The Unofficial Non-Carrier of Burning Man 2008
(Please do not call us Black Rock City Cellular. We are not a telephone company.)
UPDATE: There was a second Black Rock field test in Sept 2009. Read about it here.
Back in the Summer of 2007, when we first started working on a hybrid GSM-SIP basestation, one of our advisors suggested that Burning Man
might make a good place for an alpha test. The short explanation of
Burning Man is that 50,000 people gather on a dry lake bed in Nevada and
build a city ("Black Rock City" or "BRC") that exists for just one
week. Whatever you may have heard about Burning Man, the festival would
be impossible on this scale without the cooperation of a lot of
competent people. Whatever may happen there, Black Rock City is (in its
odd way) an orderly, functioning community brought into existence by
careful planning and hard work on the part of all of the participants.
I'm a very
practical person. We run a city. We run a real city. I'm not a
hippie. I'm not talking about everyone loving everyone. I'm talking
about everything it takes to live well together. -- Larry Harvey, BM
We thought it was as great idea, and once the basestation started coming to life, we started scheming to actually do it.
What Makes Burning Man Ideal?
Black Rock City offers a large assembly of people, with working phones, in an area with no existing cellular coverage. This makes it a near-ideal test site.
There are two steps to legally operating an experimental basestation in
the United States.
First you must clear it with the FCC. Second, since nearly all cellular
spectrum in the US is already licensed already, you must clear it with
the local license holder.
The FCC experimental license process, more formally called "special
temporary authorization" (STA), normally takes about six weeks, but ours
cleared in just a few days. We submitted our application
online, using our consulting company, Kestrel, as the official
applicant. After a few phones calls and a polite question and answer
session with an FCC staffer, we were issued this license.
To meet the license's signage requirements, we prepared this poster.
Next, we did a search of the FCC database to identify the
cellular and PCS license holders in the Black Rock area. We contacted
the smallest license holder first and after a couple of call transfers
got the blessing of their head engineer to run our BTS in their spectrum
at Burning Man, in cellular allocation block B, 880.02-889.98 MHz and
891.51-893.97 MHz downlink, paired with corresponding uplink frequencies
45 MHz below that.
We chose the network identity MCC=901, MNC=55, an unclaimed network code in a non-geographic country code.
Once we cleared the legal hurdles, we had to scramble to actually
collect, integrate and test all of the equipment we would need to run an
8-Watt cell off-grid for a week.
We scrounged a lot of good used equipment from eBay, we borrowed a few
things and we built a few things ourselves, literally from bare metal.
Pulling together the equipment was an adventure in itself and there's enough detail to justify a separate web page.
Adding It Up
We were very cost-sensitive. In total, we spent about $4,500 on radio
and power gear for the basestation. We probably spent another $600 on
supplies and equipment for the camp (food, PVC pipe, etc.) and about
$600 on the Burning Man admission tickets. Including travel expenses
from the Bay Area and VoIP carrier fees, but excluding labor, the total
cost of this field test was $6,000-$6,500.
In the two weeks prior to departure, we hooked up everything for
integration testing. We also tried to estimate our range. We
range-tested by operating the BTS downlink in the upper part of the ISM
band and using a Nokia EGSM900 handset in field test mode for our call-testing and measurements. We did not use the power amp for these tests, but we did bench-test it separately.
Here, we have the USRP and duplexer hooked up to the masted antenna on Harvind's back deck.
Here, we test the mechanical installation of the wind turbine.
(That's Harvind walking by.) The turbine is near the center of the
photo, on top of the vertical white pole.
Early Subscriber Recruiting
As soon as we got the STA cleared, we started contacting potential test users, especially people who had prior experience with internet serviceVoIP
on the Playa.
We approached these folks first because we thought they'd 'get' it and
because we wanted permission to use their satellite IP gateway for our
Our first contacts were from the Camp I Am , Save-the-Man and Entheon Village.
They most definitely 'got' it.
They all seemed like great people and Harvind even met a guy he knew from his college days.
Using a pessimistic assumption of a 1-mile service radius, we decided we'd cover the most people by setting up near 4:00 and Dart.
By luck, this was also the same general area as our early contacts.
We ended up about 1000' (300m) away, though, near 3:15 and G.
We pitched camp and hooked up all the kit.
Actually installing the BTS took just over an hour.
We took another two hours to configure our wireless backhaul and place a
PSTN call, but that was mostly due to upstream problems in the BRC NOC.
For the first few days, nothing went as planned.
Broadly speaking, keeping anything running reliably at Burning Man is
hard, and for some of the same reasons it is hard in rural Africa: the
physical environment is brutal and the nearest retail stores are 3-4
hours away in Reno. However, the system limped along for intermittent
testing in limited configurations while we sorted out the power
Up and Running
By Tuesday night, we had reliable power and could start running some
full-scale tests. The first thing that happened, though, was that the
BTS was suddenly flooded with service requests from hundreds of phones.
It seems that most burners don't bother to turn off their cell phones,
and these guys were hammering our system in what amounted to a denial of
service attack. Eventually, each unprovisioned phone received a reply
telling it that it cannot roam onto our network, but even processing
5-10 phones per second it took nearly an hour to convince the majority
of phones in our service radius to go away and leave us alone.
Once all of the registration activity died down, we were able to go
out and do some range testings. We found that our service radius was
roughly 1.5 km (~1 mile) and that we were limited by the sensitivity of
our receiver. The poor receiver performance was due to adjustments on
one of our filters getting shaken loose in the drive out here. Good
thing we brought the test equipment.
After retuning the filters, our service radius was up to 2.4 km (~1.5
miles) and uplink and downlink ranges were roughly matched. Our main
limiting factors on range were antenna height (only 10m/33ft), possible
damage to our uplink filter, poor shielding on the uplink filter and RF
crosstalk between the daughter cards inside the USRP case. [Note: We
later discovered that this crosstalk could be greatly reduced through
proper gain settings in the RFX cards.]
Provisioning Test Subscribers
Late Thursday afternoon, a few of our early contacts came to visit the
tent, see the hardware, get their phones provisioned and try making a
That box on the pole contains a Linksys WRT54G and a 14 dB antenna
pointed to a WiFi access point in Center Camp for backhaul to the "real
A New Strategy for Stray Phones
As more people began to populate Black Rock City, we saw that a lot of
unprovisioned phones (particular models of phones) were continuing to
try to register with us, even after they had been denied service. The
rate of these repeating registration attempts was high enough to cause
congestion and to expose latent bugs in our control layer. We also
found that transactions on marginal radio channels placed a much greater
load on the system by triggering retransmissions and timeouts in L2.
Starting on Friday afternoon, we tried a new approach for these stray phones:
After these changes, the registration activity died down to a manageable
level within a few minutes. We also saw a wave of "IMSI detach"
transactions, meaning that a lot of people were turning their phones
off. Maybe they didn't like the 666.
- Just accept the registration attempts, even if the phones are not provisioned in Asterisk.
- Display a network code that will get attention. MCC=666 was an unclaimed code.
- Change the BTS configuration to have more control channels
available at the expense of traffic capacity. We might as well, since
the traffic capacity is useless when phones can't get control channels
for call setup. This allowed us to support much higher levels of
(For you GSM nerds, we changed the C0 configuration from C5+7C1 to
- Change the GSM registration timer (T3212) from 6 minutes to 48 minutes.
Surprise! The BTS is a Little Too Open
On Saturday afternoon, we realized that unprovisioned users were making
outgoing trunk calls. All they had to do was dial 1 at the beginning of
the number to get routed to our VoIP carrier. We did some analysis and
research and determined that this security hole was due to a
combination of two bugs, one in our Asterisk configuration and another
in our GSM control layer. By the time we fully understood the problem
and could fix it without crippling the test, it was Saturday evening and
our license was about to expire anyway. At around 10:00 PM we shut
down the BTS for the last time and went to go see the burning of The
A post-test analysis of the CDRs and logs of the GSM stack showed
that we successfully connected about 120 phone calls to 95 different
numbers in area codes all over North America, most of them in the last
24 hours of the test. About half of these calls lasted over a minute
and the longest was over 15 minutes. At least 60 different users placed
calls and nearly all of these users were AT&T and T-Mobile
subscribers. No attempt was made to identify specific subscribers or
called parties and all subscriber-specific information was destroyed
after the analysis. Roughly 1/2 of the call attempts were successful
when the subscriber prefixed the dialed number with "1", with the high
failure rate due to a combination of congestion, backhaul limitations
and previously-unknown bugs in the control layer. Many of the control
layer bugs were corrected or mitigated during the test, causing the
success rate to rise over time, even though this meant rebooting the BTS
frequently. We also estimate that about 150 call attempts failed
because the user did not know to use the "1" prefix.
The testing team also placed several dozen calls within the
Asterisk PBX, either between provisioned handsets or to the wired SIP
phone in the tent.
Early Saturday evening, David was in a hooka bar at 3:15 and Esplanade.
His cellphone rang with a call from the tent. At that moment, he
realized that widespread calling service at Burning Man, even local
service, was a mixed blessing. He got up and left the bar to take the
call. The abrupt departure was rude but taking the call in the bar
would have been even more rude. Since there was a queue to get back in,
the call also meant the end of the hooka bar visit. At the same time,
there was great utility in being able to locate a campmate in the sprawl
and dust of Black Rock City. Text messaging would be a much more
appropriate service, giving nearly all of the utility of a short phone
call but with a much lower degree of disruption.
We packed up Sunday morning and made the 4-hour "Exodus" to the nearest
paved road. About 3 hours into this ordeal, most of the way to the
gates, we heard news on BMIR
that hurricane Gilbert was bearing down on the Gulf Coast and burners
from that area needed to find satellite phones to make calls home. To
turn around and rebuild the BTS would have taken several hours, so we
just kept going. We wish we would have known about this need soon
enough to help out.
Despite the difficulties with power supplies, we had several successes:
- Other than backhaul problems, which were outside of our control,
we had the basestation unpacked, installed and running in less than two
- The core GSM functions worked "out of the box".
- We connected a lot of real telephone calls for real people.
- Our service radius matched our predictions.
- We discovered several bugs that could not have been exposed in other testing environments.
- The BTS survived two dust storms and two afternoons of 100F heat, despite the lack of robust packaging.
- Many people visited the tent, saw the system and were impressed, including telecom engineers from major carriers.
Lessons for Next Time
If we did this again, and we well might, here's what we would do differently:
- Register as a theme camp so that people know about us and we have a predictable location.
- Fix our security holes, now that we understand them.
- Focus on SMS. Don't even provision most users for voice.
- Require users to disable audible ringtones and make a promise
to take their calls out on the street as part of the provisioning
- If there's some real-world emergency, like a hurricane, allow
users to make outgoing calls to the real world, but do not allow them
to accept incoming calls. The gets rid of the problem of the ringing
phone, but allows people to make important calls to their families.
With Asterisk, we can even limit outgoing calls to specific area codes.
- Don't rely on a wind turbine. If we bring a turbine, it will be to augment a solar array.
- Don't use a laptop for the BTS. At ambient temperatures
above about 100F, USRP drivers start to fail on the MacBook. We need
something with better heat tolerance, prefably PPC-based.
- Get a taller tower if at all possible.
- Build better isolation filters and try to build better internal shielding for the USRP.
- Fit the USRP with a 13, 26 or 52 MHz clock to simplify sample rate matching with the GSM symbol clock.
We'd like to thank the people who offered assistance and support along the way.
- Bill Alexander, for helping to run the site, loaning his WiFi bridge and sweep generator, and offering useful advice on the RF chain.
- Roshan Baliga, for early footwork identifying radio gear.
- Jessica Burgess, for general moral support, camp planning and for helping round up camp supplies.
- Glenn Edens, for originally suggesting this idea.
- Dewayne Hendricks, for offering his 3318PA.
- Ralf Muehlen, for backhaul support to the "real world".
- David Rowe, for Asterisk advice.
- Raffi Sevlian, who wrote a lot of our control layer.
- Brad Templeton, our first confirmed test subscriber and friendly Asterisk reference.
注：OpenBTS Field Test（原文出处，翻译整理仅供参考!）