Time Domain Analysis of NB-IoT Signals

Abstract

The NB-IoT (NarrowBand-Internet of Things) radio technology is now widely implemented by mobile phone network operators to support the communication of IoT devices such as smart meters, insurance black boxes for cars, network connected waste bins, smart bicycles. In the present work, some LTE800 cells of different mobile phone network operators implementing the NB-IoT technology in the guard band mode have been investigated. The signals, consisting of a PRB (Physical Resource Block) 180 kHz wide, have been analyzed and characterized in the time domain by means of a narrow band instrumental chain equipped with a Rohde & Schwarz FSH8 spectrum analyzer. Time domain analysis allows us to identify, within the transmission frame, the position of the NB-IoT signaling channels such as the Narrowband Reference Signal (NRS), the primary (NPSS) and secondary (NSSS) synchronization signals and the broadcast channel (NPBCH), but, above all, to measure the power received during the transmission of the NRS. This value has been compared with that measured by the NB-IoT decoding module supplied on the same analyzer, in order to verify the equivalence of these measurement methods. This would allow use of a more diffuse and cheaper instrumentation rather than more expensive vector analyzers, currently required to assess electric fields due to the NB-IoT signals through the extrapolation techniques set by Italian CEI 211-7/E technical standard.

1. Introduction

Internet of things (IoT) embodies the concept of connecting devices from different environments with the aim to collect, process and exchange data via Internet protocols or other defined interfaces. Smart meters, automobile insurance black boxes, networked waste bins, smart bicycles are examples of IoT devices that can be both physical or virtual.

The IoT represents a revolution in telecommunications by connecting different technologies and billions of objects in order to sustain smart decisions and the realization and the remote control of different objects. The IoT will help the development of many business sectors, such as manufacturing, transportation, agriculture, health, logistics (Figure 1). The total number of connected IoT devices was projected to reach 18 billion by 2022 [1,2,3].

In recent years, many communication standards and protocols have been developed to support applications for machine-to-machine (M2M) communication, also termed Machine-Type Communication (MTC) [4,5,6,7,8,9,10,11,12,13]. Standards and protocols such as NFC, RFID, Bluetooth Low-energy, ZigBee, Z-Wave, Wi-Fi are mostly dedicated to short-range applications while new Low-Power Wide-Area (LPWA) technologies such as LoRa, LoRaWAN, Weightless SIG, Sigfox and RPMA meet the need for wide-range communications between objects. These technologies operate in the unlicensed spectrum and provide massive connectivity for devices but require the implementation of proper infrastructures. Cellular systems have also been considered in order to provide connectivity for MTC devices. For this, 3GPP introduced in June 2016 a new cellular technology standard called NB-IoT (Narrow-Band IoT) to provide IoT services over cellular networks. NB-IoT is based on Long-Term Evolution (LTE) and therefore operates in the licensed spectrum. It is conceived to meet most of the IoT requirements, such as very good internal coverage, very low cost connectivity and low power consumption, as well as support for a huge number of connected devices. Unlike other IoT technologies on unlicensed bands, the use by NB-IoT of existing LTE infrastructures allows us to reduce costs for network implementation.

In this work, after a brief description of the radio interface of the NB-IoT protocol, the results of a first set of time and code domain measurements on LTE/NB-IoT cells by means, respectively, of a spectrum and a vector analyzer will be described. The aim is to analyze the NB-IoT signal over time by showing how the analysis of individual sub-carriers enables the identification of control channels and signals of the NB-IoT standard including the Narrowband Reference Signal (NRS). Then, the results for the received power during transmission of the NRS obtained from measurements in the two different domains will be compared to verify their agreement. Power received during transmission of NRS is at the basis of the extrapolation methods set by the CEI 211-7/E technical standard [14] of the Italian Electrotechnical Commitee (Comitato Elettrotecnico Italiano). For this, the use of vector analyzers with measurements in the code domain is currently required. The agreement of results in the two domains demonstrates that time domain measurements by means of cheaper spectrum analyzers may be an alternative method.

2. NB-IoT: Radio Interface

NB-IoT inherits most of the functionalities from LTE, but with some simplifications to meet the low cost and low power constraints of NB-IoT modules [13,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34].

NB-IoT makes use of the same modulation transmission schemes of LTE in both downlink and uplink, i.e., the OFDMA (Orthogonal Frequency-Division Multiple Access) and SC-FDMA (Single-Carrier Frequency-Division Multiple Access) schemes, respectively.

NB-IoT has been designed to occupy one or more 180 kHz wide frequency bands, each corresponding in LTE to a Physical Resource Block (PRB). A PRB consists of 12 sub-carriers each having a 15 kHz bandwidth. NB-IoT uses the same frame structure of LTE with differences in channel and signal mapping. The downlink and uplink transmissions are organized in frames each 10 ms long. Each frame is made up of 10 subframes (SF) lasting 1 ms, in turn made up of two time slots each 0.5 ms long (Figure 2).

The 3GPP standard defines three operating modes for NB-IoT (Figure 3):

• In-band mode: NB-IoT signal occupies one PRB within the LTE signal bandwidth.
• Guard-band mode: the NB-IoT signal occupies one of the PRBs within the unused guard band in the LTE bandwidth.
• Stand-alone mode: the NB-IoT signal occupies the spectrum released by the GSM. In this case, the NB-IoT signal still uses 180 kHz of the 200 kHz assigned to the GSM carrier, with 10 kHz of guard band on both sides of the spectrum.

In the In-band mode, the six central PRBs of the LTE signal are not usable for NB-IoT to avoid conflicts between NB-IoT transmissions and LTE channels and signals transmitted on these PRBs (PBCH channel and PSS and SSS synchronization signals). The indices of the available PRBs are shown in

Table 1. Indices of available PRBs for NB-IoT in In-band mode [13,15,18,30]. Adapted from ref [13].

LTE Bandwidth	3 MHz	5 MHz	10 MHz	15 MHz	20 MHz
PRB indices	2, 12	2, 7, 17, 22	4, 9, 14, 19, 30, 35, 40, 45	2, 7, 12, 17, 22, 27, 32, 42, 47, 52, 57, 62, 67, 72	4, 9, 14, 19, 24, 29, 34, 39, 44, 55, 60, 65, 70, 75, 80, 85, 90, 95

depending on the used LTE bandwidth, while

Table 2. Available values of PRB frequency offsets with respect to the LTE carrier for NB-IoT Guard-Band mode [15,18,31,33]. Adapted from ref [33].

LTE Bandwidth	5 MHz	10 MHz	15 MHz	20 MHz
NB-IoT anchor carrier offset with respect to LTE carrier	±2392.5 ±2407.5	±4597.5 ±4702.5 ±4792.5 ±4807.5 ±4897.5	±6892.5 ±6907.5 ±6997.5 ±7102.5 ±7192.5 ±7207.5 ± 7297.5 ±7402.5	±9097.5 ±9202.5 ±9292.5 ± 9307.5 ±9397.5 ±9502.5 ±9592.5 ±9607.5 ±9697.5 ±9802.5 ±9892.5 ±9907.5

shows possible PRB frequency offsets with respect to the center frequency of LTE carrier for Guard-Band mode.

Table 3. NB-IoT channels and signals [13,15,18,31]. Adapted from ref [13].

Link	Type	Name	Function
Uplink	Channels	NPUSCH	Transmission of user data/control informations
		NPRACH	Transmission of preambles for access requests
	Signals	DMRS	Channel estimation
Downlink	Channels	NPBCH	Transmission of MIB
		NPDCCH	Transmission of control/scheduling informations
		NPDSCH	Transmission of data
	Signals	NPSS	Time and frequency synchronization
		NSSS	Cell ID detection
		NRS	Channel estimation and signal strength measurements
		NPRS	Positioning service

reports the NB-IoT channels and signals while Figure 4 shows the allocation schemes of the even and odd frames, respectively, in the Guard-band and Stand-alone mode [33]. As required by the standard, a maximum of two ports can be used by the transmitter (eNB).

In particular:

• the NPBCH channel is transmitted on subframe # 0, typically on symbols # 3 ÷ 13
• the NPSS signal is transmitted on subcarriers # 0 ÷ 10 of subframe # 5, and typically on symbols # 3 ÷ 13
• the NSSS signal is transmitted on subframe # 9 of even frames only, typically on symbols # 3 ÷ 13

NRS is transmitted on symbols # 5,6,13,14 of each subframe except those where NPSS and NSSS transmission occurs. They are transmitted on 4 carriers, 45 kHz spaced, whose positions depend on the cell identifier (Cell_ID). Figure 5 shows the NRS mapping sequence in one or two ports use cases [34].

3. Italian Technical Standard CEI 211-7/E: Extrapolations Techniques

NRS is of particular interest from the point of view of exposure measurements to electromagnetic fields since their measurement is at the basis of the extrapolation procedures of Italian CEI 211-7/E technical standard [14,35]. In Italy, since the end of the 1990s, the adoption of more stringent exposure limits than Europe has increased the interest for measurement techniques to assess limits compliance. The techniques related to radio base stations are contained in technical standard CEI 211-7/E which was updated in 2019 with reference to the European (CENELEC) and international (IEC) standards but also introducing measurement techniques for NB-IoT signals.

In particular, the standard provides for the measurement of the electric field level due to NRS of the used antenna ports, E_NRS,n, by means of a vector analyzer. The value of the electric field due to each PRB assigned to NB-IoT in maximum power transmission conditions is obtained by means of the following extrapolation formula:

$$E_{NBIoT}\left(V/m\right)=\sqrt{\frac{12}{B{F}_{NBIoT}}}\ast \sqrt{{\displaystyle \sum }_n{E}_{NRS,n}^2}$$

(1)

where BF_NBIoT is the boosting factor associated with the NRS and 12 is the number of subcarriers of the PRB.

In the presence of NB-IoT, the overall contribution of the LTE band will therefore be given by:

$$E_{LTE+NBIoT}\left(V/m\right)=\sqrt{E_{LTE}^2+E_{NBIoT}^2}$$

(2)

where E_LTE is the electric field contribution of the LTE signal in the same frequency band.

In Release 13 of 3GPP standard, NB-IoT was initially conceived to operate on a frequency division duplexing (FDD) scheme. Band 20 (LTE800) is among the bands defined by 3GPP as available for NB-IoT transmission.

4. Materials and Methods

The purpose of the measurements carried out was twofold: on the one hand, to examine the trend over time of the NB-IoT signal and in particular of the single sub-carriers, identifying those on which the NRS is transmitted; on the other hand, to measure the received power during the transmission of the NRS in the time domain and compare it with what is obtained with a vector analyzer in code domain to verify the equivalence of methods.

As known, the electric field E due to the measured signal is related to the power P (dBm) received by the analyzer by the relationship:

$$E\left(V/m\right)={10}^{\left(P+AF+CL-13,01\right)/20}$$

(3)

where AF (dB/m) is the Antenna Factor and CL (dB) are the cable losses.

The measurements were carried out in Pisa and surroundings, at some LTE800 base stations with NB-IoT signal implemented.

The measurements were performed with a narrow band measurement chain consisting of a Rohde & Schwarz FSH8 spectrum analyzer (9 kHz ÷ 8 GHz) connected to a Rohde & Schwarz mod. TSEMF-B1 antenna (30 MHz ÷ 3 GHz). The analyzer is also equipped with a vector module for the analysis of NB-IoT signals in the code domain. This module allows the analysis and measurements on NB-IoT signals that use a single port (SISO). This configuration is actually implemented in the investigated cells. The module provides the measurement of the average power value received during the transmission of the NRS of the selected cell on a frame time basis. Cell selection may be done through introduction of its Cell_ID.

On the other hand, the time domain measurements were performed with the spectrum analyzer in Span Zero mode. Here the analyzer operates in scope mode measuring, as a function of time, power received by IF filter (RBW) set at the established analyzer center frequency. The acquisitions were carried out tuning the analyzer at each sub-carrier center frequency and using a width of the RBW filter equal to 10 kHz, the first available value lower than the bandwidth of the single sub-carriers, so that the received power was uniquely due to the analyzed one. Even if the used RBW value is lower than the channelization of the NB-IoT subcarriers, we expect an underestimation of no more than 0.7 dB on the received power obtained by Gaussian RBW filter compared to the one acquired with an ideal 15 kHz wide rectangular filter. In order to verify the trend of the sub-carriers over time, acquisitions of the received power were performed in Single Sweep mode with sweep times equal to 2 frame duration (20 ms), in order to display an even and an odd frame together. The RMS detector was used for acquisitions. The identification of the sub-carriers transmitting the NRS was carried out through prior acquisitions in the frequency domain (Figure 6).

5. Results

5.1. Time Domain Analysis of NB-IoT Subcarriers

Figure 6 shows an acquisition in frequency domain of the LTE800 band of one of the network operators. It shows the presence of the NB-IoT signal in guard-band mode in the lower part of the spectrum. The same figure shows the detail that allows the identification of the sub-carriers on which the NRS is transmitted. The NB-IoT signal is transmitted in the 801. 3125÷ 801. 4925 MHz band with a central frequency equal to 801. 4025 MHz with an offset of 4.5975 MHz with respect to the LTE carrier (see Table 2). The sub-carriers’ frequencies and the position of the NRS are shown in Figure 7. As mentioned, the position depends on the Cell_ID of the LTE cell and more specifically on the combination of the Cell_ID Group (values 0 ÷ 167) and the Cell_ID Sector (values 0 ÷ 2).

Figure 8 shows a acquisition in time domain (20 ms) of one of the sub-carriers (801.440 MHz) transmitting the NRS. It is possible to distinguish the NPBCH control channel and the expected signals (NRS, NPSS, NSSS). In the even frame, subframe # 4 is occupied by the transmission of an NPDSCH channel, probably containing the Narrowband System Information Block type1 (SIB-NB 1) [13].

Figure 9 shows an acquisition of the last subcarrier (801.485 MHz) which also transmits the NRS. The trend is similar to that of Figure 8. Again, control channels and signals are easily identifiable and the power amplitude received during NRS transmission is about the same as that at 801.440 MHz. As previously mentioned, the NPSS signals are not provided in the last subcarrier. The signals detected in the subframes reserved for NPSS transmission are about 15 dB lower than those of the NRS in Figure 8 and are due to the near subcarrier. Here also, in the even frame, subframe # 4 is occupied by the transmission of an NPDSCH channel.

Finally, Figure 10 shows a time acquisition of a subcarrier (801.425 MHz) that does not transmit the NRS. In this case, the detected NRS is that relating to one of the near cells. The ratio between the power detected for the NRS on this subcarrier and that of the previous figures represents the ratio between the signal received due to the two cells at the measurement point.

The acquisitions shown here demonstrate that the time domain analysis allows us to identify the channels and signals transmitted in the NB-IoT frame and, particularly, to measure the power received during the transmission of the NRS.

Similar trends to those shown in previous figures were found in the acquisition of the NB-IoT signal in the LTE800 band of other network operators. In this case, however, the NB-IoT signals were transmitted in the 791.1025 ÷ 791.÷ 2825 MHz and 811.2075 ÷ 811.3875 MHz bands (Figure 11), with central frequencies equal to 791.1925 MHz and 811.2975 MHz, respectively. Frequency offsets related to the LTE carrier are 4.8075 MHz for the first and 4.7025 MHz for the second case (see Table 2).

5.2. Comparison between Power Measurements of NRS in Time and Code Domains

A first series of tests has been performed in order to compare what obtained with the two measurement methods for the received power due to the NRS. Figure 12 shows an example of the comparison.

The typical uncertainty budget of narrow band measurement chains at LTE800 frequency band is over ±2 dB. An additional contribution to uncertainty due to in situ measurement must be considered. In view of this, the average values measured in the time domain (Figure 12a,b) show that the acquisitions on two different sub-carriers are in excellent agreement (within 0.5 dB) with what obtained in the code domain (Figure 12c) which, as previously described, represents the average value on the NB-IoT frame. The variability around the mean of the measured values in the time domain is typically within ±1 dB.

These preliminary results are promising from the point of view of using the measurement of the NRS power in the time domain for the extrapolation techniques provided for in CEI 211-7/E technical standard as an alternative or in the absence of that in the code domain, by means of more diffuse and cheaper spectrum analyzers rather than more expensive vector analyzers. For this purpose, however, further tests will be necessary, also analyzing the results varying acquisition parameters such as different types of detectors or RBW filter bandwidth.

6. Conclusions

Measurements of NB-IoT signals were performed at some LTE800 cells of various network operators in Pisa and surroundings both by analyzing the sub-carriers of the PRB in the time domain and by measuring the signal with a vector analyzer using the available NB-IoT module. All the analyzed cells transmit the NB-IoT signal in guard-band mode with a configuration that involves the use of a single port and PRBs with different center band frequencies.

The time domain analysis of the sub-carriers allows us, on the one hand, to identify the control channels (NPBCH) and the signals (NRS, NPSS, NSSS) transmitted in the NB-IoT frame and, mostly, to measure the power received during the transmission of the NRS as is done in vector analyzers equipped with specific analysis module and as required by CEI 211-7/E technical standard for extrapolation techniques.

The comparison between the average values of the received power due to the NRS obtained in the time and code domains showed an agreement within 0.5 dB. These results support the hypothesis that the two methods are equivalent with an uncertainty less than 1 dB, which is acceptable for this kind of measurements.

More data are necessary to confirm the preliminary results in order to confirm that time domain measurements, obtained by common spectrum analyzer, could represent an alternative method for extrapolation of the maximum electric field level produced by an NB-IoT cell. Further measurements should also be performed in order to verify the dependence of the results on different analyzer settings (detector and RBW filter bandwidth).