BACHELOR'S THESIS. An Approach to Mobile Communication with Software Defined Radio. Erik Persson 2013

Transcription

1 BACHELOR'S THESIS An Approach to Mobile Communication with Software Defined Radio Erik Persson 2013 Bachelor of Science in Engineering Technology Computer Engineering Luleå University of Technology Department of Computer Science, Electrical and Space Engineering

2 An approach to mobile communication with Software Defined Radio Erik Persson Luleå University of Technology

3 Abstract Synchronizing a mobile device to the host system is an important feature for all mobile communication systems. In WCDMA, a Radio Access Technology (RAT) used in a third generation mobile telecommunication system called UMTS, the synchronisation process is divided in a number of steps. This thesis project covers the necessary steps in order to synchronise and receive broadcast messages from a WCDMA radio base station by creating a software WCDMA receiver capable of tuning in on WCDMA radio base stations, finding radio frames, detecting coding schemes used by the base station and finally being able to capture and decode broadcast messages transmitted by the base station and in the meantime also evaluate the usage of software defined radio within WCDMA. This involves performing tasks traditionally performed in hardware such as processing signals, detecting slot and frame boundaries, descrambling, performing phase compensation, detecting scrambling codes, decoding channels, decoding convolutionally encoded bit strings, performing CRC calculations and much more in order to turn the signal received by a universal software radio peripheral into decoded bits. This thesis project was carried out, in-house at Neava AB in Luleå, Sweden.

4 Preface For me, studying WCDMA with Software Defined Radio has been an interesting journey, coming from a background with no previous knowledge in signal processing or radio technology. I want to thank Staffan Johansson at Neava AB for offering me the chance of playing around with this technology and the rest of the Neava staff for helping me out during this project. I would also like to thank my wife and kids for their patience and support.

5 Contents 1 Introduction 1 2 Method Tools and hardware Software Defined Radio GNU Radio USRP N Introduction to UMTS and WCDMA UMTS WCDMA The WCDMA stack RRC RLC MAC PHY Chips, slots and radio frames Modulation and complex signals WCDMA codes Correlation Primary synchronisation code Secondary synchronisation codes Channelisation codes Scrambling codes Modulation / demodulation IQ modulation Spreading Scrambling Pulse shaping Channels P-SCH S-SCH CPICH PCCPCH RSSI scan 15 5 Synchronisation Slot synchronisation Frame synchronisation Scrambling code identification

6 6 Phase rotation 19 7 From signal to bits 20 8 Decoding the broadcast channel The mapping from BCH onto physical channels Cyclic redundancy check Convolutional coding Convolution decoding Interleaving The BCH data bits Implementation Concept GNU Radio blocks Fitting it all together Results Receiver performance Implementation discussion and details Conclusions and discussion Future work Lessons learned Abbreviations 36 References 37

7 1 Introduction Mobile communication involves huge computational demands, especially for the physical layer. As a result of this, the physical layer algorithms are often realised onto specially designed hardware, eg. ASICs (Application Specific Integrated Circuits), built for a specific physical layer protocol. As mobile communication evolves, the complexity- and the amount- of physical layer protocols are increasing. Mobile devices, often light weight hand-held terminals with limited power supplies, are facing an increased demand to support an increasing amount of protocol stacks. From this, the idea of performing parts- and/or all- of the physical layer operations in software started to arise, and so the first ideas of Software Defined Radio [1] (SDR) were born. SDR offers a low cost solution to research and development within the field of radio technology. SDR enables development of radio receivers and/or transmitters without the requirement of creating new specially designed hardware. The benefits of SDR makes the technique well suited for use in studying different physical layer protocols. A key functionality within all physical layer protocols is to synchronize a mobile device to the host system. In WCDMA [2][3] (the Radio Access Technology (RAT) used within UMTS; a 3rd generation telecommunication system) being synchronized means to be able to read the broadcast messages transmitted by a Radio Base Station (RBS)/WCDMA cell. The synchronisation is performed in a number of steps. The first step is to locate any possible cells within a set of frequency bands. This is done by performing a RSSI (Received Signal Strength Indicator) scan. When a candidate cell has been detected the synchronisation is performed in three steps: Slot synchronisation, Frame synchronisation and Scrambling code identification. First when these steps have been carried out the mobile device can try to read the broadcast messages transmitted by the cell. In this thesis project the goals are to evaluate the usage of Software Defined Radio for use in mobile communication. This should be done by creating software for a Universal Software Radio Peripheral in order to synchronize against WCDMA cells. By being synchronized means, to be able to read the broadcast messages transmitted from a base-station. This document describes UMTS and WCDMA systems in short, the synchronisation process, channel decoding and the software implementation done during this thesis project. The focus will be on the physical layer of WCDMA [4][5][6][7][8][9]. The intention with this report is not to explain SDR in detail since others have already done this [1][12]. The software radio device used in this thesis is an USRP N210 from Ettus Research [11] which is used together with the GNU Radio software [10]. This thesis project were done in-house at Neava AB, in Luleå, Sweden. Neava is a software company mainly focusing on embedded real time systems within the sector of mobile telecommunications. 1(38)

8 2 Method The work done during this thesis project were divided into three phases: Pre-studies - Literature studies in order to get a grip of the subject. Literature used were Convergence Technologies for 3G Networks IP, UMTS, EGPRS and ATM, [2] and WCDMA Design Handbook, [3]. These two books were used in order to write the section Introduction to WCDMA (Sec. 3). Parts of the 3GPP specifications [4][5][6][7][8][9][18] have also been studied, but mostly during the implementation phase. The 3GPP specification were also used in order to write the more technically detailed sections of the report. Implementation - The implementation phase involved implementing a software radio receiver for synchronizing against WCDMA cells, using GNU radio, C++ and Python. It also involved generating the radio signals in order to verify the implementation of the receiver. Report writing - The writing of the report has been a constant process during the entire project and the structure of the report mainly follows the structure of the workflow. 2.1 Tools and hardware This section lists a few of the tools used during this thesis project. All software were at the time available for free (open source licence / other public licence) and available for multiple operating systems Software Defined Radio In short, SDR (Software Defined Radio) is often described as the technique of getting code as close to the antenna as possible. It turns radio hardware problems into software problems. In reality it means that parts of the radio receiver/transmitter chain has been replaced by software. A more technical definition of SDR is defined by The Wireless Innovation Forum[13], where differences are made between software controlledand software defined- radio, and is as follows (SDRF Cognitive Radio Definitions[14]): Software Controlled Software controlled refers to the use of software processing within the radio system or device to select the parameters of operation. Software Defined Software defined refers to the use of software processing within the radio system or device to implement operating (but not control) functions. Software Controlled Radio Radio in which some or all of the physical layer functions are Software Controlled. 2(38)

9 Software Defined Radio (SDR) Radio in which some or all of the physical layer functions are Software Defined. A basic SDR may consist of some sort of computer (personal or embedded), connected to a device capable of sampling radio signals. The samples are delivered to the computer and software is used to perform the actual signal processing GNU Radio GNU radio is an open source software development toolkit for creating signal processing software. Basically it consists of signal processing blocks that can be combined into flow charts that processes signals. The signal processing blocks are written in C++ and Python code is used in order to combine the blocks into flow charts. It comes with a set of signal processing blocks for common signal processing tasks and new blocks are easily written in C++ by extending the predefined classes. GNU Radio also includes a graphical tool, GNU Radio Companion (Fig. 1), with which flowcharts can be created by dragging and dropping signal processing blocks. The tool then creates the python code that combines the signal processing blocks. For more information about GNU Radio and installation instructions see: Figure 1: Image of gnuradio-companion, a graphical tool for creating signal processing software USRP N210 The USRP N210 device from Ettus Research LLC is a device for receiving and transmitting radio signals using a computer with a Gigabit Ethernet connection. Various 3(38)

10 daughter boards can be plugged in, in order to use the device on different frequency bands. The entire design of the hardware is open source, including the daughter boards. The device can be tuned in on different carrier frequencies and sampling rates. It performs the downscaling of the signal from the specified carrier frequency down to baseband. The signal is then sampled at the specified sampling rate and the samples are transmitted over the Gigabit Ethernet interface to a computer for further processing. The N210 can be used together with GNU Radio, for more information and installation instruction see USRP N210 SDR specification (from Ettus Research web page [11], ) 50 MHz of instantaneous RF bandwidth Gigabit Ethernet connectivity MIMO capable - Requires two or more USRP N210 devices as motherboard has one daughterboard slot Onboard FPGA processing FPGA: Xilinx Spartan XC3SD3400A ADCs: 14-bits 100 MS/s DACs: 16-bits 400 MS/s Ability to lock to external 5 or 10 MHz clock reference TCXO Frequency Reference ( 2.5ppm) Optional internal GPS locked reference oscillator FPGA code can only be changed with the paid version of the Xilinx R ISE R Design Suite tools The device used for receiving and sample the signals is an USRP N210 from Ettus Research LLC with WBX daughter boards having a coverage of 50 MHz to 2.2 GHz. 4(38)

11 3 Introduction to UMTS and WCDMA The following sections contains a short introduction to UMTS and WCDMA needed in order to understand the basic concepts. 3.1 UMTS Universal Mobile Telecommunications System (UMTS) is the name of a third generation (3G) telecommunication system that is being defined by the 3rd Generation Partnership Project (3GPP). UMTS consists of two Radio Access Technologies (RATs), WCDMA and GSM/EDGE, where GSM/EDGE is an evolved version of the 2G GSM system. Figure 2: High level representation of a UMTS network. Figure 2 displays the structure of a UMTS network. A user equippment (UE) is connected to a radio base station (RBS). The RBS is connected to a radio network controller (RNC), and the RNC is connected to the core network (CN) and optionally to other RNCs. The figure also displays the interfaces that connects the different devices. The different interfaces are often referred to as Uu between UE and RBS, Iub between RBS and RNC, Iu between RNC and CN, and as Iur for RNC to RNC. UMTS networks supports both circuit switched and packet switched data exchange. 3.2 WCDMA WCDMA (Wideband Code Division Multiple Access) is one of the RATs used in UMTS networks for communication between UEs and RBSs. WCDMA exists in two different forms FDD (Frequency Division Duplex) and in TDD (Time Division Duplex). In FDD 5(38)

12 the uplink (UL) and downlink (DL) are separated by frequency, compared to TDD where the UL and DL are separated in the time domain. Throughout this document when referring to WCDMA it means WCDMA FDD, unless WCDMA TDD is specifically stated. When sending signals through a shared physical medium, as the radio air interface, it is important to separate different signals or streams of data from each other. There exists numerous different techniques for doing this. CDMA, FDMA and TDMA are probably some of the most common ways of dividing a shared medium between different users. As the name implies, WCDMA is based on CDMA, performed in wideband. FDMA - Frequency Division Multiple Access, divides the frequency usage between the different users. TDMA - Time Division Multiple Access, the shared medium is divided in the time domain between the different users. CDMA - Code Division Multiple Access, separates the different signals by encoding them with special codes. 3.3 The WCDMA stack This section gives a brief explanation of the WCDMA stack. The stack is separated into two sets: the access stratum (AS) and the non access stratum (NAS). The AS mainly handles signalling and data transportation while the NAS interprets and handles the transported data. Figure 3: The WCDMA stack. 6(38)

13 3.3.1 RRC The radio resource control (RRC) layer is responsible of establishing, maintaining and releasing radio resource connections between the UE and the CN. The RRC controls the lower layers of the WCDMA stack RLC The radio link control (RLC) layer provides transport services between RLC entities in the UE and in the RNC. Three modes are supported: transparent, unacknowledged and acknowledged. In transparent mode the RLC passes packets directly without adding any extra header information. This requires that the packets being sent is of appropriate size. In unacknowledged mode the RLC passes packets onwards without ensuring delivery. The data can be concatenate and padded in order to fit appropriate packet size. Unacknowledged mode also contains some ciphering functionality. The acknowledged mode provides the same services as the unacknowledged mode with the addition of retransmission control, discarding of duplicated packets and in sequence delivery MAC The medium access control (MAC) layer is responsible of mapping logical channels onto transport channels. This mapping can change dynamically as the characteristics of the network or the user changes. The MAC layer is also responsible of reporting the bandwidth usage back to RRC PHY PHY, the physical layer, is responsible mapping transport channels onto physical channels and the transmission/reception of the physical channels over the air interface. The physical layer also deliver measurement reports back to the RRC. 3.4 Chips, slots and radio frames In WCDMA each radio frame is 10 ms long. Each frame consists of 15 slots. Each slot consists of 2560 chips. Giving a total of chips per frame or, in other words, a chip rate of 3.84 million chips per second. A chip is the smallest whole information carrying part of the signal, although it is also possible and common to use fractions of chips, half-chip and quarter chips etc. 3.5 Modulation and complex signals There exists three basic modulation techniques: frequency modulation (FM), amplitude modulation, and phase modulation. WCDMA uses phase modulation and for some channels a combination of phase and amplitude modulation. When dealing with phase and amplitude modulation of a sinusoidal it is practical to represent the signal in the 7(38)

14 complex plane, often referred to as the I/Q plane. Each sample consists of one real part, I, and one imaginary part Q. Figure 4 illustrates how the amplitude and phase maps to the I and Q parts. For further reading on IQ signals the web tutorial: What is I/Q Data? from National Instruments is recommended [15]. Figure 4: Representation of a signal in the IQ-plane 3.6 WCDMA codes The codes covered in this section are described further in the 3GPP technical specification [7] which can be acquired from the 3GPP website [16]). The information about the properties of the codes are collected from the WCDMA Design Handbook [3] which explains the properties in greater detail. For all codes declared in the following subsections, the leftmost chip in a sequence corresponds to the chip transmitted first in time Correlation Correlation [17] is widely used within WCDMA as a matching filter. The following formula is used for correlation of two sequences, s 1 and s 2, where s 1 [k] and s 2 [k] corresponds to the (k + 1):th value of the respective sequence: R[m] = N 1 i=0 (s 1 [i]s 2[i + m]), where N is the length of s 1, s 2 [n] is the complex conjugate of s 2[n] and m is the correlation offset into the sequence s 2. The result R[m] may be used to judge of how well s 1 matches s 2 at offset m Primary synchronisation code The primary synchronisation code (PSC) is transmitted on the primary synchronisation channel (P-SCH) at the first 256 chips of each slot. The purpose of the P-SCH is to 8(38)

15 ease the detection of the slots boundaries. According to [7] the PSC is constructed as a so-called generalised hierarchical Golay sequence and is constructed to have good autocorrelation properties, in short meaning that it will generate large peaks when perfectly aligned and correlated against itself and almost no peak otherwise. The PSC is defined as: a = [x 1, x 2, x 3,..., x 16 ] = [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] P SC = (1 + j)[a, a, a, a, a, a, a, a, a, a, a, a, a, a, a, a] Secondary synchronisation codes The secondary synchronisation codes (SSC) are transmitted on the secondary synchronisation channel (S-SCH) at the first 256 chips of each slot. There exists 16 different SSCs and they are used to create the 64 different S-SCH sequences defined by the 3GPP. The purpose of the S-SCH is to ease the detection of the frame boundaries and also to identify what scrambling code group that a particular cell belongs to. The SSCs {SSC 1, SSC 2,..., SSC 16 } are constructed by combining a set of so-called Hadamard sequences with the sequence z defined as: z = [b, b, b, b, b, b, b, b, b, b, b, b, b, b, b, b] b = [x 1, x 2, x 3, x 4, x 5, x 6, x 7, x 8, x 9, x 10, x 11, x 12, x 13, x 14, x 15, x 16 ] where {x 1, x 2,..., x 16 } are the same as the {x 1, x 2,..., x 16 } used in the definition of the PSC in the previous section. SSC k = (1 + j) [z(0)h k (0), z(1)h k (1), z(2)h k (2), z(3)h k (3),..., z(255)h k (255)] for 1 k 16 where h k (i) denotes the i:th symobol of the k:th Hadamard sequence and z(i), the i:th symbol of the z sequence. The Hadamard sequences are obtained from the rows of a recursively created matrix, H 8, defined as: H 0 = 1 [ ] Hj 1 H H j 1 j, j > 0. H j 1 H j 1 Finally h k is defined as h k = H 8 (16 (k 1)), where H 8 (i) denotes the i:th row from the matrix H Channelisation codes The purpose of the channelisation codes are to spread and separate the different channels transmitted from a RBS or a UE. One important property of channelisation codes are orthogonality, meaning that the sum of the position wise multiplication of two codes is 9(38)

16 equal to zero. This can be compared to an orthogonal system in a three-dimensional space where each dimension is completely independent of the others. The formula below describes the relationship of the channelisation codes: C i = [C i0, C i1, C i2,..., C i(n 1 )], C j = [C j0, C j1, C j2,..., C j(n 1 )], where C in ɛ {+1, 1}, C jn ɛ {+1, 1}, 0 n N 1 and N defines the chip length of each code. The codes are orthogonal to each other if the following statement holds: N 1 n=0 C in C jn = { 0 i j N i = j. The codes are created from a so-called orthogonal variable spreading factor (OVSF) three see Fig.5. The set of codes generated from the OVSF tree contains the same orthogonal codes as codes generated using Hadamard or Walsh codes, the differences comes from how they are indexed. Figure 5: An Orthogonal Variable Spreading Factor Tree (OVSF-Tree). In the bit strings defining the OVSF codes a 0 represents +1 and a 1 represents Scrambling codes The scrambling codes are used to separate the signals from multiple RBSs or UEs transmitting at the same frequency. The scrambling sequence is a pseudo random noise sequence which, by its own, appears as white noise. The properties of the scrambling codes are, large impulse response when cross-correlated against itself and small when correlated against any of the other scrambling codes. 10(38)

17 The scrambling codes are divided into 512 sets each containing one primary and fifteen secondary codes. The codes are pseudo random noise sequences and built from a set of Gold sequences Z n, n = {0, 1, 2,..., }, which are generated from two so called m-sequences x and y. The x and y m-sequences and the Gold sequences Z n are recursively defined as: x(i + 18) = (x(i + 7) + x(i)) mod 2, y(i + 18) = (y(i + 10) + y(i + 7) + y(i + 5) + y(i)) mod 2, z n (i) = (x((i + n) mod (2 18 1)) + y(i)) mod 2, i = {0, 1, 2,..., }, n = {0, 1, 2,..., }, with the following starting conditions for x and y as: x(0) = 1, x({1, 2,..., 17}) = 0, y({0, 1, 2,..., 17}) = 1 The scrambling codes S n are then finally defined as: S n (i) = Z n (i) + jz n ((i ) mod (2 18 1)), where i = {0, 1,..., 38399} and n = 16 m + k where m defines the scrambling code set from and k is equal to zero for primary scrambling codes and else in the range from 1 to 15 for the secondary scrambling codes. 3.7 Modulation / demodulation This section focuses on the transformation of the data from bits into chips, ready to be transmitted over the air interface. Figure 6 displays a simplified view of how bits from one channel, are processed into chips. Figure 6: The modulation pipeline from bits to antenna for a single channel IQ modulation In the process of IQ modulation, bits are turned into complex symbols. The symbols are produced by dividing the two dimensional IQ space into regions (constellations) representing symbols, where each symbol represents a bit pattern. In QPSK (Quadrature 11(38)

18 phase-shift keying), which is one of the modulation schemes used in WCDMA, the two dimensional space is divided along the two axes, I and Q, into four regions each representing two bits (00, 01, 11, 10). The diagram in Figure 7 illustrates the mapping from bits to symbols for QPSK. Notice that gray-coding is often preferred when mapping bits to symbol constellations, this in order to minimize bit errors caused by symbols wrongfully ending up in a neighbour constellation on the receiver side due to interference. Figure 7: Diagram of the mapping from bits to symbols for QPSK Spreading In the spreading process the channelisation code is applied on the symbols. Each symbol is multiplied with each chip in the spreading code. D = S C ch,s,c = S [C ch,s,c (0),..., C ch,s,c (s 1)]; s > 0, where S is the complex symbol, C ch,s,c is the channelisation code from the OSVF tree with spreading factor s and code number c and C ch,s,c (n) refers to the n:th chip in the sequence C ch,s,c. The result D is a sequence of chips with the same length as the spreading factor s of the spreading code C ch,s,c Scrambling The scrambling process multiplies the chips from the spreading process with the scrambling code. The scrambling code is aligned with the PCCPCH frame start Pulse shaping For pulse shaping a root raised cosine (RRC) filter is used with a roll-off factor of The purpose of the RRC filter is to reduce inter symbol interference. 12(38)

19 3.8 Channels The channels used in WCDMA are divided into three layers: logical-, transport- and physical- channels. The logical channels mainly carries NAS data and are mapped onto transport channels. The transport channels are then carried over the air interface by the physical channels. This section describes the downlink physical channels [5] used throughout this thesis project. Figure 8 contains a chart of the physical channels covered in this section and their alignment. Figure 8: Chart of some of the physical channels P-SCH The primary synchronisation channel (P-SCH) transmits the PSC each first 256 chips of every slot. This channel is not spread or scrambled with channelisation and scrambling codes S-SCH The secondary synchronisation channel (S-SCH) transmits a predefined repetitive sequence of 15 SSCs each one transmitted on the first 256 chips of every slot. This channel is not spread or scrambled with channelisation and scrambling codes CPICH The Common pilot channel (CPICH) carries pilot information used by the UE to identify the scrambling code of the RBS. It is also used for detecting the phase rotation (Sec. 6) and for measuring the signal quality. All symbols on the CPICH channel contains IQ data of (1+1j). The CPICH uses channelisation code C ch,256,0 [7] PCCPCH Primary common control physical channel (PCCPCH) carries the broadcast transport channel (BCH), which in terms carries the broadcast control channel (BCCH). PCCPCH 13(38)

20 uses QPSK modulation and channelisation code C ch,256,1 [7]. No information is transmitted the first 256 chips of every slot on PCCPCH. 14(38)

21 4 RSSI scan A RSSI scan (received signal strength indicator scan) is performed by measuring the energy on a set of frequencies. Frequencies with higher energy levels are potentially better candidates for containing a WCDMA cell. The RSSI measurements done in this thesis is done by calculating the squared magnitude of the received IQ samples. 15(38)

22 5 Synchronisation This section describes the synchronisation process, derived from the cell search procedure in [8]. The process is divided into three parts: slot synchronisation, frame synchronisation and scrambling code identification. It is however possible to identify the scrambling code and find slot and frame synchronisation without the first two steps but it makes the process much more complex in terms of computational complexity. Correlating all 512 primary scrambling codes against the received signal, measuring which one producing the largest response on every chip over at least an entire frame would simply be too time consuming. The first steps in the synchronisation procedure eliminates the set of possible scrambling codes down to eight and also detects the frame boundaries so that each possible scrambling code only needs to be correlated using one correlation offset that matches a frame boundary. 5.1 Slot synchronisation The first step in the synchronisation process is to acquire slot synchronisation. This is performed by calculating the magnitude of the correlation (Section 3.6.1) of the PSC against the received signal. This process may need to be done a number of times and the result should be accumulated in order to receive proper results that can be trusted as valid. Large peaks indicates the beginning of a slot, see Figure 9. Figure 9: Illustration of the magnitude of the correlation ( R[m] ) of the PSC against the received signal and its usage in order to detect the slot boundaries. 5.2 Frame synchronisation The purpose of the second step is to acquire frame synchronisation and also to detect what scrambling code group that the cell belongs to. This is done by correlating the the 16 SSCs against the 256 first chip of every slot in order to detect a pattern of a repetitive sequence of 15 SSC. The process may need to be performed a number of times over a multiple of 15 slots and the result from each chunk of 15 slots should be accumulated. By taking the SSC with the best match in each of the 15 slots a sequence of 15 SSCs is constructed. Figure 10 describes the process. The detected SSC sequence can then be used to detect the frame boundaries and the scrambling code group for the cell by checking the received sequence against a table, defined in the 3GPP TS [7], containing the 64 predefined SSC sequences that 16(38)

23 Figure 10: Illustration of the SSC correlation result and the identified SSC sequence. defines the scrambling code group. At this point, the start of the received SSC sequence is unknown, therefore it needs to be rotated and for each iteration it needs to be checked against each row of the SSC sequence table. The newly found start of the SSC sequence defines the start of the frame boundaries and the row from the SSC sequence table defines what scrambling code group that the cell belongs to, see Figure 11. Figure 11: The detected SSC sequence is measured against the SSC sequence table defined in [7], containing all the valid SSC sequences. Since the slot boundaries should be known by the previous step in the synchronisation process, the 16 SSCs only needs to be correlated against the first 256 chip in every slot, giving 16 correlations each slot. 17(38)

24 5.3 Scrambling code identification The final step in the synchronisation process involves detecting the primary scrambling code that the cell is using, this in order to be able to descramble the actual signals transmitted by the cell. The process of identifying the scrambling code is done by correlating the complex conjugate of the scrambling codes against the received signal starting from the beginning of each frame. The correlation that gives the strongest peak is probably the primary scrambling code used by the RBS. Each scrambling code may need to be correlated against multiple frames and the accumulated result may be used in order to receive a better response. Not all 512 scrambling codes needs to be used in the correlation, since the frame synchronisation step identified what scrambling code group that the measured cell belongs to. Therefore only those scrambling codes that belongs to the scrambling code group for the particular cell are relevant to test. 18(38)

25 6 Phase rotation When a signal propagates through the air it gets distorted in a couple of ways. One phenomena is phase rotation. Phase rotation may occur as an effect of a frequency error in the receiver. Phase rotation is also necessary, since without any pilot information, the reference phase is unknown on the receiver side. The CPICH channel may be used in order to deal with phase rotation, since a known signal (1 + j) is constantly being transmitted on the CPICH channel. The difference between the phase of the received CPICH channel and the expected phase (1 + j) can be calculated and used in order to rotate the signal back into the correct phase, see Figure 12. Figure 12: The phase difference d between a received chip R, from the CPICH channel, and its expected position (1 + j) 19(38)

26 7 From signal to bits Figure 13: The different processing blocks for transforming the signal into bits for one channel in WCDMA Section 3.7 describes in short how bits are modulated into a signal that gets transmitted over the radio air interface. This section describes the necessary steps for doing the reverse operation of transforming the signal into bits for a particular channel. The required steps are the following, Table 1 contains a listing of the definitions used and Figure 13 displays a flowchart of the process (Note that this description is based on a sample rate equal to the chip rate, for higher sample rates the WCDMA codes should be spread with a factor equal to the multiple of the chip rate that is used for the sampling rate. This is necessary in order to align the codes correctly with the received signal): Table 1: Definitions Symbols C scr,q (i) C ch,a,b x Explanation The i:th chip of the primary scrambling code number q The channelisation code number b with spreading factor a from the OVSF-tree The complex conjugate of x 1. Sample the received signal and perform pulse shaping with a raised root cosine filter with a roll-off factor of 0.22 producing the samples R 0 (n) where n defines the chip number and R 0 (0) is the first chip in a frame. 2. De-scramble the signal by chip-wise multiplication of the complex conjugate of the identified scrambling code (C scr,q ) against the chips in R 0 (n) R 1 (n) = C scr,q(n mod 38400)R 0 (n). 3. De-spread the signal by calculating the sum of the chip wise multiplication of the channelisation code C ch,a,b for the wanted channel with the chips, R 1 (n) received from step 2, with spreading factor a and channelisation code b a 1 R 2 (n 1 ) = (C ch,a,b (i)r 1 (an 1 + i)). i=0 20(38)

27 4. At this step it would be possible to measure the phase difference for the CPICH (see Section 6). If phase rotation has occurred the signal needs to be rotated back in order to decode the other channels. Taking the symbols in R 2 (n 1 ) as input and correct the phase against the CPICH producing the phase corrected symbols, R 3 (n 1 ) as output. 5. Map the chips R 3 (n 1 ) from symbols to bits. Different channels may use different modulation techniques. For PCCPCH which carries the BCH QPSK is used (see Section 3.7.1). 6. Done, a sequence of bits can now be obtained for a specific channel. 21(38)

28 8 Decoding the broadcast channel The BCCH is the logical channel containing the broadcast messages transmitted by the RBS. The BCCH is mapped onto the transport blocks (TrBlk) on the BCH transport channel and the BCH is mapped onto the PCCPCH that is transmitted over the air. This section describes the mapping from BCH to PCCPCH and how to perform the reverse operation. The process is derived from 3GPP TS [6] (Section 4 Multiplexing, channel coding and interleaving ) and TS [18] (Annex A (normative): Description of Transport Formats) which describes the process in general for all channels. Figure 14: The different steps in mapping the BCCH onto PCCPCH 8.1 The mapping from BCH onto physical channels The following steps maps the BCH onto the PCCPCH (Fig. 14 illustrates the process): 1. The data bits from the BCCH are mapped onto BCH TrBlk each of size 246 bits. 2. A CRC checksum of 16 bits is appended onto each TrBlk, see Section Each TrBlk with the appended CRC checksum passes through a convolution coder, see Section (38)

29 4. Bit interleaving. 5. Data is passed onwards to the PCCPCH. 8.2 Cyclic redundancy check The purpose of the Cyclic redundancy check (CRC) is to create a set of bits which can be used on the receiver side to verify that the received bits are correct, although it should be noticed that there is a slight chance that bit errors may be introduced in both the CRC bits and the CRC encoded data, this could make the CRC bit check pass on the receiver side even though the received bits contains errors. There is also the case of when the CRC coded data is intact but bit errors have been introduced in the CRC bits, in that case there is no way of detecting at the receiver side what actually happened. Instead the CRC coded data gets discarded as invalid. The CRC calculator takes TrBlks as input, calculates and outputs the CRC bit string and finally attaches it at the end of the TrBlk. Figure 15 displays a scheme of the 16-bit CRC calculator, with the generator polynomial of D 16 + D 12 + D 5 + 1, that is used to calculate the CRC bits for BCH. The bits from the transport block is inserted into the CRC calculator. During TrBlk insertion the output bits are ignored. The CRC calculator is cleared between each TrBlk by inserting zero bits. The output generated while clearing the CRC calculator is the actual CRC bits that are appended to the TrBlk. Figure 15: A scheme of the 16-bit CRC calculator used in WCDMA 8.3 Convolutional coding WCDMA uses two different types of forward error correcting codes: Convolution coding and Turbo coding. The purpose of the error correcting codes are to correct bit errors that may have been introduced when data was transmitted over the air interface. For the BCH half-rate (1/2) convolution coding is applied, meaning that one input bit generates two output bits. Figure 16 contains a chart of the 1/2 convolution coder used in WCDMA. The encoding machine is a state machine with 2 k number of states where k is the number of memory registers holding the current state of the machine (as seen in Fig.16). Code blocks are delivered as input to the convolution coding machine one at a time in sequence. Each code block consists of a TrBlk with the appended CRC bits and eight tail bits of zeros. The purpose of the tail bits are to clear the state of the convolution coding machine between each code block. 23(38)

30 Figure 16: The half rate convolutional encoder used in WCDMA. Output bits are ordered as Output 0, Output 1, Output 0, Output 1,..., Output 0, Output Convolution decoding The output from the convolution coder describes a path through a trellis diagram, where the entire set of states of the encoding machine makes up the columns of the diagram. The number of columns is equal to the number of bits inserted to the encoding machine plus one (the start state). The transition from one state to another is based on the current state and the input. Decoding a convolutionally encoded string is done by finding the path through the trellis diagram, that best matches the encoded string. As an example, the convolution coder in Figure 17 has encoded the bit string 1001 which generates the output Figure 18 displays a trellis diagram of the encoded bit string and the path through the diagram that represents the correct decoding of the encoded string. Going through and calculating how well each path matches the bit string that should be decoded is a complex procedure in terms of computational power. Therefore, in order to speed up the process, it is necessary to make some decision on which paths that are more likely to contain the proper solution. A common way of doing this is often referred to as Viterbi decoding[19]. The principle behind a Viterbi decoder is that whenever two paths meet at the same state in the trellis diagram, discard the path with the lowest match. For further reading about the Viterbi Algorithm the tutorial introduction The Viterbi Algorithm[20] is recommended. In WCDMA, since the start state of the encoding machine is known to be zero for each coding block delivered to the encoding machine, all paths originating from the other starting states are not needed to be included in the set of paths that may make up the original code block, neither any paths not ending with eight decoded zero bits. Figure 17: A scheme of a simple convolution encoder. 24(38)

31 Figure 18: A Trellis diagram displaying the correct path and all invalid paths starting at state Interleaving A property of convolutionally encoded bit strings are that the decoder works better if the errors that may have been introduced into the bit string are somewhat evenly distributed [21]. Therefore a set of bit interleaving operations are applied before the encoded blocks are transmitted over the air. The BCH is transmitted over two radio frames and the first interleaver spreads equally many bits from each radio frame to the other by using the following formula on each BCH encoded code block: The output bits from the convolution coder, for each encoded code block, are denoted as b n where n = 1, 2, 3,..., i where i is the number of output bits produced by the convolution coder for one code block, for BCH i = 540. A R 1 C 1 matrix M 1 where R 1 = 270 and C 1 = 2 is filled with the bits b n row by row. M 1 = b 1 b 2 b 3 b 4 b 5 b b 539 b 540 The first interleaving step then outputs the bits column by column: b 1, b 3, b 5,..., b 539, b 2, b 4, b 6,..., b 540, where the first 270 bits belongs to the first radio frame in the TTI and the second 270 bits belongs to the second radio frame in the TTI. The second interleaving step spreads the bits within each radio frame. For bits from the BCH the following formula is used: Let the bits in each radio frame sent to the second interleaving step be denoted as c n where n = 1, 2, 3,..., j where j = 270. A R 2 C 2 matrix M 2 where R 2 = 9 and C 2 = 30 is filled with the bits c n row by row. M 2 =. c 1 c 2 c 3... c 30 c 61 c 62 c c 60 c 91 c 92 c c c 241 c 242 c c (38).

32 A new matrix M 2p is then defined as an inter column permutation of the matrix M 2 according to the following pattern: M 2p = [A 0, A 20, A 10, A 5, A 15, A 25, A 3, A 13, A 23, A 8, A 18, A 28, A 1, A 11, A 21, A 6, A 16, A 26, A 4, A 14, A 24, A 19, A 9, A 29, A 12, A 2, A 7, A 22, A 27, A 17 ], where A 0,1,2,...,29 are the columns of matrix M 2 from left to right. The output bits from the second interleaving step are then read out column by column from the matrix M 2 p. 8.6 The BCH data bits Finally when the entire process of reading bits on the PCCPCH (Section 7) and the process of decoding the PCCPCH bits turning them into BCH bits (Section 8), the BCH data bits are revealed. The BCH data bits carries the broadcast messages and the System Frame Number (SFN) of the current cell. The SFN is the first 12 bits of every BCH TrBlk and the rest of the data bits carries the BCCH messages. The BCCH messages basically consists of a set of different data blocks. The Master Information Block (MIB) describes when the other System Information Blocks (SIBs) are scheduled. The SIBs contains the actual information about the current cell. 26(38)

33 9 Implementation This section covers the implementation, the design of the software and implementation specific issues. Figure 19: A scheme of the signal processing blocks of the receiver chain. 9.1 Concept The implemented software consists of two signal processing blocks. The blocks are combined with other signal processing blocks in a flow chart that makes up the receiver. Figure 19 displays a scheme of the receiver chain. The implemented slot Sync block and the Resampler blocks are described further within this section. The other blocks in the figure are standard GNU radio blocks. 9.2 GNU Radio blocks Two signal processing blocks were implemented for the WCDMA cell synchronisation software. A resampler block that takes samples of some sample rate as input and linearly interpolates between the incoming samples producing new samples with some other sample rate as output. This was needed since the N-210 device was not able to sample at a multiple of the WCDMA chip rate. The second block makes up the entire WCDMA receiver. It consists of four different states: WAIT ON RADIO, FIND SLOT SYNC, FIND FRAME SYNC and IN SYNC. The slot sync block contains pre generated lookup tables of the PSC, SSCs and the scrambling code group table containing the SSC sequences for the different scrambling code groups. The scrambling codes are generated online, by using pre-calculated start values for each primary scrambling code and then generating the rest of the chips in the scrambling sequences on the fly, this due to the length of the sequences. The codes and how they are generated are described in Sections 3.6.2, and WAIT ON RADIO, at this state the signal processing block only waits for a predefined 27(38)

34 number of samples in order to make sure that the radio has become stable. When done, it changes state into FIND SLOT SYNC. FIND SLOT SYNC, at this state the signal processing block searches for the slot boundaries by correlating the PSC against the received signal in order to detect slot boundaries (Section 5.1). To improve the slot boundary detection, the correlation is performed for the duration of 3 frames and the result is accumulated in order to improve the correlation peaks. This is performed by, for each new sample that is arriving to the signal processing block, calculating the sum of the chip wise multiplication of the PSC and the latest received samples. The result is accumulated in a buffer, B sbacc, with length equal to the number of samples per slot l, in this case The result is stored at position i sample, where i is the current sample number. After 3 15 l number of samples (three frames) the index i sbound of the highest accumulated value in the buffer B sbacc is calculated. The slot boundaries can now be considered to start on each sample where the following condition is met, ((s + 511) mod l) = i sbound where s is the sample number. The addition of 511 comes from fact that the index i sb ound is placed at the end of the PSC correlation, and each new slot starts at the beginning of the PSC. FIND FRAME SYNC, at this state the signal processing block tries to detect the frame boundaries and tries to identify the scrambling code group (Section 5.2). On success it switches state into IN SYNC and in case of failure to detect frame boundaries or scrambling code group it goes back to state WAIT ON RADIO, to try the same procedure again. At the start of each slot 512 samples are stored away in a buffer B s sch, capturing the S-SCH. The sixteen SSCs are then correlated against the buffer B s sch at offset zero in order to decide which SSC with the best match in each slot. The result is accumulated over seven frames before deciding which SSC sequence the cell is using. The SSC sequence is then checked against a table containing the valid SSC sequences for each scrambling code group. IN SYNC, when in this state the slot- and frame- boundaries and the scrambling code group have been successfully detected. In this state the signal processing block starts to identify the primary scrambling code for the cell, as described in Section 5.3. Once detected it starts receiving the PCCPCH bits (see Section 7). Meanwhile in this state, since the samples delivered to the block may drift in time with respect to how they are transmitted from the RBS, some simple mechanism is needed in order to keep slot and frame synchronisation. This is done by correlating the PSC around the detected slot boundaries in order to detect if the chips are drifting in time. If this occurs it is corrected by inserting or removing extra chips. Received PCCPCH frames are stored away in an array for offline processing, since the decoding of the BCH is too time consuming to be performed in real time by software running on a standard computer at the time of the implementation. 28(38)

35 9.3 Fitting it all together Figure 19 shows the resampler block and the cell sync block together with the rest of the receiver chain. A python script launches the application and sets the frequency. It then polls the cell sync block for information about the number of synchronisation tries, and if it has finished reading the PCCPCH frames. If a defined number of synchronisation tries has been done without successfully reading the PCCPCH frames the application terminates. When all PCCPCH frames has been successfully read by the slot sync block, the receiver chain is stopped and the decoding of the BCH is handled by the python script as explained in Section 8. 29(38)

36 10 Results 10.1 Receiver performance The RSSI scan performance were measured in a lab environmet, scanning through the frequency range from GHz to GHz on a 200 khz raster with one cell located at 2.14 GHz. With a cell power of 90 dbm / 3.84 MHz the frequency containing the cell is placed around the first quartile in the frequency ranking list from the RSSI scan. Raising the cell power to 75 dbm / 3.84 MHz places the cell frequency near the top of the ranking list. The WCDMA receiver is capable of decoding BCH data from live cells. In a simulated lab environment the WCDMA receiver has been used to decoding BCH data on power levels around -115 dbm / 3.84 MHz although on power levels below -110 dbm / 3.84 MHz decoding problems starts to arrive quite frequently Figure 24 shows the measurement tests on the different power levels. On live networks no detailed performance measurements has taken place, although the receiver has been able to decode the BCH data from the live cells that have been tested. It should also be noticed that the receiver only works under static conditions. This is because of no functionality for continuously monitoring and tracking peaks (by continuously correlating the scrambling code against the received signal). That functionality would probably be too computationally expensive to perform in software. Figure 20 contains charts of PSC correlations performed against a live cell and against the lab equipment and Figure 21 displays plots of the received CPICH symbols in live and lab environment. Figure 22 displays the rotated CPICH symbols. Figure 20: Plot of the magnitude of the correlation ( R[m] ) of the PSC against the received signal during slot synchronisation. 30(38)

37 Figure 21: Plots of the received CPICH symbols. Figure 22: Plots of the rotated CPICH symbols. 31(38)

38 During the development of the receiver, the Raised Root Cosine (RRC) filter unintentionally was left unconfigured, resulting in the filter having none or minimum impact. Configuring the RRC filter resulted in a great performance boost. From having trouble with reading the BCH and synchronising against cells with power levels below -80 dbm / 3.84 MHz to having no problem at power levels below -100 dbm / 3.84 MHz. Figure 23 and 24 shows performance graphs of the receiver, before and after the RRC filter setup. The performance data were collected by examining the results from six consecutive test runs of the receiver software on each power level. Figure 23: Performance graph of the receiver for different power levels, before RRC filter setup. Figure 24: Performance graph of the receiver for different power levels, after the RRC filter setup. 32(38)