Anritsu lte guide

w w w. a n r i t s u . c o m

LTE Resources Guide

2

Introduction

Table of Contents

Abstract.....................................................................................................................................................

References.................................................................................................................................................

LTE - The de facto Mobile Access Standard.................................................................................................................

OFDMA.....................................................................................................................................................

SC-FDMA...................................................................................................................................................

Multiple Input Multiple Output (MIMO) Adaptive Modulation and Coding (AMC).....................................................

LTE Network Components and Functions....................................................................................................................

Frame Structures..........................................................................................................................................................

LTE Frame Structure and Bandwidth Concepts...........................................................................................................

LTE Downlink Channels and Signals.............................................................................................................................

LTE Uplink Channels and Signals..................................................................................................................................

LTE Bands, Channel Bandwidths, and Frequency Allocations.............................................................................

Radio Protocol Architecture........................................................................................................................................

RRC States and Inter-RAT Mobility (3GPP)...................................................................................................................

RRC Messages.............................................................................................................................................................

Paging..........................................................................................................................................................................

RRC Connection Establishment...................................................................................................................................

Security.........................................................................................................................................................................

MD8430A Signaling Tester: LTE Base Station Emulator.............................................................................................

Conformance Test........................................................................................................................................................

Testers, Analyzers and Generators..............................................................................................................................

Handheld Test.............................................................................................................................................................

LTE IQproducer............................................................................................................................................................

3

3

4

5

5

6

7

8

9

10

11

12

13

14

14

16

16

17

18

19

20

21

23

| LTE - Contents

3w w w. a n r i t s u . c o m

Mobile/Wireless

Abstract

Many global wireless carriers have announced plans to deploy Long Term Evolution (LTE) technology, with 3 operatorsalready providing commercial service as of this writing, and many more launches planned through 2010 and beyond. Theprimary reason for the transition from 3G technology to LTE is the benefits that this technology provides to both theconsumer and carrier, including both increased bandwidth and lower network latency to the consumer as well as lowercost per data bit to the carrier.

Incumbent with any new generation technology is a host of technical challenges, so these areas must be tested andoptimized before deployment. For LTE, a few of these challenges include optimizing and maximizing data rates under avariety of conditions, ensuring seamless handovers to current 2G and 3G networks, and verifying that the devices roam tothe correct network when outside “home” conditions. Only after these and other parameters are tested and optimizedcan quality of the LTE devices and network equipment be assured.

Anritsu is proud to offer a complete line of LTE test solutions to ensure the performance and quality of LTE devices andnetwork equipment. For LTE device-focused testing, the MD8430A LTE Signaling Tester is the first complete LTE networksimulator, with capability to simulate up to 6 cells on 4 RF channels (including 2x2 and 4x2 MIMO), and optional fadingusing the MF6900A Baseband Fading Simulator. A variety of user interfaces are available for this instrument, including C-scenarios, Testing and Test Control Notation (TTCN), and the unique device Rapid Test Designer graphical environment.The MD8430A is used as a building block in turnkey LTE test systems including the ME7832L LTE Protocol ConformanceTest System, the ME7873L RF Conformance Test System, and various operator-focused test solutions. As an alternative tofull RF conformance testing, the MT8820C One-Box Tester is also available for LTE and 2G/3G testing, and is optimizedfor a variety of applications from R&D to pre-conformance to manufacturing.

Anritsu also offers flexible test solutions which can be used for testing of either LTE devices or enhanced Node Bs (eNBs).The MS269xA and MS2830A Vector Signal Analyzers provide both LTE uplink and downlink analysis as well as optionalsignal generation, while the MG3700A Vector Signal Generator produces realistic LTE signals with available MIMOconfigurations. For signal generation in any of these platforms, the PC-based LTE IQProducer software provides agraphical interface, enabling the user to quickly and easily generate LTE-compliant waveforms, with options for either FDDor TDD variants. For field and other portable applications, Anritsu also offers LTE analysis using the BTS Master, CellMaster, and Spectrum Master series of products, with available vector signal generator capability in the MT8221B BTSMaster.

This LTE Resource Guide provides in-depth knowledge of LTE and Next Generation Networks and serves as an excellenteducational and reference tool on the technology. Areas covered include modulation formats, network components, framestructures, and physical channels and signals.

References

All 3rd Generation Partnership Project (3GPP) TS 36 series standards are available at http://www.3gpp.org/ftp/Specs/html-info/36-series.htm.

• 3GPP TS 36.101: User Equipment (WIRELESS DEVICE) Radio Transmission and Reception• 3GPP TS 36.104: Base Station (BS) Radio Transmission and Reception• 3GPP TS 36.141: BS Conformance Testing• 3GPP TS 36.201: Physical Layer - General Description• 3GPP TS 36.211: Physical Channels and Modulation• 3GPP TS 36.212: Multiplexing and Channel Coding• 3GPP TS 36.213: Physical Layer Procedures• 3GPP TS 36.214: Physical Layer - Measurements• 3GPP TS 36.300: Overall description• 3GPP TS 36.508: Common Test Environments for UE Conformance Testing• 3GPP TS 36.521-1: UE Conformance Specification; Radio Transmission and Reception; Part 1: Conformance Testing• 3GPP TS 36.521-3: UE Conformance Specification; Radio Transmission and Reception; Part 3: Radio Resource

Management (RRM) Conformance Testing

• 3GPP TS 36.521-3: UE Conformance Specification; Part 1: Protocol Conformance Specification

4

LTE

| LTE - The de facto mobile access standard

Traditionally, operators have built multiple networks to provide multiple services to customers such as fixed telephonenetworks, cable TV networks, cellular telephone networks and data networks. The Next Generation Network (NGN) providesall of these functions using a flat all-IP core that interconnects multiple access technologies and provides a consistent andreliable user-experience regardless of the access method. The NGN core will provide Quality of Service (QoS) support and awide variety of applications and services. The NGN access network will provide mobility and routing management and ensurethat the core sees the mobile networks simply as another IP network. Mobile handover between access types will be seamlessas the IP access network controls security, authentication, and billing for the multiple access technologies.

LTE is the first technology designed explicitly for the NGN and is set to become the de-facto NGN mobile access networkstandard. It takes advantage of the NGN's capabilities to provide an always-on mobile data experience comparable to wirednetworks.

• LTE Release 8 supports peak data rates of up to 326 Mbps on the downlink and 86 Mbps on the uplink with a 20 MHzchannel and 4x4 MIMO. A more common configuration of 20 MHz and 2x2 MIMO supports peak rates of 173 Mbps on thedownlink and 58 Mbps on the uplink.

• LTE Rel. 8 allows for over four times the throughput on the downlink and over five times the throughput on the uplinkrelative to HSPA Release 8 (HSPA+/DC-HSPA).

• LTE improves spectrum efficiency relative to HSPA+.

• LTE provides flexible duplex methods including both Frequency Division Duplex (FDD) and Time Division Duplex (TDD).This allows LTE technology to fit within either existing or new carrier spectrum allocations.

• LTE Rel. 8 supports scalable RF channel bandwidths from 1.4 MHz to 20 MHz.

• LTE interoperates with CDMA2K, W-CDMA and GSM systems. Multimode wireless devices will support handover to andfrom these other systems.

• Legacy technologies such as CDMA2K, HSPA and GSM will continue to operate within the new data infrastructure.

LTE - The de facto Mobile Access Standard

Figure 1: LTE supports the Next generation Network by providing mobile access to an all-IP core.


OFDMA

LTE takes advantage of Orthogonal Frequency Domain Modulation Access (OFDMA), a multi-carrier scheme that allocatesradio resources to multiple users based on frequency (subcarriers) and time (symbols) using Orthogonal Frequency DivisionModulation (OFDM). For LTE, OFDM subcarriers are typically spaced at 15 kHz and modulated with QPSK, 16-QAM, or 64-QAM modulation.

OFDMA allows a network to flexibly assign bandwidth to a user based on bandwidth needs and fees paid on the user's dataplan. Unassigned subcarriers are switched off, thus reducing power consumption and interference. OFDMA uses OFDM;however, it is the scheduling and assignment of radio resources that makes OFDMA distinctive. The OFDM diagram in Figure2 shows a situation where the subcarriers assigned to a set of users are static for a period of time. In the OFDMA diagram,multiple users flexibly share the subcarriers, with differing bandwidth available to each user versus time.

SC-FDMA

In the uplink, LTE uses a pre-coded version of OFDM called Single Carrier Frequency Domain Multiple Access (SC-FDMA).SC-FDMA is used in place of OFDMA due to high current requirements for OFDMA-based power amplifiers andcorrespondingly short battery life. Lower Peak-to-Average Power Ratio for SC-FDMA-based power amplifiers results inextended battery life along with improved uplink performance.

In SC-FDMA, data is spread across multiple subcarriers. This differs from OFDMA, where each subcarrier transports uniquedata. The need for a complex receiver makes SC-FDMA unacceptable for the downlink due to size and processing powerlimitations in a wireless device.

Figure 2: OFDM vs. OFDMA. Each color represents aburst of data. In a given period, OFDMA allows users to

share the available bandwidth.

Figure 3: In OFDM, each frequency component carriesunique information. In SC-FDMA, the information is

spread across multiple subcarriers.

Modulation

6

Modulation

| LTE - Modulation

Multiple Input Multiple Output (MIMO)

Most modern wireless communication techniques use MIMO to increase data rate to the user as well as provide bettercoverage at the cell edge. Various techniques are available, including transmission of separate data streams from each antenna(spatial multiplexing), transmission of identical streams of data from each antenna (transmit diversity), reception on multipleantennas (receive diversity), and various combinations thereof. These techniques can be generalized as Single Input SingleOutput (SISO), Single Input Multiple Output (SIMO), Multiple Input Single Output (MISO), and Multiple Input Multiple Output(MIMO) as shown in figure 4 on page 6.

For LTE Rel. 8, MIMO configurations from SISO to 2x2 and 4x4 MIMO are supported, and the MIMO configuration changesdynamically based on measurements reports from the wireless device. When a user is close to a base station and propagationconditions are optimal, 2x2 MIMO may be used with a high data rate experienced by the user. When a user is at a cell edge,one or both of the diversity modes may be used to increase Signal to Interference and Noise Ratio (SINR).

Adaptive Modulation/Coding (AMC) and Spatial Multiplexing

Adaptive Modulation and Coding (AMC) refers to the ability of the network to dynamically setthe modulation type and coding rate based on the current RF channel conditions reported by theLTE wireless device in Call Quality Indicator (CQI) measurement reports and re-transmissionattempts from the HARQ acknowledgement/re-transmission process. In addition to AMC, eitherClosed Loop Spatial Multiplexing or Open Loop Spatial Multiplexing can be used to dynamicallyset the MIMO mode. This is based on additional channel conditions reported by the LTE deviceincluding Rank Indicator (RI) and Pre-Coding Matrix Indicator (PMI) reports.

The modulation used to transport data on subcarriers can be QPSK, 16-QAM, or 64-QAM. Thisis illustrated in the pictures below, showing the ideal constellation for each type of modulationwith each dot representing a symbol. In the QPSK case, there are four possible symbol states, andeach symbol carries two bits of information. In 16-QAM, there are 16 symbol states, with eachsymbol carrying 4 bits of information. Lastly, in 64-QAM, there are 64 symbol states, and eachsymbol carries 6 bits. Higher-order modulation is more sensitive to poor channel conditions thanlower-order modulation because the detector in the receiver must resolve smaller amplitude andphase differences as the constellation becomes more dense. Based on this, the network wouldset the modulation to a lower order if poor channel conditions are reported by the wirelessdevice.

Coding refers to various error-correction methodologies that add extra bits to the data stream toallow for error detection and correction. Specified as fractions, Code Rates specify the number ofdata bits in the numerator and the total number of bits in the denominator. Thus if the Code Rateis 1/3, protection bits are added so one bit of data is sent as three bits. If errors are reported bythe wireless device, the network would increase the error correction to compensate.


LTE Network Components

| LTE Network Components

UE (User Equipment)

• Access device for user. • Provides measurements that indicate channel conditions

to the network.

eNB (Enhanced Node B)

• Hosts the PHYsical (PHY), Medium Access Control (MAC),Radio Link Control (RLC), and Packet Data ConvergenceProtocol (PDCP) layers.

• Controls user-plane header-compression and encryption. • Provides Radio Resource Control (RRC) functionality for

the control plane. • Functions include radio resource management, admission

control, scheduling, enforcement of negotiated uplinkQoS, cell information broadcast, ciphering/deciphering ofuser and control plane data, and compression anddecompression of downlink and uplink user-plane packetheaders.

PDN Gateway (P-GW)

• Provides connectivity between the UE and external packetdata networks (PDNs) by being the point of exit and entryfor UE traffic (A UE may have simultaneous connectivitywith more than one P-GW for accessing multiple PDNs).

• Performs policy enforcement, packet filtering for eachuser, charging support, lawful Interception, and packetscreening.

• Acts as the anchor for mobility between 3GPP and non-3GPP technologies such as WiMAX and 3GPP2 (CDMA 1Xand EvDO).

MME (Mobility Management Entity)

• Acts as the key control node for the LTE network. • Responsible for idle mode UE tracking and paging

procedure including retransmissions. • Controls bearer activation/deactivation process. • Chooses the Serving Gateway (S-GW) for a UE at initial

attachment and at the time of intra-LTE handover. • Authenticates the user by interacting with the Home

Subscriber Server (HSS) [Not shown in diagram]. • Serves as the termination point for the Non-Access

Stratum (NAS) signaling. NAS signaling is responsible forgeneration and allocation of temporary identities to UEsand checks the authorization of the UE to camp on thesystem.

• Serves as the termination point for ciphering and integrityprotection for NAS signaling.

• Handles security key management. • Provides control plane function for mobility between LTE

and other access networks.

Serving Gateway (S-GW)

• Routes and forwards user data packets. • Acts as the mobility anchor for the user plane during inter-

eNB handovers and as the anchor for mobility betweenLTE and other 3GPP technologies.

• Terminates the downlink data path for idle state UEs andtriggers paging when DL data arrives for the UE.

• Manages and stores UE contexts, e.g. parameters of theIP bearer service and network internal routing information.

LTE Network Components and Functions

Figure 5: TRadio Acccess Network S1 is the physical interface between the eNB and the MME.


Frame Structures

In LTE, downlink and uplink transmissions are organized into frames that are 10 milliseconds (ms) long. A frame is divided into10 subframes that are 1 ms each, and a subframe is divided into 2 slots that are .5 ms each. Each slot contains 7 symbols, whereTs (Sample Time) is the amount of time dedicated to each OFDM sample, and is the basic unit of time for LTE. Ts is defined asTs = 1/(15000 x 2048) seconds or about 32.6 nanoseconds. The frame, subframe, and slot structure for LTE is illustrated inFigure 6.

Two frame types are defined for LTE: Type 1, used in Frequency Division Duplexing (FDD) and Type 2, used in Time DivisionDuplexing (TDD). Type 1 frames consist of 20 slots with slot duration of 0.5 ms as discussed previously. Type 2 frames containtwo half frames, where at least one of the half frames contains a special subframe carrying three fields of switch informationincluding Downlink Pilot Time Slot (DwPTS), Guard Period (GP) and Uplink Pilot Time Slot (UpPTS). If the switch time is 10 ms,the switch information occurs only in subframe one. If the switch time is 5 ms, the switch information occurs in both half frames,first in subframe one, and again in subframe six. Subframes 0 and 5 and DwPTS are always reserved for downlink transmission.UpPTS and the subframe immediately following UpPTS are reserved for uplink transmission. Other subframes can be used foreither uplink or downlink. Frame Type 2 is illustrated in Figure 7.

Figure 6: Type 1 frame type, timing and symbol allocations shown for FDD with normal cyclic prefix (CP)

Figure 7: Type 2 frame. Special fields are shown in Subframes 1 and 6. Guard period separates the Downlink and Up-link. This TDD example represents a 5 ms switch point. A 10 ms switch point would not have the special fields

in subframe 6.

| RF and Microwave Testing Solutions8 | LTE - Frame Structures

Frame Structures

Frame Structures

LTE Frame Structures and Bandwidth Concepts

As explained previously, in LTE, 10 one ms subframescomprise a 10 ms frame, two 0.5 ms slots comprise a onems subframe, and 7 symbols comprise a .5 ms slot. Movingfrom this time-domain viewpoint to one taking intoaccount both time and frequency aspects, the smallestmodulation structure in LTE is one symbol in time vs. onesubcarrier in frequency and is called a Resource Element(RE). Resource Elements are further aggregated intoResource Blocks (RB), with the typical RB havingdimensions of 7 symbols by 12 subcarriers. The RE and RBstructure is shown in Figure 8.

The number of symbols in a RB depends on the CyclicPrefix (CP) in use. When a normal CP is used, the RBcontains seven symbols. When an extended CP is useddue to extreme delay spread or multimedia broadcastmodes, the RB contains six symbols.

Channel bandwidth used by a carrier depends onspectrum allocation from local regulatory agencies like theFCC in the US, and is typically purchased through anauction or other similar means. The spectrum allocatedmay be paired spectrum for use with FDDcommunications, or unpaired spectrum for use with TDDcommunications.

Figure 8: Relationship between a slot, symbols and ResourceBlocks. N is the symbol used to indicate the maximum number

of downlink Resource Blocks for a given bandwidth.

DLRB

Physically, channel bandwidth is the width of the channel in frequency as measured from the lowest channel edge to the highestchannel edge. In unpaired spectrum, channel bandwidth is simply the width of the channel in frequency. In paired spectrum,channel bandwidth is the width of the uplink or downlink in frequency (typically the same).

The number of RBs that can fit within a given channel bandwidth varies proportionally to the bandwidth. Logically, as thechannel bandwidth increases, the number of RBs can increase. The Transmission Bandwidth Configuration is the maximumnumber of Resource Blocks that can fit within the channel bandwidth with some guard band. Given a channel bandwidth at themaximum channel bandwidth of 20 MHz for LTE Rel. 8, 100 RBs can fit within this bandwidth. These concepts are shown inFigure 9.

Figure 9: Relationship between Channel bandwidth, TransmissionBandwidth Configuration, and Transmission Bandwidth. Figure 10: Transmission Bandwidth Con-

figuration

w w w. a n r i t s u . c o m 9

10 | LTE - Physical Channels & Signals

LTE Downlink Channels and Signals

The LTE frame carries both physicalchannels and physical signals, positioned bythe LTE standard at certain positions in theframe in terms of subcarriers and symbols.Channels are defined as carryinginformation received from higher layers.Signals are defined as originating at thephysical layer. The next sections will reviewthe functions of these physical layerchannels and signals as well as theirpositioning in the frame structure.

Figure 11: This diagram of a downlink frame using FDD and normal CP shows the relative location of the various physicalchannels. Frames in systems using extended CP or TDD would be slightly different.

Download Physical Channels

Physical Downlink Shared Channel (PDSCH)

Used to transport user data, the PDSCH is designed for high data rates. Modulation options include QPSK, 16-QAM, and 64-QAM. Spatial multiplexing is exclusive to the PDSCH. The Resource Blocks associated with this channel are shared among usersvia OFDMA.

Physical Broadcast Channel (PBCH)

The PBCH is used to send cell-specific system identification and access control parameters every 4th frame (40 ms) using QPSKmodulation.

Physical Control Format Indicator Channel (PCFICH)

The PCFICH is used to inform the wireless device how many OFDM symbols will be used for the PDCCH in a subframe, rangingfrom 1 to 3. The PCFICH uses QPSK modulation.

Physical Downlink Control Channel (PDCCH)

Wireless devices obtain uplink and downlink resource scheduling allocations from the PDCCH. The PDCCH maps onto resourceelements in up to the first three OFDM symbols in the first slot of a subframe and uses QPSK modulation. The value of thePCFICH indicates the number of symbols used for the PDCCH (not shown in diagram).

Physical Multicast Channel (PMCH)

The PMCH carries multimedia broadcast information, and like the PDSCH, the PMCH has multiple options for modulationincluding QPSK, 16-QAM, or 64-QAM. Multicast information can be sent to multiple wireless devices simultaneously (not shownin diagram)..

Physical Hybrid ARQ Indicator Channel (PHICH)

PHICH carries ACK/NACKs in response to uplink transmissions in order to request retransmission or confirms the receipt ofblocks of data. ACKs and NACKs are part of the HARQ mechanism (not shown in diagram).

Physical Channels & Signals


LTE Downlink Channels and Signals

Reference Signal (RS)

Wireless devices use the RS for downlink channel estimation. They allow the wireless device to determine the channel impulseresponse (CIR). RS’s are the product of a two-dimensional orthogonal sequence and a two-dimensional pseudo-random se-quence. Since there are 3 different sequences available for the orthogonal sequence and 170 possible sequences for thepseudorandom number (PRN), the specification identifies 510 RS sequences. The RS uses the first and fifth symbols under nor-mal CP operation, and the first and fourth symbols for extended CP operation; the location of the RS on the subcarriersvaries.

Primary and Secondary Synchronization Signal (P-SS and S-SS)

Wireless devices use the Primary Synchronization Signal (P-SS) for timing and frequency acquisition during cell search. The P-SS carries part of the cell ID and provides slot timing synchronization. It is transmitted on 62 of the reserved 72 subcarriers (6Resource Blocks) around DC on symbol 6 in slot 0 and 10 and uses one of three Zadoff-Chu sequences. Wireless devices usethe Secondary Synchronization Signal (S-SS) in cell search. It provides frame timing synchronization and the remainder of thecell ID, and is transmitted on 62 of the reserved 72 subcarriers (6 Resource Blocks) around DC on symbol 5 in slot 0 and 10.The S-SS uses two 31-bit binary sequences and BPSK modulation.

LTE Uplink Channels and Signals

Uplink Physical Channels

Physical Uplink Control Channel (PUCCH)

The PUCCH carries uplink control information and is never transmittedsimultaneously with PUSCH data. PUCCH conveys control informationincluding channel quality indication (CQI), ACK/NACK responses of theUE to the HARQ mechanism, and uplink scheduling requests.

Physical Uplink Shared Channel (PUSCH)

Uplink user data is carried by the PUSCH. Resources for the PUSCH are allocated on a sub-frame basis by the UL scheduler.Subcarriers are allocated in units of RB’s, and may be hopped from sub-frame to sub-frame. The PUSCH may employ QPSK,16-QAM, or 64-QAM modulation.

Physical Random Access Channel (PRACH)

The PRACH carries the random access preamble and coordinates and transports random requests for service from UE’s. ThePRACH channel transmits access requests (bursts) when a wireless device desires to access the LTE network (call origination orpaging response).

Uplink Physical Signals

Uplink Reference Signal

There are two variants of the UL reference signal. The demodulation reference signal facilitates coherent demodulation, and istransmitted in the fourth SC-FDMA symbol of the slot. A sounding reference signal is also used to facilitate frequency-dependent scheduling. Both variants of the UL reference signal use Constant Amplitude Zero Autocorrelation (CAZAC)sequences.

Downlink Physical Channels

Figure 12: LTE Uplink Subframe with NormalCyclic Prefix


12 | LTE Bands

LTE Bands, Channel bandwidths and frequency allocations

LTE Operating Bands indicates the carrier frequency to be used. Not all LTE frequency bands support all bandwidths. The chartincludes both FDD and TDD bands.

Figure 13: Bands and channel bandwidths

LTE Bands


Radio Protocol Architecture

NAS Security

Idle State Mobility

Handling

MME

NAS

RRC

UE

PDCP

RLCRLC

PHY

MAC

Inter Cell RRM

RB Control

UE

Connection Mobility Ctrl

Radio Admission Ctrl

Dynamic Resource

Allocation (Scheduler)

eNB Measurement

Config. & Provision

RRC

PDCP

RLC

MAC

PHY

EPS Bearer Control

Mobility

Anchoring

S-GW

UE IP Address

allocation

P-GW

Packet Filtering

E-UTRAN Evolved Packet Core (EPC)

Air

Inte

rfa

ce

S1

AS

Control Plane Protocol

Radio Protocol Architecture: L3 Control Plane

RRC Main Functions

• Broadcast of system information, including NAS common information.

• RRC connection control:

• Paging• Establishment/ modification/ release of RRC connection (SRBs) and DRBs• Initial security activation (integrity protection (CP) and AS ciphering (CP, UP))• RRC connection mobility including e.g. intra-frequency and inter-frequency handover, associated security handling• Radio configuration control including e.g. assignment/ modification of ARQ configuration, HARQ configuration,

DRX configuration• QoS control including assignment/modification of semi-persistent configuration information for DL and UL,

assignment/modification of parameters for UL rate control in the UE• Recovery from radio link failure

• Inter-RAT mobility including e.g: security activation, transfer of RRC context information

• Measurement configuration control and reporting:

• Establishment/ modification/ release of measurements• Configuration and (de-)activation of measurement gaps• Measurement reporting


• RRCConnectionReconfiguration• RRCConnectionReconfigurationComplete

• RRCConnectionReestablishment• RRCConnectionReestablishmentComplete• RRCConnectionReestablishmentReject• RRCConnectionReestablishmentRequest

• RRCConnectionReject• RRCConnectionRelease• RRCConnectionRequest• RRCConnectionSetup• RRCConnectionSetupComplete

• SecurityModeCommand• SecurityModeComplete• SecurityModeFailure

• SystemInformation• MasterInformationBlock• SystemInformationBlockType1

• UECapabilityEnquiry• UECapabilityInformation

• DLInformationTransfer• ULInformationTransfer

• CounterCheck• ConuterCheckResponse

• MobilityFromEUTRACommand• HandoverFromEUTRAPreparationRequest (C2K)• ULHandoverPreparationTransfer (C2K)• CSFBParametersRequestCDMA2000• CSFBParametersResponseCDMA2000

• MeasurementReport• Paging

RRC Messages

RRC States

CELL_DCH

CELL_FACH

CELL_FACHURA_PCH

ConnectionEstablishment/

Release

UTRA_Idle

E-UTRARRC CONNECTED

E-UTRARRC IDLE

GSM_Connected

GPRS PacketTransfer Mode

GSM_Idle/GPRSPacket_Idle

ConnectionEstablishment/

ReleaseConnection

Establishment/Release

Handover

Reselection

Handover

Reselection

CCO, Reselection

CCO,Reselection

CCOwith NACC

Reselection

RRC States and Inter-RAT Mobility Procedures (3GPP)

Radio Bearer Types• SRB (Signalling Radio Bearers), used to carry C-Plane traffic, i.e. RRC signalling messages.

• RRC messages can contain other messages, such as NAS messages or HRPD/1xRTT messages.• There are three SRBs, all MUST be established.

• DRB (Data Radio Bearers), used to carry U-Plane traffic (user data).

• Carry IP packets

Signal Radio Bearers• SRBs are used only for transmission of RRC or NAS messages

• Three SRBs are defined:

• SRB0 is for RRC messages using the CCCH logical channel.• SRB1 is for RRC messages (which may include a piggybacked NAS message) as well as for NAS messages prior to

the establishment of SRB2, all using DCCH logical channel.• SRB2 is for NAS messages, using DCCH logical channel. SRB2 has a lower-priority than SRB1 and is always config

ured by E-UTRAN after security activation.

• All RRC messages are integrity protected and ciphered by PDCP.

• NAS independently applies integrity protection and ciphering to the NAS messages.

| RF and Microwave Testing Solutions

RRC States

14 | LTE - RRC States and Inter-RAT Mobility Procedures (3GPP)

System Information

• Transmitted periodically on BCCH.

• MIB contains crucial cell information (e.g. bandwidth) and is transmitted on a fixed schedule, i.e. every 40 ms

• Dynamic scheduling: SIB1 (80 ms periodicity) contains information about scheduling of other SIBs

• SIBs are grouped in SI (System Information) “containers”

• Each SI can contain several SIBs.• Each SI can have a different schedule (transmission

frequency).• Each SI has to be sent in a single subframe. • Only one SI can be sent in a subframe.

• MIB (Master Information Block) transmitted on BCCHmapped on BCH mapped on PBCH.

• SIBs are transmitted on BCCH mapped on DL-SCH mappedon PDSCH.

UE E-UTRAN

MasterInformationBlock

SystemInformationBlockType1

SystemInformation


System Information Blocks

• MIB - defines the most essential physical layer information of the cell required to receive further system information .

• SIB1 - contains information relevant when evaluating if a UE is allowed to access a cell and defines the scheduling of othersystem information blocks.

• SIB2 - contains common and shared channel information.

• SIB3 - contains cell re-selection information.

• SIB4 - contains information about the serving neighbouring frequencies and intra-frequency neighbouring cells relevant forcell re-selection, covering both E UTRA and other RATs.

• SIB5 - contains information about other E UTRA frequencies and inter-frequency neighbouring cells relevant for cell re-se-lection.

• SIB6 - contains information about UTRA frequencies and UTRA neighbouring cells relevant for cell re-selection.

• SIB7 - contains information about GERAN frequencies and GERAN neighbouring cells relevant for cell re-selection/handover.

• SIB8 - contains information about CDMA2000 frequencies and CDMA2000 neighbouring cells relevant for cell re-selec-tion/handover.

• SIB9 - contains a home eNB identifier (HNBID)

• SIB10 - contains an ETWS primary notification

• SIB11 - contains an ETWS secondary notification

Change Notification Updated Information

Change Notification BCCH Modulation Period (n + 1)

System information can change every BCCH modification period.

• Notification about system information change:

• Both in RRC_IDLE and RRC_CONNECTED a Paging message containing systemInfoModification is used to informthe UE about SI change

• If an SI-RNTI is discovered on PDCCH, the UE reads SIB1 at the next modification message boundary

• SIB1 contains a value tag indicating that content of other SIBs (except MIB and SIB1) has changed. No informationis provided regarding which SIB has changed.

Paging

• Transmit paging information to a UE in RRC_IDLE.

• Inform UEs in RRC_IDLE and RRC_CONNECTED about a system information change.

• Inform UEs in RRC_IDLE and RRC_CONNECTED about an ETWS primary notification.

UE E-UTRAN

Paging

• eNB transmits an RRC Paging message on DL-SCH (PDSCH) at Paging Occasions

• One Paging Frame (PF) is one Radio Frame, which may contain one or multiple Paging Occasion(s).

• One Paging Occasion (PO) is a subframe where there may be P-RNTI (Paging RNTI) transmitted on PDCCH ad-dressing the paging message

• PO and PF are calculated by the eNB and UE using the UE’s C-RNTI

• The UE looks for its identifier in the RRC paging message

Connection Control• The UE and eNB start connection establishment over SRB0, which has default configuration.

• Well known to the UE, so no need to be signalled

• First, RRC connection establishment involves the establishment of SRB1.

• E-UTRAN completes RRC connection establishment prior to completing the establishment of the S1 connection

• Upon receiving the UE context from the EPC, E-UTRAN activates AS security (both ciphering and integrity protection) usingthe initial RRC-based security activation procedure.

• Next, E-UTRAN initiates the establishment of SRB2 and of radio bearers carrying user data (DRBs)

• E-UTRAN may do this prior to receiving the confirmation of the initial security activation from the UE

• A Default Bearer is always established

Paging

| RF and Microwave Testing Solutions16 | LTE - Paging and Security

RRC Connection Establishment• The purpose is only to establish SRB1

• SRB0, used in this procedure, has a default well-known configuration• Before connection establishment, RRC is in RRC_IDLE state; after successful completion, RRC is in

RRC_CONNECTED state.

UE E-UTRAN

RRCConnectionRequest

RRCConnectionSetup

RRCConnectionSetupComplete

• RRCConnectionRequest is sent in RA procedure message 3

• RRCConnectionSetup is sent in RA procedure message 4. If theprocedure fails, RRCConnectionReject is sent instead.

• Both RRCConnectionRequest and RRCConnectionSetup are senton SRB0 (CCCH)

• RRCConnectionSetupComplete is sent on SRB1 (DCCH), estab-lished as a result of this procedure

• RRC messages used in this procedure are neither integrity pro-tected not ciphered

• This procedure is executed prior to security establish-ment


Security• As a result of the RRC security activation procedure, the AS applies three different security keys:

• One for the integrity protection of RRC signalling (KRRCint), • One for the encryption of RRC signalling (KRRCenc)• One for the encryption of user data (KUPenc).

• The integrity and ciphering algorithms can onlybe changed upon handover.

• The AS keys (both the base-key and the de-rived-keys) change upon every handover andconnection re-establishment.

USIM / AuC

UE / HSS

UE / MME

UE / eNB

K

CK, IK

KASME

KNAS enc KNAS int KeNB NH

KUP enc KRRC enc KRRC int KeNB*

NCC

Key Hierarchy

• UE calculates keys, checks MAC (Message Authentication Code) of SMC and if correct, sends back an integrity protected and ciphered Security Mode Complete message

• If SMC integrity protection fails (or there is any other activation failure), the UE sends back a SecurityModeFailure message.

• SRB0 cannot be used after security activation

Ciphering Integrated Protection

NAS Signalling Required and terminated in MME Required and terminated in MMEU-Plane Data Required and terminated in eNB Not required and not supportedRRC Signalling (AS) Required and terminated in eNB Required and terminated in eNB

Security Termination Points

Security Establishment

• The purpose is to configure and activate AS security

• Prerequisites to activating AS security:

• UE must be in RRC_CONNECTED state• Successful NAS Authentication and Key

Agreement (AKA) procedure – i.e. the UE is authenticated

• Successful NAS security activation (exchange of NAS SECURITY MODE COMMAND and NAS SECURITY MODECOMPLETE messages)

UE E-UTRAN

SecurityModeCommand

SecurityModeComplete

• AS security activation must be performed after setting up SRB0 and SRB1 and before setting up SRB2 and any DRBs.

• eNB sends an integrity protected SecurityModeCommand (SMC), containing information on selected algorithms for AS integrity protection and ciphering

Security

| RF and Microwave Testing Solutions18 | LTE - Base Station Emulator

Base Station Emulator

MD8430A Signalling Tester: LTE Base Station Emulator

The MD8430A is the first complete LTE Signaling Tester, allowing for simulationof multiple eNBs with both 2x2 and 4x2 MIMO, as well as portions of the LTEnetwork. It allows for protocol-based testing of LTE UEs at RF and higher layers,and is integrated as a fundamental component of Anritsu's ProtocolConformance, RF Conformance, and Operator IOT test systems.

Anritsu’s LTE Signaling Tester (MD8430A) allows the user to test any of the LTEUE layers from PHY to NAS. In addition, applications can be tested under real-world conditions using an external server. The MD8430A's built-in basebandcapability allows for FPGA-based prototype testing at either sub-speed or real-time, and helps speed time to market for LTE wireless devices.

The LTE Signaling Tester (MD8430A) can be automated with the user's choice of 3 PC-based user interfaces (UIs) including thegraphical Rapid Test Designer (RTD) software, C-Scenarios, or TTCNbased Protocol Conformance Test (PCT) software. Inter-RAT handover between technologies is enabled using a system including the MD8480C GSM/W-CDMA Signaling Tester orMD8470A CDMA2K Signaling Tester as well the appropriate UI software.

Rapid Test Designer (RTD)

The Rapid Test Designer (RTD) software is a revolutionary new tool that speeds the testing of LTE devices by simplifying theway in which users create, execute, and analyze test cases. Tests are grouped as objects, parameters are set by simply clickingon the objects, and test cases are easily compiled by linking the objects with lines signifying test flow.

When used with the MD8430A or other available signaling testers, the RTD software provides fast, interactive creation andexecution of tests. The RTD software hides the complexity of testing 3GPP protocols and allows the user to test specificfunctions and protocols within the UE without being an expert on all protocol layers. The intuitive graphical interface removesthe need to learn a highly specialized test language like TTCN.

Built upon Anritsu's years of experience in testing 3GPP protocols with the leading wireless device vendors, RTD provides abroad array of configurable building blocks for designing tests, a catalog of common network settings, interactive errorchecking, and an integrated protocol analyzer. Applications include operator acceptance testing, integration testing,interoperability testing, regression testing, and application testing.

Signal Generat


Conformance Test

ME7873L LTE RF Conformance Test System

ME7872L LTE Conformance Test System

The ME7832L LTE Protocol Conformance Test System allows the user to verifyconformance of a UE's protocol stack to 3GPP LTE standards. Pre-written, validatedTTCN3 test cases are available for the system, conforming to GCF Work Items and PTCRBRequest for Tests. The MD8430A used in the ME7832L is highly stable and repeatable. Inaddition, the ME7832L offers options for UE automation, allowing the user to conductregression tests over extended periods including overnight or over the weekend. TheLTE Protocol Conformance Test System (ME7832L) includes an intelligent test sequencer,allowing the user to schedule tests using a drag and drop graphical interface, withautomated creation of PICS/PIXIT files. The included protocol analyzer shows completesequences including all layers and time stamps, with detailed analysis of any message.Options are available to allow the user to view, edit, and create custom test cases basedon the 3GPP 36.523 standard.

The ME7873L LTE RF Conformance Test System allows theuser to verify conformance of a UE's RF layer to 3GPP LTEstandards. Prewritten, validated test cases are available for thesystem, conforming to GCF Work Items and PTCRB Requestfor Tests. The system is extremely flexible, with availableoptions for any LTE band currently scheduled for deployment,as well as easily changeable test parameters to enable testingof UE performance. The LTE RF Conformance Test System(ME7873L) is a modular system to fit with user requirements,and can include 36.521-1 tests for Chapter 6 (TX), Chapter 7(RX), Chapter 8 (Performance), or Chapter 9 (UE Reporting) aswell as 36.521-3 (RRM). A user may compile a test sequencecombining test cases from any of these chapters. Additionaloptions will be available in the future including inter-RAThandover tests and TD-LTE.

MF6900A Fading Simulator

The MF6900A Fading Simulator provides a stable, repeatablefaded testingenvironment when connected to the MD8430A using a baseband interface. Onceconnected, it provides a simple and accurate way to add fading profiles to any testscenario under either SISO or MIMO conditions.

Digital baseband processing in the Fading Simulator (MF6900A) assures reproducible fading profiles. As there are no analogor RF circuits, periodic calibration is eliminated, making the MF6900A as easy to maintain as it is to use. In inter-RAT systemsincluding both the MD8480C GSM/W-CDMA Signaling Tester and the MD8430A LTE Signaling Tester, included fading profilesallow rapid test setup since the fading profiles are pre-configured and ready to use immediately. The MF6900A is expandableto accommodate four input ports and four output ports. Software updates add functionality such as 4x2 MIMO.

tor

| RF and Microwave Testing Solutions20 | LTE - Testers, Analyzers and Generators

MT8820C LTE One-Box Tester

The MT8820C LTE One-Box Tester is a multi-format 2G, 3G, and LTE tester with capability forUE calibration, RF parametric testing, and functional testing, including call processing or no-call based testing. Formats supported include LTE, W-CDMA/HSPA to Release 8, CDMA2K to1xEV-DO rel. A, TD-SCDMA/HSPA, and GSM/GPRS/E-GPRS. Several high-speed calibrationmodes are also included such as Anritsu's “TX/RX Sweep” mode, allowing calibration of TXand RX in parallel. For current users of either the MT8820B or MT8820A, the MT8820C is adrop-in replacement with backwards compatibility.

The MT8820C makes testing of LTE physical layer parameters easy and simple, including measurement of both TX and RXparameters. Parameter setups and pass/fail limits for tests defined in 3GPP 36.521-1 are pre-programmed, including easy setupof uplink and downlink RB allocations. Options are available for 2x2 MIMO including IP-layer throughput at 100 MB/s downlinkdata rates.

MS269xA and MS2830A Vector Signal Analyzers (VSA)

Anritsu's MS269xA and MS2830A-series high performance VSAs perform multi-format signalanalysis, including LTE uplink and downlink analysis with optional signal generation. TheMS269xA is focused on applications requiring high performance, while the MS2830A isfocused on applications requiring high speed and low cost. The VSAs are ideal for thedemanding requirements of LTE measurement, and include DSP-based modes for fast TXmeasurements as well as a digitizer that captures signals so they can be replayed on the

instrument or removed from the analyzer for post-processing.

Both Vector Signal Analyzers (MS269xA and MS2830A) support one-button spectrum analysis including Channel Power,Occupied Bandwidth, Adjacent Channel Leakage Ratio, and Spectrum Emission Mask, all with wide dynamic range. In addition,vector analysis is available including EVM and power by symbol, subcarrier, RB, RE, and many other variations. Users can createa One-Box LTE tester (without signaling) by adding the optional signal generator to the base package. For eNB testing, built-in test model configurations allow rapid test setup.

MG3700A Vector Signal Generator

MG3700A is a vector signal generator with two separate arbitrary (ARB) waveformmemories. Patterns loaded into the memories can play one at a time or simultaneouslythrough the single RF output port. Typically, one signal represents the desired signal andthe second represents interference. Additive White Gaussian Noise (AWGN) can beautomatically added to one or both signals. The MG3700A provides the flexibility tocreate reproducible real-world signals.

The MG3700A produces signals up to 3 GHz or, optionally, up to 6 GHz. Boasting a 256 Msample/channel memory, theMG3700A has the largest standard memory size on the market today. If needed, increase the memory to 512 Msamples. TheMG3700A has the largest standard modulation bandwidth on the market today: 120 MHz when using the internal basebandgenerator and 150 MHz when using the external I/Q inputs. The MG3700A includes a 20 Mbps Bit Error Rate (BER) tester on-board with an option that allows the speed to increase to 120 Mbps.

Testers, Analyzers & Generators


Handhelds

BTS Master, Spectrum Master and Cell Master

LTE Signal Analyzers

The BTS Master features three LTE measurement modes:

• RF Measurements• Modulation Measurements• Over-the Air Measurements (OTA)

The goal of these measurements is to increase data rate and capacity byaccurate power settings, ensuring low out-of-channel emissions, and goodsignal quality. These attributes help to create a low dropped call rate, a lowblocked call rate, and a good customer experience. Cell site technicians or RFengineers can make measurements Over-the-Air (OTA) to spot-check atransmitter's coverage and signal quality without taking the cell site off-line.When the OTA test results are ambiguous one can directly connect to thebase station to check the signal quality and transmitter power.

Adjacent Channel Leakage Ratio (ACLR)

Adjacent Channel Leakage Ratio (ACLR) measures how much BTS signal getsinto neighbouring RF channels. ACLR checks the closest (adjacent) and thesecond closest (alternate) channels. Poor ACLR can lead to interference withadjacent carriers and legal liability. It also can indicate poor signal qualitywhich leads to low throughput.

Cell ID (Sector ID, Group ID)

Cell ID indicates which base station is being measured OTA. The strongestbase station at your current location is selected for measurement. Wrongnvalue devices for Cell ID lead to inability to register. If the cause is excessiveoverlapping coverage, it also will lead to poor EVM and low data rates.

Frequency Error

Frequency Error is a check to see that the carrier frequency is preciselycorrect. The BTS Master can accurately measure Carrier Frequency Error OTAif the instrument is GPS enabled or in GPS holdover. Calls will drop whenmobiles travel at higher speed. In some cases, cell phones cannot hand offinto, or out of the cell when the base station frequency error is excessive.

Sync Signal Mapping

Sync Signal Scanner can be used with the GPS to save scan results for laterdisplay on a map. The EVM of the strongest synch signal available at that spotis also recorded. The Cell, Sector, and Group ID information is also includedso that it's easier to interpret the results. Once the Synch Signals are mapped,it becomes much easier to understand and troubleshoot any interference orcoverage issues.


Fading Simulator

| RF and Microwave Testing Solutions

Master Series Handhelds

22 | LTE - Handhelds

BTS Master, Spectrum Master and Cell Master Specifications

MT8221B BTS Master MS272XC SeriesSpectrum Master

MT8221B Cell Master

| Vector Signal Generator w w w. a n r i t s u . c o m 23

LTE IQproducer

MX269908A LTE IQproducer is PC application software with a graphical user interface (GUI) for generating waveform patternsin compliance with the 3GPP TS36.211, TS36.212, and TS25.814 standards. This Windows-based software creates waveformsfor the MG3700A and the signal generator option of the MS269xA. The GUI allows a user to quickly set signal parameters forLTE waveforms. Built-in simulation tools allow the user to examine these waveforms in the time domain, as a CCDF plot, or asan FFT spectrum. It's easy to generate test patterns by allocating the physical channels in resource block units.

Figure 13: The Frame Structure Screen shows the layoutof the physical layers in the upper section and the powerprofile of the symbols in the lower section. In the uppersection, the physical channels map to the Y-axis as fre-

quency in Resource Block units (12 subcarriers) and to theX-axis as time in OFDM symbol units.

Figure 14: Here the Frame Structure Screen shows an up-link subframe with eight PUSCH and eight PUCCH. Easilyconfigure test signals such as this one by changing param-eters and get immediate feedback in the Frame Structure

Screen.

Figure 15: The Frame Structure Screen shows a downlinksubframe configured with 25 PDSCH. The PDCCH is on

the first symbol; the Primary and Secondary Synchroniza-tion Signals are on the sixth and fifth symbols respectively,

and the Broadcast Channel ranges from the seventh tothe tenth symbols. Both the Synchronization Signals and

the Broadcast Channel are assigned to the center 72 sub-carriers for all bandwidths. Reference Signals are shown

by hash marks in the first and fifth symbols of the slot. ThePCFICH is on the first symbol of each subframe.

Figure 17: The LTE IQproducer supports Spatial Multiplex-ing and Transmit Diversity. When multiple antennas areselected, the appropriate files are created for each an-

tenna for immediate MIMO.

Figure 18: IQproducer also creates Random Access Pream-bles for uplink testing. Frequency hopping and powerramping can be quickly set from the parameter screen.

Limits on all settings ensure that signals comply with thestandards.

IQProducer

Anritsu Corporation 5-1-1 Onna, Atsugi-shi, Kanagawa, 243-8555 JapanPhone: +81-46-223-1111Fax: +81-46-296-1238

• U.S.A.Anritsu Company1155 East Collins Blvd., Suite 100, Richardson, TX 75081, U.S.A.Toll Free: 1-800-267-4878Phone: +1-972-644-1777Fax: +1-972-671-1877

• CanadaAnritsu Electronics Ltd.700 Silver Seven Road, Suite 120, Kanata, Ontario K2V 1C3, CanadaPhone: +1-613-591-2003 Fax: +1-613-591-1006

• Brazil Anritsu Eletrônica Ltda.Praca Amadeu Amaral, 27 - 1 Andar01327-010-Paraiso-São Paulo-BrazilPhone: +55-11-3283-2511Fax: +55-11-3288-6940

• Mexico Anritsu Company, S.A. de C.V.Av. Ejército Nacional No. 579 Piso 9, Col. Granada11520 México, D.F., MéxicoPhone: +52-55-1101-2370Fax: +52-55-5254-3147

• U.K.Anritsu EMEA Ltd.200 Capability Green, Luton, Bedfordshire, LU1 3LU, U.K.Phone: +44-1582-433200 Fax: +44-1582-731303

• FranceAnritsu S.A.16/18 avenue du Québec-SILIC 72091961 COURTABOEUF CEDEX, FrancePhone: +33-1-60-92-15-50Fax: +33-1-64-46-10-65

• GermanyAnritsu GmbHNemetschek Haus, Konrad-Zuse-Platz 1 81829 München, Germany Phone: +49-89-442308-0 Fax: +49-89-442308-55

• ItalyAnritsu S.p.A.Via Elio Vittorini 129, 00144 Roma, ItalyPhone: +39-6-509-9711 Fax: +39-6-502-2425

• SwedenAnritsu ABBorgafjordsgatan 13, 164 40 KISTA, SwedenPhone: +46-8-534-707-00 Fax: +46-8-534-707-30

• FinlandAnritsu ABTeknobulevardi 3-5, FI-01530 VANTAA, FinlandPhone: +358-20-741-8100Fax: +358-20-741-8111

• DenmarkAnritsu A/SKirkebjerg Allé 90, DK-2605 Brøndby, DenmarkPhone: +45-72112200Fax: +45-72112210

• SpainAnritsu EMEA Ltd. Oficina de Representación en EspañaEdificio VeganovaAvda de la Vega, n˚ 1 (edf 8, pl 1, of 8)28108 ALCOBENDAS - Madrid, SpainPhone: +34-914905761Fax: +34-914905762

• RussiaAnritsu EMEA Ltd. Representation Office in RussiaTverskaya str. 16/2, bld. 1, 7th floor.Russia, 125009, MoscowPhone: +7-495-363-1694Fax: +7-495-935-8962

• United Arab EmiratesAnritsu EMEA Ltd.Dubai Liaison OfficeP O Box 500413 - Dubai Internet CityAl Thuraya Building, Tower 1, Suit 701, 7th FloorDubai, United Arab EmiratesPhone: +971-4-3670352Fax: +971-4-3688460

• SingaporeAnritsu Pte. Ltd.60 Alexandra Terrace, #02-08, The Comtech (Lobby A)Singapore 118502Phone: +65-6282-2400Fax: +65-6282-2533

• IndiaAnritsu Pte. Ltd. India Branch Office3rd Floor, Shri Lakshminarayan Niwas, #2726, 80 ft Road, HAL 3rd Stage, Bangalore - 560 075, IndiaPhone: +91-80-4058-1300Fax: +91-80-4058-1301

• P.R. China (Hong Kong)Anritsu Company Ltd.Units 4 & 5, 28th Floor, Greenfield Tower, Concordia Plaza, No. 1 Science Museum Road, Tsim Sha Tsui East, Kowloon, Hong KongPhone: +852-2301-4980Fax: +852-2301-3545

• P.R. China (Beijing)Anritsu Company Ltd.Beijing Representative OfficeRoom 2008, Beijing Fortune Building, No. 5, Dong-San-Huan Bei Road, Chao-Yang District, Beijing 100004, P.R. ChinaPhone: +86-10-6590-9230Fax: +86-10-6590-9235

• KoreaAnritsu Corporation, Ltd.8F Hyunjuk Building, 832-41, Yeoksam Dong, Kangnam-ku, Seoul, 135-080, KoreaPhone: +82-2-553-6603Fax: +82-2-553-6604

• AustraliaAnritsu Pty. Ltd.Unit 21/270 Ferntree Gully Road, Notting Hill, Victoria 3168, AustraliaPhone: +61-3-9558-8177Fax: +61-3-9558-8255

• TaiwanAnritsu Company Inc.7F, No. 316, Sec. 1, Neihu Rd., Taipei 114, TaiwanPhone: +886-2-8751-1816Fax: +886-2-8751-1817

Specifications are subject to change without notice.

Rev 1 0609

Please Contact:

®Anritsu All trademarks are registered trademarks of their respective companies. Data subject to change without notice. For the latest specifications and products visit www.anritsu.com

Rev 1010

Technology

Anritsu lte guide