Course RF100 Chapter 7

Technical
Technical
Introduction
Introduction to
to CDMA
CDMA

February, 2000 RF100 (c) 1998 Scott Baxter V1.30 7-1

Course Outline

„ Basic CDMA Principles
• Coding
• Forward and Reverse Channels
„ CDMA Operational Details
• Multiplexing, Forward and Reverse Power Control
„ CDMA Handset Architecture
„ CDMA Handoffs
„ CDMA Network Architecture
„ CDMA Messaging and Call Flow
„ Optional Topics
„ Wireless Multiple Access Technologies
„ Overview of Current Technologies
• Capacity; CDMA Overlays, Spectrum Clearing

February, 2000 RF100 (c) 1998 Scott Baxter V1.30 7-2

Section A

How
How Does
Does CDMA
CDMA Work?
Work?
Introduction
Introduction to
to Basic
Basic Principles
Principles

February, 2000 RF100 (c) 1998 Scott Baxter V1.30 7-3

February. CDMA: -10 to -17 dB. 2000 RF100 (c) 1998 Scott Baxter V1.but with a uniquely recoverable Figure of Merit: C/I code (carrier/interference ratio) AMPS: +17 dB TDMA: +14 to +17 dB GSM: +7 to 9 dB.30 7-4 . CDMA: Using A New Dimension „ All CDMA users occupy the same frequency CDMA at the same time! Frequency and time are not used as discriminators „ CDMA operates by using CODING to discriminate between users „ CDMA interference comes mainly from nearby users „ Each user is a small voice in a roaring crowd -. CDMA: Eb/No ~+6 dB.

then transmitted Time Frequency User 1 • broadband signal is received.30 7-5 . unused User 1 User 2 User 4 User 3 although used by the military „ Direct Sequence Frequency • narrowband input from a user is Direct Sequence CDMA coded (“spread”) by a user-unique broadband code. Two Types of CDMA There are Two types of CDMA: Frequency Hopping CDMA „ Frequency-Hopping User 1 User 2 User 3 User 4 • Each user’s narrowband signal hops among discrete frequencies. 2000 RF100 (c) 1998 Scott Baxter V1. receiver knows. and the User 3 User 4 User 1 unused User 2 receiver follows in sequence • Frequency-Hopping Spread User 1 User 4 User 3 User 2 unused Spectrum (FHSS) CDMA is NOT currently used in wireless systems. + Code 1 recovers users’ data • Direct Sequence Spread Spectrum = Composite (DSSS) CDMA IS the method used in IS-95 commercial systems February. applies user’s code.

200 bits/second just 1 as originally sent Drawn to actual scale and time alignment February.200 bits/second Exclusive-OR Gate „ Input B: Walsh Code #23 @ 1.30 7-6 . 2000 RF100 (c) 1998 Scott Baxter V1.2288 Mcps Output: User’s Original Data „ Output: User’s Data @ 19.2288 Mcps „ Output: Spread Spread Spectrum Signal spectrum signal via air interface Input A: Received Signal Destination Site At Destination Site: „ Input A: Received XOR Input B: Spreading Code Exclusive-OR spread spectrum signal Gate „ Input B: Walsh Code #23 @ 1. DSSS Spreading: Time-Domain View Input A: User’s Data Originating Site At Originating Site: 1 „ Input A: User’s Data @ Input B: Spreading Code XOR 19.

Spreading from a Frequency-Domain View TRADITIONAL COMMUNICATIONS SYSTEM Spread Spectrum „ Traditional technologies try Slow Narrowband Signal Slow to squeeze signal into Information Sent Information Recovered minimum required TX RX bandwidth „ CDMA uses larger SPREAD-SPECTRUM SYSTEM bandwidth but uses Wideband resulting processing gain to Slow Signal Slow increase capacity Information Sent Information Recovered TX RX Fast Fast Spreading Spreading Sequence Sequence Spread Spectrum Payoff: Processing Gain February.30 7-7 . 2000 RF100 (c) 1998 Scott Baxter V1.

CDMA Uses Code Channels Building a „ A CDMA signal uses many chips to convey just CDMA Signal one bit of information „ Each user has a unique chip pattern. in effect a Bits code channel from User’s Vocoder „ To recover a bit. 2000 RF100 (c) 1998 Scott Baxter V1. integrate a large number of chips interpreted by the user’s known code pattern Forward Error Correction „ Other users’ code patterns appear random and integrate in a random self-canceling fashion. don’t Symbols disturb the bit decoding decision being made with the proper code pattern Coding and Spreading Chips February.30 7-8 .

2000 RF100 (c) 1998 Scott Baxter V1.30 7-9 . as we’ll see in following slides. CDMA: The Code “Magic” “behind the Veil” QPSK RF Users Σ Summing Analog BTS Demodulated Received CDMA Signal 1 Despreading Sequence if 0 = (Locally Generated. February. The actual coding process used in IS-95 CDMA includes a few additional layers. =0) Decision: if 1 = Received energy: Correlation Matches! (=0) 1 Σ matches +10 opposite -26 Opposite Time ( =1) Integration -16 This figure illustrates the basic technique of CDMA signal generation and recovery.

10 . Spreading: What we do. uses same spreading sequence to extract original data February. we can undo ORIGINATING SITE DESTINATION Spread Data Stream Input Recovered Data Data Spreading Spreading Sequence Sequence „ Sender combines data with a fast spreading sequence. 2000 RF100 (c) 1998 Scott Baxter V1. transmits spread data stream „ Receiver intercepts the stream.30 7 .

and the receiver unpacks in the reverse order „ CDMA “containers” are spreading codes February. packaging is extremely important! „ Cargo is placed inside “nested” containers for protection and to allow addressing „ The shipper packs in a certain order.11 . 2000 RF100 (c) 1998 Scott Baxter V1. or in CDMA. “Shipping and Receiving” via CDMA Shipping Receiving FedEx FedEx Data Mailer Mailer Data „ Whether in shipping and receiving.30 7 .

robust channels „ The sequences are easy to generate on both sending and receiving ends of each link „ “What we do. 2000 RF100 (c) 1998 Scott Baxter V1. CDMA’s Nested Spreading Sequences ORIGINATING SITE DESTINATION Spread-Spectrum Chip Streams X+A X+A+B X+A+B+C X+A+B X+A Input Recovered Data Data X X Spreading Spreading Spreading Spreading Spreading Spreading Sequence Sequence Sequence Sequence Sequence Sequence A B C C B A „ CDMA combines three different spreading sequences to create unique.30 7 . we can undo” February.12 .

each 64 chips long 3 4 5 6 0110011001100110011001100110011001100110011001100110011001100110 0000111100001111000011110000111100001111000011110000111100001111 0101101001011010010110100101101001011010010110100101101001011010 0011110000111100001111000011110000111100001111000011110000111100 „ Each Walsh Code is precisely Orthogonal 7 0110100101101001011010010110100101101001011010010110100101101001 8 0000000011111111000000001111111100000000111111110000000011111111 9 0101010110101010010101011010101001010101101010100101010110101010 10 0011001111001100001100111100110000110011110011000011001111001100 11 0110011010011001011001101001100101100110100110010110011010011001 with respect to all other Walsh Codes 12 13 14 0000111111110000000011111111000000001111111100000000111111110000 0101101010100101010110101010010101011010101001010101101010100101 0011110011000011001111001100001100111100110000110011110011000011 15 0110100110010110011010011001011001101001100101100110100110010110 • it’s simple to generate the codes. 2000 RF100 (c) 1998 Scott Baxter V1.30 7 . or 16 0000000000000000111111111111111100000000000000001111111111111111 17 0101010101010101101010101010101001010101010101011010101010101010 18 0011001100110011110011001100110000110011001100111100110011001100 19 0110011001100110100110011001100101100110011001101001100110011001 20 0000111100001111111100001111000000001111000011111111000011110000 • they’re small enough to use from ROM 21 22 23 24 0101101001011010101001011010010101011010010110101010010110100101 0011110000111100110000111100001100111100001111001100001111000011 0110100101101001100101101001011001101001011010011001011010010110 0000000011111111111111110000000000000000111111111111111100000000 25 0101010110101010101010100101010101010101101010101010101001010101 26 0011001111001100110011000011001100110011110011001100110000110011 27 0110011010011001100110010110011001100110100110011001100101100110 28 0000111111110000111100000000111100001111111100001111000000001111 29 0101101010100101101001010101101001011010101001011010010101011010 Unique Properties: 30 31 32 0011110011000011110000110011110000111100110000111100001100111100 0110100110010110100101100110100101101001100101101001011001101001 0000000000000000000000000000000011111111111111111111111111111111 33 0101010101010101010101010101010110101010101010101010101010101010 Mutual Orthogonality 34 35 36 0011001100110011001100110011001111001100110011001100110011001100 0110011001100110011001100110011010011001100110011001100110011001 0000111100001111000011110000111111110000111100001111000011110000 37 0101101001011010010110100101101010100101101001011010010110100101 38 0011110000111100001111000011110011000011110000111100001111000011 39 0110100101101001011010010110100110010110100101101001011010010110 40 0000000011111111000000001111111111111111000000001111111100000000 41 0101010110101010010101011010101010101010010101011010101001010101 42 0011001111001100001100111100110011001100001100111100110000110011 EXAMPLE: 43 44 45 0110011010011001011001101001100110011001011001101001100101100110 0000111111110000000011111111000011110000000011111111000000001111 0101101010100101010110101010010110100101010110101010010101011010 46 0011110011000011001111001100001111000011001111001100001100111100 47 0110100110010110011010011001011010010110011010011001011001101001 Correlation of Walsh Code #23 with Walsh Code #59 48 49 50 0000000000000000111111111111111111111111111111110000000000000000 0101010101010101101010101010101010101010101010100101010101010101 0011001100110011110011001100110011001100110011000011001100110011 51 0110011001100110100110011001100110011001100110010110011001100110 52 0000111100001111111100001111000011110000111100000000111100001111 #23 0110100101101001100101101001011001101001011010011001011010010110 53 0101101001011010101001011010010110100101101001010101101001011010 54 0011110000111100110000111100001111000011110000110011110000111100 #59 0110011010011001100110010110011010011001011001100110011010011001 55 0110100101101001100101101001011010010110100101100110100101101001 56 0000000011111111111111110000000011111111000000000000000011111111 Sum 0000111111110000000011111111000011110000000011111111000000001111 57 0101010110101010101010100101010110101010010101010101010110101010 58 0011001111001100110011000011001111001100001100110011001111001100 59 0110011010011001100110010110011010011001011001100110011010011001 60 0000111111110000111100000000111111110000000011110000111111110000 Correlation Results: 32 1’s.13 . 32 0’s: Orthogonal!! 61 62 0101101010100101101001010101101010100101010110100101101010100101 0011110011000011110000110011110011000011001111000011110011000011 63 0110100110010110100101100110100110010110011010010110100110010110 February.64-Chip Sequence ------------------------------------------ 0 0000000000000000000000000000000000000000000000000000000000000000 1 0101010101010101010101010101010101010101010101010101010101010101 2 0011001100110011001100110011001100110011001100110011001100110011 „ 64 “Magic” Sequences. One of the CDMA Spreading Sequences: Walsh Codes WALSH CODES # ---------------------------------.

Summing Shift Register „ Tapped shift register generates a wild. • Such sequences match if where N is number of cells in register compared in step (no-brainer. Half 0’s February. where N is number of cells in register sequence = length of register A Tapped. Other Sequences: Generation & Properties An Ordinary Shift Register „ Other CDMA sequences are generated in shift registers Sequence repeats every N chips. 2000 RF100 (c) 1998 Scott Baxter V1.30 7 . in sync: Sum: Complete Correlation: All 0’s exactly matched in time Compared Shifted: Little Correlation • false correlation typically <2% Sequence: Self. Shifted: Sum: Practically Orthogonal: Half 1’s. „ Plain shift register: no fun. self-mutating sequence 2N-1 chips long (N=register length) Sequence repeats every 2N-1 chips.14 . A Special Characteristic of Sequences any sequence matches itself) Generated in Tapped Shift Registers • Such sequences appear Compared In-Step: Matches Itself approximately orthogonal if Sequence: compared with themselves not Self.

15 .768 chips long 26-2/3 ms. CDMA QPSK Phase Modulator (75 repetitions in 2 sec. In handset. I and Q are used in-phase. 2000 RF100 (c) 1998 Scott Baxter V1.) Using I and Q PN Sequences I Q I-sequence cos ωt QPSK- chip modulated „ The short PN code consists of two Σ RF input Output PN Sequences. Q is delayed 1/2 chip to • They’re always used together. each 32.768 chips long • Generated in similar but Q-sequence * sin ωt differently-tapped 15-bit shift registers * In BTS. I and Q. Another CDMA Spreading Sequence: The Short PN Code 32.30 7 . avoid zero-amplitude crossings which modulating the two phase axes would require a linear power amplifier of a QPSK modulator February.

produces unique shift • private long code masks are available for enhanced privacy „ Integrated over a period even as short as 64 chips.2288 MCPS) AND Public Long Code Mask 1100011000 PERMUT ED ESN SUM = (STATIC) User Long Code Modulo-2 Addition Sequence (@1. 2000 RF100 (c) 1998 Scott Baxter V1.30 7 . the PN Long code is more than 40 days long (~4x1013 chips) -. so it’s generated chip-by-chip using the scheme shown above „ Each handset codes its signal with the PN Long Code. Third CDMA Spreading Sequence: Long Code Generation & Masking to establish Offset Long Code Register (@ 1.2288 MCPS) „ Generated in a 42-bit register.16 . but at a unique offset computed using its ESN (32 bits) and 10 bits set by the system • this is called the “Public Long Code Mask”.too big to store in ROM in a handset. phones with different PN long code offsets will appear practically orthogonal February.

and a specific PN offset for the sector „ A reverse channel exists because the mobile uses a specific offset of the Long PN sequence February. 2000 RF100 (c) 1998 Scott Baxter V1.30 7 .17 . Putting it All Together: CDMA Channels FORWARD CHANNELS One LONG CODE: Sector Data WALSH CODE: Individual User Scrambling SHORT PN OFFSET: Sector REVERSE CHANNELS WALSH CODES: used as symbols LONG CODE OFFSET: for robustness individual handset SHORT PN: BTS used at 0 offset for tracking „ The three spreading codes are used in different ways to create the forward and reverse links „ A forward channel exists by having a specific Walsh Code assigned to the user.

18 . Section B IS-95 IS-95 CDMA CDMA Forward Forward and and Reverse Reverse Channels Channels February.30 7 . 2000 RF100 (c) 1998 Scott Baxter V1.

30 7 . Sync FEC Sector X x Walsh #1 sin ωt Paging FEC A Forward Channel Walsh #12 is identified by: Vocoder FEC ΣΣ ™ its CDMA RF Walsh #23 carrier Frequency Vocoder FEC a Channel Element I Q ™ the unique Short Walsh #27 Code PN Offset of Vocoder FEC the sector ™ the unique Walsh Walsh #44 Vocoder FEC Code of the user more more more February. 2000 RF100 (c) 1998 Scott Baxter V1. How a BTS Builds the Forward Code Channels Switch BSC or BTS (1 sector) Short PN Code Access PN Offset 246 Manager Walsh #0 I Q cos ωt Pilot FEC x Trans- Walsh #32 + mitter.19 .

All remaining Walsh codes are available. and call setup orders Walsh 55 „ TRAFFIC: any remaining WALSH codes • The traffic channels are assigned to Walsh 56 individual users to carry call traffic. Functions of the CDMA Forward Channels Pilot Walsh 0 „ PILOT: WALSH CODE 0 Paging Walsh 1 • The Pilot is a “structural beacon” which does not contain a character stream. It is a Walsh 6 timing source used in system acquisition and as a measurement device during Walsh 11 handoffs Walsh 19 „ SYNC: WALSH CODE 32 • This carries a data stream of system Walsh 20 identification and parameter information used by mobiles during system acquisition Sync Walsh 32 „ PAGING: WALSH CODES 1 up to 7 Walsh 37 • There can be from one to seven paging Walsh 41 channels as determined by capacity needs. 2000 RF100 (c) 1998 Scott Baxter V1. system parameters Walsh 42 information.20 .30 7 . They carry pages. Walsh 60 subject to overall capacity limited by noise February.

30 7 . Code Channels in the Reverse Direction Switch BSC. offset Long Code Gen Sector X Vocoder Channel Element a Channel Element Long Code Gen Long Long Vocoder Channel Element Code Code offset Long Code offset offset Long Long Code Gen Code offset Vocoder Channel Element more more more February. A Reverse Channel is identified by: Access Long Code Gen ™ its CDMA RF carrier Frequency Manager Channel Element ™ the unique Long Code PN Offset Access Channels of the individual handset Long Code Gen Long Code Vocoder Channel Element offset Long Code Receiver. BTS (1 sector) CBSC.21 . 2000 RF100 (c) 1998 Scott Baxter V1.

Each paging channel can have up to 32 access 1-800 242 channels. and each paging channel can have up to 32 access channels. call setup requests. page responses. 2000 RF100 (c) 1998 Scott Baxter V1. nearly all systems today use only one paging channel per sector and only one access channel per paging channel. 4444 Although a sector can have up to seven paging channels.22 . February. Functions of the CDMA Reverse Channels There are two types of CDMA Reverse Channels: „ TRAFFIC CHANNELS are used by individual users during their actual calls to transmit traffic to the BTS • a reverse traffic channel is really just a user-specific public or private Long Code mask • there are as many reverse Traffic Channels as there are CDMA phones in the world! BTS „ ACCESS CHANNELS are used by mobiles not yet in a call to transmit registration requests. order responses.30 7 . and other signaling information • an access channel is really just a public long code offset unique to the BTS sector REG • Access channels are paired to Paging Channels.

2000 RF100 (c) 1998 Scott Baxter V1.30 7 . Card ACC DISCO 1 CDSU LPP ENET LPP CDSU CDSU Packets DISCO 2 CDSU Σα Txcvr A RFFE A Σβ Chips Txcvr RFFE CDSU DS0 in T1DTCs CDSU Σχ B Txcvr C B RFFE C SBS IOC Vocoders Vocoder Channel RF Selectors Element PSTN February. Basic CDMA Network Architecture Switch Access Manager BTS GPS or (C)BSC GPS GPSR SLM CM GPSR BSM CDSU CDSU DISCO TFU DMS-BUS TFU1 CDSU Ch.23 .

8 Puncturing 19.24 .2288 1200 bps Convolutional Block Mcps U or Encoding and Interleaving 14400 bps Repetition Symbol X 7200 bps 28.30 7 .2 (From Vocoder) 1.2 2400 bps ksps Scrambling M 1. 2000 RF100 (c) 1998 Scott Baxter V1.2 3600 bps ksps (13 kb only) ksps 1800 bps 19.2288 ksps Q PN User Address Long PN Code Mcps Mask Decimator Decimator 800 Hz Generation (ESN-based) February. Forward Traffic Channel: Generation Details from IS-95 bits symbols chips I PN CHANNEL ELEMENT Power Control Walsh 9600 bps function Bit 4800 bps R = 1/2 19.

2000 RF100 (c) 1998 Scott Baxter V1.2288 2400 bps 28.8 307.2 Mcps 1200 bps Convolutional ksps ksps Orthogonal kcps Data Burst 1/2 PN Block or Encoder & Randomizer Chip Interleaver Modulation 14400 bps Repetition Delay 7200 bps D 3600 bps R = 1/2 1800 bps 1.2288 Q PN User Address Long Mcps (no offset) Mask PN Code Generator Direct Sequence Spreading February.30 7 .8 28.25 . Reverse Traffic Channel: Generation Details from IS-95 I PN 9600 bps (no offset) 4800 bps R = 1/3 1.

26 .30 7 . Multiplexing. Power Power Control Control February. 2000 RF100 (c) 1998 Scott Baxter V1. Multiplexing. Section C IS-95 IS-95 Operational Operational Details Details Vocoding. Vocoding.

Variable Rate Vocoding & Multiplexing DSP QCELP VOCODER „ Vocoders compress speech. 24/36 1/8 Frame Contents: can be a mixture of Primary Signaling Secondary Traffic (System (On-Air (Voice or data) Messaging) activation. and user secondary 96/144 1/2 Rate Frame data may be mixed in CDMA frames 48/72 1/4 Rt. reduce bit 20ms Sample rate.30 7 . etc) February. 2000 RF100 (c) 1998 Scott Baxter V1. greatly increasing capacity Pitch Filter „ CDMA uses a superior Variable Rate Codebook Vocoder Coded Result Feed- • full rate during speech back Formant Filter • low rates in speech pauses • increased capacity bits Frame Sizes • more natural sound 192/288 Full Rate Frame „ Voice.27 . signaling.

and maximum traffic channel DGU values February. 2000 RF100 (c) 1998 Scott Baxter V1.28 .30 7 . Forward Power Control BSC BTS (1 sector) Help! Pilot Trans- Sync mitter. minimum. it requests more energy „ The complainer’s chip stream gets a quick boost. afterward. Forward Paging Sector X RF User 1 Σ I Q User 2 Short PN Vocoder/ Selector User 3 more „ The BTS continually reduces the strength of each user’s forward baseband chip stream „ When a particular handset sees errors on the forward link. continues to diminish „ Each network manufacturer uses FER-based triggers and initial.

Reverse Power Control
800 bits per second

BSC BTS RX RF Digital
Stronger than Reverse Closed
Open
setpoint? RF Loop Loop
Bad FER?
Raise Setpoint Setpoint TX RF Digital
Occasionally, Handset
as needed
„ Three methods work in tandem to equalize all handset signal levels
at the BTS
• Reverse Open Loop: handset adjusts power up or down based
on received BTS signal (AGC)
• Reverse Closed Loop: Is handset too strong? BTS tells up or
down 1 dB 800 times/second
• Reverse Outer Loop: BSC has FER trouble hearing handset?
BSC adjusts BTS setpoint

February, 2000 RF100 (c) 1998 Scott Baxter V1.30 7 - 29

Details of Reverse Link Power Control
Subscriber Handset
„ TXPO Handset Transmit Power BTS
Receiver>> Rake
R
• Actual RF power output of the LNA

Viterbi
DUP x IF R Σ
Decoder
handset transmitter, including TXPO PA ∼ LO R
combined effects of open x ~
LO
Open Loop S

loop power control from Closed Loop Pwr Ctrl
IF I Long PN
receiver AGC and closed x
Vocoder
Orth
loop power control by BTS IF Mod
x
x Mod FEC

Q <<Transmitter
• can’t exceed handset’s
maximum (typ. +23 dBm) Typical TXPO:
+23 dBm in a coverage hole
TXPO = -(RXdbm) -C + TXGA 0 dBm near middle of cell
C = +73 for 8K vocoder systems -50 dBm up close to BTS
= +76 for 13K vocoder systems
Typical Transmit Gain Adjust
„ TXGA Transmit Gain Adjust 0 dB

• Sum of all closed-loop -10 dB
power control commands
from the BTS since the
beginning of this call -20 dB
Time, Seconds
February, 2000 RF100 (c) 1998 Scott Baxter V1.30 7 - 30

Section D

A
A Quick
Quick Introduction
Introduction to
to
CDMA
CDMA Messages
Messages and
and Call
Call Processing
Processing

February, 2000 RF100 (c) 1998 Scott Baxter V1.30 7 - 31

2000 RF100 (c) 1998 Scott Baxter V1. most of the time is filled with traffic and messages are sent only when there is something to do „ All CDMA messages have very similar structure. regardless of the channel on which they are sent February. they never carry user’s voice traffic • Sync Channel (a forward channel) • Paging Channel (a forward channel) • Access Channel (a reverse channel) • On these channels.30 7 . there are only messages.32 . continuously all of the time „ Some CDMA channels exist just to carry user traffic • Forward Traffic Channel • Reverse Traffic Channel • On these channels. most call processing events are driven by messages „ Some CDMA channels exist for the sole purpose of carrying messages. Messages in CDMA „ In CDMA.

30 7 .33 . NUM_PILOTS occurrences of this field: the sender may release the call PILOT_STRENGTH 6 t „ Field data processing tools capture and display the messages for study RESERVED (‘0’s) 0-7 February. 2000 RF100 (c) 1998 Scott Baxter V1. How CDMA Messages are Sent EXAMPLE: „ CDMA messages on both forward A POWER MEASUREMENT and reverse traffic channels are REPORT MESSAGE normally sent via dim-and-burst Field Length „ Messages include many fields of (in bits) binary data MSG_TYPE (‘00000110’) 8 „ The first byte of each message ACK_SEQ 3 identifies message type: this allows MSG_SEQ 3 the recipient to parse the contents ACK_REQ 1 „ To ensure no messages are missed. If not acknowledged. all CDMA messages bear ENCRYPTION 2 serial numbers and important ERRORS_DETECTED 5 messages contain a bit requesting POWER_MEAS_FRAMES 10 acknowledgment LAST_HDM_SEQ 2 „ Messages not promptly NUM_PILOTS 4 acknowledged are retransmitted several times.

many others…..30 7 . 2000 RF100 (c) 1998 Scott Baxter V1. Extended System Channel Assignment Origination Msg Parameters Msg Msg Extended Neighbor Page Response Msg List Msg Feature Notification Msg Authentication Challenge Global Service Authentication Response Msg Redirection Msg Challenge Msg Status Response Msg Service Redirection Msg Status Request Msg TMSI Assignment SSD Update Msg TMSI Assignment Msg Completion Message Data Burst Msg Null Msg Data Burst Msg February.34 ..Message Vocabulary: Acquisition & Idle States Pilot Channel Sync Channel No Messages Sync Channel Msg Access Channel Paging Channel BTS Registration Msg Access Parameters Msg General Page Msg Order Msg System Parameters Msg Order Msg • Mobile Station Acknowldgment •Base Station Acknowledgment •Lock until Power-Cycled • Long Code Transition Request • Maintenance required • SSD Update Confirmation CDMA Channel List Msg many others….

Acknowledgment Analog Handoff Extended Handoff Pilot Strength •Long Code Transition Direction Msg Direction Msg Measurement Msg Request • SSD Update Confirmation SSD Update Msg Neighbor List Handoff Completion Msg • Connect Update Msg Mobile Station In-Traffic System Registered Msg Parameters Msg February. Message Vocabulary: Conversation State Forward Traffic Channel Order Msg Alert With Reverse Traffic Channel • Base Station Acknowledgment Information Msg • Base Station Challenge Confirmation Service Request Msg Service Request Msg Origination • Message Encryption Mode Continuation Msg Authentication Service Response Msg Service Response Msg Authentication Challenge Challenge Msg Response Msg TMSI Assignment Msg Service Connect Msg Service Connect TMSI Assignment Completion Message Completion Message Send Burst DTMF Msg Service Option Service Option Control Send Burst DTMF Msg Control Msg Message Set Parameters Msg Status Request Msg Status Response Msg Parameters Response Message Power Control Flash With Flash With Power Measurement Parameters Msg.30 7 . 2000 RF100 (c) 1998 Scott Baxter V1.35 . Information Msg Information Msg Report Msg Retrieve Parameters Msg Data Burst Msg Data Burst Message Order Message • Mobile Sta.

30 7 . Section E CDMA CDMA Handset Handset Architecture Architecture CDMA CDMA Handoffs Handoffs February.36 . 2000 RF100 (c) 1998 Scott Baxter V1.

Decoder. PN xxx Walsh xx Demultiplexer power IF. 2000 RF100 (c) 1998 Scott Baxter V1. Detector Traffic Correlator Packets AGC PN xxx Walsh xx RF Audio Open Loop Messages Duplexer Pilot Searcher CPU Vocoder PN xxx Walsh 0 RF Transmit Gain Adjust Audio Messages Transmitter Transmitter Digital Section RF Section Long Code Gen.37 . What’s In a Handset? How does it work? Digital Rake Receiver Symbols Chips Traffic Correlator summing PN xxx Walsh xx bits Traffic Correlator PN xxx Walsh xx Σ Symbols control Receiver Traffic Correlator ∆t Viterbi Decoder.30 7 . time-aligned RF Section Convl. February.

BTS Messages PN Walsh BTS Searcher Pilot Ec/Io PN W=0 „ Every frame.30 7 .38 . 2000 RF100 (c) 1998 Scott Baxter V1. The Rake Receiver Handset Rake Receiver PN Walsh Voice. or even on different BTSs „ Searcher continuously checks pilots February. RF PN Walsh Σ Data. handset uses combined outputs of the three traffic correlators (“rake fingers”) „ Each finger can independently recover a particular PN offset and Walsh code „ Fingers can be targeted on delayed multipath reflections.

RF PN Walsh Σ Data.30 7 . PN Walsh Messages BTS BTS Searcher Pilot Ec/Io PN W=0 „ CDMA soft handoff is driven by the handset • Handset continuously checks available pilots • Handset tells system pilots it currently sees • System assigns sectors (up to 6 max.39 . tells handset • Handset assigns its fingers accordingly • All messages sent by dim-and-burst. on a frame-by-frame basis! • Users are totally unaware of handoff February. Sel. no muting! „ Each end of the link chooses what works best.). CDMA Soft Handoff Mechanics Switch BSC Handset Rake Receiver PN Walsh Voice. 2000 RF100 (c) 1998 Scott Baxter V1.

by PILOT_INC) Remaining „ Handset sends Pilot Strength Measurement Message to the system whenever: HANDOFF • It notices a pilot in neighbor or remaining set PARAMETERS exceeds T_ADD T_ADD T_DROP • An active set pilot drops below T_DROP for T_TDROP time T_TDROP T_COMP • A candidate pilot exceeds an active by T_COMP Exercise: How does a pilot „ The System may set up all requested handoffs. The Complete Rules of Soft Handoff „ The Handset considers pilots in sets PILOT SETS • Active: pilots of sectors actually in use Active 6 Req’d. as nearby sectors to check Neighbor 20 • Remaining: any pilots used by system but not already in the other sets (div. in one set migrate into or it may apply special manufacturer-specific another set. By Std.40 .30 7 . 2000 RF100 (c) 1998 Scott Baxter V1. February. Members • Candidates: pilots mobile requested. Min. for all cases? screening criteria and only authorize some Identify the trigger. and the messages involved. but not yet set up & transmitting by system Candidate 5 • Neighbors: pilots told to mobile by system.

Softer Handoff Handset Rake Receiver Switch BSC PN Walsh Voice.30 7 .41 . this is called Softer Handoff „ Handset can’t tell the difference. but softer handoff occurs in BTS in a single channel element „ Handset can even use combination soft-softer handoff on multiple BTS & sectors February. Sel. RF PN Walsh Σ Data. 2000 RF100 (c) 1998 Scott Baxter V1. BTS Messages PN Walsh Searcher PN W=0 Pilot Ec/Io „ Each BTS sector has unique PN offset & pilot „ Handset will ask for whatever pilots it wants „ If multiple sectors of one BTS simultaneously serve a handset.

30 7 . • Can be degraded by noise Io Total energy received February. sectors Ec desired pilot alone – Imperfect orthogonality.42 . What is Ec/Io? „ Ec/Io • “cleanness” of the pilot -25 -15 -10 0 – foretells the readability of the associated traffic channels • guides soft handoff decisions Ec/Io dB • digitally derived: ratio of good to bad energy seen by the search correlator at the desired PN offset • Never appears higher than Pilot’s percentage of serving cell’s transmitted energy Energy of • Can be degraded by strong RF from other cells. 2000 RF100 (c) 1998 Scott Baxter V1. other PNs are ~-20 dB.

43 .30 7 . 2000 RF100 (c) 1998 Scott Baxter V1. Section F CDMA CDMA Call Call Processing Processing February.

Example 1 Let’s Let’s Acquire Acquire the the System! System! February.44 .30 7 . 2000 RF100 (c) 1998 Scott Baxter V1.

Cellular Spectrum 824 MHz. 835 845 849 870 880 890 894 A B Paging. 1930MHz. etc. unlic.5 869 891. Freq System3 NO CDMA?! Go to AMPS. etc. depending on model) LIST/MRU ROAMING History List LIST/PRL Last-used: Preferred Roaming List Freq System1 Freq System2 until a CDMA signal is found. Freq System4 Freq System5 or to a power-saving standby mode etc. ESMR.30 7 . 2000 RF100 (c) 1998 Scott Baxter V1.5 1900 MHz. February. PCS Spectrum unlic. 1910MHz. Find a Frequency with a CDMA RF Signal Reverse Link Frequencies Forward Link Frequencies (Mobile Transmit) (Base Station Transmit) 800 MHz. A D B E F C data voice A D B E F C 1850MHz. FREQUENCY LISTS: Mobile scans forward link frequencies: HISTORY PREFERRED (Cellular or PCS.45 . A B 825 846. 1990 MHz.

2000 RF100 (c) 1998 Scott Baxter V1.30 7 .46 . read SID permitted? from MRU Sync available? F3 No Signal Denied SID No CDMA Ch HASH using F2 Config List Message IMSI F1 Messages: Read remain Paging Channel Global Svc my ACCOLC? Redir Msg redirect to another CDMA frequency or system Legend to Analog Steps from Steps from Proprietary Typical Mobile the CDMA proprietary SDA standards SDAs databases System Determination Algorithm February. Idle mobiles use proprietary algorithms to find the initial CDMA carrier intended for them to use „ Within that CDMA signal. two types of paging channel messages could cause the idle mobile to choose another frequency: CDMA Channel List Message and GSRM Start Preferred MRU Only Bit 0 PRL Acq Idx Yes Go to last Strongest Is better Is SID frequency PN. How Idle Mobiles Choose CDMA Carriers „ At turnon.

Read Sync Channel All PN Offsets 0 Ec/Io 1.47 . Find Strongest Pilot. decode Walsh 32.30 7 . 2000 RF100 (c) 1998 Scott Baxter V1.817 [SCH] available PN. MSG_LENGTH = 208 bits MSG_TYPE = Sync Channel Message and read Sync Channel Message P_REV = 3 MIN_P_REV = 2 SID = 179 Active Pilot NID = 0 PILOT_PN = 168 Offset Index Handset Rake Receiver n Rake Fingers LC_STATE = 0x0348D60E013 F1 PN168 W32 o SYS_TIME = 98/05/24 23:14:10. Pilot Searcher Scans the Entire Range of PNs -20 Chips 0 32K PN 0 512 SYNC CHANNEL MESSAGE 2. Put Rake finger(s) on strongest 98/05/24 23:14:09.160 LP_SEC = 12 RF F2 PN168 W32 p LTM_OFF = -300 minutes ≈ x ≈ F3 PN168 W32 DAYLT = 0 LO Srch PN??? W0 PRAT = 9600 bps Reference PN RESERVED = 1 February.

the mobile reads all of them again February. or if 600 seconds passes since the last time these messages were read. The Configuration Messages „ After reading the Sync Channel.48 .all configuration messages are repeated on the paging channel every 1. 2000 RF100 (c) 1998 Scott Baxter V1.30 7 . the mobile is now capable of reading the Paging Channel. which it now monitors constantly „ Before it is allowed to transmit or operate on this system. the mobile must collect a complete set of configuration messages „ Collection is a short process -.28 seconds „ The configuration messages contain sequence numbers so the mobile can recognize if any of the messages have been freshly updated as it continues to monitor the paging channel • Access parameters message sequence number • Configuration message sequence number • If a mobile notices a changed sequence number.

49 . 2000 RF100 (c) 1998 Scott Baxter V1. System Parameters Msg and monitor the Paging Channel CDMA Channel List Msg Active Pilot Extended System Parameters Msg (*opt. Get Configured All PN Offsets 0 Ec/Io -20 Chips 0 32K PN 0 Read the 512 Configuration Messages Access Parameters Msg Keep Rake finger(s) on strongest available PN.30 7 . decode Walsh 1.) ≈ x ≈ F3 PN168 W01 LO Srch PN??? W0 Now we’re ready to operate!! Reference PN February.) Handset Rake Receiver n Rake Fingers (Extended*) Neighbor List Msg F1 PN168 W01 o Global Service RF F2 PN168 W01 p Redirection Msg (*opt. Go to Paging Channel.

00E Persist Val for Acc Overload Class 12 = 0 REG_DIST = 0 Persist Val for Acc Overload Class 13 = 0 SRCH_WIN_A = 40 PN chips Persist Val for Acc Overload Class 14 = 0 SRCH_WIN_N = 80 PN chips Persist Val for Acc Overload Class 15 = 0 SRCH_WIN_R = 4 PN chips Persistance Modifier for Msg Tx = 1 NGHBR_MAX_AGE = 0 Persistance Modifier for Reg = 1 PWR_REP_THRESH = 2 frames Probe Randomization = 15 PN chips PWR_REP_FRAMES = 56 frames Acknowledgement Timeout = 320 ms PWR_THRESH_ENABLE = 1 Probe Backoff Range = 4 Slots Maximum PWR_PERIOD_ENABLE = 0 Probe Sequence Backoff Range = 4 Slots Max.0 Db T_DROP = -15.30 7 .50 .126 [PCH] MSG_LENGTH = 264 bits 98/05/24 23:14:10.08 sec Persist Val for Acc Overload Class 11 = 0 BASE_LAT = 00D00'00. PWR_REP_DELAY = 20 frames Max # Probe Seq for Requests = 2 Sequences RESCAN = 0 Max # Probe Seq for Responses = 2 Sequences T_ADD = -13.427 [PCH] MSG_TYPE = System Parameters Message MSG_LENGTH = 184 bits PILOT_PN = 168 Offset Index MSG_TYPE = Access Parameters Message CONFIG_MSG_SEQ = 0 PILOT_PN = 168 Offset Index SID = 179 NID = 0 ACC_MSG_SEQ = 27 REG_ZONE = 0 TOTAL_ZONES = 0 ZONE_TIMER = 60 min ACC_CHAN = 1 channel MULT_SIDS = 0 MULT_NID = 0 BASE_ID = 8710 NOM_PWR = 0 dB INIT_PWR = 0 dB PWR_STEP = 4 dB BASE_CLASS = Public Macrocellular NUM_STEP = 5 Access Probes Maximum PAGE_CHAN = 1 channel MAX_CAP_SZ = 4 Access Channel Frames Maximum MAX_SLOT_CYCLE_INDEX = 0 PAM_SZ = 3 Access Channel Frames HOME_REG = 0 FOR_SID_REG = 0 FOR_NID_REG = 1 Persist Val for Acc Overload Classes 0-9 = 0 POWER_UP_REG = 0 POWER_DOWN_REG = 0 Persist Val for Acc Overload Class 10 = 0 PARAMETER_REG = 1 REG_PRD = 0. Two Very Important Configuration Messages SYSTEM PARAMETERS MESSAGE ACCESS PARAMETERS MESSAGE 98/05/24 23:14:11.5 dB Authentication Mode = 1 T_TDROP = 4 sec Random Challenge Value = Field Omitted EXT_SYS_PARAMETER = 1 Reserved Bits = 99 RESERVED = 0 GLOBAL_REDIRECT = 0 February.0 dB T_COMP = 2.00N BASE_LONG = 000D00'00. 2000 RF100 (c) 1998 Scott Baxter V1.

30 7 . NGHBR_CONFIG = 0 NGHBR_PN = 304 Offset Index DELETE_TMSI: 0.486 [PCH] RESERVED = 0 MSG_LENGTH = 216 bits MSG_TYPE = Neighbor List Message PILOT_PN = 168 Offset Index CONFIG_MSG_SEQ = 0 PILOT_INC = 4 Offset Index NGHBR_CONFIG = 0 NGHBR_PN = 220 Offset Index GLOBAL SERVICE REDIRECTION NGHBR_CONFIG = 0 NGHBR_PN = 52 Offset Index 98/05/17 24:21. CONFIG_MSG_SEQ: 0 NGHBR_CONFIG = 0 NGHBR_PN = 8 Offset Index Redirected access overload classes: { 0. 2000 RF100 (c) 1998 Scott Baxter V1. NGHBR_CONFIG = 0 NGHBR_PN = 176 Offset Index RETURN_IF_FAIL: 0. Four Additional Configuration Messages CDMA CHANNEL LIST MESSAGE EXTENDED SYSTEM PARAMETERS 98/05/24 23:14:10.566 Paging Channel: Global Service Redirection NGHBR_CONFIG = 0 NGHBR_PN = 500 Offset Index PILOT_PN: 168. NGHBR_CONFIG = 0 NGHBR_PN = 136 Offset Index Redirection to an analog system: NGHBR_CONFIG = 0 NGHBR_PN = 384 Offset Index EXPECTED_SID = 0 NGHBR_CONFIG = 0 NGHBR_PN = 216 Offset Index Do not ignore CDMA Available indicator on the redirected analog NGHBR_CONFIG = 0 NGHBR_PN = 68 Offset Index system NGHBR_CONFIG = 0 NGHBR_PN = 328 Offset Index Attempt service on either System A or B with the custom system NGHBR_CONFIG = 0 NGHBR_PN = 112 Offset Index selection process RESERVED = 0 February.51 . 1 }. MSG_TYPE: 96.946 [PCH] MSG_LENGTH = 72 bits MSG_LENGTH = 104 bits MSG_TYPE = CDMA Channel List Message MSG_TYPE = Extended System Parameters Message PILOT_PN = 168 Offset Index PILOT_PN = 168 Offset Index CONFIG_MSG_SEQ = 0 CONFIG_MSG_SEQ = 0 RESERVED = 0 CDMA_FREQ = 283 PREF_MSID_TYPE = IMSI and ESN RESERVED = Field Omitted MCC = 000 IMSI_11_12 = 00 RESERVED_LEN = 8 bits NEIGHBOR LIST RESERVED_OCTETS = 0x00 BCAST_INDEX = 0 98/05/24 23:14:11.786 [PCH] 98/05/24 23:14:10.

Example 2 Let’s Let’s do do an an Idle Idle Mode Mode Handoff! Handoff! February.52 . 2000 RF100 (c) 1998 Scott Baxter V1.30 7 .

NBC. then instantly switches to the paging channel of the new signal • The system doesn’t know the mobile did this! (Does NBC’s Tom Brokaw know you just switched your TV to CNN?) „ On the new paging channel. it isn’t possible to do soft handoff and listen to multiple sectors or base stations at the same time -. and CNN TV news programs aren’t in word-sync for simultaneous viewing • Since a mobile can’t combine signals. it re-registers on the new sector February. the mobile must switch quickly.just like ABC.30 7 .the paging channel information stream is different on each sector. Idle Mode Handoff „ An idle mobile always demodulates the best available signal • In idle mode. not synchronous -. if the mobile learns that registration is required.53 . CBS. always enjoying the best available signal „ The mobile’s pilot searcher is constantly checking neighbor pilots „ If the searcher notices a better signal. the mobile continues on the current paging channel until the end of the current superframe. 2000 RF100 (c) 1998 Scott Baxter V1.

Idle Mode on the Paging Channel:
Meet the Neighbors, track the Strongest Pilot
All PN Offsets
0
Ec/Io

-20

Chips 0 SRCH_WIN_A Mobile Rake RX 32K
PN 0 F1 PN168 W01 512
Active Pilot F2 PN168 W01
Rake Fingers n F3 PN168 W01
o Srch PN??? W0
p
SRCH_WIN_N The phone’s pilot searcher constantly checks
the pilots listed in the Neighbor List Message
Reference PN
Neighbor Set

If the searcher ever notices a neighbor pilot substantially stronger than
the current reference pilot, it becomes the new reference pilot
and the phone switches over to its paging channel on the next superframe.
This is called an idle mode handoff.

February, 2000 RF100 (c) 1998 Scott Baxter V1.30 7 - 54

Phone Operation on the Access Channel
A Successful Access Attempt
„ A sector’s Paging Channel announces 1
(typ) to 32 (max) Access Channels: PN Origination Msg ACCESS
Long Code offsets for mobiles to use if Success!
accessing the system. BTS MS
• For mobiles sending Registration, Probing
Origination, Page Responses an Access Probe
• Base Station always listening! a Probe Sequence
an Access Attempt
„ On the access channel, phones are not
yet under BTS closed-loop power control! PAGING Base Sta. Acknlgmt. Order
„ Phones access the BTS by “probing” at
FW TFC TFC frames of 000s
power levels determined by receive power
and an open loop formula PAGING Channel Assnmt. Msg.
• If “probe” not acknowledged by BTS
within ACC_TMO (~400 mS.), phone TFC preamble of 000s RV TFC
will wait a random time (~200 mS)
FW FC Base Sta. Acknlgmt. Order
then probe again, stronger by PI db.
• There can be 15 max. (typ. 5) probes Mobile Sta. Ackngmt. Order RV TFC
in a sequence and 15 max. (typ. 2)
sequences in an access attempt FW TFC Service Connect Msg.
• most attempts succeed on first probe!
Svc. Connect Complete Msg RV TFC
„ The Access Parameters message on the
paging channel announces values of all FW TFC Base Sta. Acknlgmt. Order
related parameters
Call is Established!
February, 2000 RF100 (c) 1998 Scott Baxter V1.30 7 - 55

Example 3

Let’s
Let’s Register!
Register!

February, 2000 RF100 (c) 1998 Scott Baxter V1.30 7 - 56

so that incoming calls can be delivered • registration also allows the system to intelligently page the mobile only in the area where the mobile is currently located. Registration „ Registration is the process by which an idle mobile lets the system know it’s awake and available for incoming calls • this allows the system to inform the mobile’s home switch of the mobile’s current location. thereby eliminating useless congestion on the paging channels in other areas of the system „ There are many different conditions that could trigger an obligation for the mobile to register • there are flags in the System Parameters Message which tell the mobile when it must register on the current system February.30 7 . 2000 RF100 (c) 1998 Scott Baxter V1.57 .

30 7 . REG_DIST: 0 REGISTRATION MESSAGE SRCH_WIN_A (PN chips): 28 SRCH_WIN_N (PN chips): 100. MFR 1. Reserved 38.5dB. We’re officially registered! February. MULT_SIDS: 0 MULT_NIDS: 0 This mobile notices that it is obligated to BASE_ID: 1618 BASE_CLASS: Reserved PAG_CHAN: 1 MAX_SLOT_CYCLE_INDEX: 2 register.826 [PCH] System Parameters Message Pilot_PN: 32 The System Parameters Message tells CONFIG_MSG_SEQ: 14 SID: 16420 NID: 0. Serial Number 69116. so it transmits a Registration HOME_REG: 1 FOR_SID_REG: 1 FOR_NID_REG: 1.00¨ Lon. SRCH_WIN_R (PN chips): 130 NGHBR_MAX_AGE: 2 16:18:27. T_TDROP: 4s IMSI: (Class: 0. An Actual Registration SYSTEM PARAMETERS MESSAGE 18:26.. MSID_TYPE: 3. 0°00´00.144 Access Channel: Registration PWR_REP_THRESH: 2 PWR_REP_FRAMES (frames): 15 ACK_SEQ: 7 MSG_SEQ: 1 ACK_REQ: 1 VALID_ACK: 0 PWR_THRESH_ENABLE: 1 PWR_PERIOD_ENABLE: 0. 2000 RF100 (c) 1998 Scott Baxter V1. POWER_UP_REG: 1 POWER_DOWN_REG: 1 Message. ACK_TYPE: 0 PWR_REP_DELAY: 1 (4 frames) RESCAN: 0.0dB T_COMP: 2.0dB T_DROP: -16.00° Lat.506 Paging Channel: Order ACK_SEQ: 1 MSG_SEQ: 0 ACK_REQ: 0 VALID_ACK: 1 MSID_TYPE: 2 IMSI: (Class: 0. REG_ZONE: 0 TOTAL_ZONES: 0 Zone timer length (min): 1 all mobiles when they should register. ESN: [0x 01 99 0d fc] T_ADD: -14. Class_0_type: 3) [0x 02 47 8d 31 74 29 36] (302) 00-416-575-0421 The base station confirms that the Order type: Base Station Acknowledgement Order mobile’s registration message was received.58 . Class_0_type: 1) [0x 01 8d 31 74 29 36] EXT_SYS_PARAMETER: 1 00-416-575-0421 EXT_NGHBR_LIST: 1 AUTH_MODE: 0 GLOBAL_REDIRECT: 0 REG_TYPE: Timer-based SLOT_CYCLE_INDEX: 2 MOB_P_REV: 1 EXT_SCM: 1 SLOTTED_MODE: 1 BASE STATION ACKNOWLEDGMENT MOB_TERM: 1 16:18:27. PARAMETER_REG: 1 Registration period (sec): 54 Base station 0°00´00.

30 7 . 2000 RF100 (c) 1998 Scott Baxter V1. Example 4 Let’s Let’s Receive Receive an an incoming incoming Call! Call! February.59 .

etc.. then notifies the mobile to use it with a Channel Assignment Message. „ The system sets up a traffic channel for the call. „ The base station and the mobile negotiate what type of call this will be -. February. 13k voice. „ When an incoming call appears. „ A mobile which has been paged sends a Page Response Message on the access channel. „ When the human user presses the send button. the paging channel notifies the mobile in a General Page Message. „ The mobile is told to ring and given a “calling line ID” to display. „ The mobile and the base station notice each other’s traffic channel signals and confirm their presence by exchanging acknowledgment messages. Receiving an Incoming Call „ All idle mobiles monitor the paging channel to receive incoming calls.I.60 . 2000 RF100 (c) 1998 Scott Baxter V1. the audio path is completed and the call proceeds.30 7 .e.

61 .768 [PCH] Order Message NAR_AN_CAP = 0 RESERVED = 0 MSG_LENGTH = 112 bits MSG_TYPE = Order Message ACK_SEQ = 2 MSG_SEQ = 0 ACK_REQ = 0 VALID_ACK = 1 ADDR_TYPE = IMSI ADDR_LEN = 40 bits IMSI_CLASS = 0 IMSI_CLASS_0_TYPE = 0 RESERVED = 0 The base station confirms that the mobile’s IMSI_S = 6153300644 ORDER = Base Station Acknowledgement Order page response was received. MSG_TYPE = General Page Message 615-330-0644. AUTHR = 0x307B5 RANDC = 0xC6 COUNT = 0 MOB_TERM = 1 SLOT_CYCLE_INDEX = 0 MOB_P_REV = 3 SCM = 106 BASE STATION ACKNOWLEDGMENT REQUEST_MODE = Either Wide Analog or CDMA Only SERVICE_OPTION = 32768 PM = 0 98/05/24 23:14:46. An Actual Page and Page Response GENERAL PAGE MESSAGE 98/05/24 23:14:46. Order-Specific Fields = Field Omitted RESERVED = 0 expecting a response within 12 seconds. Now the ADD_RECORD_LEN = 0 bits mobile is waiting for channel assignment. 2000 RF100 (c) 1998 Scott Baxter V1. February.425 [ACH] Page Response Message PAGE_CLASS = 0 PAGE_SUBCLASS = 0 MSG_LENGTH = 216 bits MSG_SEQ = 1 MSG_TYPE = Page Response Message IMSI_S = 6153300644 ACK_SEQ = 1 MSG_SEQ = 2 ACK_REQ = 1 SPECIAL_SERVICE = 1 VALID_ACK = 1 ACK_TYPE = 2 SERVICE_OPTION = 32768 MSID_TYPE = IMSI and ESN MSID_LEN = 9 octets RESERVED = Field Omitted ESN = 0xD30E415C IMSI_CLASS = 0 IMSI_CLASS_0_TYPE = 0 RESERVED = 0 IMSI_S = 6153300644 AUTH_MODE = 1 The mobile responds to the page. CONFIG_MSG_SEQ = 1 ACC_MSG_SEQ = 20 CLASS_0_DONE = 1 CLASS_1_DONE = 1 RESERVED = 0 PAGE RESPONSE MESSAGE BROADCAST_DONE = 1 RESERVED = 0 ADD_LENGTH = 0 bits ADD_PFIELD = Field Omitted 98/05/24 23:14:46.30 7 .127 [PCH] General Page Message MSG_LENGTH = 128 bits The system pages the mobile.

2000 RF100 (c) 1998 Scott Baxter V1. and the forward channel.62 . channel.using concludes this is the right traffic the assigned Walsh code. Channel Assignment and Traffic Channel Confirmation CHANNEL ASSIGNMENT MESSAGE 18:14:47. ADD_RECORD_LEN: 5 FREQ_INCL: 1 GRANTED_MODE: 2 CODE_CHAN: 43 FRAME_OFFSET: 2 ENCRYPT_MODE: Encryption disabled BAND_CLASS: 800 MHz cellular band CDMA_FREQ: 283 The mobile sees at least two The base station is already good blank frames in a row on sending blank frames on the forward channel. Class_0_type: 0) acknowledgment order. Everybody is ready! February.598 Reverse Traffic Channel: Order ENCRYPTION: 0 USE_TIME: 0 ACTION_TIME: 0 ACK_SEQ: 0 MSG_SEQ: 0 ACK_REQ: 0 Base Station Acknowledgement Order ENCRYPTION: 0 Mobile Station Acknowledgement Order The base station acknowledges The mobile station acknowledges the receiving the mobile’s preamble. base station’s acknowledgment. BASE STATION ACKNOWLEDGMENT MOBILE STATION ACKNOWLEDGMENT 18:14:47.30 7 .027 Paging Channel: Channel Assignment Only about 400 ms. after the base station ACK_SEQ: 2 MSG_SEQ: 1 ACK_REQ: 0 VALID_ACK: 1 MSID_TYPE: 2 IMSI: (Class: 0. the mobile receives [0x 01 f8 39 6a 15] 615-330-0644 ASSIGN_MODE: Traffic Channel Assignment the channel assignment message. It sends a preamble of two blank frames of its own on the reverse traffic channel.581 Forward Traffic Channel: Order ACK_SEQ: 7 MSG_SEQ: 0 ACK_REQ: 1 18:14:47.

1800 bps actually begin. The mobile says it’s ringing. 3600.018 Reverse Traffic Channel: Order CHARi = 6153000124 RESERVED = 0 RESERVED = 0 ACK_SEQ: 1 MSG_SEQ: 4 ACK_REQ: 0 ENCRYPTION: 0 The base station orders the mobile to ring. Up RECORD_TYPE = Calling Party Number until now. 1800 bps proposes that the requested call Reverse Traffic Channel Rate (Set 2): 14400. Service option: (6) Voice (13k) (0x8000) Forward Traffic Channel: Primary Traffic Reverse Traffic Channel: Primary Traffic SERVICE CONNECT COMPLETE MSG.760 Forward Traffic Channel: Service Connect Now that both sides have arrived on the ACK_SEQ: 0 MSG_SEQ: 1 ACK_REQ: 0 ENCRYPTION: 0 USE_TIME: 0 ACTION_TIME: 0 SERV_CON_SEQ: 0 traffic channel. 7200. 7200. 3600. RECORD_LEN = 96 bits NUMBER_TYPE = National Number Now it is officially a call. NUMBER_PLAN = ISDN/Telephony Numbering Plan PI = Presentation Allowed SI = Network Provided 18:14:48.961 Forward Traffic Channel: The mobile agrees and Alert With Information says its ready to play. Service Negotiation and Mobile Alert SERVICE CONNECT MESSAGE 18:14:47. this was an access attempt. 2000 RF100 (c) 1998 Scott Baxter V1.63 . and Mobile Station Acknowledgement Order gives it the calling party’s number to display. the base station Service Configuration: supported Transmission: Forward Traffic Channel Rate (Set 2): 14400. ACK_SEQ: 3 MSG_SEQ: 1 ACK_REQ: 1 ENCRYPTION: 0 SIGNAL_TYPE = IS-54B Alerting ALERT_PITCH = Medium Pitch (Standard Alert) SERVICE CONNECT COMPLETE is a SIGNAL = Long RESERVED = 0 major milestone in call processing.30 7 .835 Reverse Traffic Channel: Service Connect Completion ACK_SEQ: 1 MSG_SEQ: 3 ACK_REQ: 1 ENCRYPTION: 0 SERV_CON_SEQ: 0 ALERT WITH INFORMATION MESSAGE 18:14:47. February. 18:14:47.

30 7 .64 . The human user finally comes over and presses the send button to answer the call. 2000 RF100 (c) 1998 Scott Baxter V1. CONNECT ORDER 18:14:54.758 Reverse Traffic Channel: Order ACK_SEQ: 6 MSG_SEQ: 0 ACK_REQ: 1 ENCRYPTION: 0 Connect Order BASE STATION ACKNOWLEDGMENT 18:14:54. The Human Answers! Connect Order The mobile has been ringing for several seconds.920 Forward Traffic Channel: Order ACK_SEQ: 0 MSG_SEQ: 1 ACK_REQ: 0 ENCRYPTION: 0 USE_TIME: 0 ACTION_TIME: 0 Base Station Acknowledgement Order Now the switch completes the audio circuit and the two callers can talk! February.

Example 5 Let’s Let’s make make an an Outgoing Outgoing Call! Call! February. 2000 RF100 (c) 1998 Scott Baxter V1.30 7 .65 .

„ The system acknowledges receiving the origination by sending a base station acknowledgement on the paging channel.30 7 . 2000 RF100 (c) 1998 Scott Baxter V1. Placing an Outgoing Call „ The mobile user dials the desired digits. „ The mobile arrives on the traffic channel. „ The system notifies the mobile in a Channel Assignment Message on the paging channel. „ The base station and the mobile negotiate what type of call this will be -. „ Mobile transmits an Origination Message on the access channel. „ The system arranges the resources for the call and starts transmitting on the traffic channel. 13k voice.66 .e.. etc. February. „ The audio circuit is completed and the mobile caller hears ringing.I. and presses SEND. „ The mobile and the base station notice each other’s traffic channel signals and confirm their presence by exchanging acknowledgment messages.

Class_0_type: 0) [0x 03 5d b8 97 c2] 972-849-5073 Base Station Acknowledgment Order The base station confirms that the origination message CHANNEL ASSIGNMENT MESSAGE was received. Class_0_type: 0) [0x 03 5d b8 97 c2] 972-849-5073 AUTH_MODE: 0 MOB_TERM: 1 SLOT_CYCLE_INDEX: 2 MOB_P_REV: 1 EXT_SCM: 1 DualMode: 0 SLOTTED_MODE: 1 PowerClass: 0 BASE STATION ACKNOWLEDGMENT REQUEST_MODE: CDMA only SPECIAL_SERVICE: 1 Service option: (6) Voice (13k) (0x8000) PM: 0 17:48:53. Origination ORIGINATION MESSAGE The mobile sends an 17:48:53.367 Paging Channel: Channel Assignment ACK_SEQ: 6 MSG_SEQ: 1 ACK_REQ: 0 VALID_ACK: 1 MSID_TYPE: 2 IMSI: (Class: 0. 2000 RF100 (c) 1998 Scott Baxter V1. 17:48:54.30 7 .487 Paging Channel: Order DIGIT_MODE: 0 MORE_FIELDS: 0 NUM_FIELDS: 11 ACK_SEQ: 6 MSG_SEQ: 0 ACK_REQ: 0 VALID_ACK: 1 Chari: 18008900829 MSID_TYPE: 2 NAR_AN_CAP: 0 IMSI: (Class: 0. Class_0_type: 0) [0x 03 5d b8 97 c2] 972-849-5073 ASSIGN_MODE: Traffic Channel Assignment. IMSI: (Class: 0. February.0 GHz PCS band Message and the mobile CDMA_FREQ: 425 goes to the traffic channel. The base station sends a ADD_RECORD_LEN: 5 FREQ_INCL: 1 GRANTED_MODE: 2 CODE_CHAN: 12 FRAME_OFFSET: 0 Channel Assignment ENCRYPT_MODE: Encryption disabled BAND_CLASS: 1.67 .144 Access Channel: Origination origination message ACK_SEQ: 7 MSG_SEQ: 6 ACK_REQ: 1 VALID_ACK: 0 ACK_TYPE: 0 MSID_TYPE: 3 on the access ESN: [0x 00 06 98 24] MFR 0 Reserved 1 Serial Number 170020 channel.8 to 2.

835 Reverse Traffic Channel: Order USE_TIME: 0 ACTION_TIME: 0 ACK_SEQ: 0 MSG_SEQ: 0 ACK_REQ: 0 Base Station Acknowledgment Order ENCRYPTION: 0 Mobile Station Acknowledgment Order The base station acknowledges The mobile station acknowledges the receiving the mobile’s preamble.30 7 . base station’s acknowledgment.757 Forward Traffic Channel: Order ACK_SEQ: 7 MSG_SEQ: 0 ACK_REQ: 1 ENCRYPTION: 0 17:48:54. and the forward channel.using concludes this is the right traffic the assigned Walsh code. Everybody is ready! February. channel. 2000 RF100 (c) 1998 Scott Baxter V1. It sends a preamble of two blank frames of its own on the reverse traffic channel.68 . Traffic Channel Confirmation The mobile sees at least two The base station is already good blank frames in a row on sending blank frames on the forward channel. BASE STATION ACKNOWLEDGMENT MOBILE STATION ACKNOWLEDGMENT 17:48:54.

137 Reverse Traffic Channel: Service Connect Completion ACK_SEQ: 1.098 Forward Traffic Channel: Service Connect Now that the traffic channel is working ACK_SEQ: 7 MSG_SEQ: 1 ACK_REQ: 1 ENCRYPTION: 0 USE_TIME: 0 ACTION_TIME: 0 SERV_CON_SEQ: 0 in both directions. Now it is officially a call. ENCRYPTION: 0. 1800 bps proposes that the requested call Reverse Traffic Channel Rate (Set 2): 14400. SERVICE CONNECT COMPLETE is a major milestone in call processing. Service Negotiation and Connect Complete SERVICE CONNECT MESSAGE 17:48:55. Up until now. USE_TIME: 0 ACTION_TIME: 0 Base Station Acknowledgment Order The base station agrees. 7200. 2000 RF100 (c) 1998 Scott Baxter V1. 7200. 3600. MSG_SEQ: 0. 17:48:55.779 Forward Traffic Channel: Order The mobile agrees and ACK_SEQ: 0 MSG_SEQ: 0 ACK_REQ: 0 ENCRYPTION: 0 says its ready to play.69 . 1800 bps actually begin. Now the switch completes the audio circuit and the two callers can talk! February.30 7 . this was an access attempt. ACK_REQ: 1. the base station Service Configuration Supported Transmission: Forward Traffic Channel Rate (Set 2): 14400. 3600. Service option: (6) Voice (13k) (0x8000) Forward Traffic Channel: Primary Traffic Reverse Traffic Channel: Primary Traffic SERVICE CONNECT COMPLETE MSG. SERV_CON_SEQ: 0 BASE STATION ACKNOWLEDGMENT 17:48:55.

70 .30 7 . 2000 RF100 (c) 1998 Scott Baxter V1. Example 6 Let’s Let’s End End aa Call! Call! February.

“normal release”.71 . Ending A Call „ A normal call continues until one of the parties hangs up. the mobile reacquires the system. and the mobile station acts to tear down the link February. and a fade timer acts • the reverse link is lost at the base station. “no reason given”. • If a normal release is visible. „ The other side of the call sends a Release Order.30 7 . • Searches for the best pilot on the present CDMA frequency • Reads the Sync Channel Message • Monitors the Paging Channel steadily „ Several different conditions can cause a call to end abnormally: • the forward link is lost at the mobile. and the base station acts to tear down the link • a number of reverse link messages aren’t acknowledged. 2000 RF100 (c) 1998 Scott Baxter V1. and a fade timer acts • a number of forward link messages aren’t acknowledged. That action sends a Release Order. the call ended normally. „ At the conclusion of the call.

A Beautiful End to a Normal Call MOBILE RELEASE ORDER 17:49:21.517 Sync Channel scanned to find the best pilot.72 . this 17:49:21.715 Reverse Traffic Channel: Order ACK_SEQ: 1 MSG_SEQ: 1 ACK_REQ: 1 ENCRYPTION: 0 Release Order (normal release) BASE STATION ACKNOWLEDGMENT At the end of a normal call. and read MSG_TYPE: 1 Sync Channel Message the Sync Channel Message. P_REV: 1 MIN_P_REV: 1 SID: 4112 NID: 2 Pilot_PN: 183 LC_STATE: 0x318fe5d84a5 SYS_TIME: 0x1ae9683dc LP_SEC: 9 LTM_OFF: -10 DAYLT: 1 Paging Channel Data Rate: 9600 CDMA_FREQ: 425 February. USE_TIME: 0 ACTION_TIME: 0 Base Station Acknowledgement Order The base station acknowledged BASE STATION RELEASE ORDER receiving the message. ACK_SEQ: 1 MSG_SEQ: 2 ACK_REQ: 0 ENCRYPTION: 0. 17:49:22.30 7 . 2000 RF100 (c) 1998 Scott Baxter V1.997 Forward Traffic Channel: Order ACK_SEQ: 1 MSG_SEQ: 3 ACK_REQ: 0 ENCRYPTION: 0 a release message of its own. then sent 17:49:21. USE_TIME: 0 ACTION_TIME: 0 Release Order (no reason given) SYNC CHANNEL MESSAGE The mobile left the traffic channel.936 Forward Traffic Channel: Order mobile user pressed end.

30 7 . Example 7 Let’s Let’s receive receive Notification Notification of of aa Voice Voice Message! Message! February. 2000 RF100 (c) 1998 Scott Baxter V1.73 .

Feature Notification FEATURE NOTIFICATION MESSAGE 98/06/30 21:16:44.30 7 .368 [PCH] Feature Notification Message MSG_LENGTH = 144 bits The Feature Notification Message on MSG_TYPE = Feature Notification Message ACK_SEQ = 0 the Paging Channel tells a specific MSG_SEQ = 0 mobile it has voice messages waiting. IMSI_CLASS_0_TYPE = 3 RESERVED = 0 MCC = 302 IMSI_11_12 = 00 IMSI_S = 9055170325 RELEASE = 0 RECORD_TYPE = Message Waiting RECORD_LEN = 8 bits MSG_COUNT = 1 RESERVED = 0 MOBILE STATION ACKNOWLEDGMENT The mobile confirms it has received the notification by sending a Mobile Station Acknowledgment Order on the access channel. ACK_REQ = 1 VALID_ACK = 0 ADDR_TYPE = IMSI ADDR_LEN = 56 bits There are other record types to notify IMSI_CLASS = 0 the mobile of other features. 2000 RF100 (c) 1998 Scott Baxter V1. February.74 .

30 7 . 2000 RF100 (c) 1998 Scott Baxter V1.75 . Example 8 Let’s Let’s do do aa Handoff! Handoff! February.

Srch PN??? W0 Continue checking the neighbors. F2 PN168 W61 o PN 168 is the only active signal. The Call is Already Established.30 7 .76 . F3 PN168 W61 p and also is our timing reference. Reference PN Neighbor Set T_ADD ! ! If we ever notice a neighbor with Ec/Io above T_ADD. 2000 RF100 (c) 1998 Scott Baxter V1. ask to use it! Send a Pilot Strength Measurement Message! February. What Next? All PN Offsets 0 Ec/Io -20 Chips 0 10752 14080 32002 32K PN 0 168 220 500 512 Mobile Rake RX Active Pilot F1 PN168 W61 Rake Fingers n The call is already in progress.

30 7 . KEEP = 1 PILOT_PN_PHASE = 32002 chips (PN500 + 2 chips) PILOT_STRENGTH = -11. this particular MSG_TYPE = Pilot Strength Measurement Message ACK_SEQ = 5 MSG_SEQ = 0 ACK_REQ = 1 mobile already was in handoff with PN 168 ENCRYPTION = Encryption Mode Disabled and 220. REF_PN = 168 Offset Index (the Reference PN) PILOT_STRENGTH = -6.386 [FTC] Order Message MSG_LENGTH = 64 bits MSG_TYPE = Order Message The base station acknowledges receiving ACK_SEQ = 0 MSG_SEQ = 0 ACK_REQ = 0 the Pilot Strength Measurement Message.205 [RTC] Pilot Strength Measurement Message MSG_LENGTH = 128 bits Just prior to this message. Mobile Requests the Handoff! PILOT STRENGTH MEASUREMENT MESSAGE 98/05/24 23:14:02.77 .5 dB T_Add.0 dB This pilot strength measurement message KEEP = 1 PILOT_PN_PHASE = 14080 chips (PN220+0chips) reports PN 500 has increased above PILOT_STRENGTH = -12. and the mobile wants to use it too. 2000 RF100 (c) 1998 Scott Baxter V1. ENCRYPTION = Encryption Mode Disabled USE_TIME = 0 ACTION_TIME = 0 ORDER = Base Station Acknowledgment Order ADD_RECORD_LEN = 0 bits Order-Specific Fields = Field Omitted RESERVED = 0 February.0 dB KEEP = 1 RESERVED = 0 BASE STATION ACKNOWLEDGMENT 98/05/24 23:14:02.

0 dB T_COMP = 2. System Authorizes the Handoff! HANDOFF DIRECTION MESSAGE 98/05/24 23:14:02.945 [RTC] Order Message MSG_LENGTH = 56 bits MSG_TYPE = Order Message ACK_SEQ = 6 MSG_SEQ = 6 ACK_REQ = 0 The mobile acknowledges it has received ENCRYPTION = Encryption Mode Disabled ORDER = Mobile Station Acknowledgment Order the Handoff Direction Message.78 . The pre-existing SEARCH_INCLUDED = 1 SRCH_WIN_A = 40 PN chips link on PN 168 will continue to use T_ADD = -13.5 dB Walsh code 61. ADD_RECORD_LEN = 0 bits Order-Specific Fields = Field Omitted RESERVED = 0 February.30 7 . and the new PRIVATE_LCM = Field Omitted RESET_L2 = Field Omitted link on PN500 will use Walsh code 50. the new link on PN220 T_TDROP = 4 sec HARD_INCLUDED = 0 FRAME_OFFSET = Field Omitted will use Walsh Code 20. RESET_FPC = Field Omitted RESERVED = Field Omitted ENCRYPT_MODE = Field Omitted RESERVED = Field Omitted NOM_PWR = Field Omitted NUM_PREAMBLE = Field Omitted BAND_CLASS = Field Omitted CDMA_FREQ = Field Omitted ADD_LENGTH = 0 PILOT_PN = 168 PWR_COMB_IND = 0 CODE_CHAN = 61 PILOT_PN = 220 PWR_COMB_IND = 1 CODE_CHAN = 20 PILOT_PN = 500 PWR_COMB_IND = 0 CODE_CHAN = 50 RESERVED = 0 MOBILE STATION ACKNOWLEDGMENT 98/05/24 23:14:02. 2000 RF100 (c) 1998 Scott Baxter V1.0 dB T_DROP = -15.926 [FTC] Extended Handoff Direction Message The base station sends a Handof MSG_LENGTH = 136 bits MSG_TYPE = Extended Handoff Direction Message Direction Message authorizing the ACK_SEQ = 0 MSG_SEQ = 6 ACK_REQ = 1 mobile to begin soft handoff with all ENCRYPTION = Encryption Mode Disabled USE_TIME = 0 ACTION_TIME = 0 HDM_SEQ = 0 three requested PNs.

085 [FTC] Forward Traffic Channel: Order ACK_SEQ: 1 MSG_SEQ: 1 ACK_REQ: 0 ENCRYPTION: 0 received the mobile’s Handoff USE_TIME: 0 ACTION_TIME: 0 Completion message. and will Base Station Acknowledgement Order continue with all of the links active.985 [RTC] Handoff Completion Message The mobile searcher quickly re-checks MSG_LENGTH = 72 bits MSG_TYPE = Handoff Completion Message all three PNs.79 .30 7 . 2000 RF100 (c) 1998 Scott Baxter V1. Mobile Implements the Handoff! HANDOFF COMPLETION MESSAGE 98/05/24 23:14:02. It still hears their pilots! ACK_SEQ = 6 MSG_SEQ = 1 ACK_REQ = 1 ENCRYPTION = Encryption Mode Disabled The mobile sends a Handoff Completion LAST_HDM_SEQ = 0 Message. confirming it still wants to go PILOT_PN = 168 Offset Index PILOT_PN = 220 Offset Index ahead with the handoff. February. PILOT_PN = 500 Offset Index RESERVED = 0 BASE STATION ACKNOWLEDGMENT The base station confirms it has 98/05/24 23:14:03.

ADD_RECORD_LEN = 0 bits Order-Specific Fields = Field Omitted The handoff is fully established. 2000 RF100 (c) 1998 Scott Baxter V1. Handoff is Complete! NEIGHBOR LIST UPDATE MESSAGE 98/05/24 23:14:03.166 [FTC] Neighbor List Update Message MSG_LENGTH = 192 bits MSG_TYPE = Neighbor List Update Message ACK_SEQ = 1 MSG_SEQ = 7 ACK_REQ = 1 ENCRYPTION = Encryption Mode Disabled In response to the mobile’s Handoff PILOT_INC = 4 Offset Index Completion Message. NGHBR_PN = 216 Offset Index NGHBR_PN = 328 Offset Index NGHBR_PN = 332 Offset Index NGHBR_PN = 400 Offset Index NGHBR_PN = 96 Offset Index RESERVED = 0 MOBILE STATION ACKNOWLEDGMENT 98/05/24 23:14:03.30 7 .80 .245 [RTC] Order Message The mobile confirms receiving the MSG_LENGTH = 56 bits MSG_TYPE = Order Message Neighbor List Update Message. Neighbor List Updated. NGHBR_PN = 136 Offset Index NGHBR_PN = 112 Offset Index This is necessary since the mobile NGHBR_PN = 372 Offset Index could be traveling toward any one of NGHBR_PN = 36 Offset Index NGHBR_PN = 8 Offset Index these pilots and may need to request NGHBR_PN = 384 Offset Index soft handoff with any of them soon. It is ACK_SEQ = 7 MSG_SEQ = 7 ACK_REQ = 0 ENCRYPTION = Encryption Mode Disabled already checking the neighbor list and ORDER = Mobile Station Acknowledgement Order will do so continuously from now on. the base station NGHBR_PN = 164 Offset Index NGHBR_PN = 68 Offset Index assembles a new composite neighbor NGHBR_PN = 52 Offset Index list including all the neighbors of each of NGHBR_PN = 176 Offset Index NGHBR_PN = 304 Offset Index the three active pilots. RESERVED = 0 February.

30 7 . but still check Pilots! All PN Offsets 0 Ec/Io -20 Chips 0 10752 14080 32002 32K PN 0 168 220 500 512 Mobile Rake RX Active Set F1 PN168 W61 n p Rake Fingers o F2 PN500 W50 T_DROP F3 PN220 W20 Srch PN??? W0 Reference PN Neighbor Set T_ADD Continue checking each ACTIVE pilot. Handoff Now In Effect. DROP IT!! Continue looking at each NEIGHBOR pilot. If any ever rises above T_ADD. send Pilot Strength Measurement Message. 2000 RF100 (c) 1998 Scott Baxter V1.81 . If any are less than T_DROP and remain so for T_TDROP time. send Pilot Strength Measurement Message. ADD IT! February.

Candidate.82 . or Neighbor sets T_ADD SRCH_WIN_R February.30 7 . 2000 RF100 (c) 1998 Scott Baxter V1. The Complete Picture of Handoff & Pilot Sets All PN Offsets 0 Ec/Io -20 Chips 0 SRCH_WIN_A 32K Rake Fingers n o p PN 0 Active Set 512 Pilots of sectors SRCH_WIN_A T_DROP now used for Mobile Rake RX communication F1 PN168 W61 Reference PN F2 PN500 W50 T_DROP Candidate Set SRCH_WIN_N F3 PN220 W20 Pilots requested Srch PN??? W0 by mobile but not set up by system Neighbor Set Pilots suggested T_ADD by system for more checking All other pilots divisible by PILOT_INC but not Remaining Set presently in Active.

30 7 . Section G Deeper Deeper Handoff Handoff Details: Details: Search Search Windows Windows && Timing Timing February. 2000 RF100 (c) 1998 Scott Baxter V1.83 .

N R R R R R R R R R R R R N N advancing one pilot each R R R R R R R R R R R R R R R R R time the Neighbors revolve. much like meshed gears. R 12 N N N N N N N N N N N N Actives and candidates N occupy the fastest. revolution. N R R R R R R R R R R R R Neighbors are A R R R R R R R R R R R R R next. The Pilot Searcher’s Measurement Process CURRENT PILOT SET CONTENTS R 3 A A A The searcher checks pilots in nested 1 C loops. 2000 RF100 (c) 1998 Scott Baxter V1. N NR 112 R R R R R R R R R R R R R R R R R R R R R R R R spinning wheel. advancing A AN R R R R R R R R R R R R one pilot for each R R R R R R R R R R R R R Act+Cand. PILOT SEARCHER VIEWED IN SEQUENCE: Typical Elapsed Time = 4 seconds A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N R A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N R A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N A A A C N R Only 3 of 112 remaining set pilots have been checked thus far! February.30 7 . N R R R R R R R R R R R R R Remaining is slowest.84 .

the seem earlier or later than expected signal from BTS B will seem 29 chips „ To overcome skew.30 7 . 2000 RF100 (c) 1998 Scott Baxter V1. A Quick Primer on Pilot Search Windows „ The phone chooses one strong sector and PROPAGATION DELAY “locks” to it. when the phone searches for a particular pilot. 1 km.= 4.85 .14 m 1 mile=6. individually for each Pilot set: „ There are pitfalls if the window sizes are improperly set • too large: search time increases • too small: overlook pilots from far away • too large: might misinterpret identity of a distant BTS’ signal One chip is 801 feet or 244. extra wide “delta” of chips centered on the If the phone is locked to BTS B. it scans an earlier than expected.1 chips February. system gives to handset a A BTS B neighbor list of nearby sectors’ PNs BTS „ Propagation delay “skews” the apparent PN offsets of all other sectors. accepting its offset at “face value” SKEWS APPARENT PN OFFSETS and interpreting all other offsets by 33 4 comparison to it Chips Chips „ In messages. making them If the phone is locked to BTS A. the expected offset (called a “search window”) signal from BTS A will seem 29 chips „ Search window values can be datafilled later than expected.6 chips.

Setting Pilot Search Window Sizes „ When the handset first powers up.88 small.42 „ Window size for actives and candidates can be 40 (±20) 7 3. 2000 RF100 (c) 1998 Scott Baxter V1.12 3.1 27.3 39. R and uses AND PROPAGATION DISTANCES them when looking for neighbors both in idle mode and during calls. N.5 the same pilot.07 9. „ When a strong neighbor is requested in a PSMM.32 search wide enough to include multipath energy! 80 (±40) 9 6.44 rechecked and tracked by the phone.30 7 .9 the spread (in chips) between fingers locked to 160 (±80) 12 12.06 1.03 4.86 . Window Datafill N. No windows are used in this process.R Delta Distance Size (Chips) Value Miles KM. it does an exhaustive search for the best pilot.2 be set to accommodate the maximum intercell distances which a mobile might experience February. Its 14 (±7) 4 1.71 offset is precisely remembered and frequently 20 (±10) 5 1.1 „ Neighbor and Remaining search windows should 452 (±226) 15 34. Only 60 (±30) 8 4.3 55. the handset learns the SEARCH WINDOW SETTINGS window sizes SRCH_WIN_A.86 15.59 12.1 19.77 • This greatly speeds up overall searching! 100 (±50) 10 7. 28 (±14) 6 2.52 2.6 how wide the SRCH_WIN_A should be set.55 7. These statistics literally show us 226 (±113) 13 17.2 „ Most post-processing tools deliver statistics on 130 (±65) 11 9. since their exact position is known. the former neighbor pilot is now a candidate. „ On the paging channel. 320 (±160) 14 24.

can’t see 80 mile un one nearby outside the neighbor search BTS Ch s tai ns ips B window and cannot be used to establish soft handoff. 2000 RF100 (c) 1998 Scott Baxter V1. 1 mi. l which might deliver occasional This is outside the 65-chip window. Handoff Problems: “Window” Dropped Calls SITUATION 1 „ Calls often drop when strong Locked to distant neighbors suddenly appear A 12 mo site.87 . 1 mi.Tra to a width at least twice the Mobile can’t see BTS B’s pilot. SRCH_WIN_N = 130 BTS BTS A is reference. „ Neighbor Search Window BTS B appears (7-80) chips 7 Chips SRCH_WIN_N should be set early due to its closer distance. February.30 7 . any site and its most distant SITUATION 2 neighbor site Locked to nearby A mo site. vel This is outside the 65-chip window. can’t see „ Remaining Search Window 12 un distant one BTS 80 mile tai SRCH_WIN_R should be set Ch s ns B ips to a width at least twice the SRCH_WIN_N = 130 BTS propagation delay between BTS B is reference. BTS A appears (80-7) chips 7 Chips any site and another site late due to its farther distance. Trave RF into the service area Mobile can’t see BTS A’s pilot. but its propagation delay between strong signal blinds us and the call drops.

but not always possible • a handset can receive BTS/sectors simultaneously only on one frequency • all involved BTS/sectors must connect to a networked BSCs. handoff still can occur but can only be “hard” break-make protocol like AMPS/TDMA/GSM • intersystem handoff: hard • change-of-frequency handoff: hard • CDMA-to-AMPS handoff: hard. and so are unable to do soft-handoff at boundaries between BSCs. 2000 RF100 (c) 1998 Scott Baxter V1.30 7 . Overall Handoff Perspective „ Soft & Softer Handoffs are preferred. no handback – auxiliary trigger mechanisms available (RTD) February.88 . • frame timing must be same on all BTS/sectors „ If any of the above are not possible. Some manufacturers do not presently support this.

2000 RF100 (c) 1998 Scott Baxter V1.89 .30 7 . Section H CDMA CDMA Network Network Architecture Architecture February.

2000 RF100 (c) 1998 Scott Baxter V1. Structure of a Typical Wireless System HLR Home Location Register HLR (subscriber database) SUPPORT FUNCTIONS BASE STATIONS Voice Mail System SWITCH BASE STATION CONTROLLER PSTN Mobile Telephone Local Carriers Switching Office Long Distance ATM Link Carriers to other CDMA Networks (Future) February.90 .30 7 .

91 . Card ACC DISCO 1 CDSU LPP ENET LPP CDSU CDSU Packets DISCO 2 CDSU Σα Txcvr A RFFE A Σβ Chips Txcvr RFFE CDSU DS0 in T1DTCs CDSU Σχ B Txcvr C B RFFE C SBS IOC Vocoders Vocoder Channel RF Selectors Element PSTN February.30 7 . Signal Flow: Two-Stage Metamorphosis MTX BSC-BSM BTS GPS GPS GPSR SLM CM GPSR BSM CDSU CDSU DISCO TFU DMS-BUS TFU1 CDSU Ch. 2000 RF100 (c) 1998 Scott Baxter V1.

30 7 .nortel. 2000 RF100 (c) 1998 Scott Baxter V1.com February.92 . Nortel Nortel CDMA CDMA Network Network Architecture Architecture www.

Card ACC CDSU DISCO 1 CDSU LPP ENET LPP CDSU Σα Txcvr A RFFE A CDSU DISCO 2 CDSU Σβ Txcvr B RFFE B DTCs CDSU Σχ Txcvr C RFFE C SBS IOC Vocoders Selectors PSTN & Billing Other MTXs February.30 7 . 2000 RF100 (c) 1998 Scott Baxter V1.93 . NORTEL CDMA System Architecture MTX BSC-BSM BTS GPS GPS GPSR SLM CM GPSR BSM CDSU CDSU DISCO TFU DMS-BUS TFU1 CDSU Ch.

94 . Pegs Billing PSTN & „ High reliability.T1 CDMA – HLR-VLR access DTCs SBS – Intersystem call delivery (IS-41C) – Inter-MTX handover (IS-41C) IOC • Billing Data Capture Ch MAP. Switch: The Nortel MTX MTX SLM CM DMS-BUS „ Primary functions CDMA • Call Processing BSC LPP ENET LPP Unch. T1 • Calling Features & Services CCS7 VDUs • Collecting System OMs. 2000 RF100 (c) 1998 Scott Baxter V1.30 7 . redundancy Other MTXs February. T1 • Mobility Management Ch.

2000 RF100 (c) 1998 Scott Baxter V1. The Nortel BSC BSC GPS GPSR BSM CDSU TFU1 CDSU MTX BTSs LPP CDSU DISCO 1 CDSU CDSU DISCO 2 CDSU „ Primary functions CDSU • vocoding CDSU • soft handoff management MTX SBS • FER-based power control (voice Vocoders trunks) Selectors • routing of all traffic and control packets „ Scaleable architecture • expand SBS to keep pace with T1 channelized (24 DS0) traffic growth T1 unchannelized • expandable DISCO BCN link (HDLC) February.95 .30 7 .

2.: indoor A A Σβ Txcvr RFFE • 1900 MHz. or 3 sectors Σα Txcvr RFFE • 800 MHz.Std.96 . & 1900 MHz. radiate. B B remotable RFFEs Σχ Txcvr C RFFE C • new 1900 MHz.30 7 . 800 MHz. The Nortel BTS „ Base Transceiver Station „ Primary function: Air link • generate. 8 GPS GPSR • high-efficiency T1 backhaul • test capabilities CDSU DISCO TFU BSC „ Configurations Ch. indoor.: self-contained outdoor. Card ACC • 1. receive CDMA RF BTS signal IS-95/J. 2000 RF100 (c) 1998 Scott Baxter V1. multi-carrier options February.

2000 RF100 (c) 1998 Scott Baxter V1. BTS configuration and GNP TELCO parameters WORKSERVER • Fault management SHELF --------- HIGH AVAILABILITY BSM Workstation – Alarm Reporting BCN Links • Performance management GPS BSC BTS GPS – interface for CDMA statistics GPSR GPSR CDSU CDSU DISCO TFU and peg counts collection TFU1 CDSU DISCO 1 CDSU CDSU Ch.97 . The Nortel BSM NORTEL CDMA BSM BSM „ Base Station Manager Ethernet LAN „ Primary functions: OA&M for CDMA components • Configuration management X-Windows terminals – BSC. Card ACC • Security management CDSU Σα Txcvr RFFE CDSU DISCO 2 CDSU Σβ A Txcvr B A RFFE B • Unix-based CDSU Σχ Txcvr C RFFE C SBS Vocoders Selectors February.30 7 .

600 DMS-BUS TFU1 CDSU traffic of all sectors: erlangs one CE per link. Each BSC-BSM One T-1 can carry all traffic originated by a BTS Typical CM processor one-carrier BTS. special capacity considerations BTS uses 1. Ctrl. consideration required if GPS SBS shelf 1. Summary of CDMA Capacity Considerations DISCO has MTX 192 ports GPS max.30 7 .98 . PSTN PSTN trunk groups must be dimensioned to support erlang load. required in BSC SBS. use mobile power cards per shelf. One pair SLM CM BSM GPSR 4. LPP CIU 1. 12 rise. daisy-chaining CDMA LPP: GPSR Link 2. one per Reverse RF Capacity: simultaneous call on the system. February. 20 Ch. 2000 RF100 (c) 1998 Scott Baxter V1. links cause noise floor 8 Vocoders per SBS card. 4 shelves per SBS cabinet. Card ACC CE per Channel Card CDSU DISCO 1 CDSU LPP ENET LPP CDSU Σα64 Walsh Txcvr A RFFE Codes/sector A CDSU DISCO 2 CDSU Σβ64 Walsh Txcvr B RFFE Codes/sector B DTCs CDSU Σχ64 Walsh Txcvr C Codes/sector RFFE C DTC & ENET: SBS Forward RF Capacity: One port per IOC links use available Vocoders BTS TX power Vocoder plus one port per Selectors Sufficient vocoders/selectors outgoing trunk. CIUs and BSM One pair CDSU CDSU DISCO TFU Sufficient channel CAUs per elements required for approx. 2.

Lucent Lucent CDMA CDMA Network Network Architecture Architecture www.99 .30 7 . 2000 RF100 (c) 1998 Scott Baxter V1.com February.lucent.

2000 RF100 (c) 1998 Scott Baxter V1. Lucent CDMA System Architecture PSTN & Other MTXs ECP 5ESS-2000 DCS BTS Circuit Switch Executive Cellular Platform Processor Complex (ECPC) Channel ACU CDMA Speech Unit Handling Equipment Cluster Σ Baseband α Combiner & Radio Σβ Baseband Combiner & Radio Packet Switch Σχ Baseband Combiner & Radio Platform February.100 .30 7 .

2000 RF100 (c) 1998 Scott Baxter V1. redundancy February. The Lucent ECP „ Executive Cellular Processor „ Primary functions ECP • Call Processing • Mobility Management Executive Cellular – HLR-VLR access Processor Complex – Intersystem call delivery (IS-41C) (ECPC) – Inter-MTX handover (IS-41C) • Billing Data Capture • Calling Features & Services • Collecting System OMs.30 7 . Pegs „ High reliability.101 .

30 7 . 2000 RF100 (c) 1998 Scott Baxter V1. The Lucent #5ESS and Access Manager PSTN & Other MTXs „ Primary functions 5ESS-2000 DCS • vocoding • soft handoff management Circuit Switch Platform • FER-based power control • routing of all traffic and control packets CDMA Speech „ Scaleable architecture Handling Equipment • expand speech handlers • expandable packet switch Packet Switch Platform February.102 .

103 . receive CDMA RF signal IS-95/J. 8 • high-efficiency T1 backhaul • test capabilities BTS Channel ACU Unit Cluster Σ Baseband α Combiner & Radio Σβ Baseband Combiner & Radio Σχ Baseband Combiner & Radio February. radiate.30 7 . The Lucent BTS „ Primary function: Air link • generate.Std. 2000 RF100 (c) 1998 Scott Baxter V1.

Motorola
Motorola CDMA
CDMA Network
Network
Architecture
Architecture

www.motorola.com

February, 2000 RF100 (c) 1998 Scott Baxter V1.30 7 - 104

Motorola CDMA System Architecture
OMC-R BTS (SC614T/611)
OMC-R Motorola
PCSC Processor Advanced
Personal Wideband
Communications Application Interface
Switching Processor (MAWI)
Center (or SC-UNO)

CBSC BTS (SC9600/4800/2400)

Group Line
DSC Mobility Manager
EMX-2500 Interface (GLI)
PSTN or
EMX-5000
Multichannel
Transcoder
CDMA Card (MCC)

PC
Local
Maintenance
Facility

February, 2000 RF100 (c) 1998 Scott Baxter V1.30 7 - 105

The Motorola PCSC

„ Personal Communications Switching Center
EMX-2500 „ Primary functions
• Call Processing
• HLR-VLR access
• Intersystem call delivery (IS-41C)
• Billing Data Capture
• Calling Features & Services
EMX-5000

DSC
EMX-2500
PSTN or
EMX-5000

February, 2000 RF100 (c) 1998 Scott Baxter V1.30 7 - 106

30 7 . 2000 RF100 (c) 1998 Scott Baxter V1.107 . The Motorola CBSC „ Centralized Base Station Controller „ Mobility Manager • allocation of BTS resources • handoff management • Call management & supervision „ Transcoder • vocoding CBSC • soft handoff management Mobility Manager • FER-based power control • routing of all traffic and control packets Transcoder February.

The Motorola BTS Family BTS (SC614T/611) „ Primary function: Air link Motorola • generate. receive Advanced CDMA RF signal IS- Wideband 95/J.Std.30 7 . 8 Interface • high-efficiency T1 (MAWI) backhaul • test capabilities BTS (SC9600/4800/2400) SC611 Microcell Group Line Interface (GLI) Multichannel CDMA Card (MCC) PC Local Maintenance Facility SC614T SC4852 February. radiate.108 . 2000 RF100 (c) 1998 Scott Baxter V1.

2000 RF100 (c) 1998 Scott Baxter V1. Section I Introduction Introduction to to Optimization Optimization February.30 7 .109 .

30 7 .110 . even if not directly involved in performance optimization February. 2000 RF100 (c) 1998 Scott Baxter V1. Introduction to Optimization „ Course RF200 provides detailed information on CDMA system performance optimization. The following slides provide a general perspective on optimization and are intended for everyone with technical responsibilities. RF200 presents: • Performance Indicators and Problem Signatures analysis • Review of tools and stats available on the system • Review of mobile tools and how to interpret test drive data • How to analyze drive-test data with post-processing tools • Real-life examples of problems for “hands-on” analysis „ Optimization is important enough that everyone should understand what it is and how it is usually performed. and is intended for all personnel who are responsible for improving system performance.

neighbor lists.30 7 . and customer complaints – reducing dropped calls. consistent with acceptable levels of dropped calls and access failures February. drive tests. and cell configuration to ensure that blatant errors are eliminated and normal operation is achieved as verified in drive tests • Minimization of Operating Problems on Existing Systems – identifying problems from system statistics.111 . 2000 RF100 (c) 1998 Scott Baxter V1. trouble spots • Capacity Enhancement – watching system capacity indicators and optimizing adjustable parameters to achieve the best possible capacity. access failures. System Performance Optimization „ The term “System Performance Optimization” really includes three distinct types of activities: • Optimization of a New System or New Cells – examining parameters.

Department Store Analogy: Tops-Down. 2000 RF100 (c) 1998 Scott Baxter V1.112 . Bottoms-Up Dis ce TaLosses Management trib utio ur an ervice Test Shopper s S ion s n In ect Sel xe Profits Capital Lea sts Complex!!! s es Simpler Co i sing Purchasing S Con ven vert r Relatio ns up pli Price ienc Ad Labo ers e System r ence Phone tw are Administration r fe S of Inte Calls d Provisioning Trans- ro ppe mission D Switch CBSC Complex!!! Simpler Data C Cov PSTN TrunkingData apture erag Analys Acces is s Failur e Neighbor Lists Configuration BTS es Field Tools Some things are easier to measure from the customer side! February.30 7 .

2000 RF100 (c) 1998 Scott Baxter V1.75 Aeronautical Investigations Flight Data Recorder Cockpit Voice Recorder CDMA Investigations BTS Temporal Analyzer Data Layer 3 Message Files To study the cause of an aeronautical accident. we try to recover the Flight Data Recorder and the Cockpit Voice Recorder.113 .50 118. we review data from the Temporal Analyzer and the Layer 3 Message Files -.25 11500 11500 125.Aeronautical Analogy: Tools for Problem Investigation Control & Parameters Messaging 114. February.for the same reasons. To study the cause of a CDMA call processing accident.30 7 .

avoiding gross spillover into other sectors • tools: PN Plots. Handoff State Plots. has major impact on pilot search speed „ Neighbor List Tuning • try to groom each sector’s neighbors to only those necessary but be alert to special needs due to topography and traffic • tools: diagnostic data. _N. _R • especially optimize SRCH_WIN_A per sector using collected finger separation data. February.114 . Dropped Call Analysis • finally. iterative corrections until within numerical goals Getting these items into shape provides a solid baseline and foundation from which future performance issues can be addressed. 2000 RF100 (c) 1998 Scott Baxter V1.30 7 . system logs „ Access Failures. Starting Optimization on a New System „ RF Coverage Control • try to contain each sector’s coverage. Mobile TX plots „ Search Window Settings • find best settings for SRCH_WIN_A.

frequency plan problems „ CDMA impairments have one audible symptom: Dropped Call • voice quality remains excellent with perhaps just a hint of garbling even as the call approaches dropping in a hostile RF environment „ Successful CDMA Optimization requires: • recognition and understanding of common reasons for call failure • capture of RF and digital parameters of the call prior to drop • analysis of call flow. where. Solving Problems on Existing Systems „ CDMA optimization is very different from optimization in analog technologies such as AMPS „ AMPS: a skilled engineer with a handset or simple equipment can hear. external interferences • dragged handoffs. and why February. 2000 RF100 (c) 1998 Scott Baxter V1.115 . checking messages on both forward and reverse links to establish “what happened”. diagnose.30 7 . and correct many common problems • co-channel. adjacent channel.

use it!” „ Software Bugs. nor the CDMA standard is perfect. Protocol Violations • Neither system software. <2% „ Forward Link Interference • typical objective: eliminate situations which prevent handoff! „ Slow Handoff • typical objective: eliminate situations which delay handoff! „ Handoff Pilot Search Window Issues • avoid handoff drops! „ Excessive Soft Handoff • control coverage. to manage soft handoff levels (~<50%) „ Grooming Neighbor Lists • “if you need it. CDMA Problems Attacked in Optimization „ Excessive Access Failures • typical objectives: <2% (IS-95B will bring improvements) „ Excessive Dropped Calls • typical objective: ~1%. Don’t humbly accept problems -.116 . not T_Add/T_Drop. 2000 RF100 (c) 1998 Scott Baxter V1. nor mobile software.30 7 .dig in and find out what’s happening! February.

117 . Sources of CDMA Data and Tools for Processing CDMA NETWORK EQUIPMENT HANDSET Switch CBSC BTS SLM CM GPSR IS-95/J-STD-8 GPSR Messages BSM CDSU CDSU DISCO TFU1 TFU1 Switch Data DMS-BUS DISCO 1 CDSU Ch. Card ACC CDSU CDSU pegs. 2000 RF100 (c) 1998 Scott Baxter V1. Various PC-based PC-based External Data Analysis Mobile Data Analysis Post-Processing Post-Processing Tools Tools Tools „ CDMA optimization data flows from three places: • Switch • CDMA peripherals (CBSC & BTS) • Handset „ Each stream of data has a family of software and hardware tools for collection and analysis February.30 7 . LPP ENETlogs LPP CDSU System DISCO 2 Σα Txcvr A Internal Messages CDSU RFFE A DTCs CDSU Σβ Txcvr B RFFE B Handset SBS CDSU Σχ Txcvr C RFFE C Vocoders Messages PC-based IOC Selectors Mobile Data Capture Tools IS-95/J-STD-008 Messages Unix-based.

and maps • store data in formats readable for post-processing analysis • small and portable. convenience. 2000 RF100 (c) 1998 Scott Baxter V1. availability. features. SAFCO Packard Grayson Comarco LCC Qualcomm „ There are many commercial CDMA field test tools „ Characteristics of many test tools: • capture data from data ports on commercial handsets • log data onto PCs using proprietary software • can display call parameters. easy to use in vehicles or even on foot „ A few considerations when selecting test tools: • does it allow integration of network and mobile data? • Cost. CDMA Field Test Tools Field Collection Tools using Handset Data PN Scanners Motorola Qualcomm Hewlett. graphs. and support • new tools are introduced every few months .118 . messaging.investigate! February.30 7 . Berkeley Packard Varitronics Grayson Hewlett.

2000 RF100 (c) 1998 Scott Baxter V1.30 7 .119 . Qualcomm’s MDM: Mobile Diagnostic Monitor „ Qualcomm’s Mobile Diagnostic Monitor • CDMA handset (customer provided) • Proprietary connecting cable • PC software for collection and field pre- analysis – Temporal analyzer display mode – Messaging February.

and other devices „ Inspector32 PC collection software • numerous output formats & exporting - ASCII messages. graphs. performance indicators as map icons. 2000 RF100 (c) 1998 Scott Baxter V1. database. map location. parameters. messaging. handsets. Grayson Electronics Mobile Collection Tools „ Wireless Measurement Instrument • one hardware platform. scanners.120 . and spreadsheet tables • message display window synched with maps and graphs • can search for events. temporal data • simultaneous display of parameters. PN scanner „ AnalyzerTM post-processing software • call event statistics. messages • can study multiple drive files at once February.30 7 . can contain up to 4 receivers.

LCC.30 7 .121 . SAFCO and Comarco Mobile Tools „ LCC: • RSAT2000 mobile collection LCC • Collect2000 PC collection software • DeskCAT post-processing Software „ SAFCO (no photo available) • Mobile PC collection tool • Portable pen-based PC tool • OPAS post-analysis software „ COMARCO: Comarco • NES-series units / PC collection • File formats for post-processing • latest models include L3 messaging February. 2000 RF100 (c) 1998 Scott Baxter V1.

T_Drop. „ Grayson Wireless (BTS-referenced) • scan speed 6.2 sec. • integrated with phone & call-processing data collection tool • a high-end version is also available using Berkeley Scanner (GPS-locked) February. • 2048 parallel processors for very fast detection of transient interferors „ Hewlett-Packard (GPS-referenced) • full-PN scan speed 1.3 sec. etc. 2000 RF100 (c) 1998 Scott Baxter V1.122 .30 7 . PN Scanners „ PN Scanners are faster than phones and more reliable finding rogue pilots „ Berkeley Varitronics (GPS-referenced) • full-PN scan speed 26-2/3 ms. • Integrated with spectrum analyzer and phone call-processing tool „ Qualcomm (BTS-referenced) • lowest-cost solution • also acts as test phone with user-set T_Add.

2000 RF100 (c) 1998 Scott Baxter V1.30 7 . Agilent Drive-Test Tools „ Agilent offers Drive-Test tools • Serial interfaces for up to four CDMA phones • A very flexible digital receiver with several modes „ PN Scanner • Fast.123 . Bands „ Base-Station Over-Air Tester (BOAT) • Can display all walsh channel activity on a specific sector • Useful for identifying hardware problems. etc. monitoring instantaneous traffic levels. can scan two carrier frequencies „ Spectrum Analyzer • Can scan entire 800 or 1900 mHz. „ Post-Processing tool: OPAS32 February. GPS-locked.

2000 RF100 (c) 1998 Scott Baxter V1.Faster. Illuminator. and Invex3G „ Agilent OPAS32 • Imports/analyzes a variety of data „ Nortel RF Optimizer • Can merge/analyze drive-test and Nortel CDMA system data „ Wavelink „ Verizon/Airtouch internal tool OPAS32 February. Post-Processing Tools Post-Processing tools display drive-test files for detailed analysis . more effective than studying data playback with collection tools alone „ Actix Analyzer • Imports/analyzes data from almost every brand of drive-test collection tool „ Grayson Interpreter • Imports/analyzes data from Grayson Wireless Inspector.30 7 .124 .

2000 RF100 (c) 1998 Scott Baxter V1. Handset Mode. Received RF Level .Handsets as Tools: Simple but always Available! „ Most CDMA handsets provide some form of maintenance display (“Debug Mode”) as well as instrumentation access • all CDMA drive-test tools use handsets as their “front-ends” Using the handset as a manual tool without Commercial Test Tools: „ Enter the maintenance mode by special sequence of keystrokes „ Displayed Parameters • PN Offset. forward link interference. etc.125 . serving PN offset not updated during voice calls February.) „ Handset Limitations during manual observation • no memory: real-time observations only. no access to messages or call details.30 7 . Transmit Gain Adjust „ Maintenance Display Applications • best serving cell/sector • simple call debugging (symptoms of weak RF.

126 .30 7 . if different) display values February. 2000 RF100 (c) 1998 Scott Baxter V1. Older Qualcomm/Sony Maintenance Displays Press This: See This: continue: See This: Menu D D MAIN MENU È DEBUG 0È 1:Volume 1:Screen 2:Call Info 2:Test Calls 3:Security 3:CDMA Only 4 * D D DEBUG 0È FEATURES 4È 4:Errors 1:AutoAnswer 5:Clr Errors 2:AutoRetry 6:13K Voice 3:ScratcAgilentad 1 0 D D 318 2 9D X A 7F ENTER FIELD SERVICE CODE ****** See following 0 0 0 0 0 0 * legend for maintenance (* or correct code.

press „ enter Field Debug Security Code „ press Screen February.127 .30 7 . Qualcomm & Sony Phones with Jog Dials „ Enter 111111 „ Press dial in for OPTIONS „ Dial to FIELD DEBUG. 2000 RF100 (c) 1998 Scott Baxter V1.

TXADJdb (800 MHz) 28 -20 TXdbm= -76 -RXDBM .30 7 .Pilot Channel Acquisition Substate 1 . use XX = XXDEC-256) 00 0 Transmit Gain Adjust Conversion: 0A -5 TXADJdb=XXDEC / 2 14 -10 Transmit Power Output Conversion: 1E -15 TXdbm= -73 -RXDBM .TXADJdb (1900 MHz) February.66. 2000 RF100 (c) 1998 Scott Baxter V1. Interpreting the QCP Maintenance Display 0 .25 (1900 MHz) X = exit reason 80 -109 (if XX>7F.MS Idle State QCP.128 .Traffic Channel State FF -67 -64 Receive State F5 -70 -67 E6 -75 -72 D D7 -80 -77 C8 -85 -82 B9 -90 -87 PN Offset 318 2 94 Receive Power AA -95 -92 9B -100 -97 X A 7F 8C -105 -102 80 -109 -106 Unsupported Transmit Adjust Receive Power Conversion: RXdbm=XXDEC / 3 .63.System Access State 1900 800 4 .25 (800 MHz) A = active pilots 80 -109 RXdbm=XXDEC / 3 .QCP- 3 .Sync Channel Acquisition Substate 2 .

Kyocera 2035 Maintenance Mode Steps to enter maintenance mode: „ 111111 „ Enter „ Options: Debug „ Enter „ Enter Field Debug Code • 000000 „ Field Debug „ Debug Screen „ Enter „ Basic „ Enter February. 2000 RF100 (c) 1998 Scott Baxter V1.30 7 .129 .

Kyocera 6035 Maintenance Mode „ 111111 „ Jog > Options „ Jog > Debug „ Open flip to continue „ Enter Code • 000000 „ OK „ SCREEN February.130 .30 7 . 2000 RF100 (c) 1998 Scott Baxter V1.

2000 RF100 (c) 1998 Scott Baxter V1.131 . Early Samsung Maintenance Display Press This: See This: continue: See This: SVC SVC Menu Main Menu ↑È Debug Menu ↑È 1:Call Logs 1:Screen 2:Phone Book 2:Test Calls 8 * SVC SVC Debug Menu ↑È Setup ↑È 3:Errors 1:Auto Retry 4:Erase Error 2:Anykey Ans 1 0 SVC SVC S04379 SI0 1 Service Code T-63 D105-06 ?????? P016 CH0600 See following 0 0 0 0 0 0 * legend for maintenance (* or correct code.30 7 . if different) display values February.

30 7 .132 . Samsung SCH-3500 Maintenance Display Here are the steps to enter maintenance mode: „ MENU „ SETUP „ 0 (undocumented “trap door”) „ 000000 (operator’s code) „ Screen February. 2000 RF100 (c) 1998 Scott Baxter V1.

Traffic Channel State Network Identifier (NID) 5.TXADJdb (1900 MHz) February. db (primary PN only) db P016 CH0600 Frequency PN Offset (channel #) Transmit Power Output Calculation: TXdbm= -73 -RXDBM .6.System Access State System Identifier (SID) 4 . Idle. S04379 SI0 1 dbm Transmit Gain Adjust.TXADJdb (800 MHz) TXdbm= -76 -RXDBM .MS Idle State Slot Cycle Index 3 .various call service options Processing State Receive svc Power.Pilot Channel Acquisition Substate 1 . Interpreting Samsung Maintenance Display: Acquisition. and Access States 0 .133 .30 7 .Sync Channel Acquisition Substate Display toggles between: 2 . T-63 D085-06 Ec/Io. 2000 RF100 (c) 1998 Scott Baxter V1.7 .

MS Idle State Vocoder Rate Vocoder code 3 . 2000 RF100 (c) 1998 Scott Baxter V1.Traffic Channel State 5.6.various call service options 2 = 1/4 Processing State 4 = 1/2 svc Receive 8 = Full Power. db db P016 CH0600 (primary PN only) Frequency PN Offset (channel #) Transmit Power Output Calculation: TXdbm= -73 -RXDBM .TXADJdb (1900 MHz) February.Pilot Channel Acquisition Substate 1 .7 . Transmit TV1 RV8 08 7 dbm Gain Adjust. T-63 D085-06 Ec/Io.System Access State 1 = 1/8 Rate assigned 4 .134 .30 7 .TXADJdb (800 MHz) TXdbm= -76 -RXDBM .Sync Channel Acquisition Substate Transmit Receive Walsh 2 . Interpreting Samsung Maintenance Display: Traffic Channel State 0 .

LG: -086:45:36 EC: -16 -63 -63 dial the digits and press OK PN: 084 084 084 while in idle mode FNGLK: Y Y N WLSH: 01 01 01 ACT: 084 484 096 -01 -01 200 CND: 220 332 200 200 332 NGH: 076 080 340 068 196 O56 320 220 316 344 488 196 200 392 124 128 084 224 008 084 February. Entering Denso Debug Mode D „ Enter ##DEBUG (##33284) CBV: 3957 ABU: 3954 ABT: 031 „ Scroll down to SAVE ARF: 0000 CCL: 01 SID: 04157 „ Press OK NID: 00001 CH: 0100 RSSI: 093 „ Highlight SERVICE SCREEN DPN: 084 TX:-46 „ Press OK BFRM:0000000968 TFRM:0000135712 FER:% 000.30 7 .71 LT: 036:06:36 „ If you want to make a test call.135 . 2000 RF100 (c) 1998 Scott Baxter V1.

71 Frame Erasure Rate. 2000 RF100 (c) 1998 Scott Baxter V1.136 . Denso Maintenance Display Charging Battery Voltage D Average Battery Voltage CBV: 3957 Average Battery Temperature ABV: 3954 ABT: 031 System ID ARF: 0000 CCL: 01 SID: 04157 Network ID NID: 00001 Received Signal Strength RF Channel Frequency CH: 0100 RSSI: 093 DPN: 084 TX:-46 Estimated Transmitter Digital PN Offset Power Output BFRM:0000000968 Number of Bad Frames TFRM:0000135712 Number of Good Frames FER:% 000. Percent Base Station coordinates LT: 036:06:36 LG: -086:45:36 EC: -16 -63 -63 Current status of Rake Fingers PN: 084 084 084 FNGLK: Y Y N WLSH: 01 01 01 Active Pilot Set ACT: 084 484 096 -01 -01 200 Candidate Pilot Set CND: 220 332 200 200 332 NGH: 076 Neighbor Pilot Set 080 340 068 196 O56 320 220 316 344 488 196 200 392 124 128 084 224 008 084 February.30 7 .

2000 RF100 (c) 1998 Scott Baxter V1.137 .30 7 . Early Sanyo Dual-Band Phones Press This: „ press menu 7. 0 Menu „ enter in DEBUGM (332846) „ screens are similar to QCP phones 7 D 0 318 2 94 X A 7F 3 3 2 8 4 6 February.

2000 RF100 (c) 1998 Scott Baxter V1. Sanyo SPC-4500 Maintenance Display „ Choose the following: „ DISPLAY „ OK „ 0 „ OK „ Enter Code: 0 0 0 0 0 0 „ Debug Menu „ SCREEN „ OK February.30 7 .138 .

• Step 1 will appear with its current setting displayed. „ Power off and back on.30 7 . Press * to accept and move on to the next step. enter it and press STO. • New prompts will appear. Repeat for steps 2-8. „ Press 55#. Enter 1 0 0 0 0 0 0 0 (The leftmost bit now set to '1' is what enables test mode. „ You should now be in test mode! February. 2000 RF100 (c) 1998 Scott Baxter V1. Don’t delay . „ Step 9 (Option byte 2) is the only step requiring manual changes. Press STO in response to each prompt until no more appear. Then enter the following: „ FCN 000000 000000 0 RCL You'll be prompted for your MSL.) „ Now press STO to accept the entry and exit back to the ' prompt.continue quickly and enter: „ FCN 0 0 * * T E S T M O D E STO • The display will briefly show US then just '. Entering Maintenance Mode: Motorola Contact your service provider to obtain your phone’s Master Subscriber entity Lock (MSL).139 .

# Neighbors Current RF Channel WO L3 WFO State Timeout MP Max Probe Failure Strongest Active 3 7 2 0 6 5 3 1 2 4 5 0 PC Paging Channel Loss RR Reorder or Rel on PCH Strongest Neighbor 1 6 8 1 8 5 1 C O N B R ?? Unknown Condition Current RSSI 0 8 2 .140 . 2000 RF100 (c) 1998 Scott Baxter V1. Last Call Indicator NI No Indication Motorola Maintenance Display MR BR Mobile Release Base Release TC Traffic Channel Lost L2 Layer 2 Ack Fail NC No Channel Asn Msg # Active N5 N5M failure BS BS Ack Failure PN Ec/Io # Cand.30 7 . 0 4 0 0 1 2 7 0 1 Dropped Call Counter 8 E V 4 1 8 3 0 0 3 1 2 6 Call Counter Current SID Call Processing State Current Service Option Current NID CP CP Exit 8V 8K voice Current TX dbm Current FER RST CP Restart 8L 8K Loopback RTC Restricted 8EV EVRC PLT Pilot Acquire 8S 8K SMS SYN Synch Acquire 13L 13K Loopback TIM Timing 13S 13K SMS BKS Background Search 8MO 8K Markov Old IDL Idle DAT Data OVD Overhead 8M 8K Markov PAG Paging 13M 13K Markov ORG Call Origination 13v 13K Voice SMS SMS N/A Null ORD Order Response REG Registration TCI Traffic Channel Init WFO Waiting for Order WFA Waiting for Answer CON Conversation REL Release NON No State February.

there are still many NeoPoint handsets in general use „ Press the M (menu) key „ Select Preferences (using the up-arrow key) „ Enter 040793 „ Choose Debug Screen [Select] „ Now you’re in maintenance mode! February. NeoPoint Phones „ Although NeoPoint went out of business in June.141 . 2000 RF100 (c) 1998 Scott Baxter V1. 2001.30 7 .

2000 RF100 (c) 1998 Scott Baxter V1. just key in: # # D E B U G SAVE February.30 7 .142 . GoldStar TouchPoint „ To enter maintenance mode.

143 . 2000 RF100 (c) 1998 Scott Baxter V1.30 7 . Nokia 6185 Maintenance Display „ Enter *3001#12345# MENU „ Scroll down to Field test „ Press Select „ Scroll up to Enabled „ Press OK „ Power the phone off and on „ You should now be in Field test mode February.

2000 RF100 (c) 1998 Scott Baxter V1. Older Nokia Models Maintenance Display „ Enter *3001#12345# MENU „ Scroll down to Field test „ Press Select „ Scroll up to Enabled „ Press OK „ Power the phone off and on „ You should now be in Field test mode and the following screens will be available: February.30 7 .144 .

2=B. FER PPCB Primary Channel B RSSI RSSI dBm SPCB Secondary Channel B CCCC Paging Channel # L Local Use RX RX power. Maintenance Display Screens of Nokia Handsets The following screens appear in field test mode on Nokia HD881 series of Handsets: Screen 1: General Screen 5: NAM Info CSST CS State PPCA Primary Channel A Idle: PN Offset SPCA Secondary Channel A XXXXX TFC: #Actv. Level BASE# BASE_ID (sys par msg) Screen 4: NAM Info P_REV P_REV (sync msg) OwnNumber Mobile MIN MIN_P_REV MIN_P_REV (sync msg. ESN Mobile Station ESN Screen 8: Time Information Preferred Sys CSST CS State P 1=AMPS.30 7 .145 . dbm A Access Overload Class TX TX power. 2000 RF100 (c) 1998 Scott Baxter V1. 2=CDMA MMDDYY Date from System Time Operator Selected HHMMSS System Time A (1=A. Screen 2: Paging CH Info SID Current SID CSST CS State NID Current NID PGCH Paging Channel # DBUS DBUS (Handsfree?) CURSO Current Service Option FER Frame Error Rate Screen 7: BS Protocol Rev. 3=both February. Info. dbm Screen 6: BS & Access.

Nokia Maintenance Display Screens (continued)

Screen 9: Acquisition Information Screen 11: Active Set (#4-6)
TA TADD PPN Pilot PN Offset
TD TDROP EC Ec/Io in 1/2 db units
TC TCOMP K Keep? 1
TT TTDROP PPN Pilot PN Offset
WW1 Active Window EC Ec/Io in 1/2 db units
WW2 Neighbor Window K Keep? 1
WW3 Remaining Window PPN Pilot PN Offset
EC Ec/Io in 1/2 db units
Screen 10: Active Set (#1-3) K Keep? 1
PPN Pilot PN Offset
EC Ec/Io in 1/2 db units
K Keep? 1
PPN Pilot PN Offset
EC Ec/Io in 1/2 db units
K Keep? 1
PPN Pilot PN Offset
EC Ec/Io in 1/2 db units
K Keep? 1

February, 2000 RF100 (c) 1998 Scott Baxter V1.30 7 - 146

Nokia Maintenance Display Screens (continued)
Screen 12: Neighbor Set (#1-5) Screen 14: Neighbor Set (#11-15)
PPN NBR 1 PN Offset PPN NBR 11 PN Offset
EC Ec/Io in 1/2 db units EC Ec/Io in 1/2 db units
PPN NBR 2 PN Offset PPN NBR 12 PN Offset
EC Ec/Io in 1/2 db units EC Ec/Io in 1/2 db units
PPN NBR 3 PN Offset PPN NBR 13 PN Offset
EC Ec/Io in 1/2 db units EC Ec/Io in 1/2 db units
PPN NBR 4 PN Offset PPN NBR 14 PN Offset
EC Ec/Io in 1/2 db units EC Ec/Io in 1/2 db units
PPN NBR 5 PN Offset PPN NBR 15 PN Offset
EC Ec/Io in 1/2 db units EC Ec/Io in 1/2 db units

Screen 13: Neighbor Set (#6-10) Screen 15: Neighbor Set (#16-20)
PPN NBR 6 PN Offset PPN NBR 16 PN Offset
EC Ec/Io in 1/2 db units EC Ec/Io in 1/2 db units
PPN NBR 7 PN Offset PPN NBR 17 PN Offset
EC Ec/Io in 1/2 db units EC Ec/Io in 1/2 db units
PPN NBR 8 PN Offset PPN NBR 18 PN Offset
EC Ec/Io in 1/2 db units EC Ec/Io in 1/2 db units
PPN NBR 9 PN Offset PPN NBR 19 PN Offset
EC Ec/Io in 1/2 db units EC Ec/Io in 1/2 db units
PPN NBR 10 PN Offset PPN NBR 20 PN Offset
EC Ec/Io in 1/2 db units EC Ec/Io in 1/2 db units

February, 2000 RF100 (c) 1998 Scott Baxter V1.30 7 - 147

Nokia Maintenance Display Screens (continued)
Screen 16: Candidate Set (#1-5)
PPN CAND 1 PN Offset
EC Ec/Io in 1/2 db units
PPN CAND 2 PN Offset
EC Ec/Io in 1/2 db units
PPN CAND 3 PN Offset
EC Ec/Io in 1/2 db units
PPN CAND 4 PN Offset
EC Ec/Io in 1/2 db units
PPN CAND 5 PN Offset
EC Ec/Io in 1/2 db units

Screen 17-22: Task Stack Ck Info
TASKN Task Name
FREE Worst-Cs Stack Free Sp

Screen 23: Stack Status Info.
Task Stack Overflow ind. by shift
Sys Stack 2=sys stack overflow

Screen 24: Codec Registers

February, 2000 RF100 (c) 1998 Scott Baxter V1.30 7 - 148

cell design. 35 chapters. Yang. 008 as well as W- CDMA. "Spread Spectrum Communications Handbook" by Simon. Bibliography “Wireless Communications Principles & Practice” by Theodore S. Gibson. "CDMA: Principles of Spread Spectrum Communication" by Andrew J. $65. “The Mobile Communications Handbook” edited by Jerry D. not very relevant to operations. Excellent treatment of CDMA basics and deeper theory. 10 chapters. 1227 pp. vocoding. 7 appendices. ISBN 0-13-572157-1 $65. 2000 RF100 (c) 1998 Scott Baxter V1. and practical details of CDMA signaling. Includes enough math for understanding and solving real problems. You can design CDMA chipsets after reading it. 1998 Artech House. voice applications. Excellent treatment of IS-95/JStd. February..30 7 . $89 If you can buy only two books. Heavy theory. system performance optimization and capacity issues. “CDMA Systems Engineering Handbook” by Jhong Sam Lee and Leonard E. noise. Comprehensive summary of wireless technologies along with principles of real systems. radio engineering. ISBN 0-8493-0573-3. Lee. ISBN 0-13-375536-3. Rappaport. $99. Edition by William C. McGraw- Hill # 057629-7. Highly recommended. Highly recommended. 360 pp. forward error correction. 689 pp. RF propagation. ISBN 0-89006-991-3. Miller. cell and system design principles. excellent full-detailed expositions of every single wireless technology known today. Addison-Wesley 1995. Omura. 641 pp. If you can only buy one book. Prentice Hall.50 Definitive technical reference on principles of Spread Spectrum including direct sequence as used in commercial IS-95/JStd008 CDMA. Good coverage of system design principles. and well-edited for readability. very complete and well done. More than just theoretical text. but beware lots of triple integrals.. CRC Press/ IEEE Press 1996. ISBN 0-201-63374-4. Each chapter is written by an expert. Prentice-Hall PTR.. digital processing theory.. "Mobile Communications Engineering" 2nd. Good CDMA treatment. and Levitt. “Applications of CDMA in Wireless/Personal Communications” by Garg. “CDMA RF System Engineering” by Samuel C. 1998 Artech House. Scholtz. 245 p. Definitive very deep CDMA Theory. Clear-language explanations for both engineers and technicians but also includes detailed mathematics for the research-inclined. Viterbi. Prestige collector’s item among CDMA faithful. buy this second. Solid foundation of modulation schemes. 577 pp. ISBN 0- 89006-990-5. Y. 1996. ISBN 0-07-037103-2 Lee’s latest/greatest reference work on all of wireless.149 . and data applications. buy this one. 1997. traffic engineering.. 15 illus. Good general treatment of CDMA capacity considerations from mathematical viewpoint. McGraw Hill 1998 $65. includes chapters on IS-41 networking. Smolik & Wilkes.

McGraw-Hill #0065342-9. If you haven’t had much hands-on experience with real RF hardware. February.30 7 . $55 Introduction to major PCS technical standards. or haven’t had a chance to see how the theory you learned in school fits with modern-day communications equipment.95. Covers applicable technologies from HF to high microwaves. this book will make dealing with hardware more comfortable. useful exposure to nuts-and-bolts practical ideas for the RF-unfamiliar. Frenzel. 75 illus. but without quite as much authoritative math or deep theoretical insights. $74 ISBN# 0-13-211939-0 Excellent in depth treatment of modulation schemes. noise. "Wireless Personal Communications Services" by Rajan Kuruppillai. All the basic principles of transmission and their underlying math. $65 Good authoritative reference on Wireless. 1988. list price $54. LAN/WAN "Communication Electronics" by Louis E. Even includes some spread- spectrum information in case you’re inclined to play and experiment at home. 350 pp. this is valuable exposure to real-world issues. If you didn’t take signals & systems in school. Bibliography (concluded) “Wireless and Personal Communications Systems” by Garg.. this is your coach in the closet. Sonet. “Digital Communications: Fundamentals and Applications” by Bernard Sklar. Still contains solid theory and discussion of practical network architecture. basic antennas and transmission lines. Fax. ATM. Glencoe/MacMillan McGraw Hill. McGraw-Hill # 05147-X. ISDN. 2000 RF100 (c) 1998 Scott Baxter V1. digital processing theory. Solid treatment of the practical side of theoretical principles such as Ohm’s law. 445 pp. Microwave. Video. and modern circuit devices. 424 pp. Good explanation of each technology for a technical newcomer to wireless. April. "Voice and Data Communications Handbook" by Bates and Gregory 699 pp. Smolik & Wilkes. $65 Tops-down view of the startup process in a PCS network.. system/RF design principles and process.. "The ARRL Handbook for Radio Amateurs (1997)" published by the American Radio Relay League (phone 800-594- 0200). receiver and transmitter architecture and performance. ISBN 0-13-234-626-5 $68. good technical reference "PCS Network Deployment" by John Tsakalakis. 70 illus.150 . At best. Ed... 428 pages hardcover. McGraw-Hill # 036077-4. This is the little brother of “The Mobile Communications Handbook”.. 1996. 1994.. $68. Includes good traffic section. 1100+ page softcopy ($44). At the very least. 360 illus. Prentice Hall. 2nd. ISBN 0028018427. 771 pp. Prentice Hall. it may motivate you to dig deeper into theory as you explore why things behave as they do.