Important foreword around data accuracy

Sadly Field Test Mode is not that dependable: data often needs to be interpreted as it is presented in a counterintuitive way and, in particular, most of the data shown may be related to hours, if not days, before present time. For this reason it is of utmost importance to check that data has been refreshed, by verifying the timestamp that's displayed on every page, under the relative section's name. Checking the timestamp on the lower part of the application is not enough.

To force a refresh of all data, you will have to switch on and off Flight Mode or reboot the iPhone altogether. Else, to update a single section of it, exit and re-enter the same page multiple times until the timestamp under the page's name gets updated too.

The author invites users, if possible, to rely on better tools such as Network Signal Guru, available on Android devices with Qualcomm chipset and root permissions.

How to access Field Test Mode

There's two ways to access Field Test Mode:

• Using the Phone keypad: dial this string *3001#12345#*, which is the universal method and works in basically any iOS version;
• Using FTM-Opener, a shortcut that works on iOS 14, 15 and 16 but only when it is launched from iOS's Home Screen.

The dashboard

This page is designed to display any bookmarked data by the user, so one can add the most interesting entries and leave clutter behind. In iOS 16, this page is empty by default and the user can bookmark data points by tapping on the icon to the right of each entry in the different sections and pages around Field Test Mode.

Data points on the dashboard get refreshed at the same time as the section of the FieldTest from which they come; hence, it is important here too to double check that the timestamp, shown in each box, is actually up to date.

In particular, we will go through these pages:

• RAT | RAT Serving Cell Info;
• 5G | 5G Nr ConnectionStats;
• 5G | 5G Nr Rach Attempt;
• LTE | LTE ConnectionStats;
• LTE | Rach Attempt;
• LTE | Cell By Band/CA Status;
• LTE | RsrpRsrqSinr.

RAT Serving Cell Info

This page is the most frequently updated one of all Field Test Mode and is, therefore, the only truly faithful one. Here you can find some fundamental infos, such as CellID, primary band number and its bandwidth and radio technology.

It is possible to calculate the base station's eNB from the CellID in various ways:

• dividing it by 256;
• copying it, by long tapping the value, and then pasting it into the search by eNB field on LTE Italy;
• copying it, then launch this Shortcut developed by me, which collects and integrates information retrieved from LTE Italy in a simple and quick way.

The first method comes from the very definition of CellID: this number is calculated by multiplying the base station's eNB by 256, plus the CID number of the currently connected band. Viceversa, to obtain eNB number, just divide the CellID by 256 and consider only the part before decimals; for example:

`7486476 / 256 = 29244,0469 -> 29244`

To obtain the CID, instead, pick the decimal part and multiply by 256, as follows:

`29244,0469 -> 0,0469 * 256 = 12`

Band Info displays the primary band currently in use and, under that, its channel bandwidth.

Another interesting indication on this page is DeploymentType, which informs whether the phone is really connected to a NR carrier or not.

On devices with 5G modems (iPhone 12 and newer), displayed values can be:

• LTE (0) -> device is connected to LTE only;
• 5G NSA (1) -> base station only has ULI; meaning, it is telling the device to show a 5G icon despite the fact a 5G carrier is not currently available;
• 5G NSA (4) -> device is connected to a NR carrier even though at that moment it is not used to transfer data;
• 5G NSA (5) -> device is connected and transferring data on a NR carrier;
• 5G NSA (7) -> device is connected to multiple NR carriers, hence using NR-CA.

5G Nr ConnectionStats

The first thing to notice is that this page, contrary to the previous one and like all other ones explained from here onwards, very often doesn't get refreshed and it is always important to double check the timestamp displayed under the page name.

The fundamental entries among the ones presented here are the NR band number and its channel bandwidth. This information is useful to verify whether, for example, W3 has switched on 60MHz of bandwidth in the area or, for any reason, the base station is still configured to transmit only 40MHz, like in Aosta Valley.

Furthermore, it can be proved, in case of NR-CA, how many frequency blocks the device is aggregating by reading the value of nr5g_total_num_ccs and which radio modulation is in use, both in download and in upload, by reading values of max dl mod and max_ul_mod.

5G Nr Rach Attempt

This page can be used mainly to understand whether a base station has 5G inter-site enabled or if it's the one transmitting the NR signal: here RSRP values (cell_rsrp) and RSRQ (cell_rsrq), as well as the NR carrier's PCI (cell_pci), are displayed.

The latter value has proven to be quite useful to distinguish inter-site on Iliad by comparing it with PCI value present in RAT Serving Cell Info: if the two values are different then the NR cell is connected as inter-site, otherwise the same base station has got AAUs.

For other carriers, distinguishing inter-site by only looking at the Field Test is not really a reliable method, but in general if there's a sensible difference between LTE and NR carriers' RSRP (especially in B7 primary band) it is plausible that the device it's connected to the NR carrier via inter-site.

In any case, it is always better to get visual confirmation that the base station currently connected doesn't have AAUs installed to have certainty on this.

LTE ConnectionStats

This page displays most information on LTE carriers and some about NR carriers; sadly, just like the two previous pages, this one too doesn't get refreshed too often.

The first two entries indicate which primary band has been selected by the network and its channel bandwidth.

Other interesting data are the maximum download modulation (max dl mod) and upload (max_ul_mod), maximum rank (max_ue_rank), number of aggregated bands (lte_total_num_ccs) and maximum number of spatial streams for both LTE and NR.

Example: on a base station with B1, B3 and B20 with B1 and B3 with 4x4 MIMO and obviously B20 with 2x2 MIMO, the value of lte_total_dl_mimo_layers will be 10 (4+4+2) and lte_total_num_ccs will be 3.

Data entries which have the prefix mrdc get refreshed only when the device finds itself in Multi-RAT Dual Connectivity, generally when it is in 5G and it is aggregating both 4G and 5G (EN-DC); so in addition to the previous infos it shows the number of NR streams (mrdc_nr_total_dl_mimo_layers) it is detecting, how many NR carriers it is aggregating (mrdc_nr_total_num_ccs) and how many total 4G+5G spatial streams (mrdc_total_dl_mimo_layers).

Cell By Band

On this page finally the most interesting details present in Field Test Mode, which are related to the aggregated bands, are shown.

Information is grouped by band and, contrary to the CA screen on Intel modems, the band number to whom data is referring to is displayed both as a subtitle and as the first row of each subsection.

The remaining four lines for each separate band represent:

• dl_bw: the bandwidth being aggregated, expressed in RB (Resource Blocks). To obtain the value in MHz a simple calculation is in order:
  
  `"Bandwidth in MHz"="Bandwidth in RB"/5`
  
  So: 25 = 5MHz, 50 = 10MHz, 75 = 15MHz e 100 = 20Mhz.
• dl_freq: the EARFCN value of the band, for more information see this page.
• state: indicates whether the band is actually used (1) or not (0).
• ul_state: indicates whether the band is being used in upload as well as in download. In the case one of these values is 1, the device is performing UL_CA (Uplink Carrier Aggregation).

LTE CA Status

This page, as previously mentioned, has the same function as LTE | Cell By Band but is only found on iPhones with Intel modems, meaning from the 11 series backwards.

For each aggregated band, a separate subsection named after it is shown, with lots of data of which we are only actually interested in:

• dl_bandwidth: the bandwidth in MHz.
• dl_earfcn: ARFCN number of such band, additional information can be found at this page.
• dl_rf_band: band number to which the data refers to.
• has_uplink: indicates whether such band is used for upload too (1, therefore it has UL_CA) or not (0, therefore only primary band is used).
• state: SCC_STATE_ACTIVATED or SCC_STATE_CONFIGURED_DEACTIVATED, respectively if the band is actually being used to transfer data or it is idle (standby or waiting to transfer data).

LTE Rach Attempt

This page is handy on iPhone 12 as they don't show the page with radio statistics about the primary band, however it is not shown on Intel modem iPhones. Despite the fact it doesn't show RSRQ and SINR values, it at least contains the RSRP value and seems to get refreshed quite frequently.

LTE RsrpRsrqSinr

In this last page, quite self explanatory and only available on iPhone 13 and 14 series, radio statistics of primary LTE band are shown:

• RSRP: Reference Signal Received Power
• RSRQ: Reference Signal Received Quality
• SINR: Signal to Interference plus Noise Ratio, indicating how "good" and clean the signal actually is.

All this information can be compared against a dataset like the following: