2. Contents
Chapter Slide #
1. Introduction 1
2. Foundation Topics
Layer-3 Messaging 9
Call Processing 14
Performance Indicators and Problem Signatures 95
PN Planning and Search Windows 116
2. Analyzing System Performance 138
System Data and Analysis Techniques 141
3. Mobile Field Tools and Data Analysis 191
Autonomous Mobile Data Collection 196
Conventional Field Data Collection Tools 201
4. Multiple Carrier Systems: Operating Principles and Analysis 262
5. Applied Optimization 292
6. 1xRTT Optimization Issues 334
Appendix I. Cell Loading Example 405
Appendix II. CDMA/3g1x Books, Publications, Web Resources 419
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 2
3. Course RF200
Introduction to Performance
Introduction to Performance
Optimization
Optimization
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 3
4. Welcome to Course RF200
Course RF100 is an introduction to RF and CDMA principles. After
completing it, you should be familiar with:
• General RF system design principles
• CDMA technology - principles, channels, network basics
• key fundamentals of Messaging and Call Processing
Course RF200 covers how to recognize and deal with system
performance problems
• key performance indicators and what they mean
• what tools are available for discovering and analyzing
problems
• mechanisms and situations that cause trouble
• how to solve many of the problems you’ll see
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 4
5. Good Performance is so Simple!!
One, Two, or Three good signals in handoff
BTS BTS • Composite Ec/Io > -10 db
Enough capacity
• No resource problems – I’ve got what I
BTS need
Ec/Io
BTS A
BTS B
BTS C
-10
available
FORWARD power
Traffic
LINK Channels
In use
Paging
Sync
Pilot
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 5
6. Bad Performance
Pilot Pollution
BTS BTS Weak Signal
Scarce Resources
available
power
• BTS forward power
Traffic
BTS
Channels • BTS receive power
In use
BTS Rx Pwr Paging • channel elements
Sync
Pilot • packet pipes
Poor System Statistics
• High Dropped Calls
• High Access
Failures
Percent
Total Drop Call Percentage
5.0%
4.5% %Drops
4.0%
3.5%
3.0%
2.5%
2.0%
1.5%
1.0%
0.5%
0.0%
Date
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 6
7. What is Performance Optimization?
The words “performance optimization” mean different things to
different people, viewed from the perspective of their own jobs
System Performance Optimization includes many different smaller
processes at many points during a system’s life
• recognizing and resolving system-design-related issues (can’t
build a crucial site, too much overlap/soft handoff, coverage
holes, etc.)
• “cluster testing” and “cell integration” to ensure that new base
station hardware works and that call processing is normal
• “fine-tuning” system parameters to wring out the best possible
call performance
• identifying causes of specific problems and customer
complaints, and fixing them
• carefully watching system traffic growth and the problems it
causes - implementing short-term fixes to ease “hot spots”, and
recognizing problems before they become critical
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 7
8. Performance Optimization Phases/Activities
Phase Drivers/Objectives Activities Main Tools Success Indicators
Cover desired area; Plan cells to effectively cover Prop. Models,
RF Design and
have capacity for as needed and divide traffic Test Transmitters, Model results
Cell Planning anticipated traffic load appropriately planning tools
New Cluster Ensure cells properly
Drive-test: coverage, all Drive-test tools; All handoffs occur;
constructed and
Testing and handoff boundaries, all call cell diagnostics and all test cases
configured to give
Cell Integration events and scenarios hardware test verified
normal performance
Solve Specific Identify problems Drive-test tools, Identified
Detect, Investigate, Resolve
Performance from complaints or system stats, problems are
performance problems
Problems statistics; fix them! customer reports resolved
Well-System Ensure present ‘plant’ Watch stats: Drops, Blocks, Acceptable levels
Performance is giving best possible Access Failures; identify/fix hot System statistics and good trends
Management performance spots for all indicators
Manage congested Watch capacity indicators; Smart optimization Stats-Derived
Capacity
areas for most identify problem areas, tune of parameters; indicators; carried
Optimization effective performance parameters & configuration system statistics traffic levels
Sectors are
Growth expanded soon
hello
Management: Overall traffic
increases and
Predict sector and area
Traffic analysis and
trending tools;
after first signs of
Optimizing both exhaustion: plan and validate congestion;
congestion; prop. models for
Performance effective growth plan, avoid capital budget
competition for capital cell spliiting; carrier
and Capital integration impact remains within
during tight times additions
Effectiveness comfortable
bounds
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 8
10. Messages in CDMA
In CDMA, most call processing events are driven by messages
Some CDMA channels exist for the sole purpose of carrying
messages; they never carry user’s voice traffic
• Sync Channel (a forward channel)
• Paging Channel (a forward channel)
• Access Channel (a reverse channel)
• Forward or Reverse Dedicated Control Channels
• On these channels, there are only messages, not voice or data
Some CDMA channels exist just to carry user traffic
• Forward Fundamental and Supplemental Channels
• Reverse Fundamental and Supplemental Channels
• On these channels, most of the time is filled with traffic and
messages are sent only when there is something to do
All CDMA messages have very similar structure, regardless of the
channel on which they are sent
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 10
11. The Basic Format of CDMA Messages
EXAMPLE:
CDMA messages on both forward A POWER MEASUREMENT
and reverse traffic channels are
normally sent via dim-and-burst REPORT MESSAGE
Messages include many fields of Field Length
binary data (in bits)
The first byte of each message MSG_TYPE (‘00000110’) 8
identifies message type: this allows ACK_SEQ 3
the recipient to parse the contents MSG_SEQ 3
To ensure no messages are ACK_REQ 1
missed, all CDMA messages bear
serial numbers and important ENCRYPTION 2
messages contain a bit requesting ERRORS_DETECTED 5
acknowledgment
POWER_MEAS_FRAMES 10
Messages not promptly
acknowledged are retransmitted LAST_HDM_SEQ 2
several times. If not acknowledged, NUM_PILOTS 4
the sender may release the call
NUM_PILOTS occurrences of this field:
Field data processing tools capture
and display the messages for study PILOT_STRENGTH 6 t
RESERVED (‘0’s) 0-7
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 11
12. Message Vocabulary: Acquisition & Idle States
Pilot Channel Sync Channel
No Messages Sync Channel Msg
Access Channel
Paging Channel BTS
Registration Msg
Access Parameters Msg General Page Msg
Order Msg
System Parameters Msg Order Msg • Mobile Station Acknowldgment
•Base Station Acknowledgment
•Lock until Power-Cycled • Long Code Transition Request
• Maintenance required • SSD Update Confirmation
CDMA Channel List Msg many others….. many others…..
Extended System Channel Assignment Origination Msg
Parameters Msg Msg
Extended Neighbor Page Response Msg
List Msg Feature Notification Msg
Authentication Challenge
Global Service Authentication Response Msg
Redirection Msg Challenge Msg
Status Response Msg
Service Redirection Msg Status Request Msg
TMSI Assignment
SSD Update Msg TMSI Assignment Msg Completion Message
Data Burst Msg
Null Msg Data Burst Msg
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 12
13. Message Vocabulary: Conversation State
Forward Traffic Channel
Order Msg Alert With Reverse Traffic Channel
• Base Station Acknowledgment Information Msg
• Base Station Challenge
Confirmation
Service Request Msg Service Request Msg Origination
• Message Encryption Mode Continuation Msg
Authentication Service Response Msg Service Response Msg Authentication Challenge
Challenge Msg Response Msg
TMSI Assignment Msg Service Connect Msg Service Connect TMSI Assignment
Completion Message Completion Message
Send Burst DTMF Msg Service Option Service Option Control Send Burst DTMF Msg
Control Msg Message
Set Parameters Msg Status Request Msg Status Response Msg Parameters Response
Message
Power Control Flash With Flash With Power Measurement
Parameters Msg. Information Msg Information Msg Report Msg
Retrieve Parameters Msg Data Burst Msg Data Burst Message Order Message
• Mobile Sta. Acknowledgment
Analog Handoff Extended Handoff Pilot Strength •Long Code Transition
Direction Msg Direction Msg Measurement Msg Request
• SSD Update Confirmation
SSD Update Msg Neighbor List Handoff Completion Msg • Connect
Update Msg
Mobile Station In-Traffic System
Registered Msg Parameters Msg
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 13
15. Troubleshooting Call Processing
CDMA call processing is complex!
• Calls are a relationship between mobile and system
– the events driven by messaging
– the channels supported by RF transmission
• Multiple codes and channels available for use
• Multiple possible problems - physical, configuration, software
• Multiple concurrent processes in the mobile and the system
Troubleshooting focuses on the desired call events
• What is the desired sequence of events?
• Compare the actual sequence of events.
– What’s missing or wrong? Why did it happen?
Messaging is a major blow-by-blow troubleshooting tool
RF indications reveal the transmission risks and the channel
configurations
Bottom Line: To troubleshoot effectively, you’ve got to know call
processing steps and details AND the RF basis of the transmission
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 15
16. Course RF200
Let's Acquire The System!
Let's Acquire The System!
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 16
17. What’s In a Handset? How does it work?
Digital
Rake Receiver Symbols
Chips Traffic Correlator
summing
PN xxx Walsh xx
bits
Traffic Correlator
PN xxx Walsh xx
Σ Symbols
control
Receiver Traffic Correlator ∆t Viterbi Decoder,
time-aligned
RF Section Convl. Decoder,
PN xxx Walsh xx Demultiplexer
power
IF, Detector
Traffic Correlator Packets
AGC
PN xxx Walsh xx
RF Audio
Open Loop
Messages
Duplexer Pilot Searcher
CPU Vocoder
PN xxx Walsh 0
RF Transmit Gain Adjust Audio
Messages
Transmitter
Transmitter Digital Section
RF Section
Long Code Gen.
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 17
18. The Task of Finding the Right System
Reverse Link Frequencies Forward Link Frequencies
(Mobile Transmit) (Base Station Transmit)
800 MHz. Cellular Spectrum
824 MHz. 835 845 849 870 880 890 894
A B Paging, ESMR, etc. A B
825 846.5 869 891.5
1900 MHz. PCS Spectrum
unlic. unlic.
A D B E F C data voice A D B E F C
1850MHz. 1910MHz. 1930MHz. 1990 MHz.
FREQUENCY LISTS:
Mobile scans forward link frequencies:
HISTORY PREFERRED
(Cellular or PCS, depending on model) LIST/MRU ROAMING
History List (MRU) LIST/PRL
Last-used:
Preferred Roaming List (PRL) Freq System1
Freq System2
until a CDMA signal is found. Freq System3
Use PRL to find best signal in area. Freq System4
Freq System5
NO CDMA? Try AMPS. No AMPS? Standby etc. etc.
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 18
19. The System Determination Algorithm
At turnon, Idle mobiles use proprietary System Determination Algorithms
(SDA) to find the initial CDMA carrier intended for them to use
The mobile finally acquires a CDMA signal and reads the Sync channel
• Find the SID & NID in the PRL (Preferred Roaming List)
• Check: is there a more-preferred system in the PRL? What Freq(s)?
• Go look for the better system
Start
Preferred
MRU Only Bit 0 PRL Acq Idx
Yes
Go to last Strongest Is better
Is SID
frequency PN, read SID
permitted?
from MRU Sync available?
No Signal No
Denied SID
Read
Last Resort: Paging Best System Found!
GEO escape Channel Begin Normal Paging Channel Operation
Or Analog
Legend
Steps from Steps from Proprietary Typical Mobile
the CDMA proprietary SDA
standards SDAs databases System Determination Algorithm
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 19
20. 1xRTT Acquisition On the Current Frequency:
Find Strongest Pilot, Read Sync Channel
All PN Offsets
0
Ec/Io
1. Pilot Searcher Scans the Entire Range of PNs
-20
Chips 0 32K
PN 0 512
SYNC CHANNEL MESSAGE
2. Put Rake finger(s) on strongest MSG_LENGTH, 28, 28 octets
MSG_TYPE, 1, Sync Channel Message
available PN, decode Walsh 32, P_REV, 6, IS-2000 Revision 0
MIN_P_REV, 1, J-STD-008
and read Sync Channel Message SID 995,
Is this the right system to use?
NID 3,
PILOT_PN 240 Check the PRL!
Active Pilot LC_STATE, 0x00 25 93 12 7C FA,
SYS_TIME, 0x02 20 34 B7 53,
10/23/2001 11:02:54
Handset Rake Receiver Rake Fingers
LP_SEC, 13,
LTM_OFF, 54, -660 minutes
F1 PN168 W32 DAYLT, 1, Yes
F2 PN168 W32 PRAT, 1, 4800 bps
RF CDMA_FREQ, 274 (IS-95)
≈ x ≈ F3 PN168 W32 EXT_CDMA_FREQ, 274 (1xRTT)
LO
Srch PN??? W0 SR1_BCCH_SUPPORTED, 0
SR3_INCL, 0, No
Reference PN RESERVED, 0,
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 20
21. PRL Database Guides System Determination
Handsets can be programmed with their Preferred Only bit set to True or
TRUE False. If True, the handset can only used preferred systems. If False, the
Preferred Only Bit FALSE handset can use non-preferred systems, but will prefer preferred systems
when available.
Acquisition Index There are 29 Acq Indexes in the current PRL. It
is normal for some to contain duplicate channels.
0 CDMA channels 350,400
1 CDMA channels 50, 100
2 Analog Block A When the phone Every three minutes idle
3 Analog Block B loses service, it phones rescan for any more-
scans the list of preferred signals in the current
channels in its Geo Group. This is called
current GEO group. “climbing the GEO group”.
System Records
SID NID PREF GEO Priority Index Roam Indicator
4139 65535 Pref New More 0 Off
59 65535 Pref Same More 2 On
52 65535 Pref Same More 3 Flash Some records are merely analog
“Guideposts” to allow the phone to
67 65535 Neg Same Same 3 Short-short-long
recognize where it is and position into the
4412 65535 Pref New More 1 Off proper GEO group “GEO confinement”.
: : : : : : :
61737 226 Neg New More 0 Off The last system record is not a real
system. It merely contains the version
65535 is a “wildcard” NID. Preferred “more” number of the PRl and is used by some
The phone is to accept any than the following phones to allow displaying the version.
NID it sees on this system. record.
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 21
23. Climbing the GEO Group
SYSTEM TABLE ACQUISITION TABLE
ROAMING LIST
NEG/ ACQ ROAM INDEX ACQ TYPE CH1 CH2 CH3 CH4 CH5 CH6 CH7 CH8 CH9
0 6 500 425 825 575 850 325 625
INDEX SID NID PREF GEO PRI INDEX IND 1 6 575 625 500 425
Roaming List Type: IS-683A 2 6 50 100 75 475 825 850 175 250
296 4144 65535 Pref NEW SAME 13 1
Preferred Only: FALSE 297 4812 65535 Pref SAME MORE 21 1
3 6 25 200 350 375 725 50 475 175 250
a GEO GROUP
4 1 Both
Default Roaming Indicator: 0 298 205 65535 Pref SAME SAME 4 0 5 6 450 500 350 575 650
Climb!
299 208 65535 Pref SAME MORE 37 0 6 6 675 500 600 575 475
Preferred List ID: 10018 7 6 250 50 175
300 208 65535 Pref SAME SAME 4 0 8 6 550 375 425 625
301 342 65535 Pref SAME MORE 37 0 9 6 75 50 175 250
302 342 65535 Pref SAME SAME 4 0 10 6 200 250 175 50
When traveling the first signal
11 6 425 500 575 25 325 650
303 478 65535 Pref SAME SAME 4 0 12 6 500 575 475 25 675
304 1038 65535 Pref SAME SAME 4 0 13 6 500 625 350 50 375 775 575 725 425
found is usually not the best 305
306
1050
1058
65535 Pref
65535 Pref
SAME
SAME
SAME
SAME
4
4
0
0
14
15
16
6
6
6
650
25
425
500
50
550
675
375
225
25
350
725
75
250
750
425 50 575
175
775
one to use 307
308
1375
1385
65535 Pref
65535 Pref
SAME
SAME
SAME
MORE
4
4
0
0
17
18
6
6
200
825
50
850
175
925
375 250
19 6 350 325 375 675 25 1175 725 600 100
309 143 65535 Pref SAME MORE 37 0
When the SID and NID are 310 143 65535 Pref SAME MORE 4 0
20
21
22
6
6
6
750
325
1150
725
725
1175
775
350 750 375 775 425 575 625
looked up in the PRL, they 311
312
4103
4157
65535 Pref
65535 Pref
NEW
SAME
SAME
MORE
3
2
1
1
23
24
6
6
350
25
875
1175
325
825
375 1175
200 75 175 250
are far down the list of 313 312 65535 Pref SAME SAME 4 0 25 6 50 200 25 100 250 75
a GEO GROUP
26 6 500 1075 850 825
314 444 65535 Pref SAME MORE 37 0 27 1 A
available choices 315
316
444
1008
65535 Pref
65535 Pref
SAME
SAME
SAME
SAME
4
4
0
0
28
29
30
1
5
5
B
A
B
317 1012 65535 Pref SAME SAME 4 0
The starts at the top of the
31 5 C
318 1014 65535 Pref SAME SAME 4 0 32 5 D
33 5 E
319 1688 65535 Pref SAME MORE 4 0
GEO group and works down 320
321
113
113
65535 Pref
65535 Pref
SAME
SAME
MORE 37
SAME 4
0
0
34
35
36
5
4
4
F
A
B
to the first (most preferred) 322 179 65535 Pref SAME MORE 37 0
37
38
4
6
Both
350 825
system it can find 323
324
179
465
65535 Pref
65535 Pref
SAME
SAME
SAME
SAME
4
4
0
0
39
40
41
6
6
6
25
675
850
100
600 750 850 1175 775
325 2119 65535 Pref SAME MORE 4 0 42 6 650
• the Acquisition Table is 326
327
2094
1005
65535 Pref
65535 Pref
SAME
SAME
MORE
SAME
4
4
0
0
43
44
6
6
450
325
475
350 375 1025 1050 1075
the list of frequencies 328 1013 65535 Pref SAME SAME 4 0
45
46
6
6
150
1025
475 625 675
1050 1075
used by the various
PRL: Preferred Roaming List
systems, so the mobile Programmed into each phone by the system
knows where to search operator; can be updated over the air.
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 23
24. Found it! Now we’re on the Right System
All PN Offsets
0
Ec/Io
1. Pilot Searcher Scans the Entire Range of PNs
-20
Chips 0 32K
PN 0 512
SYNC CHANNEL MESSAGE
2. Put Rake finger(s) on strongest 98/05/24 23:14:09.817 [SCH]
available PN, decode Walsh 32, MSG_LENGTH = 208 bits
MSG_TYPE = Sync Channel Message
and read Sync Channel Message P_REV = 3
MIN_P_REV = 2 If PRL shows: Go to the
SID = 179 This is the Best Paging
Active Pilot NID = 0
Available System! Channel!
PILOT_PN = 168
Rake Fingers Offset Index
Handset Rake Receiver LC_STATE = 0x0348D60E013
F1 PN168 W32 SYS_TIME = 98/05/24 23:14:10.160
LP_SEC = 12
F2 PN168 W32
RF LTM_OFF = -300 minutes
≈ x ≈ F3 PN168 W32 DAYLT = 0
LO
Srch PN??? W0 PRAT = 9600 bps
Ref. RESERVED = 1
PN
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 24
25. Course RF200
After finding the right system:
After finding the right system:
Normal Paging Channel Operation
Normal Paging Channel Operation
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 25
26. The Configuration Messages
After reading the Sync Channel, the mobile is now capable of reading the
Paging Channel, which it now monitors constantly
Before it is allowed to transmit or operate on this system, the mobile must
collect a complete set of configuration messages
In IS-95, the configuration messages are sent on the Paging Channel,
repeated every 1.28 seconds
In CDMA2000 systems, the configuration messages may be sent on the
separate F-BCH channel
• This would be indicated as SR1_BCCH_SUPPORTED = 1
There are six possible types of configuration messages; some are
optional; and they may happen in any order
The configuration messages contain sequence numbers so the mobile
can recognize if any of the messages have been freshly updated as it
continues to monitor the paging channel
• Access parameters message sequence number
• Configuration message sequence number
• If a mobile notices a changed sequence number, or if 600 seconds
passes since the last time these messages were read, the mobile
reads all of them again
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 26
27. Reading the Configuration Messages
All PN Offsets
0
Ec/Io
-20
Chips 0 32K
PN 0 Read the 512
Configuration Messages
Access Parameters Msg
Keep Rake finger(s) on strongest
available PN, monitor Walsh 1, System Parameters Msg
the Paging Channel
CDMA Channel List Msg
Active Pilot Extended System
Parameters Msg (*opt.)
Handset Rake Receiver Rake Fingers (Extended*) Neighbor
List Msg
F1 PN168 W01
Global Service
F2 PN168 W01
RF Redirection Msg (*opt.)
≈ x ≈ F3 PN168 W01
LO
Srch PN??? W0
Now we’re ready to operate!!
Reference PN
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 27
28. 1xRTT Access Parameters Message
ACCESS PARAMETERS MESSAGE
Basic Access Procedure
000035, Time 15:28:37.709, Record 6408,
QcpCdmaLogMsgPagingChan Any Access Msg
PD: P_REV_IN_USE < 6
MSG_TYPE: Access Parameters Message Success!
PILOT_PN: 36
ACC_MSG_SEQ: 2 BTS MS
ACC_CHAN: 1 Access Channel(s) Probing
NOM_PWR: 3 dB
INIT_PWR: -13 dB
an Access Probe
a Probe Sequence
PWR_STEP: 5 dB
NUM_STEP: 4 Probe(s) an Access Attempt
MAX_CAP_SZ: 6 ACH Frames
PAM_SZ: 3 ACH Frame(s)
PSIST(0-9): 0 The Access Parameters message
PSIST(10): 0
PSIST(11): 0
controls all the steps mobiles must
PSIST(12): 0 perform when they transmit on the
PSIST(13): 0 Access Channel
PSIST(14): 0
PSIST(15): 0 Mobiles perform a trial-and-error
MSG_PSIST: 1.00 process called “Probing” to get their
REG_PSIST: 1.00
PROBE_PN_RAN: 0 PN chip(s) messages through
ACC_TMO: 240 ms
PROBE_BKOFF: 1 Slot(s)
BKOFF: 1 Slot(s)
MAX_REQ_SEQ: 3
MAX_RSP_SEQ: 3
AUTH_MODE: 0
NOM_PWR_EXT: -8 to 7 dB inclusive
PSIST_EMG_INCL: No
RESERVED: 0
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 28
29. Phone Operation on the Access Channel
Successful Basic Access Attempt
A sector’s Paging Channel announces 1
(typ) to 32 (max) Access Channels: PN Origination Msg ACCESS
Long Code offsets for mobiles to use if Success!
accessing the system. BTS MS
• For mobiles sending Registration, Probing
Origination, Page Responses an Access Probe
• Base Station always listening! a Probe Sequence
an Access Attempt
On the access channel, phones are not
yet under BTS closed-loop power control! PAGING Base Sta. Acknlgmt. Order
Phones access the BTS by “probing” at
FW TFC TFC frames of 000s
power levels determined by receive power
and an open loop formula PAGING Channel Assnmt. Msg.
• If “probe” not acknowledged by BTS
within ACC_TMO (~400 mS.), phone TFC preamble of 000s RV TFC
will wait a random time (~200 mS)
FW FC Base Sta. Acknlgmt. Order
then probe again, stronger by PI db.
• There can be 15 max. (typ. 5) probes Mobile Sta. Ackngmt. Order RV TFC
in a sequence and 15 max. (typ. 2)
sequences in an access attempt FW TFC Service Connect Msg.
• most attempts succeed on first probe!
Svc. Connect Complete Msg RV TFC
The Access Parameters message on the
paging channel announces values of all FW TFC Base Sta. Acknlgmt. Order
related parameters
Call is Established!
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 29
30. 1xRTT System Parameters Message
SYSTEM PARAMETERS MESSAGE
000029, Time 15:28:37.607, Record 6330,
QcpCdmaLogMsgPagingChan
PD: P_REV_IN_USE < 6
MSG_TYPE: System Parameters Message
PILOT_PN: 36
CONFIG_MSG_SEQ: 1
SID: 4379 NID: 15 REG_ZONE: 6
TOTAL_ZONES: 3 ZONE_TIMER: 1 min
MULT_SIDS: No MULT_NIDS: No BASE_ID: 2155
BASE_CLASS: Public PCS System # Paging Channels, Slotted Mode period
PAGE_CHAN: 1 MAX_SLOT_CYCLE_INDEX: 1
HOME_REG: Yes FOR_SID_REG: Yes FOR_NID_REG: Yes
POWER_UP_REG: Yes POWER_DOWN_REG: Yes Who Registers?
PARAMETER_REG: No
REG_PRD: 30.89 min Why & When?
BASE_LAT: 37D18'35.00N
BASE_LONG: 079D15'19.00W
REG_DIST: 0 SRCH_WIN_A: 60 chips Search Window
SRCH_WIN_N: 60 chips SRCH_WIN_R: 80 chips
NGHBR_MAX_AGE: 0 Widths
PWR_REP_THRESH: 2 Bad Frame(s)
PWR_REP_FRAMES: 113 frame(s)
PWR_THRESH_ENABLE: Yes Handoff Thresholds
PWR_PERIOD_ENABLE: No
PWR_REP_DELAY: 4 frames
RESCAN: No T_ADD: -14.0 dB T_DROP: -16.0 dB
T_COMP: 4.0 T_TDROP: 4 sec
EXT_SYS_PARAMETER: Yes EXT_NGHBR_LIST: Yes
GEN_NGHBR_LIST: No GLOBAL_REDIRECT: Yes
PRI_NGHBR_LIST: No USER_ZONE_ID: No What other optional
EXT_GLOBAL_REDIRECT: No
EXT_CHAN_LIST: Yes configuration messages
RESERVED: 0 exist?
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 30
31. 1xRTT Extended System Parameters Message
EXTENDED SYSTEM PARAMETERS
000021, Time 15:28:37.421, Record 6188,
QcpCdmaLogMsgPagingChan
PD: P_REV_IN_USE < 6 One main job of this message is to
MSG_TYPE: Extended System Parameters Message tell mobiles how to report their
PILOT_PN: 36
CONFIG_MSG_SEQ: 1
identities when they transmit on the
DELETE_FOR_TMSI: No Access Channel
USE_TMSI: No
PREF_MSID_TYPE: IMSI and ESN • IMSI - International Mobile
MCC: 1134
IMSI_11_12: 813
Subscriber Identity
TMSI_ZONE_LEN: 1 octet
TMSI_ZONE: 0
– The “world” phone number
BCAST_INDEX: Disable Periodic Broadcast Paging of the mobile
IMSI_T_SUPPORTED: No
P_REV: IS-2000 Revision 0 • ESN - Electronic Serial Number
MIN_P_REV: J-STD-008
SOFT_SLOPE: 18 Different Networks may request
ADD_INTERCEPT: 6 dB different identification modes; the
DROP_INTERCEPT: 6 dB
PACKET_ZONE_ID: Base Station Does Not Support A phones simply comply
Packet Data Service Zone
MAX_NUM_ALT_SO: 0 • IMSI and ESN
RESELECT_INCLUDED: No
PILOT_REPORT: No • IMSI only
NGHBR_SET_ENTRY_INFO: No
NGHBR_SET_ACCESS_INFO: No • ESN only
BROADCAST_GPS_ASST: No
QPCH_SUPPORTED: No Intelligent soft handoff parameters
SDB_SUPPORTED: No are also included
RLGAIN_TRAFFIC_PILOT: 0.000000 dB
REV_PWR_CNTL_DELAY_INCL: No
AUTO_MSG_SUPPORTED: No
RESERVED: 0
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 31
32. The Neighbor List Message
EXTENDED NEIGHBOR LIST The Neighbor List Message gives the
000017, Time 15:28:37.381, Record 6158, mobile up to 20 PN offsets of sectors it
QcpCdmaLogMsgPagingChan may soon need in handoff
PD: P_REV_IN_USE < 6
MSG_TYPE: Extended Neighbor List Message • This enables the mobile to search
PILOT_PN: 36
CONFIG_MSG_SEQ: 1 smarter and faster
PILOT_INC: 4
NGHBR_CONFIG: 0, NGHBR_PN: 32 On the paging channel, Enhanced or
SEARCH_PRIORITY: Very High, FREQ_INCL: No Extended neighbor lists may also include
NGHBR_CONFIG: 0 NGHBR_PN: 28
SEARCH_PRIORITY: Very High FREQ_INCL: No
neighbors on different frequencies
NGHBR_CONFIG: 0 NGHBR_PN: 308
SEARCH_PRIORITY: Very High FREQ_INCL: No
• Slotted mode mobiles can jump to
NGHBR_CONFIG: 0 NGHBR_PN: 432 other frequencies in their “sleep”
SEARCH_PRIORITY: Very High FREQ_INCL: No
NGHBR_CONFIG: 0 NGHBR_PN: 20
time to check pilots
SEARCH_PRIORITY: Very High FREQ_INCL: No
NGHBR_CONFIG: 0 NGHBR_PN: 24
• This is useful at system boundaries
SEARCH_PRIORITY: Very High FREQ_INCL: No
NGHBR_CONFIG: 0 NGHBR_PN: 260
During a call, a mobile first uses the
SEARCH_PRIORITY: Very High FREQ_INCL: No neighbor list remembered from idle mode
NGHBR_CONFIG: 0 NGHBR_PN: 196
SEARCH_PRIORITY: Very High FREQ_INCL: No • After each handoff, a new Neighbor
NGHBR_CONFIG: 0 NGHBR_PN: 392 List Update message is sent to the
SEARCH_PRIORITY: Very High FREQ_INCL: No
NGHBR_CONFIG: 0 NGHBR_PN: 312 mobile on the Forward Traffic
SEARCH_PRIORITY: Very High FREQ_INCL: No Channel
NGHBR_CONFIG: 0 NGHBR_PN: 316
SEARCH_PRIORITY: Very High FREQ_INCL: No Each neighbor list received by the mobile
RESERVED: 0
overwrites and replaces the previous
neighbor list
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 32
33. The CDMA Channel List Message
EXTENDED
CDMA CHANNEL LIST MESSAGE If a mobile sees a CDMA
000005, Time 15:28:37.056, Record 5910, Channel List Message, it notices
QcpCdmaLogMsgPagingChan
PD: P_REV_IN_USE < 6
the list of channels included in the
MSG_TYPE: Extended CDMA Channel List Message message
PILOT_PN: 36
CONFIG_MSG_SEQ: 1 • There may be one, two,
NUM_FREQ: 1
CDMA_FREQ: 600
three, or more channels listed
RC_QPCH_SEL_INCL: No
TD_SEL_INCL: No
The mobile immediately uses a
RESERVED: 0 random selection process called
“hashing” to select one of the
listed channels
• The outcome of hashing
depends only on the mobile’s
F3
F2 IMSI
CDMA Ch HASH using
F1
Fnow List Message IMSI • Both the system and the
mobile know which carrier the
mobile will choose
The message also includes an
indicator to show if the QPCH is
in use, and for what radio
configurations
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 33
34. How Hashing Works
If a mobile sees a CDMA Channel List Message, it notices the list
of channels included in the message
• There may be one, two, three, or more channels listed
Whenever a phone encounters multiple announced resources, it
uses its number (IMSI, International Mobile Subscriber Identity)
and a randomized process called “hashing” to determine which
resource it should use. This is how mobiles select:
• Carrier Frequencies in idle mode
• Preferred Paging Channel
• Preferred Access Channel
• Paging Time Slot in Slotted Mode
Optimization personnel may wish to carry a phone for each carrier
frequency, or use the multiple NAM capability of some handsets to
operate on different numbers so as to prefer different frequencies
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 34
36. The Global Service Redirection Message
GLOBAL SERVICE REDIRECTION
000011, Time 15:28:37.118, Record 5957,
QcpCdmaLogMsgPagingChan
PD: P_REV_IN_USE < 6
The GSRM was originally
MSG_TYPE: Global Service Redirection Message intended as a way to
PILOT_PN: 36
CONFIG_MSG_SEQ: 1
solve system and
REDIRECT_ACCOLC (ACCOLC_0): No multicarrier border
REDIRECT_ACCOLC (ACCOLC_1): No
REDIRECT_ACCOLC (ACCOLC_2): No problems
REDIRECT_ACCOLC (ACCOLC_3): No
REDIRECT_ACCOLC (ACCOLC_4): No • Outermost F2 cells
REDIRECT_ACCOLC (ACCOLC_5): No
REDIRECT_ACCOLC (ACCOLC_6): No
transmit GSRM,
REDIRECT_ACCOLC (ACCOLC_7): No
REDIRECT_ACCOLC (ACCOLC_8): No
sending distant F2
REDIRECT_ACCOLC (ACCOLC_9): No mobiles to F1
REDIRECT_ACCOLC (ACCOLC_10): No
REDIRECT_ACCOLC (ACCOLC_11): No The GSRM can also be
REDIRECT_ACCOLC (ACCOLC_12): No
REDIRECT_ACCOLC (ACCOLC_13): No used to manually
REDIRECT_ACCOLC (ACCOLC_14): No
REDIRECT_ACCOLC (ACCOLC_15): No
distribute idle mobiles to
RETURN_IF_FAIL: No different frequencies
DELETE_TMSI: No
EXCL_P_REV_MS: No • A GSRM applies only
RECORD_TYPE: Redirection to An Analog System
RECORD_LEN: 3 octets to phones of Access
EXPECTED_SID: 0
IGNORE_CDMA: No
Overload Classes
SYS_ORDERING: Attempt To Obtain Service On Either System A specified in the
Or System B. If Unsuccessful, Attempt Alternate System
MAX_REDIRECT_DELAY: 0 sec
message
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 36
37. Summary: How Idle Mobiles Choose CDMA Carriers
At turnon, Idle mobiles use proprietary System Determination Algorithms
(SDA) to find the initial CDMA carrier intended for them to use
On the paging channel of the idle mobile’s newly-found home signal, the
mobile might be sent to a different frequency if it hears
• CDMA Channel List Message
• Global Service Redirection Message (GSRM)
Start System Determination Algorithm
Preferred
MRU Only Bit 0 PRL Acq Idx
Go to last Strongest Is better
Yes Idle Mode Carrier Selection
Is SID
frequency PN, read SID
permitted?
from MRU Sync available? F3
No Signal
Denied SID
No
CDMA Ch HASH using
F2 Config
List Message IMSI F1 Messages:
Read remain
Last Resort: Paging
GEO escape Channel Global Svc my ACCOLC?
Or Analog Redir Msg redirect
to another CDMA frequency or system
Legend
to Analog
Steps from Steps from Proprietary
the CDMA proprietary SDA
standards SDAs databases
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 37
38. Course RF200
Let’s Do An Idle Mode
Let’s Do An Idle Mode
Handoff!
Handoff!
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 38
39. Idle Mode Handoff
An idle mobile always demodulates the best available signal
• In idle mode, it isn’t possible to do soft handoff and listen to
multiple sectors or base stations at the same time -- the paging
channel information stream is different on each sector, not
synchronous -- just like ABC, NBC, CBS, and CNN TV news
programs aren’t in word-sync for simultaneous viewing
• Since a mobile can’t combine signals, the mobile must switch
quickly, always enjoying the best available signal
The mobile’s pilot searcher is constantly checking neighbor pilots
If the searcher notices another signal at least 3 db better than the
present one, and it remains so for 5 seconds, the mobile starts
listening to it at the beginning of the next paging slot.
• The mobile doesn’t automatically say anything to the system,
so system doesn’t know about the idle mode handoff
On the new paging channel, if the mobile learns that registration is
required, it re-registers on the new sector
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 39
40. Idle Mode on the Paging Channel:
Meet the Neighbors, track the Strongest Pilot
All PN Offsets
0
Ec/Io
-20
Chips 0 SRCH_WIN_A Mobile Rake RX 32K
PN 0 F1 PN168 W01 512
Active Pilot F2 PN168 W01
Rake Fingers F3 PN168 W01
Srch PN??? W0
SRCH_WIN_N The phone’s pilot searcher constantly checks
the pilots listed in the Neighbor List Message
Reference PN
Neighbor Set
If the searcher ever notices a neighbor pilot substantially stronger than
the current reference pilot, it becomes the new reference pilot
and the phone switches over to its paging channel on the next superframe.
This is called an idle mode handoff.
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 40
42. Registration
Registration is the process by which an idle mobile lets the system
know it’s awake and available for incoming calls
• this allows the system to inform the mobile’s home switch of
the mobile’s current location, so that incoming calls can be
delivered
• registration also allows the system to intelligently page the
mobile only in the area where the mobile is currently located,
thereby eliminating useless congestion on the paging channels
in other areas of the system
There are many different conditions that could trigger an obligation
for the mobile to register
• there are flags in the System Parameters Message which tell
the mobile when it must register on the current system
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 42
43. Registration
Registration Message (by PROBING)
BTS
Base Station Acknowledgment Order
Paging Access
Channel Channel
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 43
44. An Actual 1xRTT Registration
SYSTEM PARAMETERS MESSAGE
IS-95 Message Type: System Parameters
PN Offset: 44 CONFIG_MSG_SEQ 0 SID 1121 NID 1
REG_ZONE: 0 TOTAL_ZONES: 0 Zone timer length (min): 1 The System Parameters Message tells
MULT_SIDS: 0 MULT_NIDS: 0
BASE_ID: 5586 BASE_CLASS: Public Macrocellular System
all mobiles when they should register.
PAG_CHAN: 1 MAX_SLOT_CYCLE_INDEX: 2 This mobile notices that it is obligated to
HOME_REG: 1 FOR_SID_REG: 1 FOR_NID_REG: 1,
POWER_UP_REG: 1 POWER_DOWN_REG: 1 register, so it transmits a Registration
PARAMETER_REG: 1 Registration period (sec): 1853.60
Base station 0°00´00.00¨ Lon., 0°00´00.00° Lat. REG_DIST: 0
Message.
SRCH_WIN_A: 20ch SRCH_WIN_N: 100ch SRCH_WIN_R: 320ch
NGHBR_MAX_AGE: 0 PWR_REP_THRESH: 2 REGISTRATION MESSAGE
PWR_REP_FRAMES (frames): 905 PWR_THRESH_ENABLE: 1
IS-95 Message Type: Registration
PWR_PERIOD_ENABLE: 0, PWR_REP_DELAY: 1 (0 frames)
ACK_SEQ: 7 MSG_SEQ: 5 ACK_REQ: 1 VALID_ACK: 0
Re-Init and Re-acquire After This Message?: No
ESN (Electronic Serial Number):0xB38092BC
T_ADD: -14dB T_DROP: -16dB T_COMP: 1 DB, T_TDROP: 4s
IMSI Class: 0 IMSI Class 0 Type: IMSI_S only
Sending Extended System Parameters Messages?: Yes
IMSI_S: 694 582 9500
Are Extended Neighbor List Messages Being Sent?: No
Pilot Strength: -8.0 dB
Are General Neighbor List Messages Being Sent?: No
Active pilot is first one probed?: Yes
Using Global Redirect Messages?: No
Original pilot is same as pilot in previous probe?: No
Are Private Neighbor List Messages Being Sent?: No
Number of additional pilots: 0
Are User Zone ID Messages Being Sent?: No
Registration Type: Timer-based Slot Cycle Index: 2
Are Extended Global Redirection Messages Being Sent?: No
Mobile Protocol Revision Level: 6
Are Extended Channel List Messages Being Sent?: Yes
Station Class Mark: Dual Mode, Slotted, Discontinuous Xmit,
Power Class 3
Mobile-Terminated Calls Acceptable?: Yes
BASE STATION ACKNOWLEDGMENT
IS-95 Message Type: Order
ACK_SEQ: 5 MSG_SEQ: 2 ACK_REQ: 0 VALID_ACK: 1 The base station confirms that the
Address Type: IMSI IMSI Class: 0 mobile’s registration message was
IMSI Class 0 Type: IMSI_S, IMSI_11_12, and MCC
Mobile Country Code (MCC): 310 IMSI 11th+12th Digits: 00 received. We’re officially registered!
IMSI_S: 694 582 9500 Order Message Type: Base ACK
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 44
45. Example 4
Let’s Receive an Incoming
Let’s Receive an Incoming
Call!
Call!
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 45
46. Receiving an Incoming Call
All idle mobiles monitor the paging channel to receive incoming
calls.
When an incoming call appears, the paging channel notifies the
mobile in a General Page Message.
A mobile which has been paged sends a Page Response
Message on the access channel.
The system sets up a traffic channel for the call, then notifies the
mobile to use it with a Channel Assignment Message.
The mobile and the base station notice each other’s traffic channel
signals and confirm their presence by exchanging
acknowledgment messages.
The base station and the mobile negotiate what type of call this will
be -- I.e., 13k voice, etc.
The mobile is told to ring and given a “calling line ID” to display.
When the human user presses the send button, the audio path is
completed and the call proceeds.
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 46
47. Incoming Call Delivery Scenario
General Page Message
Page Response Message (by PROBING)
BTS
Base Station Acknowledgment Order
Paging Channel Assignment Message Access
Channel Channel
Continuous frames of all 000’s
Traffic Channel Preamble: Frames of 000’s
Base Station Acknowledgment Order
Forward Reverse
Traffic Traffic
Channel Mobile Station Acknowledgment Order Channel
Service Connect Message
Service Connect Complete Message
The Call is now officially Established!
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 47
48. An Actual Page and Page Response
GENERAL PAGE MESSAGE
98/05/24 23:14:46.127 [PCH] General Page Message
MSG_LENGTH = 128 bits The system pages the mobile,
MSG_TYPE = General Page Message 615-330-0644.
CONFIG_MSG_SEQ = 1 ACC_MSG_SEQ = 20
CLASS_0_DONE = 1
CLASS_1_DONE = 1 RESERVED = 0 PAGE RESPONSE MESSAGE
BROADCAST_DONE = 1 RESERVED = 0
ADD_LENGTH = 0 bits ADD_PFIELD = Field Omitted 98/05/24 23:14:46.425 [ACH] Page Response Message
PAGE_CLASS = 0 PAGE_SUBCLASS = 0 MSG_LENGTH = 216 bits
MSG_SEQ = 1 MSG_TYPE = Page Response Message
IMSI_S = 6153300644 ACK_SEQ = 1 MSG_SEQ = 2 ACK_REQ = 1
SPECIAL_SERVICE = 1 VALID_ACK = 1 ACK_TYPE = 2
SERVICE_OPTION = 32768 MSID_TYPE = IMSI and ESN MSID_LEN = 9 octets
RESERVED = Field Omitted ESN = 0xD30E415C IMSI_CLASS = 0
IMSI_CLASS_0_TYPE = 0 RESERVED = 0
IMSI_S = 6153300644
AUTH_MODE = 1
The mobile responds to the page. AUTHR = 0x307B5 RANDC = 0xC6 COUNT = 0
MOB_TERM = 1 SLOT_CYCLE_INDEX = 0
MOB_P_REV = 3 SCM = 106
BASE STATION ACKNOWLEDGMENT REQUEST_MODE = Either Wide Analog or CDMA Only
SERVICE_OPTION = 32768 PM = 0
98/05/24 23:14:46.768 [PCH] Order Message NAR_AN_CAP = 0 RESERVED = 0
MSG_LENGTH = 112 bits
MSG_TYPE = Order Message
ACK_SEQ = 2 MSG_SEQ = 0 ACK_REQ = 0
VALID_ACK = 1
ADDR_TYPE = IMSI ADDR_LEN = 40 bits
IMSI_CLASS = 0 IMSI_CLASS_0_TYPE = 0 RESERVED = 0 The base station confirms that the mobile’s
IMSI_S = 6153300644
ORDER = Base Station Acknowledgement Order
page response was received. Now the
ADD_RECORD_LEN = 0 bits mobile is waiting for channel assignment,
Order-Specific Fields = Field Omitted RESERVED = 0
expecting a response within 12 seconds.
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 48
49. Channel Assignment and
Traffic Channel Confirmation
CHANNEL ASSIGNMENT MESSAGE
18:14:47.027 Paging Channel: Channel Assignment Only about 400 ms. after the base station
ACK_SEQ: 2 MSG_SEQ: 1 ACK_REQ: 0 VALID_ACK: 1
MSID_TYPE: 2 IMSI: (Class: 0, Class_0_type: 0) acknowledgment order, the mobile receives
[0x 01 f8 39 6a 15] 615-330-0644
ASSIGN_MODE: Traffic Channel Assignment the channel assignment message.
ADD_RECORD_LEN: 5 FREQ_INCL: 1 GRANTED_MODE: 2
CODE_CHAN: 43 FRAME_OFFSET: 2
ENCRYPT_MODE: Encryption disabled
BAND_CLASS: 800 MHz cellular band
CDMA_FREQ: 283
The mobile sees at least two
The base station is already good blank frames in a row on
sending blank frames on the forward channel, and
the forward channel,using concludes this is the right traffic
the assigned Walsh code. channel. It sends a preamble
of two blank frames of its own
on the reverse traffic channel.
BASE STATION ACKNOWLEDGMENT
MOBILE STATION ACKNOWLEDGMENT
18:14:47.581 Forward Traffic Channel: Order
ACK_SEQ: 7 MSG_SEQ: 0 ACK_REQ: 1 18:14:47.598 Reverse Traffic Channel: Order
ENCRYPTION: 0 USE_TIME: 0 ACTION_TIME: 0 ACK_SEQ: 0 MSG_SEQ: 0 ACK_REQ: 0
Base Station Acknowledgement Order ENCRYPTION: 0
Mobile Station Acknowledgement Order
The base station acknowledges The mobile station acknowledges the
receiving the mobile’s preamble. base station’s acknowledgment.
Everybody is ready!
November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 49
