Hi!
In order to minimize any potential interference with other GSM networks, I think we should try to improve our current power control. I have so far seen the various power control related attributes and parameters in the 12.21, 08.58 and 04.08 specs, but I might not yet have the full picture.
So I've done some reading up and am sharing my experience here now:
1) BS power control: controls the power of the downlink (BTS->MS)
12.21 has a 'power class' attribute, defined as binary representation of a 05.05 power class. However, 05.05 power classes also come alphanumeric (M1 .. M3, P1) and thus cannot be mapped 1:1. Also, this attribute is marked as read-only - thus not important for this discussion. It can only be used by the BSC to get some rough idea about the TRX power range.
12.21 also specifies a 'RF max power reduction' value in 9.4.47. This element can be sent as part of 'SET RADIO CARRIER ATTRIBUTE'. The value in this IE is the 'Pn' value of 08.58. The Scale is 2dB steps, and the maximum value is 255, so there can be a maximum value of 512dB.
08.58 defines Pn as the 'nominal power level', i.e. the level that is not yet reduced by dynamic power control.
Please also note that the first TRX (the TRX carrying the TS0 i.e. the CCCH) is only allowed to transmit at a fixed power level.
So if my calculations are correct, we can do the following calculation:
* BS-11 TRX power set to 30mW. 30mW equals roughly 15dBm * Pn can be set to anywhere between 0 (30mW) and 512dB less, i.e. literally nothing. A 'rf max power reduction' level of 7 (14dB) should reduce our _maximum_ BS power output to about 1dBm, i.e. 1.2mW
I'm creating the following table (with tabs, so use fixed-width fonts)
Power class Pn_val=0 (0Db) BS-11 30mW 15dBm BS-11 80mW 19dBm BS-11 250mW 24dBm BS-11 2W 33dBm
08.58 furthermore contains a 'BS power' attribute, chapter 9.3.4. This is used for initial channel activation, but also can be used in a later message to alter the current power level of a particular channel (BS POWER CONTROL message). The attribute contains the number of 2dB steps that are to be subtracted from the Pn nominal power, up to Pn-30dB.
There also is a "fast power control" (FPC) bit that can be set to enable or unset to disable FPC. As far as I understand, FPC is only available to circuit-switched-data TCH's in ECSD (enhanced circuit switched data) mode. The idea that power control happens every 20ms, rather than every 480ms (SACCH)
There are also "BS Power Parameters" (9.3.32) which describe the parameters and limits for the dynamic power control algorithm. However, no algorithm is standardized and thus the parameters are manufacturer/network dependent.
2) MS power control: controls the power of the uplink (MS->BTS)
08.58 9.3.13 specifies the initial power level as indicated in the CHANNEL ACTIVATION message. It can also be changed for an active channel by a MS POWER CONTROL message.
Analoguous to the BS power, there also are 'MS Power Parameters' (9.3.31)
The algorithm for MS power control (also defining the example ms power parameters) can be found in GSM 05.08 10.2.1.
What I can summarize is:
a) The Tx power of the MS is typically controlled by the MS_TXPWR_REQUEST field of the L1 header of the data sent by the BTS on the corresponding channel. The content of the field is a 'ms power level' in nominal 2dB steps, as defined in 05.08 and even more specifically in Section 4.1.1 of 05.05.
Interestingly, the tables in 05.05 don't contain relative values in dB, but absolute values in dBm. If the MS is asked to transmit at a power level it doesn't support, it has to use the closest level it supports.
For GSM900, the range is 5dBm (3.2mW) to 39dBm (close to 10W) For GSM1800, the range is 0dBm (1mW) to 36dBm (4W)
b) When accessing the RACH and before the MS has received any such L1 headers, it shall use the value broadcasted in the MS_TXPWR_MAX_CCH field of the BCCH.
c) The BTS will employ some non-specified algorithm to configure the MS to use the minimum neccessary power to still be received by the BTS. This is actually an optional feature in the spec, but I have clearly heard this in the speakers of my monitor with both the BS-11 and the nanoBTS: The initial bursts are loud, and then the follow-up bursts are becoming less and less loud.
d) The L1 header IE that we get as part of every MEASUREMENT REPORT contains the absolute power level in dBm that the MS used to transfer this frame. We can thus use this information to verify that our assumptions about the power control have actually worked.
If we use the knowledge of the behavior as described above, we can also deduct:
* the BS-11 is configured to a NM_ATT_RF_MAXPOWR_R of 0, i.e. it will transmit with the power level that is configured by LMT / ipaccess_config. By default this is set to 30mW
* the nanoBTS 900 has 20dBm (1800 is 23dBm) TRX output power. bsc_hack is configured to a NM_ATT_RF_MAXPOWR_R of 12, i.e. 24dB. This means we are transmitting with a mere -4dBm (398uW) or -1dBm (794uW) which would be _really_ low. So either the nanoBTS are not following specs, or we're really transmitting something that would barely be possible to receive. Or my calculations are wrong ;)
I don't actually have any RF measurement equipment around, but it could be useful if somebody who has can do some experimentation based on the information I have provided in this message.
On Thu, Jun 18, 2009 at 11:32:55PM +0200, Harald Welte wrote:
If we use the knowledge of the behavior as described above, we can also deduct:
the BS-11 is configured to a NM_ATT_RF_MAXPOWR_R of 0, i.e. it will transmit with the power level that is configured by LMT / ipaccess_config. By default this is set to 30mW
the nanoBTS 900 has 20dBm (1800 is 23dBm) TRX output power. bsc_hack is configured to a NM_ATT_RF_MAXPOWR_R of 12, i.e. 24dB. This means we are transmitting with a mere -4dBm (398uW) or -1dBm (794uW) which would be _really_ low. So either the nanoBTS are not following specs, or we're really transmitting something that would barely be possible to receive. Or my calculations are wrong ;)
I've now also realised that every CHANNEL ACTIVATE message contains a BS power and MS power IE with 0x0f as value, i.e. another 30dB decrease in initial power levels. This really makes me suspicious... at levels that low, everything should never be working. Probably the MS and BTS cannot operate below a certain level, and thus they choose whatever is the minimum level they support.
But that would again disagree with my 'speaker sound level decreases after initial burst and settles on a low level' observation.
So I think there is a lot of experimentation to do for somebody with a somewhat accurate spectrum analyzer or similar equipment.
On Thu, Jun 18, 2009 at 11:58:48PM +0200, Harald Welte wrote:
On Thu, Jun 18, 2009 at 11:32:55PM +0200, Harald Welte wrote:
If we use the knowledge of the behavior as described above, we can also deduct:
the BS-11 is configured to a NM_ATT_RF_MAXPOWR_R of 0, i.e. it will transmit with the power level that is configured by LMT / ipaccess_config. By default this is set to 30mW
the nanoBTS 900 has 20dBm (1800 is 23dBm) TRX output power. bsc_hack is configured to a NM_ATT_RF_MAXPOWR_R of 12, i.e. 24dB. This means we are transmitting with a mere -4dBm (398uW) or -1dBm (794uW) which would be _really_ low. So either the nanoBTS are not following specs, or we're really transmitting something that would barely be possible to receive. Or my calculations are wrong ;)
I've now also realised that every CHANNEL ACTIVATE message contains a BS power and MS power IE with 0x0f as value, i.e. another 30dB decrease in initial power levels. This really makes me suspicious... at levels that low, everything should never be working. Probably the MS and BTS cannot operate below a certain level, and thus they choose whatever is the minimum level they support.
For the BTS I'm still puzzled. For the MS, a power level of 0xf (15) means: 13dBm (19mW) output power in GSM900 and 0dBm (1mW) in GSM1800 - which would probably work well unless there's actual uplink interference on the respective channel.
On Fri, Jun 19, 2009 at 12:05:47AM +0200, Harald Welte wrote:
On Thu, Jun 18, 2009 at 11:58:48PM +0200, Harald Welte wrote:
On Thu, Jun 18, 2009 at 11:32:55PM +0200, Harald Welte wrote:
If we use the knowledge of the behavior as described above, we can also deduct:
the BS-11 is configured to a NM_ATT_RF_MAXPOWR_R of 0, i.e. it will transmit with the power level that is configured by LMT / ipaccess_config. By default this is set to 30mW
the nanoBTS 900 has 20dBm (1800 is 23dBm) TRX output power. bsc_hack is configured to a NM_ATT_RF_MAXPOWR_R of 12, i.e. 24dB. This means we are transmitting with a mere -4dBm (398uW) or -1dBm (794uW) which would be _really_ low. So either the nanoBTS are not following specs, or we're really transmitting something that would barely be possible to receive. Or my calculations are wrong ;)
I've now also realised that every CHANNEL ACTIVATE message contains a BS power and MS power IE with 0x0f as value, i.e. another 30dB decrease in initial power levels. This really makes me suspicious... at levels that low, everything should never be working. Probably the MS and BTS cannot operate below a certain level, and thus they choose whatever is the minimum level they support.
For the BTS I'm still puzzled. For the MS, a power level of 0xf (15) means: 13dBm (19mW) output power in GSM900 and 0dBm (1mW) in GSM1800 - which would probably work well unless there's actual uplink interference on the respective channel.
However, what contradicts this is:
The BCCH never gets 'activated', i.e. we just set the 12.21 CHANNEL ATTRIBUTEs and don't call a 08.58 'ACTIVATE CHANNEL'. 12.21 CHANNEL ATTRIBUTEs don't allow us to set any power level. Thus the TS0 should currently be instructed to transmit at the maximum TRX power.
Since the TRX that carries TS0 cannot employ any power control but has to operate at constant power, the BTS will have to use the highest power of any TS on that TRX.
What we could try is to send a 'BS POWER CONTROL' 08.58 message containing a 'BS POWER' IE for TS0 and see if that further reduces the TRX power. I think especially on the nanoBTS this is desirable, since it's nominal output can not be reduced to 30mW like we can do for the BS-11 with lmt or bs11_config.
Cheers,
On Thu, Jun 18, 2009 at 11:32:55PM +0200, Harald Welte wrote:
12.21 also specifies a 'RF max power reduction' value in 9.4.47. This element can be sent as part of 'SET RADIO CARRIER ATTRIBUTE'. The value in this IE is the 'Pn' value of 08.58. The Scale is 2dB steps, and the maximum value is 255, so there can be a maximum value of 512dB.
08.58 defines Pn as the 'nominal power level', i.e. the level that is not yet reduced by dynamic power control.
As I've now figured, the 'RF max power reduction' element seems to be marked as read-only, i.e. the BSC is not allowed to change it. This means that I was probably reading the specs the wrong way earlier.
It's also weird that all the A-bis traces that I've seen actually try to set that attribute (without any error message).
So if it was read-only, it might well be that this is only indicating the 'maximum possible power reduction', i.e. the limit you can specify for the 'BS power level' IE in the CHANNEL ACTIVATION or other messages.
If we once again combine this with our knowledge, i.e.
BS-11 30mW 15dBm BS-11 80mW 19dBm BS-11 250mW 24dBm BS-11 2W 33dBm nanoBTS 900 20dBm nanoBTS 1800 23dBm
And we set the BS power level in channel activation as 0xf (i.e. -30dB),then we get something like -15dBm for BS-11/30mW and -10/-7dBm for the nanoBTS. That would still be _very_ low.
05.05 Chapter 4.1.2 tells us that a BTS has to support at least six levels of 2dB each power reduction, i.e. -12dB is the minimum it has to support.
-
Harald Welte