NB IoT (standalone) - UEsim
The purpose of this tutorial is to show you how to do basic connectivity test between a UEsim and Amari Callbox with LTE NB in standalone Mode. NB IoT is designed to use the bandwidth 200khz which is single LTE RB(180khz) plus a little bit of guardband. It can be deployed in a few different operation mode called Inband, Guardband, Standalone mode as illustrated below.
Source : Sharetechnote
On top of the operation mode, there are a few additional features depending on operation mode.
- Inband Mode
- with Same PCI
- Non-Anchor Carrier Disabled
- Non-Anchor Carrier Enabled
- with Different PCI
- Guarband Mode
- Standalone Mode
This tutorial is based on the configuration for standalone mode.
Table of Contents
- NB IoT (standalone) - UEsim
Test Setup
Test setup for this tutorial is as shown below.
Configuration
An important thing in using UE sim is to do proper matching between UE sim configuration and Call box configuration In this tutorial, I used the ue-nbiot-standalone.cfg and and enb-nbiot-standalone.cfg without any change
If you use other Network (e.g, other network simulator or real network), you have to make it sure to configure UE sim according to the settings on network side
For UEsim, the ue-nbiot-standalone.cfg is used (
For Callbox, the enb-nbiot-standalone.cfg is used (
For the core network, mme-ims.cfg is used for configuration.
Open up enb-nbiot-standalone.cfg and note some fundamental configuration parameter for this test. It is important to note dl_earfcn, n_antenna_dl, n_antenna_ul and operation_mode and UEsim configuration should set to match these parameters.
You would see following in /root/mme/config/ims-ims.cfg file on Callbox. The important part to note is 'include "ue_db-ims.cfg" which carries the information about authentication and IMS registration.
Following is the contents of "ue_db-ims.cfg" on Callbox. sim_algo, imsi, amf, sqn, K are authentication related parameters and other parts (impi, impu, domain) are for IMS registration and basic call setup.
In this tutorial, following SIM information will be used. this is the configuration in ue-nbiot-standalone.cfg on UEsim. The important part to note are imsi and K which is USIM parameter for attach.
Following is the configuration on Callbox (enb-nbiot-standalone.cfg). The important part to note is dl_earfcn and operation_mode in this test. You should match dl_earfcn on Call box with dl_earfcn on UEsim.
Following is the configuration on UEsim (ue-nbiot-standalone.cfg) . The important things to note are to match the UEsim parameters (CELL_BANDWIDTH, N_ANTENNA_DL, N_ANTENNA_UL, dl_earfcn) with the correspoinding configurations of Callbox (eNB)
Check if LTE service is Running
Whatever you want to test, the first thing you need to do is that call box program (LTE Service) is running. You can check on the execution status of the call box program by running following command and you should get the result as shown below
# service lte status
NOTE : Getting this result is pre-requisite for Call Box Operation, but this result itself does not guarantee the normal operation. If you see some unexpected issues. You may restart the call box with following command
# service lte restart
Getting into Screen Mode
If it is confirmed that the lte service is running, go to screen mode by running 'screen -r' and follow through the steps as shown below. The steps shown here is the procedure that you would use for almost every test and it is highly recommended to get familiar with these steps. For further commands you can use in this screen mode, refer to the tutorial : Command Line Command
Run following command on UE sim
You will get the screen as shown below
Run following command on Callbox
You will get the screen as shown below
Attach UE
Now perform UE attach procedure. This would be a little bit busy process since you need to switch back and forth between Callbox screen and UEsim screen.
This is not the mandatory step, but I would stronly recommend you to check the output of 'cell phy' and 'cell' command in (ENB) screen and check out the basic configuration (e.g, ARFCN, BAND, BW etc) is configured as intended.
Start tracing on Callbox
power_on UE on UE sim.
You will see following message once UE detect the cell and decoded SIBs.
Once UE completed SIB decoding and perform initial attach, you will see following trace on Callbox screen.
When the initial attach completed, you can check on the cell information to which the UE sim is registered to with 'cells' command.
You can get the ue information that is in connection with gNB on Callbox with 'ue' command in (enb) screen.
You can get the ue information that is in connection with gNB on Callbox with 'ue' command in (mme) screen.
Log Analysis
In this section, you will see how to confirm if UE registration is complete from trace log. You can use the same method to find any issues (e.g, registration failure) for troubleshooting. When UE registration fails, you may use this tutorial to figure out the point of the failure and troubleshoot
Open /tmp/ue0.log on UEsim using any text editor. I am using nano in this tutorial. (NOTE : In the same way, you can check eNB log by opening /tmp/enb0.log on Callbox).
First thing to note is to check if NPSS and NPBCH is logged. If you find this, it indcates that UEsim successfully detected sync channels and decoded MIB.
This is SystemInformationBlockType1-r13 message indicating that the cell operates on frequency band 20 (freqBandIndicator-r13) and broadcasts system information every 128 radio frames with repetition every 2nd frame (si-Periodicity-r13, si-RepetitionPattern-r13). The PLMN is identified as MCC 001 and MNC 01 (plmn-Identity-r13), and the cell is not reserved (cellReservedForOperatorUse-r13 notReserved). The system information(i.e, SIB2 and others) is carried in transport block index b208 (si-TB-r13).
This is sib2-r13, which configures essential NB-IoT parameters for random access, paging, and uplink/downlink channels.
The paging configuration (pcch-Config-r13) sets the default paging cycle to rf128 and defines one repetition (npdcch-NumRepetitionPaging-r13 r1), indicating how often and how many times paging messages are sent. Random access settings (rach-ConfigCommon-r13) allow up to 10 preamble transmissions with an initial target power of -104 dBm, and the contention resolution timer is set to 32 subframes.
For NPRACH (nprach-Config-r13), preambles are scheduled every 80 ms (nprach-Periodicity-r13) with 12 subcarriers and allow up to 10 attempts per CE level (maxNumPreambleAttemptCE-r13). Each RA preamble is repeated once, and the downlink control channel uses 8 repetitions (npdcch-NumRepetitions-RA-r13 r8).
The uplink shared channel (npusch-ConfigCommon-r13) uses 1 repetition for HARQ feedback and disables group hopping (groupHoppingEnabled-r13 FALSE). For downlink, the NPDSCH transmit power is set to 0 dB (nrs-Power-r13 0).
This is an LTE Attach Request message where the UE initiates an EPS attach with IMSI 001010123456789 and requests a PDN connection. It supports extended protocol configuration (ePCO=1) and multiple DRBs (multipleDRB=1). The embedded PDN Connectivity Request asks for an IPv6 connection (PDN type = 3) with an initial request type.
Pay attention to UE network capability and see if the UE support all the capabilities that is required for the intended test.
This is an NB-IoT RRC Connection Request message with establishmentCause-r13 set to mo-Signalling, indicating the UE is initiating signaling. The UE identity is provided as a random value (5B095D9A1B'H). It supports multi-tone operation (multiToneSupport-r13 = true) and early contention resolution (earlyContentionResolution-r14 = TRUE), with no CQI measurements reported (cqi-NPDCCH-r14 = noMeasurements).
This is an NB-IoT RRC Connection Setup message with transaction ID 0. It configures the dedicated radio resources (radioResourceConfigDedicated-r13), including control signaling over the NPDCCH. The configuration sets npdcch-NumRepetitions-r13 to r8 (8 repetitions), with npdcch-StartSF-USS-r13 as v4 and npdcch-Offset-USS-r13 as zero, defining the starting subframe and offset for NPDCCH in the uplink shared search space (USS).
This is an NB-IoT RRC Connection Setup Complete message indicating the UE has successfully completed the RRC setup procedure. It includes the selected PLMN ID (selectedPLMN-Identity-r13 = 1) and carries the NAS message (dedicatedInfoNAS-r13). The flag up-CIoT-EPS-Optimisation-r13 = true confirms that the UE is using control plane CIoT EPS optimization for efficient small data transmission over NAS.
This is an EMM Authentication Request message (message type = 0x52) from Network to the UE during the LTE attach procedure. It includes a random challenge value (RAND) and an authentication token (AUTN) used for mutual authentication. The message is a plain NAS message (not ciphered or integrity protected) with NAS key set identifier set to 0, indicating initial security context establishment.
This is an EMM Authentication Response message (message type = 0x53) from the UE to the network. It contains the authentication response parameter, an 8-byte value used to verify the UE's identity based on the earlier challenge (RAND). The message is a plain NAS message, indicating it is still part of the initial security setup.
This is a Security Mode Command message (message type = 0x5d) from the network to UE to establish NAS security. It is protected with a new EPS security context (Security header = 0x3) and selects EEA0 for encryption and EIA2 for integrity (Selected NAS security algorithms = 0x02). The UE is asked to confirm previously reported security capabilities, and the network also requests the IMEISV (IMEISV request = 1) for identity verification.
This is a Security Mode Complete message (message type = 0x5e) sent by the UE, confirming acceptance of the NAS security algorithms and EPS security context. The message is both integrity protected and ciphered (Security header = 0x4). The UE also includes its IMEISV (0123456700000101) as requested earlier by the network.
This is an NB-IoT RRC Security Mode Command message (securityModeCommand-r13) sent from the network to the UE. It specifies the selected security algorithms: eea0 for ciphering (no encryption) and eia2 for integrity protection
This is an NB-IoT RRC Security Mode Complete message (securityModeComplete-r13) sent by the UE in response to the Security Mode Command. It confirms acceptance of the configured security algorithms (eea0 for ciphering and eia2 for integrity).
This is an NB-IoT RRC UE Capability Enquiry message (ueCapabilityEnquiry-r13) sent by the network to request the UE’s supported features and capabilities
This is an NB-IoT RRC UE Capability Information message (ueCapabilityInformation-r13) sent by the UE in response to the UE Capability Enquiry. It indicates that the UE supports multi-tone operation (multiTone-r13 = supported), operates on band 20 with 20 dBm power class (powerClassNB-20dBm-r13 = supported), and belongs to Category NB1 (ue-Category-NB-r13 = nb1).
This is an NB-IoT RRC Connection Reconfiguration message (rrcConnectionReconfiguration-r13) used to set up data radio bearer configuration after the attach. It includes dedicatedInfoNASList-r13, which carries a NAS message, and configures DRB 1 for EPS bearer ID 5. The PDCP configuration disables header compression and sets discardTimer to infinity. The RLC is configured in AM mode with retransmission timer t-PollRetransmit = 6000 ms and maxRetxThreshold = 32. The logical channel is assigned ID 4 with priority 13.
This is an NB-IoT RRC Connection Reconfiguration Complete message (rrcConnectionReconfigurationComplete-r13) sent by the UE. It confirms successful application of the configuration received in the preceding RRC Connection Reconfiguration message, including DRB setup and NAS content.
This is an EMM Attach Accept message sent from the Network to the UE, confirming successful attach with result "EPS only". The timer T3412 is set to 30 minutes, and the UE is assigned a PDN address (192.168.2.2) with PDN type = IPv4.
Embedded within is an ESM Activate Default EPS Bearer Context Request message (message type = 0xc1), assigning EPS bearer ID 5 with QCI = 9 and APN "default.mnc001.mcc001.gprs". The ESM cause = 0x32 indicates that only IPv4 is allowed. The UE is also informed of supported network features like ePCO=1, S1-U data=1, and IMS VoPS=1
This is an EMM Attach Complete message sent by the UE, confirming successful completion of the attach procedure. It includes an ESM message container with Activate Default EPS Bearer Context Accept (message type = 0xc2) for EPS bearer ID 5, confirming acceptance of the default bearer and PDN connectivity settings provided earlier.
RRC / NAS Signaling
SIB1
: This is the SIB1 sent by eNB to configiture NB IoT (
{
message c1: systemInformationBlockType1-r13: {
hyperSFN-MSB-r13 '01'H,
cellAccessRelatedInfo-r13 {
plmn-IdentityList-r13 {
{
...
}
},
...
},
cellSelectionInfo-r13 {
...
},
p-Max-r13 10,
freqBandIndicator-r13 7,
eutraControlRegionSize-r13 n3,
nrs-CRS-PowerOffset-r13 dB0,
schedulingInfoList-r13 {
{
si-Periodicity-r13 rf128,
si-RepetitionPattern-r13 every2ndRF,
sib-MappingInfo-r13 {
},
si-TB-r13 b208
}
},
si-WindowLength-r13 ms160,
systemInfoValueTagList-r13 {
0
}
SIB2
: This is the SIB2 sent by eNB to configiture NB IoT (
{
message c1: systemInformation-r13: {
criticalExtensions systemInformation-r13: {
sib-TypeAndInfo-r13 {
sib2-r13: {
radioResourceConfigCommon-r13 {
rach-ConfigCommon-r13 {
preambleTransMax-CE-r13 n10,
powerRampingParameters-r13 {
powerRampingStep dB2,
preambleInitialReceivedTargetPower dBm-104
},
rach-InfoList-r13 {
{
ra-ResponseWindowSize-r13 pp5,
mac-ContentionResolutionTimer-r13 pp32
}
}
},
bcch-Config-r13 {
modificationPeriodCoeff-r13 n64
},
pcch-Config-r13 {
defaultPagingCycle-r13 rf128,
nB-r13 oneT,
npdcch-NumRepetitionPaging-r13 r1
},
nprach-Config-r13 {
nprach-CP-Length-r13 us66dot7,
nprach-ParametersList-r13 {
{
nprach-Periodicity-r13 ms80,
nprach-StartTime-r13 ms32,
nprach-SubcarrierOffset-r13 n0,
nprach-NumSubcarriers-r13 n12,
nprach-SubcarrierMSG3-RangeStart-r13 twoThird,
maxNumPreambleAttemptCE-r13 n10,
numRepetitionsPerPreambleAttempt-r13 n1,
npdcch-NumRepetitions-RA-r13 r8,
npdcch-StartSF-CSS-RA-r13 v4,
npdcch-Offset-RA-r13 zero
}
}
},
npdsch-ConfigCommon-r13 {
nrs-Power-r13 0
},
npusch-ConfigCommon-r13 {
ack-NACK-NumRepetitions-Msg4-r13 {
r1
},
dmrs-Config-r13 {
threeTone-CyclicShift-r13 0,
sixTone-CyclicShift-r13 0
},
ul-ReferenceSignalsNPUSCH-r13 {
groupHoppingEnabled-r13 FALSE,
groupAssignmentNPUSCH-r13 0
}
},
uplinkPowerControlCommon-r13 {
p0-NominalNPUSCH-r13 -80,
alpha-r13 al1,
deltaPreambleMsg3-r13 0
}
},
ue-TimersAndConstants-r13 {
t300-r13 ms2500,
t301-r13 ms2500,
t310-r13 ms200,
n310-r13 n6,
t311-r13 ms10000,
n311-r13 n5
},
freqInfo-r13 {
additionalSpectrumEmission-r13 1
},
timeAlignmentTimerCommon-r13 infinity
}
}
}
}
}
Attach Request
: This is the AttachRequest sent by UE to inform UE capability for NB IoT NAS feature (
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x41 (Attach request)
EPS attach type = 1 (EPS attach)
NAS key set identifier:
TSC = 0
NAS key set identifier = 7
Old GUTI or IMSI:
IMSI = 001010123456789
UE network capability:
0xe0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=0, EEA4=0, EEA5=0, EEA6=0, EEA7=0)
0xe0 (EIA0=1, 128-EIA1=1, 128-EIA2=1, 128-EIA3=0, EIA4=0, EIA5=0, EIA6=0, EIA7=0)
0x00 (UEA0=0, UEA1=0, UEA2=0, UEA3=0, UEA4=0, UEA5=0, UEA6=0, UEA7=0)
0x00 (UCS2=0, UIA1=0, UIA2=0, UIA3=0, UIA4=0, UIA5=0, UIA6=0, UIA7=0)
0x00 (ProSe-dd=0, ProSe=0, H.245-ASH=0, ACC-CSFB=0, LPP=0, LCS=0, 1xSRVCC=0, NF=0)
0x90 (ePCO=1, HC-CP CIoT=0, ERw/oPDN=0, S1-U data=1, UP CIoT=0, CP CIoT=0, ProSe-relay=0, ProSe-dc=0)
0x01 (15 bearers=0, SGC=0, N1mode=0, DCNR=0, CP backoff=0, RestrictEC=0, V2X PC5=0, multipleDRB=1)
ESM message container:
Protocol discriminator = 0x2 (EPS Session Management)
EPS bearer identity = 0
Procedure transaction identity = 1
Message type = 0xd0 (PDN connectivity request)
Request type = 1 (initial request)
PDN type = 3 (IPv4v6)
Extended protocol configuration options:
Ext = 1
Configuration protocol = 0
Protocol ID = 0x8021 (IPCP)
Data = 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00
Protocol ID = 0x0001 (P-CSCF IPv6 Address Request)
Data =
Protocol ID = 0x0003 (DNS Server IPv6 Address Request)
Data =
Protocol ID = 0x000a (IP address allocation via NAS signalling)
Data =
Protocol ID = 0x000c (P-CSCF IPv4 Address Request)
Data =
Protocol ID = 0x000d (DNS Server IPv4 Address Request)
Data =
Protocol ID = 0x0016 (APN rate control support indicator)
Data =
Additional update type = 0x01 (no additional information, keeping NAS signalling connection not required, SMS only)
MS network feature support = 0x01 (MS supports the extended periodic timer in this domain)
RrcConnectionSetup
: This is the RrcConnectionSetup sent by eNB to configiture NB IoT (
{
message c1: rrcConnectionSetup-r13: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: rrcConnectionSetup-r13: {
radioResourceConfigDedicated-r13 {
srb-ToAddModList-r13 {
{
rlc-Config-r13 explicitValue: am: {
ul-AM-RLC-r13 {
t-PollRetransmit-r13 ms6000,
maxRetxThreshold-r13 t32
},
dl-AM-RLC-r13 {
}
},
logicalChannelConfig-r13 explicitValue: {
priority-r13 1
}
}
},
mac-MainConfig-r13 explicitValue-r13: {
ul-SCH-Config-r13 {
periodicBSR-Timer-r13 pp16,
retxBSR-Timer-r13 pp64
},
timeAlignmentTimerDedicated-r13 infinity
},
physicalConfigDedicated-r13 {
npdcch-ConfigDedicated-r13 {
npdcch-NumRepetitions-r13 r8,
npdcch-StartSF-USS-r13 v4,
npdcch-Offset-USS-r13 zero
}
}
UE Capability Information
: This is the UE Capability Information sent by UE to inform RRC capability for NB IoT (
{
message c1: ueCapabilityInformation-r13: {
rrc-TransactionIdentifier 0,
criticalExtensions ueCapabilityInformation-r13: {
ue-Capability-r13 {
accessStratumRelease-r13 rel14,
ue-Category-NB-r13 nb1,
multipleDRB-r13 supported,
pdcp-Parameters-r13 {
supportedROHC-Profiles-r13 {
profile0x0002 TRUE,
profile0x0003 FALSE,
profile0x0004 TRUE,
profile0x0006 FALSE,
profile0x0102 FALSE,
profile0x0103 FALSE,
profile0x0104 FALSE
},
maxNumberROHC-ContextSessions-r13 cs12
},
phyLayerParameters-r13 {
multiTone-r13 supported
},
rf-Parameters-r13 {
supportedBandList-r13 {
{
band-r13 7,
powerClassNB-20dBm-r13 supported
}
}
}
},
ue-RadioPagingInfo-r13 {
ue-Category-NB-r13 nb1
},
nonCriticalExtension {
ue-Capability-ContainerExt-r14 {
ue-Category-NB-r14 nb2,
rf-Parameters-v1430 {
}
Attach Accept
: This is the AttachAccept sent by UE to inform NW capability for IoT NAS feature and Activate Default EPS Bearer(
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x2 (Integrity protected and ciphered)
Auth code = 0x8cd0b681
Sequence number = 0x01
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x42 (Attach accept)
EPS attach result = 1 (EPS only)
T3412 value:
Value = 30
Unit = 1 (1 minute)
TAI list:
Length = 6
Data = 00 00 f1 10 00 02
ESM message container:
Protocol discriminator = 0x2 (EPS Session Management)
EPS bearer identity = 5
Procedure transaction identity = 1
Message type = 0xc1 (Activate default EPS bearer context request)
EPS QoS:
QCI = 9
Access point name = "default.mnc001.mcc001.gprs"
PDN address:
PDN type = 1 (IPv4)
IPv4 = 192.168.2.2
ESM cause = 0x32 (PDN type IPv4 only allowed)
Extended protocol configuration options:
Ext = 1
Configuration protocol = 0
Protocol ID = 0x8021 (IPCP)
Data = 03 00 00 0a 81 06 08 08 08 08
Protocol ID = 0x000d (DNS Server IPv4 Address)
Data = 8.8.8.8
Protocol ID = 0x0016 (APN rate control parameters)
Data = 00 00 00 00
GUTI:
MCC = 001
MNC = 01
MME Group ID = 32769
MME Code = 1
M-TMSI = 0x209e332f
Emergency number list:
Length = 8
Data = 03 1f 19 f1 03 1f 11 f2
EPS network feature support:
0x01 (CP CIoT=0, ERw/oPDN=0, ESRPS=0, CS-LCS=0, EPC-LCS=0, EMC BS=0, IMS VoPS=1)
0x0a (15 bearers=0, IWK N26=0, RestrictDCNR=0, RestrictEC=0, ePCO=1, HC-CP CIoT=0, S1-U data=1, UP CIoT=0)
Additional update result = 0x02 (SMS only)