See discussions, stats, and author profiles for this publication at: https://www.researchgate.net/publication/283594716 Capturing, recording, and analyzing LTE signals using USRPs and LabVIEW Conference Paper · June 2015 DOI: 10.1109/SECON.2015.7132939 CITATIONS READS 7 3,932 2 authors: Nadisanka Rupasinghe Ismail Guvenc Samsung North Carolina State University 34 PUBLICATIONS 665 CITATIONS 438 PUBLICATIONS 14,143 CITATIONS SEE PROFILE Some of the authors of this publication are also working on these related projects: Non-Orthogonal multiple access for drone based communication networks View project Towards UAV Assisted 5G Public Safety Networks View project All content following this page was uploaded by Nadisanka Rupasinghe on 07 February 2018. The user has requested enhancement of the downloaded file. SEE PROFILE +-IEEE Proceedings of the IEEE SoutheastCon 2015, April 9 - 12, 2015 - Fort Lauderdale, Florida Capturing, Recording, and Analyzing LTE Signals Using USRPs and Lab VIEW Nadisanka Rupasinghe and ismail Giiven� Department of Electrical and Computer Engineering, Florida International University, Miami, FL 33174 Email: { rrupaOOl, iguvenc } @fiu.edu Abstract-Long Term Evolution (LTE) systems are currently playing a major role in catering the ever increasing traffic demand. Better performance and better throughput compared to other mobile communication technologies are main objectives of LTE deployments. To provide a better quality of experience, LTE signals from real base stations should be captured and analyzed, for possibly making adjustments to network operation parameters, or for deploying new base stations. In this paper, real LTE signals from the base stations are recorded using universal software radio peripheral (USRP) devices and NI LabVIEW software. Then, these recorded LTE signals are processed and an­ alyzed in MATLAB to identify information such as primary cell identifier (PCI) and master information block (MIB). LabVIEW and MATLAB graphical user interfaces (GUIs) are provided to make the system more user friendly. Index Terms-LTE, Universal software radio peripheral (USRP), primary synchronization signal (PSS), secondary syn­ chronization signal (SSS), software defined radio (SDR), Zadoff­ Chu sequence. I. IN TRODUC TION With the emergence of new wireless applications and de­ vices, the demand for radio spectrum has been dramatically increasing over the last decade. Cisco has recently predicted an 11-fold increase in global mobile data traffic between 2013 and 2018 [1], while Qualcomm has predicted an astounding 1000x increase in mobile data traffic in near future [2]. It is obvious that the 4G broadband Long Term Evolution (LTE) and its foreseen 5G successor will be the dominant technologies to keep up with the emerging traffic demand. While satisfying this increasing traffic demand, it is essential to provide a better quality of experience to users by optimizing network parameters. This can be achieved through drive tests [3]-[8], through careful monitoring of LTE signals in the field, and by modifying network parameters to improve QoS [9]-[11]. In order to monitor LTE signals, there are tools available in the market [12], [13]. However most of these tool are very expensive, and service support for maintenance and software upgrades adds extra cost. There are also some open source tools available for analyzing LTE signals [14]-[17]. They use RTL-SDR, HackRF and BladeRF to capture LTE signals. In [14], open source software tools to locate and track LTE cells have been introduced, using very low performance RF front ends such as RTL-SDR [18] based dongles (E4000, This research was supported in part by the U.S. National Science Founda­ tion under the grants CNS-1406968 and AST-1443999. 978-1-4673-7300-5/15/$31.00 ©2015 IEEE R820T, etc.) with a noise figure of 20 dB and only 8 bits in the AID. However, due to the processing power limitations of RTL-SDR, it is difficult to further enhance this open source tool. The gr-lte project implemented in [15] is an open source software package which aims to provide a GNU radio LTE receiver to receive, synchronize and decode LTE signals. There are different modules in this project, to achieve different functionalities in LTE signal reception. With this package, capabilities of GNU radio can be extended to LTE related implementations. libLTE, an open-source LTE library introduced in [17], does not rely on any external dependencies or frameworks. This library contains a set of Python tools for the automatic code generation of modules for popular soft­ ware defined radio (SDR) frameworks, including GNURadio, ALOE++, IRIS, and OSSIE. However, several incompatibility issues were encountered when installing these software tools which limits ease of use and reliability. In this paper, we introduce a reliable and low cost LTE signal monitoring tool which can be used either in academia or industry, with universal software radio peripheral (USRP) devices and MATLAB. For recording LTE signals, NI USRP is used. A LabVIEW virtual instrument (VI), LTE Signal Recorder, is developed to achieve this task. For analyzing recorded LTE signals, a MATLAB GUI, LTE Signal Analyzer, is developed to provide user friendly access to the MATLAB implementation. The rest of the paper is organized as follows. In Section II, we provide details about LabVIEW VI implementation for capturing LTE signals using USRP. Then in Section III, MATLAB implementation for analyzing various information in recorded LTE signals, is presented. Section IV discusses observed results and possible future extensions. Finally, Sec­ tion V provides concluding remarks. II. LTE SIGNA L RECORDING USING USRP NI USRP [19] is a low cost, reliable solution for advanced SDR related implementations. In this paper, USRP devices are used for capturing real LTE signals. As can be seen from Fig. 1 and Fig. 3, using Nl LabVIEW software, a VI is developed to capture LTE signals using USRPs (LabVIEW code can be downloaded from [20]). Synchronization signals and master information block (MIB) are transmitted in central 6 resource blocks (RBs) in LTE [21] and to identify and attach to a LTE cell, a user equipment (UE) has to decode these signals. "IEEE Proceedings of the IEEE SoutheastCon 2015, April 9 - 12, 2015 - Fort Lauderdale, Florida session handle out Filename IM1 Coerced parameters o coerced carrier frequency r gain IQrate coerced � 10M r Carrier frequency �915M gain � 10 Number of samples active antenna IRX1 Fig. 1: LabVIEW front panel of LTE Signal Recorder. Radio Frame: 10 ms bandwidth of 1.4 MHz. For that much of bandwidth, FFT size ( N pPT ) of 128 has to be considered. Since N pPT should be in the form 2X where x E Z, x 7 is selected as the optimum FFT value for 1.4 MHz bandwidth. If x 6 is selected, only 64 sub-carriers would be utilized, wasting the scarce spectrum resources. However, with the NFFT of 128, actual bandwidth requirement (if all 15 KHz sub-carriers are transmitting) equals to 128 x 15 KHz 1.92 MHz which exceeds allocated 1.4 MHz bandwidth. To overcome this issue, only 72 sub-carriers are utilized and rest of the 56 sub-carriers are set to zero. This will ensure that there won't be any spectral leakage to the adjacent bands from the LTE transmission. In LTE, at least about 200 KHz of bandwidth is padded with zeros due to spectral mask constraints. In an OFDM based communication system, time duration between two adjacent samples in an OFDM symbol (T��ri�n can be given as, = = = Dsss .pss Slot: 0.5 ms Fig. 2: LTE FDD frame structure, and locations of PSS and SSS signals within the radio frame. A. Derivation of Sampling Frequency samples TOPDM (fs) In LTE, with normal cyclic prefix, OFDM symbol duration (TOPDM) is approximately 71.4 fJs [21]. This is fixed and will not be changed with different transmissions bandwidths (i.e., FFT sizes). For an example, TOPDM is same for FFT sizes of 2048 and 128. From that it can be understood that duration between two samples in an OFDM symbol varies with FFT size. Hence, with different bandwidths, it is required to sample the medium with different sampling frequencies (fs). When a UE searches for an LTE network, it will consider only the central 6 RBs that carry the synchronization signals (see Fig 2). That means that the synchronization signals, regardless of the transmission bandwidth, are carried in a _ - 6.1 1 X NFFT' where 6.1 is the sub-carrier spacing. In LTE, 6.1 and hence for 1.4 MHz of bandwidth Is is Is = 128 x 15 KHz = 1.92 MHz. (1) = 15 KHz (2) To capture data in central 6 RBs, the medium has to be sam­ pled with this rate irrespective of the actual system bandwidth. B. Capturing and Recording LTE Signals with USRP and Lab VIEW Fig. 1 and Fig. 3 show the front panel and the block diagram of the developed LTE Signal Recorder VI in LabVIEW which +-IEEE Proceedings of the IEEE SoutheastCon 2015, April 9 - 12, 2015 - Fort Lauderdale, Florida Filename Device names session handle out error out � stop Ig � active antenna Fig. 3: LabVIEW block diagram of LTE Signal Recorder. is used to capture LTE signals using USRP. In the front panel, the user has to set desired center frequency, I/Q rate, gain, and number of samples per fetch. Below, a brief explanation about each of these parameters are provided. • File Name: Collected I/Q data are saved in an CSV file. User can define the name of that file using this parameter. • Device Name: IP address of the USRP which is used to record LTE signals. • I1Q Rate: This is the sampling rate Us) to capture primary synchronization signal (PSS), secondary syn­ chronization signal (SSS) and physical broadcast channel signals. As derived in Section II-A, this is 1.92 MHz. • Carrier frequency: Center frequency of the LTE trans­ mission to be recorded is set using this parameter. • Gain: This is the gain introduced by the USRP. • Number of samples: This much of samples will be fetched from USRP Rx buffer and written to comma separated values (CSV) files. If the sampling rate is too high and number of samples fetched during one access is low, there is a chance of experiencing buffer overflow issue. Hence, this value should be selected carefully. • Active antenna: The antenna which is used to record LTE signals by the USRP. III. ANA LY ZING LTE SING ALS WITH MATLAB In this section, details about PSS and SSS detection and PBCH decoding processes are briefly explained. After that, the implementation details of each of these processes are presented. Fig. 4 shows the developed MATLAB GUI, to make the system user friendly. A. PSS/SSS Detection In order to extract data from LTE reference signals, first step is to synchronize in to the LTE cell. There are three major synchronization requirements in LTE [21J. II Select Center Frequency PSS SSS PCI [OJ [6OJ � RBs � Fig. 4: CP Rx Power level GmaQ §392""dBJ Antenna Ports SFN IT] � MATLAB GUI of LTE Signal Analyzer. Acquiring symbol and frame timing. So that it is possible to identify the correct symbol start position. • Carrier frequency synchronization. This is to reduce or eliminate the effect of frequency errors arising from a mismatch of the local oscillators between the transmitter and the receiver and also due to the Doppler shift caused by any UE motion. • Sampling clock synchronization For synchronization procedure in LTE, two specially de­ signed physical signals are used: 1) Primary synchronization signal, and 2) Secondary synchronization signal. In order to achieve time and frequency synchronization with the LTE cell [22], proper detection of these two signals are very important. In addition, from this synchronization procedure, it is possible to detect cyclic prefix length and duplexing mode (frequency division duplex (FDD) or time division duplex (TDD)) used by that cell. 1) PSS Sequence Detection [21J: The PSS is generated by using frequency domain Zadoff-Chu (ZC) sequence of length 63, with the middle element punctured to avoid transmitting on the d.c. subcarrier [21J. Fig. 5 shows ZC sequence mapping • +-IEEE Proceedings of the IEEE SoutheastCon 2015, April 9 - 12, 2015 - Fort Lauderdale, Florida to sub carriers to generate a PSS sequence. Fig. 5: PSS mapping of a length-63 ZC sequence into the central 62 sub-carriers in LTE [23]. Fig. ZC sequence are also know as Generalized Chirp-Like (GCL) sequences. These ZC sequences are non-binary unit­ amplitude sequences and satisfy the property of Constant Am­ plitude Zero Autocorrelation (CAZAC) [24]. Hence DFT of a ZC sequence also has a constant amplitude limiting the peak­ to-average-power ratio. Further, ZC sequence of any length has ideal cyclic autocorrelation. These properties have made ZC sequences to be selected in achieving LTE synchronization. Three PSS sequences can be selected in LTE based on the three possible ZC roots, M E 29,34,25. For a selected ZC root M, frequency domain length-63 ZC sequence can be written as, . ZCM(n)=exp[-J 63 7rMn(n + 1) ],n=0.1. . . . ,62, (3) 63 here n is the sub-carrier index where each element of the PSS will be mapped. PSS has to be detected without any prior knowledge of the channel. Hence, a maximum likelihood detector is used for non-coherent correlation for identifying the timing offset m'M with the maximum correlation, as follows: m'M = arg m�x l %1 I Y[i + m]S'M[i] , (4) where i is time index, m is the timing offset, N is the PSS time-domain signal length, Y[i] is the received signal at time instant i and SM[i] is the PSS with root M replica signal at time i which is defined by (3) in the frequency domain. An important thing to note here is that, ZC sequences show similar type of correlation behavior both in the frequency domain and as well as the time domain [25], [26]. 2) SSS Sequence Detection {2lj: The SSS sequences are based on maximum length sequences (also known as M­ sequences), which is generated by cycling through every possible state of a shift register of length n. Each SSS sequence is constructed by interleaving, in the frequency domain, two 6: Resource element allocation for PSS, SSS, PBCH and Reference Signals within 1 ms in one of the 6 central resource blocks. length-31 BPSK modulated secondary synchronization codes. Because of these two codes, it is possible to determine the 10 ms radio frame timing from a single observation of an SSS. SSS detection is carried out after non-coherent PSS detec­ tion. Therefore, by assuming channel is not varying signifi­ cantly, channel state information from PSS can be used for coherent detection of SSS (S') as follows [21]: S'= arg mjn N (,8 ly[n]- s[n,n]hnl ) , (5) where y and S represent received signal vector and candidate SSS sequence matrix (diagonal), respectively, and h represents estimated channel coefficients from the PSS detection. B. Determination of Physical Cell ID Using PSS and SSS There are 504 unique physical-layer cell IDs in the LTE system. The cell IDs are grouped into 168 unique cell ID groups, and each group contains three unique sector numbers. A physical layer cell identity (PID) can be defined as, ID= 3 NsIDSS R X + NPSS ID (6) Here, NI�S is the cell ID group which is a value between 0 to 167 and identified through SSS sequence and Nross cell ID which is a value between 0 to 2 and corresponds to ZC root indices (25,29,34). Once the ZC root index is identified through non-coherent detection, that can be used to identify the corresponding NfDSS [22]. C. Physical Broadcast Channel (PBCH) Decoding In cellular systems, the basic system information (SI) re­ quired for the other channels in the cell to be configured and operated is usually transmitted through Broadcast CHannel (BCH). LTE also utilizes BCH to achieve this task. There are two categories of SI transmitted by LTE cells [21]. +-IEEE Proceedings of the IEEE SoutheastCon 2015, April 9 eRe '----.....,r-L----' " MIB with 16 bit eRe " 1920 bits , Four equal-sized individually decodable units Fig. 7: MIB generation in LTE systems. - 12, 2015 - to receive the other parts of MIB within 40 ms time duration. But if the SIR is low, the UE can receive more parts of the MIB transmission, and can implement soft-combining of each part with those received already, until successful decoding is achieved [21]. The number of transmit antenna ports used by the eNodeB is also determined by UE through space-frequency block code (SFBC) decoding which corresponds to different possible number of transmit antenna ports. Once 24 MIB bits (IMIB) (14 information bits and 10 spare bits) are decoded successfully, system bandwidth is determined as follows: RefBw The "Master Infonnation Block" (MIB), which consists of a limited number of parameters which are essential for initial access to the cell. This is carried on the Physical Broadcast CHannel (PBCH) (see Fig. 6). • The other System Information Blocks (SIBs) which are transmitted along with the physical downlink shared channel (PDSCH). MIB which is broadcasted through PBCH, carries three essential system information. They are [27]: • System bandwidth • System Frame Number (SFN) • Physical Hybrid Automatic Repeat Request (HARQ) In­ dicator Channel (PRICH) Configuration PBCH transmission is based on a fixed coding and modula­ tion scheme. After the initial cell search and synchronization procedure, UE decodes PBCH and extract MIB data. With the information obtained from the MIB, the UE can decode the control format indicator (CFI), which indicates the physical downlink control channel (PDCCH) length. Then, UE uses this infonnation to decode PDCCH. The presence in the PDCCH of a downlink control information (DCI) message scrambled with system infonnation radio network temporary identifier (SI-RNTI) indicates that a SIB is carried in the same sub­ frame. The SIB is transmitted in the broadcast control logical channel (BCCH). Generally, BCCH messages are carried on the downlink shared channel (DL-SCH) and transmitted on the physical downlink shared channel (PDSCH). The format and resource allocation of the PDSCH transmission is indicated by the DCI message on the PDCCH. Hence, successful decoding of the PBCH is extremely important to gain access to an LTE cell. As PBCH has to be detected without prior knowledge of the system bandwidth, it is mapped to the central 72 subcarriers (central 6 REs) of the OFDM signal. As can be seen from Fig. 7 that a large number of overhead bits are added to the 14 bit MIB data. This will provide a better forward error correction (FEC) capability at the UE. This MIB data is segmented in to four individually­ decodable parts as shown in Fig. 7 and transmitted in PBCH for a time duration of 40 ms. The data rate of the PBCH is low and equals to 350 bps. If the signal to interference ratio (SIR) is good and it is possible to decode the MIB correctly from the transmission less than 40 ms period, there is no need • Fort Lauderdale, Florida = 4 x IMIB(l) + 2 x IMIB(2) + IMIB(3), (7) where, 1MIB(i) is the ith bit in the MIB, RefBW E {O, 1,2,3,4, 5 } , and RefBw 0 corresponds to 1.4 MHz or 6 RB LTE transmission. Accordingly, other values in RefBw correspond to 3,5,10,15,20 MHz of bandwidth respectively. Based on the value of the 4th MIB bit IMIB(4), PRICH duration is determined. If IMIB(4) 1, PRICH duration is Extended; otherwise it is Normal. To identify PHICH resource type, IMIB(5) and IMIB(6) are used. Finally, SFN is detected by using 8 MIB bits, from IMIB(7) to IMIB(14). = = D. Extracting Samples from the Recorded Data for PSS/SSS Detection and MIB Decoding As discussed in Section III-A, through PSS/SSS detec­ tion, symbol and frame timing acquisition can be achieved. Using PSS and SSS, PCI can also be identified. Further, PSS, SSS detection will enable frequency synchronization and sampling clock synchronization. Once synchronization is achieved, PBCH decoding can be carried out. As explained in Section III-C, MIB information is distributed in 40 ms time duration and hence to decode PBCH and identify MIB data it is required to extract at least 40 ms of data. With a sampling rate of 1.92 MHz, number of samples recorded during slot duration (N:l�,;,ples) is Nslsaotmples = 1 · 92 X 106 x 0.5 X 10-3 = 960. (8) Hence, number of samples required for capturing 40 ms of samples) .IS data (N40 ms Nl��les = 960 x 2 x 40 = 76800 (9) This much of samples (Nl��les) from the recorded data should to be extracted for decoding MIB. However, in the paper, 80 ms of data is extracted for better reliability. There­ fore 153,600 samples will be extracted from collected data for analyzing in MATLAB. E. Analyzing Recorded Data in MATLAB In this section, explanation about MATLAB implemen­ tations on how to extract infonnation from recorded data, is provided. When implementing previously discussed func­ tionalities, MATLAB implementations provided in [14] were closely followed. As explained in Section III-D, extracted 153,600 samples will be correlated with 3 possible PSS sequences. Each PSS +-IEEE Proceedings of the IEEE SoutheastCon 2015, April 9 - 12, 2015 - Fort Lauderdale, Florida TABLE I: Information from a detected LTE cell. Parameter Center frequency PSS SSS PCI CP type Rx Power level No. of RBs No. of antenna ports SFN Value 739 MHz o 60 180 Normal -60.8392 dB SO 2 698 -5 8 Fig. 8: Setup inside MPACT Lab. LTE signals are captured using NI USRP and LabVIEW software, and analyzed using MATLAB. sequence with 15 different frequency offsets will be used to achieve higher accuracy. PSS is incoherently detected where no prior knowledge about the channel is assumed. More details regarding PSS identification can be found in MATLAB functions xcorr -pss. m and peak_search. m. After PSS is successfully detected, the MATLAB function sss_detect. m performs SSS detection. In that, first, channel response is identified using the detected PSS sequence. After that, coherent detection to identify transmitted PSS sequence, is carried out. Finally the MATLAB function sss_detect. m provides detected PSS sequence, cyclic prefix type and the starting position of the frame. This starting position is the starting of the cyclic prefix of that OFDM symbol. Hence, for FFT operation, samples should be extracted from eliminating number of cyclic prefix samples from this starting position. Frequency offset is calculated using the MATLAB function pss_sssJoe. m after successfully identifying PSS and SSS sequences of the LTE transmission. With all these information, time/frequency grid is created while correcting frequency offset and time offset using MATLAB functions extracctjgm and tjoec.m, for further processing of collected samples to identify MIB information. Finally, by using the MATLAB function decode_mib.m, MIB data is extracted. Within this function, as described in Section III-C, first, number of transmit antenna ports are determined using trial and error approach. This approach in­ volves demodulation, unscrambling, de-rate matching, viterbi decoding and cyclic redundancy check (CRC) processing. Detected bit sequence with proper CRC decoding will be identified as the MIB information (24 bits). After that, as explained in Section III-C, number of resource blocks in the transmission, SFN and PHICH information will be extracted. IV. RESULTS DISCUSSION AND FUTURE EX TENSIONS In this paper, AT&T downlink LTE transmission within the frequency range of 734 - 744 MHz, with the center frequency of 739 MHz is recorded using USRP as explained in Section II. System setup inside MPACT Lab, which is located in the Engineering Center of flU, is shown in Fig 8. Table I sUlmnarizes information from a detected LTE cell inside the MPACT Lab. Full detection of PSS, SSS and MIB can be -60 Detected PSS peak iii' -62 :!:!. -64 :; c. :; -66 0 '0 -68 .2! '" -70 � 0 u X: 4557 Y:-60.84 -72 -74 1000 Fig. 9: 2000 3000 4000 5000 6000 OFDM sample index 7000 8000 9000 Detected first PSS OFDM location in the recorded LTE samples. achieved with the developed MATLAB program. However, note here that if the signal to interference plus noise ratio (SINR) is not acceptable it is difficult to decode MIB data. From Fig. 9, the detected first PSS sequence carrying OFDM symbol can be identified. Here, the value 4557 is the starting sample of the 7th OFDM symbol in oth slot of a sub-frame. Fig. 10 shows coherent detection output for SSS, as used in (5). As mentioned in Sections III-E and III-A2, SSS detection is coherent and channel response is determined through detected PSS sequence. There are several future extensions that can be introduced to this paper to make it more useful. Firstly, to make this more user friendly it is convenient to move everything to LabVIEW. All the MATLAB codes used here can be implemented using � 10 30 :!:!. in 28 26 Fig. 10: SSS coherent detection output. +-IEEE Proceedings of the IEEE SoutheastCon 2015, April 9 LabVIEW MathScript RT modules. Once MATLAB imple­ mentations are moved to LabVIEW, it is possible to start capturing and analyzing LTE signals real time. At the moment, LTE signal analysis is not done in real time and LTE signals are recorded first using NI USRP and then analyzed using MATLAB. Further, if GPS signal decoding VI can be integrated to this LabVIEW project, the new system can be used for drive testing purposes where LTE signals can be captured and analyzed for mobile equipment. At the moment, this system can capture only one LTE cell. It can be easily extended to capture more than one LTE cell simultaneously. Also, the current version has to provide central frequency of the LTE transmission which we are interested to analyze. Instead, it can be extended to automatically scan frequencies within a given frequency range for ease of operation. After implementing the features mentioned here and introducing common reference signals decoding, it is possible to demodulate signal strength indicators, and make drive tests to obtain a data base of coverage areas from different LTE base stations. As mentioned earlier, even though there are products in the market to capture and analyze LTE signals real time, they are very expensive. From the solution proposed in the paper, a reliable, cost effective LTE signal scanner can be developed. V. CONCLUDING REM A RKS In this paper, a novel LTE signal recording and analysis approach is introduced. To record LTE signals, NI USRP device is used. Those recorded signals are then analyzed in MATLAB. PSS, SSS and MIB information could successfully be decoded from the recorded data. With further extensions, it is possible to use this system as a drive testing tool to capture and analyze LTE signals in real time. ACKNOWLEDGMEN T The authors would like to thank the REU students Alex Per­ domo and Sami Elkabli for fruitful discussions on LabVIEW implementation of the LTE signal reception codes. REFERENCES [1] Cisco, "Cisco visual networking index: global mobile data traffic fore­ cast update, 2013-2018," Feb. 2014, White Paper. [2] Qualcomm, "The 1000x mobile data challenge: more small cells, more spectrum, higher efficiency," Nov. 2013, White Paper. [3] B. Haider, M. Zafrullah, and M. K. Islam, "Radio Frequency optimiza­ tion & QoS evaluation in operational GSM network," in Proc. World Congress on Engineering and Computer Science, vol. 1, Oct. 2009. [4] J. Zhang, J. Sun, and D. Yang, "Application of drive test for QoS evaluation in 3G wireless networks," in Proc. Int. Conf. on Communi. Techno. (ICCT ), vol. 2, Apr. 2003, pp. 1206-1209. [5] A. Rufini, A. Neri, F. Flaviano, and M. Baldi, "Evaluation of the impact of mobility on typical KPls used for the assessment of QoS in mobile networks: an analysis based on drive-test measurements," in Proc. Int. Telecommun. Network Strategy and Planning Symp., Sep. 2014, pp. 1-5. [6] I. Kostanic, N. Mijatovic, and S. Vest, "Measurement based QoS comparison of cellular communication networks," in Proc. IEEE Int. Workshop Technical Committee on Communi. Quality and Reliability, May 2009, pp. 1-5. [7] W. Jiao, H. Yiling, W. Zaixue, and Y. Dacheng, "A Novel model of drive test data processing in wireless network optimization," in Proc. IEEE Int. Symp. on Personal, Indoor and Mobile Radio Communi. (PIMRC), Sep. 2006, pp. 1-4. View publication stats - 12, 2015 - Fort Lauderdale, Florida [8] J. Matamales, D. Martin-Sacristan, J. Monserrat, and N. Cardona, "Performance assessment of HSDPA networks from outdoor drive-test measurements," in Proc. IEEE Vehic. Tee/mol. Con! (VTC Spring), Apr. 2009, pp. 1-5. [9] F. Chemogorov and J. Puttonen, "User satisfaction classification for minimization of drive tests QoS verification," in Proc. IEEE Int. Symp. on Personal Indoor and Mobile Radio Communi. (PIMRC), Sep. 2013, pp. 2165-2169. [IO] F. Chernogorov and T. Nihtila, "QoS verification for minimization of drive tests in LTE networks," in Proc. IEEE V ehic. Technol. Conf. (VT C Spring), May 2012, pp. 1-5. [11] M. Yosra, A. Ayari, M. Ayadi, and S. Tabbane, "A novel approach for mobile network QoS evaluation," in Proc. Int. Symp. on Networks, Computers and Communi., June 2014, pp. 1-6. [12] BV Systems, "YellowFin LTE 4G Analyzer." [Online]. Available: http://www.bvsystems.comlProductslWiMAXlYellowFin-LTE/ yellowfin-Ite.htm [13] Rohde & Schwarz, "High-performance RF testing for LTE TDD and LTE FDD." [Online]. Available: http://www.rohde-schwarz.comlenl solutions/wireless-communications!lte/products/products_53604.html [14] "Evrytania LTE cell scanner/tracker," 2012. [Online]. Available: https://github.comlEvrytaniaiLTE-Cell-Scanner [IS] "GNU radio LTE receiver," 2014. [Online]. Available: https://github. comlkit-cellgr-Ite [I6] "Lte Cell Scanner," 2013. [Online]. Available: https://github.com/ JiaoXianjunILTE-Cell-Scanner [17] "libLTE," 2014. [Online]. Available: https://github.com!libLTE/libLTE/ blob/masterlREADME.md [18] "RTL-SDR.COM." [Online]. Available: http://www.rtl-sdr.coml about-rtl-sdr/ [I9] National Instruments, "NI USRP." [Online]. Available: http://www.ni. comlsdr/usrp/ [20] "LTE Signal Recorder," 2014. [Online]. Available: http://www.mpact. fi u.edu/data -management! [21] S. Sesia, I. Toufik, and M. Baker, LT E : From T heory to Practice, 2nd Edition. John Wiley and Sons Ltd, 2011. [22] R. Buvaneswaran and S. Sriknath, "Cell search and uplink synchroniza­ tion in LTE," Int. Journal of Scientific and Engineering Research, vol. 4, May 2013. [23] Zhongshan Zhang, Jian Liu, and Keping Long, "Low-complexity cell search with fast PSS identification in LTE," IEEE Trans. on Vehic. T echno., vol. 61, no. 4, pp. 1719-1729, May 2012. [24] B. Popovic, "Generalized chirp-like polyphase sequences with optimum correlation properties," IEEE Trans. on Information Theory" vol. 38, no. 4, pp. 1406-1409, Jul. 1992. [25] J.-1. Kim, J.-S. Han, H.-J. Roh, and H.-J. Choi, "SSS detection method for initial cell search in 3GPP LTE FDDITDD dual mode receiver," in Int. Symp. Communi. and Info. Tee/mol., Sep. 2009, pp. 199-203. [26] A. Donarski, T. Lamahewa, and J. Sorensen, "Downlink LTE synchro­ nization: A software defined radio approach," in Proc. 8th Int. Con! on Sig. Processing and Communi. Sys. (ICSPCS)" Dec 2014, pp. 1-9. [27] MatLab, "Cell Search, MIB and SIB1 Recovery." [Online]. Available: http://www.mathworks.comlhelp!lte/examples/ cell-search-mib- and-sib1-recovery.html