f RRC and NAS messages using the dedicated control channel. However, there is no SRB2 defined for NB-IoT. In addition, a new SRB, the SRB1 is defined, which is implicitly configured with SRB1 using the same configuration, rather without the packet data convergence protocol entity. This bearer type plays the role of the SRB1 until the security architecture is activated, after that SRB 1bis is not used anymore. This also implies that for the control-plane CloT EPS optimization, only SRB1bis is used, because there is no security activation in this mode. The NB-IoT user-plane and control-plane protocol stack are the same as those of LTE with functionalities optimized for NB-IoT sustainable operation (see Fig. 6.7). Chapter 6 Spectrum CDF of throughput LTE_UL NBloT UL Stand-alone Inband Frequency (MHz) SNR (dB) Spectrum CDF of throughput LTE_UL NBloT UL Stand-alone Guardband Frequency (MHz) SNR (dB) Figure 6.6 Example of in-band/guard-band NB-loT operation and uplink coexistence analysis (10 MHz victim LTE system and aggressor NB-loT device). A total of 1000 LTE subframes were used to derive CDF of the throughput 16,17]. NB-loT data transmission on control-plane (low overhead) LTE data transmission on user-plane (IP overhead) User-plane Control-plane Figure 6.7 NB-loT user-plane and control-plane protocol structure [6]. Internet of Things 757 6.3 Physical Layer Aspects 6.3.1 Frame Structure The downlink multiple access scheme of NB-IoT is based on orthogonal frequency division multiple access with the same 15 kHz subcarrier spacing as LTE with the slot, subframe, and frame durations configured as 0.5, 1, and 10 ms, respectively. Furthermore, the slot for- mat in terms of cyclic prefix length and number of OFDM symbols per slot are also identi- cal to those in LTE. In principle, an NB-IoT carrier can occupy one LTE PRB in the frequency domain. Reusing the same OFDM numerology as LTE ensures coexistence with LTE in the downlink. The uplink of NB-IoT supports both multi-tone and single-tone trans- missions. Multi-tone tr