In my last post about 5G NR, which was part of a series in which I analyzed the signals in a short recording of an idle srsRAN gNB, I mentioned that I had already decoded all the signals that appear in the recording, and that to move on with my 5G series I would need to make and use some more complex real world recordings next.
A 5G band I’m particularly interested in is n78 (3.3 – 3.8 GHz TDD). This is being used to deploy 5G in many European countries, including Spain, as showed by this list in Wikipedia. Due to the large bandwidth available, it is common to see cells with 100 MHz bandwidth in this band.
The n78 band isn’t the only band being used for 5G in Europe. For instance, in Spain the n28 band (700 MHz) is also being used, although as of writing this at least in my area only Movistar is running a “native” 10 MHz 5G cell on this band. The two other operators (Vodafone and Orange) are running 10 MHz cells with DSS (dynamic spectrum sharing) to serve 5G and LTE.
Traditional LTE bands such as B1 (2.11 – 2.17 GHz downlink) and B3 (1.805 – 1.88 GHz downlink) are reported to be used for 5G with DSS. As I’m writing this, in my area in B1 Movistar is using a 15 MHz cell exclusively for 5G, while Orange is running a 20 MHz LTE cell (see the relevant frequency allocations in this article), whereas in B3 there are only 20 MHz LTE cells from Movistar, Vodafone and Orange.
Since n78 is a band that is new for 5G, uses TDD (which is infrequent for LTE in Europe), has large bandwidth, and a higher carrier frequency than usual LTE bands, I expect to see more interesting 5G features being used in this band than in the others. Hence my particular interest in this band.
The following diagram shows the allocation of the n78 band in Spain following the sell in October 2024 of the MásMóvil 80 MHz block, which is depicted in the diagram. It is taken from a bandaancha.net article about the MásMóvil spectrum sell.
n78 band allocation in Spain (taken from bandaancha.eu)
Recording this band with an SDR is more challenging (or just more expensive!) than recording traditional LTE bands, since the typical bandwidth of an n78 cell is around 100 MHz. Most “low-end” SDRs based on the AD936x and LMS7002M RFICs have a maximum sample rate of 61.44 Msps. While I could record three 10 MHz LTE cells in the B20 band at once using a USRP B205mini at 30.72 Msps a few years ago, none of the SDRs I have is reasonably able to capture 100 MHz of spectrum.
Since recording cells in the n78 band was going to take more effort than just going to a nearby cell tower with a Pluto running Maia SDR and a phone, or a USRP B205mini and a laptop, I also wanted to use multiple antennas for the recording (at least 2 antennas). This would allow me to demonstrate MIMO techniques when analyzing the recording. In my single-antenna LTE recording I’ve been talking about some MIMO signals and resorting to clever tricks to decode them with a single antenna.
For a while I was pondering about whether I could “overclock” one of the AD9361 SDRs I have to run at 122.88 Msps, or whether I could configure the LimeSDR USB to a higher sample rate (there is conflicting information about the maximum sample rate and bandwidth achievable by the LMS7002M, and LimeSuiteGUI will let you set it to sample rates above 61.44 Msps, but I always ran into issues such as corrupted data because of digital timing failures or PLLs not locking).
... continue reading