LTE Spectrum Sharing Research Testbed: Integrated Hardware, Software, Network and Data

LTE Spectrum S haring Resea rch Testbed: Integrated Hardwar e, Software, Netw ork and Data* Vuk Marojevic Bradley Department of E lectrical and Computer Engineering Virginia Tech, Blac ksburg, VA, USA maroje@vt.edu Randall Nealy Bradley Department of E lectrical and Computer Engineering Virginia Tech, Blacksburg, V A, USA rnealy@vt.edu Jeffrey H. Reed Bradley Department of E lectrical and Computer Engineering Virginia Tech, Blacksburg, VA, USA reedjh@vt.edu ABSTRACT This 1 paper presents Virginia Tech’s wireless testbed supporting research on long-term ev olution (LTE) signaling and radio frequency (RF) spe ctrum coexistence. LTE is continuously refined and new features released . As the communications contexts for LTE expand, new research problems arise and include operation in harsh RF signaling envir onments and coexistence wi th other radios. Our testbed provid es an integrated research tool for investigating these and other research pro blems; it allows analyzing the severity of th e problem, designing and rapidly prototyping solutions, and assessing them with standard- compliant equipment and t est procedures. Th e modular testbed integrates general-purpose software-defined radio hardware, LTE- specific test equipment, RF components, free open-source and commercial LTE software, a configurable RF network and recorded radar waveform samples . It supports RF c hannel emulated and over-the-air radia ted modes. The testbed can be remotely accessed and configured. An RF switching network allows for design ing many differ ent experiments t hat can involve a variety of real and v irtual radios with support f or multiple-input multiple-output (MIMO) an tenna operation. We present t he testbed, the research it has enabled and some valuable lessons t hat we learned and that may help designing, developing, a nd operating future wireless testbeds. KEYWORDS Long-term evolution (L TE), te stbed, software-defined radio, spectrum sharing 1 INTRODUCTIO N Long-term e volution (LTE) has become t he standard for fourth generation (4G) mobi le communications. LTE has been deployed in many parts of the world and allows true broadband wireless communications services on the move. Whereas the fundamental concepts of LTE, as standardized by the 3 rd Generation Partnership Project (3GPP) in Rele ase 8 (Rel. 8), are well * This is the author's version of the work. It is posted here for your personal use. Not for redistribution. For citation purpos es, the definitive Ver sion of Rec ord is: V. Marojevic, R. Nealy, J.H. Reed, “LTE s pectrum sharing research testbed: integr ated hardware, softw are, network a nd data,” Proc. ACM WiNT ECH ’17 , 20 Oct. 2017, Snowbird, UT, USA, to appear in ACM D ig ital Library © 2017 Copyright is held by the owner/au thor(s). understood, i ts massive deployment, emerging applications and new features bring along new research and development (R&D) challenges. For example, 3GPP is finalizing Rel. 14, which adds new cellular vehicle to everything (C-V2X) capabili ties, among others. Some of t he R&D challenges of C-V2X are reliability and capacity. Release 13 intro duced LTE operation in unlic ensed radio frequency (RF) spectrum. Licensed assisted access (LAA) uses carrier aggregation, supported since Rel. 10, to aggregate an LTE channel in the unlicensed spectrum to a primary channel in a li censed LTE band. LAA or LTE-Unlicensed (LTE- U) ne eds t o coexist with WiFi and legacy radios. In the US, the Fi rst Responder Network Authority (FirstNet) has been established to provide emergency responders with the first nationwide broadband public safety network using LTE Rel. 8 or higher. T he deployment of such network i s underway. The National Institute of Standards and Te chnology (NIST) recently announced 33 R&D projects to help accelerate successful deployment. The e mphasis areas i nclude LTE open -source software and t estbed development using software -defined radio (SDR) technology. Testbeds play a major ro le in developin g and testing new wireless communications technologies and systems. They enable research and education on variou s aspects of radio communications system de sign, de ployment, operation and evolution. This paper presents the evolution of our LTE testbed presented in [ 1 ]. The testbed extended RF network allows experimenting with advanced communications features, including multiple-input multiple-output (MIMO) communications and Narrowband Internet of Things (NB-IoT) . The re vised te stbed supports operation over extended frequency bands. In addition, we offer new data that repre sent samples of a radio signal and allow recreating a real radio environment for spectrum sharing ex periments. An open -source flexible OFDM waveform generator targeting LTE research has been implemented and can be configured to recreate one or more LTE control channels or rapidly impleme nt and test new channels. The core of th is versatile testbed i s integrated in a full-size rack and features several LTE base stations or eNodeBs (eNBs), user equipment (UEs), RF channel emulators, a con figurable RF network, software and data supporting research in a controlled laboratory setup. T his, together with distributed SDR/RF components and hooks for adding additional e quipment, provides a unique wi reless communications testbed for rapi d prototyping and quick e valuation of research contributions t o the latest 3GPP standard specifications. WiNTECH 2017 , Oct. 2017 , Sno wbird , Utah, USA V . Marojevic et al. 2 Reference [ 1 ] provides a comprehensive overview of university LTE testbe ds and their capabilities. Th ese include t he LTE-A t estbed [ 2 ] at TU Dre sden, Ge rmany, the UC4G wireless MIMO t estbed [ 3 ] at Heriott-Watt University in Edinburg, UK , NITOS [ 4 ] at University of Thessaly, Gree ce , Cl oud radio acce ss network (CRAN) research testbed [ 5 ] at Campus Universitario de Santiago, Portugal, and ORBIT [ 6 ] at Rutgers University, USA . This testbed is unique in several ways, including  Channel emulated and radiated RF signaling,  Modular design, eas il y exte nsible and upgradable ,  Custom software and recorded radio samples,  FCC experimental license,  Industry-grade LTE test equipment, and  Controlled RF environment enabling jamming and spectrum sharing experiments, among others. The re st of the paper is organized as fol lows. Section 2 provides an overview, before discussing the hardware, software, network and data in detail i n Sections 3 -6. Section 7 di scusses some enabled research. Sections 8 and 9 de scribe some of the key lessons learned and conclude the paper with an outlook. 2 SYSTEM OVER VIEW The testbed is built of general and speci al-purpose processing hardware, software, and a flexible Ethernet and RF network. The networked testbed allows re motely con figuring the system and experiment. It features open -source SDRs, commercial software and hardware, and industry-grade LTE test equipment. Fig. 1 shows a block diagram of the testbed’s main hardware components and RF connection s. The RF sig nals can access t he wireless channel through eight multipurpose RF ports. Five multiband antennas are currentl y deployed in the ceiling of our RF laboratory (lab) with three additional ports for connecting other antennas, lab or user - pr ovided equipment to t he testbed. Alternatively, the signals can be ro uted through configurable RF channel emulators. This allows for non-radiating e xperiments in a controlled RF en vironment. The testbe d features different implementations of LTE base s tations (eNodeBs or eNB) with their evolved packet cores (EPCs). These are available as SDR Figure 1: Blo ck diagram of main hardware components with simplified RF network. Table 1: LTE spectrum sharing research testbed features Feature Support Standards 3GPP LTE Rel. 8- 13 IEEE 802.11a,g,n Customizable synthetic and real waveforms Frequen- cies Hardware supports up to 6 GHz Antennas: 698-960, 1710-2700, 2700-3200 MHz Licenses FCC experimental license, several bands between 450 and 3650 MHz [ 7 ] Channels Channel emulation Over-the-air transmission Reference signals 10 MHz and pulse per second (PPS) references (OctoClock) Network Configurable RF network, Ethernet network Software Testbed configuration and SDR software Data Sampled radar signals Access Physical and remote implementations or hardware emulators. In addition t o SDR UEs, several commercial UEs of different categories and types are available. A shielded box can be used for controlled over -the-air experiments and the required RF isolation in such a testbe d. An FCC experimental li cense for several bands is also in place. Table 1 summarizes the testbed’s main features. Our design uses an RF switching network to select individual device ports for interfacing with other devices. The entire testbed is remotely accessible and configurable through the Internet. The IP -based Ethernet network allows accessing individual equipment, including SDRs, RF swi tches, channel emulators and other instruments. 3 HARDWARE Fig. 2 shows a photo of the main equipment rack. Its components are described in continuation. 3.1 LTE eNB Emula tor and UE Tester The CMW 500 from Rohde & Schwarz is a wideband communication system tester. Our CMW500 is currently equipped with FD -LTE and T D-LTE sign aling that is compliant with 3GPP Rel. 8. It allows LTE sig naling in any arbitrary RF band be low 6 GHz. As an LTE UE te st i nstrument, it allows the monitoring of LTE performance parameters, such as t hroughput, block error rate (BLER), and channel q uality indicator (CQI), in real-time. Data logging i s available for offline analysis. The CMW500 can also serve as a spectrum analyzer (SA) and provide WiFi or 3G signaling. Its main screen can be expo rted and all knobs and mete rs remotely accessed ( Fi g. 3 ). Addition al 3GPP or other functionalities can be added any ti me through software, hardware of firmware upgrades. 3.2 Software-Defi ned Radi o Hardware An SDR hardware system consists of a computer and one or more USRPs. The computing nodes provide the softwa re USRP PC RF Pr ocessing C h a n n el CMW 500 UE UE RF Switch- ing Net- work Shie lded box ··· USRP PC RF Pr ocessing SDRs ··· ··· ··· C h a n n el Cha nnel Emula tor RF Fil ter Bank External connecti ons LTE Spectrum Sharing Research Testbed WiNTECH 2017 , Oct. 2017 , Sno wbird , Utah, USA 3 Figure 2: Main equipment rack (cabling partiall y shown for clarity). processing capabilities of the testbed. An 18 -core, Dual Intel Xeon Processor E5 -2694 v4 embedded in a rack-mountable workstation allows concurrently ru nning several waveforms. Three high-performance desktops are shown on the bottom of Fig. 2 . The mobile workstations (8 high -performance laptops) can be connected to the internal network of the fi xed in frastructure or used individually. Three Intel i5/i7 NUC mini PCs serve dual purposes: (1) mobile SDR computing nodes and (2) hubs for powering, controlling, and accessing the LTE UEs (Section 4). The USRPs that we use i n this testbed are of type N210, B210, and E310. The N210 is connected through 1000BaseT Ethernet to a computer, the B210 uses USB 3.0, whereas the E310 operates without a computer. Each N210 ha s a modular RF daug hterboard Figure 3: CMW500 remote access control panel. of type SBX. This board covers frequencies between 440 and 4400 MHz and support an instantaneous bandwidth of 40 MHz. The B210s operat e at 0.1 – 6 GHz with 60 MHz i nstantaneous bandwidth. The E310s have similar specifications. The testbed has three N210s, which are integrated into the main rack above the PCs in Fig. 2 , thre e E310s, which only need a power source, and ten B210s, which can be conne cted to desktops, laptops or the rackmount workstation . The B210s are used primarily with the portable nodes and a single laptop can connect to several B210s. 3.3 RF Processing Bloc ks Each N210 USRP ha s an RF processing block attached to it ( Fig. 1 ). This processing consists of RF attenuators and combiners. The combiner takes the form of a wideband 10 dB directional coupler that allows both USRP ports — t he receive on ly port and the transmit/receive port — to be used. This configurat ion provides 10 dB of attenuation to the transmitted signal while allowing for re ception with no additional attenuation. An additional 10 dB attenuator is provided at the channel emulator port to reduce the transmitted signal by a tot al of 20 dB. Since the USRP N210 with SBX daughterboard can output 100 mW, t he system provides 0 dBm maximum sig nal strength to the channel emulator port and 10 dBm to the RF filter bank. The combiners are primarily used to facilitat e full dup lex operation (on different frequencies). A single SDR can then implement an FD -LTE eNB. Without t he combiner, two RF channel emulator port s would be required. The attenuators are needed t o match the signal levels of the SDRs to t he channel emulator levels. 3.4 Channel Emula tor Intelligent Automation, Inc.’s RFn est is a RF network channel e mu lation and simulation t ool. The channel emulator hardware applies signal attenuation between desired signal ports to create RF channels under program con trol. The A208 model is a digitally-controlled analog RF channel emulator that allows up to eight simultaneous RF connections. It is accessed via Ethernet. The two RFnest channel emulators in our testbed cover different bands: 0 – 1 and 1.8 – 2.8 GHz. A third, custom-built channel emulator is being implemented and will cover a wider range of frequencies of up to 6 GHz. The eight RF port s of each A208 mode l can be used t o establish four simult aneous single- input single-output (SISO) radio links that can be fully isolated or not, creating different radio environments with different levels of adj acent or co-channel i nterference. Different combinations of MIMO and SISO radios can also be deployed. Moreover, t he A208 allows creating a network with physical and virtual radios. The mai n limi tations of the analog channel emulator are the low number of physical ports and the fact th at no delays or Doppler effects can be e mulated. The analog solution serves our purpose and we chose it ove r the more sophisticated digital RFnest [ 9 ]. N210 USRPs SDR PCs RFnest-1 RFnest-2 RF Switches RF Switches Directional Couplers + RF Switches Ethernet Sw itch CMW500 RF Switches + Filters OctoClock WiNTECH 2017 , Oct. 2017 , Sno wbird , Utah, USA V . Marojevic et al. 4 3. 5 Filters and An tennas Since the USRP RF components of t he SBX daug hterboard (used with the N210), for example, only i nclude a single fixed fi lter (cutoff at the highest specified daughterboard frequency of 4.4 GHz in this case), additional filtering must be provided in order to suppress transmitted harmonics and spurious re ceiver responses. In other words, filtering is required for (a) re gulatory compliance and (b) radio performance. Configurable filter banks are therefore provided for use in con junction with the antenna system for controlled over-the- air operation. We have four filter banks, one for each N210 and one for a B210. The pass bands are 800 -1000, 2025-2075, 2350-2550 and 3550-3650 MHz, each corresponding to one of four e lectronic sw itch posi tions. The setup covers the US 3.5 GHz Innovation Band, which i s a shared spectrum band for next generation wireless communications below 6 GHz [ 8 ]. Filters can be exchanged as needed. The system uses five ceiling mounted radome -enclosed, omni-directional, and vertically polarized antennas operating over the frequency ranges 698 -790, 790 -960, 1710-2700 and 2700- 3200 MHz. These antennas are lo cated in the RF lab, which is adjacent to the server room where the mai n testbed rack is located. 3. 6 User Equipment LTE Cate gory 4, 5 and 6 user devices in the form of USB dongles or access points are provided with the testbed: H uawei B593s-22, Huawei E3276 LTE D ongle, H uawei E8278, and Rogers Aircard U330. All but the first are USB dongles. USB dongles are powered from USB and can be accessed throug h USB using a browser or vendor-specific application. This allows observing the UE mode , performance and other LTE-specific radio or network parameters. An Intel NUC or a laptop i s used for the purpose of interfacing with a USB dongle s. The NUC can be conven iently placed in the shielded box. A Mini-UICC Test Card from Rohde & Schwarz provide s the universal subscriber identity module (USIM) for each user device. This particular card ensures smooth interfacing with the CMW500 and Amarisoft eNBs. 3. 7 Spectrum Analy zer The testbed includes two portable spectrum analyzers (SAs) for indoor and outdoor measurement studies over a frequency range between 10 kHz and 6.2 GHz. It is a mobi le unit that can be hooked up with the testbed as needed via RF cables or antennas. Each SA has a built-i n GPS re ceiver and supports r emote operation using its Ethernet interfa ce. 3. 8 Reference Oscillato r and Clock Source Ettus Research Octoclock has eight 10 MHz and e ight pulse per second (1 pps) re ference signals. It distri butes a common timing and 10 MHz reference signal to the USRPs and CMW500. The use of i t is optional. You can select through the USRP hardware driver (uhd) whether to use an internal or e xternal reference signals. Octoclock allows to provide an increase i n frequenc y accuracy. The 1 pps signal allows the sample clocks to be aligned. 4 S OFTWARE 4.1 Wireless Communi cations So ftware This is the main software and feature s LTE software as well as several toolboxes for building SDRs for diverse experiments. 4.1.1 Amarisoft LTE100 eNB. Amarisoft’s Software eNB is installed on several workstations, on two fi xed and one mobile node. It supports operation wi th USRPs B210 and N210. Amarisoft is able to connect to several UEs simultaneou sly. It is well maintained continuously upgraded with the newest 3GPP releases. The latest release features NB-IoT. Fig. 4 shows a screenshot of t he MAC t race for a 2x2 MIMO DL ex periment. The first ‘brate’ column matches the theoretical maximum D L user throughout of 102 Mbps for a 20 MHz FD - LTE system and Cat. 3 UE. The other parameters are ty pical LTE link parameters. They are helpful to understand system conditions and educate students about the fundamental parameters used by eNBs to manage the uplink and downlink. 4.1.2 Amarisoft LTE100 UE. This software allows seve ral UEs to be emulated a nd controlled through a GUI interf ace. Mor e precisely, it can simulate the behavior of up to 64 LTE UEs connected to an e NB vi a 3GPP compliant LTE signaling. The combined signals go through a channel emulator or over-the -air . LTE100 UE is in stalled on the rackmount workstation because of the required processing power. 4.1.3 srsLTE. srsLTE is a free, open-source SDR li brary for implementing 3GPP compliant LTE system on general - purpose processors (GPPs). It has a modular structure with minimal i nter-modular and external dependencies. T he current version i s compliant with LTE Release 8, and is written entirely using C language. It supports USRPs [ 10 ]. 4.1.4 Flexible OFDM Waveform - Physical Channels. We used srsLTE to de velop a flexible waveform generator for custom RF signaling. The waveform is OFDM-based with configurable Figure 4: Amarisoft LTE100 eNB’s MAC trace for over-the- air DL measurement with 20 MHz BW and 2x2 MIMO. LTE Spectrum Sharing Research Testbed WiNTECH 2017 , Oct. 2017 , Sno wbird , Utah, USA 5 bandwidth, subcarrier spacing, subcarrier allocation (regular or irregular), duty cycl e, and so forth. T his allows creating non - contiguous and time -discontinuous OFD M waveforms at the granularity of a single resource element (the smallest OFDM resource that carries one modu lation symbol). Using th e LTE resource mapper, the generate d RF frame can mimic LTE physical channels, such as the LTE synchronization signals or the bro adcast channel. Arbitrary physical channels can also be defined ( Fig. 5 ). 4.1.5 GNU Radio. GNU Radio i s a free and open -source software development kit meant for imple menting and rapid prototyping of DSP algorithms for SDR. It can be used with a) low-cost e xternal RF hardware to create a software radio, or b) used without any external hardware in a purely simulation - based setting. GNU Radi o companion (GRC) is the g raphical user interface for GNU Radio. It i s installed on most workstations. To install GNU Radio, i t is recommended to use a UHD version that i s compatible with both Amarisoft and GNU Radio. UHD version 3.8.1 has be en found to be compati ble with all other software tools. GNU Radio version 3.6, including GNU Radio Companion (GRC), is curre ntly installed on most nod es. Upgrades to newer versions are possibl e. The mob ile workstations run the latest GNU Radio version, version 3.7. 4 .2 Channel Emulation Sof tware RFnest comes with software that allows controlling the channel attenuation on the different RF paths : Figure 5 : OFDM resource grids: The flexible waveform can generate the LTE synchronization signals (top) or any LTE control channel or arbitrary sig nal (bottom).  RFview GUI: The graphical user-interface (GUI) allows for scenario modeling, analysis, recording and replay. The GUI provides time -synchronized and geospatial displays of the scenario state.  Channel Emulation Co ntroller (CEC): The CEC coordinates with RFview and carries out i nitialization and update s the channel emulation properties over time according to the RF scenario. The syste m supports various standard propag ation models and can e mulate fading channels. One can specify terrain, mobility paths in three dimensions and velocities for several radios. 4.3 Performance Ana lysis Software Performance analysis software is useful for evaluating the performance of L TE or o ther radios in differ ent RF environments. 4.3.1 iPerf and jPerf. i Perf is a measurement too l tha t crea tes streams of traffic data and determines the maximum achievable bandwidth on IP networks. jPerf is a GUI front -end developed in Java for iPerf. It provides an i nterface t o select various options, which are ultimately translated to a command line i nterface. Both, iPerf and jPerf, are available for download on the Internet. 4.3.2 UE Monitoring. All commercial user devices co me with an application t o monitor status of the UE and other radio link parameters, such as communications mode and data rate. Some devices also allow logging into them and looking at several radio parameters through AT commands [ 11 ]. 5 Network 5.1 Ethernet Netwo rk The t estbed can be accessed remotely by a uthorized users over a Virtual Private Network (VPN) by using a valid .OVPN certificate t hat was issued by the t estbed administrator. The certificate is verified by t he gateway computer, and once authenticated, users are g ranted access t o t he networked system components. The user can ssh into each one of the computers or instruments and access the channel emulator, switches, filters, UEs, for experiment configuration and execut ion a nd runtime analysis ( Fig. 6 ). 5.2 RF Network The RF switches allow reconfiguring the testbed to operate in channel emulated or radiated mode. It also allows combi ning different LTE t est equipment , SDRs and UEs i nto an experiment, limited only by the number of channel emulation or antenna ports. For 2x2 MIMO operation, t he transmitter and receiver both require t wo ports each to be selected simultaneously, which is equal to half the number of available po rts on each RF channel emulator. Apart from the USRPs and UEs, separate t f WiNTECH 2017 , Oct. 2017 , Sno wbird , Utah, USA V . Marojevic et al. 6 Figure 6 : Ethernet network. connections need to be provided to connect to the CMW500, t o external antennas, and to additional equipment in the RF lab. One way of accomplishing flexible configurations is through the use of a series of cascaded RF switches or switching matrix. To keep the cost low and to maximize the reuse of the original testbed setup [ 1 ], a new approach to the problem was considered where th e dev ice ports were r anked in terms of priority a nd several operational scenarios were considered. Combinations of these device ports were then accordingly grouped to eliminate combinations of device po rts that would no t be used . The selected combinations e nable switching between several modes of operatio n with the inclusion of only one additional 8-port switch matri x . That is, three switch matrices are nee ded to choose among (1) over-the-air transmission, (2) RFnest1, (3) RFnest2, and (4) custom channel emulator. The fort h swi tch matrix facilitates defining an experiment with a different combination of radios and essentially e nables 2x2 MIMO. Operating at 4x4 MIMO would re quire additional ports on the network emulators, 4-port UEs and additional RF switching. Fig. 7 shows the RF di agram. Switch Matrix 1 allows switching be tween channel emulated and radiated mod es. For example, t he top most RF line from t he SDRs block connects to Switch Matrix 3 and from there to one of the RF channel emulators or to the leftmost antenna of the group of four antennas. If channel emulation is chosen, Switch Matrices 3 and 4 allow choosing between one of t he three channel emulators that cover differe nt frequency ranges. All RF signals go through a channel emulator or the air interface betwee n two antennas. All con nections from t he shielded enclosure go into Switch Matrix 2, which also provides access to two of the laboratory connections. The three laborator y connections allow integrating other lab e quipment or adding additional devices to the testbed . These cou ld be UEs, SDRs, or another instrument s that ha ve RF ports ( bring your own device ). The five a ntennas and three lab connections are in the adjacent RF lab that students and faculty can access. The CMW500 has direct access to a channel emulator port, an antenna port, or a lab connection. All switches have an IP address and are electronically configurable through a browser. Figure 7 : Functional RF diagram for all testbed operational modes including 2x2 MIMO. 6 Data Real signals can be re corded in the field using a binary I/Q format file. The file can then be played back on one of the system USRP transmitters as either a desired signal or interferer for spectrum sharing experiments. Several 10 minute data files were recently re corded from a live NOAA weather radar on 2.8 GHz [ 12 ]. Since the radar was scanning continuously signal levels vary widely with only occasional full strength peaks. The recordings were made using one of the portable SDR equipment with a GNU Radio flowgraph, operating at a bandwidth of 10 MHz. The resulting files are approximately 48 GB each. Since the signals were recorded as I/Q baseband data they may be replayed through a USRP transmitter at any desired center frequency. Fig. 8 shows the radar signal spectrum. During frequency sharing experiments sample radar si gnal can be played back through a USRP and then directed through a channel emulator which may apply additional path loss and fading t o t he radar signal as appropriate for a mobi le scenario. The radar signal can then be added to t he communications link path of the emulator to evaluate the effects of radar interference. 7 ENABLED RESEAR CH The testbed e nables experimental research in a controlled RF environment. Its main purpose is not only to advance LTE, but rather te st and advance solutions for spectrum coexistence in heterogeneous radio envi ronments, including LTE, WiFi and radars. We summarize some of the enabled research here and cite sources for further details and results. Gateway eth0 eth1 192 .16 8.0 . 11 … P C 1 192 .16 8.0 .1 Ethernet Switch 192 .16 8.0 .1 4 192 .16 8.10 .1 RF Atten. 192 .16 8.0. 30- 37 192 .16 8.0.40 - 47 Fiber Transducers and Link UE UE Internet CMW500 R f N e s t R f N e s t RfNest P C 1 CPU 192 .16 8.0. 50- 54 USRP RF Switches Shield ed Box RF Filter Bank LTE Spectrum Sharing Research Testbed WiNTECH 2017 , Oct. 2017 , Sno wbird , Utah, USA 7 Figure 8 : Example spectrum of the replayed radar signal. It shows a snapshot of t he very wideband radar signal along with the peak hold line. Th e noise floor is at about -120 dB. 7.1 Waveform Re silience to RF Inter ference RF interference can be intentional or unintentional and i s generated from other radios of the same type (e.g. as the result of aggressive frequency reuse in a cell ular network) or differ ent types (e.g. from other radios operating in the same band or from jammers). Our fle xible OFDM wa veform and SDR fram ework can be conveniently used to an alyze the vulnerability of LTE to protocol-aware control channel interference [ 13 ]. Using Amarisoft LTE100 eNB, CMW500 and srsLTE, we have analyzed the effect of LTE control chan nel spoofing. The results have shown that a fake LTE downlink con trol signal can deceive UEs and impe de their attachment to a legitimate eNB [ 11 , 14 ]. Solutions t o this problem can be effec tively i mplemented and tested [ 15 ]. We have also used the testbed to evaluate external LTE equipment, such as commercial, public safety, or military -grade LTE syste ms. The extra RF ports allows connecting external eNBs and UEs to test system pe rformance in t argeted RF interference, detect in terference, and evaluate practical solutions for interference mitigation [ 16 ]. This unique system setup providing a modular and extensible framework for controlled RF experiments with commerci al and experimental LTE waveforms ha s been a key enabler for our research on improving the availability of 4G LTE in shared spectrum and in harsh radio conditions. 7.2 Harmonious S pectrum Coexis tence The capacity limitations of current LTE deploy ments require LTE network operators to consider s hared or unlicensed spectrum. Motivated by that and the success of WiFi, LTE is now considered for operation in the 5 GHz unlicensed band, the new US 3.5 GHz band, the AWS-3 band, and other shared bands around the world. The primary users i n t he aforementioned bands are radars and ot her le gacy (govern ment) users. WiFi i s also present in 5 GHz. Hence, LTE needs to coexist with legacy users, WiFi, and, possibly, other radios as well. The testbed provides WiFi signaling through the CMW500 and the UEs. Real radar signals can be emulated using our collected data, as de scribed in Section 6. This can be effectively used to create a number of realistic scenarios t hat allow evaluating RF spectrum coexistence techniques. Our te stbed provides several features that allow experimental evaluation of coexistence in shared spe ctrum. The number of fixed and po rtable radio nodes allows emulating primary, secondary and tertiary users, creating a dedicated sensing network, and implementing different spectrum access ru les. The LTE user bands signaling license of our CMW500 and capability of the deployed SDR software and hardware facili tate LTE experiments at any fre quency below 6 GHz. An FCC experimental license for several bands is provided through CORNET f or over-the-air exper iments. The publ ic safety LTE system described in [ 8 ] can be recreated and evaluated with additional radios, policies and coe xistence mechanisms. This allows setting up di fferent scenari os that need experimental validation of spectrum sharing concept s and rules for enabling harmonious spectrum coexistence before doing actual field tr ials. 7.3 Analysis o f RF Imperfection s One emerging line of research in the context of spectrum sharing is characterizing receiv ers and quant ifying achievable performance in heterogeneous signaling environment. As opposed to li censed spectrum, recei vers will be heterogeneous, especially in multi-tier spectrum sharing scenarios. T he analog components in the RF and intermediate frequency ( IF ) processing chains of receivers and the data conve rters are nonlinear devices that introduce in -band interference (intermodulation distortion or IMD) from adjacent signals. This interference can limit the achievable throughput [ 17 ], the extent of which needs t o be quantified through experimental research. Receivers need to be properly characterized and this information used for dynamic spectrum allocation. This testbed is ideal for IMD testing because of the variety of signals that it can be generate within the bandwidth of the pre -selector filter. Real and synthetic signals and devices can be used to emulate various RF environments. The g oal of this ongoing research is characterizing RF imperfections and their i mpact on system performance. Then , these imperfections can be taken into account to adapt protocols and m ake better spectrum management dec isions in heterogeneous and dynamic ra dio environments. The channel emulator, with addi tional RF components, can provide the necessary gain settings to drive receivers i nto controlled nonlinear region for validation of theoretical research resul ts. 8 LESSONS L EARNED Some of the lessoned learned are:  Proper RF shielding: RF shielding is critical i n such a testbeds t o avoid undesired signal paths, e.g. t hrough RF board leakage, when a cabled connection is desired. RF shielding is also important to ob ey the spectrum regulations and avoid comm ercial e NBs interfe ring in the experimen t.  Remote access: Remot e acce ss is important for avoiding physical testbed disassembly (e.g. removal of WiNTECH 2017 , Oct. 2017 , Sno wbird , Utah, USA V . Marojevic et al. 8 cables) or damage. This requires extra effort for setting up the needed processes for automati on, such as reimaging, to ensure th e testbe d is in a known stat e after an experiment.  SDR: The use of SDR hardware and software e nables versatile experi ments. Open -source software libraries allow customizing the tools to enable experimental R&D with reasonable effort.  Automation: Automating as many pro cesses as possible can be of huge benefit for effective testbed operation and management. We recommend providing GUIs and scripts for improving the usability. Nevertheless, any testbed has learning curve associate with i ts use . We recommend that the effort be somewhat spli t between the manage r and the user community.  Maintenance and upgrades: Even if all pro cesses are automated, there is a need for a testbed manager to perform mechanical and functional checks and replacement of parts as needed. Studen ts who have used the testbed for research and class projects have effectively contributed to testbed maintenance and upgrades a s well as training of new users. T he main source of support for upgrades needs to come from research projects that leverage the existing research infrastructure or from equipment grants.  Compliance with sp ecifications: Standard compliant (commercial) components do not necessarily implement all standard features. This can lead to unexpected results. Sanity checks and re vising specifications helps as doe s t he use of alternative components. Research using a te stbed like ours can convincingly point out the importance of certain features in a standard [ 15 ]. Many more lessons have been learned that have enabled research as well as education [ 18 ]. 9 CONCLUSIO NS AND OUT LOOK This paper has int roduced a testbed e nabling LTE spectrum sharing a nd related exper iments. Our testbed is unique in its components and how they are i ntegrated. It features SDRs, indust ry -grade LTE te st instru ments and a configurabl e RF network, which allows connecting different components while defining an experiment. We also offer software and data t hat is useful for RF experiments in a controlled lab env ironment. The testbed is re motely acc essible and we encourage researchers and educators to contact us for use. We are planning to integrate our LTE testbed into the CORNET testbe d management framework to provide integrated resource and user management. CORNET, moreover, pro vides tools to visualize resource status, spectrum, s ystem performance and results in real time though a Web browser [ 19 ]. We also plan for software upgrades to support emerging 3GPP releases, that i s, 4.5 and 5G technology, such as LTE-U, CRAN, and C-V2X. I n the CRAN configuration, the testbed would allow executing LTE waveforms in a central location and serving remote radio heads that could be located i ndoors or outdoors. We also envision experiments with un manned aerial vehi cles to assess th e performance of LTE-like waveforms and shared spectrum solutions for next generation unma nned aerial systems [ 20 ]. ACKNOWLEDGM ENTS This wor k was supported i n part by t he Army Research Office contract numbers W 911NF- 14 -1-0553/0554 and the National Science Foundation (N SF) contract number CNS-1642873. The authors would like to tha nk Deven Ch heda , Raghunandan M. Rao and Pradeep Reddy Vaka for thei r contributions to the design, development and vali dation of the testbed. The open access of thi s article is facilitated by Virginia Te ch's Open Access Subvention Fund. REFERENCES [1] V. Marojevic, et al. 2017. Software -defined testbed enabli ng rapid prototyping and controlled experime nts for the LT E e volution. In Proceeding of the IEEE WCNC , 19 – 22 Mar. 2017. [2] M. Danneberg, R. Datta, A. Festag, G. Fettweis. 2014. Experimental testbed for 5G cognitive radio access in 4G LTE cellular systems . Proc. IEEE Sens or Array and Multichanne l Signal Processing Worksho p , A Coruñ a, Jun. 2014. [3] P. Cha mbers, et al., “The UC4G wireless MIMO testbed,” Proc . IEEE Global Telecom. Conf. , Anahei m, CA, Dec. 2012. [4] N. Makris, et al. 2015. Enabli ng open access to LTE network c omponents; the NITOS testbed paradigm . In Proc. IEEE NetSoft 2015 , 13-17 Apr. 2015. [5] D. Riscado, et al. 2015. A flexible resea rch testbed for C-RAN. In Proc. Euromicro Conf. Digital System Design , Fuchas, Madeira, Aug. 2015. [6 ] Open-Access Research Testbed for Next -Generation Wireless Networks (ORBIT) Homepage, http://www.orbit- lab.org/ [7] Cognitive Radio Network Testbed (CORNET) Web Site, http://cornet.wireless. vt.edu [8] M. Sohul, X. Ma, M. Yao, E. Imana, V. Ma rojevic, and J.H. Reed. 2016. Next generation public safety ne tworks : a spectrum sharing approach. IEE E Commun. Mag ., Vol. 54, Iss. 3, March 2016. [9] Intelligent Automati on Inc. 2017. RFnest P roduct Specifications. 2017. [10] srsLTE – Open Source LTE, https://github.com/srsLTE [11] M. Labib, V. Marojevic, and J. Reed. 2015., Analyzing and enhanci ng th e resilience of LTE/LTE- A. In Proc. IEEE Conf. Standards for Communic ations and Networking (CSCN) , Tokyo, Japan, 28 -30 Oct. 2015, pp. 315 – 320. [12] NOAA’s National Weather Servi ce Rada r Oper ations Center Web Site, https://www.roc.noaa.gov/W SR88D/Engineer ing/NEXRADTechInfo.asp x [13] M. Lichtman, R. Jover, M. Labib, R. Rao, V. Marojevic, and J.H. Reed, 2016 LTE/LTE -A jamming, spoofing, and sniffing: thre at asses sment and mitigation. IEEE Com mun. Mag. , Vol. 54, Iss. 4, April 2016. [14] M. Labib, V. M arojevic, J. Reed, and A. Zaghlou l. 2016. How to enh ance the immunity of L TE systems against RF spoofing. In Pr oc. Int. Conf . C omp ut ing, Networking and Comm s. (ICNC 20 16) , Kauai, HI, 15 - 18 Feb. 2016. [15] M. Labib, V. Marojevic, J .H. Reed, and A.I. Zaghloul, 2017. En hancing the robustness of LTE s ystems: analysis and evolu tion of the cell se lection process. IEEE Com mun. Mag. , Vol. 55, Iss. 2, Feb. 2017. [16] V. Marojevic, R. Rao, S. Ha, and J.H. Reed. 2017. Performance analysis of a mission-critical portable LT E system in targeted RF interfer ence . In Proceeding of the IEEE V TC Fall 2017 , 24-27 Sept. 2017. [17] A. Padaki, V. Marojevic, and J. H. Reed. 2014. Role of receiver performance data in efficient spectrum utilization. In IEEE DySPAN 2014 , McLean VA, April 2014. [18] A. Gelonch, V. Marojevic, and I. Gomez. 2017. T eaching telec ommunications standards: bridging the gap between theory and practice . IEEE Com mun. Mag. , Vol. 55, Iss. 6, May 2017. [19] N. Sh arakhov, V. Marojevic, F. Romano, N. Polys, and C. Dietrich. 2014. Visualizing Real-Time Radi o Spectrum Access with CORN ET3D. In Proceeding of the ACM 19th International Conference on 3D W eb T echnology (Web3D '14) . ACM, Vancouver, Cana da, 8-10 Aug. 2014, 109- 116 . [20] J. Kakar and V. Marojevic, 2017. Waveform and Spectrum Management for Unmanned Aerial Systems Beyond 202 5. In Proceeding of t he 28 th IEEE PIMRC 2017 . IEEE. Montreal. Canada, 8 -13 Oct. 2017.