GSM / WCDMA Leakage Detection System
Kim Myhrman, Emil Johansson February 28, 2011
Report number: LiTH−ISY-EX−−11/4428−−SE
Examensarbete utf¨ort i Elektroniksystem av Emil Johansson och Kim Myhrman
Division of Electronic Systems Link¨oping University
S-581 83 Link¨oping, Sweden
Link¨opings tekniska h¨ogskola Institutionen f¨or systemteknik 581 83 Link¨oping
Examensarbete utf¨ort i Elektroniksystem vid Link¨opings tekniska h¨ogskola
av
Emil Johansson, Kim Myhrman
LiTH−ISY-EX−−11/4428−−SE
Handledare: Mats ˚Agesj¨o, Sang Yu Examinator: Kent Palmqvist Link¨oping February 28, 2011
whole Ericsson Company. Mainly, the laboratories contain equipment for GSM, WCDMA and LTE. To test these systems, a quite large number of Radio Base Stations are needed. The RBS’s are housed in a proportionately small area. Instead of sending signals through the air, cables are used to transfer the RF signals. In this way the equipment communicating with each other are well specified. However this may not be the case if leakage occur.
This thesis work is about developing a system for monitoring the radio environment and detect leakages in the test site. There is a need to define what a leakage really is and measurements needs to be performed in order to accomplish this. This report describes how the work has proceeded towards the final implemented solution.
1 Introduction 1 2 Theory 3 2.1 Mobile Technologies . . . 3 2.1.1 GSM . . . 3 2.1.1.1 History . . . 3 2.1.1.2 Overview of GSM . . . 5 2.1.2 WCDMA . . . 6 2.1.3 LTE . . . 7 2.2 Environment . . . 8
2.3 Radio waves propagation in free space . . . 8
3 Problem 11 3.1 Requirement Specification . . . 11
3.1.1 Investigation . . . 11
3.1.2 Function of the system . . . 12
3.1.3 Interface . . . 12
3.1.4 Economy . . . 12
3.1.5 Delivery . . . 12
3.2 Restrictions . . . 12
4 Method and Device Evaluation 15 4.1 RF propagation and antenna investigation . . . 15
4.1.1 Equipment . . . 15
4.1.2 Transmitting settings . . . 15
4.1.3 Empty room . . . 17
4.1.3.1 Measurements from the empty room at 1878.8 MHz . . . 17
4.1.3.2 Empty room summary . . . 18
4.1.4 BTS ROOM 3 . . . 19 4.1.4.1 BTS ROOM 3 936.6 MHz . . . 19 4.1.4.1.1 936.6 MHz 1m leakage 1m measure 20 4.1.4.1.2 936.6 MHz 1m leakage 2m measure 21 4.1.4.1.3 BTS ROOM 3 936.6 MHz summary 22 4.1.4.2 BTS ROOM 3 1878.8 MHz . . . 22 4.1.4.2.1 1878.8 MHz 1m leakage 1m measure 23 4.1.4.2.2 1878.8 MHz 1m leakage 2m measure 24 4.1.4.2.3 1878.8 MHz 1m leakage upper right corner . . . 25
4.1.4.2.4 1878.8 MHz 2m leakage upper right corner . . . 26 4.1.4.2.5 1878.8 MHz changed polarization . 27
4.1.5 New BETE floor plan E building measurements . . . . 28
4.1.6 Statistic analysis of measured data . . . 30
4.1.6.1 Calculation of average signal power vs. dis-tance . . . 30
4.1.6.2 Methods used . . . 31
4.1.6.2.1 SPLINE interpolation method . . . 31
4.1.6.2.2 Least Square Method . . . 32
4.1.6.3 Calculations and plots . . . 32
4.1.6.4 Summary . . . 34
4.1.7 Measurements around Radio Base Stations . . . 35
4.1.7.1 GSM 900 MHz band . . . 35
4.1.7.2 GSM 1800 MHz band . . . 35
4.1.7.3 Measurements around radio base stations sum-mary . . . 35
4.1.8 Leakage around connectors and defect cables . . . 36
4.1.9 Leakage around connectors and defect cables . . . 37
4.1.10 Leakage around connectors and defect cables summary 37 4.1.11 Antennas connected to power splitter investigation . . 37
4.1.11.1 Antennas connected to power splitter inves-tigation measurement . . . 37
4.1.12 Bit problems for separated antennas . . . 38
4.1.13 Antennas connected to power splitter investigation sum-mary . . . 39
4.1.14 Leakage interference in a cable . . . 39
4.1.14.1 Measurement of leakage interference in cables 39 4.1.14.2 Leakage interference in a cable summary . . 40
4.1.15 Leakage in patch panel . . . 40
4.1.15.1 Leakage between connectors in patch panel measurements . . . 41
4.1.15.2 Leakage from connectors in patch panel mea-surements . . . 41
4.1.15.3 Leakage from connectors in patch panel mea-surements summery . . . 42
4.1.16 Conclusion for RF propagation and antenna investi-gation . . . 42
4.2 Topologies . . . 43
4.2.1 Topology 1 . . . 43
4.2.1.1 Advantages with topology 1 . . . 43
4.2.1.2 Disadvantages with topology 1 . . . 44
4.2.2 Topology 2 . . . 44
4.2.2.1 Advantages with topology 2 . . . 45
4.2.3.2 Disadvantages with topology 3 . . . 46
4.2.4 Topology 4 . . . 47
4.2.4.1 Advantages with topology 4 . . . 47
4.2.4.2 Disadvantages with topology 4 . . . 47
4.2.5 Topology 5 . . . 48
4.2.5.1 Advantages with topology 5 . . . 48
4.2.5.2 Disadvantages with topology 5 . . . 48
4.3 Devices . . . 49
4.3.1 TEMS investigation . . . 49
4.3.1.1 Description . . . 49
4.3.1.2 Advantages . . . 49
4.3.1.3 Disadvantages . . . 49
4.3.2 Telit EVK2 Evaluation Kit . . . 50
4.3.2.1 Description . . . 50
4.3.2.2 Advantages . . . 50
4.3.2.3 Disadvantages . . . 51
4.3.3 Rohde & Schwarz TSMx devices with ROMES . . . . 52
4.3.3.1 TSMx device description . . . 52
4.3.3.2 Advantages . . . 52
4.3.3.3 Disadvantages . . . 53
4.3.4 Anritsu BTS Master MT8221B device description . . 53
4.3.4.1 Advantages . . . 53
4.3.4.2 Disadvantages . . . 54
4.4 Choice . . . 54
5 Result 55 5.1 Description of the system . . . 55
5.2 Leakage definition . . . 55 5.3 Algorithm . . . 56 5.4 Implementation . . . 59 5.4.1 Hardware . . . 59 5.4.1.0.1 Telit module . . . 59 5.4.1.0.2 Monitor computer . . . 60 5.4.2 Software . . . 61 5.4.2.1 Telit Upload . . . 62 5.4.2.1.1 Initial tasks . . . 62 5.4.2.1.2 Uploading data . . . 63 5.4.2.1.3 Error handling . . . 63
5.4.2.2 Leakage Detection Calculator . . . 63
5.4.2.3 CscannerBETEmonitoring . . . 64
6.2 Leakage test in the middle of a radio room . . . 67
6.3 Generated leakages from a BTS . . . 69
6.4 Handling of a real leakage . . . 69
6.4.1 The leakage . . . 69
6.4.2 Cause to the leakage . . . 70
6.4.3 Improvement after handled leakage . . . 70
6.5 Stability . . . 71
6.6 Fulfilled requirements . . . 72
7 Discussion 75 7.1 Own thoughts . . . 75
7.2 Problems still there . . . 75
7.2.1 Same ARFCN signals . . . 76
7.2.2 Short time leakage . . . 76
7.2.3 Rx signal power . . . 76
7.2.4 Cellid problems . . . 77
7.3 Improvements . . . 77
7.3.1 Ability to detect LTE signals . . . 77
7.3.2 Plots over several days . . . 77
7.3.3 EMF measurements . . . 77 7.3.4 Location of BTS . . . 78 8 Abbreviations 79 References 81 A Measured Values 83 B User Guide 89 B.1 Purpose . . . 89 B.2 System overview . . . 89 B.3 System components . . . 90 B.3.1 Telit Module . . . 90 B.3.2 Monitor computers . . . 92 B.3.3 User computers . . . 95 B.3.4 Server . . . 95
B.3.4.1 Web server with support for PHP and MySQL 96 B.3.4.1.1 Installation . . . 96
B.3.4.2 Leakage Detection Calculation program . . . 97
B.3.4.2.1 A typical session . . . 97
B.3.4.2.2 Code and environment . . . 99
B.3.5.2 Calculated leakage level . . . 101
B.3.6 CscannerBETEmonitoring . . . 102
B.3.6.1 Short about the program . . . 102
B.3.6.2 Running the program . . . 102
B.3.6.3 LogCscannerBETEmonitoring . . . 104
B.3.6.4 Simulation of leakage . . . 104
B.3.7 telit upload . . . 105
B.3.7.1 A typical session . . . 105
B.3.7.2 Code and environment . . . 106
B.3.8 Web page . . . 107 B.3.8.1 Start . . . 107 B.3.8.2 Detected Leakage . . . 109 B.3.8.3 Measured data . . . 109 B.3.8.3.1 Rx level data . . . 110 B.3.8.3.2 ARFCN plots . . . 111 B.3.8.3.3 Real time . . . 112 B.3.8.3.4 SQL search . . . 113 B.3.8.3.5 Guide . . . 114 B.3.8.4 Settings . . . 114 B.3.8.4.1 General . . . 114
B.3.8.4.2 Exceptions for plots . . . 114
B.3.8.4.3 Devices and rooms . . . 115
B.3.8.4.4 Exceptions for leakage . . . 116
B.3.8.4.5 Guide . . . 116
B.3.8.5 Status . . . 117
1 GSM overview . . . 5
2 WCDMA overview . . . 7
3 LTE overview . . . 8
4 Ideal Free Space Signal Power . . . 10
5 Ideal Free Space Signal Power 3D . . . 10
6 GSM 900 Open Band . . . 16
7 Empty Room Signal Power . . . 18
8 BTS Room 3 Floor Plan . . . 19
9 936.6 MHz 1m leakage 1m measure . . . 20 10 936.6 MHz 1m leakage 1m measure 3D . . . 20 11 936.6 MHz 1m leakage 2m measure . . . 21 12 936.6 MHz 1m leakage 2m measure 3D . . . 21 13 1878.8 MHz 1m leakage 1m measure . . . 23 14 1878.8 MHz 1m leakage 1m measure 3D . . . 23 15 1878.8 MHz 1m leakage 2m measure . . . 24 16 1878.8 MHz 1m leakage 2m measure 3D . . . 24
17 1878.8 MHz 1m leakage upper right corner . . . 25
18 1878.8 MHz 1m leakage upper right corner 3D . . . 25
19 1878.8 MHz 2m leakage upper right corner . . . 26
20 1878.8 MHz 2m leakage upper right corner 3D . . . 26
21 1878.8 MHz changed polarization . . . 27
22 1878.8 MHz changed polarization 3D . . . 27
23 New BETE floor plan E building signal power measurement . 29 24 New BETE floor plan E building signal power measurement 2 30 25 SPLINE interpolation . . . 32
26 1878.8 MHz BTS Room 3 (SPLINE and LSM) . . . 33
27 1878.8 MHz New BETE floor plan E (LSM) . . . 34
28 Defect cable . . . 36
29 Patch panel . . . 41
30 Antenna polarization at patch panel . . . 41
31 Topology 1 . . . 43 32 Topology 2 . . . 44 33 Topology 3 . . . 45 34 Topology 4 . . . 47 35 Topology 5 . . . 48 36 Antenna placing . . . 56
37 Calculation of leakage level . . . 57
38 Algorithm . . . 57
39 Overview of the system . . . 59
40 Telit module on Evaluation Kit 2 . . . 60
41 Module installed in Shuttle PC . . . 61
45 Leakage SMS . . . 68
46 Leakage Mail . . . 68
47 Defect Cable . . . 70
48 Leakage report . . . 71
49 System Overview . . . 89
50 Telit module parts . . . 92
51 Module in computer . . . 92
52 Leakage Monitoring System folder . . . 94
53 Program start up . . . 98
54 A typical session for leakage detection calculator . . . 99
55 Antenna used . . . 101
56 Antenna placing . . . 101
57 Cscanner WCDMA . . . 103
58 Cscanner GSM . . . 103
59 Close Cscanner . . . 104
60 Telit upload start . . . 105
61 Telit upload uploading . . . 107
62 Start page . . . 108
63 Detected leakage . . . 109
64 Measured data start page . . . 110
65 Rx level data plot of all signals . . . 111
66 ARFCN plots main page . . . 112
67 Real time data presented . . . 113
68 General settings . . . 114
69 Exceptions for plots . . . 115
70 Devices and rooms . . . 116
71 Exceptions for leakage . . . 116
1
Introduction
This thesis work is about finding RF leakage in the test environment at Ericsson’s test site in Link¨oping. This document describes how the work has proceeded, what has been accomplished and the function of the imple-mented solution. The report is structured in the same way as the work has proceeded.
First a large series of measurements in the site were performed in order to evaluate what a leakage really is, how signals attenuates and what kind of devices to use in order to detect and present potential leakages.
Further on the monitoring system was developed, implemented in the test site and verified to meet the requirements specified by Ericsson.
Finally a discussion about the work and the final solution is found at the end of the report. Suggestions on improvements and further development of the system is also there to be found.
2
Theory
This section serves as an introduction and a description of the environment that the developed system is operating within. The mobile technologies are briefly described and also the laboratory at Ericsson. The issues in the lab, which are the basis for this thesis work, are also described. To make the report easier to understand, due to a lot of abbreviations, a list of frequently used abbreviations is found in Section 8.
2.1 Mobile Technologies
Below a short introduction to the current available mobile technologies are found.
2.1.1 GSM
This section gives a brief description of GSM and how it works. The focus will be on the parts of GSM where the developed system is operating. The information is found in the book GSM boken [5]. The GSM technologies for this thesis are 850/900/1800/1900 MHz.
2.1.1.1 History
The history of GSM started in June 1982 when the Scandinavian operators along with Holland purposed that a group should be put together to develop a common European mobile system in the 900 MHz band. Earlier each country had developed there own system and hardware which was a great restriction according to the mobility since there was no support for roaming. A mobile designed for one specific country could not be used in another country. The European tele- and post public authority (CEPT) therefore approved the project and a group called GSM (Groupe Special Mobile) was formed. Four years later eight different test systems were developed and an evaluation of each of them started. In the spring 1987 the GSM group decided to use a TDMA (Time Domain Multiple Access) system that was specified to work more or less like the test system provided by Ericsson. It is important to know that the specification of GSM does not include any specifications for hardware, it only describes the function of the system and the interfaces between the nodes in the GSM system. The services that should be available when the system started July 1 1991 was specified as GSM Phase 1 and are described further below.
• Telephony - GSM shall provide speech service with 13 kbit/s bitrate. • Emergency calls - Ability for emergency calls even without SIM card. Any operator that has coverage in the area can be used for emergency calls.
• SMS - GSM shall provide SMS (Short Message Service) service. Each message has a length of 160 characters.
• SMS Cell Broadcast - A short message is transmitted to many users at the same time. This can be the name of the city that you are in, the name of the operator and so on. Normally this message shows up in the main window of a cellphone.
• FAX - Ability to send FAX using a cellphone.
• Supplementary Services - Several services such as call forwarding and different types of barring has to be supported.
Later on other abilities have been added in GSM Phase 2 and GSM Phase 2+ but these will not be discussed here. Beside these requirements other fundamental goals for the system were formed. Ability for usage of hand held devices in the system was one of them. The GSM system should also be designed to facilitate cheap hand held devices for the costumers and also a cheaper solution for the operators to build. Further GSM should provide both speech and data transmission, better coverage and also high security. The earlier systems were easy to listen to, change number and escape from payments. All these aspects were later fulfilled by GSM.
2.1.1.2 Overview of GSM
Figure 1 shows an overview of the GSM network. This section gives a short description of each part.
Figure 1: GSM overview
MS (Mobile Station), this is the cellphone plus the SIM card. The cell-phone provide a connection between the GSM network and the SIM card. The SIM card contains information about the user and serves as identifi-cation in the GSM network. When someone makes a call the right user information is located at a SIM card and the call is set up to that cellphone, and the operators then also know who to charge for the call. SOS calls are free of charge and do not require identification in the GSM network, and therefore no SIM is needed.
BTS (Base Transceiver Station), this part of the system consists of an antenna, mast and transceivers (TRX). The main task for an BTS is to maintain radio contact with the MS’s. The area that provides coverage from one BTS is called a cell, see Figure 1. Since BTS’s are expensive several di-rectional antennas are placed in the intersection of several cells. The BTS is also called RBS (Radio Base Station) which is the same thing in the GSM system.
BSC (Base Station Controller), this device is used to control several BTS’s. A BSC handles handover’s when MS moves from one cell to an-other, if the cells are controlled by the same BSC. If a MS moves into a cell controlled by another BSC a unit called MSC handles the handover between the BSC’s. The BSC also handles speech coding.
MSC (Mobile services Switching Centre), this device handles switch-ing of calls. Let us assume that a cellphone makes a call to another cellphone in another cell. The speech will then be received in the BTS and transferred to the BSC that encodes the speech from 13 kbit/s to 64 kbit/s and then transfer the data to the MSC. Here the MSC reconnects the call to the right BSC that controls the BTS which serve the cell containing the other cellphone. MSC also contains a database called VLR (Visitor Location Reg-ister) which contains information of all cellphones that successfully have log in within the area served by the MSC. If a new cellphone connects to a cell within this area the MSC first controls if the cellphone is stored in the VLR database. If this is not the case the MSC tries to get the information about the subscriber from the HLR (Home Location Register) database. This database contains information of all subscribers belonging to the operators network.
2.1.2 WCDMA
WCDMA (Wideband Code Division Multiple Access) is the air interface for the third generation mobile technology. This was decided by the European standardisation ETSI in 1998 [14]. The technology was developed to support higher data rates than the previous technologies. With the High Speed Packet Access (HSPA) technology the user data rate becomes 14 Mbit/s [15]. Figure 2 shows the Radio Access Network for the system [13]. Below the figure is a short description of the different parts. The WCDMA technologies for this thesis are 850/1900/2100 MHz.
Figure 2: WCDMA overview
MSC (Mobile services Switching Centre), handles traffic control, roam-ing, call routing and handover.
RNC (Radio Network Controller), controls the RBS. An RNC can control several RBS’s.
RBS (Radio Base Station), communicates with the Mobile terminals through the Air interface.
UE (User Equipment), mobile phones or similar equipment using for example wireless internet.
2.1.3 LTE
The number of users of mobile broadband is constantly increasing and also the need for higher speed. LTE (Long Term Evolution) is the technology that is going to provide just that. The first LTE based networks were imple-mented in 2009. The architecture is simplified and optimized compared to the GSM and WCDMA architectures. For LTE a packet switched domain is used and a simplified topology is shown in Figure 3 [12].
The eNB handles the radio transmission and reception from the UE (User Equipment). Each eNB serve one or several cells. The neighbouring eNB are also connected together. This way the eNB can handle handover when a UE travels from one cell to another. LTE also has a common anchor point and gateway to for instance access the outer world.
Figure 3: LTE overview
2.2 Environment
Ericsson in Link¨oping houses one of the largest test laboratories within the whole Ericsson Company. Mainly, the laboratories contain equipment for GSM, WCDMA and LTE. To test these systems, a quite large number of Radio Base Stations are needed. The RBS’s are housed in a proportionately small area. Instead of sending signals through the air, cables are used to transfer the RF signals. In this way the equipment communicating with each other are well specified. However this may not be the case if leakage occur. Interference from leaking RBS’s may cause problems in the testing activities. If a signal show up in the air in the laboratory, with an unusual high signal power, the possibility that a leakage has occur and that the testing is disturbed is then high. By decoding information from the signals the source of the leakage can be found and taken care of. In GSM, for example, a broadcast control channel (BCCH) is constantly transmitting information that can be traced down to the transmitting RBS. The BCCH channel contains information such as Mobile Country Code (MCC), Mobile Network Code (MNC), Location Area Code (LAC), Base Station Identity Code (BSIC) and Cell Identity (CI or CELLID).
2.3 Radio waves propagation in free space
This section describes how radio waves propagate in an free space envi-ronment. Below some calculations are made to investigate what should be the case if the room described in Section 4.1.3.1 were an ideal environment without any reflections, or more correct, how the signal propagate and what signal levels a spectrum analyser would show. First let us take a look at the power density. Formula 1 show how the power density is calculated when
an isotropic transmitter is used [3].
Sr = Power spectral density at the receiver.
Pt = Output power from the transmitter.
Sr=
Pt
4πr2 (1)
At the receiver at a distance r from the transmitter the received power can be expressed as in Formula 2 below.
Am = Effective Area for the antenna
Pr = Received power
Pr = SrAm =
PtAm
4πr2 (2)
By knowing the gain (G) for the antenna and the wavelength (λ) of the signal this can be calculated. Formula 3 shows how.
Am=
λ2G
4π where λ = c
f (3)
Below in Figure 4 and Figure 5 it is shown how the signal will propagate in an ideal free space for the same area that was measured in an empty room, see Section 4.1.3.1. Figure 4 is a 2D figure of the room seen from above and Figure 5 is a 3D figures of the room seen from the side. In the figure the signal power drops 5 dB for each colour. In the middle, where the signal level is the highest, it is -10 dBm. The values used can be found in APPENDIX A.
Figure 4: Ideal Free Space Signal Power
3
Problem
To prevent the kind of problems described in Section 2 a monitoring sys-tem is inquired by Ericsson to monitor the radio environment and detect potential leakages.
3.1 Requirement Specification
The requirement specification describes what should be accomplished during the thesis work. It specifies Ericsson’s requirements for the final product. In this document two different requirement levels are used. The first level (LEV1) has the highest priority and needs to be accomplished by the end of the thesis work. The second level (LEV2) has a lower priority and will be focused on if time is available. Different kinds of requirements are presented in the sections below. All requirements are marked with a level according to priority.
3.1.1 Investigation
Requirement 1
Investigate where to place anten-nas to collect data for GSM and WCDMA.
LEV1 Requirement 2 Investigate where to place antennas
to collect data for LTE. LEV2 Requirement 3 Investigate a suitable platform as a
base for the system. LEV1
Requirement 4 Investigate technical solutions for
3.1.2 Function of the system
Requirement 5 Detect GSM 850/900/1800/1900
MHz leakage LEV1
Requirement 6 Detect WCDMA 850/1900/2100
MHz leakage LEV1
Requirement 7 Detect LTE leakage LEV2 Requirement 8 Ability to check several
measure-ment stations from one location. LEV2 Requirement 9
Alert the responsible persons for the radio environment via email / SMS when a leaking RBS is detected.
LEV1
3.1.3 Interface
Requirement 10 Simple graphical user friendly
inter-face of relevant information LEV1 Requirement 11
Graphical interface that is easy to expand for new technologies in the future.
LEV1
3.1.4 Economy
Requirement 12 The cost for the system should be
considered. LEV1
3.1.5 Delivery
Requirement 13 The system should be delivered by
the end of week 50 2010. LEV1 Requirement 14
A written report about the project along with oral presentations shall be presented by the end of week 5.
LEV1
3.2 Restrictions
At the beginning of the project a vague description and requirement speci-fication was provided by Ericsson. This was further developed and specified through a discussion with the supervisors (see Section 3.1). However, no
absolute restrictions were declared initially according to hardware and tech-nology’s supported for the system. Worth to mention here is Requirement 7 which has priority level LEV2. This is because only a few devices ex-ists at the market since LTE is a relatively new technology. However, it is preferable to monitor this type of signals too. The actual restrictions were set when a suitable platform and hardware were chosen (see Section 4.4). Actually only one restriction according to the requirements has been made due to the choice of devices, and that was support for the LTE technology which was excluded. The main factor for this restriction was the lack of affordable devices on the market for this kind of system.
4
Method and Device Evaluation
This part serves as an evaluation of different technologies that had potential to meet the requirements specified in section 3.1. The measurements and conclusions in Section 4.1 are also taken in consideration for this evaluation. In Section 4.4 you can find the final decision for which device to use to fullfill the requirements.
4.1 RF propagation and antenna investigation
One important thing to do was to investigate how signals propagate in the laboratory and what a good placement of antennas might be. To get a clear picture of the loss variations of RF signals, measurements were needed at different locations in the laboratory. The results were of good help when planning the positions of the antennas that was used for the final product. As a restriction the measurements are performed only at GSM 900 MHz and GSM 1800 MHz and it is assumed that the loss for GSM 850/1900 MHz and WCDMA signals (850/1900/2100 MHz) behaves more or less like GSM 900/1800 MHz signals. Several different investigations have been made. Selected measurement data are included in this section and the rest is to be found in Appendix A.
4.1.1 Equipment
To evaluate the loss of the signals a well defined test signal is needed. This signal was created using a signal generator [Agilent E4433B] that has the ability to send GSM signals at different frequencies. The signal is transmit-ted into the air by using an antenna called [Kathrein 80010431] which has the gain 2 dBi (dBisotropic). This antenna is an omnidirectional antenna. For detection and measurements of the signal power a spectrum analyser [FSH 6 Spectrum Analyser 100 kHz. . . 6 GHz] was used. This one was connected to the same type of antenna that was transmitting.
4.1.2 Transmitting settings
It is very important not to interfere with existing GSM signals. Ericsson has licence to transmit at the nine highest ARFCN channels (877 - 885) for the 1800 MHz band. Some of them are in use so therefore you can not transmit anything on these channels. To investigate what channels to transmit on without interfere with existing channels the BTS’s that are used for transmitting live signals into the air was determined. By looking into the BSC the ARFCN channel 880 (Up link: 1783.8 MHz, Down link: 1878.8 MHz [1]) was determined as not in use, so this channel was used to transmit the test signal on. For GSM 900 a frequency band without any GSM signals was located using a spectrum analyser. Figure 6 verifies that no other signals
exist between 936 – 939 MHz. Because the test is supposed to investigate the signals we might detect as leakage later on we choose to send the test signal at 936.6 MHz (ARFCN 8) when investigating the 900 band. When sending the test signals 10 dBm (10 mW) will be used as output power from the signal generator to the antenna. As a reference a mobile send out at about 2 W [2] (33 dBm) when it receives a relatively low signal from the BTS. According to the description of GSM a cell phone shall be able to detect a signal as week as -102 dBm [6].
4.1.3 Empty room
Measurements to see how the RF waves propagate in an empty room were done by placing a transmitter in the center of an empty room and then measure the power at different locations in the room. The reason for doing this measurement was to get an idea about how the signals behaves and later on be able to compare these results with measurements in a more urban area, and also in an ideal environment (free space), see Section 2.3.
4.1.3.1 Measurements from the empty room at 1878.8 MHz This measurement was performed in an empty room. As described above a transmitter was placed in the center of the room. Figure 7 shows how the signal decreases as we move away from the transmitter. In the figure the signal power drops 5 dB for each colour. In the middle, where the signal level is the highest, equal to -10 dBm. The signal generator is set to send out 10 dBm at a frequency of 1878.8 MHz. This means that there is a 20 dB loss through all the cables and from one antenna to the other. In this measurement an assumption is made; that the measured values in the second quarter of the room will be more or less the same as in the first quarter and so on. Therefore only one quarter was measured carefully. Remember that the reason for doing the measurement was to get a rough idea about how the signals propagate. The area for one quarter is 2.4x2.4m which makes the room 4.8x4.8m wide.
Figure 7: Empty Room Signal Power 4.1.3.2 Empty room summary
The first thing to conclude from the information given in Section 4.1.3.1 and 2.3 is that the two measurements are quite similar. The power received by the antenna decrease in both cases with a factor close to 1/r2. Observed is also that the ideal free space measurement tends to decrease more than the open room measurements. This can be explained by the fact that there are reflections from the walls, roof and floor in the empty room.
4.1.4 BTS ROOM 3
BTS ROOM 3 (BA4131) is a laboratory that represents a typical laboratory quite well. It contains rows of cabinets with RBS’s and several posts with small RBS’s. The laboratory also contains low cabinets with RBS’s. Figure 8 shows a drawing of the room. Every square is 0.60m x 0.60m. The room is therefore 6.6m x 10.2m. In the upper right corner and the lower left corner the room contains projecting walls. The signal generator that was simulating the leakage was placed at two different places. One was in the upper right corner and the other was in the middle of the room. The effect of shifting the polarization on the source antenna was also measured. In the figures shown in this section the signal level drops 10 dB for each darker colour.
Figure 8: BTS Room 3 Floor Plan 4.1.4.1 BTS ROOM 3 936.6 MHz
Two different measurements were performed to see the spreading of the signal level at the GSM 900 band. The first one was leakage at the height of 1m above the floor and the signal measured 1m above the floor. The second measurement was leakage at the height of 1m above the floor and signal power measured 2m above the floor.
4.1.4.1.1 936.6 MHz 1m leakage 1m measure
Figure 9 below shows the spreading of the signal when a potential leakage occurs 1m above the floor and in the middle of the room. The measure-ments are performed 1m above the floor. The most yellow colour represents the signal level -20 dBm. Figure 10 shows a 3D view to demonstrate the spreading more clearly. Since the signal power inside the cabinets and the wall can not be measured these values are set to -90 dBm which is fictitious value since no measurements can be performed there.
Figure 9: 936.6 MHz 1m leakage 1m measure
4.1.4.1.2 936.6 MHz 1m leakage 2m measure
Figure 11 below shows the spreading of the signal when a potential leakage occurs 1m above the floor and in the middle of the room. The most yellow colour represents the signal level -20 dBm. The measurements are performed 2m above the floor. Figure 12 shows a 3D view to demonstrate the spreading more clearly.
Figure 11: 936.6 MHz 1m leakage 2m measure
4.1.4.1.3 BTS ROOM 3 936.6 MHz summary
The measurements at 1m level above the floor shows that the signal has big difficulties reaching down between cabinets. This could be seen by looking between the three cabinet sections in the lower part of Figure 9. The mea-surements at 1m level also show that the cabinets have an attenuating effect on the signal. This could be verified by looking behind the two cabinet sec-tions down to the right (view from the source) and also behind the cabinet that is alone to the right of the source. At these places the signal attenuates 10 dB or more than the signal at the same distance from the source. The measurements done at 2m level above the floor shows that the signal has a better chance of spreading on this height to the whole room. This could be verified by looking on the big areas of -40 and -50 dBm in Figure 11. In comparison to Figure 9, Figure 11 shows less level shifts of the measured power. This is probably due to the fact that the air is fairly open and free except from some cables.
4.1.4.2 BTS ROOM 3 1878.8 MHz
Five different measurements were performed to see the spreading of the signal level at the GSM 1800 band. The first one was leakage 1m above the floor and signal power measured 1m above the floor. The second was leakage 1m above the floor and measured 2m above the floor. The two first had the source placed in the middle of the room. The third was leakage 1m above the floor and measured 1m above the floor but with the source moved to the upper right corner of the room. This was done to see the effect of a little longer distance. The fourth was leakage 2m above the floor and measure 1m above the floor. Also this one had the source placed in the upper right corner of the room. This was done to see the spreading of the signal if leakages occur high up on the cabinets where many RBS’s have there connectors to the feeders (cables to antenna). The fifth and last one was leakage 1m above the floor in the middle of the room and measure 1m above the floor but with a different polarization of the antenna. The polarization is changed by flipping the antenna 90 degrees.
4.1.4.2.1 1878.8 MHz 1m leakage 1m measure
Figure 13 below shows the spreading of the signal when a potential leakage occurs 1m above the floor and in the middle of the room. The most yellow colour represents the signal level -0 dBm. The measurements are done 1m above the floor. Figure 14 shows a 3D view to demonstrate the spreading more clearly. Since the power inside the cabinets and the wall can’t be measured these values are set to -90 dBm.
Figure 13: 1878.8 MHz 1m leakage 1m measure
4.1.4.2.2 1878.8 MHz 1m leakage 2m measure
Figure 15 below shows the spreading of the signal when a potential leakage occurs 1m above the floor and in the middle of the room. The most yellow colour represents the signal level -0 dBm. The measurements were performed 2m above the floor. Figure 16 shows a 3D view to demonstrate the spreading more clearly.
Figure 15: 1878.8 MHz 1m leakage 2m measure
4.1.4.2.3 1878.8 MHz 1m leakage upper right corner
Figure 17 below shows the spreading of the signal when a potential leakage occurs 1m above the floor and from the upper right corner of the room. The most yellow colour represents the signal level -0 dBm. The measurements were performed 1m above the floor. Figure 18 shows a 3D view to demon-strate the spreading more clearly. Since the power inside the cabinets and the wall can’t be measured these values are set to -90 dBm.
Figure 17: 1878.8 MHz 1m leakage upper right corner
4.1.4.2.4 1878.8 MHz 2m leakage upper right corner
Figure 19 below shows the spreading of the signal when a potential leakage occurs 2m above the floor and in the middle of the room. The most yellow colour represents the signal level -0 dBm. The measurements are done 1m above the floor. Figure 20 shows a 3D view to demonstrate the spreading more clearly. Since the power inside the cabinets and the wall can’t be measured these values are set to -90 dBm.
Figure 19: 1878.8 MHz 2m leakage upper right corner
4.1.4.2.5 1878.8 MHz changed polarization
Figure 21 below shows the spreading of the signal when a potential leakage occurs 1m above the floor and in the middle of the room. The most yellow colour represents the signal level -20 dBm. This is nearly the same settings as in Section 15 except from the polarization of the antenna. The measure-ments were performed 2m above the floor. Figure 22 shows a 3D view to demonstrate the spreading more clearly. Since the power inside the cabinets and the wall can not be measured these values are set to -90 dBm.
Figure 21: 1878.8 MHz changed polarization
4.1.4.2.6 1878.8 MHz summary
Figure 13 shows that the signal is attenuated by all the RBS’s in the room. This could be seen when for example looking behind the row with cabinets down in the right corner (seen from the source). The figure also shows that the signal has difficulties reaching down between the cabinets. These two facts can also be verified by looking at Figure 17. When measuring at 2m height from the floor, as seen in Figure 15, the signal level is higher than the one measured at 1m height. When the signal is transmitted from 2m Figure 19 shows that the spreading of the signal is almost the same as if the signal would have been sent out at 1m. If the measurements also would have been at 2m height from the floor the signal level most probably would have been higher. By comparing Figure 21 with the changed polarization and Figure 15 there is a very little difference between the signal levels on the lower and upper part of the figures. There the signal levels are around -30 to -40 dBm. The big difference is in the middle of the figures from left to the right. That’s because the height difference had no impact when shifting the polarization. The antenna then had ”free” sight to the transmitting antenna in the direction where the transmitting antenna had its gain. No conclusion that polarization in one direction is better than the other can be drawn from this, and will therefore not be taken into consideration when placing the antennas.
4.1.4.3 BTS ROOM 3 summary
By comparing Figure 11 with Figure 15 it seems like signals on the GSM 1800 band spreads a little bit better in a room compared with 900 signals. Therefore the hardest thing might be to detect leakage at the GSM 900 band. For the GSM 900 band we see that the signal can drop 40 dB in just 5 m. In Section 4.1.6.1 this is investigated in a more mathematical way to see if there really is a difference between signals in the GSM 900 and 1800 band. Since the signal has trouble reaching down between the cabinets the best thing will be to place antennas as open as possible at high level in the middle between the cabinets. Since the spreading of the signal is much better above the cabinets the best thing will be to place the antennas high up. Also just by looking at the measured values the signal level is low on some places even though you might not expect that. This can be an effect of interfering reflections due to cancellation and just to place one antenna in a room will be risky. Two or more antennas depending on the environment will have a better chance of finding the potential leakage.
4.1.5 New BETE floor plan E building measurements
Ericsson is building a new test environment and that is where the detec-tion system will be placed. For this reason measurements on how signals propagate in this area were performed. The transmitter was placed in room
EE1005 (see Figure 11 below) and the signal generator was set to send out 14 dBm at 1878.8 MHz. EE1005 was chosen because that room will contain RBS’s and that is one of the rooms were signal leakage might occur. The slightly increased signal power is used to make the detection easier at longer distances.
Figure 23: New BETE floor plan E building signal power measurement
From Figure 23 we can see that the walls decrease the signal power and that open doors make it easier for the signal to propagate. Some of the rooms are supposed to be RF shielded but as you can see a GSM signal can still be detected far from the source even though the output power transmitted to the air is relatively low.
Another measurement was performed for the new laboratory in the end of the thesis work to evaluate if there were any significant differences for the signal propagation when for example all doors were in place. Figure 24 shows a picture describing the loss. What can been seen is that the room in the left upper corner now is better RF shielded and that the doors cause a bigger loss between the rooms.
Figure 24: New BETE floor plan E building signal power measurement 2
4.1.6 Statistic analysis of measured data
In order to describe what is happening with a signal propagating in the laboratory some calculations have been made. The results will later on be used for a more accurate detection of leakage and give the ability to calculate the loss of a possible leakage. All data is taken from previous measurements and the data can be found in Appendix A.
4.1.6.1 Calculation of average signal power vs. distance
The measurements done in previous section contain a lot of information about how the signal attenuates when the distance from the source increases. Three different interesting datasets where chosen for evaluation. Two of them were from BTS ROOM 3 and the third was from the New BETE floor plan E building. Since the summery from BTS ROOM 3 (see Section 4.1.4.3) showed that the antennas should be placed high up, the measurements from Section 4.1.4.1.2 and 4.1.4.2.2 where chosen. These where also interesting because of the need for further investigation about the difference in spreading between signals in the GSM 900 and GSM 1800 band. The last dataset was from New BETE floor plan E building and was chosen because of the long distance between the measuring points and that walls were involved. The
two different environments where chosen to see how the signal attenuate in a smaller room and also at bigger distances and environments. By calculating the distance from every measuring point, except from those who are set to – 90 dBm and saving both the distance and the signal power, a vector with the values were created. Since most of the distances occur more than once the number of times that each distance showed up was saved and the signal power was added to the previous. By using this information the mean value was created and saved for each distance. The mean value was chosen because it is an unbiased estimator of the signal power. Using dBm instead of Watts when calculating the mean value gives a more correct estimation of the signal power. This is because the big difference in signal power that would have been if they were expressed in Watts.
4.1.6.2 Methods used
The data calculated in Section 4.1.6.1 is used to analyze how the signal is attenuating at a certain distance from the source. This is done using two different methods, the LSM (Least Square Method) and the SPLINE interpolation method. Both of them estimate a function for how the signal is attenuating. In the sections below the methods are described briefly and the results can be found in Section 4.1.6.4.
4.1.6.2.1 SPLINE interpolation method
SPLINE interpolation is a method to interpolate certain discrete values with a polynomial function, or in fact several polynomial functions defined at a specific section. Several polynomial functions are used because a single in-terpolation polynomial with a high order tends to oscillate and the obtained function will therefore provide a useless function for describing the measured values. If an interpolation polynomial with a lower order is used instead to describe a small intersection and further several of these functions are used to describe all intersections a better approximation will be provided. In Figure 25 you can see a cubic SPLINE function that interpolates the mean values for the loss at a certain distance from the RF source. The data are taken from the measurements performed at BTS Room 3.
Figure 25: SPLINE interpolation
There are several types of SPLINE functions of different orders. SPLINE functions with order one approximate the function between two measured points with straight lines between them.
The SPLINE function plotted in Figure 25 has an order of two and is there-fore smoother than straight lines would have been. In this case functions of order two will provide a more correct function for describing the loss of RF signals and therefore this order of SPLINE curves are used later on.
4.1.6.2.2 Least Square Method
Another way of creating an estimated function using different values are by using the Least Square Method. In this method a function is decided to have certain parameters and then the fault between the function and the values is minimized by changing the parameters. The measurements showed that a linear function of type shown in Formula 4, where c(1) and c(2) are the unknown parameters, worked as a good approximation. This is after the x values have been logarithmic to the type of log10(distance).
y = c(1) · x + c(2) (4)
4.1.6.3 Calculations and plots
The results from the calculations done in Matlab are summarized in Table 1 below. Figure 26 shows an example for how the mean value, SPLINE curve
and the LSM curve behaves for measured values in BTS Room 3. Figure 27 shows how the LSM function behaves for the new BETE floor plan E. For both figures the cross shows all the measured values, the circles the mean value and the straight line the LSM approximation. On the first figure the curve is the SPLINE function.
Figure 27: 1878.8 MHz New BETE floor plan E (LSM)
Calculation Function
BTS Room 3, 1878.8 MHz 1m leakage 2m measure y= -16.30x -29.16 BTS Room 3, 936.6 MHz 1m leakage 2m measure y= -16.92x -36.43 New BETE floor plan E, 1878.8 MHz y= -56.74x + 10.94
Table 1: Calculated functions 4.1.6.4 Summary
The two methods described above describe the loss in two different ways. The SPLINE function interpolates all measured values. The LSM method however provides a rough estimation of the loss and provides the best straight line describing the measured values. When using the SPLINE functions a more accurate value for the loss is provided at a certain point; however the LSM provides a mean value for how the signal is attenuating when moving away from the source. Since the loss tends to vary from one room to another a mean value seems more fair. Another good thing with the LSM method is that the result is simple and easy to use to get a rough estimation and since a relatively large amount of data will be processed and analysed a simple method is preferable to reduce the computation needed. According to sec-tion 4.1.6.2.2 it seems fair to estimate the loss with a straight line and the estimation will be good enough for the purpose of which the function will be used for. The LSM functions shown in Table 1 describes a leakage with
specific signal power and for further calculations only the loss parameter in the function is of interest. It is shown that all signals in BTS room 3 with different frequencies attenuate more or less in the same way for all signal powers. This loss is about -17 dB / decade which is shown in Table 1. This is approximately 1/r2 which gives -20 dB / decade. For bigger distances, or in fact between RBS rooms, the loss is about -56 dB / decade.
4.1.7 Measurements around Radio Base Stations
In order to determine the positions of the antennas it is very important to know how much signal power a RBS sends out even though everything is cor-rectly connected. This could be leakage from cables and connectors or just the RBS itself. To be able to compare the power values with the previous measurements in the BTS room 3, measurements have been done as close as possible to the RBS’s where the signal has been found strongest. Mea-surements have also been made 0.60m away from the RBS’s to get an even clearer picture of the leakage. The distance 0.60m makes the comparison with previous measurements easier.
4.1.7.1 GSM 900 MHz band
A small investigation on BTS 227 and BTS 107 to determine what frequen-cies and output power they were using was made. BTS 227 is of RBS 2308 type and BTS 107 is of RBS 2206 type. Table 2 shows different values for the RBS’s and also the result of the measurements that was made.
BTS ARFCN Frequency Output power Close leakage 60 cm leakage
107 17 938.4 39 dBm -37 dBm -52 dBm
227 44 943.8 33 dBm -62 dBm -80 dBm
Table 2: Measurements around GSM 900 MHz BTS’s 4.1.7.2 GSM 1800 MHz band
A small investigation on BTS 258 was also performed. BTS 258 is of RBS 2308 type which is the same as BTS 227. Table 3 shows different values for the RBS’s and also the result of the measurements that was made.
BTS ARFCN Frequency Output power Close leakage 60 cm leakage
258 535 1809.8 33 dBm -53 dBm -60 dBm
Table 3: Measurements around GSM 1800 MHz BTS’s 4.1.7.3 Measurements around radio base stations summary The leakage was found strongest around the connectors. Leakages were measured even though all connectors were properly connected. The signal power that was discovered reached a significant high level from a leakage
point of view, and higher values are to be expected when real leakages occur (see Section 4.1.9).
4.1.8 Leakage around connectors and defect cables
To see how much leakage a badly attached connector or an defect cable (see Figure 28), might transmit a small test was performed. A typically GSM signal was transmitted from a signal generator through a cable to a device with 50 Ohm input impedance and the leakage around it was measured. To be able to compare the power values with the previous measurements in the BTS room 3, measurements have been done as close as possible to the connectors and defect cables where the signal has been found strongest. Measurements have also been performed 0.60m away from the connectors and defect cables to get an even clearer picture of the leakage. The distance 0.60m makes the comparison with previous measurements easier.
4.1.9 Leakage around connectors and defect cables Table 4 below shows the measured data.
Measurement Frequency/ ARFCN Output Power Leakage close to connector/ injury 60 cm leak-age Correct con-nected connec-tor, no injury to cable 936.6 MHz/ ARFCN 8 14 dBm Less then -75 dBm Less then -75 dBm Loosely con-nected connec-tor, no injury to cable 936.6 MHz/ ARFCN 8 14 dBm -20 dBm - 40 dBm Correct con-nected con-nector, defect cable 936.6 MHz/ ARFCN 8 14 dBm -17 dBm - 42 dBm Correct con-nected connec-tor, no injury to cable 1878.8 MHz/ ARFCN 880 14 dBm Less then -75 dBm Less then -75 dBm Loosely con-nected connec-tor, no injury to cable 1878.8 MHz/ ARFCN 880 14 dBm - 35 dBm - 50 dBm
Table 4: connectors and defect cables measurements
4.1.10 Leakage around connectors and defect cables summary As shown in Table 4 a badly connected connector or an defect cable can cause a leakage of around -35 dBm less then the output power. In the laboratory environment the BTS 107 has an output power of 39 dBm. This means that the power transmitted out as leakage from a badly connected connector could be around 0 dBm.
4.1.11 Antennas connected to power splitter investigation In order to reduce the number of measurement devices a small investigation about antennas connected to a power splitter has been made. The splitter used for the measurement is a MICROLAB/FXR model: no D2-69FM. 4.1.11.1 Antennas connected to power splitter investigation mea-surement
transmitting source. The antennas were then connected to a power splitter and into a spectrum analyser. The transmitting antenna was then moved closer to one of the receiving antennas. The signal power was then mea-sured for each antenna and also both antennas connected at the same time through the splitter. A 10 dBm GSM signal was sent from the signal gen-erator to the antenna and the frequency was 936.6 MHz. Table 5 shows the measured values. The loss for the power splitter was also measured for different frequencies. A GSM signal was applied to one of the inputs, and the other input was terminated with 50 Ohm. Table 6 shows the measured values. Measurement Signal power Both anten-nas Signal power Antenna 1 Signal power Antenna 2 Both antennas
far from source - 25 dBm - 23 dBm - 35 dBm Source
antenna close to Antenna 1
- 17 dBm - 16 dBm - 37 dBm
Table 5: Antennas connected to power splitter measured values
Frequency Signal power into splitter
Signal power out
from splitter
Loss for the power split-ter
936.6 MHz 5.2 dBm 9.0 dBm 3.8 dB
1878.8 MHz 5.1 dBm 9.2 dBm 4.1 dB
Table 6: Power splitter loss 4.1.12 Bit problems for separated antennas
With separated antennas the same signal will be detected at different times by different antennas. If the difference is too big a bit error will occur when decoding the signal measured at the output of the power splitter. The calculations below shows the minimum separation distance between the antennas that will cause a bit error. The factor 1/2 in the formula describes the fact that the signal, in the worst case, needs to go the distance twice, once in the air and once in the cable. Table 7 shows the maximum separation distance for different technologies and equation 5 the calculation.
SD = C 2BR (5) Where SD = Separation distance C = Speed of light BR = Bit rate
Technology Bit rate SD
GSM 271 kbit/s [4] 554 m WCDMA 3.84 Mcps [13] 39 m
LTE 300 Mbit/s [11] 0.5 m
Table 7: Separation distance for different technologies
4.1.13 Antennas connected to power splitter investigation sum-mary
If a power splitter is used and the same signal is detected by all antennas the signal power from the antenna that picks up the strongest value will be approximately the same value that is measured at the output of the splitter. A two way power splitter causes a loss of about 4 dB of the signal power which might be a problem if several splitters are used. The separation distance is probably not a problem for GSM. Since the rooms are quite big in the E building laboratory the separation distance might be a problem for WCDMA signals and definitely a problem for LTE signals.
4.1.14 Leakage interference in a cable
Equipment in the laboratory can be disturbed if leakage from the RBS is picked up in the neighboring cables. For instance a cell phone can lock at the wrong RBS if that signal is stronger. A small investigation has been performed in order to determine the risk for this to occur.
4.1.14.1 Measurement of leakage interference in cables
A disturbing GSM signal was sent out using a signal generator connected to an antenna. The output power from the signal generator to the antenna was 14 dBm. The measured signal power close to the antenna was 6 dBm and can be seen as a leakage of 6 dBm. A cable was then connected to a spectrum analyzer and the signal power was measured for the interfering signal picked up by the cable. The cable used was a Rosenberger RTK 043 and it was terminated with 50 Ohm. Table 8 below shows the measured values.
Distance to interfering source Interfering Signal Power measured
1 cm - 70 dBm
20 cm - 118 dBm
60 cm Not measurable
Table 8: Measurement results of leakage interference in cables
These measurements were done with a correct connected cable. Unfortu-nately this is not always the case. By detaching the connector on the spec-trum analyser a little the signal power reached as much as -20 dBm when the interfering source was placed close to the cable. This is probably not only leakage between cables, but also a combination of the connector becoming an antenna and standing waves in the cable.
4.1.14.2 Leakage interference in a cable summary
As seen in Section 4.1.9 a loosely connected connector gives the highest leakage. The distance between a cable from another BTS to the connector can be around 20 cm. Therefore it is possible that a leakage occur as close as 20 cm from a sensitive cable. As mentioned in Section 4.1.14 a mobile connected to this cable can pick up the signal and in the worse case connect to the wrong RBS. Since the signal power is -118 dBm it is not very plausible when the cable is properly connected. However if this is not the case the signal power can reach much higher levels and a mobile will definitely be able to connect to the wrong RBS due to leakage. Therefore it is very important to connect the cables properly.
4.1.15 Leakage in patch panel
The lab environment at Ericsson contains several patch panels to distribute the RF signals to different equipment in different rooms. An investigation has been made to see how much leakage a patch panel may cause. Two different measurements were done on the type of patch panel that is going to be used in the lab in E building. This patch panel consists of TNC connectors (female-female) separated 27 mm from each other (distance between inner conductors). See Figure 29. The first measurement was to see if there was any chance that a signal could propagate from one connector to another. The second was to see how much leakage a connector that is not terminated can cause and also the effect of terminating the connector. For all measurements a GSM 1878.8 MHz signal with the signal power of 14 dBm was used.
Figure 29: Patch panel
4.1.15.1 Leakage between connectors in patch panel measure-ments
When applying the GSM signal on connector 1, leaving that one open, and measure on connector 2 no signal could be detected by the signal generator. Even when terminating the connectors in different combinations no signal could be detected on connector 2.
4.1.15.2 Leakage from connectors in patch panel measurements Figure 30 shows how the antenna was placed to find the strongest leakage. Table 9 shows the measured values at different distances.
Figure 30: Antenna polarization at patch panel
Output power Distance Signal power (leakage) 14 dBm As close as possible - 40 dBm 14 dBm Connector terminated As close as possible - 63 dBm 14 dBm 60 cm - 71 dBm 14 dBm 180 cm - 79 dBm
4.1.15.3 Leakage from connectors in patch panel measurements summery
Table 9 shows that it is important to put termination on all connectors on the patch panel. The termination lowers the signal level with 23 dB. What also can be seen is that leakage from connectors in patch panels can reach quite high levels but the signals will not propagate to connectors nearby. 4.1.16 Conclusion for RF propagation and antenna investigation RF signals tends to decrease in the same way for frequencies between 900 MHz to 2100Mhz. Therefore it is no need to separate any calculations depending on frequencies and not either place antennas different when mea-suring different frequencies. The antennas can not be separated too long because of the risk for bit errors, especially for LTE signals. Since the sys-tem is supposed to be flexible and have ability for handling LTE in the future, interconnection between antennas is not an option. However several antennas are needed in order to be able to detect and identify leakage. The minimum number of measurement points in the radio rooms is two to accom-plish this, otherwise no calculations can be performed to analyse whether a measured value is leakage or not. The plots show that it is significant better to place the antennas high up above the cabinets. Further on there is no need to consider the polarization of the antennas since there is no significant difference in signal power when measuring signals in the radio room with different polarization on the antennas. In order to prevent leakage that can be detected outside Ericsson measurements close to the patch panels is to be considered. The measurements and the fact that a directional antenna causes a gain of about 10 dB a level of -120 dBm at the outer walls will serve as a good limit to prevent detection of leakage outside Ericsson’s facilities. This is by assuming that a cellphone can detect a signal with a signal power of -106 dBm [6]. The shortest distance from the new Radio rooms are about 22 meters to the outer walls. Therefore a limit for the signal power caused by leakage can be calculated using the LSM equation for long distance to -50 dBm 1 meter from the source. A higher level on the leakage can be detected outside Ericsson and are therefore classified as leakage in the radio rooms. For leakage calculations inside the radio rooms the LSM equation for short distance will be used.
4.2 Topologies
Different kinds of topologies have been evaluated for the detection system. This chapter describes the advantages and disadvantages with these topolo-gies. From the conclusion in Section 4.1.16 it is a fact that several antennas are needed in the system. In the descriptions below an RF Device is the kind of hardware evaluated in Section 4.3. The information from an RF device is sent to a computer so that the right information can be presented or forwarded via LAN.
4.2.1 Topology 1
Figure 31 shows the solution for topology 1. In this solution one antenna is connected to an RF Device which is connected and controlled by its own computer. Every computer has its own program running and nothing is centralized.
Figure 31: Topology 1
4.2.1.1 Advantages with topology 1 Topology 1 has following advantages:
• The system can be tested in very small scale.
• The system is easy to expand and measurement points are easily placed at different locations in the test site.
• The system is redundant.
4.2.1.2 Disadvantages with topology 1 Topology 1 has following disadvantages:
• Without any central unit the system will have less flexibility and might be hard to overview.
• Several RF devices might be expensive dependent on the device choice. • When upgrading to a newer technology every RF device needs to be
upgraded or changed. 4.2.2 Topology 2
Figure 32 Topology 2 shows the solution for topology 2. In this solution several RF devices are connected to one computer with one program running.
4.2.2.1 Advantages with topology 2 Topology 2 has following advantages:
• With a centralized unit the system will be easy to overview and easy to control.
• More sophisticated methods can be used to decide if there is a leakage or not.
• In comparison with Topology 1 less computers are needed (see 4.2.1 Topology 1).
4.2.2.2 Disadvantages with topology 2 Topology 2 has following disadvantages:
• Depending on the type of connection between the computer and the RF device this communication might be a problem. For example this could be the maximum length of using a USB cable or the number of RF devices a computer can handle.
4.2.3 Topology 3
Figure 33 Topology 3 shows the solution for topology 3. In this solution one RF Device is decoding the signals from the antennas.
4.2.3.1 Advantages with topology 3 Topology 3 has following advantages:
• With one RF device the system will be easy to upgrade for newer technologies.
• If the RF device is expensive it is good that there is only need for one. 4.2.3.2 Disadvantages with topology 3
Topology 3 has following disadvantages:
• Depending on the choice of the RF device there might be problems with antennas that have to be connected with each other. See Section 4.1.11. Due to this problem this solution can not be used for LTE. • Long RF cables needs to be installed. This antenna network might be
very static and hard to expand. If this solution is used in the new lab the RF cables need to be about 50m long. If for example cable CNT-600 from Rosenberger is used the signal will be attenuated around 6 dB for a 1800 MHz signal and around 4 dB for a 900 MHz signal. Depending on how the antennas are connected there will also be losses in power splitters and connectors. One way of connecting all antennas is to use a RF switch which is shown in topology 4 (see 4.2.4 Topology 4).
4.2.4 Topology 4
Figure 34 Topology 4 shows the solution for topology 4. This solution is very similar to topology 3 (see 4.2.3 Topology 3) except from how antennas are connected to the RF device. In topology 4 an RF switch is used so that only one antenna at the time is connected to the RF device.
Figure 34: Topology 4
4.2.4.1 Advantages with topology 4 Topology 4 has following advantages:
• If only one antenna at the time is connected to the RF device the problems with several antennas connected to each other will not occur. See Section 4.1.11.
• With one RF device the system will be easy to upgrade for newer technologies.
• If the RF device is expensive it is good that there is only need for one. 4.2.4.2 Disadvantages with topology 4
Topology 4 has following disadvantages:
• Same problem with long cables as for topology 3 (see 4.2.3.2 Disad-vantage with topology 3).
• Controlling the RF switch and having it synchronized with the RF device might be hard.
4.2.5 Topology 5
Figure 35 Topology 5 shows the solution for topology 5. In this solution a server is gathering all the information from different computers with indi-vidual RF devices.
Figure 35: Topology 5
4.2.5.1 Advantages with topology 5 Topology 5 has following advantages:
• More sophisticated methods can be used to decide if there is a leakage or not.
• A well defined interface between the program executing on the com-puter and the program running on the server can make the system easy to upgrade and expand.
4.2.5.2 Disadvantages with topology 5 Topology 5 has following disadvantages:
4.3 Devices
In these sections below you find technical data, description of features, ad-vantages and disadad-vantages for the devices taken into consideration. 4.3.1 TEMS investigation
This system is developed by Ascom. It is used to analyse mobile networks on an advanced level.
4.3.1.1 Description
This system has a lot of features and below you just get a glitch of all of them, however it is the most relevant ones. Tems investigation is a system where a cellphone is connected to a computer. The cellphone has specific software and the system can provide information about the radio environ-ment, signalling and much more [7].
4.3.1.2 Advantages
Below the TEMS mobile advantages are listed according to the requirements that have to be fulfilled.
• Has support for GSM / WCDMA / LTE. This means that the system can decode and analyse signals of this types.
4.3.1.3 Disadvantages
• The TEMS mobile is very expensive.
4.3.2 Telit EVK2 Evaluation Kit
4.3.2.1 Description
This device is developed by Telit [8]. The circuit works more or less like a cell phone and can be controlled by sending AT commands. It can be connected to a computer using an USB or RS-232 connection. One of the main features in comparison with a cell phone is that it can be used like a sniffer without transmitting anything. This is to be preferred in a radio laboratory environment since you do not want to interfere with the devices in the laboratory.
4.3.2.2 Advantages
Below a list of the Telit EVK2 advantages are listed according to the re-quirements that have to be fulfilled.
• It can detect both GSM and WCDMA signals and can decode them and provide information such as ARFCN and CELLID.
• A previous thesis work at Ericsson where the module has been used resulted in software that controls the hardware and performs scans for a specific type of signal (GSM or WCDMA) and present the informa-tion in a GUI. Since the thesis work was performed at Ericsson the source code can be used to add new features. However the GSM part is not completed and needs to be further developed and more stable. • The device does not need any specific SIM card to work as a sniffer
and therefore does not try to lock to a specific operator. You can therefore scan the air for all GSM and WCDMA signals within range. • When scanning the air no signals are transmitted from the device. This is to be preferred since you do not want to interfere with existing
equipment in the laboratory.
• The device can be controlled by sending AT commands. AT commands is a well known standard for mobile devices and by sending a few commands you can perform a scan and receive a lot of information about what the device has detected.
• The antenna for the device can easily be replaced with another antenna to obtain better precision and detect weaker signals.
• The device is small and can be placed almost anywhere.
• The Telit Kit is cheap in comparison to other devices at the market with the same abilities.
• The device can easily be upgraded with new firmware and it is easy to replace the module on the device. Since the device consists of a motherboard and an Add on chip board, the motherboard can be used for other technologies in the future by replacing the chip board. According to Fabio Bernardi who is working at Telit a new hardware with support for LTE will be available in the future. Telit’s devices are usually pin to pin compatible so the interface for the new hardware will probably be very similar to the modules available now.
4.3.2.3 Disadvantages
Below a list of all disadvantages for the Telit EVK2 are listed and described. • The Telit Kit itself is a stand alone solution and there are no interface for connecting several devices. According to Section 4.1 in the RF propagation and antenna investigation several measurement points will be needed and therefore multiple devices have to be used together. The software created in the earlier project does not have a solution for forwarding of data over TCP or something similar.
• This device can not be used for detection of LTE signals.
• The developed software for the device tends to be unreliable, especially for GSM. Sometimes it can not connect to the device and it seems to be dependent of which computer it is operating at.
• The software does not support scans for GSM and WCDMA simulta-neously.
• The program report signals up to -47 dBm as the highest measurable value. The data sheet however declares -51 dBm as the highest mea-surable value for the device. This is maybe a bug in the code or maybe just wrong information in the data sheet.
