NB IoT - UEsim
The purpose of this tutorial is to show you how to do basic connectivity test between a UEsim and Amari Callbox with LTE NB in Inband Mode. NB IoT is designed to use the bandwidth 200khz which is single LTE RB(180khz) plus a little bit of guardband. It can be deployed in a few different operation mode called Inband, Guardband, Standalone mode as illustrated below.
Source : Sharetechnote
On top of the operation mode, there are a few additional features depending on operation mode.
- Inband Mode
- with Same PCI
- Non-Anchor Carrier Disabled
- Non-Anchor Carrier Enabled
- with Different PCI
- Guarband Mode
- Standalone Mode
This tutorial is based on the configuration for Inband , same PCI , Non-Anchor Carrier Disabled.
Table of Contents
- NB IoT - UEsim
Test Setup
Test setup for this tutorial is as shown below.
Configuration
An important thing in using UE sim is to do proper matching between UE sim configuration and Call box configuration In this tutorial, I used the ue-catm1.cfg and and enb-catm1.cfg without any change
If you use other Network (e.g, other network simulator or real network), you have to make it sure to configure UE sim according to the settings on network side
You would see following in /root/mme/config/ims-ims.cfg file on Callbox
Following is the contents of "ue_db-ims.cfg" on Callbox.
In this tutorial, following SIM information will be used. this is the configuration in ue-nbiot.cfg on UEsim.
Following is the configuration on Callbox (enb-nbiot.cfg)
Following is the configuration on UEsim (ue-nbiot.cfg)
Check if LTE service is Running
Whatever you want to test, the first thing you need to do is that call box program (LTE Service) is running. You can check on the execution status of the call box program by running following command and you should get the result as shown below
# service lte status
NOTE : Getting this result is pre-requisite for Call Box Operation, but this result itself does not guarantee the normal operation. If you see some unexpected issues. You may restart the call box with following command
# service lte restart
Getting into Screen Mode
If it is confirmed that the lte service is running, go to screen mode by running 'screen -r' and follow through the steps as shown below. The steps shown here is the procedure that you would use for almost every test and it is highly recommended to get familiar with these steps. For further commands you can use in this screen mode, refer to the tutorial : Command Line Command
Run following command on UE sim
You will get the screen as shown below
Run following command on Callbox
You will get the screen as shown below
Attach UE
Now perform UE attach procedure. This would be a little bit busy process since you need to switch back and forth between Callbox screen and UEsim screen.
Start tracing on Callbox
power_on UE on UE sim.
You will see following message once UE detect the cell and decoded SIBs.
Once UE completed SIB decoding and perform initial attach, you will see following trace on Callbox screen.
When the initial attach completed, you can check on the cell information to which the UE sim is registered to with 'cells' command.
You can get the ue information that is in connection with gNB on Callbox with 'ue' command in (enb) screen.
You can get the ue information that is in connection with gNB on Callbox with 'ue' command in (mme) screen.
Log Analysis
In this section, you will see how to confirm if UE registration is complete from trace log. You can use the same method to find any issues (e.g, registration failure) for troubleshooting. When UE registration fails, you may use this tutorial to figure out the point of the failure and troubleshoot
NOTE : This section is just to check quickly some important points in the log, but it may be a little bit tricky to do the detailed log analysis (especially for lower layer log analysis). In that case, I strongly recommend you to use WebGUI for the log analysis. You may refer to WebGUI Tutorial
Open /tmp/ue0.log on UEsim using any text editor. I am using nano in this tutorial. (NOTE : In the same way, you can check eNB log by opening /tmp/enb0.log on Callbox).
RRC / NAS Signaling
SIB1
: This is the SIB1 sent by eNB to configiture NB IoT (
{
message c1: systemInformationBlockType1-r13: {
hyperSFN-MSB-r13 '01'H,
cellAccessRelatedInfo-r13 {
plmn-IdentityList-r13 {
{
...
}
},
...
},
cellSelectionInfo-r13 {
...
},
p-Max-r13 10,
freqBandIndicator-r13 7,
eutraControlRegionSize-r13 n3,
nrs-CRS-PowerOffset-r13 dB0,
schedulingInfoList-r13 {
{
si-Periodicity-r13 rf128,
si-RepetitionPattern-r13 every2ndRF,
sib-MappingInfo-r13 {
},
si-TB-r13 b208
}
},
si-WindowLength-r13 ms160,
systemInfoValueTagList-r13 {
0
}
SIB2
: This is the SIB2 sent by eNB to configiture NB IoT (
{
message c1: systemInformation: {
criticalExtensions systemInformation-r8: {
sib-TypeAndInfo {
sib2: {
radioResourceConfigCommon {
rach-ConfigCommon {
preambleInfo {
numberOfRA-Preambles n52
},
powerRampingParameters {
powerRampingStep dB2,
preambleInitialReceivedTargetPower dBm-104
},
ra-SupervisionInfo {
preambleTransMax n10,
ra-ResponseWindowSize sf10,
mac-ContentionResolutionTimer sf40
},
maxHARQ-Msg3Tx 5
},
bcch-Config {
...
},
pcch-Config {
...
},
prach-Config {
rootSequenceIndex 204,
prach-ConfigInfo {
prach-ConfigIndex 4,
highSpeedFlag FALSE,
zeroCorrelationZoneConfig 11,
prach-FreqOffset 2
}
},
pdsch-ConfigCommon {
...
},
pusch-ConfigCommon {
pusch-ConfigBasic {
n-SB 1,
hoppingMode interSubFrame,
pusch-HoppingOffset 4,
enable64QAM TRUE
},
ul-ReferenceSignalsPUSCH {
groupHoppingEnabled FALSE,
groupAssignmentPUSCH 0,
sequenceHoppingEnabled FALSE,
cyclicShift 0
}
},
pucch-ConfigCommon {
...
},
soundingRS-UL-ConfigCommon setup: {
...
},
uplinkPowerControlCommon {
...
},
ul-CyclicPrefixLength len1,
pusch-ConfigCommon-v1270 {
enable64QAM-v1270 true
}
},
ue-TimersAndConstants {
t300 ms200,
t301 ms200,
t310 ms200,
n310 n6,
t311 ms10000,
n311 n5
},
freqInfo {
additionalSpectrumEmission 1
},
timeAlignmentTimerCommon infinity
},
Attach Request
: This is the AttachRequest sent by UE to inform UE capability for NB IoT NAS feature (
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x41 (Attach request)
EPS attach type = 1 (EPS attach)
NAS key set identifier:
TSC = 0
NAS key set identifier = 7
Old GUTI or IMSI:
IMSI = 001010123456789
UE network capability:
0xe0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=0, EEA4=0, EEA5=0, EEA6=0, EEA7=0)
0xe0 (EIA0=1, 128-EIA1=1, 128-EIA2=1, 128-EIA3=0, EIA4=0, EIA5=0, EIA6=0, EIA7=0)
0x00 (UEA0=0, UEA1=0, UEA2=0, UEA3=0, UEA4=0, UEA5=0, UEA6=0, UEA7=0)
0x00 (UCS2=0, UIA1=0, UIA2=0, UIA3=0, UIA4=0, UIA5=0, UIA6=0, UIA7=0)
0x00 (ProSe-dd=0, ProSe=0, H.245-ASH=0, ACC-CSFB=0, LPP=0, LCS=0, 1xSRVCC=0, NF=0)
0x90 (ePCO=1, HC-CP CIoT=0, ERw/oPDN=0, S1-U data=1, UP CIoT=0, CP CIoT=0, ProSe-relay=0, ProSe-dc=0)
0x01 (15 bearers=0, SGC=0, N1mode=0, DCNR=0, CP backoff=0, RestrictEC=0, V2X PC5=0, multipleDRB=1)
ESM message container:
Protocol discriminator = 0x2 (EPS Session Management)
EPS bearer identity = 0
Procedure transaction identity = 1
Message type = 0xd0 (PDN connectivity request)
Request type = 1 (initial request)
PDN type = 3 (IPv4v6)
Extended protocol configuration options:
Ext = 1
Configuration protocol = 0
Protocol ID = 0x8021 (IPCP)
Data = 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00
Protocol ID = 0x0001 (P-CSCF IPv6 Address Request)
Data =
Protocol ID = 0x0003 (DNS Server IPv6 Address Request)
Data =
Protocol ID = 0x000a (IP address allocation via NAS signalling)
Data =
Protocol ID = 0x000c (P-CSCF IPv4 Address Request)
Data =
Protocol ID = 0x000d (DNS Server IPv4 Address Request)
Data =
Protocol ID = 0x0016 (APN rate control support indicator)
Data =
Additional update type = 0x01 (no additional information, keeping NAS signalling connection not required, SMS only)
MS network feature support = 0x01 (MS supports the extended periodic timer in this domain)
RrcConnectionSetup
: This is the RrcConnectionSetup sent by eNB to configiture NB IoT (
{
message c1: rrcConnectionSetup-r13: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: rrcConnectionSetup-r13: {
radioResourceConfigDedicated-r13 {
srb-ToAddModList-r13 {
{
rlc-Config-r13 explicitValue: am: {
ul-AM-RLC-r13 {
t-PollRetransmit-r13 ms6000,
maxRetxThreshold-r13 t32
},
dl-AM-RLC-r13 {
}
},
logicalChannelConfig-r13 explicitValue: {
priority-r13 1
}
}
},
mac-MainConfig-r13 explicitValue-r13: {
ul-SCH-Config-r13 {
periodicBSR-Timer-r13 pp16,
retxBSR-Timer-r13 pp64
},
timeAlignmentTimerDedicated-r13 infinity
},
physicalConfigDedicated-r13 {
npdcch-ConfigDedicated-r13 {
npdcch-NumRepetitions-r13 r8,
npdcch-StartSF-USS-r13 v4,
npdcch-Offset-USS-r13 zero
},
npusch-ConfigDedicated-r13 {
npusch-AllSymbols-r13 FALSE
}
UE Capability Information
: This is the UE Capability Information sent by UE to inform RRC capability for NB IoT (
{
message c1: ueCapabilityInformation-r13: {
rrc-TransactionIdentifier 0,
criticalExtensions ueCapabilityInformation-r13: {
ue-Capability-r13 {
accessStratumRelease-r13 rel14,
ue-Category-NB-r13 nb1,
multipleDRB-r13 supported,
pdcp-Parameters-r13 {
supportedROHC-Profiles-r13 {
profile0x0002 TRUE,
profile0x0003 FALSE,
profile0x0004 TRUE,
profile0x0006 FALSE,
profile0x0102 FALSE,
profile0x0103 FALSE,
profile0x0104 FALSE
},
maxNumberROHC-ContextSessions-r13 cs12
},
phyLayerParameters-r13 {
multiTone-r13 supported
},
rf-Parameters-r13 {
supportedBandList-r13 {
{
band-r13 7,
powerClassNB-20dBm-r13 supported
}
}
}
},
ue-RadioPagingInfo-r13 {
ue-Category-NB-r13 nb1
},
nonCriticalExtension {
ue-Capability-ContainerExt-r14 {
ue-Category-NB-r14 nb2,
rf-Parameters-v1430 {
}
Attach Accept
: This is the AttachAccept sent by UE to inform NW capability for IoT NAS feature and Activate Default EPS Bearer(
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x2 (Integrity protected and ciphered)
Auth code = 0x8cd0b681
Sequence number = 0x01
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x42 (Attach accept)
EPS attach result = 1 (EPS only)
T3412 value:
Value = 30
Unit = 1 (1 minute)
TAI list:
Length = 6
Data = 00 00 f1 10 00 02
ESM message container:
Protocol discriminator = 0x2 (EPS Session Management)
EPS bearer identity = 5
Procedure transaction identity = 1
Message type = 0xc1 (Activate default EPS bearer context request)
EPS QoS:
QCI = 9
Access point name = "default.mnc001.mcc001.gprs"
PDN address:
PDN type = 1 (IPv4)
IPv4 = 192.168.2.2
ESM cause = 0x32 (PDN type IPv4 only allowed)
Extended protocol configuration options:
Ext = 1
Configuration protocol = 0
Protocol ID = 0x8021 (IPCP)
Data = 03 00 00 0a 81 06 08 08 08 08
Protocol ID = 0x000d (DNS Server IPv4 Address)
Data = 8.8.8.8
Protocol ID = 0x0016 (APN rate control parameters)
Data = 00 00 00 00
GUTI:
MCC = 001
MNC = 01
MME Group ID = 32769
MME Code = 1
M-TMSI = 0x209e332f
Emergency number list:
Length = 8
Data = 03 1f 19 f1 03 1f 11 f2
EPS network feature support:
0x01 (CP CIoT=0, ERw/oPDN=0, ESRPS=0, CS-LCS=0, EPC-LCS=0, EMC BS=0, IMS VoPS=1)
0x0a (15 bearers=0, IWK N26=0, RestrictDCNR=0, RestrictEC=0, ePCO=1, HC-CP CIoT=0, S1-U data=1, UP CIoT=0)
Additional update result = 0x02 (SMS only)