The Unofficial Non-Carrier of Burning Man 2008

(Please do not call us Black Rock City Cellular. We are not a telephone company.)

UPDATE: There was a second Black Rock field test in Sept 2009. Read about it here.

Back in the Summer of 2007, when we first started working on a hybrid GSM-SIP basestation, one of our advisors suggested that Burning Man might make a good place for an alpha test. The short explanation of Burning Man is that 50,000 people gather on a dry lake bed in Nevada and build a city ("Black Rock City" or "BRC") that exists for just one week. Whatever you may have heard about Burning Man, the festival would be impossible on this scale without the cooperation of a lot of competent people. Whatever may happen there, Black Rock City is (in its odd way) an orderly, functioning community brought into existence by careful planning and hard work on the part of all of the participants.

I'm a very practical person. We run a city. We run a real city. I'm not a hippie. I'm not talking about everyone loving everyone. I'm talking about everything it takes to live well together. -- Larry Harvey, BM co-founder

We thought it was as great idea, and once the basestation started coming to life, we started scheming to actually do it.

What Makes Burning Man Ideal?

Black Rock City offers a large assembly of people, with working phones, in an area with no existing cellular coverage. This makes it a near-ideal test site.

Legal Preparation

There are two steps to legally operating an experimental basestation in the United States. First you must clear it with the FCC. Second, since nearly all cellular spectrum in the US is already licensed already, you must clear it with the local license holder.

The FCC experimental license process, more formally called "special temporary authorization" (STA), normally takes about six weeks, but ours cleared in just a few days. We submitted our application online, using our consulting company, Kestrel, as the official applicant. After a few phones calls and a polite question and answer session with an FCC staffer, we were issued this license. To meet the license's signage requirements, we prepared this poster.

Next, we did a search of the FCC database to identify the cellular and PCS license holders in the Black Rock area. We contacted the smallest license holder first and after a couple of call transfers got the blessing of their head engineer to run our BTS in their spectrum at Burning Man, in cellular allocation block B, 880.02-889.98 MHz and 891.51-893.97 MHz downlink, paired with corresponding uplink frequencies 45 MHz below that.

We chose the network identity MCC=901, MNC=55, an unclaimed network code in a non-geographic country code.

Technical Preparation

Once we cleared the legal hurdles, we had to scramble to actually collect, integrate and test all of the equipment we would need to run an 8-Watt cell off-grid for a week. We scrounged a lot of good used equipment from eBay, we borrowed a few things and we built a few things ourselves, literally from bare metal. Pulling together the equipment was an adventure in itself and there's enough detail to justify a separate web page.

Adding It Up

We were very cost-sensitive. In total, we spent about $4,500 on radio and power gear for the basestation. We probably spent another $600 on supplies and equipment for the camp (food, PVC pipe, etc.) and about $600 on the Burning Man admission tickets. Including travel expenses from the Bay Area and VoIP carrier fees, but excluding labor, the total cost of this field test was $6,000-$6,500.

Smoke Tests

In the two weeks prior to departure, we hooked up everything for integration testing. We also tried to estimate our range. We range-tested by operating the BTS downlink in the upper part of the ISM band and using a Nokia EGSM900 handset in field test mode for our call-testing and measurements. We did not use the power amp for these tests, but we did bench-test it separately.

Here, we have the USRP and duplexer hooked up to the masted antenna on Harvind's back deck.

Here, we test the mechanical installation of the wind turbine. (That's Harvind walking by.) The turbine is near the center of the photo, on top of the vertical white pole.

Early Subscriber Recruiting

As soon as we got the STA cleared, we started contacting potential test users, especially people who had prior experience with internet serviceVoIP on the Playa. We approached these folks first because we thought they'd 'get' it and because we wanted permission to use their satellite IP gateway for our PSTN backhaul. Our first contacts were from the Camp I Am , Save-the-Man and Entheon Village. They most definitely 'got' it. They all seemed like great people and Harvind even met a guy he knew from his college days. and

Setting Up

Using a pessimistic assumption of a 1-mile service radius, we decided we'd cover the most people by setting up near 4:00 and Dart. By luck, this was also the same general area as our early contacts. We ended up about 1000' (300m) away, though, near 3:15 and G. We pitched camp and hooked up all the kit. Actually installing the BTS took just over an hour. We took another two hours to configure our wireless backhaul and place a PSTN call, but that was mostly due to upstream problems in the BRC NOC.

For the first few days, nothing went as planned. Broadly speaking, keeping anything running reliably at Burning Man is hard, and for some of the same reasons it is hard in rural Africa: the physical environment is brutal and the nearest retail stores are 3-4 hours away in Reno. However, the system limped along for intermittent testing in limited configurations while we sorted out the power problems.

Up and Running

By Tuesday night, we had reliable power and could start running some full-scale tests. The first thing that happened, though, was that the BTS was suddenly flooded with service requests from hundreds of phones. It seems that most burners don't bother to turn off their cell phones, and these guys were hammering our system in what amounted to a denial of service attack. Eventually, each unprovisioned phone received a reply telling it that it cannot roam onto our network, but even processing 5-10 phones per second it took nearly an hour to convince the majority of phones in our service radius to go away and leave us alone.

Once all of the registration activity died down, we were able to go out and do some range testings. We found that our service radius was roughly 1.5 km (~1 mile) and that we were limited by the sensitivity of our receiver. The poor receiver performance was due to adjustments on one of our filters getting shaken loose in the drive out here. Good thing we brought the test equipment.

After retuning the filters, our service radius was up to 2.4 km (~1.5 miles) and uplink and downlink ranges were roughly matched. Our main limiting factors on range were antenna height (only 10m/33ft), possible damage to our uplink filter, poor shielding on the uplink filter and RF crosstalk between the daughter cards inside the USRP case. [Note: We later discovered that this crosstalk could be greatly reduced through proper gain settings in the RFX cards.]

Provisioning Test Subscribers

Late Thursday afternoon, a few of our early contacts came to visit the tent, see the hardware, get their phones provisioned and try making a call.

That box on the pole contains a Linksys WRT54G and a 14 dB antenna pointed to a WiFi access point in Center Camp for backhaul to the "real world".

A New Strategy for Stray Phones

As more people began to populate Black Rock City, we saw that a lot of unprovisioned phones (particular models of phones) were continuing to try to register with us, even after they had been denied service. The rate of these repeating registration attempts was high enough to cause congestion and to expose latent bugs in our control layer. We also found that transactions on marginal radio channels placed a much greater load on the system by triggering retransmissions and timeouts in L2.

Starting on Friday afternoon, we tried a new approach for these stray phones:

• Just accept the registration attempts, even if the phones are not provisioned in Asterisk.
• Display a network code that will get attention. MCC=666 was an unclaimed code.
• Change the BTS configuration to have more control channels available at the expense of traffic capacity. We might as well, since the traffic capacity is useless when phones can't get control channels for call setup. This allowed us to support much higher levels of registration activity. (For you GSM nerds, we changed the C0 configuration from C5+7C1 to C5+3C7+4C1.)
• Change the GSM registration timer (T3212) from 6 minutes to 48 minutes.

After these changes, the registration activity died down to a manageable level within a few minutes. We also saw a wave of "IMSI detach" transactions, meaning that a lot of people were turning their phones off. Maybe they didn't like the 666.

Surprise! The BTS is a Little Too Open

On Saturday afternoon, we realized that unprovisioned users were making outgoing trunk calls. All they had to do was dial 1 at the beginning of the number to get routed to our VoIP carrier. We did some analysis and research and determined that this security hole was due to a combination of two bugs, one in our Asterisk configuration and another in our GSM control layer. By the time we fully understood the problem and could fix it without crippling the test, it was Saturday evening and our license was about to expire anyway. At around 10:00 PM we shut down the BTS for the last time and went to go see the burning of The Man.

A post-test analysis of the CDRs and logs of the GSM stack showed that we successfully connected about 120 phone calls to 95 different numbers in area codes all over North America, most of them in the last 24 hours of the test. About half of these calls lasted over a minute and the longest was over 15 minutes. At least 60 different users placed calls and nearly all of these users were AT&T and T-Mobile subscribers. No attempt was made to identify specific subscribers or called parties and all subscriber-specific information was destroyed after the analysis. Roughly 1/2 of the call attempts were successful when the subscriber prefixed the dialed number with "1", with the high failure rate due to a combination of congestion, backhaul limitations and previously-unknown bugs in the control layer. Many of the control layer bugs were corrected or mitigated during the test, causing the success rate to rise over time, even though this meant rebooting the BTS frequently. We also estimate that about 150 call attempts failed because the user did not know to use the "1" prefix.

The testing team also placed several dozen calls within the Asterisk PBX, either between provisioned handsets or to the wired SIP phone in the tent.

Social Aspects

Early Saturday evening, David was in a hooka bar at 3:15 and Esplanade. His cellphone rang with a call from the tent. At that moment, he realized that widespread calling service at Burning Man, even local service, was a mixed blessing. He got up and left the bar to take the call. The abrupt departure was rude but taking the call in the bar would have been even more rude. Since there was a queue to get back in, the call also meant the end of the hooka bar visit. At the same time, there was great utility in being able to locate a campmate in the sprawl and dust of Black Rock City. Text messaging would be a much more appropriate service, giving nearly all of the utility of a short phone call but with a much lower degree of disruption.

Regrets

We packed up Sunday morning and made the 4-hour "Exodus" to the nearest paved road. About 3 hours into this ordeal, most of the way to the gates, we heard news on BMIR that hurricane Gilbert was bearing down on the Gulf Coast and burners from that area needed to find satellite phones to make calls home. To turn around and rebuild the BTS would have taken several hours, so we just kept going. We wish we would have known about this need soon enough to help out.

Successes

Despite the difficulties with power supplies, we had several successes:

• Other than backhaul problems, which were outside of our control, we had the basestation unpacked, installed and running in less than two hours.
• The core GSM functions worked "out of the box".
• We connected a lot of real telephone calls for real people.
• Our service radius matched our predictions.
• We discovered several bugs that could not have been exposed in other testing environments.
• The BTS survived two dust storms and two afternoons of 100F heat, despite the lack of robust packaging.
• Many people visited the tent, saw the system and were impressed, including telecom engineers from major carriers.

Lessons for Next Time

If we did this again, and we well might, here's what we would do differently:

• Register as a theme camp so that people know about us and we have a predictable location.
• Fix our security holes, now that we understand them.
• Focus on SMS. Don't even provision most users for voice.
• Require users to disable audible ringtones and make a promise to take their calls out on the street as part of the provisioning process.
• If there's some real-world emergency, like a hurricane, allow users to make outgoing calls to the real world, but do not allow them to accept incoming calls. The gets rid of the problem of the ringing phone, but allows people to make important calls to their families. With Asterisk, we can even limit outgoing calls to specific area codes.
• Don't rely on a wind turbine. If we bring a turbine, it will be to augment a solar array.
• Don't use a laptop for the BTS. At ambient temperatures above about 100F, USRP drivers start to fail on the MacBook. We need something with better heat tolerance, prefably PPC-based.
• Get a taller tower if at all possible.
• Build better isolation filters and try to build better internal shielding for the USRP.
• Fit the USRP with a 13, 26 or 52 MHz clock to simplify sample rate matching with the GSM symbol clock.

Acknowledgments

We'd like to thank the people who offered assistance and support along the way.

• Bill Alexander, for helping to run the site, loaning his WiFi bridge and sweep generator, and offering useful advice on the RF chain.
• Roshan Baliga, for early footwork identifying radio gear.
• Jessica Burgess, for general moral support, camp planning and for helping round up camp supplies.
• Glenn Edens, for originally suggesting this idea.
• Dewayne Hendricks, for offering his 3318PA.
• Ralf Muehlen, for backhaul support to the "real world".
• David Rowe, for Asterisk advice.
• Raffi Sevlian, who wrote a lot of our control layer.
• Brad Templeton, our first confirmed test subscriber and friendly Asterisk reference.

注：OpenBTS Field Test（原文出处，翻译整理仅供参考!）