LTE LPP (LTE Positioning Protocol)

This tutorial is to show how to configure and test LPP. LPP stands for LTE Positioning Protocol and it is a mechanism to facilitate the exchange of positioning information between the mobile device and the network. Conceptually in terms of the purpose LPP is similar to SUPL(Secure User Plane Location). Main differences from SUPL would be

• LPP can be associated not only with GPS but also with other system like GLONASS, Galileo, and QZSS etc whereas SUPL is mainly associated with GPS
• LPP support the information exchange not only via U-plane but also via C-Plane whereas SUPL supports U-Plane only.
• LPP is supported in LTE and NR, whereas SUPL is supported in 3G/4G.

NOTE :Currently there are a couple of limitation in Amarisoft LPP

• Only C-Plane LPP is supported (U-Plane LPP is not supported)
• LCS Server (SLP, E-SMLC) is not supported by Amarisoft. Instead we provide a feature to generate location request and process the response by internal test function. (NOTE : If you have your own LCS server, it can be connected to Amarisoft LPP functionality)

NOTE : LPP is supported since the release 2024-02-20

Table of Contents

• LTE LPP (LTE Positioning Protocol)
• Test Setup
• Setup A
• Setup B
• Key Configuration Parameters
• Configuration
• Perform the test
• Log Analysis
• RRC / NAS Signaling
• Downlink generic NAS transport /(LTE Positioning Protocol (LPP) message)
• Uplink generic NAS transport /(LTE Positioning Protocol (LPP) message)

Test Setup

Test setup for this tutorial is as shown below.  

• SIM Card used in this tutorial is the one delivered with the system as it is.
• If you want to change the configuration, The tutorial Configuration Guide would help

Setup A

This is the setup where you use a commercial UE as DUT.

Setup B

This is the setup where you use a commercial Amarisoft UEsim as DUT.

Key Configuration Parameters

Followings are important configuration parameters for this tutorial. You may click on the items for the descriptions from Amarisoft documents.

• nl1
• api_root
• transaction_timeout
• server_bind_addr
• lcs
• server_addr
• bind_addr
• local_e_smlc
• lpp_test
• e_smlc_id
• transaction_id
• periodic_meas
• meas_period
• meas_id
• otdoa_assistance_data
• ref_pci
• ref_earfcn
• neighbour
• earfcn
• pci
• nr_tdoa_assistance_data
• pointA_arfcn
• cells
• arfcn
• pci

Configuration

I have used  enb.default.cfg on Callbox (gNB) as it is without any modification.

I am using the  mme-ims-lte-lpp.cfg which is copied and modified from mme-ims.cfg

I have used  ue.default.cfg on UEsim as it is without any modification.

For eNB configuration, there is no specific parameters you need to set.  Just use enb.default.cfg without any modification.

Here FDD is used and Bandwidth is set to 5Mhz (N_RB_DL 25)

Specify dl_earfcn as you want. A band 7 freuency is used in this test.

In mme-ims-lte-lpp.cfg , the e-SMLC configuration is specified. It is configured by the parameter local_e_smlc. In case where you want to use Anarisoft mme for the testing purpose without using external e-SMLC server, just set lpp_test : true and set e_smlc_id, perodic_meas, meas_period, meas_id and otdoa_assistance_data as you want.

In ue-lpp.cfg , I didn't configure any specific parameter. I just used the default LTE configuration on UEsim as it is.

FDD is used and bandwidth is set to 5 Mhz (CELL_BANDWIDTH 5).

Configure ground_position_at_origin in cell_groups. This is required for the UEsim to respond to lpp_location_request for gnss. If you don't configure this, UEsim will send Error message in NAS when it is requested with GNSS report.

Cell frequency is set to be same as eNB configuration (Band 7) by dl_earfcn.  

UE configuration in ue_list is also used as in the default configuration.

Perform the test

Check out the cell configuration with the command 'cell phy and cell' command, and confirm that they are configured as intended.

Switch to (mme) screen and run 'lcs' command. Make it sure that the LCS connection state is 'state=connected'.

Power on a UE in UEsim

Make it sure that the initial attach is completed properly.

On Callbox, send the remote API command to send location requation message to UE. Go to /root/mme directory on Callbox and run following Remote API command.

./ws.js mme '{"message": "location_req","imsi": "001010123456789","imei": "01234567000001","session_id": 1,"plmn": "00101","cell_id": 0x1A2D001,"type": "geographic"}'

Once you receive the response to location_req message, send another command to request report to E-SMLC. The command that I sent at this point is 'lpp_request_location' command for "ecid".

NOTE : This command should be sent within 5min after "location_req" command since the session for "location_req" will expire in 5min.

./ws.js mme '{"message": "lpp_request_location","supi": "imsi-001010123456789","imei": "01234567000001","correlation_id": 1,"lpp_methods": ["ecid"],"report_type":"once"}'

NOTE : "pei" is an optional parameter, but you should specify this when multi-UE is enabled.

Now let's send another command to request report to E-SMLC. The command that I sent at this point is 'lpp_request_location' command for "gnss".

NOTE : This command should be sent within 5min after "location_req" command since the session for "location_req" will expire in 5min.

./ws.js mme '{"message": "lpp_request_location","supi": "imsi-001010123456789","imei": "01234567000001","correlation_id": 1,"lpp_methods": ["gnss"],"report_type":"once"}'

NOTE : "pei" is an optional parameter, but you should specify this when multi-UE is enabled.

Log Analysis

When you turn on eNB with mme configured with LPP, LCSAP is activated. Make it sure that LCSAP is connected before powering up UE.

After the initial attach is completed, you trigger eNB to send location request with remote API 'location_req'. Once the command is received by the core network (mme), it send the request to LCS via LCSAP.

First the core network send 'Location Request' message with id-UE-Positioning-Capability information.

Then the e-SMLC send LPP request capabilities to the LCS client in the MME in the message LCS-AP  Connection Oriented Information

Then the details of the request is sent from LCS to core network and the core network finally conveys the message to UE via NAS message (Downlink generic NAS transport).

Once the LPP request capabilities is received by the UE, the UE is supposed to send the response LPP provide capabilities via NAS message Uplink Generic NAS transport

Once the Positioning Information from UE is received by the core network (mme), the core network relays it to LCS server.

Once the LCS get the positioning information, it replies with ack (acknowledgement).

When you run ./ws.js mme '{"message": "lpp_request_location","supi": "imsi-001010123456789","imei": "01234567000001","correlation_id": 1,"lpp_methods": ["ecid"],"report_type":"once"}', a sequence of steps are performed as follows :

When you run ./ws.js mme '{"message": "lpp_request_location","supi": "imsi-001010123456789","imei": "01234567000001","correlation_id": 1,"lpp_methods": ["gnss"],"report_type":"once"}', a sequence of steps are performed as follows

RRC / NAS Signaling

Downlink generic NAS transport /(LTE Positioning Protocol (LPP) message)

Message: Downlink generic NAS transport

Data:

0000:  27 39 64 3e b7 03 07 68  01 00 0c 90 02 00 fa 02  '9d>...h........

0010:  05 02 c0 e0 14 06 40 65  04 00 00 00 01           ......@e.....

Protocol discriminator = 0x7 (EPS Mobility Management)

Security header = 0x2 (Integrity protected and ciphered)

Auth code = 0x39643eb7

Sequence number = 0x03

Protocol discriminator = 0x7 (EPS Mobility Management)

Security header = 0x0 (Plain NAS message, not security protected)

Message type = 0x68 (Downlink generic NAS transport)

Generic message container type = 1 (LTE Positioning Protocol (LPP) message)

Generic message container:

{

  transactionID {

    initiator locationServer,

    transactionNumber 1

  },

  endTransaction FALSE,

  lpp-MessageBody c1: requestCapabilities: {

    criticalExtensions c1: requestCapabilities-r9: {

      commonIEsRequestCapabilities {

        lpp-message-segmentation-req-r14 '11'B

      },

      a-gnss-RequestCapabilities {

        gnss-SupportListReq TRUE,

        assistanceDataSupportListReq TRUE,

        locationVelocityTypesReq TRUE

      },

      otdoa-RequestCapabilities {

      },

      ecid-RequestCapabilities {

      },

      nr-ECID-RequestCapabilities-r16 {

      },

      nr-DL-TDOA-RequestCapabilities-r16 {

      }

    }

  }

}

Additional information:

  Length = 4

  Data = 00 00 00 01

Uplink generic NAS transport /(LTE Positioning Protocol (LPP) message)

Message: Uplink generic NAS transport

Data:

0000:  27 37 b2 a9 1c 03 07 69  01 00 29 f0 03 00 42 1e  '7.....i..)...B.

0010:  80 81 60 28 28 00 0a 3f  c4 4a 85 2b 08 84 04 00  ..`((..?.J.+....

0020:  c0 02 00 02 00 02 00 02  a0 02 00 02 01 87 05 80  ................

0030:  60 00 70 00 65 04 00 00  00 01                    `.p.e.....

Protocol discriminator = 0x7 (EPS Mobility Management)

Security header = 0x2 (Integrity protected and ciphered)

Auth code = 0x37b2a91c

Sequence number = 0x03

Protocol discriminator = 0x7 (EPS Mobility Management)

Security header = 0x0 (Plain NAS message, not security protected)

Message type = 0x69 (Uplink generic NAS transport)

Generic message container type = 1 (LTE Positioning Protocol (LPP) message)

Generic message container:

{

  transactionID {

    initiator locationServer,

    transactionNumber 1

  },

  endTransaction TRUE,

  sequenceNumber 0,

  acknowledgement {

    ackRequested TRUE

  },

  lpp-MessageBody c1: provideCapabilities: {

    criticalExtensions c1: provideCapabilities-r9: {

      commonIEsProvideCapabilities {

        segmentationInfo-r14 noMoreMessages,

        lpp-message-segmentation-r14 '10'B

      },

      a-gnss-ProvideCapabilities {

        gnss-SupportList {

          {

            gnss-ID {

              gnss-id gps

            },

            agnss-Modes {

              posModes '100'B

            },

            gnss-Signals {

              gnss-SignalIDs 'FF'H

            },

            adr-Support FALSE,

            velocityMeasurementSupport FALSE

          }

        },

        locationCoordinateTypes {

          ellipsoidPoint TRUE,

          ellipsoidPointWithUncertaintyCircle FALSE,

          ellipsoidPointWithUncertaintyEllipse FALSE,

          polygon FALSE,

          ellipsoidPointWithAltitude TRUE,

          ellipsoidPointWithAltitudeAndUncertaintyEllipsoid FALSE,

          ellipsoidArc FALSE

        }

      },

      otdoa-ProvideCapabilities {

        otdoa-Mode '100'B,

        supportedBandListEUTRA {

          {

            bandEUTRA 7

          }

        },

        interFreqRSTDmeasurement-r10 supported,

        prs-id-r14 supported,

        tp-separation-via-muting-r14 supported,

        maxSupportedPrsBandwidth-r14 n100,

        periodicalReporting-r14 supported,

        interRAT-RSTDmeasurement-r15 supported

      },

      ecid-ProvideCapabilities {

        ecid-MeasSupported '00111'B,

        ueRxTxSupTDD-r13 true,

        periodicalReporting-r14 supported,

        triggeredReporting-r14 supported

      }

    }

  }

}

Additional information:

  Length = 4

  Data = 00 00 00 01