OpenBTS Nevada Test Site

David A. Burgess Kestrel Signal Processing, Inc. Faireld, California

OpenBTS is a registered trademark of Kestrel Signal Processing, Inc.

Understanding Um
Um is the GSM subscriber interface. Think ISDN, not WiFi. ~108 kb/s sync serial PHY, TDMd into
logical channels

shared channels for radio management Dm signaling channels (~1.4 kb/s) Bm media channels (~13.5 kb/s)

Presence on Um
Channels are scarce resources. Channel use drains batteries. Channel establishment can take a several
seconds.

Phones go in and out of service routinely.

(GSM 03.02 version 7.1.0 Release 1998)

GSM 2G Core Network

18 ETSI TS 100 522 V7.1.0 (2000-02)

From GSM 03.01. The key pieces: MS - Mobile station. BTS - Base transceiver

subsystem (Um L1/L2). BSC - Basestation controller (L3 RR) MSC - Mobile switching center (L3 CC). HLR/VLR - Location registers (L3 MM). Must have all 5!
BSS: BSC: BTS: Base Station System; Base Station Controller; Base Transceiver Station.

Figure 1: Configuration of a PLMN (not supporting GPRS) and interfaces

OpenBTS

Open-source Um implementation with a pure SIP/ RTP network interface. Manages radio resources internally (no BSCs). Maps mobility management, call control and SMS to SIP operations (no MSCs, H/VLR). Through OpenBTS, GSM handsets appear to VoIP network as SIP endpoints. Through OpenBTS,VoIP network appears to handsets as a GSM carrier.

OpenBTS
USRP RF Analog RF Gear "Um", the GSM Air Interface GSM GSM Handset GSM Handset GSM Handset Handsets

time-tagged USB pckets

Software GMSK Radiomodem

Private IP Network

SIP

smqueue SIP

time-tagged GSM bursts

SIP

SIP SIP, IAX, etc.

Private or Public IP Network

GSM Stack (L1, L2)

soft Abis

Hybrid GSM/SIP Control Layer (L3)

Demo

OpenBTS Advantages
Backhaul GSM through any SIP/IAX carrier. Replace GSM core network with
commodity HW and open source SW.

Minimum viable network is a single cell. Use $5 refurb handset as a wireless VoIP
terminal.

Installation/management similar to WISP. Open source (GLPv3, others available).

Where to test Um?

Some things are hard to simulate. physical propagation heavy loads from many handset models Need an open-air range with ready users. Q: Where? CONUS? A: If you have a sense of humor, try Black
Rock City, NV

Fabulous Black Rock City

Aerial view of 2009 Burning Man site: 3 km wide, 43,000 people, 1 week.

The Road to BRC

Experimental license WD9XSP from FCC. Spectrum consent from Verizon (GSM850, A-block). Camp placement (Papa Legba, 4:30&H), early access. PSTN gateway from Link2VoIP; iNum gateway from Voxbone. Static IP and backhaul from Playanet. Discussions with BMOrg about social aspects.

Planned Services
Auto-provisioning via SMS. Local SMS and speech calls. SMS gateways to iNum and e-mail. Speech gateways to iNum and PSTN. Expected service radius of about 1.5 miles
within BRC, >10 miles in the open desert.

Voxbone/iNum Integration
Assigned a block of 10,000 +883 DIDs. Assigned these DIDs to handsets. Routed +883 calls to Voxbone SIP speech
gateway.

Routed +883 SMS to Voxbone RFC-3428

SIP messaging gateway.

Radio Hardware
Pelican Case

Power Amp (40 dB, 10 W)

USRP + 2 RFX900 w/clock Duplexer (70 dB)

Mini-ITX 1.6 GHz Atom

LNA (40 dB)

Uplink BPF (90 dB)

Power Buses (GND, +6, +12)

Power System
1.8 kW generator (run as needed) gasoline/petrol (~7 kWh/gal useful) BTS units (180 W total)

6 kWh battery bank

inverter for "ops center" (200 W total)

720 W charger

The Wildcard

Aerial photo of the Comnnet Wireless site at Frog Pond.

Days 1,2: High Wind and Hard Ground

Due to high winds, tower work was delayed for safety. C B A 70 (21 m) tower Had a tough time driving guyline stakes into the playa clay.

Wind nearly took our shelter. John saved us with extra tiedown straps.

IP Network
X
Asterisk & smqueue 206.158.7.144 Ubiquity NS5 BTS Consoles Payanet backbone (206.158.7.224) DMZ "3:00" tower "Fusion Valley"

In-camp LAN (192.168.10.255) BTS A

BTS B WRT54G BTS C microwave relay chain to Sparks, NV

Public internet

PAP2 In-camp WLAN for public use (192.168.20.255)

GSM Network
10:00

Lin Ki eag n e Ju shi p r In ass he ic Ho rit Ge min Fo nom id Ex ssil e DN tinc t Ch A Bi aos olo Ad ap g y t

2:00

pla

9:00

Plaza

Es

9:30

C B
Ev
Center Camp

Walk-In Camping Area

na d

2:30

Plaza

3:00

8:30

3:30

8:00

4:00

ut

io n

X
4:30
Walk-In Camping Area

ol

7:30

7:00 6:30

5:00 6:00

Landing Strip

BLACK ROCK CITY 2009

5000'

A
5:30

1500m

Days 3-6: Cong & Debug

Handsets attempt to
L1, L3 & smqueue. register in droves. DOS, but expected.

Found/xed several bugs in Several cong adjustments. Managed high loads with
power adjustments.

Days 7-9: Running. Mostly.

Trading phones with Commnet Wireless
produces high registration loads.

Asterisk registry hangs sometimes. Should

have tried real-time extensions & SQL.

Playanet is up and down. DNS problems. Forgot to check water in batteries. Love
that low-voltage alarm at 4 am.

System is running most of the time.

Service Radius Over BRC

Propagation inside BRC follows Hata suburban model.
RACH Timing Offset in Symbols (1 symbol = 500 meters range)
300000

Esplanade Far edge of BRC

225000

150000

75000

-1

unit A

unit B

unit C

Service Radius Over BRC

99% @ 3 km
10:00

Lin Ki eag n e Ju shi p r In ass he ic Ho rit Ge min Fo nom id Ex ssil e DN tinc t Ch A Bi aos o Ad log ap y t

2:00

Es p

lan

ad

90% @ 2km
2:30

Walk-In Camping Area

9:30

9:00

Plaza

Plaza

3:00

8:30

50% @ 1km
Center Camp

3:30

8:00
Ev

4:00

ut

io n

X
4:30
Walk-In Camping Area

ol

7:30

7:00 6:30 5:30

5:00 6:00

Landing Strip

BLACK ROCK CITY 2009

5000'

1500m

Service Radius Beyond BRC

Propagation outside BRC follows Hata open rural model: much longer range.
RACH Timing Offset in Symbols (1 symbol = 500 meters)
500

gate road & Hwy 34 ???

375

Text

Gerlach, NV

250

125

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

unit A

Day 10: Teardown, Packing

Thanks to Heavy Equipment Camp and DPW! Pulling the guy line stakes was even harder than driving them.

Successes
Hardware and packaging satisfactory. Coverage slightly better than predictions. Mobility strategy worked. Provisioned ~1,300 users via SMS. Connected ~1,000 PSTN calls. Delivered ~270 user-to-user SMS (and
~3,800 other non-user SMS).

Lessons Learned (SW) Presence vs. load will be trade-off. Use realtime SQL-based registry for
autoprovisioning.

Avoid DNS and reverse DNS. Automatically adjust downlink power to

control load. for SMS.

Try HTTP gateway with SMTP return

Lessons Learned (Users)

Most burners dont want inbound calls. Temporary DIDs are not useful if the CLID cant be used for direct call return. Ditto for SMS origination address. Most users dont pay attention to their phones network selection. Time-limiting calls controls load, prevents abuse and preserves Playa social environment. Usage loads much smaller than expected. (For Commnet, too.) Registration is a bigger load.

Lessons Learned (HW)

Narrow beam wi BH works ... if you keep
the nodes powered.

New batteries are not ready-to-use. Positive-pressure ltered fan is OK, but
need a better lter medium for BRC. min with marine pole mast.

Could reduce omni cell setup time to <30

Thanks to...
Harvind Samra (the other half of KSP) John Gilmore, Martin Pelayo Arturo Mayorga Cerda & Victor de Leon Alon Levy Voxbone Pavel Antokolsky, William Alexander Many others

More Information
http://openbts.sourceforge.net http://gnuradio.org/trac/wiki/OpenBTS http://www.kestrelsp.com/OpenBTS.html http://openbts.blogspot.com