LTE PDCCH introducton

PDCCH is also called heart of LTE. 1 PDCCH consist of 1, 2, 4 or 8 CCEs. 1 CCE = 9 REG, 1 REG = 4REs, with QPSK modulation, 1 RE could carry 2 bits information. In total, 1CCE has 36RE * 2 bits = 72 bits. There are 4 different PDCCH formats mapped to 4 different CCE aggregation levels (1, 2, 4, 8).

Search Space is defined Sk = L * {(Yk + m') mod floor(NCCE,k/L)} + i

For common search space, L is 4 or 8; For UE-specific search space, L is 1, 2, 4 or 8
NCCE,k is total number of CCEs in subframe k
i = 0, 1, ...... L-1
For common search space, m' = m; For UE-specific search space, if no carrier indicator field is configured on UE, m' = m; else m' = m + M(L) * nCI,  wehre nCI is the value of carrier indicator, M(L) is the number of PDCCH candidates to monitor in the given search space.
m = 0, 1, ..... M(L)-1

Following table is quoted from 3GPP 36.213 9.1.1

For common search space, Yk is set to 0 for L = 4 or 8
For UE-specific search space, Yk = (A * Yk-1) mod D, where Y-1 = nrnti, A = 39827, D = 65537, k = floor(ns/2), ns is the slot number in a radio frame.

Following is an example of calculating C-RNTI = 135, UE-specific search space starting point:
For k=0 (ns = 0 or 1, subframe 0),

LTE attach procedure after random access

After random access, UE acquired some RRC dedicated configuration, but in order to establish DRB, UE has to follow NAS protocol and make connection with MME to setup signaling channel.

NAS protocol is in 3GPP 24.301, to search certain IE from ASN decoded log in 24.301, add space between each word. I.E. Search "MMEGroupID", use string "MME Group ID"

Following NAS procedure is quoted from http://www.sharetechnote.com/

Following is a very good chart explained all channels of all layers. Also quoted from http://www.sharetechnote.com/

Comments regarding UE attach procedure
1. IE ESMInformationTransferFlag in attachRequest (RRCConnectionComplete) has to be set to '01'H in order for MME to send ESMInformationRequest. UE has to respond ESMInformationRequest with ESMInformationResponse which contains requested APN information.
2. After proper detach, when attach again, UE will not need to be authenticated again for certain amount of times depending on MME's configuration.
3. If UENetworkCapability is included in attachRequest or trackingAreaUpdateRequest, MME will send authenticationRequest to UE.

LTE troubleshoot case analysis (1)

1. Issue description:
Observed from eNB baseband log that at every subframe 9, eNB detected DTX for PDSCH transmission. And for subframe 3, eNB NACKed every PUSCH transmitted by UE.

2. Troubleshoot steps:
  (1) Since UL grant information is missed in baseband log, used Sanjole Intelijudge captured UL grant for 10secs.
  (2) From Intelijudge log, it showed that eNB gave UE UL grant at subframe 7 and subframe 9. The subframe 9 grant has CSI-requested bit set to 1; the subframe 7 grant has CSI-requested bit set to 0.
  (3) By comparing UE log, Intelijudge capture and eNB log, UE missed UL grant at subframe 9 (This is very hard to tell why).
  (4) With above missing, the whole process can be explained logically as follows:
      <1> At subframe 9, eNB sent UL grant with CSI-requested bit set to 1 (DL buffer size exceed threshold and a-periodic CQI report interval is 10ms). However, UE missed this grant.
      <2> At subframe 3, eNB was expecting UE to report CQI with PUSCH transmission but didn't get anything. Since this is interpreted as DTX, at subframe 7, eNB send ACK on PHICH and decided to use adaptive re-transmission. UE successfully decode this UL grant and at subframe 1, UE send PUSCH data, which is ACKed by eNB at subframe 5.

3. Conclusion:
The root cause is UE missed the DCI format 0 at subframe 9 and result in following consecutive consequences.

LTE PDSCH, PUSCH and PMCH transmission

1. For PDSCH transmission, after eNB sent TB to UE at subframe X, UE has to firstly decode C-RNTI scrambled PDCCH to get the location of REs that carries PDSCH data. Combined decoding of PDCCH and corresponding PDSCH usually has allowance of 4ms. UE would send HARQ ACK/NACK to eNB at subframe (X+4).
  (1) If eNB sent DCI format 0 to UE at subframe X, eNB would expect UE to send HARQ ACK/NACK on PUSCH at subframe (X+4). However, eNB should also monitor PUCCH at subframe (X+4).
  (2) If eNB didn't send DCI format 0 to UE, eNB would only monitor PUCCH resource (This UE specific PUCCH sequence is allocated to UE at attach procedure) at subframe (X+4).
On detection of NACK or DTX at subframe (X+4), eNB would resend TB with RV0 (All systematic bits) with DTX detection and RV2 (Only redundancy bits) with NACK reception after maximum 4ms of processing time.

2. For PUSCH transmission, UE send PUSCH at subframe Y, decoding allowance time for eNB is also 4ms, at subframe (Y+4), eNB send ACK/NACK in PHICH channel with pre-allocated PHICH group and sequence number. For UE to decide whether and how to do PUSCH re-transmission, UE has to monitor PHICH channel as well as C-RNTI scrambled PDCCH channel. (The reason for this is that UL has adaptive and non-adaptive and which one to way is based on the scheduling of PDCCH). This would gave UE 4ms allowance. Thus, for synchronized non-adaptive/adaptive UL re-transmission, UE is supposed to send after 8ms of initial transmission.

3. For PMCH transmission,

LTE random access procedure after cell search

After acquired common RRC configuration information. UE knows random access configuration and is ready to do random access to get RRC dedicated configuration from cell. Following RRC IEs provided RACH and PRACH configuration.

1. Interpretation of 3GPP 36.331 6.3.2 Radio Resource Config Common: prach-Config

IE prach-ConfigIndex, by mapping to 3GPP 36.211 TABLE 5.7.1-2 (FDD), -3 (TDD), UE knows it can send PRACH sequence at subframe 1 of any radio frame. 

IE prach-FreqOffset, UE knows the first PRB to transmit PRACH. 

IE rootSequenceIndex, IE zeroCorrelationZoneConfig and IE highSpeedFlag, by mapping to 3GPP 36.211 TABLE 5.7.2-2, UE know NCS value, this value is used for preamble generation. 

2. Interpretation of 3GPP 36.331 6.3.2 Radio Resource Config Common: rach-ConfigCommon

IE numberOfRA-Preambles, value represents number of non-dedicated random access preamble

IE powerRampingStep, value represents power ramping factor, used to calculate preamble received target power (PREAMBLE_RECEIVED_TARGET_POWER)

IE preambleInitialReceivedTargetPower, used to calculate preamble received target power. 

PREAMBLE_RECEIVED_TARGET_POWER = preambleInitialReceivedTargetPower + DELTA_PREAMBLE + (PREAMBLE_TRANSMISSION_COUNTER – 1) * powerRampingStep 

IE preambleTransMax, value represents maximum number of preamble transmission. PREAMBLE_TRANSMISSION_COUNTER has to be smaller than preambleTransMax. 

IE ra-ResponseWindowSize, value is in unit of number of subframes, represents duration of RA response window. Following is quoted from 3GPP 36.321 5.1.4

"Once the Random Access Preamble is transmitted and regardless of the possible occurrence of a measurement gap, the UE shall monitor the PDCCH of the PCell for Random Access Response(s) identified by the RA-RNTI defined below, in the RA Response window which starts at the subframe that contains the end of the preamble transmission [36.211] plus three subframes and has length ra-ResponseWindowSize subframes."

IE mac-ContentionResolutionTimer, value is in unit of subframes. Following is quoted from 3GPP 36.321 3.1 

"Specifies the number of consecutive subframe(s) during which the UE shall monitor the PDCCH after Msg3 is transmitted."

IE maxHARQ-Msg3Tx, value represents Maximum number of Msg3 HARQ transmissions, used for contention based random access.

3. RACH process flow chart quoted from http://www.sharetechnote.com/

LTE reference signal measurements

RSRP (Received Signal Reference Power) is defined as the measured power level at one specific RE. I.E. UE in cell centre would have a RSRP level at -65dBm.

RSSI (Received Signal Strength Indicator) is defined as the total measured power for all REs that carries RSRP across the whole measured spectrum.

RSRQ (Received Signal Received Quality) is defined using equation (NPRB * RSRP ) / RSSI

1. RSRP, RSSI and RSRQ of antenna port 0 and 1 CRS
Relation between RSSI and RSRP depends on channel bandwidth. For 10MHz system, there are in total 50 PRBs and for each PRB, the first symbol has 2 REs that transmitting CRS, thus in total there are 100 subcarriers of first symbol that is transmitting CRS. RSSI is 100 times RSRP. Converted in to dB is 10log100 = 20dB. So for UE in cell centre, if RSRP is -65dBm, RSSI is -65dBm+20dBm=-45dBm. Ideally, RSRQ =  (NPRB * RSRP ) / RSSI = -3dB. However, due to interferences, RSRQ is always lower than -3dB and RSSI is always higher than 20dB of RSRP.

2. RSRP, RSSI and RSRQ of antenna port 0 and antenna port 1 with 2 CRS
For 10MHz system,  50PRBs, each first symbol has 4 CRS (2 for antenna port 0 and 2 for antenna port 1), in total, there will be 200 subcarriers that carry cell reference signal. RSSI is 200 times RSRP. Converted in to dB is 10log200 = 23dB. So for UE in cell centre, if RSRP is -65dBm, RSSI is -65dBm+23dBm=-42dBm. Ideally,1 RSRQ =  (NPRB * RSRP ) / RSSI = -6dB. However, due to interferences, RSRQ is always lower than -6dB and RSSI is always higher than 23dB of RSRP.

LTE Cell Search from UE's perspective

Once power-up UE, UE will do initial cell search and try to camp on suitable cell. Following is general UE's procedure on cell search.

1. UE has no knowledge of any close-by band, bandwidth and pilot signal. UE has to do a step called "RSSI scan" before actual cell search started. (This RSSI concept is different than the RSSI associated with RSRP and RSRQ).  During RSSI scan, UE first filter which band it should scan on, this could be done by applying software filter, I.E. UE supported Band3, Band4, Band5 and Band13, once power up, UE would start detecting power for every 20MHz chunk starting from lowest frequency in Band3.

2. After RSSI scan phase, UE would have knowledge about which earfcn is transmitting, and power strength. I.E. earfcn 2170 has highest power level.

3. Pinpointing earfcn 2170 as central frequency with 6 PRBs as cell search bandwidth, UE first acquire PSS (For FDD, located at the last symbol of slot 0 and slot 10; For TDD, located at third symbol of subframe 1 and 6), PSS is a Zadoff-Chu sequence with length of 62 bits. PSS's root sequence has information about NID2 (3 possible root sequence mapping to 0,1,2 NID2). Since PSS's two appearances in one radio frame is the same, UE only knows 5ms timing with PSS.

4. After acquired PSS, UE has knowledge of system frame timing but not subframe timing. In order to get subframe timing and calculate CellId, UE needs to acquire SSS (For FDD, located at 1 symbol before PSS; For TDD, second last symbol of slot 1 and slot 11). The sequences that SSS used in two different locations are different (3GPP 36.211 6.11.2 ). By acquiring SSS, UE can retrieve NID1 and 10ms timing information.

5. After acquired PSS and SSS, UE is now able to do following steps:
   (1) Calculate CellId, CellId = 3 * NID1 + NID2. This CellId will be used to de-scrambling PBCH bits.
   (2) Decode PBCH (MIB, is transmitted every 4 radio frames), which is located in slot 1 of subframe 0.
   (3) Successfully decoded MIB provided 8 bits of SFN (last 2 bits of SFN is implicitly acquired in decoding PBCH), system bandwidth and PHICH configuration information (PHICH duration and PHICH Ng factor)

6. MIB was also coded by number of antenna ports. After retrieved MIB and CellId, UE is now able to do following steps:
   (1) Decode PCFICH and get number of symbols used for PDCCH.
   (2) Locate REs used for CRS (by calculating Vshift using CellId)
   (3) Locate REs used for PHICH
   (4) Calculate remaining REs left for PDCCH

7. UE is now in state waiting for System Information. UE would do blind-decoding of CCE on aggregation level 4 and 8 using SI-RNTI (65535).

8. After successful decoding SystemInformationBlock1 and other SIBs, UE has common RRC configuration information of the cell and can do random access now.

LTE PUCCH CDM (Walsh Codes as example)

In LTE PUCCH, CDM (Orthogonal Sequence) is used to increase capacity for each TTI (1ms). The principal concept of CDM can be elaborated using following example:

Simple Walsh Matrix:

1. (1 -1 1 1)          
2. (1 1 -1 1)        
3. (-1 1 1 1)
4. (1 1 1 -1)

User A, data = 1 0 1   => (1-1 1)
User B, data = 0 0 1   => (-1 -1 1)

For transmitter side:
Select sequence number 1 as code for User A, after multiplication, User A's data to be transmitted become (1 -1 1 1) | (-1 1 -1 -1) | (1 -1 1 1)

Select sequence number 4 as code for User B, after multiplication, User B's data to be transmitted become (-1 -1 -1 1) | (-1 -1 -1 1) | (1 1 1 -1)

Add User A and User B's matrix together for transmission, the total data become
(0 -2 0 2) | (-2 0 -2 0) | (2 0 2 0)


For receiver side:
To extract User A's data, multiple received codes matrix with assigned code.
[(0 -2 0 2) | (-2 0 -2 0) | (2 0 2 0)] * (1 -1 1 1) = (0+2+0+2) | (-2+0-2+0) | (2+0+2+0)
                                                                         = (4 -4 4)

Interpret 4 as 1 and -4 as 0, User A's data become 1 0 1.

The same procedure used to recover User B's data.

LTE FDD DL code rate calculation

1. Formula to calculate DL code rate for a non-special subframe (No PSS, SSS, PBCH is transmitted) is as follows:

Code Rate = (input bits+ CRC bits)/(numOfRes * Q')

In above equation,

input bits = tbs + parity bits (3GPP 36.212 5.1)
tbs is mapped to tables in 3GPP 36.213 7.1.7.2, depending on transmission configuration. I.E. number of layers.
parity bits = CRC overhead = 24 bits (For LTE PDSCH)
CRC bits = CRC overhead * numberOfCodeblock (3GPP 36.212 5.1)
numberOfCodeBlock = ceilt[input bits/(Z - L)] where Z = 6144, L = CRC overhead = 24
numOfRes (in 1ms) = [( NRBsc  * NDLsymb * 2 ) - NRBsc - numberOfResOccupiedByAntennaPortsPerPRB ] * NPRB
Q' = 6 bits for PDSCH (64QAM)


2. For PCFICH = 01 (CFI = 1), TM3, NPRB = 50 (10MHz), NRBsc = 12, NDLsymb = 7:
numberOfResOccupiedByAntennaPortsPerPRB = 12
MCS28 -> tbs = 36696 bits
CRC bits = 24 * ceil[(36696+24)/6120] = 144 bits
Q' = 6 bits (64QAM)

numOfRes (in 1ms) = [(12 * 7 * 2) - 12  - 12 ] * 50
                                 = 144 * 50 = 7200

=> DL code rate = (36696 +24 + 144)/(7200 * 6) = 0.853 < 0.931 (3GPP.36.213 7.1.7)


2. For PCFICH = 01(CFI = 1), TM7, NPRB = 50 (10MHz), NRBsc = 12, NDLsymb = 7:
numberOfResOccupiedByAntennaPortsPerPRB = 12 (antenna ports 0, 1) + 12 (antenna ports 5 or 7 and 8)

MCS28 -> tbs = 36696 bits
CRC bits = 24 * ceil[(36696+24)/6120] = 144 bits
Q' = 6 bits (64QAM)

numOfRes (in 1ms) = [(12 * 7 * 2) - 12  - 24 ] * 50
                                 = 132 * 50 = 6600

=> DL code rate = (36696 +24 + 144)/(6600 * 6) = 0.9309 < 0.931 (3GPP.36.213 7.1.7)