Baicells Technical Training

Wispapalooza 2017
Contents
01 LTE Primer

13 Unboxing the Baicells 1W Nova &

Installation Tools Required

27 Preparing the UEs

32 Antenna Basics

39 Troubleshooting
top customer issues

49 RF Planning and Design

61 Advanced Configuration

78 OMC and BOSS configuration

80 Basic LTE Network Architecture

3
 For full color booklet, visit our documentation page at 
www.baicells.com

4
LTE - Primer

1
 LTE overview
• LTE stands for Long Term Evolution and it was started
as a project in 2004 by telecommunication body known as
3GPP.
• A rapid increase of mobile data usage and emergence
of new applications 3GPP to work on the Long-Term
Evolution (LTE) on the way towards fourth-generation mobile.
• The main goal of LTE was to provide :
1. High throughput
2. Low latency
3. FDD and TDD in the same platform
Wireless Standard Evolution 4. Superior end-user experience i.e optimized signalling
5. Seamless Connection with legacy systems
6. Simple architecture

LTE network architecture

The high-level network architecture of LTE is comprised of
following three main components:
1. The User Equipment (UE).
2. The Evolved UMTS Terrestrial Radio Access Network
(E-UTRAN).
3. The Evolved Packet Core (EPC).
• The E-UTRAN handles the radio communications
between the mobile and the evolved packet cor and
just has one component, the evolved base stations,
called eNodeB or eNB.

LTE network architecture – EPC

(evolved packet core)
• The Home Subscriber Server (HSS) component has • The serving gateway (S-GW) acts as a router, and
been carried forward from UMTS and GSM and is a central forwards data between the base station and the PDN
database that contains information about all the network gateway.
operator’s subscribers.
• The mobility management entity (MME) controls the
• The Packet Data Network (PDN) Gateway (P-GW) high-level operation of the mobile by means of signaling
communicates with the outside world i.e. packet data messages and Home Subscriber Server (HSS).
networks PDN, using SGi interface. Each packet data
• The Policy Control and Charging Rules Function
network is identified by an access point name (APN). The
(PCRF) is a component which is not shown in the above
PDN gateway has the same role as the GPRS support node
diagram but it is responsible for policy control decision-
(GGSN) and the serving GPRS support node (SGSN) with
making, as well as for controlling the flow-based charging
UMTS and GSM.
functionalities in the Policy Control Enforcement Function
(PCEF), which resides in the P-GW.
2
LTE downlink : OFDM (Orthogonal
Frequency Division Multiplexing)
• Orthogonal frequency-division multiplexing (OFDM),
is a frequency-division multiplexing (FDM) scheme used as a
digital multi-carrier modulation method.
• OFDM meets the LTE requirement for spectrum
flexibility and enables cost-efficient solutions for very wide
carriers with high peak rates.
• The OFDM symbols are grouped into resource blocks.
The resource blocks have a total size of 180kHz in the
frequency domain and 0.5ms in the time domain. Each 1ms
Transmission Time Interval (TTI) consists of two slots (Tslot).
• Each user is allocated a number of so-called resource
blocks in the time. frequency grid. The more resource blocks
a user gets, and the higher the modulation used in the
resource elements, the higher the bit-rate.

3
 Advantages and Disadvantages of
OFDM
Advantages:
• Robustness against intersymbol interference (ISI) and
fading caused by multipath
• Reduced computational complexity using Fast Fourier
Transforms (FFT)
• Can easily adapt to severe channel conditions
• Robustness against burst errors caused by portions or
spectrum undergoing deep fades
• Efficient multi-access scheme by partitioning different
subcarriers among multiple users (OFDMA)
• Robustness against narrowband interference
Disadvantages
• adapt to severe channel conditions
• Robustness against burst errors caused by portions or
spectrum undergoing deep fades

LTE uplink: SC-FDMA (Single Carrier

Frequency Division Multiple Access )
• LTE uses a pre-coded version of OFDM called Single
Carrier Frequency Division Multiple Access (SC-FDMA) in
the uplink.
The main advantages for using SC-FDMA for uplink
communications:
• Lower peak-to-average power ratio
• Reduced cost of the power amplifier
• Low sensitivity to carrier frequency offset

Frame structure in LTE - FDD

The LTE frame structure are of two types based on topology
either FDD or TDD. Total Frame duration is about 10ms. There
are total 10 subframes in a frame. Each subframe composed
of 2 time slots.
Type 1, LTE frame structure is applicable to FDD system. As
shown in the figure below, an LTE TDD frame is made of
total 20 slots, each of 0.5ms. Two consecutive time slots will
form one subframe. 10 such subframes form one radio frame.
One subframe duration is about 1 ms. Hence LTE radio frame
will have duration of about 10ms. Each radio frame will have
307200 Ts. Where in one Ts equals 1/(15000 x 2048) seconds.

4
Frame structure in LTE - TDD
Each radio frame is of 10ms in length, which consists of two
half-frames of length 5ms each. Each half-frame is divided
into five subframes with 1ms duration. There are special
subframes to provide large guard periods when switching
between transmission and reception.

LTE Network Identifiers

• Public Land Mobile Network Identity (PLMN-
ID) is the identification of the network itself. PLMN is a
combination of the MCC (Mobile Country Code) and MNC
(Mobile Network Code).
• Tracking Area Code (TAC) identifies a tracking area
within a particular network.
• E-UTRAN Cell Identity (ECI) identifies a cell within a
particular network.
• Physical Cell Identity (PCI) distinguishes a cell from
its immediate neighbors.

5
 LTE User Equipment Identifiers
• International Mobile Subscriber Identity
(IMSI) is a unique ID that globally identifies a
subscriber. The IMSI is programmed on the USIM
card (SIM card).
• International Mobile Equipment Identity
(IMEI) is a unique ID that globally identifies 3GPP
UE hardware.

LTE Signal Measurements –

RSSI, RSRP, RSRQ
• RSSI (Received Signal Strength Indicator)
measures the total received wide-band power.
• RSRP (Reference Signal Received Power)
is the average power of the LTE reference signals
over the entire bandwidth.
[RANGE]: -44 ~ -140dBm

RSRP does a better job measuring signal power from a specific sector
while potentially excluding noise from other sectors.

• RSRQ (Reference Signal Received

Quality) indicates the quality of the received
reference signal.
[RANGE]: -3 ~ -19.5dB

RSRQ Formula:
RSRQ = N x RSRP / RSSI
N = Number of PRBs.

Basically, RSRQ depends on serving cell power and the number of

Tx antennas.

6
RSSI vs RSRP
• RSSI measures the power of the entire
resource block symbol containing RS (Reference
Signal).
• RSRP measures the power of a single
resource element.

LTE Signal Measurements – SINR, CINR

• Signal-to-Interference plus Noise Ratio
(SINR) is the ratio of the average received
modulated carrier power to the sum of the
average co-channel interference power and the
noise power from other sources.
• Carrier-to-Noise Ratio (CINR) is the ratio
between the power of the RF carrier bearing the
wanted signal and the total power of interfering
signals and noises.

TDD Configuration Options

Supported subframe assignments:
• 2 - DL:UL = 3:1
• 1 - DL:UL = 2:2
Peak data rates:
• 20MHz, 2-7 = 112 Mbps DL / 10 Mbps UL
• 20MHz, 1-7 = 82 Mbps DL / 20 Mbp UL
Supported special subframe patterns:
• Format 7: Short guard period (~18km limit)
• Format 5: Long guard period (~75km limit)

7
 Modulation and Coding Max troughtput [Mbps] SINR (dB) Receiver Sensitivity (dBm)
Scheme rank 1 rank 2 rank 1 rank 2
DL MCS UL MCS DL (Rank 2) UL DL UL DL DL UL DL

0-QPSK 0-QPSK 4.19 Mbps 0.53 Mbps -7.9 -6.5 -6.9 -101.9 -105.5 -100.9
1-QPSK 1-QPSK 5.44 Mbps 0.70 Mbps -6.9 -5.4 -5.5 -100.9 -104.4 -99.5
2-QPSK 2-QPSK 6.85 Mbps 0.85 Mbps -6 -4.4 -4.5 -100 -103.4 -98.5
3-QPSK 3-QPSK 8.64 Mbps 1.11 Mbps -4.8 -3.4 -3.7 -98.8 -102.4 -97.7

4-QPSK 4-QPSK 10.81 Mbps 1.39 Mbps -3.7 -2.3 -2.3 -97.7 -101.3 -96.3
5-QPSK 5-QPSK 13.20 Mbps 1.70 Mbps -3.1 -0.9 -1.5 -97.1 -99.9 -95.5
6-QPSK 6-QPSK 15.45 Mbps 1.98 Mbps -2.1 -0.1 -0.6 -96.1 -99.1 -94.6
7-QPSK 7-QPSK 18.32 Mbps 2.37 Mbps -1.1 0.6 0.6 -95.1 -98.4 -93.4
8-QPSK 8-QPSK 21.21 Mbps 2.71 Mbps -0.1 1.4 1.7 -94.1 -97.6 -92.3
9-QPSK 9-QPSK 23.74 Mbps 3.05 Mbps 0.6 2.2 2.9 -93.4 -96.8 -91.1
10-16QAM 10-QPSK 23.74 Mbps 3.40 Mbps 1.5 3 3.7 -92.5 -96 -90.3
11-16QAM 11-16QAM 26.27 Mbps 3.40 Mbps 1.7 3.3 3.9 -92.3 -95.7 -90.1
12-16QAM 12-16QAM 29.92 Mbps 3.82 Mbps 2.7 4.4 5.1 -91.3 -94.6 -88.9

13-16QAM 13-16QAM 34.30 Mbps 4.43 Mbps 3.8 5.2 6.3 -90.2 -93.8 -87.7
14-16QAM 14-16QAM 38.18 Mbps 4.90 Mbps 4.6 6.1 7.4 -89.4 -92.9 -86.6
15-16QAM 15-16QAM 42.56 Mbps 5.48 Mbps 5.5 7.2 8.8 -88.5 -91.8 -85.2
16-16QAM 16-16QAM 45.86 Mbps 5.86 Mbps 5.9 7.7 9.3 -88.1 -91.3 -84.7

17-64QAM 17-16QAM 45.86 Mbps 6.34 Mbps 6.9 8.7 10.6 -87.1 -90.3 -83.4
18-64QAM 18-16QAM 49.23 Mbps 7.03 Mbps 7.4 9 11.2 -86.6 -90 -82.8

19-64QAM 19-16QAM 54.99 Mbps 7.58 Mbps 8.4 9.5 12.7 -85.6 -89.5 -81.3
20-64QAM 20-16QAM 58.80 Mbps 8.12 Mbps 9 10.4 13.4 -85 -88.6 -80.6
21-64QAM 21-16QAM 65.72 Mbps 8.12 Mbps 10.5 10.5 15.3 -83.5 -88.5 -78.7

22-64QAM 22-16QAM 70.33 Mbps 9.07 Mbps 11 11.4 15.6 -83 -87.6 -78.4
23-64QAM 76.38 Mbps 12.1 17.2 -81.9 -76.8
24-64QAM 82.30 Mbps 13.1 18.6 -80.9 -75.4
25-64QAM 86.33 Mbps 13.6 19.1 -80.4 -74.9
26-64QAM 92.14 Mbps 14.5 21.3 -79.5 -72.7
27-64QAM 95.29 Mbps 15.5 21.4 -78.5 -72.6
28-64QAM 112.47 Mbps 19.2 22.3 -74.8 -71.7

MCS Chart
Channel Bandwidth = 20 MHz
Subframe Assignment = 2 (3:1)
Special Subframe Patterns = 7
Category 4 UE – 2rx 1tx

8
 Modulation and Coding Max troughtput [Mbps] SINR (dB) Receiver Sensitivity (dBm)
Scheme rank 1 rank 2 rank 1 rank 2
DL MCS UL MCS DL (Rank 2) UL DL UL DL DL UL DL

0-QPSK 0-QPSK 3.07 Mbps 1.07 Mbps -7.9 -6.5 -6.9 -101.9 -105.5 -100.9
1-QPSK 1-QPSK 3.99 Mbps 1.40 Mbps -6.9 -5.4 -5.5 -100.9 -104.4 -99.5
2-QPSK 2-QPSK 5.01 Mbps 1.71 Mbps -6 -4.4 -4.5 -100 -103.4 -98.5

3-QPSK 3-QPSK 6.35 Mbps 2.22 Mbps -4.8 -3.4 -3.7 -98.8 -102.4 -97.7
4-QPSK 4-QPSK 7.92 Mbps 2.79 Mbps -3.7 -2.3 -2.3 -97.7 -101.3 -96.3
5-QPSK 5-QPSK 9.69 Mbps 3.40 Mbps -3.1 -0.9 -1.5 -97.1 -99.9 -95.5

6-QPSK 6-QPSK 11.33 Mbps 3.96 Mbps -2.1 -0.1 -0.6 -96.1 -99.1 -94.6
7-QPSK 7-QPSK 13.43 Mbps 4.73 Mbps -1.1 0.6 0.6 -95.1 -98.4 -93.4
8-QPSK 8-QPSK 15.56 Mbps 5.41 Mbps -0.1 1.4 1.7 -94.1 -97.6 -92.3
9-QPSK 9-QPSK 17.40 Mbps 6.11 Mbps 0.6 2.2 2.9 -93.4 -96.8 -91.1
10-16QAM 10-QPSK 17.40 Mbps 6.80 Mbps 1.5 3 3.7 -92.5 -96 -90.3

11-16QAM 11-16QAM 19.24 Mbps 6.80 Mbps 1.7 3.3 3.9 -92.3 -95.7 -90.1
12-16QAM 12-16QAM 21.98 Mbps 7.63 Mbps 2.7 4.4 5.1 -91.3 -94.6 -88.9

13-16QAM 13-16QAM 25.13 Mbps 8.86 Mbps 3.8 5.2 6.3 -90.2 -93.8 -87.7
14-16QAM 14-16QAM 28.00 Mbps 9.80 Mbps 4.6 6.1 7.4 -89.4 -92.9 -86.6

15-16QAM 15-16QAM 31.22 Mbps 10.95 Mbps 5.5 7.2 8.8 -88.5 -91.8 -85.2
16-16QAM 16-16QAM 33.63 Mbps 11.72 Mbps 5.9 7.7 9.3 -88.1 -91.3 -84.7
17-64QAM 17-16QAM 33.63 Mbps 12.68 Mbps 6.9 8.7 10.6 -87.1 -90.3 -83.4

18-64QAM 18-16QAM 36.08 Mbps 14.06 Mbps 7.4 9 11.2 -86.6 -90 -82.8

19-64QAM 19-16QAM 40.31 Mbps 15.16 Mbps 8.4 9.5 12.7 -85.6 -89.5 -81.3
20-64QAM 20-16QAM 43.10 Mbps 16.23 Mbps 9 10.4 13.4 -85 -88.6 -80.6
21-64QAM 21-16QAM 48.20 Mbps 16.23 Mbps 10.5 10.5 15.3 -83.5 -88.5 -78.7

22-64QAM 22-16QAM 51.57 Mbps 18.14 Mbps 11 11.4 15.6 -83 -87.6 -78.4

23-64QAM 55.97 Mbps 12.1 17.2 -81.9 -76.8

24-64QAM 60.28 Mbps 13.1 18.6 -80.9 -75.4
25-64QAM 63.40 Mbps 13.6 19.1 -80.4 -74.9
26-64QAM 67.47 Mbps 14.5 21.3 -79.5 -72.7
27-64QAM 69.78 Mbps 15.5 21.4 -78.5 -72.6
28-64QAM 82.32 Mbps 19.2 22.3 -74.8 -71.7

MCS Chart
Channel Bandwidth = 20 MHz
Subframe Assignment = 1 (2:2)
Special Subframe Patterns = 7
Category 4 UE – 2rx 1tx

9
 UE Initial Access Procedure
UE Initial Access is the process between
the UE is powered on and before sending UE
specific data.
Different steps for UE initial access:
1. Cell Search and Selection
2. Receive System Information
3. Random Access Procedure

Cell Search Procedure

Step 1
UE detects the symbol timing and the Physical
Layer ID (0~2) from the primary synchronization
signal (PSS).
Step 2
UE detects Physical Layer Cell ID group
(0~167) and frame timing from the secondary
synchronization signal (SSS).
Step 3
UE detects broadcast channel to obtain physical
layer information such as bandwidth size, number
of antennas, and subframe assignment.

Physical-Layer Cell Identity (PCI)

PSS Signal
• 3 different sequences called Physical-Layer ID
(0~2)
SSS Signal
• 168 different sequences called Physical-Layer
Cell ID Group (0~167)
• 3x168 = 504 available Physical-Layer Cell
Identities. Once UE knows the PCI, it also
knows the location of cell reference signals.

10
System Information Reception
Step 1
UE receives Master Information Block (MIB).
MIB contains system bandwidth and PHICH
(Physical Hybrid-ARQ Indicator Channel).
Step 2
UE receives System Information Block Type1
(SIB1). SIB1 contains PLMN, TAC, PCI, scheduling
info of other SIBs.
Step 3
UE receives System Information Block Type2
(SIB2). SIB2 contains common channel, random
access, and HARQ info. After SIB2 reception, UE
can start uplink synchronization.

eNodeB UE

Random Access Procedure

In LTE, all of the UEs use the same shared
resources to get initial access. The Random
Access Procedure is where the UE will receive
the initial UL grant to transmit UE specific
data for the first time. This procedure is always
contention based.

11
12
Unboxing the Baicells 1W Nova
&
Installation Tools Required

13
 Open a Baicells CloudCore Account
• Open a web browser, and enter the
CloudCore address: https://cloudcore.cloudapp.
net/cloudcore/
• Click on the “Sign up” button.
• Complete the mandatory fields, and click
“Sign up”
• You will receive an email from CloudCore.
In the email, click on the CloudCore link to go to
the login page. Enter your login user name (email
address) and a password to authenticate.

14
Contents of Nova 1W eNodeB Carton
• Nova 1W eNodeB
• (1) GPS Antenna
• (1) GPS Cable
• (1) GPS Lightning Arrestor
• (2) GPS Mounting Brackets
• (1) Base Station Handle
• (2) eNB Mounting Brackets
• (1) 48VDC Power Supply
• (1) Waterproof DC Connector
• (1) Waterproof Ethernet Connector
• (1) Power Cable Extender Connector
• (1) Ground Cable
• Misc. Bolts/Nuts
• Mastic and Electrical Tape

15
 Overview of Installation Preparation Work

16
Connecting Power and Grounding
• No more than (2) eNBs per stock power
supply
• Calculate needed wire size per tower
mounting height
• Use only UV rated 2-wire cable
• Alternative: DIN Rail Mount 48v 240w
• Alternative: POE Power Inserter
• Tycon POE-INJ-1000-DIN

17
18
19
 Antenna Selection and Considerations
• Define desired coverage area and
demographics
• Estimate potential subscriber capacity of
coverage area
• No. of subscribers
• Bandwidth/subscriber (packages)
• Oversubscription Model: 10:1
• Consider Reuse models, spectrum
availability, channel size
• Omni versus Sectors
• Vertical Beamwidth
• Electrical versus Mechanical Downtilt
• Horizontal Beamwidth-Overlap
• Use Downtilt Calculator
• Height Above Average Terrain
• Accurate Azimuth Settings
• Dual Slant versus H/V

Check eNB Status in Software

• The BaiCells base stations are designed to
be plug-and-play and, therefore, arrive precon-
figured. Before you seal and weatherproof the
connections on the base station elements, you
will need to log in either to the client Web GUI or
the cloud-based OMC to ensure the base station
status is reported as active.
• From the base station MGMT port, type in
http://192.168.150.1, using username admin, pass-
word admin. (Once the application is installed and
has a WAN IP address assigned, you can log in
remotely with http://x.x.x.x.)

20
Setup eNB for use with CloudCore Account
• Directly connect the base station’s DATA
port to a network routed to the Internet. The base
station DATA interface is set to DHCP client by
default.
• Log into the base station web GUI
from either the DATA or MGMT interface IP.
(e.g. http://192.168.150.1)
• Configure base station to connect to Baicells
Cloud OMC
• Navigate to the Network Management
Settings page: BTS Settings -> Network
Management Settings
• Enter baiomc.cloudapp.net:48080 into
“Network Management IP” and then click save.
• Upgrading Firmware sets this by default

Check eNB Status in CloudCore OMC

• Go to eNB > Monitor > Active Status. If the
status is not reported as active, contact BaiCells
support.

21
 Weatherproofing Techniques
• All weather electrical tape and mastic
• Self-fusing Silicone Electrical Tape: Scotch
70
• Black Cold Shrink Amalgamating Tape
• Cold Shrink Tubing
• Heat Shrink Tubing w/Adhesive
• Weatherproof RF Cable Boots

22
Basic Configuration on the eNodeB
• Login to MGMT port of eNodeB8 by typing
http://192.168.150.1 in a browser.
• Default Username and Password: admin/
admin

Quick Settings
• Select County Code
• Band (41 or 43) CBRS will be (48)
• Channel Size (10 or 20 MHz)
• Frequency (EARFCN)
• SubFrame Assignment: 1 or 2, where: 1 =
DL:UL is 2:2 transmission ratio 2 = DL:UL is 3:1
transmission ratio (default)
• SSF: 5 or 7 (default). Pertains to synchroni-
zation of downlink and uplink timing.
• Physical Cell Identification (PCI): allocated
by the operator. Range is 0-503

23
 WAN/LAN
• Select Network/WAN/LAN
• Select Static IP, DHCP or PPPOE (Not rec-
ommended)
• Assign Static IP address
• Enter Subnet Mask
• Enter Default Gateway
• Enter DNS Servers (8.8.8.8 default)
• LAN address is only used for initial configu-
ration and shouldn’t need to be changed.

Upgrade Firmware via Web Gui

• Select System/Upgrade
• Go to https://community.na.baicells.com/c/
welcome/announcements for recent firmware
releases.
• Download firmware to computer
• Select Firmware File
• Check Attempt to Preserve Settings
• Push Upgrade Now button

Upgrade Firmware via OMC

• Go to eNB/Strategy/Upgrade
• Click on + sign in top right corner
• Check eNB(s) to upgrade
• Click right arrow
• Name Task at top of page
• Select Upgrade Time/Date under Execute Type
• Push Next button
• Select upgrade firmware file
• Push Finish button

24
Management Server
• Management Server: http://baiomc.
cloudapp.net:48080/smallcell/ or IP Address
• Cloudkey: Unique Operator Identifier
• Entering Cloudkey enters device into the
OMC Operator Account automatically

Mobility Mgmt Entity (MME) and

IPSEC Tunnels
• The LTE MME is responsible for initiating
paging and authentication of LTE devices. The
operator may have more than one MME in the
network.
• Upgrading firmware sets defaults
• IKE Port can be 4500 or 500
• Note IPSEC Gateway addresses
• Note MME IP Addresses

Local Gateway (LGW)

• Local Gateway (LGW) fields allow you to
enable or disable the gateway
• Select an LGW Mode of Network Address
Translation (NAT), router, or bridge
• If Router, make sure there is a default route
to assigned subnet
• If Bridge, make sure there is a DHCP server
feeding subnet to eNodeB WAN port
• NAT is default

25
26
Preparing the UEs
(User Equipment)

27
 SIM Card Import
• Open an excel sheet paste the sim cards
in the excel sheet the sim card number should
appear in digits eg:  311980000012596. Save file.
• Click “BOSS” at the top left.
• Go to Network -> Sim card -> Click on
import tab -> click on file tab.
• Under file option search for the file you
saved in step 1.
• Enter subscriber info and click on the search
icon in the SIM card field.
• Click on import.
• You will get a dialog box saying how many sim
cards have been added successfully click on ok.

SIM Card Activation

• Log into CloudCore
• Click “BOSS” at the top left.
• Click “Subscriber” on the left menu.
• Click “New” to add a new subscriber.
• Enter subscriber info and click on the search
icon in the SIM card field.
• Select the respective IMSI number.
• Select Service Plan (default is wide open)
• Click save to add a new subscriber and
activate the SIM card.

Basic Configuration on the Atom UEs

• Login to UE by typing http://192.168.254.1 in
a browser.
• Some old firmware versions used 192.168.1.1
• Default Username and Password: admin/
28 admin
Overview Fields of the Atom UEs

Network Mode on the Atom UEs

Select the network mode as either Network
Address Translation (NAT), Router, or Bridge. NAT
is default
Warning: Selecting Bridge mode will pass the
assigned IP address to customer router. Remote
mgmt of the UE will no longer be possible.
This will hopefully be corrected in a future
firmware upgrade.

LTE Settings on the Atom UEs

29
 Scan Mode Settings on the Atom UEs
• FullBand – The CPE will routinely scan all
channels in the band.
• PCI Lock – Allows you to select the specific
E-UTRA Absolute Radio Frequency Channel
Number (EARFCN) and Physical Cell Identifier
(PCI).
• Band/Frequency Preferred – You can specify
which band(s) the CPE will scan.

TR069 Settings on the Atom UEs

• Navigate to System -> TR069
• Check Enable
• ACS URL: http://baiomc.cloudapp.
net:48080/smallcell/AcsService
• Periodic Inform Interval: 60
• Enter Cloudkey
• Click Submit

30
PCI Lock Settings on the Atom UEs
• Select PCI Lock in Scan Mode
• Add EARFCN and PCI number, then click
Add.
• You can add multiple PCI lock entries
• The CPE will scan the list for base stations
with the PCI and EARFCN combination.

Upgrade UE Firmware via Web Gui

• Select System/Version Manager
• Go to https://community.na.baicells.com/c/
welcome/announcements for recent firmware
releases.
• Download firmware to computer
• Select Firmware File
• Push Submit button

Upgrade UE Firmware via OMC

• Go to CPE/Strategy/Upgrade
• Click on + sign in top right corner
• Check CPE(s) to upgrade
• Click right arrow
• Name Task at top of page
• Select Upgrade Time/Date under Execute
Type
• Push Next button
• Select upgrade firmware file
• Push Finish button

31
Antenna Basics -
Coverage vs Interference
• Antenna choice is very important when designing
your next LTE site.
• The next few slides will have some DOs and some
DO NOTs.

32
Antenna Choice -
Three 120 degree
(DO NOT)

Antenna Choice -
Three 90 degree
(Acceptable)

33
 Antenna Choice
- Four 90 degree
(DO NOT)

Antenna Choice
- Four 65 degree
(DO!)

34
Antenna Choice
- Six 45 degree
(Best use)

35
 Antenna Basics - Downtilt
• Need to know:
• Desired coverage area (radius from tower)
• Antenna Mounting Height above Average
Terrain
• Vertical Beamwidth
• Electrical Downtilt
• Use Downtilt Calculator before ordering
antennas
• http://www.commscope.com/
calculators/qdowntilt.aspx
• Most antennas fall in a range of 6-8
degree vertical beamwidth
• (use 7 as an average starting point)

Antenna Downtilt –
Electrical vs Mechanical
• Need to know:
• With mechanical tilt, the coverage area is
reduced in central direction, but the coverage
area in side directions are increased.
• With electrical tilt, the coverage area
suffers a uniform reduction in the direction
of the antenna azimuth, that is, the gain is
reduced uniformly.
• Tilt is used to reduce and control
interference with other sites
• Tilt is used to concentrate RF pattern in
desired coverage area

36
Antenna Selection
• Now that you know the approximate antenna
specifications you desire for your deployment, it is
time to search for the proper antenna that fits the
deployment best.
• Baicells has tested:
• Alpha Antennas https://alphaantennas.
com/
• KP Performance Antennas https://www.
kpperformance.ca
• MTI Antennas http://www.mtiwe.com/
• Fixed vs Adjustable Electrical Downtilt
• F/B Ratio - The front-to-back ratio denotes
the sensitivity of an antenna to radio waves in the
region of 180 degrees plus or minus 40 degrees
from the main beam direction - the area of space
behind the antenna.
• 30-35 db F/B Ratio is considered good, less
than that is not. The higher the number the better.
• Polarization:
• Dual Slant
• Horizontal/Vertical
• Baicells has tested:
• Improved Noise Immunity
• Improved Signal to Noise Ratio (SNR)
• Improve Coverage in Congested
Environments
• Vertical Polarization generally maintains
stronger receive signal than Horizontal
Polarization (Inequality)
• Slanting both polarities 45 degrees
improves receive sensitivity equality
• Find a few antennas that may fit your
deployment
• Run downtilt calculations again with correct
vertical beamwidth specs.
• Choose as much electrical downtilt as
possible to meet your desired downtilt, reduced
mechanical downtilt reduces pattern skew.
• Total Downtilt = Electrical DT + Mechanical
DT
• Install antenna with accurate mechanical
downtilt per calculations
• Test and adjust if needed
37
 RF Cables
• PIM - PIM is defined as the unwanted signal
or signals generated by the non-linear mixing of 2
or more frequencies
• High PIM means poor reception and limited
bandwidth to the end user, which in turn means
lost customers.
• Low PIM means strong signals with more
bandwidth for more users, which means happy
customers and higher revenues.
• Extensive testing by LTE providers
discovered that legacy LMR braided cables may
test perfectly in a Return Loss or VSWR test, but
generally possess only average PIM performance.
• PIM lowers the reliability, capacity and data
rate of LTE systems. It does this by limiting the
receive sensitivity.
• PIM shows up as a set of unwanted signals,
created by loose or corroded connectors, nearby
rust, medium or high PIM braided cable products
and other variables listed below. Other names for
PIM include the diode effect and the rusty bolt
effect.
• Connectors made for LTE usage are non-
ferrous and plated with coatings such as silver,
white bronze, and gold.
• Over-tightening, insufficient contact
pressure, distorted contact surfaces, foreign
material in the mating surfaces, or corrosion can
cause excessive PIM.
• Other causes of PIM: Poorly manufactured
antennas, Nearby corrosion, Lightning Arrestors
• Here are some datasheet links for Low PIM
cables from various manufacturers:
• RFS Cellflex49
• Superior Essex HSFC Series23
• Commscope Heliax Sureflex27
• Times Microwave LMR-SW49

Remember
38 Every dB Counts!
Troubleshooting
top customer issues

39
 eNB shows inactive

OMC Status check

40
IPSEC status check

MME Status and quick settings

41
 CPE connect/reconnect problems
Check SIM status
• For a new install, please firstly check the
USIM card status, ‘USIM Normal’ is expected,
• If you find it display ‘SIM not ready’, please
check if the SIM card is firmly installed.

Check if CPE can hear a cell

If it can’t, maybe the CPE is out of RF coverage
of an eNB, adjust the height/down tilt of eNB’s
antenna.
You can adjust the orientation of the CPE to let it
facE the eNB’s antenna to get better RF quality.

Check if the user is activated in BOSS

If you can’t find it, contact BaiCells support to
add it in.
• If PC cannot get IP from CPE, then restart
CPE, probably the CPE LAN is not working.
• If CPE’S PCI lock feature enabled, please
make sure the frequency and PCI information are
correct.
• Make sure the ENB power settings are
correct. Some ENB’s reference signal may be
wrongly set so the CPE will receive lower RSRP
and be very difficult to attach.
• make sure ENB is activated.
• If all above checked ok but CPE still failed
to access in, please collect logs from eNB LMT or
BaiOMC and report to BaiCells.

42
CPE/eNB not showing up on OMC
• Add the eNB/CPE on OMC
1. Login to the OMC
2. Go to the Device Management Menu
3. Click the eNB/CPE tab
4. Click the plus symbol in the top right corner
5. Enter the serial number/ MAC address of
your eNB/CPE into the box

• Check that the eNB/CPE are active and

getting internet.
• Check that the management server
settings on the eNB and the tr069 settings are
correct on the CPE.
• Check the DNS settings.

Speed and latency issues

• Check if there is any flow control is enabled
on the switch connected to the eNB.
• Check for the RF parameters on the CPE like
the RSRP, MCS, CINR, SINR and see if they are
optimum.
• Check to see if the backhaul is the problem,
run iperf between the eNB and the client PC:
• Run iperf server on iperf server-Tower, and try
iperf test on client PC. i.e, use iperf3 for the test.

Iperf3 TCP Test w/ 8 Parallel Connections - Download

Server: iperf3 -s
Client: iperf3 -c x.x.x.x -P8 -t15 -O5 -R 

Iperf3 TCP Test w/ 8 Parallel Connections - Upload

Server: iperf3 -s
Client: iperf3 -c x.x.x.x -P8 -t15 -O5

If the results are satisfactory include the ISP and run

the iperf test again.

43
 LGW modes on eNB and CPE
There are three LGW modes on eNB and CPE
i.e Router, NAT, Bridge.
• NAT mode on eNB
To access CPE when eNB is in NAT mode use
URL: https://[IP Address]:[Port]
• [IP Address] is the eNB’s IP address.
• [Port] is a number with format 5XXXX, XXXX
is the last 4 digits of IMSI of CPE.

• Router mode on eNB

use CPE’s local IP address to access Web GUI.
Eg. https://10.10.0.10

• Bridge mode on the eNB

In LGW L2 bridge mode, the eNB will create a
virtual interface for every UE that attaches. Each
virtual interface will then do a DHCP request and
create a 1:1 mapping between the UE IP (from
Cloud EPC) and LGW IP. In L2 mode, the MAC
address that the CPE uses is generated from the
IMSI number. To calculate the CPE Mac address,
convert the last 12 digits of the IMSI number to
hex, then prefix it with 8A. For example, if the IMSI
is 311980000002918, you would take the last 12
digits “980000002918” and convert it to hex which
would equal “E42C8D5366”, which brings us to
the MAC address of 8A:E4:2C:8D:53:66. Once you
know the MAC address, you can provision your
networking accordingly.
use CPE’s local IP address to access Web GUI.
Eg: https://192.168.1.101

44
 CPE not getting internet
• Check the CPE sim status
• Check the CPE is connected to the eNB.
• Check the DNS info on the CPE

• Perform the ping test on the CPE:

GPS unsynchronized
• After installation unsync alarm is found:
according to eNB user manual, the user should
mount the GPS antenna on eNB correctly
before it is powered on. So if the GPS status
appears unsynchronized in OMC page after eNB
• Check the LGW setting on the eNB/CPE. is powered on for first time, please check the
• Check the route between eNB and the following items:
external router 1. Check whether the GPS switch is enabled on
eNB web page
2. Check whether the GPS connector is
loosened;
3. Check whether the GPS antenna is shielded;
4. Check whether the GPS antenna is well by
connecting it to other eNB;
• Pls reboot the eNB to try again if above items
are normal.

• During normal operations unsync alarm

is seen :sometimes, the GPS status suddenly
appears unsynchronized in OMC page while eNB
in normal operate, the probable cause of this
situation is as below:
1. GPS antenna has been damaged by natural
factor, such as thunder, storm;
2. GPS antenna has been unplugged manually,
3. GPS connector is loosened;
• Pls reboot the eNB after you have checked
above itmes.

45
 CPE shows disconnected on the OMC
while passing traffic
• Delete the CPE from the OMC after noting
down the MAC.
• Upgrade the CPE if not already done so.
• Reboot the CPE incase upgrade was not
required.
• Add the CPE back on the OMC by using its
MAC address.

Interference issues
• First indication that it might be interference
is bad CINR values and MCS values despite
having good RSRP.
• To confirm look at the CINR, SINR and MCS
values on the other CPEs connected to this eNB.
• If all the CPEs are facing similar problem it
could be that interference is at eNB or else it can
be at only that CPE.
• To further verify this check the BLER %.
• If you have a frequency scanner and know
that you are not operating anywhere near the eNB
on same frequency please scan and see if you are
seeing signals in your operating frequency.
• Check the frequency configuration on your
near by eNBs and also make sure there is no PCI
conflict on any of your eNBs.

46
CPE weak RF conditions
From CPE web GUI, we can monitor both RSRP0 and RSRP1 in
real-time, If the values are greater than -110dBm, it indicates that RF is
within the service scope of base station, if the values are greater than
-95dBm, it indicates RF well. So we strongly suggest the RSRP of CPE
got should be greater than -110dBm, otherwise the CPE will be offline

and broken frequently.

Below items may cause poor RF issue:

1. RF path from eNB to antenna (water in
RF cable, bad lightning protector, bad cable
termination, bad cable)
2. One radiator in the antenna is defective or
disconnected internally (replace with another
antenna to test)
3. Bad UE (One antenna radiator is defective or
disconnected internally or one transmitter is bad.
Try another UE)
4. RF interference on one RF chain (Try
changing to a different frequency)
5. Incorrect antenna downtilt or UE antenna is
not mounted directly at the eNB antenna. (check
antenna downtilt and vertical beamwidth in
relation to UE location)
6. UE mounted outside or at the edge of the
eNB antenna propagation field. (move UE inside
antenna propagation field)
7. Bad eNB (One RF port is disconnected from
the transmitter internally or a bad transmitter.
Replace eNB)

47
48
RF Planning and Design

49
 CHALLENGE

How do we develop a business

model with so many parameters?
• The three C’s to planning. Coverage,
Capacity & Cost
• Vertical assets: Towers, Buildings, Utility
Poles, etc.
What are the challenges that we
must overcome?
• Data accuracy - Clutter
• Site Selection

50
Cell Planning
• The aim of the cell planning engineer is
to establish the proper radio network in terms
of service coverage, capacity, cost, frequency
use, equipment deployment, and performance.
In order to plan a cellular radio network, you
have to identify specifications, study the area
under consideration and create a database
with geographic information (GIS), analyze the
population in the service area, create models
(i.e., cell types, IDs, locations, etc.), and perform
simulations and analysis using proper propagation
scenarios and tools. Afterward, simulation and
coverage results are analyzed, followed by cell
deployment and static or drive testing. The results
of field measurements are compared against the
simulation model results that you used, and the
model is tuned for performance optimization.
Each of the aforementioned stages in turn consist
of a number of steps that need to be performed.
Common platforms for this detailed design and
tuning that major carrier operators use are: Forsk
Atoll, EDX and others. This also offer features
such as auto frequency planning and auto PCI
planning. Which we’ll discuss later.

Coverage
• Coverage planning is an important step in
deploying an LTE network. This process includes
the selection of a proper propagation model
based on the area’s terrain, clutter, and population.
Propagation models (empirical models) are too
simplistic to predict the signal propagation behavior
in an accurate fashion; they provide us with some
relatively good accuracy of how things would
behave. Field measurements are the most accurate
in predicting radio coverage in a certain area. For
example, in buildings coverage will add about 16 to
20 dB of extra signal loss, and inside vehicle ones
can increase the loss by an extra 3 to 6 dB. Let’s
not forget about the trees. I think we all know what
challenges they present from time to time.
51
 Propagation Modeling - Software

PCI Planning - Why it’s important

Two synchronization signals transmitted
once every 5 ms Primary Synchronization
Signal (PSS)
• Subframe #0 and #5
• Mapped on 72 subcarriers in the middle of
the band
• OFDM symbol #6 Secondary
Synchronization Signal (SSS)
• Subframe #0 and #5
• Mapped on 72 subcarriers in the middle of
the band
• OFDM symbol #5

Capacity Planning
• The challenge of macro and HetNet
planning is ensuring capacity is provided where
the demand is located.
• The cell spectral efficiency is critical if
there is to be an effective increase in network
capacity. In the presence of traffic hotspots,
an adaptive modulation and coding scheme
means the difference users sharing .5Mbps and
100Mbps.
• The location of traffic hotspots determines
whether there will be a return on investment or
not, and maximizes profit margins.

52
Modulation Schemes
• Providing data capacity is not like provice
voice “lines”. With voice

PCI Planning - Sync signals - TDD

Two synchronization signals transmitted
once every 5 ms
• Primary Synchronization Signal (PSS)
• Subframe #1 and #6
• Mapped on 72 subcarriers in the middle
of the band
• OFDM symbol #2
• Secondary Synchronization Signal (SSS)
• Subframe #0 and #5
• Mapped on 72 subcarriers in the middle
of the band
• OFDM symbol #13

PCI Planning - Sync signals - TDD

Two synchronization signals transmitted
once every 5 ms
• Primary Synchronization Signal (PSS)
• Subframe #1 and #6
• Mapped on 72 subcarriers in the middle
of the band
• OFDM symbol #2
• Secondary Synchronization Signal (SSS)
• Subframe #0 and #5
• Mapped on 72 subcarriers in the middle
of the band
• OFDM symbol #13

53
 PCI Planning - Priority orders
When planning PCI:s the following priority
orders are recommended:
1. The same PCI:s should be avoided within the
same site and as neighbors
2. PCI:s with conflicting k values should be
avoided within the same site and as neighbors
3. PCI:s with conflicting m 0 and m1 values
should be avoided within the same site and as
neighbors
Reasons for not following these rules strictly: Will
not work in an irregular pattern (see previous
slide) Will cause a lot of limitations on neighbors
and neighbor lists have to be shortened

54
PCI Planning - examples
Example Formula from Excel to calculate PCI
usage: =SUM(3*E2+D2)

Antenna choice -
Coverage vs interference
Antenna choice is very important when designing
your next LTE site.
The next few slides will have some DO’s and
some DO NOTs.

55
 Antenna Choice -
Three 120 degree (DO NOT)

Antenna Choice -
Three 90 degree (Acceptable)

Antenna Choice -
Four 90 degree (DO NOT)

56
Antenna Choice -
Six 45 degree (Best use)

Antenna Choice -
Four 65 degree (DO!)

57
 Coverage & Power Levels
• Exist in forms that have very large power
ranges from the smallest to the largest
component.
• With more power can swamp the smaller
components and render them inoperable; they
must be planned carefully with new levels of
accuracy.
• Have such a range of sizes, that
environment modelling such as clutter must be
reconsidered with accuracy the main focus.
• Will be deployed in significant numbers
resulting in an exponential growthin the
planning complexity.

Challenge
1. Clutter data accuracy (recommendations)
• Macro <10M
• Pico/SmallCell <2.5M
• Femto/Wi-Fi <1M
• Atto <0.25M
2. Network Capacity
• Provide capacity where demand is located
• Spectral efficiency is critical if there is to
be an effective increase in network capacity.
Difference between users sharing 5 Mbps and
50 Mbps
3. Location, Location, Location
• Adaptive modulation works to achieve
maximum performance of the link
• High Signal to Noise means more spectrum
efficient in turn maximizes ROI

58
What
are the
solutions?

Network Capacity Interference

• Network capacity is sensitive to the cell • The power of a distant macro can often be
spectral efficiency. at a similar value to the power of a pico’s serving
area.
• An adaptive modulation and coding
scheme means that user locations determine • The interference potential of a macro is
the capacity of the serving cell. increased considerably for a pico due to the
greater powers of the macro.
• A commuting, dynamic population means
• Complex interplays between the macro and
that residential or business census falls short
picos or femtos should be modelled.
of the actual population distribution in modern
cities. • Modelling entire cities, it is found that it is
necessary to extend the signal predictions to
• Components are sensitive to the mobility
much further distances in order to compute a
of the demand. Fast moving demand cannot be site’s capacity.
served by small cells such as picos.
• Different components are suited to different
How do we address this?
environments. Femto and Wi-Fi are design
for indoor situations; macros and picos work • Reduce power, increase gain
effectively outdoors • Tilt - Focus your antenna for your planned
coverage and stick to it.

59
Planning
Summary

Planning Summary
• Use deployment-ready business case
studies for cell planning.
• Use good clutter data as available and
design for capacity with coverage as second
most important factor.
• Remember clutter data is not cheap but
neither is putting a site in the wrong spot.
• Various techniques will be needed to
understand the ROI on each new site.

60
Advanced Configuration

61
 LTE Freq/Cell > Neigh
Freq Table Settings

Field Name Description

EARFCN In short, this is the frequency point of the neighboring base
station’s frequency. Range is 0-65,535.
Stands for:
Evolved Universal Mobile Telecommunications System
(UMTS) Terrestrial Radio Access (E-UTRA) Absolute Radio
Frequency Channel Number.
Q-RxLevMin The minimum received signal level at which a CPE will
detect a neighboring base station’s signal. The range is -70
to -22 dBm.
Q-OffsetRange Indicates the difference in signal level between the serving
and neighboring base stations, as determined by the
received signal level at the CPE. If the received signal level
is better from a neighboring base station by at least this
amount of difference in dB, the CPE will reselect the other
cell. The range is +24 to -24 dB.
Resel Timer Determines when the cell reselection timer expires. Range
is 0-7.
Resel Prior Priority of cell reselection to cells at this frequency. Range is
0-7.
Resel Thresh High The cell reselection threshold for higher priority inter-band
frequency. Represents the access threshold levelat which
the CPE will leave the serving cell and reselect another cell
at the target frequency (assuming the target frequency cell
has a higher cell reselection priority than the serving cell).
Range is 0-31.
Resel Thresh Low The cell reselection threshold for lower priority inter-band
frequency. Represents the access threshold level at which
the CPE will leave the serving cell and reselect another cell
at the target frequency (assuming the target frequency cell
has an absolute priority lower than the serving cell). Range
is 0-31.
P-Max The maximum transmit power that CPEs in this cell are
allowed to use in the uplink. Range is -30 to 33 dB.
62
LTE Freq/Cell > Neigh
Cell Table Settings

Field Name Description

PLMN The 5- or 6-digit Public Land Mobile Network (PLMN) that
the neighbor cell belongs to.
Cell ID The cell ID of the neighbor cell. Range is 0-268,435,455.
EARFCN Frequency point of the neighbor cell. EARFCN stands for
Evolved Universal Mobile Telecommunications System
(UMTS) Terrestrial Radio Access (E-UTRA) Absolute Radio
Frequency Channel Number.
PCI Physical Cell Identifier (PCI) of the neighbor cell. Range is 0-
503.
QOFFSET Frequency offset of this neighbor cell. Indicates the
difference in signal level between the serving and this
neighboring base station, as determined by the received
signal level at the CPE. If the received signal level is better
from this neighbor base station by at least this amount of
difference in dB, the CPE will reselect this cell. Range is +24
to -24 dB.
CIO Cell Individual Offset (CIO) is this neighbor base station’s
cell offset, which is one of the variables used to determine
which base station (cell) will best serve a given CPE.
TAC Tracking Area Code (TAC) of this neighbor cell

63
 LTE Freq/Cell > Neigh
Freq Table Settings

Field Name Description

TDD Mode Enter the Time Division Duplex (TDD) mode, one of three
possible chip rates (bps) used to spread the signal:
UTRA_TDD_128, UTRA_TDD_384, or UTRA_TDD_768.
Bands Channels in which the TD-S neighbor base station operates
UARFCN In short, this is the frequency point of the neighboring base
station’s frequency. Range is 9505 to 9595, or 10055 to
10120.
The acronym stands for Universal Mobile
Telecommunications System(UMTS) Absolute Radio
Frequency Channel Number.
Q-RxLevMin The minimum received signal level at which a CPE will
detect a neighboring base station’s signal. The range is -60
to -13 dBm.
Resel Prior Priority of cell reselection to cells at this frequency. Range is
0-7.
Resel Thresh High The cell reselection threshold for higher priority inter-band
frequency. Represents the access threshold level at which
the CPE will leave the serving cell and reselect another cell
at the target frequency (assuming the target frequency cell
has a higher cell reselection priority than the serving cell).
Range is 0-31.
Resel Thresh Low The cell reselection threshold for lower priority inter-band
frequency. Represents the access threshold level at which
the CPE will leave the serving cell and reselect another cell
at the target frequency (assuming the target frequency cell
has an absolute priority lower than the serving cell). Range
is 0-31.
P-Max The maximum transmit power that CPEs in this cell are
allowed to use in the uplink. Range is -50 to -33 dB.
Q-Offset Indicates the difference in signal level between the serving
and neighboring base stations, as determined by the
received signal level at the CPE. If the received signal level
is better from a neighboring base station by at least this
amount of difference in dB, the CPE will reselect the other
cell. The range is -15 to 15 dB.

64
TD-S Freq/Cell > Neigh
Cell Table Settings

Field Name Description

UARFCN Display of the frequency point of the neighboring base
station’s frequency.
PLMN The Public Land Mobile Network (PLMN) that the neighbor
cell belongs to. Range is 5-6 digits.
Cell ID The cell ID of the neighbor cell. Range is 1-65,535.
RNC ID The neighbor cell’s Radio Network Controller (RNC) ID.
Range is 0-65,535.
Scrambling Code The scrambling code assigned to this neighbor cell. Range is
0-127. The scrambling code is unique to each base station
and is used to distinguish one base station’s data from
another base station’s data.
LAC Location Area Code (LAC) of the neighbor cell

65
 GSM Freq/Cell > Neigh
Freq Table Settings

Field Name Description

BAND Channel in which the GSM neighbor base station operates:
GSM850, GSM900, DCS1800, or PCS1900.
ARFCN In short, this is the frequency point of the neighbor base
station’s frequency. Range is 128-251. The acronym stands
for Absolute Radio Frequency Channel Number.
Q-RxLevMin The minimum received signal level at which a CPE will
detect a neighboring base station’s signal. The range is 0-45
dBm.
Resel Prior Priority of cell reselection to cells at this frequency. Range is
0-7.
Resel Thresh High The cell reselection threshold for higher priority inter-band
frequency. Represents the access threshold level at which
the CPE will leave the serving cell and reselect another cell
at the target frequency (assuming the target frequency cell
has a higher cell reselection priority than the serving cell).
Range is 0-31.
Resel Thresh Low The cell reselection threshold for lower priority inter-band
frequency. Represents the access threshold level at which
the CPE will leave the serving cell and reselect another cell
at the target frequency (assuming the target frequency cell
has an absolute priority lower than the serving cell). Range
is 0-31.

66
GSM Freq/Cell > Neigh
Cell Settings

Field Name Description

ARFCN Display of the frequency point of the neighbor base
station’s frequency.
PLMN The Public Land Mobile Network (PLMN) that the neighbor
cell belongs to. Range is 5-6 digits.
LAC Location Area Code (LAC) of the neighbor cell
BSIC Base station identification code (BSIC) of the neighbor cell
Cell ID The cell ID of the neighbor cell. Range is 1-65,535.

67
68 Mobility Parameters
A1, A2, A3, and A5
Event Thresholds

Field Name Description

A1 Event Threshold
LTE A1 RSRP Threshold The LTE A1 event is triggered when the serving cell’s
Reference Signal Received Power (RSRP) becomes better
than the A1 threshold. The A1 event can be used to turn off
certain inter-cell measurements. Range is 0-97 dB. Default
value is 90 dB.
A2 Event Threshold
LTE A2 RSRP Threshold The LTE A2 event is triggered when the serving cell’s
Reference Signal Received Power (RSRP)becomes worse
than the A2 threshold. Range is 0-97 dB.
A3 Event Threshold
Intra-Freq Handover A3 The LTE A3 event is triggered when a neighbor cell becomes
Offset better than the serving cell by as much as the offset value.
The offset can be either positive or negative. Range is -30
dB to 30 dB.
Intra-Freq ANR A3 Offset Automatic Neighbor Relation (ANR). Range is -30 dB to 30
dB. The integer should be less than or equal to the Intra-
Freq Handover A3 Offset parameter.
A5 Event Threshold
Inter-Freq Handover A5 The LTE A5 event is triggered when the serving cell
RSRP Threshold 1 becomes worse than Threshold 1 while a neighbor cell
becomes better than Threshold 2. Range is 0-97.
Inter-Freq Handover A5 Range is 0-97.
RSRP Threshold 2
Inter-Freq ANR A5 RSRP Range is 0-97. The integer should be larger than or equal to
Threshold 1 the Inter-Freq Handover A5 RSRP Threshold 1 parameter.
Inter-Freq ANR A5 RSRP Range is 0-97. The integer should be less than or equal to
Threshold 2 the Inter-Freq Handover A5 RSRP Threshold 2 parameter.
69
 B2 Event Threshold

Field Name Description

UTRA B2 RSRP Threshold parameter 1 of the UTRA Time Domain
Threshold 1 Scheduling (TDS) based B2 event. Range is 0-97 dB. Default
is 70 dB.
RSRP Threshold 2 Threshold parameter 2 of the Reference Signal Received
Power (RSRP) based B2 event. Range is -5 dB to 91 dB.
GERAN B2 RSRP Threshold parameter 1 of the GSM Edge Radio Access
Threshold 1 Network (GERAN) B2 event based on Reference Signal
Received Power (RSRP). Range is 0-97 dB. Default is 10 dB.
GERAN B2 IRAT Threshold parameter 2 of the GSM Edge Radio Access
Threshold 2 Network (GERAN) B2 event, based on Inter-Radio Access
Technology (IRAT). Range is 0-63 dB.

Measurement Control
Parameters

Field Name Description

Hysteresis Refers to the hysteresis of the handover measurement
event and is used to avoid the frequent triggering of cell
handover evaluation due to the fluctuation in wireless
signals. Range is 0-30 dB.
Time To Trigger Length of time the target cell RSRP value is better than the
serving cell before the CPE initiates a handover request.
Range is 0-5120 ms.

70
Cell Selection and Cell
ReSelection Parameters

Field Name Description

Cell Selection Parameter
Qrxlevmin(dBm) Minimum acceptable signal level at the CPE before cell
selection. Range is -70 dBm to -22 dBm.
Qrxdevminoffset Minimum level offset (difference) in RSRP at the CPE
needed for cell selection. Range is 1-8.
Cell ReSelection Parameter
S-IntraSearch Intra-band measurement threshold that must be met
before the CPE will reselect a neighbor base station.
Range is 0-31.
S-NonIntraSearch Inter-band measurement threshold that must be met
before the CPE will reselect a neighbor base station.
Range is 0-31.
Qrxlevmin(dBm) Minimum level for reselection. Range is -70 dBm to -22
dBm.
Qhyst Delay time for reselection. Range is 0-24.
Reselection Priority Priority for reselection. Range is 0-7.
ThreshServingLow Threshold for selection to cells of low priority. Range is 0-
31.
Allowed Meas BW Sib3 Measurement bandwidth allowed. Choices are n15, n25,
n50, n75, or n100.

71
 Advanced Parameters
Sub-Menus

X2 Parameter

72
Power Control
Parameters

eNodeB Settings

GAP Settings

73
 Field Name Description
p-Max The maximum power that a CPE can transmit in this cell.
Range is -30 dB to 33 dB.
Reference Signal Power Transmit power of the reference signals.Range is -60 dB to
50 dB.
Power Ramping Step size of the Physical Random-Access Channel’s
(PRACH’s) power index broadcast to the CPEs via a Layer
1 channel used by CPEs to access the mobile network for
call setup and bursty data transmission. Options are 0, 2, 4,
or 6.
Preamble Init Target Initial power of the Physical Random-Access Channel
Power (PRACH). Range is -90 to -120.
Po_nominal_pusch Physical Uplink Shared Channel (PUSCH) carries user data. It
supports Quadrature Phase Shift Keying (QPSK) and 16
Quadrature Amplitude Modulation (QAM), with 64QAM
being optional. Range is -126 to 24 dB.
Po_nominal_pucch Physical Uplink Control Channel (PUCCH) is used to carry
Uplink Control Information (UCI). LTE CPEs can never
transmit both PUCCH and Physical Uplink Shared Channel
(PUSCH) during the same subframe. Range is -127 to -96
dB.
Alpha Power control loss compensation factor, which controls the
CPE power. Range is 0 to 100.
Max Pathloss Maximum threshold at which the CPE determines not to
transmit to the base station based on pathloss. Pathloss is
the difference between the transmitted reference signal
information and the actual received signal power.Range is
100 to 135.
Target ul sinr Desired Signal-to-Interference-Plus-Noise Ratio (SINR) level
to ensure an acceptable level of communication between
the CPE and base station, while also controlling
interference that might be caused to neighboring cells.
Range is -6 dB to 10 dB.
Po_ue_pucch Initial CPE transmit power when using Physical Uplink
Control Channel (PUCCH). Range is -8 dB to 7 dB.
Po_ue_pusch Initial CPE transmit power when using Physical Uplink
Shared Channel (PUSCH). Range is -8 dB to 7 dB.
PA Physical Downlink Shared Channel (PDSCH) is the main data
bearing channel. Power boosting the reference signal is
allocated to CPEs on a dynamic and opportunistic basis.
The relative PDSCH power is determined by two computed
parameters: PA and PB. Traffic loading must be balanced
with controlling interference to neighboring cells.

Options are -600, -477, -300, -177, 0, 100, 200, or 300.

PB See description for parameter “PA”. Range is 0-3.

74
RRC Status Parameters

Field Name Description

Ue Inactivity Timer Expire time of the CPE inactive status timer(s). The range is
0-4294967 seconds. If set to 0, the timer does not take
effect.
Max Expiry Count Maximum number of times the CPE inactive status timer
expires. The range is 1-65,535 times.

SON Functional
Parameters

Field Name Description

PCI Selfconfig Enable or disable self-configuration of the base station
Physical Cell Identifier (PCI)
PCI Self-configuring The Physical Cell Identifier (PCI) numbers to use. Enter each
Optional List PCI number, and click on Add. The range is 0-503. To
remove a PCI number, select the Remove button.

Tx and Rx Settings

75
 Random Access
Parameters

Field Name Description

Prach-ConfigurationIndex Physical Random-Access Channel (PRACH) configuration
index number. Range is 0-63. Default is ?
Zero Correlation Zone Specifies the cyclic shift intervals to generate the PRACH
Config sequence. Range is 0-15. Default is 10.

Refer to BaiTip on this setting:

https://community.na.baicells.com/t/baitip-of-the-day-
december-14th-2016-subframes-and-special-
subframes/163
PRACH Freq Offset Determines the location of the Physical Random-Access
Channel (PRACH) preamble in the frequency domain. The
range is:
• 10MHz – 1 to 43
• 20MHz – 2 to 92

Capacity Parameters

Scheduling Algorithm
Parameters

76
Sync Adjust Parameters

Field Name Description

GPS Sync Adjust Value An integer. Range is -65,535 to 65,535. Default is 0.
ICTA Adjust Value Industry Council for Tangible Assets (ICTA) Adjust Value is
an integer. Range is -65,535 to 65,535. Default is 0.

Link Activation State

Detector Parameters

Field Name Description

Link Keep Alive Enable or disable the link activation state detector for the
link between the CPE and EPC, LAN, or both
Link Keep Alive Timer Select 5, 10, or 15 minutes for the link keep alive timer

Caution: The reboot action will disrupt

! base station service.

77
OMC and BOSS configuration

78
Baicells Cloudcore
CloudCore is a Software-as-a-Service (SaaS)
solution managed and hosted by Baicells via
Azure, a Microsoft based and North American
hosted Cloud computing platform. CloudCore
includes two service modules:
• Operations Management Console (OMC),
• Business Operations Support System (BOSS)

HOW TO SIGN UP FOR

A CLOUDCORE ACCESS ACCOUNT
• Enter the url https://cloudcore.cloudapp.net/
cloudcore/ to go to the CloudCore home page &
click the [Sign up] button.
• Fill out the mandatory information, then click
the [Sign up] button.
• You will receive an E-mail from CloudCore,
your login account user name is your email. You
will then need to click the active url to complete
the authentication.
• The account is now active, click [return
home] to go back to the CloudCore home page.
• Login the CloudCore with user name (email),
and password you entered when you signed up.
• Next, you will need to configure an eNB to
connect to the Baicells Cloud OMC.

79
Basic LTE Network Architecture

80
E-UTRAN
The main components of the Enhanced UMTS
Terrestrial Radio Access Network (E-UTRAN)
are:
1. User Equipment (UE): Device directly used
by end-user to communicate such as a mobile
phone or CPE.
2. E-UTRAN Node B (eNodeB or eNB): Also
called the base station, is the evolution of the
Node B in UMTS. The eNB terminates the air
interface protocol and is first point of contact for
the UE.

E-UTRAN Network Interfaces

S1 Interface
Connects the eNodeB to the EPC. It is split into
two interfaces: control plane (S1-MME) and user
plane (S1-U).
X2 Interface
Used to interconnect eNodeBs where load
or interference-related and handover-related
information is exchanged. 81
 EPC Elements
• Mobility Management Entity (MME):
Responsible for user authentication (by
interacting with HSS), idle mode location tracking,
paging, roaming, handovers, bearer activation/
deactivation process, and selecting gateways for
UE.
• Home Subscriber Server (HSS): Central
database that contains user-related and
subscription-related information.
• Serving Gateway (S-GW): Gateway which
terminates the interface towards E-UTRAN,
serving a large number of eNodeBs. Responsible
for handovers with neighbor eNodeBs and data
transfer across the user plane.
• Packet Data Network Gateway (P-GW):
Controls IP data services, routing, allocates IP
addresses, enforces policies, and provides access
for non-3GPP access networks such as WiMAX
and 3GPP2.
• Policy and Charging Rules Function (PCRF):
Interfaces with PGW and supports service data
flow detection, policy enforcement, and flow-
based charging.

User Plane – UE to P-GW

IP packets in the core network are encapsulated
in an EPC-specific protocol and tunneled
between the P-GW and the eNodeB. GPRS Tunnel
Protocol (GTP) is used on the S1 and S5/S8
interface.
Protocol stack between the eNodeB and UE
consists of the Packet Data Convergence Protocol
(PDCP), Radio Link Control (RLC), and Medium
Access Control (MAC) sublayers.

82
Control Plane – UE to MME
The control plane additionally includes the
Radio Resource Control layer (RRC) which is
responsible for establishing the radio bearers and
configuring the lower layers.
Control plane handling of radio-specific
functionality includes:
• Cell selection and reselection procedures
• UE info on downlink channel quality and
neighbor cell information

LTE eNodeB Startup Procedure –

Step 1
eNodeB establishes an S1 connection with the
MME.
S1 Setup Request Parameters:
• PLMN
• Cell ID
• Tracking Area Code (TAC)

LTE eNodeB Startup Procedure –

Step 2
eNodeB starts broadcasting Master Information
Block (MIB) and System Information Block (SIB)
information.

83
 MIB and SIB Overview – Part 1
Master Information Block (MIB) is transmitted
using a physical layer channel and contains
the following vital system parameters and
information:
• System bandwidth
• PHICH info
• System frame number
System Information Blocks (SIB) carry relevant
information for the UE, which helps UE to access
a cell and perform cell-reselection. There are 16
types (since R11) of SIBs with each one having a
specific task. A minimum of two SIBs are required
(SIB1 and SIB2).

MIB and SIB Overview – Part 2

Features Main Parameters

MIB Carries physical layer information of LTE DL bandwidth, SFN, PHICH configuration
cell
SIB1 Access restriction info of a UE and Access restriction info, Cell selection info,
scheduling of other SIBs scheduling info list, and carries Cell ID, MCC, MNC,
TAC
SIB2 Radio resource configuration common Common and shared channel info, RRC, UL power
for all UEs control, preamble power ramping, uplink cyclic
prefix length, sub-frame hoping, and uplink
EARFCN

84
LTE Random Access Procedure – Step 1
1. UE synchronizes with the downlink channel
by decoding PSS and SSS signal.
2. Upon downlink channel synchronization, MIB
and SIB messages are downloaded.

LTE Random Access Procedure – Step 2

Msg1:
1. UE randomly selects and transmits Preamble
on RA channel. UE is also assigned an identity
(RA-RNTI).
Msg2:
2. eNodeB sends Random Access Response
to UE addressed to RA-RNTI. Message contains
Temp C-RNTI, Timing Advanced Value, and Uplink
Grant Resource.
Msg3:
3. UE sends RRC connection request message
to eNodeB. Message contains UE identity (TMSI)
and connection establishment cause.
Msg4:
4. eNodeB responds with contention resolution
message to UE and is addressed to TMSI value.
Message also contains new C-RNTI which will be
used for further communication.

LTE RRC Connection Establishment

Procedure
Radio Resource Control (RRC) connection
establishment procedure configures Signal Radio
Bearer 1 (SRB1) for UE and lets UE inform the
network what it wants to do.
RRC Connection Request (RACH Msg3)
Contains UE identity (TMSI) and connection
establishment cause.
RRC Connection Setup Message
Contains configuration details for SRB1.
RRC Connection Setup Complete Message
UE moves to RRC Connected mode. 85
 LTE Attach Procedure
On NAS layer, the UE sends an Attach Request
(including IMSI) message to request initial
attach to the NAS layer of the MME. The Attach
Request message is embedded in the RRC
Connection Setup Complete message which is
then embedded again in the successive Initial UE
Message.
At this stage, IMSI acquisition and ECM
connection is complete.

LTE ECM Connection Overview – Part 1

The EPS Connection Management (ECM)
connection is the logical connection between a
UE and MME which tunnels across the RRC and
S1 signaling connection. This connection is used
for exchanging NAS messages.
The EPS Mobility Management (EMM) is a
sub-layer of the NAS layer and is responsible for
mobility management procedures, e.g. Attach and
Tracking Area Update.

86
LTE ECM Connection Overview – Part 2
Layer State Entity Description
EMM EMM-Deregistered UE, MME UE is not attached to any network. MME does not know current
location of the UE.
EMM-Registered UE, MME UE is attached and successfully registered to the network. An IP
address has been assigned with an established EPS bearer. MME
knows the current location of the UE.
ECM ECM-Idle UE, MME No NAS signaling connection (ECM connection) established yet.
ECM-Connected UE, MME NAS signaling connection is established.
RRC RRC-Idle UE, eNB No RRC connection is established yet.
RRC-Connected UE, eNB RRC connection has been established.

LTE Authentication Procedure

Acquire Authentication Vectors
1. [MME → HSS] Authentication Info Request
2. [HSS] Generate AVs
3. [MME ← HSS] Deliver AVs

Mutual Authentication
1. [UE ← MME] Request by MME for User Auth
2. [UE] Generate AVs and compare
3. [UE → MME] Deliver User RES to MME
4. [MME] Network authenticating UE

At this stage, user authentication is complete.

87
 LTE NAS Security Setup Procedure
1. [MME] Generate NAS Keys
2. [UE ← MME] Helping UE to Generate NAS
Security Keys
3. [UE] Generate NAS Security Keys
4. [UE → MME] NAS Security Key Generation
Complete

At this stage, all NAS messages are security

delivered, as encrypted and integrity-protected.

LTE Location Update Procedure

1. [MME → HSS] Notify UE Location
2. [HSS] UE Location Update
3. [MME ← HSS] Deliver User Subscription
Information
4. [MME] Store Subscription Information

88
LTE EPS Session Establishment – Part 1
Request for EPS Session Creation Message
• MME selects APN which is provided from
HSS or UE.
• MME selects S-GW to go through for access
to selected P-GW.
• MME initiates creation request of an EPS
session and a default EPS bearer.
EPS Session Creation Response Message
• P-GW informs the MME of QoS information
applied to the established EPS sessions and
default EPS bearer.

LTE EPS Session Establishment – Part 2

Initial Context Setup Request
MME sends an Initial Context Setup Request
message so that the eNB can establish the
E-UTRAN Radio Access Bearer (E-RAB), which
is the concatenation of an S1 bearer and the
corresponding radio bearer. Message consists of
the following elements:
- UE-AMBR(UL/DL) - E-RAB ID
- S1 S-GW TEID - E-RAB QoS
- UE Security Algorithm - KENB
- NAS-PDU (Attach Accept)

LTE EPS Session Establishment – Part 3

AS Security Mode Command/Complete
• eNB generates AS security keys from KENB
for safe delivery for RRC messages and user
traffic.
• eNB informs UE of the AS security
algorithms it selected.
• UE generates AS security keys and performs
integrity check.
• UE indicates to the eNB that AS security
keys are generated.

89
 LTE EPS Session Establishment – Part 4
Reconfiguring RRC Connection
• eNB sends RRC Connection Reconfiguration
message to UE to activate the DRB (default
radio bearer) and also carries the Attach Accept
message.
• Attach Accept message contains UE IP
address, GUTI (Global Unique Temporary ID), TAI
(Tracking Area Identifier) list, EPS Bearer ID, UE-
AMBR, and QoS parameters.

LTE EPS Session Establishment – Part 5

Initial Context Setup Response
• eNB allocates a downlink S1 TEID (tunnel
endpoint identifier) for S1 bearer and sends Initial
Context Setup Response message to the MME
which is forwarded to the SGW.
Attach Complete
• UE sends a Direct Transfer message to the
eNB which includes the Attach Complete (EPS
Bearer Identity, NAS sequence number, NAS-
MAC) message.

LTE EPS Session Establishment – Part 6

S1 Bearer Modification
• MME Forwards the downlink S1 TEID
received from the eNB to the SGW.
• SGW responds to MME through Modify
Bearer Response message. SGW is now ready to
deliver downlink S1 traffic.
• S1 bearer is established which allows the
eNB and SGW to exchange traffic with each other.
• The default bearer from the UE to the PGW
is finally established.

90
EPS Bearer – Part 1
EPS (Evolved Packet System) Bearer (bearer for
short) is defined between the PGW and UE, and
maps to a specific set of QoS parameters such as
data rate, latency, and packet error rate.

Bearer Classes:
• Guaranteed Bit Rate (GBR) bearer
• Non-GBR bearer

EPS Bearer – Part 2

• Access Point Name (APN) is a gateway the
UE attaches to and identifies the Packet Data
Network (PDN).
• QCI (QoS Class Identifier) indicates nine
different QoS performance characteristics.
• ARP (Allocation and Retention Priority)
indicates the priority of the bearer.
• GBR (UL/DL) is used for GBR type bearers,
and indicates the bit rate to be guaranteed.
• MBR (UL/DL) is used for GBR type bearers,
and indicates the maximum bit rate allowed.
• APN-AMBR (UL/DL) is used for non-GBR
type bearers, and indicates the maximum bit rate
allowed for all bandwidth in a PDN.
• UE-AMBR (UL/DL) is the same as APN-
AMBR, but is the maximum bit rate allowed for all
non-GBR type bearers associated to the UE.

EPS Bearer – Part 3

91
 Baicells CloudCore Design

92
 Contact Info
Baicells Support Website
https://na.baicells.com/support/

Baicells Operators Support Group on Facebook

https://www.facebook.com/groups/baicellsoperatorsupportgroup/

Baicells Community Forum

https://community.na.baicells.com

Baicells Address
555 Republic Dr., #200, Plano, TX 75074, USA

Baicells Phone
+1(888)-502-5585

Baicells Email
[email protected] / [email protected] 93