1. Unambiguous 4G LTE coverage test via PBCH decoding
Renshou Dai
Sage Instruments
February 17, 2016
Abstract
This paper describes an innovative method of characterizing the 4G LTE signal via PBCH channel
decoding. This method is offered at Sage Instruments 8901A UCTT (Universal Cellular Test Tool)
product. PBCH (Public Broadcast Channel) signal is present at every 10 ms frame. The PBCH
data bits are CRC-checked, 1/3 convolutionally encoded, interleaved, repeated and then scrambled.
By decoding the PBCH bits and exploiting the repetition and CRC structure, one can positively
determine if the data contain any bit errors without the need to know the original PBCH bits. Such
method is the most decisive and least ambiguous way of determining the signal coverage in a certain
area. The same antenna ports that transmit the user traffic PDSCH (Physical-Down-Link-Shared-
Channel) are also used to transmit the PBCH. A good PBCH channel is an absolute necessary
condition for a good PDSCH channel. A bad PBCH channel means positively and unambiguously
a bad PDSCH channel. If the PBCH channel contains so many uncorrectable bit errors that its
CRC check does not match, one can safely say all other control channels (such as PDCCH) and the
traffic channel (PDSCH) are highly unlikely to survive. The conventional signal coverage metrics
such as RSSI and RSRP are ambiguous and do not apply to technologies such as CDMA, WCDMA
and LTE that no longer use frequency planning and that keep using the same carrier frequency at
adjacent cells and sectors.
1 Introduction
The conventional signal coverage test measures RSSI (Received Signal Strength Indicator) and RSRP
(Reference Signal Received Power) metrics. These two metrics originate from the earlier AMPS/TDMA/GSM
technologies where frequency planning is used and each adjacent cell or sector is strictly prohibited
from using the same frequency. For technologies such as CDMA, WCDMA and LTE, the frequency
planning is no longer used, and the same carrier frequency is used across all cells and sectors. These
two metrics no longer apply, and the measurement results are misleading and ambiguous, to say the
least.
1.1 RSSI measurement is indiscriminate and ambiguous
RSSI measures the total in-band power, and it has no ability to discriminate the signals from adjacent
cells or sectors. For CDMA, different PN offsets are used for different sectors and cells. For WCDMA,
different scrambling codes are used. For LTE, different cell-IDs are used. The simple RSSI measurement
does not take these mechanisms into account. You may get high RSSI readings at certain sector or
cell boarder areas, but the actual signal coverage could be the worst and no users can connect to the
network.
1

2. 1.2 RSRP is vulnerable to in-band interference
For LTE signal, the RSRP is simply the averaged RS (Reference Signal) power per resource element.
The RS from each antenna port occupies a subset of the resource elements at symbol 0 and 4 of each
timeslot. More specifically, every 6 sub-carriers of symbol 0 and 4 are used by a specific antenna port.
Which subset of sub-carriers to use is determined by the cell ID number of that sector. The subset
used by one sector for RS can also be used by another sector for control or traffic channels. This is one
of the problems for RSRP metric. At the sector boarder, you may get high RSRP number, but the
actual signal coverage quality can be very bad. For the cells/sectors that employ multiple TX antenna
ports, the RSRP from each antenna port needs to be measured, and their relative power and phase
(delay) balance or imbalance also matter greatly in determining the coverage quality of a given area.
Suffice it to say, the single reading of RS power alone from the default antenna port 0 can not and will
not determine the overall coverage quality.
1.3 PBCH decoding is the solution
To decode PBCH data bits, the measurement instrument has to function like an actual LTE phone
or modem. It must synchronize to the PSS (Primary Sync Signal) and decode the PSS and SSS
(Secondary Sync Signal) to obtain the cell-ID. From there, it must determine how many TX antenna
ports are used and then extract all the RS signals from all the TX antenna ports to form an equalization
matrix in order to decouple the signals that have been mixed up via transmit diversity layer mapping
and pre-coding [1]. The same process applies to decoding the other control channels such as PDCCH
and PDSCH traffic channel. If the decoded PBCH channel does not even come out right, one can be
absolutely certain that the PDCCH and PDSCH channels will not work either. Regardless of power
and regardless of how many sectors can be seen at a given area, a good bit-error-free PBCH channel is
the simplest and also the most decisive way of determining the overall signal coverage quality for that
area.
2 PBCH data encoding process
Technical details of PBCH encoding process can be found at [1] and [2]. Here is the most essential
information:
For every 40ms multi-frame, a 24-bit PBCH data is generated. These 24 bits are used to calculate
a 16-bit CRC (Cyclic Redundancy Check). The CRC is then XORed with different CRC masks that
depend on the 1-port, 2-port and 4-port TX antenna configurations. The 16-bit CRC is then appended
to the 24- bit data, thus forming a 40-bit data group.
The 40-bit data group then goes through the 1/3 tail-biting convolutional encoding, thus the 40-bit
becomes 120-bit. The 120-bit then goes through the block inter-leaver, which basically involves entering
the bits into a matrix row by row, then performing inter-column permutation on the matrix and then
outputting the bits column-wise.
The interleaved 120-bit data is then rate matched to the PBCH physical channel size. Simply
speaking, the 120-bit is repeated until it fills up all the PBCH resource elements. For each 10 ms
frame, the PBCH occupies the middle resource elements of symbol 0 to 3 of the 2nd timeslot (for
FDD). A total of 240 REs (Resource Elements) are used for PBCH. With QPSK modulation, these
can transport 480 bits. So the 120-bit data group is repeated 4 times every 10 ms frame, and 16 times
per 40 ms multi-frame.
The total 120x16=1920 bits per 40 ms multi-frame is then scrambled with a random sequence
aligned with the beginning of the 40 ms multi-frame boundary. The sequence generation is controlled
by the cell-ID.
2

3. The scrambled bits then go through the QPSK modulation, generating 960 complex symbols per 40
ms multi-frame. The complex symbols then go through the layer mapping and pre-coding associated
with transmit diversity (for multi-TX antenna ports), and the outputs are assigned to the designated
REs associated with each specific TX antenna port.
3 PBCH decoding process, PBCH OK, PBCH poor and PBCH bad
The decoding process must reverse the encoding process. First, the REs associated with PBCH must
be extracted. The RE complex symbols then go through the decoupling matrix to remove the transmit-
diversity mixing effect when multiple TX antenna ports are used. The decoupling equalization matrix
is obtained by extracting all the reference signals from all TX antenna ports. After this, a clean QPSK
constellation should be obtained. The IQ constellations are then converted into the raw bits. The
raw bits are then frame-aligned to the 40ms multi-frame boundary and then descrambled, and the
descrambling sequence is generated based on the cell ID.
The descrambled sequence must possess the 120-bit repetition pattern. If the 120-bit repetition
pattern is preserved, then a single 120-bit data group will go through the de-interleaving, convolutional
decoding and then CRC checking. If the CRC check matches, Sage UCTT will declare PBCH OK,
meaning absolutely zero bit error is detected. If not, UCTT will declare PBCH bad.
If the 120-bit repetition pattern is not preserved, we know there are bit errors. Each of the 120-bit
group will go through the de-interleaving, convolutional decoding and CRC checking. If at least one
40-bit sub-group contains no CRC error, this means the bit errors are still correctable, and Sage UCTT
will declare PBCH poor, meaning there are bit errors, but the PBCH channel is still recoverable.
If none of the 40-bit sub-groups contains correct CRC match, then we know there are uncorrectable
bit errors, and Sage UCTT will declare PBCH bad. This means at this location, it’s highly unlikely
that a user will get any data connection.
4 Test examples
Figure 1 shows the PBCH constellation when the PBCH is OK (meaning no bit errors). The signal
is obtained from an indoor antenna situated about half a mile from the cell site and roughly in the
center of a sector. Figure 2 shows the PBCH poor situation (meaning there are bits errors, but
still correctible, marginal performance). This is obtained through the same indoor antenna by rapidly
waving and shaking the antenna. Figure 3 shows PBCH bad situation (meaning there are uncorrectable
bit errors). This is obtained by intentionally disconnecting the antenna wire-tip from the base and
hiding the antenna base inside a closed metal drawer.
3

4. Figure 1: PBCH OK example. No bit errors. Excellent situation
Figure 2: PBCH poor example. There are some bit erros, but the PBCH data is still
recoverable. Marginal situation.
4

5. Figure 3: PBCH bad example. Bad situation that absolutely has no coverage.
5 Practical considerations
A good PBCH signal quality is the necessary condition for a good PDSCH quality. A PBCH bad
situation means there is no chance for a good PDSCH signal (hence no user data connection). To have
high confidence in signal coverage at certain area, we suggest you must obtain PBCH OK status. The
PBCH poor is only marginal and it should be used as a warning to poor coverage. Of course, ”PBCH
bad” must be avoided at all cost, except at known sector or cell boarder areas.
References
[1] 3GPP TS 36.211, ”Physical Channels and Modulation.”
[2] 3GPP TS 36.212, ”Multiplexing and channel coding.”
[3] 3GPP TS 36.141, ”Base Station conformance testing.”
[4] 3GPP TS 36.104, ”Base Station radio transmission and reception.”
5