LTE: Default vs. Dedicated Bearer

One of the big changes brought about by LTE is that when the mobile device connects to the network it also implicitly gets an IP address. This is called "Default EPS Bearer Activation". What seems to be a trivial change at first is actually a whole new way of thinking compared GSM and UMTS.

In 2G and 3G systems, the mobile registers to the network first and in order to get an IP address, a "PDP context activation procedure" has to follow. This is also what is known as establishing a "packet call". I never very much liked the term "packet call" which was probably created because of the still mainly circuit switched thinking at the time. So with the default bearer activated right from the start, the "packet call" and all the legacy behind it has become history.

To build on the default bearer there is also a procedure in LTE called "Dedicated EPS Bearer Activation" which is initiated for the network. But what is it needed for, most people ask at first, the mobile already has an IP address!? True, the mobile already has an IP address but the default bearer comes without any quality of service guarantees. For VoIP, IMS, VoLGA and other real time streaming applications, it would be good to have some QoS, especially on the air interface. This ensures that the base station and other network components deliver IP packets for those applications with a higher priority. Also on the mobile side, such IP packets should get a higher priority than other packets, especially when the bandwidth is limited. And that's what is done with a dedicated bearer.

In the network, the dedicated bearer is connected to a Traffic Flow Template (TFT), a concept that already exists in GSM and UMTS. In this template, think of it as a list of ip addresses and tcp/udp port combinations, describes which IP packets should be given a higher priority. The TFT is also forwarded to the mobile during the dedicated bearer activation and it helps the protocol stack to put the IP packets to or from a specific TCP/UDP port and/or IP addresses into a special QoS queue that is treated with a higher priority.

No need for the mobile to have an extra IP address for this higher priority traffic, as the protocol stack uses the Traffic Flow Template information to decide what to do with each IP packet. In other words for those who are familiar with GSM and UMTS, a dedicated bearer activation is pretty similar to a Secondary PDP context activation in 2G and 3G that can be used by the IMS for example to ensure real time data is delivered promptly.

For the details have a look at 3GPP TS 24.301, chapter 6.4 and table a bit further down for the message details.

Verizon’s first Draft Specification for LTE Devices

Unstrung has an interesting pointer to Verizon's first draft spec (v0.9) which details what they want devices to be capable of to allow them on their future LTE network. While they are mainly referring to relevant 3GPP specification documents, there are some nuggets of information in there that took my attention:

  • The 700 MHz band they intend to use seems to be band 13 in 3GPP talk. I wonder if that encompasses the complete 700 MHz band in the US or just a part for it!? In other words, will band 13 devices also be usable in other LTE networks (e.g. that of AT&T)? According to this post on Gigaohm, the total bandwidth of the 700 MHz that was auctioned off was 18 MHz per direction (uplink/downlink), so the answer is probably yes.
  • The channel bandwidth they will use: 10 MHz (double that of HSPA today but short of the theoretically possible 20 MHz as per the standard. Again, by looking at the link above, that's obvious because that's all there is available.
  • Devices must have RF connectors for testing purposes for all antennas. Haven't seen that in years on mobile devices. RF designers will have fun…
  • Devices will be assigned an IPv6 address when attaching to the network. IPv4 addresses shall be requested by the device if an application requests an IPv4 connection. The IPv4 address shall be released once no applications are executed on the device that require it. Interesting requirement, looks like an IPv4 address is not initially assigned to the mobile device by the network. This should not be a big deal, S60 for example already has a dual IPv4/IPv6 stack today.
  • Mobile device timer for moving from Connected to Idle state: The document says that the LTE standards say that the move from Connected to Idle state (on the radio layer, this has nothing to do with the IP address assignment) is controlled by the network. The standard leaves it open for the mobile to also initiate such a state change, for example if the device detects (by whatever means) that no applications currently wants to send and receive data. At this point, however, Verizon does not mandate devices to implement this. An interesting side note: Today, HSPA only knows a network initiated state change in the standards. In practice, however, there seem to be some devices that also trigger it from the devices side with a bit of an unorthodox signalling message exchange. Looks like standards people have learnt from that and included this feature in the LTE specs from day one.
  • No mention is made of dual mode CDMA/LTE capabilities. I wonder if that means that they expect that first devices will be LTE only? That wouldn't make a lot of sense to me. I can't imagine people would be very happy using a CDMA USB dongle and a separate LTE dongle, depending on where they are.
  • Verizon expects that first devices are data only, no voice capabilities. A pity, but who knows, they might yet discover the benefits of VOLGA.

Note that the current version is only a draft, there are still many unfinished chapters.

SAE Review Part 3: Keeping Track of Users – The GUTI and the GUMMEI

This is part 3 of my mini-series on the latest version of 3GPP TS 23.401 which describes how the LTE/SAE core network manages user mobility and routes data. In part 1, I've taken a look at the flexibility in terms of load balancing and network node distribution and part 2 featured a look at connection and mobility management. Part 3 now focuses at how the MME (Mobility Management Entity) keeps track of users while they are moving and helps handing over connections from one base station to the other.

As described in previous parts an LTE mobile always has an IP address assigned while it is switched on. To conserve battery and to reduce signaling there are two basic activity states are: While data is exchanged the mobile is seen as connected. If no data is transferred for some time, the network moves the connection to idle, which means the mobile has no physical connection over the air interface during that time. Data can still be sent and received but the air interface connection needs to be re-established first. For applications this is transparent, they will just notice some delay.

Mobility While Being Idle

Let's look at the idle state (to be exact RRC idle and ECM idle) first because that is the most simple from the network point of view. Here, the mobile is free to roam from one cell to another and only contact the network if it suddenly finds itself with a cell that is outside the group of cells to which its former cell belonged to. Such groups are referred to as Tracking Areas (TA) and the action performed when changing to a new cell in a different TA is referred to as a Tracking Area Update (TAU). For a mobile it is simple to detect a tracking area change because each cell broadcasts its Tracking Area ID as part of its general cell information. In case data arrives from the Internet for that user while the device is in idle state, the network has to search the mobile first and sends a 'paging' message via all cells belonging to the TA. The mobile then re-establishes the air interface connection and implicitly reports it's current location to the network.

Now let's have some fun with a couple of further abbreviations, because they are really cute. In GPRS and UMTS the mobile's temporary id was the Packet Temporary Mobile Identity, or the P-TMSI. This id is changed on a frequent basis and used instead of the IMSI (The International Mobile Subscriber Identification) in most air interface messages for security reasons. In LTE, the P-TMSI is now called the Globally Unique Temporary ID, or the GUTI. Some of the digits in the GUTI identify the Mobility Management Entity the mobile was last registered with and they are referred to as the Globally Unique MME Identifier, or the GUMMEI.

When contacting the network, the mobile sends the GUTI to the base station which then uses the parameter to identify the MME to which it will send the request to re-establish the communication session. It's also possible to roam between different radio technologies. If the mobile has reselected from a UMTS cell to an LTE cell, a TAU is made and since the mobile does not have a GUTI, the P-TMSI is sent instead. This way, the newly assigned MME can contact the 3G SGSN to request the subscribers current profile (IP address, PDP contexts, etc.). The same mechanisms apply when the mobile reselects from an LTE cell to a UMTS or GPRS cell. In this case the GUTI is sent in the P-TMSI parameter and the procedure is reffered to as Routeing Area Update (RAU) instead of TAU.

Handover between Two LTE Cells

3GPP TS 23.401 also describes the possible scenarios for handovers, i.e. the handing over of an active radio network connection. Unlike the cell reselection in idle state above, which is controlled by the mobile device, handovers are controlled by the network. Due to the flat network architecture of LTE, the handover is directly initiated by the base station and not, like in previous network architectures, by a higher network element. If implemented, two base stations can organize a handover between the two of them (over the X2 interface) and only report the successful execution to the MME afterwards. The MME then either just acknowledges the handover and the serving gateway is informed to redirect the downlink data traffic to the new cell. In case it makes sense from a network topology or traffic point of view, the MME can at this point also assign a new serving gateway. Note that in practice, the X2 interface is not a physical interface, i.e. base stations are only logically connected with each other over IP and not via a direct physical link.

If there is no direct interface between two base stations, or the base stations do not yet have that functionality implemented, the current base station can also ask the MME to coordinate the handover. This is called an S1 handover, due to the name of the interface between the base station on the MME. Again, there are a number of different variants such as with or without a change of the Serving Gateway.

Inter Radio Access Technology (Inter-RAT) Handovers

And last but not least, there is also the possibility to perform a handover from and to a different radio network architecture, i.e. from/to a GPRS or UMTS network. Three different variants exist:

  • To/from an SGSN that is aware how a LTE core network works and has the S4 interface implemented.
  • In case Direct Tunnel is used in a UMTS network, the S4 and S12 interfaces are used for the handover.
  • And for networks without upgraded SGSNs there is a backwards compatible variant. In this case the MME acts like an SGSN for the older network elements. This is probably the way how handovers to and from LTE will be made at first. This variant is described in Annex-D of the specification, which kind of marks it as a temporary solution.

It all sounds very complicated with lots of options and it probably is. It makes one appreciate network operators who have done their homework and have optimized their networks for seamless nationwide handovers without dropped calls and lost IP addresses. Yes, they do exist.

Nevertheless, to me this all looks a lot more straight forward compared to how things are done in UMTS. Here, the RNC complicates matters and in practice not all network elements can communicate with all others. In LTE/SAE, the removal of the RNC and using IP as the routing protocol for all network activities instead of ATM makes things a lot simpler. Those who don't believe me should have a look at the situation that requires a UMTS SRNS relocation for both the circuit switched and packet switched side simultaneously and how the messaging looks like…

For those who would like to know more about Inter-RAT handovers with CDMA networks I can warmly recommend the several hundred pages of specification in an additional document, 3GPP TS 23.402. Another tribute to CDMA that is also described there is the use alternative use of PMIP (Proxy Mobile IP) instead of the 3GPP GTP (GPRS Tunneling Protocol) on the Interface between the MME and the PDN-Gateway (to the Internet). Long live the options!

There we go, we are almost through with the main SAE features. Remains the Idle State Signaling Reduction (ISR) feature, but I keep that for part 4.

Escaping Future Bandwidth Bottlenecks: LTE and HSPA on Several Bands

I think everyone in the industry is pretty clear by now that the amount of data that cellular wireless networks will have to carry in the future is going to rise. In my recent book I’ve taken a closer look at theoretical and practical capacity on the cellular level in chapter 3 and I come to the conclusion that from a spectrum point of view, there is quite a lot of free space left in most parts of the world that will last for quite some time to come.

So while alternative approaches like integrating Wi-Fi and femtos into an overall solution will ultimately bring much more capacity, I think it is quite likely that network operators will over time deploy their cellular networks in ever more bands. In Europe, for example, I think it’s quite likely that operators at some point will have networks deployed on the 900, 1800, 2100 and 2600 MHz band simultaneously.

Quite an interesting challenge to solve for networks and especially for mobile devices as they have to support an ever growing number of frequency bands.  Also, those bands should not also be used in tight cooperation instead of just aside each other. Ideally, the resources in the 900 MHz band could be reserved for in-house coverage as radio waves in this band penetrate walls quite well. But as soon as the network or the device detect that other bands can be received quite well, they should automatically switch over to them to leave more capacity for devices used indoors or under difficult radio conditions.

Switching between different frequencies and radio technologies during a call or a session is already done today but mostly based on deteriorating reception levels. So in the future, when using so many bands, I think this reactive mechanism has to be enhanced into a proactive mechanism and switch-overs need to be timed so that the user does not notice an interruption.

2 Day LTE Services Course at the University of Oxford

Great News: On April 20 and 21st, Ajit Jaokar of Open Gardens and I will host a 2 day course on LTE Services at the University of Oxford's Department of Continuing Education!

Here’s the agenda:

  • New services based on enhanced capacity of the network
  • IP based business models
  • Rich voice applications
  • New role of devices to handle rich content and social networks
  • Social networks based on rich content like video
  • Services unique to LTE and the core network
  • Greater role for user generated content and for rich media
  • Unified communications and beyond 3G networks
  • Fixed mobile integration – leveraging enhanced networks and learning from past mistakes
  • Integrated networks and connecting back to home networks
  • Network elements: Femtocells vs Wi-Fi in the home gateway and services based on these elements
  • Wireless sensor networks at home and their role and opportunity in an overall beyond 3G network

I am very happy to be part of this and it will be great to look at these topics from our two different angles. We've also put together a questionnaire to see what your angle is on this topic. If you have a minute and are interested, we'd be happy to get your feedback. We'll share the result with those who leave their e-mail address and of course with all course participants. Needless to say that all responses are treated confidentially.

So, if I have caught your interest, head over to the course's web site for the details. During this week, there’s also the yearly Forum Oxford Future Telecommunication Conference. More about that in an extra post once the details are sorted out.

SAE Review Part 2: Mobility and Connection Management

LTE and SAE are making big steps forward and the major specification documents are nearing completion. In part 1 of this mini-series, I've started taking a closer look at 3GPP TS 23.401, the main SAE (System Architecture Evolution) specification document and reported about the flexible meshed like architecture design. In this part, I'll have a look at Evolved Packet System Mobility Management (EMM) and EPS Connection Management (ECM) and their differences to Mobility- and Session Management of UMTS.

Before taking a look at the features in SAE, let's have a look at how similar things work today with UMTS as many of you will be familiar to that. Here, the SGSN at the border between the radio access network and the core network has two management tasks:

UMTS – Packet Mobility Management

The first is called Packet Mobility Management (PMM) and deals with keeping track of the whereabouts of mobile devices. There are three states: A mobile device is PMM detached when it is switched off or if it is not connected to the packet switched part of the UMTS network. That's the case for example if the device has been set to connect to the circuit switched part right at power on but not to the packet switched part unless it becomes necessary, i.e. the user wants to establish a data session. When a data session is established, the connection state changes to PMM connected. Afterwards, if the mobile is connected but hasn't exchanged data with the network for some time, the radio network controller (RNC) can ask the SGSN to release the mobility management connection. The connection then enters PMM idle state and the mobile only reports to the SGSN when it changes a routing or location area. If an IP address was assigned, it is kept. From the application layer point of view (e.g. the web browser) there is no difference between PMM connected and PMM idle.

UMTS – Session Management

The Mobility Management only deals with the whereabouts and tracking of the mobile device, so this state machine knows nothing about assigned IP addresses and contexts. This is task of Session Management (SM). Here there are only two states, either a device has a session and an IP address or it hasn't. 

And now to SAE / LTE

In SAE things work a bit different and I guess that's the reason why the mechanisms had to change as well. The biggest difference in SAE is that once a mobile device is switched on it always has at least a default bearer. In other words, it always has an IP address when it is switched on. And again in other words it's not possible for a mobile device to be attached to the network and not have an IP address. Hence, session managements makes no sense in LTE/SAE. To reflect this, the following two state machines are used in LTE/SAE:

EPS – Mobility Management

This EMM state machine only has two states. When a mobile is switched off or uses a different radio access network technology (e.g. GPRS or UMTS) it's state is EMM deregistered. That's simple. There's an optional feature referred to as Idle-mode Signaling Reducation (ISR) described in Annex J of 23.401 that changes that rule somewhat but let's ignore it for now. Once the mobile sees an LTE network it tries to register and if successful it's state is changed to EMM registered. At the same time the mobile is also assigned an IP address. As a consequence mobile devices in EMM registered state always have an IP address. But the EMM state machine does not care about that fact, it is only influenced by mobility management procedures such as Attach, Detach and Tracking Area Updates. While in EMM registered, the network knows the location of the mobile device either on a cell level or a tracking area level. Which of the two depends on the connection management state machine described right below.

EPS – Connection Management

When a mobile device is registered (EMM state = registered) it can be in two connection management (ECM) states. While a data transfer is ongoing the device is in ECM connected state. For the mobile device this means that on the radio link a Radio Resource Control (RRC) connection is established. For the network, ECM connected means that both the Mobility Management Entity (MME) and the Serving (User Data) Gateway (SGW) have an connection to the mobile device via the S1 interface (the physical and logical link between the core network and the radio access network). in ECM connected state, the location of the mobile is known to the cell level and cell changes are controlled by handovers.

If there is no activity for some time, the network can decide that it is no longer worthwhile to keep a logical and physical connection in the radio network. The connection management state is then changed to ECM idle. Note the use of the term 'idle'. It doesn't mean the connection completely goes away. Logically, it is still there but the RRC connection to the mobile is removed as well the S1 signalling and data link. The mobile continues to be EMM registered and the IP address it has been assigned remains in place. In ECM idle state the location of the mobile is only known down to the tracking area level and cell changes are performed autonomously by the device without any signaling exchanges with the network

Interactions With the Radio Interface

From the base station and mobile device point of view there is a lot of room for maneuvering between ECM connected and ECM idle. While a lot of data is exchanged, the air interface can be fully activated for a device so it has to continuously listen for incoming data. In times of lower activity or even no activity at all, the base station can activate a discontinuous reception (DRX) mode so mobile devices can power down their transcievers for some time. The power down cycles range from milliseconds to seconds. In fact, the longest DRX cycle is as long as the paging interval. So from a mobile point of view the main difference between being in ECM connected state with a DRX cycle the length of a paging intervall and being in ECM idle state without a radio interface connection is how it's mobility is controlled. In ECM connected state, handovers are performed, in ECM idle state, it can change its serving cell autonomously and only has to report to the network when it leaves the current tracking area. In other words, the base station is likely to keep the mobile device in ECM connected state for as long as possible by using DRX so data transfers can be resumed very quickly before cutting the link entirely and setting the state to ECM idle.


Quite difficult to make a summary as Mobility Management, Connection Management and air interface DRX control are in theory independent from each other but have to be looked at in common to make sense. In a rough generalization I would say that during normal operation:

  • a mobile is always in EMM registered state because it's identiy is known to the network and, implicity, an IP address has been assigned;
  • a mobile transfering data is always in ECM connected state;
  • a mobile not transfering data is also in ECM connected state but DRX is activated on the air interface;
  • only mobile whith very long periods of inactivity are in ECM idle state while staying EMM registered.

I hope this look at EMM and ECM from different points of view have made the concepts a bit clearer. In the next part of this mini-series, I'll have a look at the different handover variants the SAE architecture supports to ensure the mobile device is always best connected. As always, comments are welcome.

SAE Review Part 1: Let’s Be Flexible and Redundant

Release 8 of the 3GPP specification is nearing completion and I thought it's the right time to have a closer look at one of the key core network architecture specifications for LTE, or to be precise, the SAE (System Architecture Evolution) in 3GPP TS 23.401. It's title 'GPRS enhancements for E-UTRAN' is a bit misleading as it is an architecture document in itself that shows the full architecture and not only enhancements. It has become a massive document, 219 pages at the moment, so a single blog post won't do to describe the features which are different compared to GSM and UMTS. So I've decided to split the review into several parts and start with the flexibility and redundancy of network elements which is built into the system from day one.

In the initial 3GPP specs for UMTS (Release 99 or Release 3 if you will after the current counting method), the network was pretty hierarchical. One UMTS base station (NodeB) was connected to one radio network controller (RNC) which was in turn connected to one MSC for voice calls and one SGSN (Serving GPRS Support Node) for packet data traffic. In later 3GPP releases the RNC interface has become more flexible (the famous Iu flex) and in theory, a single UMTS RNC can now be connected to several MSCs and SGSNs for redundancy and load sharing purposes. In practice, however, I suspect it is not used a lot (yet).

Splitting the gateway into MME and SGW and assigning several to a single base station

In the LTE/SAE specs, flexibility and redundancy is built in from day one.  A single LTE base station, called eNodeB, can now be connected to several gateway nodes simultaneously. The gateway node itself is split into a Mobility Management Entity (MME) and a Serving Gateway (SGW) and an interface has been defined between the two. So in practice both can be in the same physical device or split into two different devices. There is also no need to have the same number of MMEs and SGWs in the network, so capacity can be independently increased for the management part (MME) or the datapath (SGW) as needed.

Moving subscribers from one gateway to another and creating redundancy

There are even functions foreseen to move subscribers of one MME or SGW to another MME or SGW, for example to upgrade the software and then reboot the device. Another benefit of pools is that in case one device fails, not all users in the area are affected. If one node fails and the connection is interrupted a device can quickly reconnect and be assigned to a different node. Quite a difference to today where the failure of a single SGSN immediately renders a part of the network useless. It happens often enough…

[Updated 7. September 2009] Tracking Area Lists to prevent border hopping

Another piece of flexibility are tracking area lists, which used to be called location areas (LAs) or routing areas (RAs) in UMTS. Like LAs and RAs, a tracking area is a conglomerate of one or more cells. Mobile devices currently not connected to the network only have to report to the network when they change to a tracking area which is not in the list that was assigned to them by the MME during the last tracking area update. This reduces power consumption and reduces mobility management signaling in the network. Tracking area lists in effect blur the tracking area boundaries and prevent scenarios in which a mobile device keeps hopping between two cells in different tracking areas resulting in frequent signaling exchanges and battery drain.

Packet Data Network Gateway flexibility

And of course the packet data gateway (PDN-GW), the gatekeeper between the mobile network and the Internet (or a fixed line IP network in general) is also not fixed but can be chosen from a pool.


As shown above, the whole LTE/SAE architecture has been defined in a very flexible way for several reasons. Compared with the flexibility added to GSM/GPRS and UMTS over time, this goes one step further and the use of IP for all interfaces helps a great deal to make this much more simple than in 2G and 3G networks.

So much for today. In the next part, I'll look at Mobility- and Connection Management (EMM and CMM) and the differences to UMTS's Packet Mobility Management and Session Management (PMM and SM).

How Can LTE Reduce the Cost Per Bit?

Recently, a question was asked in the LTE forum on LinkedIn how LTE can reduce the cost per bit compared to todays broadband wireless systems such as HSPA. I found it quite interesting that a lot of people immediately jumped at the greater spectral efficiency as the means to reduce the overall cost. But I think there are also other innovations which will drive down cost:

  • There are no Radio Network Controllers (RNC) anymore, i.e. fewer network components
  • The backhaul network is radically different. While E-1/T-1 connections (cable, microwave) are still heavily used today, LTE will be rolled out with Ethernet over fiber / VDSL and microwave. Huge cost advantage here. It's not spectral efficiency operators worry about today, it's the rising E1/T1 backhaul costs.
  • In all fairness, it has to be said, that current HSPA networks are changing towards this as well in terms of backhaul and network element (e.g. one tunnel architecture) but it is not built in and the RNC is still required.
  • Another reason why LTE has a cost advantage over today's deployed networks is that technology has advanced and allows smaller base stations to be built which require less power, less space. These will be deployed from day 1 and in many cases will be put inside existing base station cabinets or mounted besides.
  •  Also count in remote radio head technology that will probably be used heavily with LTE to drive the cost down.
  • In the mid- to long term, I think LTE access will be the catalyst to have multi radio base stations with a common Ethernet based backhaul thus also driving down the cost of 2G and 3G systems to some extend that will remain in place for the time to come.

Anything else you can think of?

LTE Field Performance

Ericsson has published an interesting article in their Ericsson review (3/2008) on their latest LTE development state. Both lab and outdoor trials were done and the article together with the many graphs and pictures is an interesting read. Highly recommended! While you read, however, you should keep the following things in mind:

  • Unlike the setup recently used by T-Mobile and Nortel in Germany, only a single base station site was used, i.e. their measurement results do not reflect a typical network deployment, were neighboring cell interference will have an impact on the throughput.
  • When looking at the graphs, it should be kept in mind that according to this article by Agilent's Moray Rumney, 90% of the users will not experience a signal to noise ration (SNR) of more than 15 dB. 50% of the users will be below 5 dB. So make sure you have a look at the graphs at those locations.
  • Figure 8 shows nicely, that 64QAM modulation only makes sense at an SNR of more than 15 dB. In other words 90% of the users will not benefit from such high order modulation. However, if you can place your LTE receiver (e.g. your dongle dock) near the window in the direction of the next base station for stationary use the system will be able to server you a lot better than indoors.
  • 4×4 MIMO is nice but I doubt that we will see this implemented in base stations or real mobile devices anytime soon.

Despite these things, however, the graphs and experiences made by Ericsson should make for a nice experience in practice once LTE gets deployed and mobile devices are available.


These days I was wondering if in the mid-term, femtocells might replace public Wi-Fi hotspots!?

With the rise of 3G USB keys and notebooks with built in 3G connectivity, the popularity of Wi-Fi hotspots, especially paid ones, is likely to degrade over time. Once people have a 3G card anyway and have instantaneous connectivity anywhere, people just won't bother anymore to search for a public Wi-Fi hotspot and go through the manual login process. In addition, femtos remove another shortcoming of public Wi-Fi, the missing air interface encryption which today leaves the door wide open for all kinds of attacks.

With rising demand for Internet access in hotspot areas such as hotels, airports, train stations, etc., HSPA or LTE femtocells might be the ideal replacement for aging Wi-Fi access points which at some point have to be replaced by new equipment anyway. So mobile operators such as T-Mobile, Orange and others, who have a dual 3G / Wi-Fi strategy today could at some point just make such a move if they see that use of their Wi-Fi systems is decreasing and use of their 3G/4G macro base stations in the neighborhoods of their Wi-Fi installations is significantly increasing.

Some 'dual-mode' operators might even have a database with the geographical location of their base stations and their Wi-Fi installations. Together with traffic statistics of both systems an automated system could document changes over time and could be used to help predict when and if a replacement of the Wi-Fi access points for femto cells might make financial sense. After all, femto cells are just as easily connected to a DSL line than a Wi-Fi installation.

Maybe some femto manufacturers even come up with integrated Wi-Fi/Femto boxes for public installations with the Wi-Fi being used to create a wireless mesh between several nodes in locations with only a single backhaul line and for access for those people not yet having 3G connectivity. Agreed, femto vendors today mainly position themselves around the femto base station for home networks but public femtos might be an interesting opportunity as well.