<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=2960562&amp;fmt=gif">
Primary_FullColor

Guest Blog: CBRS TDD-LTE Interference - TDD Timing Coordination

Adam Wohld

02/26/22

1643614832114-1

Note: This content first appeared February 1, 2022 on LinkedIn and is authored by Adam Wohld, RF Deployment Engineer and Solutions Architect. Adam's post is being republished on our blog in its entirety. We thank Adam for his excellent contribution to our blog series.

 

I've been contacted by a number of TDD-LTE CBRS network operators about interference concerns since the launch of CBRS.

By the time these issues reach me it's usually an emergency. Once when discussing the issue with a WISP CEO, he interrupted me as a customer cancellation email hit his inbox and raged, "$%&^, we're bleeding out all our customers!" Last week, this occurred again, and I took a few vacation days to travel on-site and document the issue. In this article, I'll demonstrate what we found and how we found it.

TLDR: 1 Minute Summary

Network "Operator X" [real name redacted] called with high noise rise on their CBRS channels. The interference couldn't be seen on a Spectrum Analyzer. To resolve, we used Epiq Solutions' PRiSM PCI Scanner to inspect the upper LTE protocol layers that a spectrum analyzer can't see.

The PRiSM PCI Scanner found three eNB's from two other network operators within Operator X's footprint. The eNB's SIB1 message decoded by the PCI scanner showed Operator X's eNB was configured to receive at the same time the foreign eNB was configured to transmit. The transmit energy from the foreign eNB is the source of Operator X's interference.

If you're having this problem or are interested in using the PRiSM PCI Scanner, feel free to reach out to me.

Full Details

When I investigate interference it follows this general format:

  1. map the problem
  2. characterize the problem signal
  3. search for the characterized signal


Step 1 - Map the Problem

To get an idea of the problem scope, we mapped eNB locations and antenna azimuths presenting with noise rise issues. Mapped out below, two sites indicate noise coming from the North and West. The stats indicated the strongest noise coming from the North facing antennas.

 

1643612917230

 

If the noise was coming from the site itself, we'd expect to see all antennas with noise rise. Here, only two of the three antenna azimuths register a noise problem. Likely the source is more to the North, than West, since the North sectors show the strongest noise rise.

 

Step 2 - Characterize the Problem Signal

When interference hunting we want to characterize the offending signal for the search phase in step #3. Unfortunately, we didn't have access to noise per PRB stats from the LTE antenna or a radio tap point for directly monitoring the antenna signal. The only option to characterize was a less-than-ideal, onsite, under-the-tower visit.

After a 7 hour drive to the land of 8-degree weather, I arrived at the site and mounted the PRiSM PCI Scanner to my dash using PRiSM's neodymium magnetic mounting system.

1643601261445

I put the PRiSM PCI Scanner into "Spectrum Analyzer" mode and dialed in the two EARFCNs, 56442 and 56640, reporting the strongest noise rise; 15 dB above the noise floor.

1643597716228

Looking at the results above, it appeared to be interference-free. We see two nice-looking LTE bart-heads on the peak hold, no spikes on the minimum hold, and normal customer traffic in the channel. I also drove in and out of town watching the spectrum, nothing looked abnormal.

This is where network operators get stuck. They're looking at the RF layer, blind to the upper layers of TDD-LTE that also cause interference. To do this they need a PCI Scanner.

However, I do have a PRiSM PCI Scanner to inspect the upper layers of the protocol and I booted it into "Blind Scan" mode. Blind scan mode will detect, analyze, and report on any LTE or 5G waveform energy found in any spectrum from 50 MHz to 6 GHz. I told it to just look at the CBRS band.

1643602506871

After a brief survey, the PRiSM PCI Scanner returned some alarming results. From now on, in this article, we'll limit the scope and focus only on Operator X's two EARFCNs (56442 and 56640) reporting the worst interference.

As expected, we see EARFCN 56442 ( 3.6702 GHz ) and 56640 ( 3.690 GHz ) broadcasting MCC/MNC 311/XXX. This positively identifies these signals as belonging to "Operator X".

Unexpectedly, we find two other TDD-LTE CBRS networks reporting MCC/MNC 314/030 (BaiCells) and 001/010 (Generic). Looking at both network's MIB messages broadcast on the upper layers of the protocol, we see those networks claim a 20 MHz channel bandwidth and transmit on EARFCN 56350 ( 3.661 GHz ) and 56540 ( 3.680 GHz ).

Analyzing the EARFCNs and channel bandwidths we've found, we can see both MCC/MNC 314/030 and 001/010 overlap in the frequency domain with Operator X's TDD-LTE channels.

1643607394093

 

Now that we identified foreign network TDD-LTE cells overlapping in the frequency domain, we need to make sure they are not transmitting when Operator X's tower is receiving. If this is the case, then we likely found an interference source.

To know a TDD-LTE cells uplink & downlink TDD frame pattern, we examine the "subframeAssignment" parameter broadcast in the SIB1 overhead message. This pattern tells a UE which subframes in a frame are reserved for uplink or downlink transmission.

Looking back at the PRiSM PCI Scanner results, we grab the SIB1 payload for each TDD-LTE Cell found and decode the "subframeAssginment" parameter.

 

1643609920647-1

 

The results show Operator X and network 314/030 both running "subframeAssgnment" pattern #1 while network 001/010 runs "subframeAssignment" pattern #2.

code

Looking up these patterns in the table below, this means Operator X and 314/030 both transmit and receive at the same time. This is likely not the source of the uplink interference. However, 314/030's UE's may degrade uplink performance for Operator X's customers.

1643611943037

 

Looking at network 001/010 is where we find the big problem, they're running "subframeAssignment" pattern #2 and Operator X is running pattern #1!!

Referring to the "subframeAssignemnt" pattern chart, when network 001/010 is transmitting on subframe #3 and #7, both Operator X and 314/030 are listening for UE transmissions on those frames. Operator X and 314/030 eNBs are receiving downlink energy from network 001/010 TDD-LTE Cells right into their uplink path.

At this point, we concluded the characterizing the problem and got into drive test mode.

 

Step 3 - Search for the Characterized Signal

To search we used the PCI Scanner in "Dedicated Scan" mode and an omni antenna. In dedicated scan mode, we continuously report RSRP of MCC/MNC 314/030 EARFCN 56350 and MCC/MNC 001/010 EARFCN 56540.

Knowing the signal was likely coming from the north, we headed off in that direction and watched the RSRP strength of MNC/MCC.

 

1643612569663

 

After 20 minutes of driving, we located two TDD-LTE transmitters on MCC/MNC 314/030 EARFCN 56350 and MCC/MNC 001/010 EARFCN 56540. On the way back to the hotel we located one more TDD-LTE system on MCC/MNC 001/010 EARFCN 56540. Results mapped below.

 

1643613449275

 

At location #1 we found a MCC MNC 001/010 tower about 17 miles from Operator X's sites. The MCC MNC 001/010 site transmits when Operator X's site is receiving. With 132 dB path loss at 3.7 GHz, 50 dBm eNB transmit EIRP over 20 MHz, and assumed 12 dB gain receive antenna for Operator X, we calculate -70 dBm RSSI interference at the receive radio port of Operator X.

 

1643613857458

 

At location #2 we found another MCC MNC 001/010 tower 10 miles away from Operator X's site presenting with the worst interference. This site transmits when Operator X's site is receiving. With 128 dB path loss at 3.7 GHz, 50 dBm eNB transmit EIRP over 20 MHz, and assumed 12 dB gain receive antenna for Operator X, we could see -66 dBm RSSI interference at the receive radio port of Operator X.

 1643614832114

 

Finally, at location #3, we found network 314/030 8 miles from Operator X's site with the worst interference. Since both these sites transmit and receive at the same time there should be no issues. However, if their frame start time is not aligned, as I've seen happen in other BaiCell/Ericsson networks, this could be an interference issue. In a few months, the PRiSM PCI Scanner will be able to detect this.

 

1643615500782

 

Wrap Up

CBRS spectrum allocation is about more than frequency, it's also about timing. Being able to survey and inspect neighboring site configurations over the air is critical to maintaining LTE and 5G performance on CBRS.

Equipping engineers and technicians with PCI scanners like PRiSM will result in quicker resolution of these issues which are not visible to a spectrum analyzer: saving revenue and customer frustration.

In short, if you're operating a CBRS network: scan your spectral neighborhood, become familiar with your spectral neighbors, and make sure everyone plays nice with timing.

Finally

If you've read this far, thanks for reading and if you can't tell, I'm a big fan of the PRiSM PCI scanner. If you want more info on it or want to get one, please feel free to contact me.

Thanks!

More Epiq Stories

Introducing Sidekiq™ NVM2: Small Form Factor MIMO SDR

Epiq Solutions is excited to announce the Sidekiq™ NVM2 - the latest addition to Epiq's small form...

READ BLOG

Sean Reminga

07/23/24

How to Troubleshoot an SDR in 6 Steps

If troubleshooting is an art, troubleshooting a complex embedded device like a Software Defined...

READ BLOG

Wyatt Taylor

04/29/24

Accelerating AI/ML Signal Processing: Epiq’s New Partnership with DeepSig

Today, we’re excited to announce a new partnership with DeepSig that will allow us to deploy...

READ BLOG

John Orlando

04/05/24

Welcoming CyberRadio Solutions to Team Epiq

Epiq has spent the last 14 years focused on bringing low-SWaP software-defined radio platforms to...

READ BLOG

Wyatt Taylor

12/07/23

Epiq Solutions Paves the Way for AI/ML Integration in RF Spectrum Analysis

The world of AI and ML is evolving at a rapid pace. While much of the fanfare is focused on...

READ BLOG

John Orlando

12/06/23

Still Epiq, Always Epiq

Over the past 14 years, Epiq’s team has been unwavering in its pursuit to become leaders in...

READ BLOG

Anastasia Hamel

10/03/23

AI & RF Sensing: Next-Gen Direction Finding Solutions

In an increasingly sophisticated wireless landscape, the need for situational awareness calls for...

READ BLOG

Wyatt Taylor

SDR

08/22/23

Introducing Sidekiq™ NV800: SDR for Advanced RF Spectrum Applications

Epiq Solutions is excited to announce the Sidekiq™ NV800 - the latest addition to Epiq's...

READ BLOG

Amy Devine

07/27/23

Unmasking AirTags: the Power of Flying Fox Enterprise

Apple's AirTags have revolutionized personal item tracking, emerging as discreet guardians of your...

READ BLOG

Amy Devine

07/26/23

Make your RF Field Work Easier: PRiSM the Compact, Agile Powerhouse

The realm of RF engineering is witnessing a radical transformation, with the advent of agile,...

READ BLOG