on UE sim.
You will see following message once UE detect the cell and decoded SIBs.
Once UE completed SIB decoding and perform initial attach, you will see following trace on Callbox screen.
When the initial attach completed, you can check on the cell information to which the UE sim is registered to with 'cells' command.
You can get the ue information that is in connection with gNB on Callbox with 'ue' command in (enb) screen.
You can get the ue information that is in connection with gNB on Callbox with 'ue' command in (mme) screen.
Log Analysis
As you see, UE send PRACH with index belonging to Coverage Level 0
Attaching with a specified Coverage Level
UEsim does not support the selection of coverage level based on RSRP in Cat-M for now. The only way you can make UEsim attach with a certain coverage level is to specify it in the configuration file as follows.
You can confirm from the log that UE is sending PRACH with the index belonging to Coverage Level 1
RRC / NAS Signaling
SIB1
: This is the SIB1 sent by eNB to configiture Cat M1 (
{
message c1: systemInformationBlockType1: {
cellAccessRelatedInfo {
plmn-IdentityList {
{
...
},
...
}
},
...
},
cellSelectionInfo {
...
},
p-Max 10,
freqBandIndicator 7,
schedulingInfoList {
...
},
si-WindowLength ms40,
systemInfoValueTag 0,
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
cellAccessRelatedInfo-v1250 {
},
nonCriticalExtension {
hyperSFN-r13 '0000001111'B,
eDRX-Allowed-r13 true,
bandwidthReducedAccessRelatedInfo-r13 {
si-WindowLength-BR-r13 ms40,
si-RepetitionPattern-r13 every4thRF,
schedulingInfoList-BR-r13 {
{
si-Narrowband-r13 1,
si-TBS-r13 b504
}
},
startSymbolBR-r13 3,
si-HoppingConfigCommon-r13 off
}
SIB2
: This is the SIB2 sent by eNB to configiture Cat M1 (
{
message c1: systemInformation: {
criticalExtensions systemInformation-r8: {
sib-TypeAndInfo {
sib2: {
radioResourceConfigCommon {
rach-ConfigCommon {
preambleInfo {
...
},
powerRampingParameters {
...
},
ra-SupervisionInfo {
...
},
maxHARQ-Msg3Tx 5,
preambleTransMax-CE-r13 n10,
rach-CE-LevelInfoList-r13 {
{
preambleMappingInfo-r13 {
firstPreamble-r13 0,
lastPreamble-r13 25
},
ra-ResponseWindowSize-r13 sf50,
mac-ContentionResolutionTimer-r13 sf80,
rar-HoppingConfig-r13 off
},
{
preambleMappingInfo-r13 {
firstPreamble-r13 26,
lastPreamble-r13 51
},
ra-ResponseWindowSize-r13 sf50,
mac-ContentionResolutionTimer-r13 sf80,
rar-HoppingConfig-r13 off
}
}
},
bcch-Config {
...
},
pcch-Config {
...
},
prach-Config {
...
},
pdsch-ConfigCommon {
...
},
pusch-ConfigCommon {
...
},
pucch-ConfigCommon {
...
},
soundingRS-UL-ConfigCommon setup: {
...
},
uplinkPowerControlCommon {
...
},
ul-CyclicPrefixLength len1,
pusch-ConfigCommon-v1270 {
enable64QAM-v1270 true
},
bcch-Config-v1310 {
modificationPeriodCoeff-v1310 n64
},
pcch-Config-v1310 {
paging-narrowBands-r13 1,
mpdcch-NumRepetition-Paging-r13 r1
},
freqHoppingParameters-r13 {
interval-ULHoppingConfigCommonModeA-r13 interval-FDD-r13: int1
},
pdsch-ConfigCommon-v1310 {
pdsch-maxNumRepetitionCEmodeA-r13 r16
},
pusch-ConfigCommon-v1310 {
pusch-maxNumRepetitionCEmodeA-r13 r8
},
prach-ConfigCommon-v1310 {
rsrp-ThresholdsPrachInfoList-r13 {
0
},
mpdcch-startSF-CSS-RA-r13 fdd-r13: v1,
prach-ParametersListCE-r13 {
{
prach-ConfigIndex-r13 4,
prach-FreqOffset-r13 4,
prach-StartingSubframe-r13 sf2,
maxNumPreambleAttemptCE-r13 n3,
numRepetitionPerPreambleAttempt-r13 n1,
mpdcch-NarrowbandsToMonitor-r13 {
1
},
mpdcch-NumRepetition-RA-r13 r1,
prach-HoppingConfig-r13 off
},
{
prach-ConfigIndex-r13 4,
prach-FreqOffset-r13 4,
prach-StartingSubframe-r13 sf2,
maxNumPreambleAttemptCE-r13 n3,
numRepetitionPerPreambleAttempt-r13 n1,
mpdcch-NarrowbandsToMonitor-r13 {
1
},
mpdcch-NumRepetition-RA-r13 r8,
prach-HoppingConfig-r13 off
}
}
},
pucch-ConfigCommon-v1310 {
n1PUCCH-AN-InfoList-r13 {
38,
38
},
pucch-NumRepetitionCE-Msg4-Level0-r13 n1,
pucch-NumRepetitionCE-Msg4-Level1-r13 n1
}
},
ue-TimersAndConstants {
t300 ms200,
t301 ms200,
t310 ms200,
n310 n6,
t311 ms10000,
n311 n5,
t300-v1310 ms5000,
t301-v1310 ms5000
},
freqInfo {
additionalSpectrumEmission 1
},
timeAlignmentTimerCommon infinity
},
Attach Request
: This is the AttachRequest sent by UE to inform UE capability for IoT NAS feature (
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x41 (Attach request)
EPS attach type = 1 (EPS attach)
NAS key set identifier:
TSC = 0
NAS key set identifier = 7
Old GUTI or IMSI:
IMSI = 001010123456789
UE network capability:
0xe0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=0, EEA4=0, EEA5=0, EEA6=0, EEA7=0)
0xe0 (EIA0=1, 128-EIA1=1, 128-EIA2=1, 128-EIA3=0, EIA4=0, EIA5=0, EIA6=0, EIA7=0)
0x00 (UEA0=0, UEA1=0, UEA2=0, UEA3=0, UEA4=0, UEA5=0, UEA6=0, UEA7=0)
0x00 (UCS2=0, UIA1=0, UIA2=0, UIA3=0, UIA4=0, UIA5=0, UIA6=0, UIA7=0)
0x00 (ProSe-dd=0, ProSe=0, H.245-ASH=0, ACC-CSFB=0, LPP=0, LCS=0, 1xSRVCC=0, NF=0)
0x80 (ePCO=1, HC-CP CIoT=0, ERw/oPDN=0, S1-U data=0, UP CIoT=0, CP CIoT=0, ProSe-relay=0, ProSe-dc=0)
ESM message container:
Protocol discriminator = 0x2 (EPS Session Management)
EPS bearer identity = 0
Procedure transaction identity = 1
Message type = 0xd0 (PDN connectivity request)
Request type = 1 (initial request)
PDN type = 3 (IPv4v6)
Protocol configuration options:
Ext = 1
Configuration protocol = 0
Protocol ID = 0x8021 (IPCP)
Data = 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00
Protocol ID = 0x0001 (P-CSCF IPv6 Address Request)
Data =
Protocol ID = 0x0003 (DNS Server IPv6 Address Request)
Data =
Protocol ID = 0x000a (IP address allocation via NAS signalling)
Data =
Protocol ID = 0x000c (P-CSCF IPv4 Address Request)
Data =
Protocol ID = 0x000d (DNS Server IPv4 Address Request)
Data =
Voice domain preference and UE's usage setting = 0x05 (IMS PS Voice only, Data centric)
MS network feature support = 0x01 (MS supports the extended periodic timer in this domain)
RrcConnectionSetup
: This is the RrcConnectionSetup sent by eNB to configiture Cat M1 (
{
message c1: rrcConnectionSetup: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: rrcConnectionSetup-r8: {
radioResourceConfigDedicated {
srb-ToAddModList {
...
},
mac-MainConfig explicitValue: {
...
},
physicalConfigDedicated {
...
},
soundingRS-UL-ConfigDedicated release: NULL,
schedulingRequestConfig setup: {
...
},
epdcch-Config-r11 {
config-r11 setup: {
setConfigToAddModList-r11 {
{
setConfigId-r11 0,
transmissionType-r11 distributed,
resourceBlockAssignment-r11 {
numberPRB-Pairs-r11 n2,
resourceBlockAssignment-r11 'E'H
},
dmrs-ScramblingSequenceInt-r11 1,
pucch-ResourceStartOffset-r11 0,
mpdcch-config-r13 setup: {
csi-NumRepetitionCE-r13 sf1,
mpdcch-pdsch-HoppingConfig-r13 off,
mpdcch-StartSF-UESS-r13 fdd-r13: v1,
mpdcch-NumRepetition-r13 r1,
mpdcch-Narrowband-r13 1
}
}
}
}
},
ce-Mode-r13 setup: ce-ModeA
}
UE Capability Information
: This is the UE Capability Information sent by UE to inform RRC capability for Cat M1 (
{
message c1: ueCapabilityInformation: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: ueCapabilityInformation-r8: {
ue-CapabilityRAT-ContainerList {
{
rat-Type eutra,
ueCapabilityRAT-Container {
accessStratumRelease rel13,
ue-Category 1,
pdcp-Parameters {
...
}
},
phyLayerParameters {
...
},
rf-Parameters {
...
},
measParameters {
bandListEUTRA {
...
}
},
featureGroupIndicators '4E001002'H /*
2: PUCCH 2a/2b, abs TPC, RB alloc type 1 for PDSCH, Periodic CQI/PMI/RI reporting on PUCCH: Modes 2-0 and 2-1
5: Long DRX cycle, DRX Mac CE
6: Prioritized bit rate
7: RLC UM
20: SRB1 and SRB2 for DCCH + 8x DRB
31: MFBI
*/,
interRAT-Parameters {
},
nonCriticalExtension {
phyLayerParameters-v920 {
},
interRAT-ParametersGERAN-v920 {
},
csg-ProximityIndicationParameters-r9 {
},
neighCellSI-AcquisitionParameters-r9 {
},
son-Parameters-r9 {
},
nonCriticalExtension {
lateNonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
ce-Parameters-v1370 {
tm9-CE-ModeA-r13 supported
},
nonCriticalExtension {
ce-Parameters-v1380 {
tm6-CE-ModeA-r13 supported
},
fdd-Add-UE-EUTRA-Capabilities-v1380 {
ce-Parameters-v1380 {
}
},
tdd-Add-UE-EUTRA-Capabilities-v1380 {
ce-Parameters-v1380 {
}
...
},
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
pdcp-Parameters-v1130 {
},
phyLayerParameters-v1130 {
tdd-SpecialSubframe-r11 supported
},
rf-Parameters-v1130 {
},
measParameters-v1130 {
},
interRAT-ParametersCDMA2000-v1130 {
},
otherParameters-r11 {
},
nonCriticalExtension {
nonCriticalExtension {
rf-Parameters-v1180 {
freqBandRetrieval-r11 supported
},
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
nonCriticalExtension {
ue-CategoryDL-v1310 m1,
ue-CategoryUL-v1310 m1,
pdcp-Parameters-v1310 {
},
rlc-Parameters-v1310 {
},
mac-Parameters-v1310 {
extendedLongDRX-r13 supported
},
ce-Parameters-r13 {
ce-ModeA-r13 supported
},
interRAT-ParametersWLAN-r13 {
},
wlan-IW-Parameters-v1310 {
},
lwip-Parameters-r13 {
}
....
},
nonCriticalExtension {
nonCriticalExtension {
ue-RadioPagingInfo-r12 {
ue-CategoryDL-v1310 m1,
ce-ModeA-r13 true
}
Attach Accept
: This is the AttachAccept sent by UE to inform NW capability for IoT NAS feature and Activate Default EPS Bearer(
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x2 (Integrity protected and ciphered)
Auth code = 0x63483d18
Sequence number = 0x01
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x42 (Attach accept)
EPS attach result = 1 (EPS only)
T3412 value:
Value = 30
Unit = 1 (1 minute)
TAI list:
Length = 6
Data = 00 00 f1 10 00 01
ESM message container:
Protocol discriminator = 0x2 (EPS Session Management)
EPS bearer identity = 5
Procedure transaction identity = 1
Message type = 0xc1 (Activate default EPS bearer context request)
EPS QoS:
QCI = 9
Access point name = "default.mnc001.mcc001.gprs"
PDN address:
PDN type = 1 (IPv4)
IPv4 = 192.168.2.2
ESM cause = 0x32 (PDN type IPv4 only allowed)
Extended protocol configuration options:
Ext = 1
Configuration protocol = 0
Protocol ID = 0x8021 (IPCP)
Data = 03 00 00 0a 81 06 08 08 08 08
Protocol ID = 0x000d (DNS Server IPv4 Address)
Data = 8.8.8.8
GUTI:
MCC = 001
MNC = 01
MME Group ID = 32769
MME Code = 1
M-TMSI = 0x275be002
Emergency number list:
Length = 8
Data = 03 1f 19 f1 03 1f 11 f2
EPS network feature support:
0x01 (CP CIoT=0, ERw/oPDN=0, ESRPS=0, CS-LCS=0, EPC-LCS=0, EMC BS=0, IMS VoPS=1)
0x08 (15 bearers=0, IWK N26=0, RestrictDCNR=0, RestrictEC=0, ePCO=1, HC-CP CIoT=0, S1-U data=0, UP CIoT=0)