RM502Q-AE based cell scanner

[pstephens]

I've recently completed a cellular data rig with an RM502Q-AE as the centerpiece mounted in an AD4M 1DP738X8 RJ antenna and connected to a Raspberry Pi 4. More details on the modem and tower construction can be found here: https://twitter.com/peterastephens/stat ... 7458794496

The antenna is mounted at the top of a 70' tower with a rotator I can control through software. This means I can point the antenna (with software!) to various headings and measure the various quality metrics to try and find the best headings. I plan on re-running the scan from time to time to see if new towers or capabilities have come on line.

I've cobbled together notes and software (mostly Python but a little Rust) at https://github.com/pstephens/project-5g. Specifically I'm polling these metrics (list here: https://github.com/pstephens/project-5g ... ner.py#L68) every 6 seconds for about 120 seconds per each 2 degrees.

Right now it seems I get some coverage in all 360 degrees. But some directions are better than others. Here's my questions:

• Should I reset the modem after changing the heading (AT+CFUN=1,1) or will the modem settle on a new better cell eventually by itself? I want to avoid having the modem stuck to an inferior but useable cell because then I won't have accurate metrics for that heading.
• Will 4x4 MIMO only kick in under load? I've used AT+QRSRP but antenna 3 & 4 rarely register anything but the default -44 or -140 values. I want to make sure the crazy small mhf4 coax connectors haven't come loose.
• Is there any way to get a feel for carrier aggregation of the various towers without putting the modem under load? I don't really want to run a speed test every 2 degrees and waste the bandwidth. An alternative approach might be to try and identify tower headings through signal quality and strength and then just run the speed test on the most promising headings.

Any other ideas from the wisdom of the forum are appreciated.

[pstephens]

A basic scanner run was completed. I mostly capture LTE and NSA RSRQ, RSRP, and SINR metrics from the serving cell command. The CA commands don't include NSA metrics (and require loading the connection) so I didn't try visualizing CA.

Command to control the Green Heron RT-21 controller: rotator.py
Command to execute the scan (also relies on the rust atcmd binary): scanner.py
Command to parse the logged scanner output: parse_logs.py
Command to visualize the parsed data using Highcharts (free for personal use): create_viz.py

Here's the resulting visualization. Low ping latency (black, 90th percentile) has been the best indicator for connection quality so far. The most consistent low ping latency, between the heading 152 and 180 degrees, roughly corresponds with peak NSA RSRP, RSRQ, and SINR.

scanner-sample.png

This typically gives me bandwidth about like so, more than sufficient for my needs:

speed-test.png

[packlet]

OK, I'm a noob here, so take my input with grain of salt. Not sure 2 minutes is long enough for a modem to settle on the best possible combination of bands at each location. You might think about giving it 10-15 minutes before doing any testing, then run a few tests before moving on. Yes, CA is only detectable when under load and when enabled by the tower. You might think about testing in several passes, first every 15 degrees to find which approximately which direction is best, then once you know that, test again at 1-2 degree intervals near there to totally dial it in...

Very cool, though! I've thought about re-purposing a cheap TV antenna rotator for such testing...

[Didneywhorl]

Keep the info coming, this is so dang cool!

[Didneywhorl]

... Here's my questions:

• Should I reset the modem after changing the heading (AT+CFUN=1,1) or will the modem settle on a new better cell eventually by itself? I want to avoid having the modem stuck to an inferior but useable cell because then I won't have accurate metrics for that heading.
• Will 4x4 MIMO only kick in under load? I've used AT+QRSRP but antenna 3 & 4 rarely register anything but the default -44 or -140 values. I want to make sure the crazy small mhf4 coax connectors haven't come loose.
• Is there any way to get a feel for carrier aggregation of the various towers without putting the modem under load? I don't really want to run a speed test every 2 degrees and waste the bandwidth. An alternative approach might be to try and identify tower headings through signal quality and strength and then just run the speed test on the most promising headings.

Any other ideas from the wisdom of the forum are appreciated.

• I would reset it, as I've found in manual aiming the modem seems to favor the last connected radio versus a stronger one, for a bit of time. Yet when reset it connects to a new radio.
• This is a bit of mystery for me, but I think that is true that 4x4, similar to CA, will kick in under load. But honestly I'm not real sure.
• I don't think so, as CA is initiated under load and the management protocols control this on the tower side. I don't know of any way to test it's presence and ability otherwise. Also remember that some carriers disable CA after the link has been connected for an arbitrary amount of time. ATT is TERRIBLE about this. It allows them to still claim their speeds without actually giving it to us full time.

[mtl26637]

[*] Should I reset the modem after changing the heading (AT+CFUN=1,1) or will the modem settle on a new better cell eventually by itself? I want to avoid having the modem stuck to an inferior but useable cell because then I won't have accurate metrics for that heading.
[*] Will 4x4 MIMO only kick in under load? I've used AT+QRSRP but antenna 3 & 4 rarely register anything but the default -44 or -140 values. I want to make sure the crazy small mhf4 coax connectors haven't come loose.
[*] Is there any way to get a feel for carrier aggregation of the various towers without putting the modem under load? I don't really want to run a speed test every 2 degrees and waste the bandwidth. An alternative approach might be to try and identify tower headings through signal quality and strength and then just run the speed test on the most promising headings.

I agree with Didneywhorl, sometimes they want to stay latched so I would reset after changes so the modem resyncs to the new changes. Yes, 4x4 MIMO usually only connects under load to save battery power. You can see this in 'Service Mode' on a capable phone. Any type of upload/download to or from the phone will kick in 4x4 if it is available, it doesn't necessarily need to be a full blown max speed upload or download however. As far as CA availability that is mostly found from testing. I don't know of a way to find specific CA combinations for a specific tower other than running tests, but yet again it doesn't necessarily need to be a full blown max upload or download. Also, most carriers only have CA enabled during data transfers and is not active when idle. This also helps save battery. Vzw seems to be the exception though as they seem to keep their CA connections active at all times.

[pstephens]

Good advice, all. A couple of take aways:

• I'll try a modem reset, but that takes about a minute for things to come back online. This last run was 2 minutes for every 2 degrees or about 6 hours for a full survey. To compensate for a longer sampling time I could run the survey over several nights. Or I could step in greater increments. The current 8dBi antenna is not that highly directional and it turns out I get some connection in all 360 degrees.
• Is there any event log that I can access? Would be super cool to see a log of antenna on/off/tx power/SINR changes etc. There is an obscure reference to "qxdm log" in this forum post. Will have to see if this is something I can access. With logging I could monitor CA, band, and antenna changes and correlate with packet transfer counters from the router to correlate modem behavior to transfer load.