5G NR

4G LTE-Adv
A Master Guide to Protocol Stack
(Telecom) Testing Job

By
Arun Baidya

i
 5G NR and 4G LTE Adv – A Master Guide to Protocol Stack
(Telecom) Testing Job

The Author has written this book from the realization of requirements of perspective professionals
and industry based on his 16+ years experience, understanding and knowledge on the subject and the
experience of real time interviews of his students. The explanation is completely intended to be
generic and does not represent any practical implementation of any OEM vendor or any R&D company
or any software development company.

Suggestion, Request and Comments regarding the contents and typo-errors of this book can be sent
to [email protected].

All Suggestions, Requests and Comments will be considered and updated in the future edition, for the
betterment of this Book.

First published: September, 2021

Published by: Self Published

Printing House details: Cyber Graphics, Kolkata, India

ISBN 978-93-5493-910-5

Edition 1, Version 1

Copyright © 2021 Arun Baidya, India

All rights reserved, including the right of reproduction in whole or in part in any form or by any means.

ii
Table of Contents (LTE Question-Answer):
1. Q-A on LTE Fundamental 1
2. Q-A on Downlink Synchronization 13
3. Q-A on Uplink Synchronization (RACH Procedure) 31
4. Q-A on RRC Protocol Layer
4.1. RRC Connection Establishment Procedure 54
4.2. Radio Link Failure (RLF) 59
4.3. RRC Connection Re-establishment Procedure 63
4.4. RRC Connection Re-establishment Reject & Release 68
4.5. RRC Connection Reconfiguration 71
5. Q-A on Non-Access Stratum (NAS) Protocol Layer
5.1. NAS Attach Procedure 83
5.2. Different NAS Procedure Failure Cases 95
5.3. TAU Procedure 98
5.4. UE Capability Enquiry & Information 103
6. Q-A on EPS Bearers and QoS 105
7. Q-A on Measurement in LTE 114
8. Q-A on Idle Mode Procedures
8.1. Cell Selection Procedure 119
8.2. Cell Reselection Procedure 123
8.3. Paging Procedure 128
9. Q-A on X2 Hand Over Procedure 135
10. Q-A on I-RAT Hand Over Procedure 143
11. Q-A on SRVCC Procedure 147
12. Q-A on Medium Access Control (MAC) Protocol Layer
12.1. MAC Functionalities & Procedures 157
12.2. MAC PDU Structure and Control Elements (CEs) 158
12.3. Uplink Time Alignment 165
12.4. MAC Schedulers 169
12.5. Resource Allocation 172
12.6. Dynamic & Semi-Persistent Scheduling 182
12.7. BSR – Buffer Status Report 190
12.8. SR – Scheduling Request 200
12.9. TTI Bundling 204
12.10. DRX – Discontinuous Reception 207
12.11. HARQ – Hybrid Automatic Repeat Request 210
12.12. PHR – Power Headroom Reporting 222
13. Q-A on Physical Layer
13.1. PHY Downlink Channels & DCI 226
13.2. PHY Uplink Channels & UCI 247
14. Q-A Downlink Reference Signals 297
15. Q-A Uplink Reference Signals 309
16. Q-A on MIMO – Multi-Input Multi-Output 319
17. Q-A on CA – Carrier Aggregation 325
18. Trouble Shooting of some projects 346
19. ADB and Linux Command Lines 350
20. Q-A on QXDM, QPST and Wireshark Tools 355
21. Q-A on Software Testing 363
22. Sample Test Cases 379
23. 31 Sets of Real Time Interview Question 380

iii
Table of Contents of 5G NR:
1. 5G Over View & Architecture
1.1. 5G Overview & IMT 2020 Requirements 400
1.2. 5G Network Architecture 402
1.3. 5GS Interworking 405
2. Open - RAN (O-RAN)
2.1. Architecture of O-RAN 400
2.2. Description of O-RAN 412
2.3. O-RAN Implementation Options 415
3. 5G Next Generation – RAN (NG-RAN)
3.1. 5G NG-RAN Architecture 421
3.2. 5G RAN Deployment Options 422
3.3. CUPS Architecture 427
3.4. Functional Placement Scenarios 430
3.5. Front Haul & eCPRI 434
3.6. Functional Decomposition of PHY Layer 435
3.7. Active Antenna Architecture 439
3.8. 5G Base Station Classes & Types 441
3.9. 5G Protocol Stack Architecture 441
3.10. 5G NR Channel Mapping 443
4. 5G NSA Call Flows
4.1. 5G NR NSA (EN-DC) Call Flow 446
4.2. SgNB Addition Procedures 457
4.3. SgNB Release Procedures 459
4.4. SN Modification Procedures 460
4.5. SN Change Procedures 463
4.6. Mobility Management Procedures 466
4.7. PCell-Scell Change Procedures 471
5. 5G Standalone (SA) Call Flow
5.1. 5G SA Call Flow 473
5.2. 5G gNB DU-CU Procedures 484
5.3. 5G SA Mobility Management Procedure 486

************

iv
 01. LTE Fundamental

1. Can you please explain LTE Architecture with Interface?

Ans: LTE Network consists of two parts, which together called EPS - Evolved Packet System.
• EPC : Evolved Packet Core and
• E-UTRAN : Evolved - UTRAN
EPC Consists of:
• MME : Mobility Management Entity
• SGW : Serving Gateway
• PGW : Packet Data Network (PDN) Gateway
• HSS : Home Subscriber Server
• PCRF : Policy and Charging Rules Function
E-URTAN Consists of:
• eNodeB : Evolved Node Base Station

Fig: Network Architecture (LTE)

Following are the Interfaces in LTE Network:

• X2: Reference point for the control plane protocol between two eNB.
• S1-MME: Reference point between E-UTRAN (eNB) and MME, used for Control Plane S1A
Protocol.
• S1-U: Reference point between E-UTRAN (eNB) and SGW for per bearer User Plane Tunnelling
and inter eNB path switching during handover.
• S10: Reference point between MMEs for MME relocation and MME to MM information /
signalling transfer.
• S11: Reference point between MME and Serving GW, used to exchange GTP-C signalling
between MME and SGW.
• S5: Reference point between SGW and PGW. It provides UP Tunnelling and tunnel
management between SGW and PGW within a same PLMN / Network. It is used for SGW
relocation due to UE mobility and if SGW needs to connect to a non-collocated PGW for the
required PDN connectivity.
• S8: Inter-PLMN reference point providing UP & CP between SGW in VPLMN and PGW in
HPLMN. S8 is the inter PLMN variant of S5.

1
 • S6a: Reference point between MME and HSS. It enables transfer of Subscription and
Authentication Data using DIAMETER message for Authenticating / Authorizing user access
between MME and HSS.
• SGi: Reference point between PGW and PDN e.g. for provision of IMS services. This reference
point corresponds to Gi for 3GPP accesses.
• Gx: Reference point between PGW and PCRF. It provides transfer of (QoS) PCC Rules from PCRF
to PCEF in PGW.
• Rx: Rx is the reference point between AF (Application Function) and PCRF.
• S9: Provides transfer of (QoS) PCC information between the Home PCRF and Visited PCRF in
order to support local breakout function.
• S12: Reference point between UTRAN and SGW for UP Tunnelling when Direct Tunnel is
established. It is based on Iu-u/Gn-u reference point using GTP-U Protocol as defined between
SGSN and UTRAN or respectively between SGSN and GGSN. Usage of S12 is an operator
configuration option.
• S13: Enables UE Identity (IMEI) check procedure between MME and EIR (Equipment Identity
Register).
• SBc: Reference point between CBC (Cell Broadcast Centre) and MME for warning message
delivery and control functions.

2. What are S5 & S8 interface?

Ans: These are the interfaces between S-GW and P-GW. In principle, S5 and S8 are the same interface,
the difference being that S8 is used when roaming between different PLMN while S5 is for internal
network.
S5 Interface:
• Provides UP tunnelling and tunnel management between SGW and PGW.
• It is used for SGW relocation due to UE mobility and if SGW needs to connect to a non-co-
located PGW for the required PDN connectivity.
S8 Interface:
• Inter-PLMN reference point, providing UP & CP between SGW in VPLMN and PGW in HPLMN.
• S8 is the inter PLMN variant of S5 interface.

3. What is GUTI in LTE?

Ans: In LTE, GUTI stands for Globally Unique Temporary Identity which is/has
• Used to identify a UE to LTE Network
• Assigned to UE by MME at the time of Initial Attach Procedure
• Used to maintain security of IMSI when transmitting over radio interface.
• Two Components, GUMMEI + M-TMSI
• GUTI = GUMMEI + M-TMSI = (PLMN ID + MME ID) + M-TMSI
= {(MCC + MNC) + (MMEGI + MMEC)} + M-TMSI
• Total no of Bits = 12 (mcc) + 12 (mnc) + 16 (mmegi) + 8 (mmec) + 32 (m-tmsi) = 80 Bits
4. What are the Logical, Transport and Physical Channels in LTE?

Ans: Three types of channels are there in LTE.

• Logical Channel
• Transport Channel
• Physical Channel
Logical Channels:
• Define what type of data is transferred.

2
 • Define the data-transfer services, offered by MAC Layer.
• Data & Signalling messages are carried on Logical Channels between RLC & MAC Layers
Logical channels are two types:
Control Channels:
• CCCH : Common Control Channel
• BCCH : Broadcast Control Channel
• PCCH : Paging Control Channel
• DCCH : Dedicated Control Channel
• MCCH : Multicast Control Channel
Traffic Channels.
• DTCH : Dedicated Traffic Channel
• MTCH : Multicast Traffic Channel
Transport Channel:
• Transport channels define how and with what type of characteristics data is transferred by
Physical Layer.
• Data & Signalling messages are carried on Transport Channels between MAC & PHY Layers.
Based on direction, Transport Channels are two types:
Downlink Transport Channels:
• BCH : Broadcast Channel
• PCH : Paging Channel
• DL-SCH : Downlink Shared Channel
• MCH : Multicast Channel
Uplink Transport Channels:
• UL-SCH : Uplink Shared Channel
• RACH : Random Access Channel
Physical Channels:
• Data and signalling messages are carried on physical channels between the different levels of
the physical layer
Physical Channels are divided into two parts:
Downlink Physical Channel:
• PDCCH : Physical Downlink Control Channel
• PDSCH : Physical Downlink Shared Channel
• PBCH : Physical Broadcast Channel
• PMCH : Physical Multicast Channel
• PCFICH : Physical Control Format Indicator Channel
• PHICH : Physical Hybrid ARQ Indicator Channel
Uplink Physical Channel:
• PUCCH : Physical Uplink Control Channel
• PUSCH : Physical Uplink Shared Channel
• PRACH : Physical Random-Access Channel

5. Where these LTE channels work / located?

Ans: At both UE and eNB side:

Logical Channel : Located between MAC Sub-Layer and Upper Layer.
Transport Channel : Located between MAC Sub-layer and Physical Layer.
Physical Channel : Work Over Air Interface / Uu Interface.

6. What are the functionalities of Logical, Transport and Physical Channels in LTE?