Qcomm LTE Log Packet Information 80 VP457 5 C LTE LPID PDF

QCT Tools Log Packet Information for
Long Term Evolution (LTE)
T
80-VP457-5 C
PS
March 8, 2011
om 23
.c 3:
sn 5:5
Submit technical questions at:
i-n t 0
https://support.cdmatech.com/
or 5 a
r.h .0
ca .01
Qualcomm Confidential and Proprietary

os 12
Restricted Distribution. Not to be distributed to anyone who is not an employee of either Qualcomm or a
20
subsidiary of Qualcomm without the express approval of Qualcomm’s Configuration Management.
Not to be used, copied, reproduced in whole or in part, nor its contents revealed in any manner to others without the
express written permission of Qualcomm.
Qualcomm reserves the right to make changes to the product(s) or information contained herein without notice. No
liability is assumed for any damages arising directly or indirectly by their use or application. The information
provided in this document is provided on an “as is” basis.
This document contains Qualcomm confidential and proprietary information and must be shredded when discarded.
QUALCOMM is a registered trademark of QUALCOMM Incorporated in the United States and may be registered
in other countries. Other product and brand names may be trademarks or registered trademarks of their respective
owners. CDMA2000 is a registered certification mark of the Telecommunications Industry Association, used under
license. ARM is a registered trademark of ARM Limited. QDSP is a registered trademark of QUALCOMM
Incorporated in the United States and other countries.
This technical data may be subject to U.S. and international export, re-export, or transfer (“export”) laws. Diversion
contrary to U.S. and international law is strictly prohibited.
QUALCOMM Incorporated
5775 Morehouse Drive
San Diego, CA 92121-1714
U.S.A.
Copyright © 2010-2011 QUALCOMM Incorporated.

All rights reserved.
Contents
1 Introduction.................................................................................................... 16
1.1 Purpose........................................................................................................................ 16
1.2 Conventions ................................................................................................................ 16
1.3 References................................................................................................................... 16
1.4 Technical assistance .................................................................................................... 17
1.5 Acronyms .................................................................................................................... 17
T
PS
2 Protocol .......................................................................................................... 18
om 23
2.1 Asynchronous connector............................................................................................. 18
.c 3:
2.2 Asynchronous data protocol ....................................................................................... 18
sn 5:5
2.2.1 Async-HDLC frame format ............................................................................. 18
2.2.1.1 Information field ................................................................................... 19
i-n t 0
2.2.1.2 Frame check.......................................................................................... 19

or 5 a
2.2.1.3 Ending flag ........................................................................................... 19

r.h .0
3 Packet Definitions ......................................................................................... 20

ca .01
3.1 Streaming diagnostic communications enhancements ................................................ 20

os 12
3.2 Error handling ............................................................................................................. 21

20
3.3 General version number response (cmd_code 0) ........................................................ 21

3.4 Packets specific to LTE .............................................................................................. 21
3.4.1 General............................................................................................................. 21
3.4.2 Lower Layer 1.................................................................................................. 21
3.4.3 Management Layer 1 ....................................................................................... 22
3.4.3.1 LTE RX Chain disable/enable (0x4000) .............................................. 22
3.4.4 Layer 2/3 .......................................................................................................... 22
3.5 Packets specific to WCDMA ...................................................................................... 22
3.5.1 WCDMA version number message (cmd_code 0) .......................................... 23
3.5.1.1 WCDMA version number response...................................................... 23
3.5.2 Set BLER reporting frequency (cmd_code 8) ................................................. 23
3.5.3 Temporal analyzer parameters message (cmd_code 9) ................................... 23
3.5.4 DIP switch retrieval message (cmd_code 10).................................................. 23
3.5.5 DIP switch set message (cmd_code 11) .......................................................... 23
3.5.6 Call origination message (cmd_code 12)......................................................... 24
3.5.6.1 Call origination request ........................................................................ 24
3.5.6.2 Call origination response ...................................................................... 24
3.5.7 Call end message (cmd_code 13) .................................................................... 24
3.5.7.1 Call end request .................................................................................... 24
3.5.8 Call end response ............................................................................................. 24
3.5.9 Status message (cmd_code 14) ........................................................................ 25
80-VP457-5 C 2 Qualcomm Confidential and Proprietary

MAY CONTAIN U.S. AND INTERNATIONAL EXPORT CONTROLLED INFORMATION
Contents
3.5.9.1 Status request ........................................................................................ 25

3.5.9.2 Status response ..................................................................................... 25
3.5.10 Additional status message (cmd_code 15)..................................................... 25
3.5.10.1 Additional status request .................................................................... 25
3.5.10.2 Additional status response .................................................................. 25
3.5.11 Reserved (cmd_code 16) ............................................................................... 26
3.5.12 Reacquisition slew statistics message (cmd_code 17) ................................... 26
3.5.12.1 Reacquisition slew statistics request................................................... 26
3.5.12.2 Reacquisition slew statistics response ................................................ 27
3.5.13 Reacquisition search statistics (cmd_code 18) .............................................. 27
3.5.13.1 Reacquisition search response ............................................................ 27
3.5.13.2 Reacquisition search response ............................................................ 27
3.5.14 Clear reacquisition search statistics (cmd_code 19) ...................................... 28
3.5.14.1 Clear reacquisition search request ...................................................... 28
3.5.15 Freeze and set TRK_LO PDM to a specific value (cmd_code 20)................ 28
T
PS
3.5.16 Apply offset to CQI value request/responseReserved (cmd_code 21) .......... 28
3.5.17 Sample server data capture request/responsereserved (cmd_code 22) .......... 29
om 23
.c 3:
sn 5:5
3.5.20 PSC scanner Diag request/responseReserved (cmd_code 25) ....................... 29
3.5.21 WCDMA Diag statistics request/response (cmd_code 26) ........................... 30
i-n t 0
3.5.22 Clear WCDMA Diag statistics (cmd_code 27) ............................................. 33

or 5 a
3.5.22.1 Clear WCDMA Diag statistics request ............................................... 33

r.h .0

ca .01

os 12

20
3.5.27 Write fbiBER_Threshold reserved (cmd_code 32) ....................................... 33

3.5.27.1 Write fbiBER_Threshold request ....................................................... 33
3.5.27.2 Write fbiBER_Threshold response ..................................................... 34
3.5.28 Read fbiBER_Thresholdreserved (cmd_code 33) ......................................... 34
3.5.28.1 Read fbiBER_Threshold request ........................................................ 34
3.5.28.2 Read fbiBER_Threshold response...................................................... 34
3.6 Dual-mode MSM packet list ....................................................................................... 35
3.6.1 Memory peek message (cmd_code 2, 3, 4) ..................................................... 35
3.6.1.1 Memory peek request ........................................................................... 35
3.6.1.2 Memory peek response ......................................................................... 35
3.6.2 Memory poke (cmd_code 5, 6, 7) .................................................................... 36
3.6.2.1 Memory poke request ........................................................................... 36
3.6.3 Memory poke response .................................................................................... 36
3.6.4 Port output byte (cmd_code 8)......................................................................... 36
3.6.4.1 Port output byte request ........................................................................ 37
3.6.4.2 Port output byte response ..................................................................... 37
3.6.5 Port output word (cmd_code 9) ....................................................................... 37
3.6.5.1 Port output word request....................................................................... 37
3.6.5.2 Port output word response .................................................................... 37
3.6.6 Port input (cmd_code 10) ................................................................................ 38
3.6.6.1 Port input request .................................................................................. 38

Contents
3.6.6.2 Port input response ............................................................................... 38

3.6.7 Port input word (cmd_code 11) ....................................................................... 38
3.6.7.1 Port input word request......................................................................... 39
3.6.7.2 Port input word request......................................................................... 39
3.6.8 Logging mask (cmd_code 15) ......................................................................... 39
3.6.8.1 Logging mask request........................................................................... 39
3.6.8.2 Logging mask response ........................................................................ 40
3.6.9 Log request (cmd_code 16) ............................................................................. 40
3.6.9.1 Log request ........................................................................................... 40
3.6.9.2 Log response ......................................................................................... 40
3.6.10 Nonvolatile memory peek (cmd_code 17)..................................................... 41
3.6.10.1 Nonvolatile memory peek request ...................................................... 41
3.6.10.2 Nonvolatile memory peek response.................................................... 41
3.6.11 Nonvolatile memory poke (cmd_code 18) .................................................... 42
3.6.12 Nonvolatile memory poke response .............................................................. 42
T
PS
3.6.12.1 Nonvolatile memory poke response ................................................... 42
3.6.13 Bad command (cmd_code 16) ....................................................................... 42
om 23
3.6.13.1 Bad command response ...................................................................... 42
.c 3:
3.6.14 Bad parameters (cmd_code 20) ..................................................................... 43
sn 5:5
3.6.14.1 Bad parameters response .................................................................... 43
3.6.15 Bad length (cmd_code 21) ............................................................................. 43
i-n t 0
3.6.15.1 Bad length response ............................................................................ 43

or 5 a
3.6.16 Bad mode (cmd_code 24) .............................................................................. 43

r.h .0
3.6.16.1 Bad mode response ............................................................................. 43

ca .01
3.6.17 Diag version (cmd_code 28) .......................................................................... 44

os 12
3.6.17.1 Diag version request ........................................................................... 44

3.6.17.2 Diag version response ......................................................................... 44
20
3.6.18 Timestamp (cmd_code 29) ............................................................................ 44

3.6.18.1 Timestamp request.............................................................................. 44
3.6.18.2 Timestamp response ........................................................................... 45
3.6.19 Text message (cmd_code 31) ........................................................................ 45
3.6.19.1 Message request.................................................................................. 45
3.6.19.2 Message response ............................................................................... 46
3.6.20 Handset emulation keypress (cmd_code 32) ................................................. 46
3.6.20.1 Handset emulation keypress request................................................... 47
3.6.20.2 Handset emulation keypress response ................................................ 48
3.6.21 Handset emulation lock/unlock (cmd_code 33) ............................................ 48
3.6.21.1 Handset emulation lock/unlock request .............................................. 48
3.6.21.2 Handset emulation lock/unlock response ........................................... 48
3.6.22 Handset emulation display (cmd_code 34) .................................................... 48
3.6.22.1 Handset emulation display request ..................................................... 49
3.6.22.2 Handset emulation display response................................................... 49
3.6.23 Nonvolatile item read (cmd_code 38) ........................................................... 49
3.6.23.1 Nonvolatile item read request ............................................................. 50
3.6.23.2 Nonvolatile item read response .......................................................... 50
3.6.24 Nonvolatile item write (cmd_code 39) .......................................................... 50
3.6.24.1 Nonvolatile item write request............................................................ 50

Contents
3.6.24.2 Nonvolatile item write response ......................................................... 51

3.6.25 Mode change (cmd_code 41)......................................................................... 51
3.6.25.1 Mode change request .......................................................................... 51
3.6.25.2 Mode change response........................................................................ 52
3.6.26 Error record retrieval (cmd_code 42) ............................................................ 52
3.6.26.1 Error record retrieval request .............................................................. 52
3.6.26.2 Error record retrieval response ........................................................... 52
3.6.27 Error record clear (cmd_code 43) .................................................................. 53
3.6.27.1 Error record clear request ................................................................... 53
3.6.27.2 Error record clear response ................................................................. 53
3.6.28 Direct test (cmd_code 46) .............................................................................. 53
3.6.28.1 Directed test request ........................................................................... 54
3.6.28.2 Directed test response ......................................................................... 54
3.6.29 Vocoder PCM loopback (cmd_code 49) ....................................................... 54
3.6.29.1 Vocoder PCM loopback request ......................................................... 54
T
PS
3.6.29.2 Vocoder PCM loopback response ...................................................... 55
3.6.30 Vocoder PKT loopback request (cmd_code 50) ............................................ 55
om 23
3.6.30.1 Vocoder PKT loopback request .......................................................... 55
.c 3:
3.6.30.2 Vocoder PKT loopback response ....................................................... 55
sn 5:5
3.6.31 Switch to downloader (cmd_code 58) ........................................................... 55
i-n t 0
3.6.31.1 Switch to downloader request............................................................. 55

3.6.31.2 Switch to downloader response .......................................................... 55
or 5 a
3.6.32 Service programming code (cmd_code 65) ................................................... 56

r.h .0
3.6.32.1 Service programming code request .................................................... 56

ca .01
3.6.32.2 Service programming code response .................................................. 56

os 12
3.6.33 Bad SPC mode (cmd_code 66) ...................................................................... 56

3.6.33.1 Bad SPC mode response ..................................................................... 56
20
3.6.34 Serial mode change (cmd_code 68) ............................................................... 56

3.6.34.1 Serial mode change request ................................................................ 57
3.6.34.2 Serial mode change response .............................................................. 57
3.6.35 Bad security mode (cmd_code 71) ................................................................ 57
3.6.35.1 Bad security mode response ............................................................... 57
3.6.36 Embedded file system operation (cmd_code 89) ........................................... 57
3.6.36.1 Embedded file system operation request ............................................ 58
3.6.36.2 Embedded file system operation response .......................................... 58
3.6.36.3 Common data structures for operations .............................................. 58
3.6.36.4 Create directory operation .................................................................. 59
3.6.36.5 Remove directory operation ............................................................... 59
3.6.36.6 Display directory list operation .......................................................... 59
3.6.36.7 Display file list operation ................................................................... 60
3.6.36.8 Read file operation.............................................................................. 60
3.6.36.9 Write file operation............................................................................. 61
3.6.36.10 Operation-specific data for write file response ................................. 61
3.6.36.11 Remove file operation ...................................................................... 62
3.6.36.12 Get file attributes operation .............................................................. 62
3.6.36.13 Set file attributes operation ............................................................... 62
3.6.36.14 Remote file link operation ................................................................ 62

Contents
3.6.36.15 Iterative directory list operation........................................................ 63

3.6.36.16 Iterative file list operation................................................................. 63
3.6.36.17 Space available operation ................................................................. 63
3.6.37 Event report control (cmd_code 96) .............................................................. 64
3.6.37.1 Event report control request ............................................................... 64
3.6.37.2 Event report control response ............................................................. 64
3.6.38 Event report ................................................................................................... 64
3.6.38.1 Event report ........................................................................................ 64
3.6.38.2 EVENT item definition ...................................................................... 65
3.6.38.3 EVENT_ID format description .......................................................... 65
3.6.39 Reserved (CMD_CODE 100) ........................................................................ 65
T
PS
om 23
3.6.47 Logging configuration (cmd_code 115) ........................................................ 66
.c 3:
3.6.47.1 Logging configuration request............................................................ 67
sn 5:5
3.6.47.2 Logging configuration response ......................................................... 67
i-n t 0
3.6.47.3 Common data structures for operations .............................................. 67

or 5 a
3.6.47.4 Logging range structure ...................................................................... 67

3.6.47.5 Disable logging operation................................................................... 68
r.h .0
3.6.47.6 Disable logging operation response .................................................... 68

ca .01
3.6.47.7 Retrieve logging ID ranges operation ................................................. 68

os 12
3.6.47.8 Set logging mask operation ................................................................ 68

20
3.6.48 Log on demand message (cmd_code 120) ..................................................... 68

3.6.48.1 Log on demand request....................................................................... 69
3.6.48.2 Log on demand response .................................................................... 69
4 Log Record Structure .................................................................................... 70
5 Lower Layer (LL1) .......................................................................................... 71

5.1 Receiver front end....................................................................................................... 71
5.1.1 AGC (LOG_CODE 0xB111) .......................................................................... 71
5.2 Searcher and measurement packets ............................................................................ 72
5.2.1 LTE LL1 PSS results (LOG_CODE 0xB113) ................................................. 72
5.2.2 LTE LL1 SSS results (LOG_CODE 0xB115) ................................................. 73
5.2.3 LTE LL1 serving cell measurement results (LOG_CODE 0xB116)............... 73
5.2.4 LTE LL1 neighbor cell measurements and tracking (LOG_CODE 0xB119) . 74
5.2.5 LTE LL1 serving cell FTL results (LOG_CODE 0xB11B) ............................ 75
5.2.6 LTE LL1 serving cell TTL results (LOG_CODE 0xB11D) ............................ 76
5.2.7 LTE LL1 serving cell frame timing (LOG_CODE 0xB114)........................... 77
5.3 Demodulator front end packets ................................................................................... 78
5.3.1 LTE LL1 serving cell CER (LOG_CODE 0xB122)........................................ 78
5.3.2 LTE LL1 neighbor cell CER (LOG_CODE 0xB123) ..................................... 78
5.3.3 LTE LL1 PDSCH demapper configuration (LOG_CODE 0xB126) ............... 79

Contents
5.3.4 LTE LL1 antenna correlation results (LOG_CODE 0xB120) ......................... 80

5.4 Demodulator back end packets ................................................................................... 81
5.4.1 LTE LL1 PCFICH decoding results (LOG_CODE 0xB12A) ......................... 81
5.4.2 LTE LL1 PHICH decoding results (LOG_CODE 0xB12C) ........................... 81
5.4.3 LTE LL1 PBCH decoding results (LOG_CODE 0xB12E) ............................. 82
5.4.4 LTE LL1 PDCCH decoding results (LOG_CODE 0xB130) .......................... 82
5.4.5 LTE LL1 PDSCH decoding results (LOG_CODE 0xB132) ........................... 83
5.5 Uplink ......................................................................................................................... 85
5.5.1 LTE LL1 PUSCH Tx report (LOG_CODE 0xB139) ...................................... 85
5.5.2 LTE LL1 PUCCH Tx report (LOG_CODE 0xB13C) ..................................... 86
5.5.3 LTE LL1 SRS Tx report (LOG_CODE 0xB140) ............................................ 87
5.5.4 LTE LL1 RACH Tx report (LOG_CODE 0xB144) ........................................ 88
5.5.5 LTE LL1 AGC Tx report (LOG_CODE 0xB146) .......................................... 88
5.5.6 LTE LL1 PUCCH CSF log (LOG_CODE 0xB14D) ...................................... 89
5.5.7 LTE LL1 PUSCH CSF log (LOG_CODE 0xB14E) ....................................... 89
T
PS
6 Management Layer 1 (ML1)........................................................................... 92
om 23
6.1 UL/DL/GM configuration log packets........................................................................ 92
6.1.1 LTE ML1 downlink common configuration (LOG_CODE 0xB160) ............. 92
.c 3:
6.1.2 LTE ML1 downlink dedicated configuration (LOG_CODE 0xB161) ............ 94
sn 5:5
6.1.3 LTE ML1 uplink common configuration (LOG_CODE 0xB162) .................. 95
i-n t 0
6.1.4 LTE ML1 uplink dedicated configuration (LOG_CODE 0xB163) ................. 97

6.1.5 LTE ML1 grant manager common configuration (LOG_CODE 0xB164) ..... 98
or 5 a
6.1.6 LTE ML1 grant manager dedicated configuration (LOG_CODE 0xB165) .. 101
r.h .0
6.1.7 LTE ML1 PRACH configuration (LOG_CODE 0xB166) ............................ 105

ca .01
6.1.8 LTE ML1 TDD Configuration (Log code ID: 0xB1B0) ............................... 106
6.2 RACH ....................................................................................................................... 107
os 12
6.2.1 LTE ML1 random access request (MSG1) report (LOG_CODE 0xB167) ... 107
20
6.2.2 LTE ML1 random access response (MSG2) report (LOG_CODE 0xB168). 108
6.2.3 LTE ML1 UE identification message (MSG3) Report (LOG_CODE 0xB169)
................................................................................................................................ 109
6.2.4 LTE ML1 contention resolution message (MSG4) report (LOG_CODE
0xB16A) ................................................................................................................. 110
6.3 Closed loop ............................................................................................................... 111
6.3.1 LTE ML1 PDCCH-PHICH indication report (LOG_CODE 0xB16B) ......... 111
6.3.2 LTE ML1 DCI information report (LOG_CODE 0xB16C) .......................... 111
6.3.3 LTE ML1 GM Tx report (LOG_CODE 0xB16D) ........................................ 113
6.3.4 LTE ML1 PUSCH power control (LOG_CODE 0xB16E) ........................... 115
6.3.5 LTE ML1 PUCCH power control (LOG_CODE 0xB16F) ........................... 116
6.3.6 LTE ML1 SRS Tx report (LOG_CODE 0xB170)......................................... 117
6.3.7 LTE ML1 SRS power control report (LOG_CODE 0xB171) ....................... 118
6.3.8 LT ML1 Uplink PKT build indication (LOG_CODE 0xB172) .................... 118
6.3.9 LTE ML1 PDSCH stat indication (LOG_CODE 0xB173) ........................... 119
6.3.10 LTE ML1 radio link monitoring (LOG_CODE 0xB18A)........................... 120
6.3.11 LTE ML1 CDRX Events Info (LOG_CODE 0xB198) ............................... 121
6.3.12 LTE ML1 TDD ACK NAK REPORT (LOG_CODE 0xB1B1) ................. 121
6.4 Measurements ........................................................................................................... 123
6.4.1 LTE ML1 initial acquisition results (LOG_CODE 0xB176) ........................ 123
6.4.2 LTE ML1 connected mode measurement configuration (LOG_CODE 0xB177)
................................................................................................................................ 124

Contents
6.4.2.1 Measurement configuration subpackets details .................................. 125

6.4.2.2 Serving cell info subpacket................................................................. 125
6.4.2.3 Conn Meas Config Bitmasks subpacket ............................................. 125
6.4.2.4 Measurement ID configuration subpacket .......................................... 126
6.4.2.5 Measurement object configuration subpacket .................................... 127
6.4.2.6 Quantity config subpacket .................................................................. 127
6.4.2.7 Measurement gap configuration subpacket ........................................ 128
6.4.2.8 S-Measure configuration subpacket ................................................... 128
6.4.2.9 Neighbor cell configuration subpacket ............................................... 128
6.4.2.10 Speed-dependent scaling parameters subpacket ............................... 128
6.4.3 LTE ML1 Connected mode LTE intra-frequency measurement results
(LOG_CODE 0xB179) ........................................................................................... 129
6.5 Idle mode log packets ............................................................................................... 131
6.5.1 LTE ML1 S criteria check procedure (LOG_CODE 0xB17A) ..................... 131
6.5.2 LTE ML1 paging DRX request (LOG_CODE 0xB17C) .............................. 131
T
PS
6.5.3 LTE ML1 idle measurement request (LOG_CODE 0xB17D) ...................... 132
6.5.4 LTE ML1 UE Mobility state change (LOG_CODE 0xB17E) ...................... 132
om 23
6.5.5 LTE ML1 serving cell measurements and evaluation (LOG_CODE 0xB17F)
.c 3:
................................................................................................................................ 133
sn 5:5
6.5.6 LTE ML1 LTE neighbor measurements log packet (LOG_CODE 0xB180) 134
6.5.7 LTE ML1 intra frequency cell reselection log packet (LOG_CODE 0xB181)
i-n t 0
................................................................................................................................ 136
or 5 a
6.5.8 LTE ML1 pBCH decode log packet (LOG_CODE 0xB183)........................ 136
6.5.9 LTE ML1 CDMA Neighbor measurements log packet (LOG_CODE 0xB185)
r.h .0
................................................................................................................................ 137
ca .01
6.5.10 LTE ML1 reselection candidates log packet (LOG_CODE 0xB186) ......... 138
os 12
6.5.10.1 Reselection candidate substructure ................................................... 138

20
6.5.10.2 LTE cell structure (CandIDate RAT Type = 0) ................................ 138

6.5.10.3 GSM cell structure (CandIDate RAT Type = 2) .............................. 138
6.5.10.4 WCDMA cell structure (CandIDate RAT Type = 1) ....................... 139
6.5.10.5 CDMA cell structure (CandIDate RAT Type = 3 or 4) .................... 139
6.5.11 LTE ML1 idle IRAT measurement request (LOG_CODE 0xB187)........... 139
6.5.12 LTE ML1 CDMA system time (LOG_CODE 0xB189).............................. 140
6.5.13 LTE ML1 idle neighbor cell measurement request/response log packet
(LOG_CODE 0xB192) ........................................................................................... 140
6.5.14 LTE ML1 serving cell measurement result log packet (LOG_CODE 0xB193)
................................................................................................................................ 141
6.5.15 LTE ML1 neighbor cell search request/response log packet (LOG_CODE
0xB194) .................................................................................................................. 141
6.5.16 LTE ML1 Connected Mode neighbor meas request response log packet
(LOG_CODE 0xB195) ........................................................................................... 142
6.5.17 LTE ML1 Serving Cell Information log packet (LOG_CODE 0xB197) .... 142
6.5.18 LTE ML1 Sleep (LOG_CODE 0xB18B) .................................................... 143
6.6 Idle mode log subpackets .......................................................................................... 143
6.6.1 Log subpacket structure ................................................................................. 143
6.6.2 LTE ML1 idle meas common config subpacket ............................................ 144
6.6.3 LTE ML1 idle meas resel common params subpacket .................................. 144
6.6.4 LTE ML1 idle meas mobility params subpacket ........................................... 144
6.6.5 LTE ML1 idle meas cell select request subpacket......................................... 144

Contents
6.6.6 LTE ML1 idle meas serving frequency resel info subpacket ........................ 145
6.6.7 LTE ML1 idle meas intra frequency resel info subpacket............................. 146
6.6.8 LTE ML1 idle meas intra frequency whitelist info subpacket ...................... 147
6.6.9 LTE ML1 Idle Meas serving Cell Measurements subpacket......................... 147
6.6.10 LTE ML1 idle meas intra frequency blacklist cells subpacket .................... 148
6.6.11 LTE_ML1 Idle mode reselection measurements common parameters
subpacket ................................................................................................................ 148
6.6.12 LTE ML1 Idle mode reselection measurements LTE frequency subpacket 149
6.6.13 LTE ML1 idle meas CDMA config subpacket ............................................ 150
6.6.14 LTE ML1 HRPD results subpacket ............................................................. 151
6.6.15 LTE ML1 HRPD MDB subpacket .............................................................. 151
6.6.16 LTE ML1 CDMA system time subpacket ................................................... 152
6.6.17 LTE ML1 serving cell measurement result subpacket ................................ 152
6.6.18 LTE ML1 Idle mode neighbor cell measurement request subpacket .......... 153
6.6.19 LTE ML1 neighbor cell measurement results subpacket ............................ 154
6.6.20 LTE ML1 neighbor cell search request subpacket ...................................... 155
T
PS
6.6.21 LTE ML1 neighbor cell search response subpacket .................................... 155
6.6.22 LTE ML1 connected neighbor meas request subpacket .............................. 156
om 23
6.6.23 LTE ML1 connected neighbour measurement result subpacket.................. 156
.c 3:
6.6.24 LTE ML1 full frequency scan response subpacket...................................... 157
sn 5:5
6.6.25 LTE ML1 list frequency scan response subpacket ...................................... 157
6.6.26 LTE ML1 Idle meas WCDMA LTE config subpacket ............................... 158
i-n t 0
6.7 LTE ML1 BPLMN Log Packets ............................................................................... 159

or 5 a
6.7.1 List of BPLMN log packets ........................................................................... 159

6.7.2 TE ML1 BPLMN START REQUEST (LOG CODE: 0xB1A0) ................... 159
r.h .0
6.7.3 LTE ML1 BPLMN CELL REQUEST (LOG CODE: 0xB1A1 ) .................. 160
ca .01
6.7.4 LTE ML1 BPLMN CELL CONFIRM (LOG CODE: 0xB1A2) ................... 160
os 12
6.7.5 LTE ML1 BPLMN TIME AVAILABLE INDICATION (LOG CODE:

20
0xB1A3) ................................................................................................................. 161

6.7.6 LTE ML1 BPLMN COMPLETE INDICATION (LOG CODE: 0xB1A4) .. 161
6.7.7 LTE ML1 BPLMN STOP REQUEST LOG (LOG CODE: 0xB1A5) .......... 162
6.7.8 LTE ML1 BPLMN STOP CONFIRM LOG (LOG CODE: 0xB1A6) ........ 162
7 MAC Layer .................................................................................................... 163

7.1 Log packets ............................................................................................................... 163
7.1.1 MAC log packet structure .............................................................................. 163
7.1.2 List of MAC log packets................................................................................ 163
7.1.3 LTE MAC configuration (LOG_CODE 0xB060) ......................................... 164
7.1.4 LTE MAC RACH trigger (LOG_CODE 0xB061) ........................................ 164
7.1.5 LTE MAC RACH attempt (LOG_CODE 0xB062)....................................... 164
7.1.6 LTE MAC DL transport block (LOG_CODE 0xB063) ................................ 164
7.1.7 LTE MAC UL transport block (LOG_CODE 0xB064) ................................ 165
7.1.8 LTE MAC UL Tx Statistics (LOG_CODE 0xB067) .................................... 165
7.2 MAC log subpackets ................................................................................................. 166
7.2.1 MAC Log subpacket structure ....................................................................... 166
7.2.2 MAC cfg type subpacket ............................................................................... 166
7.2.3 MAC DL cfg subpacket ................................................................................. 167
7.2.4 MAC RACH cfg subpacket ........................................................................... 167
7.2.5 MAC UL cfg subpacket ................................................................................. 168
7.2.6 MAC LC info type subpacket ........................................................................ 168

Contents
7.2.7 MAC RACH reason subpacket ...................................................................... 169

7.2.8 MAC RACH attempt subpacket .................................................................... 170
7.2.9 MAC DL TB subpacket ................................................................................. 171
7.2.10 MAC UL TB subpacket ............................................................................... 171
7.2.11 MAC UL Tx stats subpacket ....................................................................... 172
8 RLC Layer..................................................................................................... 173

8.1 Log packets ............................................................................................................... 173
8.1.1 RLC log packet structure ............................................................................... 173
8.1.2 List of RLC log packets ................................................................................. 173
8.1.3 LTE RLC DL configuration (LOG_CODE 0xB081) .................................... 174
8.1.4 LTE RLC DL AM All PDU (LOG_CODE 0xB082) .................................... 174
8.1.5 LTE RLC DL AM control PDU (LOG_CODE 0xB083) .............................. 175
8.1.6 LTE RLC DL AM polling PDU (LOG_CODE 0xB084) .............................. 175
8.1.7 LTE RLC DL AM signaling PDU (LOG_CODE 0xB085)........................... 175
T
8.1.8 LTE RLC DL UM data PDU (LOG_CODE 0xB086)................................... 175
PS
8.1.9 LTE RLC DL statistics (LOG_CODE 0xB087) ............................................ 175
8.1.10 LTE RLC UL configuration (LOG_CODE 0xB091) .................................. 176
om 23
8.1.11 LTE RLC UL AM all PDU (LOG_CODE 0xB092) ................................... 176
.c 3:
8.1.12 LTE RLC UL AM control PDU (LOG_CODE 0xB093) ............................ 176
sn 5:5
8.1.13 LTE RLC UL AM polling PDU (LOG_CODE 0xB094) ............................ 176
8.1.14 LTE RLC UL AM signaling PDU (LOG_CODE 0xB095)......................... 176
i-n t 0
8.1.15 LTE RLC UL UM data PDU (LOG_CODE 0xB096)................................. 176

or 5 a
8.1.16 LTE RLC UL statistics (LOG_CODE 0xB097) .......................................... 177

r.h .0
8.2 Logging design motivation ....................................................................................... 177

ca .01
8.3 RLC log subpackets .................................................................................................. 177

8.3.1 RLC log subpacket structure ......................................................................... 177
os 12
8.3.2 RLC DL config subpacket ............................................................................. 178

20
8.3.3 RLC DL PDU subpacket ............................................................................... 179

8.3.4 RLC DL statistics subpacket ......................................................................... 180
8.3.5 RLC UL config subpacket ............................................................................. 182
8.3.6 RLC UL PDU subpacket ............................................................................... 183
8.3.7 RLC UL statistics subpacket ......................................................................... 184
9 PDCP Layer .................................................................................................. 186

9.1 Log packets ............................................................................................................... 186
9.1.1 PDCP log packet structure ............................................................................. 186
9.1.2 List of PDCP log packets ............................................................................... 186
9.1.3 LTE PDCP DL config (LOG_CODE 0xB0A0) ............................................ 187
9.1.4 LTE PDCP DL data PDU (LOG_CODE 0xB0A1) ....................................... 187
9.1.5 LTE PDCP DL control PDU (LOG_CODE 0xB0A2) .................................. 187
9.1.6 LTE PDCP DL cipher data PDU (LOG_CODE 0xB0A3) ............................ 188
9.1.7 LTE PDCP DL statistics (LOG_CODE 0xB0A4) ......................................... 188
9.1.8 LTE PDCP DL SRB integrity data PDU (LOG_CODE 0xB0A5) ................ 188
9.1.9 LTE PDCP UL config (LOG_CODE 0xB0B0) ............................................ 188
9.1.10 LTE PDCP UL control PDU (LOG_CODE 0xB0B2) ................................ 189
9.1.11 LTE PDCP UL cipher data PDU (LOG_CODE 0xB0B3) .......................... 189
9.1.12 LTE PDCP UL statistics (LOG_CODE 0xB0B4) ....................................... 189
9.1.13 LTE PDCP UL SRB integrity data PDU (LOG_CODE 0xB0B5) .............. 189
9.2 PDCP log subpackets ................................................................................................ 190

Contents
9.2.1 PDCP log subpacket structure ....................................................................... 190

9.2.2 PDCP DL config subpacket ........................................................................... 191
9.2.3 PDCP UL config subpacket ........................................................................... 192
9.2.4 PDCP PDU subpacket ................................................................................... 192
9.2.5 PDCP PDU subpacket with ciphering ........................................................... 193
9.2.6 PDCP DL SRB integrity pdu subpacket ........................................................ 194
9.2.7 PDCP UL SRB integrity pdu subpacket ........................................................ 195
9.2.8 PDCP DL statistics subpacket ....................................................................... 195
9.2.9 PDCP UL statistics subpacket ....................................................................... 197
10 RRC Layer .................................................................................................. 199

10.1 LTE OTA message (LOG_CODE 0xB0C0) .......................................................... 199
10.2 LTE MIB message (LOG_CODE 0xB0C1) ........................................................... 199
10.3 LTE serving cell info (LOG_CODE 0xB0C2) ....................................................... 200
10.4 LTE PLMN Search Request (LOG_CODE 0xB0C3) ............................................ 200
T
10.5 LTE PLMN Search Response (LOG_CODE 0xB0C4) .......................................... 201
PS
11 NAS Layer .................................................................................................. 202
om 23
.c 3:
11.1 ESM sublayer .......................................................................................................... 202
sn 5:5
11.1.1 LTE NAS ESM security protected OTA incoming msg (LOG_CODE
0xB0E0) .................................................................................................................. 202
i-n t 0
11.1.2 LTE NAS ESM security protected OTA outgoing msg (LOG_CODE
or 5 a
0xB0E1) .................................................................................................................. 202

11.1.3 LTE NAS ESM plain OTA incoming msg (LOG_CODE 0xB0E2) ........... 202
r.h .0
11.1.4 LTE NAS ESM plain OTA outgoing msg (LOG_CODE 0xB0E3) ............ 203
ca .01
11.1.5 LTE NAS ESM Bearer Context state (LOG_CODE 0xB0E4) ................... 203
os 12
11.1.6 LTE NAS ESM bearer context info (LOG_CODE 0xB0E5) ...................... 203
20
11.1.7 LTE NAS ESM Procedure state (LOG_CODE 0xB0E6)............................ 204

11.2 EMM sublayer ........................................................................................................ 205
11.2.1 LTE NAS EMM security protected OTA incoming msg (LOG_CODE
0xB0EA) ................................................................................................................. 205
11.2.2 LTE NAS EMM security protected OTA outgoing msg (LOG_CODE
0xB0EB) ................................................................................................................. 205
11.2.3 LTE NAS EMM plain OTA incoming msg (LOG_CODE 0xB0EC) ......... 205
11.2.4 LTE NAS EMM plain OTA outgoing msg (LOG_CODE 0xB0ED) .......... 206
11.2.5 LTE NAS EMM state (LOG_CODE 0xB0EE) ........................................... 206
11.2.6 LTE NAS EMM USIM card mode (LOG_CODE 0xB0EF) ....................... 208
11.2.7 LTE NAS EMM USIM service table (LOG_CODE 0xB0F5) .................... 209
11.2.8 LTE NAS EMM Forbidden TAI list (LOG_CODE 0xB0F6) ..................... 210
12 Call Manager .............................................................................................. 211

12.1 CM phone event (LOG_CODE 0x1273) ................................................................ 211
12.1.1 Phone event.................................................................................................. 212
12.1.2 PLMN .......................................................................................................... 214
12.1.3 USER_PREF_NETWORKS ....................................................................... 214
12.1.3.1 INFO ................................................................................................. 214
12.1.4 AVAILABLE_NETWORKS ...................................................................... 214
12.1.4.1 INFO ................................................................................................. 214
12.1.5 CDMA_CAPABILITY................................................................................ 215

Contents
12.2 CM call event (LOG_CODE 0x12C1).................................................................... 215

12.2.1 Call event ..................................................................................................... 215
12.2.2 Call end ........................................................................................................ 219
12.2.3 NUM ............................................................................................................ 222
12.2.3.1 SUBADDR ....................................................................................... 223
12.2.4 REDIRECTING_NUMBER........................................................................ 223
12.2.5 ALPHA ........................................................................................................ 223
12.2.6 SIGNAL ....................................................................................................... 223
12.2.7 END_PARAMS........................................................................................... 223
12.2.7.1 Mode-specific END_PARAMS........................................................ 224
12.3 CM serving system event (LOG_CODE 0x134F) .................................................. 224
12.3.1 Serving system event ................................................................................... 226
12.3.2 Changed fields ............................................................................................. 227
12.3.3 SYS_ID ........................................................................................................ 228
12.3.3.1 ID ...................................................................................................... 228
T
12.3.3.2 IS95................................................................................................... 228
PS
12.3.3.3 PLMN ............................................................................................... 228
om 23
12.3.3.4 SSID ................................................................................................. 228
12.3.3.5 PLMN_LAC ..................................................................................... 228
.c 3:
sn 5:5
12.3.4 MODE_INFO .............................................................................................. 229
12.3.4.1 GW_INFO ........................................................................................ 229
i-n t 0
12.3.5 WLAN_BSS_INFO ..................................................................................... 231

or 5 a
12.3.6 WLAN_BSS_STATS .................................................................................. 231

12.3.7 MAIN_THR_STATUS/HDR_THR_STATUS ........................................... 231
r.h .0
ca .01
13 Other DIAG Requirement .......................................................................... 232

os 12
13.1 LTE on-demand log ................................................................................................ 232

20
13.1.1 LTE on-demand log request ........................................................................ 232

13.1.2 LTE on-demand log response ...................................................................... 232

Contents
Figures
Figure 7-1 MAC PDU .............................................................................................................................. 165
Figure 7-2 Coding of the SFN field .......................................................................................................... 172
T
PS
om 23
.c 3:
sn 5:5
i-n t 0
or 5 a
r.h .0
ca .01
os 12
20

Contents
Tables
Table 1-1 Reference documents and standards .......................................................................................... 16
Table 6-1 CDMA cell reselection parameters........................................................................................... 150
Table 6-2 CDMA band class information ................................................................................................. 150
Table 6-3 CDMA neighbor information ................................................................................................... 150
Table 6-4 HRPD pilot results parameters ................................................................................................. 151
Table 6-5 HRPD layer parameters ............................................................................................................ 151
Table 6-6 HRPD pilot parameters............................................................................................................. 151
Table 6-7 Connected mode common neighbor cell parameters ................................................................ 156
Table 7-1 List of MAC Log Packets ......................................................................................................... 163
Table 7-2 MAC log subpacket identifier .................................................................................................. 166
Table 8-1 List of RLC Log Packets .......................................................................................................... 173
T
Table 8-2 RLC log subpacket identifier ................................................................................................... 178
PS
Table 9-1 PDCP log subpacket identifier ................................................................................................ 190
om 23
Table 11-1 EPS_QOS format ................................................................................................................... 204
.c 3:
sn 5:5
i-n t 0
or 5 a
r.h .0
ca .01
os 12
20

Revision history
Revision Date Description

A Aug 2010 Initial release
B Nov 2010 Engineering updates
C Mar 2011 Engineering updates
T
PS
om 23
.c 3:
sn 5:5
i-n t 0
or 5 a
r.h .0
ca .01
os 12
20

1 1 Introduction
2 1.1 Purpose
3 This document describes the logging requirement and definitions for LTE access stratum. It will
4 serve as the basis for formal serial ICD documentation of log packets.
5 This ICD should be considered a supplement to the serial interface document for WCDMA [Q2],
6 which provides additional information on the protocol and packet formats.
T
PS
7 1.2 Conventions
om 23
8 Function declarations, function names, type declarations, and code samples appear in a different
.c 3:
9 font, e.g., #include. sn 5:5
10 Code variables appear in angle brackets, e.g., <number>.
i-n t 0
11 Commands and command variables appear in a different font, e.g., copy a:*.* b:.
or 5 a
12
r.h .0
13 Shading indicates content that has been added or changed in this revision of the document.
ca .01
1.3 References
os 12
14
20
15 Reference documents, which may include QUALCOMM®, standards, and resource documents,
16 are listed in Table 1-1. Reference documents that are no longer applicable are deleted from this
17 table; therefore, reference numbers may not be sequential.
18 Table 1-1 Reference documents and standards

Ref. Document
Qualcomm
Q1 QCT Tools Software Glossary for Customers 80-B5582-1
Q2 QCT Tools Interface Control Document for WCDMA/HSPA 80-B5704-2
Q3 QCT Tools CDMA 1x and 1xEV Interface Control Document 80-B1188-2
Standards
S1 E-UTRA Physical channels and modulation (Release 8) 3GPP 3GPP TS 36.211
V8.0.0 (2007-09)
S2 E-UTRA Multiplexing and channel coding (Release 8) 3GPP 3GPP TS 36.212
V8.0.0 (2007-09)
S3 E-UTRA Physical layer procedures (Release 8) 3GPP 3GPP TS 36.213
V8.0.0 (2007-09)
S4 E-UTRA Physical layer – measurements (Release 8) 3GPP 3GPP TS 36.214
V8.0.0 (2007-09)

Introduction
Ref. Document
S5 E-UTRA Medium Access Control (MAC) protocol specification 3GPP 3GPP TS 36.321
(Release 8) V8.3.0 (2008-09)
S6 E-UTRA Radio Resource Control Protocol specification (Release 8) 3GPP 3GPP TS 36.331
V8.1.0 (2008-03)
S7 E-UTRA Packet Data Convergence Protocol (PDCP) specification 3GPP 3GPP TS 36.323
(Release 8) V8.3.0 (2008-09)
S8 E-UTRA Radio Link Control (RLC) protocol specification (Release 8) 3GPP 3GPP TS 36.322
V8.0.0 (2007-12)
S9 NAS protocol for EPS; Stage 3 (Release 8) 3GPP 3GPP TS 24.301
V8.1.0 (2009-03)
S11 UE Procedures in Idle Mode and Procedures for Cell Reselection in 3GPP TS 25.304
Connected Mode (Release 4) V4.5.0 (2002-06)
S12 Layer 3 specification; Core network protocols; Stage 3 (Release 8) 3GPP TS 24.008
S13 Characteristics of the USIM Application (Release 8) 3GPP TS 31.102
T
V8.5.0
PS
S14 3rd Generation Partnership Project; Technical Specification Group 3GPP TS 31.102 4.2.2
Core Network and Terminals; Characteristics of Universal Subscriber
om 23
Identity Module (USIM) application (Release 7)
S15
.c 3:
Technical realization of Short Message Service (SMS) 3GPP TS 23.040
sn 5:5
S16 3rd Generation Partnership Project; Technical Specification Group 3GPP TS 36.101
i-n t 0
Core Network; Evolved Universal Terrestrial Radio Access (E-UTRA);

User Equipment (UE) radio transmission and reception (Release 8)
or 5 a
S17 3rd Generation Partnership Project; Technical Specification Group 3GPP TS 33.401
r.h .0
Services and System Aspects; 3GPP System Architecture Evolution

(SAE) Security architecture; (Release 8)
ca .01
S18 Non-Access-Stratus (NAS) protocol for Evolved PAcket System 3GPP TS 24.301
os 12
(EPS); Stage 3
20
1 1.4 Technical assistance

2 For assistance or clarification on information in this guide, submit a case to Qualcomm CDMA
3 Technologies at https://support.cdmatech.com/.
4 If you do not have access the CDMA Tech Support Service web site, register for access or send
5 email to support.cdmatech@qualcomm.com.
6 1.5 Acronyms
7 For definitions of terms and abbreviations, refer to [Q1].
8

1 2 Protocol
2 The Dual-Mode Subscriber Station (DMSS) supports the asynchronous RS-232 protocol.
3 Async-HDLC mode is a software implementation of High-Level Data Link Control (HDLC) over
4 an asynchronous link.
5 2.1 Asynchronous connector
T
6 The serial port connector is provided by a special data cable, with a Qualcomm-specific
PS
7 connector and the appropriate voltage translation for each phone. The cable used by all FFA
8 phones is MCN CV90-87013-1.
om 23
The connector pinout for the RS-232 mode is defined in below and is as specified in [S3]. The
.c 3:
9
DMSS serial port is wired as the Data Circuit-Terminating Equipment (DCE). This is the
10
sn 5:5
11 standard pinout that is presented at the special cable interface.
i-n t 0
12
or 5 a
Connector pinout for RS-232 mode

r.h .0
Contact Signal name Direction Function

ca .01
2 TXD- Input Tx data to DCE

os 12
3 RXD- Output Rx data from DCE

20
7 GND N/A Signal ground

13
14 2.2 Asynchronous data protocol

15 Asynchronous mode is used in the DMSS for serial port communication. It consists of an
16 asynchronous serial connection running at 38400 BPS. The port must be configured for 8-bit
17 characters, 1 stop bit, and no parity.
18 2.2.1 Async-HDLC frame format

19 An async-HDLC frame consists of the fields specified below. This is specified in ISO-3309:1984-
20 PDAD1.
21
Field Description
Information Message
Frame check CRC-CCITT standard 16-bit CRC
Ending flag Ending character

22

Protocol
1 2.2.1.1 Information field

2 The information field consists of all of the messages used to control the DMSS operation. This
3 includes both request messages sent from the external device to the DMSS and responses sent
4 from the DMSS to the external device.
5 If the information to be sent contains either the ending flag (0x7E) or the escape character
6 (0x7D), the escape character is inserted into the data stream and the byte XORed with the Escape
7 Complement Value (0x20), and then sent. ON the receiving end, this means that any escape
8 character should be discarded and the next byte should be XORed with the Escape Complement
9 Value. Note that this same procedure should also be performed if either of these special
10 characters appears as part of the Cyclic Redundancy Check (CRC).
11 2.2.1.2 Frame check

12 The frame check field detects errors in the address, control, and information fields. It is generated
by a CRC using the standard CRC-CCITT-16 generator polynomial of X16 + X12 + X5 + 1. The
T
13
PS
14 CRC is first initialized to all 1s. After calculation, the 1s complement of the CRC is transmitted.
15 The receiver performs the CRC calculation on the received bits, including the CRC bits, and
om 23
16 compares the 1s complement of the result against a known constant (0x0F47). Note that inserted
.c 3:
17 and removed escape bytes are not included in the CRC calculation.
sn 5:5
18 The following is a packet example:
i-n t 0
19 Timestamp Request message, which shows bytes in the order they should be sent in HEX:
or 5 a
20 1D 1C 3B 7E
r.h .0
ca .01
21 2.2.1.3 Ending flag

os 12
22 The ending flag delineates the end of a frame, and always consists of the 8-bit binary sequence
20
23 01111110.

1 3 Packet Definitions
2 3.1 Streaming diagnostic communications enhancements

3 This section explains the changes in communications between the DMSS and the DM.
4 The enhanced DMSS diagnostics system allows the DMSS to send unsolicited diagnostic packets
5 (referred to as streaming diagnostics), violating the existing master/slave relationship between the
6 DMSS and the Diagnostic Monitor (DM).
T
PS
7 After configuration, the DMSS will send existing diagnostic packets when the data is available,
8 rather than storing the data in a queue until it is requested by the DM. The following describes the
om 23
9 data that may be streamed and how to configure it:
.c 3:
10  Streamed Message response – To configure the Streamed Message response, the DM sends a
sn 5:5
11 Remote file link operation with the desired MSG_LEVEL, as defined in Text message
(cmd_code 31). The response to this packet will be a Remote file link operationMessage
i-n t 0
12
13 response, as defined in Text message (cmd_code 31), with the QUANTITY field set to 0 and
or 5 a
14 the DROP_CNT set to its current value. All other data is arbitrary for this response, since it is
r.h .0
15 merely an acknowledgment (ACK).

ca .01
16  As messages are generated in the DMSS, given available bandwidth, a Message Response
os 12
17 message will be streamed. The DM will handle this packet in the same manner that it handles
a Message Response message in a nonstreaming phone. Except for the QUANTITY field, is
20
18
19 the data the same? The QUANTITY field in a streaming phone is set to a nonzero value for
20 tools compatibility.
21  To configure the Streamed Message response to OFF (no unsolicited messages), the DM
22 sends a Message Request message with the MSG_LEVEL field that is set to
23 MSG_LVL_NONE.
24
25 Streamed log response – To configure the Streamed Log response, the DM

26 sends a Remote file link operation(
27
28 Call end message (cmd_code 13)) with the desired logging mask.
29
30  As log data becomes available and sufficient bandwidth exists, the DMSS will check the
31 logging mask and send a Remote file link operation (Asynchr). The DM will handle this
32 packet in the same manner that it handles a Log Response message in a nonstreaming phone.
33 The data is the same.
34  To configure the Streamed Message response to OFF (no unsolicited Log Response
35 messages), the DM sends a Logging Mask Request message or an Extended Logging Mask
36 Request message, with the logging mask set to 0.

Packet Definitions
1  Streamed Event report – Streamed Event Report is a feature that is incorporated into the
2 DMSS Streaming Diagnostic Communications Enhancements feature. If the latter feature is
3 disabled in the DMSS software, Event Report messages will not be delivered.
4 To configure the Streamed Event report, the DM sends an Event Report Control Request message
5 (see Section 3.6.37 for details).
6 3.2 Error handling

7 Error packets are given a packet ID that is keyed to the type of error being indicated, but the
8 contents of the error packet are the first 16 bytes of the packet sent by the DM. This measure is
9 taken for the convenience of the debuggers of DM software (see 3.6.13 through Section 3.6.17,
10 Section 0, and Section 3.6.35. If the DMSS detects a bad CRC on an incoming message, no
11 response will be given.
3.3 General version number response (cmd_code 0)
T
12
PS
13 This is a backward-compatible definition of the version number response message.
om 23
14
.c 3:
Field sn 5:5 Description
CMD_CODE (0)
i-n t 0
COMP_DATE These fields are identical to the original Version Number

Response message
or 5 a
COMP_TIME
REL_DATE
r.h .0
REL_TIME
ca .01
VER_DIR
os 12
SCM – null
20
MOB_CAI_REV – Null
MOB_MODEL return on request Model number of this mobile station – Model #90
(SURF5200™-SingleMode-WCDMA-FDD)
MOB_FIRM_REV – Null
SLOT_CYCLE_INDEX – Null
HW_MAJ_VER
HW_MIN_VER
15 3.4 Packets specific to LTE

16
17 LTE-specific diag commands (packets) must use the system dispatcher. The assigned subsystem
18 ID for LTE is 68.
19 3.4.1 General
20 General diag command code IDs range between 0x0 to 0x1FFF.
21 3.4.2 Lower Layer 1

22 Diag commands related to lower layer 1 range between 0x2000 to 0x3FFF.

Packet Definitions
1 3.4.3 Management Layer 1

3 3.4.3.1 LTE RX Chain disable/enable (0x4000)

4
Field Description
CMD_CODE Value is set to 75
SUBSYS_ID Value is set to 68
SUBSYS_CMD_CODE (0) Message ID
DM sets CMD_CODE 0x4000 for this message
COMMAND This diag command enables or disables a specific RX
chain while the UE is in LTE mode and camped on a
specific system.
T
5
PS
6 The following table is a usage summary for the bit 2 to bit 0:
om 23
7
Enable/Disable Rx1 Rx0 Summary
.c 3:
sn 5:5
0 0 0 No action
0 0 1 Enables RX0 only
i-n t 0
0 1 0 Enables RX1 only

or 5 a
0 1 1 Enables RX0 and RX1

r.h .0
1 0 0 No action
ca .01
1 0 1 Disables RX0 only

os 12
1 1 0 Disables RX1 only

20
1 1 1 Disables RX0 and RX1

8
9 3.4.4 Layer 2/3

11 3.5 Packets specific to WCDMA

12 WCDMA-specific diag commands (packets) must use the system dispatcher. The assigned
13 MSM5200 ID is 4. By using the system dispatcher, the WCDMA packets can be renumbered
14 independently from other Qualcomm CDMA Technologies (QCT) systems. The numbering of
15 WCDMA packets does not have to start at a specific number.

Packet Definitions
1 3.5.1 WCDMA version number message (cmd_code 0)
2 3.5.1.1 WCDMA version number response

3
ield Description
SUBSYS_CMD_CODE (0) Mobile station shall set this field to 0
VOC_DSP_VER Vocoder DSP version number; 16 bits range is 0 to 0xffff
MDSP_VERSION_ROM DSP version number (first part) 16 bits
MDSP_VERSION_RAM DSP version number (second part) 16 bits
4
T
PS
5 NOTE: Packet list from [Q2] is applicable to MSM5200™.
om 23
.c 3:
6 3.5.2 Set BLER reporting frequency (cmd_code 8)
sn 5:5
7
i-n t 0
Field Description
or 5 a

r.h .0
ca .01

DM sets CMD_CODE 8 for this message
os 12
bler_meas_duration_ms This field sets the frequency of reporting BLER

20
measurements in milliseconds
Using a zero value disables BLER reporting
(This value is 2 sec by default, unless changed by this
command)
8
9 3.5.3 Temporal analyzer parameters message (cmd_code 9)

10 TBD
11 3.5.4 DIP switch retrieval message (cmd_code 10)

12 TBD
13 3.5.5 DIP switch set message (cmd_code 11)

14 TBD

Packet Definitions
1 3.5.6 Call origination message (cmd_code 12)
2 3.5.6.1 Call origination request

3
Field Description
SUBSYS_CMD_CODE(12, 0x0C) Message ID
NUM_DIGITS Number of digits
DM shall set this field to be the number of valid digits in the
DIGITS field
DIGITS Dialed digits
The dialed digits, ASCII characters; 0 – 9, #, *, only
T
PS
AMR_RATE Rate of the vocoder
4
om 23
5 3.5.6.2 Call origination response
.c 3:
sn 5:5
6
i-n t 0
Field Description
or 5 a

r.h .0

ca .01
SUBSYS_CMD_CODE(12, 0x0C) Message ID

DMSS sets CMD_CODE 12 for this message
os 12
7
20
8 3.5.7 Call end message (cmd_code 13)
9 3.5.7.1 Call end request

10 To determinate a call in progress, the DM sends a Call End Request message to the DMSS.
11
Field Description
SUBSYS_CMD_CODE(13, 0x0D) Message ID
12
13 3.5.8 Call end response

14 The format of the Call End Response message is identical to the format of the Call End Request
15 message. It is sent from the DMSS to the DM to acknowledge receipt of the request message.

Packet Definitions
1 3.5.9 Status message (cmd_code 14)
2 3.5.9.1 Status request

3
Field Description
SUBSYS_CMD_CODE(14, 0x0E) Message ID
AMSS sets CMD_CODE 14 for this message
4
5 3.5.9.2 Status response

6
T
Field Description
PS
om 23
.c 3:
SUBSYS_CMD_CODE(14, 0x0E) sn 5:5Message ID
TMC_STATE TMC state
i-n t 0
or 5 a
7
r.h .0
ca .01
8 3.5.10 Additional status message (cmd_code 15)

os 12
20
9 3.5.10.1 Additional status request

10
Field Description
SUBSYS_CMD_CODE(15, 0x0F) Message ID
11
12 3.5.10.2 Additional status response

13
Field Description
SUBSYS_CMD_CODE(15, 0x0F) Message ID
IMEI International mobile station equipment identity; at most, 15
digits from 0 to 9; first byte is the length byte
For additional details, see [S18], Section 10.5.1.4

Packet Definitions
Field Description
IMSI International mobile subscriber identity; 15 digits from 0 to 9.
First byte is the length byte
For additional details, see [S18], Section 10.5.1.4
L1_STATE L1 state notation
State Notation
L1M_IDLE 0
L1M_FS 1
L1M_ACQ 2
L1M_BCH 3
L1M_PCH 4
L1M_FACH 5
T
L1M_DCH 6
PS
L1M_DEACTIVATE 7
om 23
L1M_PCH_SLEEP 8
.c 3:
L1M_DEEP_SLEEP sn 5:5 9
L1M_STOPPED 10
i-n t 0
L1M_SUSPENDED 11
L1M_PCH_BPLMN 12
or 5 a
L1M_WAIT_FOR_TRM_STOP 13
r.h .0
ca .01
3.5.11 Reserved (cmd_code 16)

os 12
1
20
2 Not developed
3 3.5.12 Reacquisition slew statistics message (cmd_code 17)
4 3.5.12.1 Reacquisition slew statistics request

5
Field Description

Packet Definitions
1 3.5.12.2 Reacquisition slew statistics response

2
Field Description
AMSS sets CMD_CODE to 17
srchzz_reacq_slew_small_cnt Value from -20 to 20
srchzz_reacq_slew_med_cnt Values from -256 to -21 or 21 to 256
srchzz_reacq_slew_large_cnt Values from -768 to -257 or 257 to 768
srchzz_reacq_slew_abnormal_cnt Values less than -768 or greater than 768
T
3.5.13 Reacquisition search statistics (cmd_code 18)
PS
3
om 23
4 3.5.13.1 Reacquisition search response
.c 3:
5
sn 5:5
Field Description
i-n t 0

or 5 a

r.h .0

ca .01

6
os 12
20
7 3.5.13.2 Reacquisition search response

8
Field Description
srchzz_reacq_list_success_cnt Maintains the number of times the initial search for the
serving cell was successful
srchzz_reacq_list_failure_cnt Maintains the number of times the initial search for the
serving cell failed, but a subsequent step 1/2/3 search
acquired a new cell that was different from the serving cell;
results in a cell reselection to the new cell
srchzz_reacq_123_success_cnt Maintains the number of times the serving cell is
reacquired using a step 1/2/3 search
srchzz_reacq_123_failure_cnt Maintains the number of times reacquisition upon waking
up from DRX fails to find any cell, serving or otherwise
9

Packet Definitions
1 3.5.14 Clear reacquisition search statistics (cmd_code 19)
2 NOTE: This command resets all the counters described in cmd_code 17 and cmd_code 18 to 0.
3 3.5.14.1 Clear reacquisition search request

4
Field Description
SUBSYS_CMD_CODE(19) Message ID
5
T
3.5.15 Freeze and set TRK_LO PDM to a specific value (cmd_code 20)
PS
6
om 23
Field Description
.c 3:
CMD_CODE sn 5:5 Value is set to 75
i-n t 0
or 5 a
tcxo_pdm_val The TRK_LO is set to this value after being frozen.

r.h .0
8
ca .01
os 12
9 3.5.16 Apply offset to CQI value request/responseReserved

20
10 (cmd_code 21)
11 This command applies a user-specified offset to the CQI values calculated by the UE. This new
12 CQI is then reported on the uplink. This is a debug feature.
13
Field Description
14
Field Description
status TRUE - Indicates that the request succeeded
15

Packet Definitions
1 3.5.17 Sample server data capture request/responsereserved

2 (cmd_code 22)
3
Field Description
mode Capture mode
ant_sel_trig_reason In SW Capture mode
OUT indicates tune back to WCDMA serving frequency
IN indicates tune to other interfrequency or GSM
T
data_to_log Type of data to capture
PS
4
om 23
Field Description
.c 3:
sn 5:5
i-n t 0

or 5 a
status TRUE – Indicates that the request succeeded

r.h .0
ca .01
5 3.5.18 Reserved (cmd_code 23)

os 12
20
7 3.5.20 PSC scanner Diag request/responseReserved (cmd_code 25)

8
Field Description
CMD_CODEL Value is set to 75
DMSS sets CMD_CODE 25 for this message
mview_cmd  1 – MVIEW SRCH ON
 0 – MVIEW SRCH OFF
status Status of the request; values are:
 0 – Indicates an error
 1 – Indicates that the command was accepted

Packet Definitions
Field Description
mview_cmd  1 – MVIEW SRCH ON
 0 – MVIEW SRCH OFF
1
2 3.5.21 WCDMA Diag statistics request/response (cmd_code 26)

3
Field Description
SUBSYS_CMD_CODE Message ID
4
T
5
PS
Field Description
om 23
.c 3:
SUBSYS_ID sn 5:5 Value is set to 4
SUBSYS_CMD_CODE Message ID
i-n t 0
srchzz_reacq_slew_small_cnt Indicates the number of times value of reacq_slew is

or 5 a
between -20 and 20

r.h .0
srchzz_reacq_slew_med_cnt Indicates the number of times reacq_slew is between -256

to -21 or 21 to 256
ca .01
srchzz_reacq_slew_large_cnt Indicates the number of times reacq_slew is between -768

os 12
to -257 or 257 to 768

20
srchzz_reacq_slew_abnormal_cnt Indicates the number of times reacq_slew is less than -768

or greater than 768
srchzz_reacq_list_serving_success_ Reacquisition succeeded, due to the initial serving cell
cnt passing
srchzz_reacq_list_failure_123_serving_suc Reacquisition succeeded on the serving cell, due to steps
cess_cnt 1/2/3 search passing after the failure
srchzz_reacq_list_failure_123_ Reacquisition succeeded on neighbor, due to steps 1/2/3
neighbor_success_cnt search passing after the failure
srchzz_reacq_fail_all_cnt Reacquisition failed on both serving and neighbor both and
steps 1/2/3 did not find anything and failed)
This will include the case where step 1/2/3 is not
performed after failure on serving cell
dl_num_times_sfn_mismatch Maintains the number of SFN mismatches
rrcpg1_num_pages Indicates the total number of pages received; This value
includes false alarm and valid pages
rrcpg1_num_pages_matched Indicates the total number of pages, minus the false
alarms
drx_pich_demod_error Indicates the number of PICH demod errors; This value
includes both PI_SUM 0 errors and occasions when the
Paging Occasion was overrun.
drx_cycle_len DRX Cycle Length in 10 ms radio-frame units
num_drx_cycles Indicates the number of elapsed DRX cycles

Packet Definitions
Field Description
intra_freq_resel_success_cnt Indicates the total number of intrafrequency cell
reselection success counts
intra_freq_nbcch_setup_failure_cnt Indicates the total number of intrafrequency cell
reselection failures due to neighbor BCCH setup failure.
intra_freq_sib_wait_timeout_cnt Indicates the total number of intrafrequency cell
reselection failures due to SIB wait timer time out while
reading neighbor SIBs
intra_freq_transition_fail_cnt Indicates the total number of intrafrequency cell
reselection failures due to failing transition to new cell
intra_freq_failed_other_causes_cnt Indicates the total number of intrafrequency cell
reselection failures due to other causes, which include
downlink going bad while reading neighbor SIBS
wtog_resel_ cnt Indicates the total number of W-to-G cell reselection
triggers
T
wtog_resel_failure_cnt Indicates the total number of W-to-G cell reselection failure
PS
counts
oos_idle_cnt Indicates the total number of times UE went to out-of-
om 23
service area (OoS) in IDLE RRC State
.c 3:
oos_connected_cnt Indicates the total number of times UE went to out-of-
sn 5:5
service area in Connected RRC State
succful_rrc_tran_retry_cnt Indicates the total number of times RRC is successful in
i-n t 0
receiving RRC procedure-level response message from

or 5 a
NW for any RRC message sent on RACH

rrc_retry_fail_due_to_l2_ack_ind Indicates the total number of times the RRC retransmits
r.h .0
the message due to receipt of L2 ACK IND, with cause

ca .01
failure for a previously attempted transmission of an RRC

message on the RACH
os 12
rrc_retry_fail_due_to_others Indicates the total number of times the RRC exhausts with
20
maximum time retransmission, before receiving an RRC

procedure-level response message on RACH
rach_ack_prmbl_cnt[0] Unused
rach_ack_prmbl_cnt[1] Indicates the number of times one preamble was sent for
AICH-ACK
rach_ack_prmbl_cnt[2] Indicates the number of times two preambles were sent for
AICH-ACK
rach_ack_prmbl_cnt[3] Indicates the number of times three preambles were sent
for AICH-ACK
rach_ack_prmbl_cnt[4] Indicates the number of times four preambles were sent
for AICH-ACK
rach_ack_prmbl_cnt[5] Indicates the number of times five preambles were sent for
AICH-ACK
rach_ack_prmbl_cnt[6] Indicates the number of times six preambles were sent for
AICH-ACK
rach_ack_prmbl_cnt[7] Indicates the number of times seven preambles were sent
for AICH-ACK
rach_ack_prmbl_cnt[8] Indicates the number of times eight preambles were sent
for AICH-ACK
rach_ack_prmbl_cnt[9] Indicates the number of times more than eight preambles
were sent for AICH-ACK

Packet Definitions
Field Description
rach_noack_cnt Indicates the total number of RACH procedures resulting
in No_ACK
rach_nak_prmbl_max_cnt Indicates the maximum number of preambles attempted in
NAK case
rach_max_prmbl_cnt Indicates the maximum number of preambles attempted in
RACH procedure
rach_total_attempts Indicates the total number of RACH attempts made by the
UE
rach_prmbl_detected_max_pwr_dB Indicates the maximum Tx power used for the RACH
procedure, resulting in ACK or NACK
rach_detected_last_prmbl_avg_pwr_ Indicates the average Tx power used for the RACH
dB procedure, resulting in ACK or NACK
rach_noack_last_prmbl_avg_pwr_dB Indicates the average Tx power used for the RACH
procedure in NOACK case
T
rach_noack_prmbl_max_pwr_dB Indicates the maximum Tx power used for the RACH
PS
procedure in NOACK case
om 23
1
2
.c 3:
sn 5:5
i-n t 0
or 5 a
r.h .0
ca .01
os 12
20

Packet Definitions
1 3.5.22 Clear WCDMA Diag statistics (cmd_code 27)
2 3.5.22.1 Clear WCDMA Diag statistics request

3
Field Description
4

Reserved
T
6
PS
3.5.24 Reserved (cmd_code 29)
om 23
7
.c 3:
8 Reserved sn 5:5
i-n t 0

or 5 a
10 Reserved
r.h .0
ca .01

os 12
12 Reserved
20
13 3.5.27 Write fbiBER_Threshold reserved (cmd_code 32)

14 This command writes a known value into the mDSP variable fbiBER_Threshold.
15 3.5.27.1 Write fbiBER_Threshold request

16
Field Description
fbiBER_threshold Indicates the value to be written into the mDSP variable
fbiBER_Threshold
17
18

Packet Definitions
1 3.5.27.2 Write fbiBER_Threshold response

2
Field Description
status  1 – Indicates that the request succeeded
 0 – Request failed because mDSP image was not
loaded
3 Reserved
4 3.5.28 Read fbiBER_Thresholdreserved (cmd_code 33)
T
This command reads from the mDSP variable fbiBER_Threshold.
PS
5
om 23
6 3.5.28.1 Read fbiBER_Threshold request
.c 3:
7
sn 5:5
Field Description
i-n t 0

or 5 a

r.h .0

ca .01
8
os 12
20
9 3.5.28.2 Read fbiBER_Threshold response

10
Field Description
status  1 – Indicates that the request succeeded
 0 – Request failed because mDSP image was not
loaded
fbiBER_threshold Indicates the value read from the mDSP variable
fbiBER_Threshold only valid if the request succeeded

Packet Definitions
1 3.6 Dual-mode MSM packet list

2 3.6.1 Memory peek message (cmd_code 2, 3, 4)
3 When the DM sends a Memory Peek Request message to the DMSS, the DMSS responds with a
4 Memory Peek Response message that contains the contents of a block of memory, starting at the
5 specific ADDRESS and consisting of LENGTH items.
6 The request may ask for BYTES, WORDS, or DWORDS.
7 The ADDRESS is specified as a 32-bit flat address.
8 This packet is protected by the DMSS Security Plan. The Security Password Request message
9 must be sent to the DMSS successfully before this message will be accepted.
10 3.6.1.1 Memory peek request
T
PS
11
Field Description
om 23
CMD_CODE (2, 3, 4) Message ID
.c 3:
The DM sets CMD_CODE to 2 to specify BYTE peek, 3 to
sn 5:5
specify WORD peek, or 4 to specify DWORD peek
i-n t 0
ADDRESS Address of peek region start; given as a flat address

LENGTH Length of peek region
or 5 a
This is the number of BYTES, WORDS, or DWORDS

r.h .0
desired. The maximum number of BYTES returned is 16,

ca .01
the maximum number of WORDS returned is 8, and the

maximum number of DWORDS returned is 4
os 12
20
12 3.6.1.2 Memory peek response

13 The Memory peek response message repeats the address and length data for the convenience of
14 the external process.
15
Field Description
DMSS sets CMD_CODE to 2 to specify BYTE peek, 3 to
specify WORD peek, or 4 to specify DWORD peek
ADDRESS Address of peek region start; given as a flat address
LENGTH Length of peek region
Number of BYTES, WORDS, or DWORDS desired. The
maximum number of BYTES returned is 16, the maximum
number of WORDS returned is 8, and the maximum
number of DWORDS returned is 4.
DATA Requested memory; contents of the requested block of
memory

Packet Definitions
1 3.6.2 Memory poke (cmd_code 5, 6, 7)

2 When the DM sends a Memory Poke Request message to the DMSS, the DMSS writes the data
3 provided into its memory and responds with a Memory Poke Response message. The poke
4 request may specify BYTES, WORDS, or DWORDS and has a maximum size of 4 bytes,
5 2 words, or 2 dwords. The response to a correctly formatted Memory Poke request is a copy of
6 the request. This packet is protected by the DMSS Security Plan. The Security Password Request
7 message must be successfully sent to the DMSS before this message will be accepted.
8 3.6.2.1 Memory poke request

9
Field Description
T
DM sets CMD_CODE to 5 to specify BYTE poke, 6 to
PS
specify WORD poke, or 7 to specify DWORD poke
ADDRESS Address at which to write POKE_DATA; given as a flat
om 23
address
.c 3:
LENGTH sn 5:5 Number of items (bytes, words, or dwords) to be written
POKE_DATA Data to be written
i-n t 0
10
or 5 a
11 3.6.3 Memory poke response

r.h .0
ca .01
12 The Memory Poke Response message is a copy of the Memory Poke Request message. It
13 acknowledges the successful receipt of the request message and the successful poke of the data
os 12
14 contained in that request.

20
15 3.6.4 Port output byte (cmd_code 8)

16 The DM sends a Port Output Byte Request message to cause the DMSS to perform an output to a
17 specified (byte) port. The Port Output Byte Response message is a copy of the request message
18 and acknowledges the successful receipt and processing of the request.
19 The purpose of the Port Output word and byte requests is to allow engineers to directly access
20 CDMA hardware via the DM, if necessary.
21 NOTE: The ports are extremely hardware-dependent. Refer to specific Qualcomm hardware ASIC
22 references for appropriate addresses and values.
23 Port addressing is currently performed by sending a 16-bit offset from 0x0300000. Ports are
24 memory-mapped.
26 must be successfully sent to the DMSS before this message will be accepted.

Packet Definitions
1 3.6.4.1 Port output byte request

2
Field Description
CMD_CODE (8) Message ID
DM sets CMD_CODE to 8 for this message
PORT_ADDR Port address to which output is to be performed
DATA Data byte to output
3
4 3.6.4.2 Port output byte response

5
Field Description
T
PS
DMSS sets CMD_CODE to 8 for this message
om 23
DATA Data byte to output
.c 3:
6
sn 5:5
i-n t 0
7 3.6.5 Port output word (cmd_code 9)

or 5 a
8 The DM sends a Port Output Word Request message to cause the DMSS to perform an output
r.h .0
9 from a specified (word) port. The Port Output Word Response message is a copy of the request
ca .01
10 message and acknowledges the successful receipt and processing of the request.
os 12
The ports are extremely hardware-dependent. Refer to specific hardware references for
20
11 NOTE:
12 appropriate addresses and values.
14 memory-mapped.
15 This packet is protected by the DMSS Security Plan. The Security Password request message
17 3.6.5.1 Port output word request

18
Field Description
DATA Data word to output
19
20 3.6.5.2 Port output word response

21 The format of the Port Output Word Response message is identical to the format of the Port
22 Output Word Request message.

Packet Definitions
1 3.6.6 Port input (cmd_code 10)

2 The DM sends a Port Input Request message to cause the DMSS to perform an input from a
3 specified (byte) port and return the byte in a Port Input Response message.
4 NOTE: The ports are extremely hardware-dependent. Refer to specific hardware references for
7 memory-mapped.
10 3.6.6.1 Port input request
T
11
PS
Field Description
om 23
.c 3:
sn 5:5
PORT_ADDR Port address from which to perform input
12
i-n t 0
or 5 a
13 3.6.6.2 Port input response

r.h .0
14
ca .01
Field Description
os 12

20
PORT_ADDR Port address from which input was performed

DATA Data byte input
15
16 3.6.7 Port input word (cmd_code 11)

17 The DM sends a Port Input Word Request message to cause the DMSS to perform an input from
18 a specified (word) port and return the word in a Port Input Word Response message.
19 NOTE: The ports are extremely hardware-dependent. Refer to specific hardware references for
22 memory-mapped.

Packet Definitions
1 3.6.7.1 Port input word request

2
Field Description
PORT_ADDR Port address from which to perform input
3 3.6.7.2 Port input word request

4
Field Description
T
PORT_ADDR Port address from which input was performed
PS
DATA Data word input
om 23
.c 3:
5 3.6.8 Logging mask (cmd_code 15) sn 5:5
6 The Logging Mask Request message is sent by the DM to the DMSS to instruct the DMSS to
i-n t 0
7 collect (or to stop collecting) log data of a specified sort. The mask is a 32-bit value, with each bit
or 5 a
8 position specifying a different type of log data. The first log item is represented by bit 0, the
9 second by bit 1, and so on. When a log item becomes available in the DMSS, it consults the mask
r.h .0
10 and if the bit corresponding to that log item type is 1, then the log item is placed in a queue
ca .01
11 waiting for output. The DM should use the Log Request message (Section 3.6.9.1) to retrieve log
messages from the DMSS log output queue, one at a time.
os 12
12
20
13 There is no restriction on the set of log mask bits, other than the bandwidth of the channel
14 between the DM and the DMSS. If the log queue in the DMSS is full when a new log message is
15 created, the new log message will be dropped. Therefore, if the DM cannot request and receive
16 the queued log items fast enough, log data will be lost.
17 After receiving and processing a Logging Mask Request message, the DMSS returns a Logging
18 Mask Response message to the DM.
19 3.6.8.1 Logging mask request

20
Field Description
MASK 32-bit mask identifying items to log
Note that this is sent in Intel-ordered format, low byte first

Packet Definitions
1 3.6.8.2 Logging mask response

2
Field Description
3
4 3.6.9 Log request (cmd_code 16)

5 The DM sends a Log Request message to retrieve a single queued log item from the DMSS. The
6 DMSS removes the oldest log item (if any), places it in a Log Response message, and outputs this
7 to the DM. See Section 3.3.7 for further logging information. This command code is almost never
8 used, because WCDMA AMSS builds support streaming diag.
T
PS
9 3.6.9.1 Log request
om 23
10
.c 3:
Field sn 5:5 Description
i-n t 0
11
or 5 a
r.h .0
12 3.6.9.2 Log response

ca .01
13
os 12
Field Description
20

MORE More log data available indicator
Indicates how many log entries (not including the entry
returned with this message) are queued in the DMSS
LENGTH Length of the included LOG_ITEM
Length in bytes of LOG_ITEM
LOG_ITEM Log data
LOG_ITEM formats
14

Packet Definitions
1 3.6.10 Nonvolatile memory peek (cmd_code 17)

2 The nonvolatile memory of the DMSS is not addressed as normal RAM and ROM are addressed;
3 it requires a separate peek-and-poke facility.
4 The DMSS requests the contents of a region of the DMSS nonvolatile memory using the
5 Nonvolatile Memory Peek Request message. The DMSS retrieves the data and returns it in a
6 Nonvolatile Memory Response message.
7 NOTE: You will normally want to use a Nonvolatile Item Read, which knows the layout of the NV. Peek
8 only performs raw reads.
9 The NVM is treated as a flat, 16-bit address space. An ADDRESS of 0x1000 accesses the
10 0x1000th byte of the NVM. The current DMSS uses 8 K of NVM, which means that addresses
11 are limited to 0x0000 through 0x3FFF.
12 This packet is protected by the DMSS Security Plan. Before this message will be accepted, the
T
Security Password Request message must be successfully sent to the DMSS.
PS
13
14 This operation is no longer active for most addresses.
om 23
.c 3:
15 3.6.10.1 Nonvolatile memory peek request sn 5:5
16
Field Description
i-n t 0

or 5 a

r.h .0
ADDRESS Address of region in NV memory

ca .01
16-bit word address of region to read; NV memory starts at

address 0
os 12
LENGTH Number of bytes to return, up to 32

20
17 3.6.10.2 Nonvolatile memory peek response

18
Field Description
16-bit word address of region read, NV memory starts at
address 0
LENGTH Number of bytes in PEEK_DATA array, up to 32
PEEK_DATA Data array
The first LENGTH bytes are the peek data
19

Packet Definitions
1 3.6.11 Nonvolatile memory poke (cmd_code 18)

2 The DM sends a Nonvolatile Memory Poke Request message to the DMSS to write values to the
3 DMSS nonvolatile memory. The DMSS writes the data to nonvolatile memory, and then returns a
4 Nonvolatile Memory Poke Response message.
5 NOTE: To set a specific item stored in the NV, the Nonvolatile Item Write Request should be used, as it
6 handles all the NV layout problems.
7 You will normally want to use a Nonvolatile Item Write – it knows the layout of the NV, while
8 Poke only performs raw writes.
11 This operation is no longer active for most addresses.
T
3.6.12 Nonvolatile memory poke response
PS
12
13
om 23
Field Description
.c 3:
sn 5:5
i-n t 0

16-bit word address of region to write, NV memory starts
or 5 a
at address 0
r.h .0
LENGTH Number of bytes in POKE_DATA array, up to 32

ca .01
POKE_DATA Data array

The first LENGTH bytes are the poke data
os 12
14
20
15 3.6.12.1 Nonvolatile memory poke response

16 The format of the Nonvolatile Memory Poke Response message is identical to the format of the
17 Nonvolatile Memory Poke Request message.
18 3.6.13 Bad command (cmd_code 16)
19 3.6.13.1 Bad command response

20 This message is special. The DM should not be generating request packets of this type. If the DM
21 sends a message that is unrecognized by the DMSS, the DMSS returns a Bad Command
22 Response message. This message contains the first 16 bytes of the unrecognized message.
23
Field Description
DATA First 16 bytes of unrecognized message
24

Packet Definitions
1 3.6.14 Bad parameters (cmd_code 20)
2 3.6.14.1 Bad parameters response

3 This message is special. The DM should not generate request packets of this type. If the DM
4 sends a recognizable message that has invalid or inconsistent parameters, the DMSS returns a
5 Bad Parameters Response message. This message contains the first 16 bytes of the misformed
6 message.
7
Field Description
DATA First 16 bytes of misformed message
T
PS
8 3.6.15 Bad length (cmd_code 21)
om 23
3.6.15.1 Bad length response
.c 3:
9
sn 5:5
i-n t 0
11 sends a message with an invalid length, the DMSS returns a Bad Length Response message. This
or 5 a
12 message contains the first 16 bytes of the message from the DM.
r.h .0
13
ca .01
Field Description
os 12

20
DATA First 16 bytes of message with bad length
14 3.6.16 Bad mode (cmd_code 24)
15 3.6.16.1 Bad mode response

17 sends a message requesting an action that can only be performed when the DMSS is in a specific
18 mode and the DMSS is not in that mode, the DMSS returns a Bad Mode Response message. For
19 example, a Nonvolatile Item Write Request can only be performed in an OFFline state (OFFline
20 analog or OFFline digital). This error will be returned if the DMSS is in an online state.
21
Field Description
DATA First 16 bytes of request message
22

Packet Definitions
1 3.6.17 Diag version (cmd_code 28)

2 The DM checks the version of the DM/DMSS packet interface in use by the DMSS by sending a
3 Diag Version Request message. The DMSS responds by sending a Diag Version Response
4 message containing the version number. If the version being used by the DMSS is not the same as
5 the version being used by the DM, proper interpretation of all packets is not guaranteed.
6 3.6.17.1 Diag version request

7
Field Description
8
T
9 3.6.17.2 Diag version response
PS
10
om 23
Field Description
.c 3:
CMD_CODE (28) sn 5:5 Message ID
DIAG_VERSION Version of Diagnostic Interface used by DMSS
i-n t 0
The version number is 7. For streaming-capability phones,

or 5 a
the version number is 8.

11
r.h .0
ca .01
3.6.18 Timestamp (cmd_code 29)

os 12
12
20
13 The Timestamp Request message is sent from the DM to the DMSS to request the current time in
14 the DMSS. This is returned in the Timestamp Response message.
15  DMSS timestamp
16  Format
17 – 48 bits – 1.25 ms counter
18 – 6 bits – 1.25 ms/40 counter (32 kHz clock)
19 – 2 bits – unused
20 – 8 bits – CFN
21 3.6.18.1 Timestamp request

22
Field Description

Packet Definitions
1 3.6.18.2 Timestamp response

2
Field Description
TIME_STAMP Current time read from DMSS system time clock
Format as above
3
4 3.6.19 Text message (cmd_code 31)

5 As a diagnostic aid, the DMSS records text messages at various points in its execution. The
6 messages provide developers with insight into the behavior of the DMSS program. The messages
T
7 consist of fixed text, determined at compile time, plus three DWORD parameters that are
PS
8 determined at run time. A severity level is associated with each message. The module name and
source code line number of each message are also reported.
om 23
9
.c 3:
10 The DM can extract these stored messages from the DMSS by sending a Message Request
sn 5:5
11 message. The Message Request message contains a severity level code to specify that messages
12 below the specific level are to be discarded. The DMSS returns a single message in the Message
i-n t 0
13 Response message and indicates whether or not additional messages are waiting to be retrieved.
or 5 a
NOTE: Severity levels are compile-time configurable in the DMSS as well; therefore, some of these
r.h .0
14
message levels will never be available. For example, even if you request MSG_LVL_LOW and
ca .01
15
16 above, some modules may only contain MSG_LVL_HIGH and above.

os 12
20
17 These messages are subject to change and may not be present in all versions of software, or in all
18 phones. These messages are not and never will be documented.
19 3.6.19.1 Message request

20
Field Description
MSG_LEVEL Minimum message severity level
21
22

Packet Definitions
1 3.6.19.2 Message response

2
Field Description
QUANTITY Number of messages in the message queue in the phone,
including with this message; (all fields in the message are
sent, but the data is not valid from MSG_LEVEL on)
DROP_CNT Total number of messages dropped between this message
and the previous message
If the DM cannot retrieve the messages as fast as they are
generated by the DMSS, the newly arriving messages are
dropped
TOTAL_MSGS Total number of messages generated by DMSS
MSG_LEVEL Severity level of the message
T
See descriptions in Section 3.6.36.14
PS
FILE_NAME NULL – Terminated filename identifying location of
message, such as mccdma.c
om 23
Long file names are truncated to this length
LINE_NUMBER
.c 3: Line number identifying location of message in file
sn 5:5
FILE_NAME
i-n t 0
FMT_STRING Fixed text string with formatting specifiers

Formatting specifiers in the text string are replaced with
or 5 a
the formatted contents of CODE1, CODE2, and CODE3 in

the order they are encountered.
r.h .0
Formatting specifiers allowed

ca .01
CODE1 First replaceable value, signed

os 12
Used as value for first formatting specifiers

20
CODE2 Second replaceable value, signed

Used as value for second formatting specifiers
CODE3 Third replaceable value, signed
Used as value for third formatting specifiers
TIME Time the message was originally generated (not
transmitted)
Format is identical to time in the Timestamp Stamp
Response message
3
4 3.6.20 Handset emulation keypress (cmd_code 32)

5 Handset keypresses and other handset conditions can be provided through the serial data
6 interface. The DM sends a Handset Emulation Keypress request message that contains the
7 indicated keypress. This keypress is inserted into the stream of keypresses between the handset
8 driver and the user interface software. A Handset Emulation Keypress Response message is
9 returned to the DM.
10 Handset Emulation Keypress Requests were previously honored only when actual handset input
11 was prohibited. This restriction required DM messages to lock and then unlock the handset. It is
12 now up to the user to decide whether keypress input should be allowed from both sources
13 simultaneously. See Section 3.6.21 for more information about locking and unlocking.

Packet Definitions
1 3.6.20.1 Handset emulation keypress request

2
Field Description
HOLD Key release indicator
KEY Desired keypress
3
4 KEY keypress values

5
Key Explanation
HS_NONE Do not use
RESERVED Reserved
T
HS_PF1_K Left-side special function button
PS
HS_PF2_K Right-side special function button
om 23
HS_MSG_K Message button
.c 3:
HS_POUND_K # key
sn 5:5
HS_STAR_K * key
HS_0_K 0 key
i-n t 0
HS_1_K 1 key
or 5 a
HS_2_K 2 key
r.h .0
HS_3_K 3 key
ca .01
HS_4_K 4 key
os 12
HS_5_K 5 key
20
HS_6_K 6 key
HS_7_K 7 key
HS_8_K 8 key
HS_9_K 9 key
HS_SEND_K Send key
HS_END_K End key
HS_CLR_K Clear key
Clear All when held down
HS_UP_K Volume key up
HS_DOWN_K Volume key down
HS_PWR_K Power key
HS_INFO_K Info button
HS_FREE_K Phone placed in hands-free cradle
HS_PHONE_K Phone lifted from hands-free cradle
HS_IGN_OFF_K Ignition was turned OFF
HS_IGN_ON_K Ignition was turned on
HS_EXT_PWR_ON_K External Power turned on
HS_EXT_PWR_OFF_K External Power turned OFF
RESERVED Reserved

Packet Definitions
Key Explanation
RESERVED Reserved
HS_HFK_CORD_K Coil cord car kit
HS_HFK_NOCORD_K Non-coil cord car kit
HS_HEADSET_K Headset (Hands-Free mode)
HS_DEV_UNKNOWN_K Unknown device (Hands-Free mode)
HS_EXT_DEV_K External device attached
HS_RELEASE_K Key to note that all keys are up
1
2 3.6.20.2 Handset emulation keypress response

3 The format of the Handset Emulation Keypress Response message is identical to the format of the
4 Handset Emulation Keypress Request message. It is sent by the DMSS in response to the Request
T
message.
PS
5
om 23
6 3.6.21 Handset emulation lock/unlock (cmd_code 33)
.c 3:
To prevent the collision of input, you may want to restrict the remote input of handset keystrokes.
sn 5:5
7
8 You can lock and unlock the handset by using a Handset Emulation Lock/Unlock Request
i-n t 0
9 message. The DMSS returns a Handset Emulation Lock/Unlock Response message after the lock
or 5 a
10 or unlock activity is performed.

r.h .0
3.6.21.1 Handset emulation lock/unlock request

ca .01
11
12
os 12
Field Description
20

LOCK Lock/Unlock command
13
14 3.6.21.2 Handset emulation lock/unlock response

15 The format of the Handset Emulation Lock/Unlock Response message is identical to the format
16 of the Handset Emulation Lock/Unlock Request message. It is sent by the DMSS in response to
17 the Request message.
18 3.6.22 Handset emulation display (cmd_code 34)

19 The DM uses the Handset Emulation Display Request message to get a snapshot of the DMSS
20 screen and annunciator status. The DMSS returns a Handset Emulation Display Response
21 message.
22 The display of the DMSS is composed of two sets of components. There is a normal screen and
23 annunciator set, then a blink screen and annunciator set. Every BLINK_RATE ms, the DMSS
24 switches between the two sets. Differences in the sets will make that difference appear to blink.
25 For example, if the Roam annunciator is set in ANNUNCIATORS, but not in
26 BLINK_ANNUNCIATORS, the Roam annunciator will blink.

Packet Definitions
1 3.6.22.1 Handset emulation display request

2
Field Description
3
4 3.6.22.2 Handset emulation display response

5
Field Description
BACKLIGHT Current state of backlight
T
SCREEN One byte for each character position on the screen in row-
PS
by-row format (screen dimensions are 4 by 12)
SCREEN (cont)
om 23
RESERVED Reserved
.c 3:
ANNUNCIATORS Current state of the annunciators, one bit per annunciator:
sn 5:5
BLINK_SCREEN Like SCREEN, but shown during the BLINK portion of the
i-n t 0
screen cycle
BLINK_ANNUNCIATORS Like ANNUNCIATORS, but shown during the BLINK
or 5 a
portion of the screen cycle

r.h .0
RSSI Number of bars set in the RSSI annunciator (1-5)

ca .01
BLINK_RATE Pause between toggling from the normal screen set to the
blink screen set, and then back again (in ms)
os 12
RESERVED Reserved
20
7 3.6.23 Nonvolatile item read (cmd_code 38)

8 Data stored in the DMSS nonvolatile memory is available to the DM through use of the
9 Nonvolatile Item Read Request message. The DM specifies the item by ID in the request message
10 and, after retrieving the data, the DMSS returns it in a Nonvolatile Item Read Response message.
11 This response message contains the item in ITEM_DATA and is identical in format to the request
12 message. Some of these NV memory items are considered to be Service Programming variables,
13 and these are protected by a security code.
14 This message should be used, rather than the Nonvolatile Memory Peek Request, to retrieve a
15 specific item, since that does not handle any of the NV memory layout issues.

Packet Definitions
1 3.6.23.1 Nonvolatile item read request

2
Field Description
NV_ITEM Item ID
DM sets this field to select the item to be read
ITEM_DATA Nonvolatile memory data item
The DM may specify parameters in this area (i.e., to select
one of an array of elements). The DMSS places the
requested data in this field.
STATUS Status of the NV Read operation
DMSS sets this field on return to indicate the status of the
read operation
T
PS
3
om 23
4 3.6.23.2 Nonvolatile item read response
.c 3:
The format of the Nonvolatile Item Read Response message is identical to the format of the
sn 5:5
5
6 Nonvolatile Item Read Request message.

i-n t 0
or 5 a
7 3.6.24 Nonvolatile item write (cmd_code 39)

r.h .0
ca .01
8 3.6.24.1 Nonvolatile item write request

os 12
9 The DM changes the value of an item stored in the DMSS nonvolatile memory by sending a
20
10 Nonvolatile Item Write Request message. The DM specifies the item and its new value. This
11 message will be accepted by the DMSS only if the DMSS has been placed in the OFFline state
12 with a Mode Change Request message. Some of these NV memory items are considered to be
13 Service Programming variables, and these are protected by a security code.
14 This message should be used, rather than the Nonvolatile Memory Poke request, to write a
15 specific item, since that does not handle any of the NV memory layout issues.
16 For the special case of writing the ESN, this packet is protected by the DMSS Security Plan. The
17 Security Password Request message must be successfully sent to the DMSS before this message,
18 with the NV_ITEM == NV_ESN_I, will be accepted.
19
Field Description
NV_ITEM Item ID
DM sets this field to select the item to be written
ITEM_DATA Nonvolatile memory data item
The DM may specify parameters in this area (to select one
of an array of elements, for example). The DMSS places
the data to be written in this field.

Packet Definitions
Field Description
STATUS DMSS sets this field to indicate the status of the write
operation
 0 – Request completed OK
 1 – Internal DMSS use
 2 – Unrecognizable command
 3 – NV memory is full
 4 – Command failed
 5 – Variable was not active (never written) (should not
get this status in a write response)
 6 – Bad parameter in command block (may indicate this
item does not exist for this phone or for the specified
index for this phone)
 7 – Item was read-only
 8 – Item not defined for this target
 9 – Free memory exhausted
T
 10 – Internal use
PS
1
om 23
.c 3:
2 3.6.24.2 Nonvolatile item write response sn 5:5
3 The format of the Nonvolatile Item Write Response message is identical to the format of the
i-n t 0
4 Nonvolatile Item Write Request message.

or 5 a
3.6.25 Mode change (cmd_code 41)

r.h .0
5
ca .01
6 Certain actions by the DMSS are not possible during normal operation. These include IS-55 type
analog tests, writes to DMSS nonvolatile memory, and others. The DMSS is instructed to enter
os 12
the special test modes and to return to normal operation using the Mode Change Request
20
9 message. The OFFline modes are OFFline Analog and OFFline Digital. The only exit from the
10 OFFline modes is through a restart. The DMSS may be power-cycled to produce this reset, or the
11 DM may send a Reset mode to reset the DMSS. The Reset mode command will cause the phones
12 to power cycle.
13 The Mode Change Response message is returned to the DM to indicate that the Mode Change
14 Request message has been received correctly and the mode change has been requested. The actual
15 mode change will occur a short time later.
16 3.6.25.1 Mode change request

17
Field Description
MODE Selected operating mode
 0 – OFFline Analog mode
 1 – OFFline Digital mode
 2 – reset
18

Packet Definitions
1 3.6.25.2 Mode change response

2 The format of the Mode Change Response message is identical to the format of the Mode Change
3 Request message.
4 3.6.26 Error record retrieval (cmd_code 42)

5 When the DMSS software encounters an error condition, it stores an error record in its
6 nonvolatile memory. An error is defined uniquely by its source file and line number. Another
7 invocation of an error that has already been recorded does not allocate another error record, it
8 increments the count for the existing error. There are dozens of potential errors in the DMSS
9 code. There is room in the NV for 20 different error records, each of which includes the number
10 of times the error has occurred, the source file and line of the location of the software reporting
11 the error, and whether the error was fatal. Fatal errors cause the DMSS to reset, nonfatal errors do
12 not.
T
13 The error number (0 to 19) does not indicate anything about the errors, other than the order in
PS
14 which they were recorded. It is only a 20-position array, and as a new error needs to be recorded,
15 a new error record is used to record it.
om 23
3.6.26.1 Error record retrieval request
.c 3:
16
sn 5:5
17
i-n t 0
Field Description
or 5 a

r.h .0

ca .01
18
os 12
3.6.26.2 Error record retrieval response

20
19
20
Field Description
ERR_COUNT Error count
The number of ERR_RECORDS that have valid error data
ERR_IGNORED Errors ignored count
Number of errors ignored since last DMSS reset; this
occurs when another error record cannot be allocated, or
the COUNT for a specified error is saturated.
ERR_RECORDS 20 of the following 5 records
20 occurrences of the following record, one
per error
ADDR Error address
Index (0-19) of this error record; sequential
COUNT Error count
Number of times this error has been recorded; if zero, this
error record is empty; this saturates at 255.

Packet Definitions
Field Description
FILE_NAME Root name of file
The root name of the file where the error was detected,
such as mobile for mobile.c; long file names are truncated
to the first eight characters
LINE_NUM Line number within file
The line number within FILE_NAME where the error was
detected
FATAL Error fatal indicator
If nonzero, the error was fatal; If zero, the error was
nonfatal
1
2 3.6.27 Error record clear (cmd_code 43)
T
3 The accumulated error statistics in the DMSS can be cleared by sending an Error Record Clear
PS
4 Request message. A single error record (identified by index, 0 to 19) or all error records
(identified by index -1) may be cleared with a single Error Record Clear Request message. After
om 23
5
6 clearing the specified error record, the DMSS shall send an Error Record Clear Response
.c 3:
7 message to the DM. sn 5:5
i-n t 0
8 3.6.27.1 Error record clear request

or 5 a
Field Description
r.h .0
ca .01

os 12
ERROR_REC Index of error record to be cleared

20
If ERROR_REC is -1 (0xFF), the DMSS shall clear all error

records; if ERROR_REC is between 0 and 19, inclusive,
the DMSS shall clear the error record specified by
ERROR_REC
10 3.6.27.2 Error record clear response

11 The format of the Error Record Clear Response message is identical to the format of the Error
12 Record Clear Request message.
13 3.6.28 Direct test (cmd_code 46)

14 The DMSS is commanded to perform OFFline tests using the Directed Test Request message.
15 The DMSS responds to the DM by performing, or in some cases, initializing, the specified test,
16 and then sends the Directed Test Response message that contains results. The set of directed tests
17 consists of the analog tests specified in Section 8 of [S16].
18 The phone must be in an OFFline state for these tests to be performed. Use the Mode Change
19 Request message see Section 3.6.25 with the mode set to OFFline Analog.

Packet Definitions
1 3.6.28.1 Directed test request

2
Field Description
TEST_CODE Directed Test code
DM sets this code to specify the desired test
TEST_PARAMETERS Parameters for directed test
The DM supplies parameters for some of the directed
tests; this field shall be zero-filled to a length of 6 bytes by
the DM for all tests that do not require 6 bytes of
parameters
3
T
PS
4 3.6.28.2 Directed test response
5
om 23
Field Description
.c 3:
sn 5:5
i-n t 0
TEST_CODE Directed test code

or 5 a
The DMSS shall set this field equal to the TEST_CODE

field in the Directed Test Request Message just received
r.h .0
TEST_RESULTS Results of test

ca .01
The DMSS returns results for some of the directed tests it

performs. This field shall be ignored by the DM, except for
os 12
the values of TEST_CODE listed in the following text.

20
7 3.6.29 Vocoder PCM loopback (cmd_code 49)

8 The DM requests the DMSS to order the vocoder to start or stop PCM loopback by sending the
9 DMSS a Vocoder PCM Loopback Request message. The DMSS requests the vocoder to start or
10 stop performing PCM loopback according to the status of the Boolean field PCM_LB.
11 In PCM loopback, the vocoder loops back the PCM samples from the encoder’s input samples as
12 the decoder’s output samples. Voice entering the DMSS microphone should be echoed in the
13 DMSS earpiece.
14 3.6.29.1 Vocoder PCM loopback request

15
Field Description
PCM_LB PCM loopback on/OFF indicator
16

Packet Definitions
1 3.6.29.2 Vocoder PCM loopback response

2 The format of the Vocoder PCM Loopback Response message is identical to the format of the
3 Vocoder PCM Loopback Request message.
4 3.6.30 Vocoder PKT loopback request (cmd_code 50)

5 The DM requests the DMSS to order the vocoder to start or stop packet loopback by sending the
6 DMSS a Vocoder PKT Loopback Request message. The DMSS requests the vocoder to start or
7 stop performing packet loopback according to the status of the Boolean field PKT_LB.
8 In packet loopback, the vocoder loops vocoder input packages back as output. The DMSS will
9 thus echo any vocoder data it receives over the air.
10 3.6.30.1 Vocoder PKT loopback request

11
T
PS
Field Description
om 23
.c 3:
PKT_LB PKT Loopback on/OFF indicator
sn 5:5
12
i-n t 0
or 5 a
13 3.6.30.2 Vocoder PKT loopback response

r.h .0
14 The format of the Vocoder PKT Loopback Response message is identical to the format of the
ca .01
15 Vocoder PKT Loopback Request message.

os 12
3.6.31 Switch to downloader (cmd_code 58)

20
16
17 Sending a Switch to Downloader Request message will cause a jump to the resident downloader.
18 In response, the phone sends a Switch to Downloader Response message before it jumps to the
19 resident downloader. The DMSS must be in an OFFline state to accept this command (see Section
20 3.6.25 for information about changing modes). ONce in the resident downloader, the packet
21 protocol is defined in [Q3].
22 3.6.31.1 Switch to downloader request

23
Field Description
The downloader sets CMD_CODE to 58 for this message.
24
25 3.6.31.2 Switch to downloader response

26 The format of the Switch to Downloader Response message is identical to the format of the
27 Switch to Downloader Request message. It is sent from the DMSS to the downloader.

Packet Definitions
1 3.6.32 Service programming code (cmd_code 65)
2 3.6.32.1 Service programming code request

3
Field Description
SECURITY_CODE 6 bytes of security code, in ASCII format (digits 0 to 9 only)
4
5 3.6.32.2 Service programming code response

6
Field Description
T
PS
om 23
SPC_RESULT Result of the SPC
.c 3:
7
sn 5:5
i-n t 0
8 3.6.33 Bad SPC mode (cmd_code 66)

or 5 a
r.h .0
9 3.6.33.1 Bad SPC mode response

ca .01
os 12
11 sends a request to read or write an item that is considered to be part of service programming and
20
12 the correct SPC has not yet been entered to unlock service programming, this command code is
13 sent in response. This message contains the first 16 bytes of the OFFending message.
14
Field Description
DATA First 16 bytes of disallowed request
15
16 3.6.34 Serial mode change (cmd_code 68)

17 The Serial Mode Change Request message tells the phone to change its serial mode from
18 Diagnostic mode to Data Services mode (modem-emulation mode). The phone responds with the
19 Service Programming Code Response message and, a short time later, switches to Data Services
20 mode. This message is only implemented in phones with Data Services. After this command is
21 issued, the phone will no longer be in Diagnostic mode, but will be able to accept AT commands.

Packet Definitions
1 3.6.34.1 Serial mode change request

2
Field Description
3
4 3.6.34.2 Serial mode change response

5
Field Description
MODE_CHG_RESULT Result of the mode change
 1 – Mode was successfully changed to Data mode
T
PS
 0 – Mode was not successfully changed
6
om 23
3.6.35 Bad security mode (cmd_code 71)
.c 3:
7
sn 5:5
i-n t 0
8 3.6.35.1 Bad security mode response

or 5 a
9 This message is special. The DM should not be generating request packets of this type. If the DM
r.h .0
10 sends a request to perform an operation that is considered a secure operation and the correct
ca .01
11 Security Password has not yet been entered to unlock the phone, this command code is sent in
response. This message contains the first 16 bytes of the OFFending message.
os 12
12
13
20
Field Description
DATA First 16 bytes of disallowed request
14
15 3.6.36 Embedded file system operation (cmd_code 89)

16 When the DM sends an Embedded File System Operation Request message, the DMSS responds
17 with an Embedded File System Operation Response message.
18 Since multiple operations can be performed with this request message, each operation includes
19 operation-specific data that is necessary to complete the operation. Each operation is documented
20 separately in this section.
21 Due to buffer limitations, read and write operations are performed in blocks, often requiring
22 multiple blocks to complete a read or write operation. Multiple blocks are written using a simple
23 sequence numbering scheme and multiple request/response packets. A sequence number of 0
24 indicates a new file. If a sequence number of 0 is specified, any unfinished file transfer will be
25 purged and the new sequence will begin. If the sequence number is overrun, the sequence number
26 following 0xFF should be 0x01.

Packet Definitions
1 3.6.36.1 Embedded file system operation request

2
Field Description
OPERATION Operation to be performed on the EFS
OP_SPEC_DATA Operation-specific data; see Section 3.6.36.3 through
Section 3.6.36.17 for formats for each operation
3
4 3.6.36.2 Embedded file system operation response

5
Field Description
T
PS
OPERATION Operation specified in request message
om 23
STATUS Status of specified operation
.c 3:
OP_SPEC_DATA Operation-specific data; this data is only provided if the
sn 5:5
value of the STATUS field is Success; see Section
3.6.36.3 through Section 3.6.36.17 for formats for each
i-n t 0
operation
or 5 a
6
r.h .0
ca .01
7 3.6.36.3 Common data structures for operations

os 12
8 This section outlines common structures that are used by multiple operations.
20
9 3.6.36.3.1 Filename/directory name structure

10
Field Description
LENGTH Length of null-terminated NAME string (NULL character
included), maximum of 60 bytes
NAME Null-terminated ASCII string that contains the absolute
name of the file or directory being specified (unless
otherwise specified)
11
12 3.6.36.3.2 Data block structure

13
Field Description
LENGTH Length of DATA, maximum of 256 bytes
DATA Data for this block
14

Packet Definitions
1 3.6.36.3.3 File attributes structure

2
Field Description
ATTRIBUTES Attributes of new file
BUFFERING_OPTION Whether to allow file buffering for this file.
CLEANUP_OPTION Cleanup option in case of failure
3
4 3.6.36.4 Create directory operation
5 3.6.36.4.1 Operation-specific data for create directory request

6
Field Description
T
PS
DIR_NAME Directory name; see Section 3.6.38.3for format description
7
om 23
.c 3:
8 3.6.36.4.2 Operation-specific data for create directory response
sn 5:5
9 No additional information is necessary.
i-n t 0
or 5 a
10 3.6.36.5 Remove directory operation

r.h .0
ca .01
11 NOTE: The specified directory must be empty to remove it.

os 12
12 3.6.36.5.1 Operation-specific data for remove directory request

20
13
Field Description
14
15 3.6.36.5.2 Operation-specific data for remove directory response

17 3.6.36.6 Display directory list operation
18 3.6.36.6.1 Operation-specific data for display directory list request

19
Field Description
20

Packet Definitions
1 3.6.36.6.2 Operation-specific data for display directory list response

2
Field Description
NUM_ITEMS Number of items listed in this directory
DIR_LISTINGS Directory listing; see Section 3.6.38.3 for format
description
3
4 3.6.36.7 Display file list operation
5 NOTE: The contents of this section are identical to the contents in Display Directory List Operation.
6 3.6.36.8 Read file operation
T
PS
7 3.6.36.8.1 Operation-specific data for read file request
8
om 23
Field Description
SEQUENCE_NUMBER
.c 3: Sequence number; 0 indicates new listing
sn 5:5
FILE_NAME See Section 3.6.38.3 for format description
i-n t 0
Note: Only include this data if the first block of a file is

being requested. If SEQUENCE_NUMBER is nonzero,
or 5 a
this field is omitted

r.h .0
9
ca .01
10 3.6.36.8.2 Operation-specific data for read file response

os 12
11
20
Field Description
SEQUENCE_NUMBER Sequence number for multiple block reads
This number is 0 for the first block of a file.
MORE Flag to specify if more blocks are to be sent to complete
the file transfer
TOTAL_LENGTH Total length of file, specified in first block of read-only
DATA_BLOCK See Section 3.6.38.3 for format description for format
description

Packet Definitions
1 3.6.36.9 Write file operation
2 3.6.36.9.1 Operation-specific data for write file request

3
Field Description
SEQUENCE_NUMBER Sequence number for multiple block writes; use 0 to start a
new file
MORE Flag to specify if more blocks are to be sent to complete
the file transfer
BEGIN_DATA Data for beginning block of file transfer (format described
in Beginning Block Data)
Note: Only include this data if the first block of a file is
being sent. During subsequent blocks, this field has length
0.
T
DATA_BLOCK See Section 3.6.36.3.2 for format description
PS
4
om 23
5 Beginning block data
.c 3:
6 sn 5:5
Field Description
i-n t 0
OVERWRITE Flag to specify whether to overwrite an existing file with

same name
or 5 a
TOTAL_LENGTH Total length of file to be transferred

r.h .0
ATTRIBUTES See Section 3.6.36.3.3 for format description

ca .01

os 12
Note: ONly include this data if the first block of a file is

being sent; during subsequent blocks, this field has length
20
0
7
8 3.6.36.10 Operation-specific data for write file response

9
Field Description
SEQUENCE_NUMBER Sequence number of transfer
10

Packet Definitions
1 3.6.36.11 Remove file operation
2 3.6.36.11.1 Operation-specific data for remove file request

3
Field Description
4
5 3.6.36.11.2 Operation-specific data for remove file response

7 3.6.36.12 Get file attributes operation
T
PS
8 3.6.36.12.1 Operation-specific data for get file attributes request
9
om 23
Field Description
FILE_NAME
.c 3: See Section 3.6.38.3for format description
sn 5:5
10
i-n t 0
3.6.36.12.2 Operation-specific data for get file attributes response

or 5 a
11
12
r.h .0
Field Description
ca .01

os 12
CREATION_DATE File creation date; see Section 3.6.18 for information

20
LENGTH Logical length of file

13
14 3.6.36.13 Set file attributes operation
15 3.6.36.13.1 Operation-specific data for set file attributes request

16
Field Description
17
18 3.6.36.13.2 Operation-specific data for set file attributes response

20 3.6.36.14 Remote file link operation

21 This operation creates a link to a file that does not reside in the file system data partition.

Packet Definitions
1 3.6.36.14.1 Operation-specific data for remote file link request

2
Field Description
BASE_ADDRESS System address for start of file to be referenced
LENGTH Length (in bytes) of file to be referenced
FILE_NAME See Section 3.6.36.3.1 for format description
3 3.6.36.14.2 Operation-specific data for remote file link response

5 3.6.36.15 Iterative directory list operation
6 NOTE: This section is only valid for builds FS 3.0. If this command is enabled, the Display Directory
T
7 List Operation will not be supported.
PS
3.6.36.15.1 Operation-specific data for iterative directory list request
om 23
8
.c 3:
9
sn 5:5
Field Description
SEQ_NUM Sequence number
i-n t 0
DIR_NAME Directory name; see Section 3.6.36.3.1 for format

or 5 a
description
r.h .0
ca .01
10 3.6.36.15.2 Operation-specific data for iterative directory list response

11
os 12
Field Description
20
SEQ_NUM Sequence number

LOGICAL_SIZE Size of file data
PHYSICAL_SIZE Amount of space consumed on device
DIRNAME_LENGTH Length of directory path in DIR_LISTINGS
DIR_LISTINGS Directory listing; see Section 3.6.36.3.1 for format
description
12
13 3.6.36.16 Iterative file list operation
14 NOTE: The contents of this section are identical to the contents in Iterative Directory List Operation.
15 3.6.36.17 Space available operation
16 3.6.36.17.1 Operation-specific data for space available request

17 No additional information is required.

Packet Definitions
1 3.6.36.17.2 Operation-specific data for space available response

2
Field Description
SPACE_AVAIL Number of bytes available in the file system
3
4 3.6.37 Event report control (cmd_code 96)

5 When the DM sends an Event Report Control Request message, the DMSS responds with an
6 Event Report Control Response message. This command is used to configure the service and for
7 the service to send information. See Section 3.6.38 for information about the Event Report
8 message.
9 3.6.37.1 Event report control request
T
10
PS
Field Description
om 23
.c 3:
sn 5:5 DM sets CMD_CODE to 96 for this message
OPERATION_SWITCH Turn scheduling on or OFF
i-n t 0
11
or 5 a
12 3.6.37.2 Event report control response

r.h .0
13
ca .01
Field Description
os 12

20

LENGTH Length – DMSS sets LENGTH to 0 for this message
14
15 3.6.38 Event report

16 When enabled, the DMSS sends an Event Report message that contains all accumulated event
17 data in the DMSS. This message contains a variable length response.
18 3.6.38.1 Event report

19
Field Description
LENGTH Length in bytes of the fields included in EVENTS
EVENTS Series of events – Format described in EVENT
item definition
20

Packet Definitions
1 3.6.38.2 EVENT item definition

2
Field Description
EVENT_ID Unique Event ID
Format described in EVENT_ID Format Description see
Section 3.6.38.3
TIME Time the event was originally generated (not transmitted)
Format is identical to time, see Section 3.6.18
The length of the timestamp will be determined by a flag in
the EVENT_ID; see EVENT_ID Format Description see
Section 3.6.38.3
PAYLOAD_LEN Length in bytes of the included PAYLOAD_DATA (if
applicable)
PAYLOAD_DATA If this EVENT_ID is specified to contain extra data, it will
be included here
T
3
PS
om 23
4 3.6.38.3 EVENT_ID format description
.c 3:
5
sn 5:5
Field Description
TIME_LENGTH Whether this timestamp is a full or half-timestamp
i-n t 0
The first event in a buffer will always have a full system

or 5 a
timestamp. To conserve bandwidth, subsequent events

will have a truncated timestamp, containing bits 8-23 of the
r.h .0
full system timestamp. If the most significant half of the

ca .01
system timestamp rolls over, a full system timestamp will

be delivered.
os 12
PAYLOAD_LENGTH_FLAG Flag to specify whether PAYLOAD _DATA is present in

20
event
RESERVED Reserved flag bit
EVENT_ID Unique event ID
TOTAL BITS
6
7 3.6.39 Reserved (CMD_CODE 100)

8 Reserved

10 Reserved

12 Reserved

14 Reserved

Packet Definitions

2 Reserved

4 Reserved

6 Reserved

8 Reserved
T
PS
9 3.6.47 Logging configuration (cmd_code 115)
om 23
10 The Logging Configuration Request message is sent by the DM to the DMSS to configure the
.c 3:
11 logging service of the DMSS diagnostics subsystem.
sn 5:5
12 Each equipment ID is configured separately using this command. A bitmask is used to denote all
i-n t 0
13 items for the specified equipment ID. The mask is an array of bytes in which each bit denotes a
or 5 a
14 log item configuration. A bit value of 1 specifies that the item is enabled. A bit value of 0
15 specifies that the item is disabled. The following formulas (C syntax) specify how to look up a bit
r.h .0
16 in the mask, given the item ID:

ca .01
17
os 12
18 extern byte log_mask[];

20
19 array_index = item_id / 8; /* The array index for 'item_id' */

20 byte_mask = 0x01 << (item_id % 8); /* The bit within the byte of'item_id'
21 */
22 if (log_mask[array_index] & byte_mask) /* Check if bit is set */
23 log_mask[array_index] |= byte_mask; /* Set the bit in the mask */
24 log_mask[array_index] &= ~byte_mask; /* Clear the bit in the mask */
25
26 When a log item becomes available in the DMSS, it consults the configuration for that item. If it
27 is enabled and adequate resources are available, the item is logged. After receiving and
28 processing a Logging Configuration Request message, the DMSS returns a Logging
29 Configuration Response message to the DM.
30 This log mask format is different than the Extended Logging Mask Request/Response
31 (CMD_CODE 93). This is due to confusion caused by that nonstandard format. The format of the
32 mask in this packet is defined in the following subsections. For compatibility purposes,
33 CMD_CODE 93 is still supported.

Packet Definitions
1 3.6.47.1 Logging configuration request

2
Field Description
RESERVED This field is reserved.
OPERATION The operation to be performed
OPERATION_DATA Operation-specific data
See Section 3.6.47.8through Section 3.6.47.8 for operation
formats
3
4 3.6.47.2 Logging configuration response

5
T
PS
Field Description
om 23
.c 3:
RESERVED sn 5:5 This field is reserved.
OPERATION Operation to be preformed
i-n t 0
STATUS The status of the operation

or 5 a
OPERATION_DATA Operation-specific data

See Section 3.6.47.8through Section 3.6.47.8 for operation
r.h .0
formats
ca .01
6
os 12
3.6.47.3 Common data structures for operations

20
8 This section outlines common structures that are used by multiple operations.
9 3.6.47.4 Logging range structure

10
Field Description
EQUIP_ID Equipment ID
LAST_ITEM Last supported item for this equipment ID. This indicates
that the range of supported items for the specified
equipment ID is 0 to LAST_ITEM.
11
12 3.6.47.4.1 Logging mask structure

13
Field Description
RANGE Logging range structure see Section 3.6.47.4.1
MASK Array of (LAST_ITEM + 7) / 8 bytes containing the mask
for the specified equipment ID
14

Packet Definitions
1 3.6.47.5 Disable logging operation
2 3.6.47.5.1 Disable logging operation request

3 No additional information specified.
4 3.6.47.6 Disable logging operation response

6 3.6.47.7 Retrieve logging ID ranges operation
7 3.6.47.7.1 Retrieve logging ID operation request

T
3.6.47.7.2 Retrieve logging ID ranges operation response
PS
9
10
om 23
Field Description
.c 3:
RANGES 16 instances of LAST_ITEM, indexed by equipment ID
sn 5:5
11
i-n t 0
3.6.47.8 Set logging mask operation

or 5 a
12
r.h .0
13 3.6.47.8.1 Set logging mask request

ca .01
14
os 12
Field Description
20
MASK_STRUCTURE Logging mask structure

See Logging range structure see Section 3.6.47.4.1 for format
description.
15
16 3.6.47.8.2 Set logging mask response

18 3.6.48 Log on demand message (cmd_code 120)

19 When the DM sends a Log ON Demand Request message with log code, the DMSS checks to see
20 if the log code exists and calls the function associated with it. The status is returned through the
21 Response message.

Packet Definitions
1 3.6.48.1 Log on demand request

2
Field Description
DM sets CMD_CODE to 120 for this message.
LOG_CODE The log code requested
3
4 3.6.48.2 Log on demand response

5
Field Description
T
DMSS sets CMD_CODE to 120 for this message.
PS
LOG_CODE The log code received
om 23
STATUS The status returned by DMSS is one of the following:
.c 3:
6 sn 5:5
i-n t 0
or 5 a
r.h .0
ca .01
os 12
20

1 4 Log Record Structure
2 The following is the general format of the log records.

3
Field Description
Length Specifies the length of log record (the entire record including
Data, LOG_CODE, and Timestamp)
LOG_CODE Specified which log item
T
PS
Timestamp DMSS timestamp format:
Data Data specific to that log type
om 23
.c 3:
4 NOTE: In a number of log_records in this document, a bit mask is defined. The bit masks are to be read
sn 5:5
5 from the Most Significant Bit (MSB) to the Least Significant Bit (LSB). Therefore, in the
sequence of bits 0 0 0 0 0 0 0 0, if the first three bits indicate the alignment, then X Y Z 0 0 0 0 0
i-n t 0
7 will indicate alignment of type X Y Z.

or 5 a
r.h .0
8 Detailed descriptions of each data type that can be included in the DATA section of each log
ca .01
9 packet are provided in the following chapters.

os 12
20

1 5 Lower Layer (LL1)
2 5.1 Receiver front end
3 5.1.1 AGC (LOG_CODE 0xB111)

4 This log packet gives important parameters related to the receiver front end automatic gain
5 control (AGC). The log record is generated every 20 records (10ms with 1Rx antenna per record).
6
T
PS
Field Description
Version Log packet version; range is 0 to 255
om 23
Version – 2 for the log packet structure described below
.c 3:
Number of Records Range is 1 to 20
sn 5:5
AGC mode Range is 0 to 15 (0:Freq scan, 1:Init Acq, 2:Traffic, 3:PBCH,
4:Inter-freq, 5:Online-DRX, 6:Offline-DRX, 15:OFF)
i-n t 0
System frame number System frame number; range is 0 to 1023

or 5 a
Sub frame number Subframe number; range is 0 to 9

r.h .0
Reserved
ca .01
Inner loop gain Unitless (0 to 1) in 16U16. Calculated as x/pow(2,16) where

x = Inner loop gain
os 12
Outer loop gain Unitless (0 to 1) in 16U16. Calculated as x/ pow(2,16) where

20
x = outer loop gain

> Rx antenna index Range 0 to 2 (0: Rx0, 1:Rx1, 2: both Rx)
> LNA Gain State LNA Gain State
Range 0..5
>Reserved
>DVGA bias 5-bit signed DVGA exponent used in HW programming.
Calculate DVGA in dB as 20*log10[x/pow(2,15)*pow(2,y)]
where x= DVGA scale, y= DVGA bias
>DVGA scale 16-bit signed DVGA mantissa used in HW programming.
Calculate in linear scale as x/pow(2,15) where x= DVGA
scale
> Broadband RSSI estimate 12-bit signed Broadband RSSI estimate value in 0.0625 dBm
resolution. Range: (-120 dBm to -10 dBm).
To be displayed in dBm scale after calculating x/16 where
x = Broadband RSSI estimate
x=-1 (unsigned raw number is all 1s) is to be interpreted as
field not populated

Lower Layer (LL1)
Field Description
>Measured total RSSI 10-bit signed RSSI value for all tones in 0.25 dBm resolution.
Range: (-120 dBm to -10 dBm).
x = Measured total RSSI
field not populated
>Measured inband RSSI 10-bit signed RSSI value for all tones in 0.25 dBm resolution.
Range: (-120 dBm to -10 dBm).
x = Measured inband RSSI
field not populated
1 5.2 Searcher and measurement packets
T
PS
5.2.1 LTE LL1 PSS results (LOG_CODE 0xB113)
om 23
2
.c 3:
3 This log packet gives important parameters related to PSS results. The log record is generated
sn 5:5
4 every 5 ms.
5
i-n t 0
Field Description
or 5 a
Version Version number; range is 0 to 255)

r.h .0

ca .01
Reserved
os 12
Subframe number Subframe number; range is 0 to 9

20
System frame number System frame number; range 0 to 1023

Reserved
> Energy_est0 32 bit, Rx ANT0 narrow band (0.96 MHz) energy estimate in
linear scale; range from 0 to 0x7fff,ffff), to be displayed in
logscale after computing 10log10(x/2^30), where x =
Energy_est0
> Energy_est1 32 bit, Rx ANT1 narrow band (0.96 MHz) energy estimate in
linear scale; range from 0 to 0x7fff,ffff), to be displayed in
logscale after computing 10log10(x/2^30), where x =
Energy_est1
Reserved
Number of PSS records Range is 0 to 16
> PSS Peak value In linear scale, range from 0 to 0xffff. To be displayed as
10log10(x/128) in units of dB, where x=PSS Peak Value.
> Peak Position Sample position with 5 ms resolution
(Range is 0 to (9600-1))
> PSS Indices Range is 0 to 2

Lower Layer (LL1)
1 5.2.2 LTE LL1 SSS results (LOG_CODE 0xB115)

2 This log packet gives important parameters related to SSS results. The log record is generated
3 every 5ms. SSS results are based on the most recent PSS/SSS occurrences in the search sample
4 server (not necessarily corresponding to the PSS log results)
5
Field Description
Version Version number; range is 0 to 255
Reserved
Number of barred cells Number of barred cells; range is 0 to 16
> Barred Cell ID Range is 0 to 503
> Reserved
Reserved
T
Number of detected cells Number of detected cells; range is 0 to 16
PS
> SSS Peak value In linear scale, range from 0 to 0xffff..
om 23
> SSS position Start of SSS sequence in search sample server.
Range is 0 to (search sample server
.c 3:
length -1)
sn 5:5
> CP Cyclic prefix used
i-n t 0
> Half Frame Hypothesis

or 5 a
> Cell ID Range is 0 to 503

> Reserved
r.h .0
ca .01
6 5.2.3 LTE LL1 serving cell measurement results (LOG_CODE 0xB116)

os 12
This log packet gives important parameters related to measurements. The log record is generated
20
8 every serving cell measurement occasion.

Field Description
Version – 0 for the log packet structure described
below
Starting SFN Sub/System Frame Number, defined as LSB 3:0 =
Subframe number; range is 0 to 9
LSB 15:4 = System frame number
is Idle mode
Measurement BW Encoded as:
Reserved
Cell ID Range is 0 to 504
Digital Rotator In units of Hz with 1 Hz resolution; range is
-15 kHz to +15 kH
Reserved
Timing offset_Rx Timing offset per Rx antenna with a resolution of 10
ms.
Range is 0 to 307200
Reserved

Lower Layer (LL1)
1 5.2.4 LTE LL1 neighbor cell measurements and tracking (LOG_CODE

2 0xB119)
3 This log packet gives important parameters related to measurements. The log record is generated
4 every scheduling period (SP) which is 40 ms when the neighbor measurements and tracking
5 module is enabled.
6
Field Description
Version Log packet version; range is 0~255
below
Total num ncells Total number of neighbor cells. The packet has a
maximum of 8.
SP_cnt_in_MP Scheduling period count in Measurement Period
T
PS
Mode
om 23
Earfcn Channel raster number
.c 3:
Duplexing mode sn 5:5 Duplexing mode
Num SWRP per MP Number of software reporting periods per
measurement period
i-n t 0
Num CNF msg sent Number of CNF messages sent

or 5 a
Packet counter
r.h .0
Reserved
ca .01
>cell_ID Range is 0~511

os 12
>cp_type
20
Reserved

Lower Layer (LL1)
1 5.2.5 LTE LL1 serving cell FTL results (LOG_CODE 0xB11B)

2 This log packet gives important parameters related to the serving cell frequency tracking loop
3 (FTL). The log record is generated once every 20 Subframes.
4
Field Description
below
Serving Cell ID Range is 0 to 503
T
Reserved
PS
RVAFC mode
om 23
Reserved
>VCO correction Total frequency correction at VCTCXO in 32S16
.c 3: Range: -15 kHz to +15 kHz

sn 5:5
>Rotator correction Total frequency correction at rotator in 32S16
i-n t 0
Range: -15 kHz to +15 kHz

or 5 a
>Inst frequency estimate Instantaneous frequency correction in 32S16. Input to

RV-AFC outer loop.
r.h .0
Reserved
ca .01
os 12
5
20

Lower Layer (LL1)
1 5.2.6 LTE LL1 serving cell TTL results (LOG_CODE 0xB11D)

2 This log packet gives important parameters related to the serving cell time tracking loop (TTL).
3 The log record is generated once every 20 subframes
4
Field Description
below
T
Reserved
PS
Inner loop step size Unitless (0 to 1) in 16U16
>Total timing adjustment Rx Total timing adjustment per Rx antenna in sample
om 23
server samples.
.c 3:
sn 5:5 Q-factor: 16S0
>Inst timing adjustment Rx Instantaneous timing adjustment per Rx antenna in
sample server samples.
i-n t 0
Q-factor: 16S0
or 5 a
>Reserved
r.h .0
ca .01
os 12
20

Lower Layer (LL1)
1 5.2.7 LTE LL1 serving cell frame timing (LOG_CODE 0xB114)

2 This log packet provides information about downlink and uplink timing. When enabled, the log
3 record is generated at least once every 20 subframes. If change in frame timing is outside of the
4 timing adjustment range, a new log is generated.
5
Field Description
below
Number of Records Range is 1 to 20. Each record corresponds to a
subframe.
Starting Subframe number Subframe number; range is 0 to 9
Starting System frame number System frame number; range is 0 to 1023
T
PS
reserved
Starting DL frame timing offset Downlink frame timing offset (in Ts units)
om 23
.c 3:
reserved sn 5:5
Starting UL frame timing offset Uplink frame timing offset (in Ts units)
i-n t 0
Starting UL timing advance Starting NTA value (in units of 16 Ts)

or 5 a
reserved
r.h .0
timing adjustment bits

ca .01
Packed array of 24-bit adjustment records.

os 12
20

Lower Layer (LL1)
1 5.3 Demodulator front end packets
2 5.3.1 LTE LL1 serving cell CER (LOG_CODE 0xB122)

3 This log packet gives important parameters related to the serving cell channel energy response
4 (CER). The log record is generated once every k*50 milliseconds in round robin fashion for each
5 valid Tx-Rx pair, where ‘k’ is configurable.
6
Field Description
below
T
PS
om 23
Reserved
.c 3:
CER Size (P) sn 5:5
Rx antenna number
i-n t 0
Reserved
SCELL Number of Records (CER size) Range is 1 to 512
or 5 a
> CER per Rx-Tx Pair 16 bit unsigned

r.h .0
ca .01
5.3.2 LTE LL1 neighbor cell CER (LOG_CODE 0xB123)

os 12
7
20
8 This log packet gives important parameters related to the neighbor cell Channel Energy Response
9 (CER). The log record is generated event based.
10
Field Description
below
Neighbor Cell ID Range is 0 to 503
Reserved
> Per Tap CER for Rx0 Unitless energy metric; range is 0 to 65535
> Per Tap CER for Rx1 Unitless energy metric; range is 0 to 65535
Reserved
Number of Tx antennas (M)
Number of Rx antennas (N)
Reserved
NCELL Taps Sum Number of Records Range is 1 to 8 (5 bit value)
(M * N) 3 bit (MSB) reserved
> CER per Rx-Tx Pair Unitless energy metric; range is 0 to 65535

Lower Layer (LL1)
1 5.3.3 LTE LL1 PDSCH demapper configuration (LOG_CODE 0xB126)

2 This log packet gives important parameters related to the serving cell Demodulation configuration
3 parameters. The log record is generated once every time a PDSCH needs to be demodulated.
4
Field Description
below
Reserved
T
PDSCH RNTI ID Describes the RNTI ID
PS
PDSCH RNTI type RNTI type
om 23
Reserved
Number of Tx antennas (M)
.c 3:
sn 5:5
Number of Rx antennas (N)
Transmission Mode Range is 0 to 7
i-n t 0
Spatial Rank Range is 0 to 3

or 5 a
RB Allocation Slot 0 Bitmask that tells which RB is allocated in slot 0 (110

r.h .0
bits, “1” means allocated)

ca .01
RB Allocation Slot 1 Bitmask that tells which RB is allocated in slot 0 (110

bits, “1” means allocated)
os 12
Reserved
20
Frequency Selective Precoding Matrix Indicator

(PMI)
Reserved
PMI Index Range is 0 to 15
Reserved
Transport Block Size for Stream 0 Unit – number of bits; range is 0 to 75376
Modulation for Stream 0
Traffic to Pilot Ratio In units of 1/256 from 0 to 15
0x0: 0 to 0xF01: 15.000
Reserved
Transport Block Size for Stream 1 Unit – number of bits; range is 0 to 75376
Modulation for Stream 1
Reserved
PB If number of TX antennas is equal to 1:
Reserved

Lower Layer (LL1)
1 5.3.4 LTE LL1 antenna correlation results (LOG_CODE 0xB120)

2 This log packet gives antenna correlation related parameters. The periodicity of this log packet is
3 configurable. Recommended range is 10 ~ 1000 ms. If a period out of range is specified, the
4 maximum value (1000ms) will be used by default.
5
Field Description
Version Version number; range is 0 to 255
below
Subframe number Subframe number; range 0 to 9
T
Reserved
PS
RSSI_rx RSSI per Rx antenna in dBm. Q-format: 32S24. For
example, -838860800 means (-838860800/2^24)=-
om 23
50dBm.
.c 3:
RSSI sn 5:5 Combined RSSI in dBm. Q-format: 32S24.
Reserved
i-n t 0

or 5 a
> Tx Antenna Range is 0 to 3

> Reserved
r.h .0
> Antenna Correlation Real Real part of Rx0 and Rx1 correlation
ca .01
> Antenna Correlation Imag Imaginary part of Rx0 and Rx1 correlation
os 12
20

Lower Layer (LL1)
1 5.4 Demodulator back end packets
2 5.4.1 LTE LL1 PCFICH decoding results (LOG_CODE 0xB12A)

3 This log packet gives important parameters related to the PCFICH decoding results. The log
4 record is generated once every 20 Subframes or every 100 ms, whichever occurs first.
5
Field Description
below
Number of records Range is 0 to 20
T
PS
Reserved
om 23
.c 3:
CFI sn 5:5 CFI value
Reserved
i-n t 0
> Subframe offset Offset relative to the starting SFN

or 5 a
5.4.2 LTE LL1 PHICH decoding results (LOG_CODE 0xB12C)

r.h .0
6
ca .01
7
os 12
8 This log packet gives important parameters related to the PHICH decoding results. The log record
is generated once after accumulating 20 records or every 100 ms, whichever occurs first.
20
9
10
Field Description
below
Reserved
> Subframe number Subframe number; range is 0 to 9
> System frame number System frame number; range is 0 to 1023
> Decoding Outcome
> Spreading Code Index Range is 0 to 7
> PHICH Group Number Range is 0 to 31
> Reserved

Lower Layer (LL1)
1 5.4.3 LTE LL1 PBCH decoding results (LOG_CODE 0xB12E)

2 This log packet gives important parameters related to the PBCH decoding results. The log record
3 is generated once every PBCH decode attempt.
4
Field Description
below
Reserved
T
Frequency offset Applied In units of Hz with 1 Hz resolution; range is
PS
-15 kHz to +15 kHz
0x0000: -15 kHz to 0x7531: +15 kHz
om 23
Reserved
.c 3:
> Transmit Antenna Config Encoded as:
sn 5:5
i-n t 0
> SFN offset (last 2 bits of Cell SFN) Range is 0 to 7

or 5 a
> CRC Pass/Fail

> Reserved
r.h .0
>Energy_metric Range is 0 to 0xffffff

ca .01
>TX0_RX0_CIR Range is 0 to 0xffffffff

os 12
Exp: 20-23
20
I: 10-19
Q: 0-9
The number = (2^-exp)(Q+iI)
5 5.4.4 LTE LL1 PDCCH decoding results (LOG_CODE 0xB130)

6 This log packet gives important parameters related to the PDCCH decoding results. The log
7 record is generated once every subframe.
8
Field Description
below
Reserved
Number of hypothesis Range is 0 to 43
>Payload Raw payload
> Aggregation Level Number of control channel elements aggregated:

Lower Layer (LL1)
Field Description
> CandIDate CandIDate or offset is measured in units of aggregation
level specified above; range is
0 to 7
> Search Space Type
> DCI Format .
> Decode Status Indicates which one of 16 RNTI/UL Antenna
configurations passed
> Start CCE Starting CCE index (range 0..86)

> Payload Size Payload size (with CRC bits)
> Tail Match Check if the code block ending state matches the
starting state
> Reserved
T
> Prune Status
PS
> Energy Metric Energy metric from decoder
om 23
> Symbol Mismatch Count Symbol mismatching count between received LLR and
re-encoded data
> Reserved
.c 3:
sn 5:5
i-n t 0
1 5.4.5 LTE LL1 PDSCH decoding results (LOG_CODE 0xB132)

or 5 a
2 This log packet gives important parameters related to the PDSCH decoding results. The log
r.h .0
3 record is generated once every 20 subframes or every 100 ms, whichever occurs first.
ca .01
4
os 12
Field Description
20
Version Log packet version; range is 0 to 255.

below
Starting Subframe number Subframe number; range is 0 to 9
Starting System frame number System frame number; range 0 to 1023
Reserved
Reserved
> Subframe OFFset OFFset relative to the starting SFN
> HARQ ID Range is0 to 15
> System Information Msg Number ONly applicable for PDSCH carrying SIB
Range is 1 ~ 10
> PDSCH Channel ID Describes the RNTI
> System Information mask ONly applicable for PDSCH carrying SIB
> Reserved
> Reserved
> Number of Streams
>> Transport Block CRC
>> Code Block CRC Bitmask

Lower Layer (LL1)
Field Description
>> NDI NDI bit
>> Code Block Size Plus Unit – number of bits; range is 0 to 8191
>> Num Code Block Plus Range is 1 to 13
>> Code Block Size Minus Unit – number of bits; range is 0 to 8191
>> Num Code Block Minus Range is 0 to 13
>> Retransmission number
>> RVID
>> Companding Stats
>> HARQ Combining
>> Reserved
1
T
PS
om 23
.c 3:
sn 5:5
i-n t 0
or 5 a
r.h .0
ca .01
os 12
20

Lower Layer (LL1)
1 5.5 Uplink
2 5.5.1 LTE LL1 PUSCH Tx report (LOG_CODE 0xB139)

3 This log packet gives important parameters related to the PUSCH transmit report. The log record
4 is generated once every 20 subframes or every 100 ms, whichever occurs first.
5
Field Description
below
T
PS
Reserved
Dispatch SFN SF System/subframe number, as 10*SFN + SF
om 23
Reserved
.c 3:
>Current SFN SF sn 5:5 System/subframe number, as 10*SFN + SF
>Reserved
i-n t 0
>UL Control MUX Bitmask (ACK/CQI/RI)

or 5 a
>Frequency Hopping
>Re-transmission index CURRENT_TX_NB
r.h .0
>Redundancy version Range is 0 ~ 3

ca .01
>Mirror Hopping
os 12
>Cyclic shift of DMRS Symbols Slot 0 Cyclic shift of DMRS symbols for slot 1. Unit is
20
samples.
Range is 0 to 11
>Cyclic shift of DMRS Symbols Slot 1 Cyclic shift of DMRS symbols for slot 1. Unit is
samples.
Range is 0 to11
>DMRS Root Slot 0 Range is 1 to 1291
>UE SRS ON
>DMRS Root Slot 1 Range is 1 to 1291
>Start resource block (RB) for Slot 0 Range is 0 to 110
>Start resource block (RB) for Slot 1 Range is 0 to 110
>Number of RB Range is 0 to 110
> pusch_tb_size Transport block size in bytes
>Num ACK Bits (nharq) Length of ACK NACK raw payload
>ACK payload ACK / NACK raw payload.
Max length:
>Rate Matched ACK Bits 504 bits

>Num RI Bits (nri)
>RI payload RI raw payload
>Rate Matched RI Bits Range: 0 – 63

Lower Layer (LL1)
Field Description
>pusch_mod_order Modulation order encoded
>PUSCH_DIGITAL_GAIN Digital amplitude gain in dB (beta_pusch is int16. Are

8 bits sufficient?)
>SRS occasion
>Reserved
>Num CQI Bits (ncqi) Range:0~66
>Rate Matched CQI Bits Range: 0~ 4959
>PUSCH Transmit Power (dBm) Range is -50 dBm to 23 dBm, with 1 dB stepsize
>Reserved
>CQI payload CQI raw payload on PUSCH; max length is 96 bits
T
5.5.2 LTE LL1 PUCCH Tx report (LOG_CODE 0xB13C)
PS
1
2 This log packet gives important parameters related to the PUCCH transmit reports. The log
om 23
.c 3:
4 sn 5:5
Field Description
i-n t 0

or 5 a
below
r.h .0

ca .01

os 12
Reserved
20

Reserved
>Current SFN SF System/subframe number, as 10*SFN + SF
>CQI payload Raw CQI payload on PUCCH; max length is 13 bits
>Format
>Start RB Slot 0 Range is 0 to 110
>Start RB slot 1 Range is 0 to 110
>SRS Shorting for 2nd Slot
>UE SRS ON
>DMRS Sequence for Slot 0 index 0 to 29
>DMRS Sequence for Slot 1 index 0 to 29
>ACK payload ACK/NACK raw payload
>Reserved
>Cyclic shift sequence for each symbol Time domain cyclic shifts per symbol per slot
>PUCCH_DIGITAL_GAIN Digital amplitude gain in dB
>PUCCH Transmit Power (dBm) Range is -50 dBm to 23 dBm, with 1 dB stepsize
>Reserved

Lower Layer (LL1)
1 5.5.3 LTE LL1 SRS Tx report (LOG_CODE 0xB140)

2 This log packet gives important parameters related to the PUCCH power control reports. The log
4
Field Description
below
Reserved
Reserved
>Current SFN SF System/subframe number, as 10*SFN + SF
T
PS
>UE SRS Enable
>Cell SRS Enable
om 23
>Start RB Range is 0 to 110
>Number of RB
.c 3: Range is 0 to 110
sn 5:5
>ZC_Root Range is 1 to 1151
i-n t 0
>Cyclic Shift Range is 0 to 7

or 5 a
>Reserved
r.h .0
>SRS Transmit Power (dBm) Range is -50 dBm to 23 dBm, with 1 dB stepsize
ca .01
>Tone offset Enable

>Reserved
os 12
20

Lower Layer (LL1)
1 5.5.4 LTE LL1 RACH Tx report (LOG_CODE 0xB144)

2 This log packet gives important parameters related to the RACH transmit reports. The log record
3 is generated once every RACH attempt.
4
Field Description
below
Reserved
Current SFN SF System/subframe number, as 10*SFN + SF
Reserved
Preamble Sequence Range is 0 to 63
T
Cyclic Shift Range is 0 to 839
PS
Preamble format Range is 0 to 4
om 23
Reserved
First RB for PRACH opportunity Range is 0 to 110. n_ra_prb in sec. 5.7.1 in [S1]
.c 3:
sn 5:5
Reserved
Start RB Range is 0 to 110
i-n t 0
PRACH Transmit Power (dBm) Range is -50 dBm to 23 dBm, with 1 dB stepsize
or 5 a
Logical root (q) Range is 1 to 839

r.h .0
ca .01
5 5.5.5 LTE LL1 AGC Tx report (LOG_CODE 0xB146)

os 12
This log packet gives important parameters related to the TxAGC. The log record is generated
20
7 once every Subframe.

8
Field Description
below
Subframe number Range is 0 to 9
System frame number Range is 0 to 1023
UL chan type UL physical channel type
Slot index Slot index per UL sub-frame
Reserved Reserved
PA Gain State At most three PA gain states:
Tx gain index Current entry number of RTR Linearization Table. At
most 128 entries
Tx gain entry Expected Tx Gain Index output at the current PA
state
Tx output power Expected Tx output power
Reserved
Reserved

Lower Layer (LL1)
1 5.5.6 LTE LL1 PUCCH CSF log (LOG_CODE 0xB14D)

2 This log packet gives important parameters related to the CSF log results in PUCCH periodic
3 reporting mode. The log record is generated on subframes receiving CSF reporting request in
4 periodic reporting mode from ML.
5
Field Description
Start system Subframe number (SFN) Range is 0 to 9
Start system frame number Range is 0 to 1023
CSF_tx_mode Range is 1 to 7
PUCCH_reporting_mode Range is 0 to 3
T
PUCCH_report_type
PS
Size_BWP
om 23
Number of subbands
.c 3:
BWP_Index sn 5:5
Rank Index
SubBand Label
i-n t 0
CQI_CW0
or 5 a
CQI_CW1
r.h .0
Wideband_PMI
ca .01
Reserved
os 12
20
6 5.5.7 LTE LL1 PUSCH CSF log (LOG_CODE 0xB14E)

7 This log packet gives important parameters related to the CSF log results in PUSCH a periodic
8 reporting mode. The log record is generated on subframes receiving CSF reporting request in a
9 periodic PUSCH reporting mode from ML.
10
Field Description
Start system Subframe number (SFN) Range is 0 to 9
Start system frame number Range is 0 to 1023
CSF_tx_mode Range is 0 to 7
PUSCH_reporting_mode Range is 0 to 4
Rank Index
Reserved
Number of subbands Range is 0 to 27
WideBand_CQI_CW0 Range: 0…15
This field is valid for all pusch_reporting_modes

Lower Layer (LL1)
Field Description
WideBand_CQI_CW1 Range: 0…15
This field is valid only when pusch_reporting_mode = 0 or 2
or 4, i.e., in reporting modes 1-2, 2-2, and 3-1
Subband size (k)
Size_M
Single_ WB_PMI
Single_MB_PMI
Reserved
SubBand_ CQI_CW0_sb0
SubBand_ CQI_CW0_sb1 This field is valid only when pusch_reporting_mode = 3 or 4
T
PS
om 23
.c 3:
sn 5:5
i-n t 0

or 5 a

r.h .0

ca .01

os 12
SubBand_ CQI_CW1_sb
20
SubBand_ CQI_CW1_sb1 This field is valid only when pusch_reporting_mode = 4

Reserved
Position of m select subbands_sb0
Position of m select subbands_sb1 This field is valid only when pusch_reporting_mode = 1 or
2, i.e., in reporting modes 2-0 and 2-2

Lower Layer (LL1)
Field Description
2, i.e., in reporting modes 2-0 & 2-2
Reserved
Multi_ SB_PMI_SB0
Multi_ SB_PMI_SB1 This field is valid only when pusch_reporting_mode = 0
Multi_ SB_PMI_SB4
T
PS
om 23
.c 3:
sn 5:5
i-n t 0

or 5 a

r.h .0
Reserved
ca .01
os 12
20

1 6 Management Layer 1 (ML1)
2 6.1 UL/DL/GM configuration log packets
3 6.1.1 LTE ML1 downlink common configuration (LOG_CODE 0xB160)

4 This log packet gives important parameters related to the DL Physical Channel configuration
5 received over broadcast signaling.
T
PS
6
Field Description
om 23
.c 3:
sn 5:5 Version – 1 for the log packet structure described
below
>TDD common cfg present Display cfg params only if cfg is present
i-n t 0
>TDD subframe assignment Display strings

or 5 a
>TDD special subframe patterns Display strings

r.h .0
>UL CP cfg present Display cfg params only if cfg is present

ca .01
>UL CP Display strings

os 12
>reserved0 Reserved for future use

20
>UL cfg present Display cfg params only if cfg is present

>UL Cell earfcn Present Display UL cell earfcn only if UL cell earfcn present is
present
>UL Cell earfcn Parameter – EARFCN, see 5.7.3 in [S16].
18000 <= Range <= 39649
Display integers
>UL Bandwidth Parameter – Uplink bandwidth, 5.6.1 in [S16]
Values mapping:
Display bandwidth in MHz
> Additional Spectrum Emission Present Display additional spectrum emission only if present
>Additional Spectrum Emission See table 6.2.4-1 in [S16]
Range is 1 to 32
Display integers
>MIB info present Display cfg params only if cfg is present
>Num enodeB antenna ports Valid values – 1, 2, 4
Display integers
> PHICH Duration Parameter – PHICH-Duration, see 6.9.3 in [S1]
Display strings
> PHICH Resource Parameter – Ng, see 6.9 in [S1]
Display strings
>PDSCH cfg present Display cfg params only if cfg is present

Management Layer 1 (ML1)
Field Description
> Reference Signal Power Parameter: Downlink Reference-signal transmit
power, see 23, 5.2 in [S3], 6.3.2 in [S6]
Range is -60 to 50 dBm
Display signed integer, e.g., -50 dBm
>P-b Parameter – PB see 23, Table 5.2-1 in [S3], 6.3.2 in
[S6]
P_B indicates the ratio of PDSCH-to-RS EPRE in
symbols with and without reference symbols for 1, 2
or 4 cell specific antenna ports
Display PB<x> string if MIB info present is not
present; otherwise display ratio in integer based on
P-b enum value and Num enodeB antenna ports in
MIB info using above mapping
>mbsfn cfg present Display cfg params only if cfg is present
T
>num_mbms_allocations Range is 0<= range <= 8
PS
Max = 8 (see Section 6.4 in [S6])
Display integers
om 23
Mbsfn_config[i]
.c 3: VARIABLE SIZE ARRAY (VARIABLE ALLOCATION)
sn 5:5
where 0 <= i < num_mbms_allocations based on num_mbms_allocations
i-n t 0
>>allocation offset Parameter: allocation offset (see 6.3.1 in [S6])

Values: [0 to 7]
or 5 a
Display integers
r.h .0
>>allocation period Parameter – allocation period (see 6.3.1 in [S6])

ca .01
Display strings
os 12
>>subfn allocation type Parameter – subfn allocation type (see 6.3.1 in [S6])
Display strings
20
>>reserved2 Reserved for future use

>>subfn allocation mask Parameter – subfn allocation mask based on subfn
allocation type (see 6.3.1 in [S6])
Display all 24 bits in HEX

1 6.1.2 LTE ML1 downlink dedicated configuration (LOG_CODE

2 0xB161)
3 This log packet gives important parameters related to the DL Physical Channels configuration
4 received over dedicated signaling.
5
Field Description
>pucch tpc cfg present Display cfg params only if cfg is present
>Enabled Display strings
>TPC RNTI RNTI for PUCCH power control using DCI format 3/3A,
see 22 in [S2], Section 7.1 in [S5]
T
Range is 0001-003C, 003D-FFF3
PS
Display in integers
Display only if TPC pucch enabled
om 23
>DCI format DCI format 3 or 3A used for TPC Index (see 22, 5.3.3.1.6
.c 3:
and 5.3.3.1.7 in [S2])
sn 5:5
Display strings
i-n t 0
>TPC Index Index of N or M, (see 22, 5.3.3.1.6 and 5.3.3.1.7 in [S2]),

or 5 a
where N or M is dependent on the used DCI format

Range is [1-15] for DCI format 3 and [1-31] for format 3A
r.h .0
Display in integers
ca .01

os 12
>pusch tpc cfg present Display cfg params only if cfg is present
20
>Enabled Display strings

Display only if TPC pusch enabled
>TPC RNTI RNTI for PUSCH power control using DCI format 3/3A
(see 22, 36.321 Section 7.1 in [S2])
Display in integers
>DCI format DCI format 3 or 3A used for TPC Index (see 22, 5.3.3.1.6
and 5.3.3.1.7 in [S2])
Display strings
>TPC Index Index of N or M, (see 22, 5.3.3.1.6 and 5.3.3.1.7 in [S2]),
Range is [1-15] for DCI format 3 and [1-31] for format 3A
Display in integers
> reserved0 Reserved for future use
>Codebook Subset Restriction (least Parameter – codebookSubsetRestriction (23, 7.2 in [S3]
significant word) and 21, 6.3.4.2.3 in [S1])
A bitmask of the codebook restriction. The number of bits
used in the restriction varies with the transmission mode.
The bit mask will be placed in the lower order bits.
Display in HEX

Field Description
>Codebook Subset Restriction (most Parameter: codebookSubsetRestriction (see 23, 7.2 in [S3]
significant word) and 21, 6.3.4.2.3 in [S1])
A bitmask of the codebook restriction. The number of bits
used in the restriction varies with the transmission mode.
The bit mask will be placed in the lower order bits.
Display in HEX
>antenna dedicated cfg present Display cfg params only if cfg is present. Note: codebook
fields above are part of this antenna cfg.
>Transmission Mode Points to one of Transmission modes defined in 7.1 of [S3]
where
Display strings
>Tx Antenna Selection Enabled Display strings
> Tx Antenna Selection Control UE transmit antenna selection control is closed-loop or
open-loop as described in 23, 8.7 in [S3]
T
Display strings
PS
Display if Tx Antenna Selection Enabled is enabled
om 23
>pdsch dedicated config present Display cfg params only if cfg is present
>P-a
.c 3: PA (see 23, 5.2 in [S3])
sn 5:5
Parameter –
Display strings
i-n t 0

or 5 a
>UE related cfg present Display cfg params only if cfg is present
r.h .0
> C-RNTI C- RNTI value (see 7.1 in [S5])

ca .01

Display in integers
os 12
20
1 6.1.3 LTE ML1 uplink common configuration (LOG_CODE 0xB162)

2 This log packet gives important parameters related to the UL Physical Channel configuration
3 received over broadcast signaling.
4
Field Description
Reserved Reserved
>PUSCH Cfg Present
>n_sb Parameter – Nsb (see 21, 5.3.4 in [S1])
Range is 1 to 4
Translation: 0x0 - 1 to 0x3 – 4
>hopping mode Parameter: Hopping-mode (see 21, 5.3.4 in [S1])
>hopping offset HO
Parameter: N RB (see 21, 5.3.4 in [S1])
Range is 0 to 98
>enable 64 QAM Range is 0 to 1
1 indicates that 64 QAM is enabled while 0 indicates that
no 64 QAM is allowed

Field Description
>Group Hopping Enabled Parameter – Group-hopping-enabled (see 21, 5.5.1.3 in
[S1])
Range is 0 to 1
1 indicates that Group Hopping is enabled while 0
Indicates that Group Hopping is disabled
>Group Assignment PUSCH Parameter – ∆SS (see TS 21, 5.5.1.3 in [S1])
Range is 0 to 29
> Sequence Hopping Enabled Parameter – Sequence-hopping-enabled (see 21, 5.5.1.4
in [S1])
Range is 0 to 1
1 indicates that Sequence Hopping is enabled while 0
Indicates that Sequence Hopping is disabled
>Cyclic Shift
(1)
Parameter – cyclicShift
nDMRS (see 21, Table 5.5.2.1.1-2
T
in [S1])
PS
Range is 0 to 7
om 23
>PUCCH Cfg Present
.c 3:
>delta shift
∆PUCCH
Parameter – shift
sn 5:5
(see 5.4.1 in [S1])
Range is 1 to 3
i-n t 0
>n_rb_cqi (2)
Parameter – N RB (see 21, 5.4 in [S1])
or 5 a
Range is 0 to 98
r.h .0
>n_cs_an
N cs(1)
ca .01
Parameter – (see 21, 5.4 in [S1])

Range is 0 to 7
os 12
>n1_pucch_an (1)
20
Parameter – N PUCCH (see 23, 10.1 in [S3])

Range is 0 to 2047
>SRS Cfg Present
>SRS Enable
>SRS Bandwidth Config Parameter – SRS Bandwidth Configuration (see 21, table
5.5.3.2-1, 5.5.3.2-2, 5.5.3.2-3 and 5.5.3.2– 4 in [S1])
Range is 0 to 7
>SRS Subframe Config Parameter – SRS subframe Configuration (see 5.5.3.3 in
[S1]); Table 5.5.3.3-1 applies for FDD whereas Table
5.5.3.3-2 applies for TDD
Range is 0 to 15
>Simultaneous ACK/NAK SRS Parameter – Simultaneous-AN-and-SRS (see 23, 8.2 in
[S3])
Range is 0 to 1
1 indicates that Simultaneous transmission of ACK/NAK
and SRS is enabled while 0 Indicates that it is disabled
>SRS Max UpPts See 21, 5.5.3.2 in [S1]; TDD only parameter –
Range is 0 to 1
max
1 indicates reconfiguration of mSRS ,0 is enabled for UpPts
while 0 indicates that reconfiguration is disabled.
>Reserved

1 6.1.4 LTE ML1 uplink dedicated configuration (LOG_CODE 0xB163)

2 This log packet gives important parameters related to the UL Physical Channels configuration
3 received over dedicated signaling.
4
Field Description
Standards version Indicate the 3GPP standards version:
Reserved Reserved
>SRS Cfg Present
>SRS Enable
>SRS Bandwidth Parameter – b (see 21, 5.5.3.2: table 5.5.3.2-1 in [S1])
Range is 0 to 3
T
PS
>SRS Hopping Bandwidth
Parameter – SRS hopping bandwidth bhop ∈ {0,1,2,3}
om 23
(see 21, 5.5.3.2 in [S1])
Range is 0 to 3
.c 3:
sn 5:5
> Frequency Domain Position Parameter – n RRC (see 21, 5.5.3.2 in [S1])
Range is 0 to 23
i-n t 0
>Duration Parameter – Duration (see 8.2 in [S3]); 0 corresponds to

or 5 a
single and value 1 to indefinite

r.h .0
Range is 0 to 1
ca .01
>SRS Config Index Parameter – ISRS (See 23, Table 8.2-1 in [S3])
Range is 0 to 1023
os 12
>Tx Combination Parameter – k TC ∈ {0,1} (see 21, 5.5.3.2 in [S1])

20
Range is 0 to 1
>Cyclic Shift Parameter – n_SRS (See 5.5.3.1 in [S1]) where cs0
corresponds to 0 etc.
Range is 0 to 7
>CQI Cfg Present
>CQI Enable
>CQI Reporting A periodic Present
>CQI Reporting Mode A periodic Parameter – reporting mode. PUSCH reporting modes are
described in 23, 7.2.1 in [S3]
>CQI Reporting Periodic Present

> CQI Format Indicator Parameter – PUCCH CQI Feedback Type (see 23, table
7.2.2-1 in [S3])
Range is 0 to 1
>Nominal PDSCH RS EPRE offset
Parameter – ∆ offset (see 23, 7.2.3 in [S3])
Range is -1 to 6
>CQI PUCCH Resource Index (2)
Parameter nPUCCH (see 23, 7.2 in [S3])
Range is 0 to 1185

Field Description
> RI Config Enabled 0x0 – Disabled
0x1 - Enabled
> RI Config Index Parameter – RI Config Index IRI, see 23, 7.2.2-1B in [S3]
Range is 1 to 1023
>K Parameter – K, see 23, 7.2.2 in [S3]
Range is 1 to 4
> Simultaneous AckNack And CQI Parameter – Simultaneous-AN-and-CQI (see 23, 10.1 in
[S3]0; 1 indicates that simultaneous transmission of
ACK/NACK and CQI is allowed and 0 indicates that it is
not
Range is 0 to 1
> CQI-PMI Config Index Parameter – CQI/PMI Periodicity and offset Configuration
Index ICQI/PMI, see 23, 7.2.2-1A in [S3]
Range is 0 to 1023
T
>CQI-mask (Release 9 only) Flag to allow CQI/PMI/RI transmitted only
PS
during the onDuration of the connected mode DRX
om 23
>Antenna Cfg Present
>Transmission Mode
.c 3:
Points to one of Transmission modes defined in 7.1 in
sn 5:5
[S3], where
i-n t 0
Range is 1 to 7
or 5 a
>Tx Antenna Selection Enabled 0 indicates that UE transmit antenna selection is disabled.
If 1, then the field indicates whether UE transmit antenna
r.h .0
selection control is closed-loop or open-loop as described

in 23, 8.7 in [S3].
ca .01
Range is 0 to 1
os 12
> Tx Antenna Selection Control 0 indicates closed loop and 1 indicates open loop
20
Range is 0 to 1
>Reserved
>Antenna Codebook Subset Restriction Lo Parameter – codebookSubsetRestriction (see 23, 7.2 in
[S3] and 21, 6.3.4.2.3 in [S1]) Lower 32 bits
>Antenna Codebook Subset Restriction Hi Parameter – codebookSubsetRestriction (see 23, 7.2 in
[S3] and 21, 6.3.4.2.3 in [S1]) Higher 32 bits
1 6.1.5 LTE ML1 grant manager common configuration (LOG_CODE

2 0xB164)
3 This log packet gives important parameters related to the Grant Manager configuration received
4 over broadcast signaling.
5
Field Description
Reserved
UL Frequency Config
>UL Frequency Cfg valid
>Cell Frequency valid

Field Description
>Cell Frequency ul-EARFCN
For FDD – Default value determined from default Tx-RX
frequency separation defined in [36.101]
Range is
For TDD – This parameter is absent and it is equal to the
downlink frequency.
>Bandwidth Parameter – Uplink bandwidth [36.101]. Value n6 corresponds to
6 resource blocks, n15 to 15 resource blocks and so on. For
TDD this parameter is absent and it is equal to the downlink
bandwidth.
> Additional Spectrum Emission
Present
>Additional Spectrum Emission Defined in [36.101]
Range is 0 to 31
T
PUCCH Config
PS
>PUCCH Cfg valid
>PUCCH Delta shift
∆PUCCH
om 23
Parameter – shift (see 5.4.1 in [S1])
.c 3:
Range is 1 to 3
sn 5:5
>N_rb_cqi (2)
Parameter – N RB (see 21, 5.4 in [S1])
i-n t 0
Range is 0 to 98
or 5 a
>n_cs_an
Parameter – N cs(1) (see 21, 5.4 in [S1])
r.h .0
Range is 0 to 7
ca .01
>n1_pucch_an (1)
Parameter – N PUCCH (see 23, 10.1 in [S3])
os 12
Range is 0 to 2047
20
UL Power Control Config

>UL Power Control Cfg Present
>P0 Nominal PUSCH Parameter – P0,NOMINAL_PUSCH (see 5.1.1.1 in [S3]), unit dBm step
1; this field is applicable for non-persistent scheduling, only
Range is -126 to 24
>Alpha Parameter – α (see 5.1.1.1 in [S3])
>P0 Nominal PUCCH Parameter – P0, NOMINAL; PUCCH (see 5.1.2.1 in [S3]), unit dBm
Range is -127 to -96
>Delta Preamble MSG3
Parameter – ∆ PREAMBLE _ Msg 3 (see 23, 5.1.1.1 in [S3]); actual
value = IE value * 2 [dB]
Range is -1 to 6
> Delta TF List PUCCH Format 1 Parameter – ∆ F_PUCCH ( F ) for the PUCCH format 1; see 23,
5.1.2 in [S3]
Range is -2 to 2
> Delta TF List PUCCH Format 1b Parameter – ∆ F_PUCCH ( F ) for the PUCCH format 1b; see 23,
5.1.2 in [S3]
Range is 1 to 5

Field Description
> Delta TF List PUCCH Format 2 Parameter – ∆ F_PUCCH ( F ) for the PUCCH format 2; see 23,
5.1.2 in [S3]
Range is -2 to 2
> Delta TF List PUCCH Format 2a Parameter – ∆ F_PUCCH ( F ) for the PUCCH format 2a; see 23,
5.1.2 in [S3]
Range is -2 to 2
> Delta TF List PUCCH Format 2b Parameter – ∆ F_PUCCH ( F ) for the PUCCH format 2b; see 23,
5.1.2 in [S3]
Range is -2 to 2
SRS Config
>SRS Cfg Present
>SRS Enable
T
PS
>SRS Bandwidth Config Parameter – SRS bandwidth configuration (see 21, table 5.5.3.2-
1, 5.5.3.2-2, 5.5.3.2-3 and 5.5.3.2– 4 in [S1])
om 23
Range is 0 to 7
.c 3:
>SRS Subframe Config Parameter – SRS subframe configuration (see 5.5.3.3 in [S1]);
sn 5:5
Table 5.5.3.3-1 applies for FDD, whereas Table 5.5.3.3-2 applies
for TDD
i-n t 0
Range is 0 to 15
or 5 a
>Simultaneous ACK/NAK SRS Parameter – Simultaneous-AN-and-SRS (see 23, 8.2 in [S3])

Range is 0 to 1
r.h .0
1 indicates that Simultaneous transmission of ACK/NAK and

ca .01
SRS is enabled while 0 Indicates that it is disabled

os 12
>SRS Max UpPts See 21, 5.5.3.2 in [S1]); TDD only parameter –
Range is 0 to 1
20
max
1 indicates reconfiguration of mSRS ,0 is enabled for UpPts while 0
indicates that reconfiguration is disabled.
UL Cyclic Prefix Config
>UL CP Cfg Present
>UL Cyclic Prefix Length Parameter – Uplink cyclic prefix length (see 21, 5.2.1 in [S1])
where 0 corresponds to normal cyclic prefix and 1 corresponds
to extended cyclic prefix
Range is 0 to 1
PUSCH Config
>PUSCH Cfg Present
>Enable 64 QAM
>Reserved

1 6.1.6 LTE ML1 grant manager dedicated configuration (LOG_CODE

2 0xB165)
3 This log packet gives important parameters related to the Grant Manager configuration received
4 over dedicated signaling.
5
NOTE: The following table has been updated.

6
Field Description
Reserved Reserved
T
PS
SR Config
>SR Cfg Valid
om 23
> SR Enable
.c 3:
>SR PUCCH Resource Index (1)
Parameter – nPUCCH, (see 23, 10.1 in [S3])
sn 5:5
SRI
Range is 0 to 2047
i-n t 0
>SR Configuration Index Parameter I SR (see 23,10.1 in [S3])

or 5 a
Range is 0 to 155
r.h .0
>SR Maximum Transmissions Parameter – DSR_TRANS_MAX (see [S5])

ca .01
Range is 4 to 64
os 12
CQI Config
20
Below fields are only displayed if standard version is REL 9

>SR Prohibit Timer (REL 9 only) Timer for SR transmission on PUCCH in TS
36.321 [6]. Value in number of SR period(s).
 Range is 0 to 7.
End of REL 9 fields
>CQI Cfg Valid
>CQI Enable
>CQI Reporting A periodic Valid
>Reserved
>CQI Reporting Mode A periodic Parameter – reporting mode. PUSCH reporting modes are
described in 23, 7.2.1 in [S3]
Range is 0 to 4
>Nominal PDSCH RS EPRE offset
Parameter – ∆ offset (see TS 23, 7.2.3 in [S3])
Range is -1 to 6
>CQI Reporting Periodic Valid
> CQI Reporting Periodic Enable
> CQI Format Indicator Parameter – PUCCH CQI Feedback Type (see 23, table
7.2.2-1 in [S3]
Range is 0 to 1

Field Description
> Simultaneous AckNack And CQI Parameter – Simultaneous-AN-and-CQI (see 23, 10.1 in
[S3]; 1 indicates that simultaneous transmission of
ACK/NACK and CQI is allowed and 0 indicates that it is
not
Range is 0 to 1
>CQI PUCCH Resource Index (2)
Parameter nPUCCH (see 23, 7.2 in [S3])
Range is 0 to 1185
>Reserved
> RI Config Index Parameter – RI Config Index IRI (see 23, 7.2.2-1B in [S3])
Range is 1 to 1023
> RI Config Enabled
>K Parameter – K, see 23, 7.2.2 in [S3]
Range is 1 to 4
T
> CQI-PMI Config Index Parameter – CQI/PMI Periodicity and offset Configuration
PS
Index ICQI/PMI (see 23, 7.2.2-1A in [S3])
Range is 0 to 1023
om 23
.c 3:
sn 5:5
>CQI-mask (REL 9 only) Flag to allow CQI/PMI/RI transmitted only
during the onDuration of the connected mode DRX
i-n t 0
End of REL 9 fields

or 5 a
SRS Config
>SRS Cfg Valid
r.h .0
ca .01
>SRS Enable
>SRS Bandwidth Parameter – b (see 21, 5.5.3.2: table 5.5.3.2-1 in [S1]).
os 12
Range is 0 to 3
20
>SRS Hopping Bandwidth

Parameter – SRS hopping bandwidth bhop ∈ {0,1,2,3}
(see 21, 5.5.3.2 in [S1])
Range is 0 to 3
>Reserved
> Frequency Domain Position Parameter – n RRC (see 21, 5.5.3.2 in [S1])
Range is 0 to 23
>Duration Parameter – Duration; see 8.2 in [S3]; 0 corresponds to
single and value 1 to indefinite
Range is 0 to 1
>Tx Combination Parameter – k TC ∈ {0,1} (see 21, 5.5.3.2 in [S1])
Range is 0 to 1
>Cyclic Shift Parameter – n_SRS (see 5.5.3.1 in [S1]) where cs0
corresponds to 0 etc.
Range is 0 to 7
>SRS Config Index Parameter – ISRS (see 23, Table 8.2-1 in [S3])
Range is 0 to 1023
PHR Config
>PHR Cfg Valid
>PHR Enable

Field Description
>Periodic PHR Timer Value Parameter – PERIODIC_PHR_TIMER [36.321]. Value in
number of subframes.
Value 0 corresponds to infinity
Range is 0 to 1000
>Prohibit PHR Timer Value Parameter – PROHIBIT PHR TIMER [36.321]. Value in
number of subframes.
Range is 0 to 1000
>DL Pathloss Change Threshold Parameter – DL PathlossChange [36.321]. Value in dB
Value 0 corresponds to infinity
Range is 0 to 6
PUSCH TPC Config
>PUSCH TPC Cfg Valid
>PUSCH TPC Enable
T
>PUSCH TPC DCI Format
PS
>PUSCH TPC Index Index of N or M (see 22, 5.3.3.1.6 and 5.3.3.1.7 in [S2]),
om 23
Range is 1 to 31
.c 3:
>Reserved sn 5:5
>PUSCH TPC RNTI RNTI for PUSCH power control using DCI format 3/3A
(see [S2])
i-n t 0
PUCCH TPC Config

or 5 a
>PUCCH TPC Cfg Valid

r.h .0
>PUCCH TPC Enable

ca .01
>PUCCH TPC DCI Format

os 12
>Reserved
20
>PUCCH TPC Index Index of N or M (see 22, 5.3.3.1.6 and 5.3.3.1.7 in [S2]),
Range is 1 to 31
>Reserved
>PUCCH TPC RNTI RNTI for PUCCH power control using DCI format 3/3A
(see 22 in [S2])
ULSCH Config
>ULSCH Cfg Valid
>MAX HARQ Transmissions Parameter – max-HARQ-Tx [36.321].
Range is 1 to 28
>TTI Bundling Enabled Configures TTI bundling on and OFF; can be configured
for FDD and for TDD only for configurations 0, 1 and 6
Range is 0 to 1
UL Power Control Config
>UL Power Control Cfg Valid
>Accumulation Enabled Parameter – Accumulation-enabled (see 23, 5.1.1.1 in
[S3]); 1 corresponds to enabled, whereas 0 corresponds to
disabled
Range is 0 to 1
>P0 UE PUSCH Parameter – P0,UE; PUSCH (see 5.1.1.1 in [S3]), unit dB. This
field is applicable for non-persistent scheduling, only
Range is -8 to 7

Field Description
> P0 UE PUCCH Parameter – P0,UE; PUCCH (see 5.1.2.1 in [S3])
Range is -8 to 7
Reserved
>Delta MCS Enabled Parameter – Ks (see 5.1.1.1 in [S3]);
Range is 0 to 1
>P_SRS offset Parameter – PSRS_OFFSET (see 5.1.3.1 in [S3]).
Range is 0 to 15
PUSCH Config
>PUSCH Cfg Valid
>Delta offset ACK Index HARQ − ACK
Parameter – I offset (see 23, Table 8.6.3-1 in [S3])
Range is 0 to 15
>Delta offset CQI Index CQI
T
PS
Range is 0 to 15
>Delta offset RI Index RI
om 23
.c 3:
Range is 0 to 15
sn 5:5
PUCCH config
i-n t 0
>PUCCH Cfg Valid

>PUCCH Cfg Enable
or 5 a
>ACK/NAK Feedback Mode Parameter indicates one of the two TDD ACK/NACK
r.h .0
feedback modes used (see 23, 7.3 in [S3]);

ca .01
This field is only applicable for TDD

Range is 0 to 1
os 12
>ACK/NAK Repetition Enabled Range is 0 to 1

20
>ACK/NAK Reputation Factor Parameter indicates whether ACK/NACK repetition is

enable or disabled (see 23, 10.1 in [S3])
Range is 2 to 6
>Reserved
>n1_PUCCH_ANRep PUCCH Resource for ACK/NAK Repetition Range is 0 to
2047
Antenna Config
>Antenna Cfg Valid
>Transmission Mode Points to one of Transmission modes defined in 7.1 in [S3]
where
Range is 1 to 7
>Tx Antenna Selection Enabled 0 indicates that UE transmit antenna selection is disabled.
Range is 0 to 1
> Tx Antenna Selection Control 0 indicates closed loop and 1 indicates open loop
Range is 0 to 1
>Reserved
>Antenna Codebook Subset Restriction Lo Parameter – codebookSubsetRestriction (see 23, 7.2 in
[S3]) and 21, 6.3.4.2.3 in [S1]) Lower 32 bits
>Antenna Codebook Subset Restriction Hi Parameter – codebookSubsetRestriction (see 23, 7.2 in
[S3]) and 21, 6.3.4.2.3 in [S1]) Higher 32 bits
CDRX config

Field Description
>CDRX config valid
>CDRX enable
>On duration timer <Value in integer> pdcch subframes
>Inactivity timer <Value in integer> pdcch subframes
>dl drx retx timer <Value in integer> pdcch subframes)
>Reserved
>long cycle len <Value in integer> subframes
>cycle start offset <Value in integer> subframes)
>Reserved
>short drx cycle enable 
>short drx cycle len <Value in integer> subframes
>short drx timer <Value in integer> short cycles
T
>Reserved
PS
om 23
1 6.1.7 LTE ML1 PRACH configuration (LOG_CODE 0xB166)
.c 3:
sn 5:5
2 This log packet gives important parameters related to the PRACH Physical channel configuration.
3
i-n t 0
Field Description
or 5 a

r.h .0

ca .01
Reserved Reserved
Logical Root Sequence Index Logical Root ZadOFF-Chu Sequence number for various
os 12
preamble formats
20
Range is 0 to 837 for Preamble Format 0-3

Range is 0 to 137 for Preamble Format 4
Prach Config Random Access Preamble timing for a range of Preamble
Formats
Range is 0 to 15
Reserved
Preamble Format Preamble format. Range: 0..4
Duplex Mode System duplex mode.
0x0: FDD
0x1: TDD
High Speed Flag Controls grouping of preamble sequences in two sets, to
differentiate a high speed UE from normal
PRACH Frequency offset Frequency Resource offset
Range is 0 to 104
Reserved
Max. Transmissions MSG3 Maximum number of HARQ re-transmissions from UE for
RACH message3
Range is 1 to 8
Cyclic Shift Zone Length Cyclic Shifts for various Preamble Formats
Range is 0 to15 for Preamble Formats 0-3
Range is 0 to 6 for Pramble Format 4

Field Description
RA Response Window Size Window size for reception of RACH message2
Range is 2 to 10
Reserved
1 6.1.8 LTE ML1 TDD Configuration (Log code ID: 0xB1B0)

2 This log packet gives important parameters related to the TDD configuration received over
3 broadcast signaling.
Log item Description
Version Log packet version. Range: 0…255.
Version = 1 for the log packet structure described below

TDD cfg
T
PS
>TDD subframe assignment Display strings
>TDD special subframe patterns Display strings
om 23
.c 3:
sn 5:5
i-n t 0
or 5 a
r.h .0
ca .01
os 12
20

1 6.2 RACH
2 6.2.1 LTE ML1 random access request (MSG1) report (LOG_CODE

3 0xB167)
4 This log packet gives important parameters related to the Random Access Request (MSG1)
5 transmission.
6
Field Description
Reserved Reserved
Preamble Sequence Preamble Sequence Index.
T
PS
Range is 0 to 63
Physical root Index Physical Root Sequence Index corresponding to Preamble
om 23
Sequence; range is 1 to 838
.c 3:
Cyclic Shift sn 5:5 Cyclic Shift.
Range is 0 to 838
Reserved Reserved
i-n t 0
PRACH Tx Power Range is -112 dBm to 23 dBm, with 1 dB stepsize

or 5 a
Beta PRACH Range is 0 to 2047

r.h .0
N_ra_prb Frequency Resource offset

ca .01
Range is 0 to 104
os 12
Preamble Format Preamble format (based on PRACH configuration

parameter signaled).
20
Range is 0 to 4
Reserved
Duplex Mode System Duplex Mode:
Random Access Resource for TDD.
(The following 4 fields are valid only when Duplex Mode is TDD)
>f_ra Frequency resource index.
Range: 0…5
>t_0_ra Range: 0..2
0x0: Resource reoccurring in all radio frames,
0x1: Resource reoccurring in all even radio frames,
0x2: Resource reoccurring in all odd radio frames.
>t_1_ra Range:0,1
0x0: Random access resource located in first half frame
0x1: random access resource is located in second half
frame
>t_2_ra UL subframe number where preamble starts
Range: 0…3
Density per 10 ms Density per 10 ms (D_ra).

This field is displayed only when Duplex Mode is TDD.
Range: 0...6

Field Description
Reserved
Random Access Request Timing Sub/System Frame Number, defined as
 LSB 3:0 – Subframe number; range is 0 to 9
 LSB 15:4 – System frame number
Random Access Response Window Start Sub/System Frame Number, defined as
Random Access Response Window End Sub/System Frame Number, defined as
RA RNTI RA RNTI based on MSG1 timing
Reserved
PRACH actual Tx power RACH actual Tx power
T
Reserved Reserved
PS
om 23
1 6.2.2 LTE ML1 random access response (MSG2) report (LOG_CODE
0xB168)
.c 3:
2
sn 5:5
3 This log packet gives important parameters related to the Random Access Response (MSG2)
i-n t 0
4 transmission.
or 5 a
5
r.h .0
Field Description
ca .01

os 12
below
20
Reserved Reserved
Random Access Response Timing Sub/System Frame Number, defined as
Timing Advance Timing Advance Value
Timing Advance Included
RACH Procedure Type
RACH Procedure Mode
RNTI Type
RNTI Value RNTI value
Reserved

1 6.2.3 LTE ML1 UE identification message (MSG3) Report (LOG_CODE

2 0xB169)
3 This log packet gives important parameters related to the MSG3 of the Contention Based Random
4 Access Procedure.
5
Field Description
below
Reserved Reserved
TPC TPC command to be applied to MSG3 transmission
MCS Modulation and Coding Scheme
T
RIV Resource Indicator Value
PS
CQI
om 23
UL Delay
.c 3:
Hopping Flag sn 5:5
UE Identification Message Timing SFN System frame number of MSG3
Reserved
i-n t 0
UE Identification Message Timing Subframe Subframe number of MSG3

or 5 a
number
r.h .0
Starting Resource Block Number Starting resource block number of the received grant
ca .01
Range is 1 to 110
Number of Resource Blocks Total number of resource blocks allocated in the grant
os 12
Range is 1 to 110
20
Transport Block Size Index Transport block size can be determined based on the
Transport Block Size Index and Number of Resource
Blocks by the log code parser
Range is 0 to 26
Modulation Type 
Redundancy Version Index Redundancy Version Index
Possible values – 0, 1, 2, 3
HARQ ID ID of the HARQ process on which MSG3
transmission was scheduled
Range is 0 to 7
Reserved

1 6.2.4 LTE ML1 contention resolution message (MSG4) report

2 (LOG_CODE 0xB16A)
3 For the Initial Access Random Access Procedure, this report will carry the contention resolution
4 message parameters.
5
Field Description
below
Reserved Reserved
Contention Resolution Message Timing SFN System frame number of MSG4
T
Contention Resolution Message Timing Subframe number of MSG4
PS
Subframe number
Contention Result
om 23
UL ACK Timing SFN System frame number of MSG4 ACK
UL ACK Timing SFN
.c 3: Subframe number of MSG4 ACK
sn 5:5
Reserved
i-n t 0
or 5 a
r.h .0
ca .01
os 12
20

1 6.3 Closed loop
2 6.3.1 LTE ML1 PDCCH-PHICH indication report (LOG_CODE 0xB16B)

3 This log packet gives important parameters received on PDCCH and PHICH on the downlink.
4 The log record is generated once every 50 subframes or every 1 sec, whichever occurs first.
5
Field Description
Reserved
>Number of PDCCH results Range is 0 to 6
T
PS
>PDCCH Timing SFN System frame number of PDCCH
>PDCCH Timing Subframe number Subframe number of PDCCH
om 23
>PHICH Included
>PHICH Timing SFN
.c 3:
System frame number of PHICH
sn 5:5
>PHICH Timing Subframe number Subframe number of PHICH
i-n t 0
>PHICH Value
or 5 a
>Reserved
>CRC status
r.h .0
ca .01
>RNTI Type
>PDCCH Payload Size PDCCH payload size
os 12
>Aggregation Level PDCCH aggregation level

20
> Reserved
6 6.3.2 LTE ML1 DCI information report (LOG_CODE 0xB16C)

7 This log packet gives important parameters about UL Grant received in DCI Format 0. The log
8 record is generated once every 50 subframes or every 1 sec, whichever occurs first.
9
Field Description
Reserved
>PDCCH Timing SFN System frame number of PDCCH
>PDCCH Timing Subframe number Subframe number of PDCCH

>UL Grant Valid
>RIV Width Bit width of RIV based on UL frequency configuration
Range is 5 to 13
>RIV Value Resource indicator value
Range is 32 to 8192

Field Description
>Hopping Flag
>MCS Index MCS index
Range is 0 to 31
>NDI New Data Indicator
>TPC TPC command
>Cyclic Shift DMRS Cyclic shift DMRS
>Duplex Mode System Duplex Mode:
>K of DCI 0 K value for DCI 0
Range: 4, 6, 7
>UL Index/DAI UL index for TDD UL/DL 0 or
UL Downlink Assignment Index for TDD UL/DL 1-6. This
field is displayed only when Duplex Mode is TDD.
Range: 0…3
T
>Reserved
PS
>CQI Request CQI request
om 23
>Start of Resource Block Starting Resource Block for the received grant :
.c 3:
Range is 1 to 110
sn 5:5
> Reserved
>Number of Resource Blocks Total number of RBs allocated in the grant.
i-n t 0
Range is 1 to 110
or 5 a
>TBS Index Transport Block Size Index. Transport Block Size can be
r.h .0
determined using TBS Index and Number of Resource

Blocks
ca .01
Range is 0 to 31
os 12
>Modulation Type
20
>Redundancy Version Index Redundancy Version Index

Possible Value – 0, 1, 2, 3
>HARQ ID Range is 0 to 7
>PDCCH Order Valid
>DL Grant Valid
>DL Grant Format type
>Num ACK/NAK bits Number of ACK/NAK bits for DL grant
Range is 0 to 2
>DL Grant TPC Command TPC command in DL grant
>TPC DCI Valid
> TPC DCI format type
> TPC DCI Rnti Type
>TPC DCI TPC Command TPC command in the TPC DCI
>DAI DL Downlink Assignment Index for TDD UL/DL 1-6. This
filed is displayed only when Duplex Mode is 1.
Range: 0…3
>Reserved

1 6.3.3 LTE ML1 GM Tx report (LOG_CODE 0xB16D)

2 This log packet gives important parameters about transmission on PUSCH/PUCCH. The log
3 record is generated once every 50 subframes or every 1 sec, whichever occurs first.
4
Field Description
Reserved
> Tx_report One of PUCCH or PUSCH reports
>pusch_tx_report
>>Chan_type
> >Tx Sfn PUSCH OTA system frame number
T
Range is 0 to 1023
PS
> >Tx Sub-fn PUSCH OTA subframe number
Range is 0 to 9
om 23
>>Transport Block Size PUSCH transport block size in bytes
>>CSF Present Flag
.c 3:
Whether CSF is being scheduled
sn 5:5
>>UL ACK/NAK Present Flag
i-n t 0
>>ACK/NAK Reporting Mode Ack/Nak reporting mode

or 5 a
>>Number of Bundled Subframes The total number of subframes in current bundling. Range:
1…9
r.h .0
>>End of Bundling The very last subframe number of current bundling. This
ca .01
field is displayed only when ACK/NAK Reporting Mode is

os 12
0x1 or 0x2.
Range: 0…9
20
>>Total Tx Power Range is -112 dBm to 23 dBm, with 1 dB stepsize

>>Beta PUSCH Range is 0 to 2047
>>Cyclic Shift DMRS Cyclic Shift DMRS
>>Resource Block Start Starting resource block number (1-110)
>>Rv Redundancy Version
>>Ack/Nak Len ACK/NAK length
>>Modulation Type
>>Number of Resource Blocks Number of contiguous resource blocks (1-110)
>>Retransmission index Retransmission index
>>Harq ID Harq index
>>Freq Hopping Flag
>>Reserved
>>Harq ACK offset index I_harq_ack_offset
>>CQI offset index I_cqi_offset
>>RI offset index I_ri_offset
>>PUSCH Hopping Payload Used to determine VRB to PRB mapping
Range is 0 to 3
>>SRS Present Flag Whether SRS is being scheduled
>>SRS UE/Cell specific Cell or UE specific SRS occasion

Field Description
>>n_dmrs N_dmrs
>>Num Antenna Number of antenna
>>reserved Reserved
>>Padding To pad 32 bits to align PUCCH and PUSCH tx records.
Not displayed.
>pucch_tx_report
>>Chan_type
> >Tx Sfn PUCCH OTA system frame number
Range is 0 to 1023
> >Tx Sub-fn PUCCH OTA subframe number
Range is 0 to 9
>>Total Tx Power Range is -112 dBm to 23 dBm, with 1 dB stepsize
>>Reserved Reserved
T
PS
>>Beta PUCCH Range is 0 to 2047
Amplitude scaling factor
om 23
>>UL ACK/NAK Present
.c 3:
>>ACK/NAK Reporting Mode Ack/Nak reporting mode
sn 5:5
>>Ack/Nak Len ACK/NAK length
i-n t 0
>>n_1_pucch PUCCH resource for format 1/1a/1b

or 5 a
Range is 0 to 2083
>> Number of n_1_pucch Number of n_1_pucch sent t in TDD multiplexing mode.
r.h .0
Range: 0…4
ca .01
>>n_1_pucch_array[4].
os 12
This field is displayed only when UL ACK/NAK Present Flag is 0 or 2.

20
The number of n_1_pucch_array [i] displayed is based on Number of n_cce for multiplexing. Each one is
2 byte.
>>> n_1_pucch_i PUCCH Resource for TDD multiplexing mode.

Range: 0…2083
>>>Reserved
>>n_2_pucch PUCCH resource for format 2/2a/2b
>>Scheduling Request Present
>>Temp RNTI ACK Flag
>>SRS Present Flag Whether SRS is being scheduled
>>SRS UE/Cell specific Cell or UE specific SRS occasion
>>CSF Present
>>Reserved Reserved

1 6.3.4 LTE ML1 PUSCH power control (LOG_CODE 0xB16E)

2 This log packet gives the information on PUSCH Power Control.
3
Description
Field

Reserved
> Tx Sfn PUSCH OTA system frame number
Range is 0 to 1023
> Tx Sub-fn PUSCH OTA subframe number
T
Range is 0 to 9
PS
Total PUSCH Tx power
> PUSCH Tx Power Range is -112 dBm to 23 dBm, with 1 dB stepsize
om 23
>DCI Format DCI format of the decoded PDCCH
.c 3:
Range is 0 to 10
sn 5:5
>Tx Type PUSCH Tx type
i-n t 0
>TPC Command TPC command on received PDCCH

or 5 a
0x7 stands for TPC not present

Range is 0 to 7
r.h .0
> Reserved
ca .01
>Transport Block Size PUSCH transport block size in bytes

os 12
>DL Path Loss Downlink path loss computed in the UE

20
>F(i) Power control accumulation factor

Range is -141 to +141
>PUSCH actual Tx power Actual PUSCH Tx power (signed integer)
Range is -112 dBm to 23 dBm, with 1 dB stepsize
>Reserved2 Reserved

1 6.3.5 LTE ML1 PUCCH power control (LOG_CODE 0xB16F)

2 This log packet gives the information on PUCCH Power Control.
3
Field Description
Reserved
> Tx Sfn PUCCH OTA system frame number
Range is 0 to 1023
> Tx Sub-fn PUCCH OTA subframe number
Range is 0 to 9
T
> PUCCH Tx Power Total PUCCH Tx power
PS
>DCI Format DCI format of the decoded PDCCH
om 23
Range is 0 to 10
>PUCCH Format
.c 3:
PUCCH Tx format type
sn 5:5
Range is 0 to 5
i-n t 0
>N harq Number of HARQ bits

or 5 a
Range is 0 to 2
>Reserved
r.h .0
>TPC Command TPC command on received PDCCH

ca .01
0x7 stands for TPC not present

os 12
Range is 0 to 7
20
> N CQI Number of CQI bits

>DL Path Loss Downlink path loss computed in the UE
>PUCCH power control adjustment state PUCCH power accumulation factor
g(i) Range is -141 to +141
>PUCCH actual Tx power PUCCH actual Tx power
>Reserved2 Reserved

1 6.3.6 LTE ML1 SRS Tx report (LOG_CODE 0xB170)

2 This log packet gives important parameters about SRS transmission. The log record is generated
3 once every 50 subframes or every 1 sec, whichever occurs first.
4

5
Field Description
Reserved
>Sys/Subframe number Sub/system frame number, defined as
T
 LSB 3:0 = Subframe number; range is 0 to 9
PS
 LSB 15:4 = System frame number
om 23
>Beta SRS Range is 0 to 2047
.c 3:
>Duplex Mode System Duplex Mode:
0: FDD
sn 5:5
1: TDD
i-n t 0
>UpPts Type UL UpPts Type. Range: 0…3

or 5 a
This field is displayed only when Duplex Mode is TDD

0x0: No SRS present
r.h .0
0x1: SRS sent on UpPts symbol 0

ca .01
0x2: SRS sent on UpPts symbol 1

os 12
0x3: SRS sent on both UpPts symbols

>Reserved
20

1 6.3.7 LTE ML1 SRS power control report (LOG_CODE 0xB171)

2 This log packet gives important parameters related to the SRS power control reports. The log
4
Field Description
Reserved
>Sys/Subframe number Sub/system frame number, defined as
T
>SRS Transmit Power (dBm) Range is -112 dBm to 23 dBm, with 1 dB stepsize
PS
>PathLoss Downlink PathLoss
om 23
>M_srs SRS Tx bandwidth
>TPC Command ( f(i) ) Power control accumulation factor
.c 3:
Range is -141 to +141
sn 5:5
> SRS actual Tx power SRS actual Tx power (signed integer)
i-n t 0

or 5 a
> Reserved Reserved

r.h .0
ca .01
5 6.3.8 LT ML1 Uplink PKT build indication (LOG_CODE 0xB172)

os 12
6 This log packet gives the parameters present in the Uplink Packet Build Indication sent from
20
7 ML1 to MAC.
8
Field Description
Reserved
Number of records
> Tx Sfn PUSCH OTA system frame number
Range is 0 to 1023
> Tx Sub-fn PUSCH OTA subframe number
Range is 0 to 9
>Transport Block Size PUSCH transport block size
> RNTI Type
> EIB Address Encoder Input Buffer Address
>Power Headroom Uplink power headroom value
>HARQ ID HARQ index
> Reserved

1 6.3.9 LTE ML1 PDSCH stat indication (LOG_CODE 0xB173)

2 This log packet gives PDSCH decode statistics.
3
Field Description
Num records Number of records present in the log packet
0 < Range <= 25
reserved0 Reserved for future use
>subframe num OTA Tx subframe number
0 < = range <= 9
Display in integers
>frame num OTA Tx frame number
0 <= range <= 1023
T
Display in integers
PS
>num rbs Number of rbs allocated
om 23
Range is 0 < num rbs <= 100
.c 3:
sn 5:5(Display integers)
>num layers Number of layers
Range is 1<= num layers <= 4
i-n t 0
(Display integers)
or 5 a
>num transport blocks present 0 <= range <= 3

r.h .0

ca .01
>>harq ID Harq ID sec. 7 in [S3]

(up to 8 for FDD (0 -7), up to 15 for TDD (0-14))
os 12
Display in integers
20
>>rv Redundancy version (0 , 1, 2, 3)

Display in integers
>> ndi New data indicator (0 or 1)
Display in integers
>> CRC result Display strings
>> rnti type
> >tb index The transport block index where two transport blocks are
received with the same rnti (for MIMO)
Index [0 , 1] will be present to represent TB with same
RNTI otherwise 0 by default
Display in integers
>> Discarded reTx present Discarded retransmission: Additional retransmission of
already received data due to ack->nak misdetection
Display strings
>> Did Recombining Recombined with previous data
>>reserved1 Reserved for future use
>> tb size Transport block size in bytes
>> reserved2 Reserved for future use
>> mcs MCS index
Range is 0 <= mcs <= 31 (Display in integer)
>> reserved3 Reserved for future use

1 6.3.10 LTE ML1 radio link monitoring (LOG_CODE 0xB18A)

2 This log packet gives the parameters related to Radio Link Monitoring by the UE Physical Layer.
3
Field Description
Reserved
Number of records
> SFN System frame number
Range is 0 to 1023
> Sub-fn Subframe number
Range is 0 to 9
>Reserved
T
>Out of Sync BLER Out of Sync BLER, calculated from the measured SNR.
PS
The out_sync BLER corresponds to the BLER if the actual
transmission parameters equal to the parameters specified
om 23
in Spec for out_sync.
.c 3:
16U15 format; range is 0 to 100%, e.g., if logged value is
sn 5:5
600, then output should be 600 / (1<<15) = 0.018 = 1.8%
i-n t 0
>In Sync BLER In Sync BLER, calculated from the measured SNR. The
in_sync BLER corresponds to the BLER if the actual
or 5 a
transmission parameters equal to the parameters specified

in Spec for in_sync.
r.h .0
ca .01
16U15 format; range is 0 to 100%, e.g., if logged value is

os 12
600, then output should be 600 / (1<<15) = 0.018 = 1.8%

> Out of Sync Count Out of Sync Count
20
Range is 1 to 20
>In Sync Count In Sync Count
Range is 1 to 10
>Reserved
>T310 Timer status T310 Timer Status
Output = logged value * 10, e.g.:
> Reserved

1 6.3.11 LTE ML1 CDRX Events Info (LOG_CODE 0xB198)

2 This log packet gives CDRX timers, cycle and ON/OFF events in chronological order.
3
Field Description
version Log packet version; range: 0…255
num_records Number of records present in log packet
Reserved Reserved for future use
> SFN Sys-frame number; range: 0..1023
> Sub-fn Sub-frame number; range: 0..9
> CDRX event
> Reserved Reserved for future use
T
PS
6.3.12 LTE ML1 TDD ACK NAK REPORT (LOG_CODE 0xB1B1)
om 23
4
5
.c 3:
This section was added to this document revision.
NOTE:
sn 5:5
i-n t 0
6 This log packet provides information for each TDD ACK/NAK in multiplexing or bundling
mode.
or 5 a
7
8
r.h .0
Field Description
ca .01

os 12

20
TDD subframe assignment

TDD ACK Reporting Mode 0x0: Multiplexing
0x1: Bundling
Number of records Range: 1…20
Reserved
> Sub-frame number Sub-frame number (Range 0..9)
> System frame number System frame number (Range 0..1023)
> N_p N_p for n_1_pucch calculation.
Range: 0,1,3,5,8,11,13,22,16,22,27,41,44,55,66,88
> N_p_plus_1 N_p_plus_1 for n_1_pucch calculation:
Range: 0,1,3,5,8,11,13,22,16,22,27,41,44,55,66,88
> m value of minimum K The position of minimum k to calculate n_1_pucch.
This field is valid only when ACK Reporting Mode is
Bundling.
Range: 0…9
>Frame number of the start of bundle Frame number of the first acknowledged DL grant
>Subframe number of the start of bundle Subframe number of the first acknowledged DL grant
>Frame number of the end of bundle Frame number of the last acknowledged DL grant
>Subframe number of the end of bundle Subframe number of the last acknowledged DL grant
>Reserved

Field Description
> Bit mask for bundled subframe The bit is set if the ACK/NAK of corresponding subframe is
bundled.
> n_cce The number of the first CCE used for transmission of the
corresponding PDCCH
This field is displayed only when the ACK Reporting Mode
is Bundling.
Range: 0…96
> Number of n_cce_i for multiplexing The number of n_cce received for multiplexing mode.
This field is valid only when the ACK Reporting Mode is
Multiplexing.
Range: 1..4
> Reserved
>n_cce_i[4] array.
This field is valid only when the ACK Reporting Mode is Multiplexing.
T
The number of n_cce_i[i] valid is based on Number of n_cce for multiplexing. Each one is 1 byte.
PS
om 23
>> n_cce_i[i] The number of the first CCE used for transmission of the
corresponding PDCCH
.c 3:
Range: 0…96
sn 5:5
>>Reserved
i-n t 0
or 5 a
r.h .0
ca .01
os 12
20

1 6.4 Measurements
2 6.4.1 LTE ML1 initial acquisition results (LOG_CODE 0xB176)

3 This log packet provides information about each initial acquisition attempt. It is sent whenever
4 RRC requests initial acquisition.
5
Field Description
Reserved Reserved
E-ARFCN The frequency number; range is 0 to 29649
Band The Band to camp on; range is 1 to 40
T
PS
Duplex Mode
Result Result of acquisition attempt
om 23
Reserved
Min Search Half Frames
.c 3:
Minimum number of half frames to combine before
sn 5:5
PSS/SSS detection
i-n t 0
Range is 1 to 4
Min Search Half Frames Early Abort Minimum number of half frames to abort early in case
or 5 a
biggest PSS value is below a certain threshold; range is 1

to 4
r.h .0
ca .01
Max Search Half Frames Maximum number of frames to use for non-coherent
combining; range is 1 to 4
os 12
Max PBCH Frames Maximum number of frames to use for PBCH; range is 1
20
to 31
Number of Blocked Cells (N) Range is 0 to 4
Number of cells for which PBCH decode This field tells the number of cells PBCH decode was
was attempted (L) attempted; range is 0 to 4
Number of Search Results (M) Number of initially detected cells; range is 0 to 8
Reserved
> Physical Cell ID Range is 0 to 504
> Reserved
> Frame offset Range is -1, 0 to 1023 (-1 indicates unknown)
> Sample offset Range is 0 to 307199
> Reserved
> CP Cyclic prefix
> Reserved
> Frequency offset Frequency offset estimate in units of Hz
Range is -32768 to 32767
> PSS Correlation Result Range is 0 to 65535
> SSS Correlation Result Range is 0 to 65535
> Frame offset Range is -1, 0 to 1023 (-1 indicates unknown)
> Sample offset Range is 0 to 307199

Field Description
> Reserved
> MIB Payload Raw MIB payload bits
(invalid if Decode Result == Failure)
> Updated Frequency offset Frequency offset estimate in units of Hz
Range is -32768 to 32767
(invalid if Decode Result == Failure)
> Number of Decode Attempts In units of radio frames
Range is 1 to 8
> Decode Result
> Number of Tx Antennas (invalid if Decode Result == Failure)
6.4.2 LTE ML1 connected mode measurement configuration
T
1
PS
2 (LOG_CODE 0xB177)
om 23
3 This log packet contains information about the measurement configuration in connected mode.
.c 3:
4 The log packet is generated every time the measurement configuration is updated from the
sn 5:5
5 network side.
6
i-n t 0
Field Description
or 5 a
Version Version number of this packet

r.h .0
Version 2 corresponds to this structure

ca .01
Number of Sub Packets Number of subpackets at the end of the packet

os 12
Reserved Reserved
20
Subpackets One or more subpackets

1 6.4.2.1 Measurement configuration subpackets details
2 6.4.2.1.1 Measurement configuration subpacket header definition

3
Field Description
Sub Packet ID Unique subpacket Identifier (see 3.4.4.1.1)
Sub Packet Version Version number of the subpacket; if the version is
unknown to the parsing tool, the subpacket should be
skipped
Sub Packet Size Size in bytes of the subpacket including the header; if
the version of the subpacket is unknown, this size can
be used to skip the subpacket and decode the next
subpacket. This field shall be a multiple of 4. If the
subpacket structure is not a multiple of 4, padding will
T
be automatically added at subpacket creation.
PS
Consequently, if the subpacket size is larger than the
parsing tool expects, but it is an ID and version it
om 23
understands, the parsing tool should parse as much
as it understands and ignore the remaining bytes,
.c 3:
sn 5:5 treating them as a reserved field.
Sub Packet Specific Data Variable length data specific to the particular
subpacket ID and version
i-n t 0
or 5 a
4 6.4.2.2 Serving cell info subpacket

r.h .0
ca .01
5 This packet logs the serving cell information on which the new measurement configuration
6 command is received on and the time it was processed.
os 12
Field Description
20
Subpacket header
E-ARFCN Range is 0 to 29649
Subframe number The sub/system frame number at the time of meas config
processing represented as sfn*10+subfn
Serving Physical Cell ID Range is 0 to 503
7 6.4.2.3 Conn Meas Config Bitmasks subpacket

8
NOTE: This section was added to this document revision.
9 This packet logs the various bitmasks in the connected mode meas config
Field Description
Subpacket header The following describes the version 1 of the subpacket
Meas ID Mod Bitmask 32-bit bitmask displayed in binary
Meas ID Valid Bitmask 32-bit bitmask displayed in binary
Meas Obj Mod Bitmask 32-bit bitmask displayed in binary
Meas Obj Valid Bitmask 32-bit bitmask displayed in binary
Report Cfg Mod Bitmask 32-bit bitmask displayed in binary
Report Cfg Valid Bitmask 32-bit bitmask displayed in binary

1 6.4.2.4 Measurement ID configuration subpacket

2
NOTE: Numerous changes were made in this section.
3 This is a subpacket of the Connected mode measurement configuration log packet.

4
Field Description
Subpacket header The following describes the version 2 of the subpacket
Number of Measurement IDs (N) Range is 0 to 32
Reserved
> Measurement ID Range is 0 to 31
> Measurement Object ID Range is 0 to 31
> Report Configuration ID Range 0 to 31
> Reserved
T
PS
om 23
.c 3:
sn 5:5
i-n t 0
or 5 a
r.h .0
ca .01
os 12
20

1 6.4.2.5 Measurement object configuration subpacket

2
NOTE: Numerous changes were made in this section.

4
Field Description
Sub packet header The following describes the version 2 of the subpacket
Number of measurement objects (N) Range is 0 to 32
Reserved
> > Reserved
> > Meas Object ID Range is 0 to 31
> > Measurement Bandwidth
T
PS
> > Carrier Frequency Range is 0 to 65535
> > Frequency offset Range is -24 dB to 24 dB, encoded as 0x00: -24 dB to
om 23
0x30: 24 dB
.c 3:
> > Number of Neighbor Cells (M) sn 5:5Range is 0 to 32
> > Reserved
i-n t 0
> > Physical Cell ID of cell for which to Range is 0 to 503

report CGI Value 0x1FF indicates not specified
or 5 a
> > Number of Blacklisted Cells (L) Range is 0 to 32

r.h .0
> > Reserved

ca .01
> > > Physical Cell ID Range is 0 to 503

os 12
> > > Cell Individual offset Range is -24 dB to 24 dB, encoded as 0x00: -24 dB to
20
0x30: 24 dB
> > > Start Physical Cell ID Range is 0 to 503
> > > Reserved
> > > End Physical Cell ID Range is 0 to 503
> > > Reserved
5 6.4.2.6 Quantity config subpacket

7
Field Description
Subpacket header
> EUTRA RSRP Filter Coefficient
> EUTRA RSRQ Filter Coefficient

1 6.4.2.7 Measurement gap configuration subpacket

3
Field Description
Subpacket header
Meas Gap Activation
The following are logged only if gaps are activated
Gap Pattern Note: Gap pattern is invalid if gaps are deactivated
Gap offset Range is 0 to 79
Note: Range is restricted to 0 to 39 for gap pattern 1
6.4.2.8 S-Measure configuration subpacket
T
4
PS
6
om 23
Field Description
.c 3:
sn 5:5
Subpacket header
s-Measure In units of dBm, range from -140 dBm to -44 dBm.
i-n t 0
Reserved
or 5 a
r.h .0
7 6.4.2.9 Neighbor cell configuration subpacket

ca .01

os 12
9
20
Field Description
Subpacket ID
Neighbor Cell Configuration
10 6.4.2.10 Speed-dependent scaling parameters subpacket

12
Field Description
Subpacket ID
Scaling Enabled
Note: remaining fields only valid if scaling is enabled
t-Evaluation
t-HystNormal
Reserved
n-CellChangeMedium Range is 1 to 16
timeToTriggerSF-Medium
Reserved
n-CellChangeHigh Range is 1 to 16

Field Description
timeToTriggerSF-High
Reserved
1 6.4.3 LTE ML1 Connected mode LTE intra-frequency measurement

2 results (LOG_CODE 0xB179)
3 This log packet gives information about the cells measured during each measurement period,
4 including the filtered results. The log is generated every measurement period, currently
5 configured to be 160 ms.
6
Field Description
T
PS
Version Version number
Version 2 corresponds to the following
om 23
Reserved Filling
E-ARFCN
.c 3: Range is 0 to 29649
sn 5:5
Serving Physical Cell ID Range is 0 to 503
i-n t 0
Subframe number The sub/system frame number of the beginning of the

measurement period represented as (sfn * 10 +subfn)
or 5 a
Serving Filtered RSRP Filtered RSRP result for the serving cell at the end of
r.h .0
the measurement period.

ca .01
In units of dBx16, range -140 to -40 dBm

0x00 = -140 dBm, 0x1 = -139.9375 dBm, ….. ,
os 12
Reserved
20
Serving Filtered RSRQ Filtered RSRQ result for the serving cell at the end of
the measurement period.
In units of dBx16, range is -30dB to 0dB.
0x000: -30dB to 0x1E0: 0 dB
Reserved
Number of Measured Neighbor Cells (N) Number of cells measured during this measurement
period.
Range is 0 to 18 (5 bit value)
3 bit (MSB) reserved
Number of Detected Cells (M) Number of new cells detected during the previous
measurement period. Some, none, or all of these may
be included in the measured cell list.
Range is 0 to 8
> Filtered RSRP Filtered RSRP result for the neighbor cell at the end
of the measurement period.
In units of dBx16, range -140 to -40 dBm
0x00 = -140 dBm, 0x1 = -139.9375 dBm,
> Reserved

Field Description
> Filtered RSRQ Filtered RSRQ result for the cell at the end of the
measurement period.
In units of dBx16, range is -30dB to 0dB.
0x000: -30dB to 0x1E0: 0 dB
> Reserved
> Reserved
> Reserved
> SSS Corr Value The SSS correlation result
> Reference Time The absolute ref time of this cell
(Note this is split into two 32-bit fields)
T
PS
om 23
.c 3:
sn 5:5
i-n t 0
or 5 a
r.h .0
ca .01
os 12
20

1 6.5 Idle mode log packets
2 6.5.1 LTE ML1 S criteria check procedure (LOG_CODE 0xB17A)

3 This packet would be logged whenever ML1 transitions to Idle from connected (cell selection) or
4 cell reselection while in Idle mode.
5
Field Description
Number Subpackets Number of subpackets concatenated on the end of the
packet
Reserved Reserved
T
Subpackets One or more subpackets concatenated together compose
PS
this field
om 23
6 This packet will include:
7 
.c 3:
LTE ML1 Idle Meas Cell Select Request Subpacket
sn 5:5
8  LTE ML1 Idle Meas serving Cell Measurements Subpacket
i-n t 0
or 5 a
9 6.5.2 LTE ML1 paging DRX request (LOG_CODE 0xB17C)

r.h .0
Logged on receiving paging DRX configuration for the current serving cell from RRC, after
ca .01
10
11 camping on a cell and subsequently if and when the SIB2 get updated by the NW.
os 12
12
20
Field Description
Reserved RESERVED
Physical cell ID Range is 0 to 504
Paging Cycle
Nb
UE ID IMSI mod 1024; range is 0 to 1023
Paging SFN offset Range is 0 to 1023
Paging sub-FN offset Range is 0 to 9
Reserved

1 6.5.3 LTE ML1 idle measurement request (LOG_CODE 0xB17D)

2 This packet would be logged whenever ML1 gets the idle measurement configuration request
3 from RRC.
4
Field Description
packet
Reserved Reserved
this field
5
T
PS
6 This packet will include a minimum of:
LTE ML1 Idle Meas Common Config Subpacket
om 23
7 
.c 3:
8 It may contain in addition the following subpackets
sn 5:5
9  LTE ML1 Idle Meas Resel Common Params Subpacket
i-n t 0
10  LTE ML1 Idle Meas Mobility Params Subpacket

or 5 a
11  LTE ML1 Idle Meas Serving Frequency Resel Info Subpacket

r.h .0
12  LTE ML1 Idle Meas Intra Frequency Resel Info Subpacket

ca .01
13  LTE ML1 Idle Meas Intra frequency Whitelist Info Subpacket

os 12
 LTE ML1 Intra Frequency BlackList cells Subpacket

20
14
15 6.5.4 LTE ML1 UE Mobility state change (LOG_CODE 0xB17E)

16 Logged when UE mobility state changes.
17
Field Description
Reserved Reserved
Previous UE mobility state
Current UE mobility state
Reserved Reserved
Camp time Camp time in milliseconds since power up
Current time Current time in milliseconds since power up
High state end time High mobility state end time in milliseconds since power up
Invalid if set to ((uint64)(-1))

Field Description
Medium state end time High mobility state end time in milliseconds since power up
Invalid if set to ((uint64)(-1))
T_cr_max
T_cr_max_hyst
N_cr_medium Range is 1 to 16
N_cr_high Range is 1 to 16
Reserved Reserved
Reserved Reserved
> Cell change time Cell change time in milliseconds since power up
> Old cell E-ARFCN Range is 0 to 39649
> Old cell physical cell ID Range is 0 to 504
> Reserved Reserved
T
> New cell E-ARFCN Range is 0 to 39649
PS
> New cell physical cell ID Range is 0 to 504
om 23
> Cell change type
.c 3:
> Reserved Reserved
sn 5:5
i-n t 0
1 6.5.5 LTE ML1 serving cell measurements and evaluation

or 5 a
2 (LOG_CODE 0xB17F)
r.h .0
3 Logged once every DRX cycle after serving cell measurements are done.
ca .01

os 12
20
Field Description
Standards version Indicate the 3GPP standards version
Reserved Reserved
Serving layer priority Range is 0 to 7
Reserved Reserved
Measured RSRP In units of dBx16, range -140 to -40 dB.
Reserved
Average RSRP In units of dBx16, range -140 to -40 dB
Reserved
Measured RSRQ In units of dBx16, range is -30dB to 0dB.
Reserved
Average RSRQ In units of dBx16, range is -30dB to 0dB.
Reserved
Measured RSSI In units of dBx16, range -110 to -10 dBm

Field Description
Reserved
Qrxlevmin In units of dB, range -140 to -44, in steps of 2
0x00 = -140, 0x1 = -138, ….., 0x30 = -44
P_max In units of dBm, range -30 to 33, 0x40 indicates not
present
Max UE Tx Power In units of dBm, range -30 to 33, 0x40 indicates not
present
Srxlev In units of dB, range -30 to 50 dB
# of consecutive DRX cycles of S < 0 Range is 0 to 63 DRX cycles
S_intra_search Range is 0 to 62 in steps of 2, 0x20 indicates not present
S_non_intra_search Range is 0 to 62 in steps of 2, 0x20 indicates not present
Measurement Rules Updated Boolean
T
Measurement Rules Bitmask of 4 bits, meaning of bits indicated below
PS
Reserved Reserved
om 23
Below fields exists only if standard version is REL 9
.c 3:
Qqualmin sn 5:5 (Release 9 only) Range is -34 dB to -3 dB, in step of 1 dB.
0x21 = NP
Squal (Release 9 only) In units of dB, range is -35 to 34 dB
i-n t 0
S_intra_search_Q (Release 9 only) Range is 0 to 31 in steps of 1, 0x20

or 5 a
indicates not present

r.h .0
S_non_intra_search_Q (Release 9 only) Range is 0 to 31 in steps of 1, 0x20

ca .01

0x0 = 0 dB, 0x1 = 1 dB to 0x1F = 31 dB, 0x20 = NP
os 12
Reserved
20
End of REL 9 fields

1
2 6.5.6 LTE ML1 LTE neighbor measurements log packet (LOG_CODE

3 0xB180)
4 Logged once per LTE neighbor cell measurements. This will include measurements on new cells
5 also. There is no separate log packet for cell detection.
6

7
Field Description
 0x00 – Release 8
 0x01 – Release 9
Reserved

Field Description
Num cells Range is 1 to 16, 0x0 = 1, 0x1 = 2 to 0xF = 16
Reserved
> Physical cell ID Range is 0 to 504
> Measured RSSI In units of dBx16, range -110 to -10 dBm
> Measured RSRP In units of dBx16, range -140 to -40 dBm.
> Reserved
> Average RSRP In units of dBx16, range -140 to -40 dBm
> Reserved
> Reserved
> Measured RSRQ In units of dBx16, range is -30dB to 0dB.
> Reserved
> Avg RSRQ in units of dBx16, range is -30dB to 0dB. B
T
> Reserved
PS
> Srxlev In units of dB, range -30 to 50 dB
om 23
> Reserved
.c 3:
> Freq_offset sn 5:5 Frequency error
> Reserved
i-n t 0
> Ant0_frame_offset Antenna 0 cell frame offset (SFN) wrt 0 time if SFN is
known
or 5 a
> Ant0_sample_offset Antenna 0 cell frame boundary in Ts units

r.h .0
> Reserved
ca .01
> Ant1_frame_offset Antenna 1 cell frame offset (SFN) wrt 0 time if SFN is
known
os 12
> Ant1_sample_offset Antenna 1 cell frame boundary in Ts units

20
> Reserved
> Squal (Release 9 only) In units of dB, range is -35 to 34 dB
0x00 = -35 dB, 0x1 = -34 dB to 0x46 = 34 dB
> Reserved
End of REL 9 fields

1 6.5.7 LTE ML1 intra frequency cell reselection log packet (LOG_CODE
2 0xB181)
3 Logged once per DRX cycle only if reselection evaluation is done.
4
Field Description
packet
Reserved Reserved
this field
T
5 This packet will include:
PS
6  LTE ML1 Idle Meas Reselection Measurement Common Params Subpacket
om 23
7  LTE ML1 Idle Meas Serving Frequency Resel Info Subpacket
.c 3:
LTE ML1 Idle Meas Reselection Measurements LTE Frequency Subpacket (Named Intra
sn 5:5
8 
9 Frequency Measurements )
i-n t 0
or 5 a
10 6.5.8 LTE ML1 pBCH decode log packet (LOG_CODE 0xB183)

r.h .0
This packet is logged on obtaining the pBCH decode results from the FW.
ca .01
11
12
os 12
Field Description
20

Reserved
EARFCN Range is 0 to 39649 EARFCN of the cell to perform PBCH
on
PBCH Payload Raw PBCH payload invalid if CRC pass is FALSE
Cell ID Range is 0 to 504 Cell ID of the cell to perform PBCH on
Num decodes The number of PBCH decodes attempted
PBCH Type
Decode_result
CRC Pass 1 (TRUE) when CRC passes 0(FALSE) otherwise
Num Antennas 1, 2 or 4 depending on the network config
RV The Revision version of the PBCH that was successfully
decoded
Phich duration PHICH duration enum as defined in [S6]
PHICH Resource PHICH resource enum as defined in [S6]
SFN The system frame number when PBCH was decoded (at
the start of the PBCH TTI)
Frequency offset The frequency offset estimate based upon the PBCH
decode

Field Description
Ref time Lower bits The lower bits of the PBCH reference
Ref time Upper bits The upper bits of the PBCH reference timing
Frame offset Frame offset – (cell frame number - reference RTC frame
number) % 1024
Range is 0 to 1023
Note: Special value -1 indicates unknown (SFN not
known)
Sample offset Frame offset – (cell frame number - reference RTC frame
number) % 1024
Range is 0 to 1023
Note: Special value -1 indicates unknown (SFN not
known)
DL Bandwidth The downlink bandwidth of a cell, in number of resource
blocks
T
Reserved
PS
1
om 23
.c 3:
2 6.5.9 LTE ML1 CDMA Neighbor measurements log packet
sn 5:5
3 (LOG_CODE 0xB185)
i-n t 0
4 This log packet is logged when a CDMA measurement is received from either HDR or 1X.
or 5 a
Field Description
r.h .0
ca .01

os 12

20
packet
Reserved Reserved
this field
6 This packet may include the following subpackets:

7  LTE ML1 HRPD results subpacket

1 6.5.10 LTE ML1 reselection candidates log packet (LOG_CODE

2 0xB186)
3 This log packet is logged when the reselection evaluation is performed in the drx cycle.
4
Field Description
Reserved
Serving EARFCN EARFCN of the cell to perform PBCH on; range is 0 to
39649
Serving Cell ID Cell ID of the cell to perform PBCH on; range is 0 to 504
Num_Reselection_CandIDate Size of the reselection candidate substructure array; max 7
T
Array of Reselection CandIDate See Section 6.5.10.1
PS
Substructure
5
om 23
6.5.10.1 Reselection candidate substructure
.c 3:
6
sn 5:5
7
i-n t 0
Field Description
or 5 a
CandIDate Priority The priority of the layer the candidate cell resides on;
range is 0 to 7, as defined in [S6]
r.h .0
ca .01
CandIDate Rat Type

RAT Specific Cell Structure LTE/GSM/WCDMA cell structure (see Section 6.5.10.2 –
os 12
Section 6.5.10.4)
20
9 6.5.10.2 LTE cell structure (CandIDate RAT Type = 0)

10
Field Description
EARFCN EARFCN of the reselection candidate; range is 0 to 39649
Cell ID Cell ID of the reselection candidate; range is 0 to 504
Reserved
11
12 6.5.10.3 GSM cell structure (CandIDate RAT Type = 2)

13
Field Description
ARFCN The ARFCN of the reselection candidate
Band The band the reselection candidate resides on
BSIC ID The base station identity code

1 6.5.10.4 WCDMA cell structure (CandIDate RAT Type = 1)

2
Field Description
U ARFCN UARFCN of the reselection candidate
PSC The primary scrambling code of the reselection candidate
3 6.5.10.5 CDMA cell structure (CandIDate RAT Type = 3 or 4)

4
Field Description
Band The band of the reselection candidate
Reserved
Channel The channel of the reselection candidate
T
PS
Pilot The pilot ID of the reselection candidate
om 23
5 6.5.11 LTE ML1 idle IRAT measurement request (LOG_CODE 0xB187)
.c 3:
sn 5:5
6 This packet would be logged whenever ML1 gets the Idle measurement configuration request
7 from RRC that contains IRAT information.
i-n t 0
8
or 5 a
Field Description
r.h .0

ca .01

os 12
packet
20
Reserved Reserved
this field
9 It may include the following subpackets

10  LTE ML1 CDMA system time subpacket
11  LTE ML1 Idle Meas CDMA config subpacket
12  LTE ML1 Idle Meas WCDMA Config Subpacket

1 6.5.12 LTE ML1 CDMA system time (LOG_CODE 0xB189)

2 This log packet is logged when the reselection evaluation is performed in the drx cycle.
3
Field Description
packet
Reserved Reserved
this field
4 It may include the following subpackets
T
 LTE ML1 CDMA system time subpacket
PS
5
om 23
6 6.5.13 LTE ML1 idle neighbor cell measurement request/response log
packet (LOG_CODE 0xB192)
.c 3:
7
sn 5:5
8 Logged whenever neighbor cell measurement request and response are received and processed.
i-n t 0
or 5 a
Field Description
r.h .0
Version Log packet version; range: 0…255

ca .01

Number Sub-packets Number of subpackets concatenated on the end of the
os 12
packet
20
Reserved Reserved
Sub-Packets One or more subpackets concatenated together compose
this field
9 It may include the following subpackets:

10  LTE ML1 Idle Mode Neighbor Cell Measurement Request Subpacket
11  LTE ML1 Neighbor Cell Measurement Results Subpacket

1 6.5.14 LTE ML1 serving cell measurement result log packet

2 (LOG_CODE 0xB193)
3 Logged whenever serving cell measurement results are processed, this is common for both Idle
4 and Connected mode.
Field Description
Version Log packet version; Range: 0…255
packet
Reserved Reserved
this field
T
PS
om 23
6  LTE ML1 Serving Cell Measurement Result Subpacket
.c 3:
sn 5:5
7 6.5.15 LTE ML1 neighbor cell search request/response log packet
i-n t 0
8 (LOG_CODE 0xB194)
or 5 a
9 Logged whenever neighbor cell search request and response are processed. This is common for
Idle and Connected mode.
r.h .0
10
ca .01
Field Description
os 12

20

packet
Reserved Reserved
this field

12  LTE ML1 Neighbor Cell Search Response Subpacket
13  LTE ML1 Neighbor Cell Search Request Subpacket

1 6.5.16 LTE ML1 Connected Mode neighbor meas request response

2 log packet (LOG_CODE 0xB195)
3 Logged whenever neighbor cell measurement request and response are processed in Connected
4 mode.
Field Description
packet
Reserved Reserved
this field
T
PS
om 23
6  LTE ML1 Neighbor Cell Measurements Results Subpacket
.c 3:
7  LTE ML1 Connected Neighbor Meas Request Subpacket
sn 5:5
i-n t 0
8 6.5.17 LTE ML1 Serving Cell Information log packet (LOG_CODE

or 5 a
9 0xB197)
r.h .0
10 This packet is logged on acquisition and thereafter on any serving cell change.
ca .01
Field Description
os 12
Version Log packet version; range 0…255

20

DL Bandwidth Downlink bandwidth of the serving cell
SFN System frame number when PBCH was decoded (at the start of the PBCH
TTI)
EARFCN Range: 0-39649 EARFCN of the serving cell
Cell id Range: 0-504 Cell ID of the serving cell
PBCH Decode Result
PHICH duration PHICH duration enum as defined in [S6]
Display strings
PHICH Resource PHICH resource enum as defined in [S6]
Display strings
PSS correlation PSS correlation value of serving cell
SSS correlation SSS correlation value of serving cell
Ref time Lower bits Lower bits of the PBCH reference timing
Ref time Upper bits Upper bits of the PBCH reference timing
MIB Payload Raw PBCH payload
Frequency Offset Frequency offset estimate based upon the PBCH decode. This is a signed
value.
Num Antennas
Reserved Reserved

1 6.5.18 LTE ML1 Sleep (LOG_CODE 0xB18B)

2 This log packed is logged every wakeup.
Field Description
Version Version number of this packet
Version – 1 corresponds to below structure
Reserved RESERVED
E_ARFCN Range: 0-39649
Physical cell id Range: 0-504
Wakeup type
Sleep subframe Range: 0-9
Sleep SFN Range: 0-1023
Sleep Reference Time Range: 0-307199 (in units of Ts: 30.72Mhz)
T
Wakeup SFN Range: 0-1023
PS
Wakeup subframe Range: 0-9
om 23
Wakeup Object subframe Range: 0-9
.c 3:
Wakeup Object SFN Range: 0-1023
sn 5:5
Reserved RESERVED
i-n t 0
6.6 Idle mode log subpackets

or 5 a
3
r.h .0
ca .01
4 6.6.1 Log subpacket structure

os 12
5 Each subpacket has a subpacket header.

20
Field Description
Sub Packet ID Unique subpacket identifier
skipped
Sub Packet Size Size in bytes of the subpacket including the header; if the
version of the subpacket is unknown, this size can be used
to skip the subpacket and decode the next subpacket. This
field shall be a multiple of 4. If the subpacket structure is
not a multiple of 4, padding will be automatically added at
subpacket creation. Consequently, if the subpacket size is
larger than the parsing tool expects, but it is an ID and
version it understands, the parsing tool should parse as
much as it understands and ignore the remaining bytes,
treating them as a reserved field.
Sub Packet Specific Data Variable length data specific to the particular subpacket ID
and version
7

1 6.6.2 LTE ML1 idle meas common config subpacket

Field Description
SUBPKT_HDR Described in Section 6.6.1
(ID = 0x1, Version = 1)
Idle measurements removal bitmask Bitmask of configuration removed in Idle measurements
request
Need to accommodate for UTRA TDD, HRPD, LTE TDD
Idle Meas Cfg Bitmask Bitmask of configuration included in Idle measurement req
Need to accommodate for UTRA TDD, HRPD, LTE TDD
2
3 6.6.3 LTE ML1 idle meas resel common params subpacket

4
T
PS
Field Description
om 23
Qhyst
.c 3:
sn 5:5
Same reference signals in neighbors
Mobility state params configured
i-n t 0
Reserved
or 5 a
5
r.h .0
ca .01
6 6.6.4 LTE ML1 idle meas mobility params subpacket

os 12
7
20
Field Description
TCrmax
TCrmaxhyst
NCR_H Range is 1 to 16
NCR_M Range is 1 to 16
Qhyst_high
Qhyst_medium
Reserved
8
9 6.6.5 LTE ML1 idle meas cell select request subpacket

10
Field Description

Field Description
Reserved
Qrxlevminoffset In units of dB, range 0 to 16, in steps of 2, 0x0 indicates
not present
Reserved
P_max In units of dBm, range -30 to 33, 0x40 indicates not
present
Max UE Tx Power In units of dBm, range -30 to 33, 0x40 indicates not
present
T
PS
Qqualminoffset (Release 9 only) In units of dB, range 1 to 8, in steps of 1,
om 23
0x0 indicates not present
.c 3:
Qqualmin sn 5:5 (Release 9 only) Range is -34 dB to -3 dB, in step of 1 dB..
Reserved
i-n t 0
End of REL 9 fields

or 5 a
r.h .0
1
ca .01
6.6.6 LTE ML1 idle meas serving frequency resel info subpacket
os 12
2
3
20

4
Field Description
Reserved
Serving cell priority Range is 0 to 7
S_non_intra_search Range is 0 to 62 in steps of 2, 0x20 indicates not present
Thresh_serving_low Range is 0 to 62 in steps of 2, range 0 to 31
Reserved
S_non_intra_search_Q (Release 9 only) Range is 0 to 31 in steps of 1
Thresh_serving_low_Q (Release 9 only) Range is 0 to 31 in steps of 1,
Reserved
End of REL 9 fields
5

1 6.6.7 LTE ML1 idle meas intra frequency resel info subpacket
2
Field Description
Reserved
Qrxlevmin for intra frequency neighbors In units of dB, range -140 to -44, in steps of 2
0x00 = -140, 0x1 = -138, to 0x30 = -44
P_max Maximum value for output power that the UE should use
In units of dBm, range -30 to 33, 0x40 indicates not
present
T
0x0 = -30, 0x1 = -29 to 0x3F = 33, 0x40 = NP
PS
Measurement BW Bandwidth to restrict measurements on
om 23
Treselection_eutran In units of seconds; range is 0 to 7
.c 3:
Reserved sn 5:5
Treselection_eutran_medium
Treselection_eutran_high
i-n t 0
Neighbour_cell_config neighCellConfig : ProvIDes information related to MBSFN

or 5 a
and TDD UL/DL configuration of neighbour cells of this

frequency
r.h .0
For TDD, 00, 10 and 01 are only used for same UL/DL
ca .01
allocation in neighbouring cells compared to the serving

cell.
os 12
20
CSG PCI range present

Reserved
S_intra_srch Range is 0 to 62 in steps of 2, 0x20 indicates not present
Reserved
Following two fields present only if CSG PCI range present is set to 0x1
>CSG PCI range start pci Range is 0 to 504
>CSG PCI range end pci Range is 0 to 504
If end pci is same as start pci then there is only one CSG
cell, else it is a range from start pci until end pci (included).
S_intra_search_Q (Release 9 only) Range is 0 to 31 in steps of 1, 0x20
Q_qualmin Range -34 to -3
Reserved
End of REL 9 fields
4

1 6.6.8 LTE ML1 idle meas intra frequency whitelist info subpacket
2
Field Description
> SUBPKT_HDR Described in Section 6.6.1
Num_white_listed-cells Range is 0 to 16
Reserved
For each white listed cell from 1 to 16
>Physical cell ID of neighbor cell Range is 0 to 504
>Qoffset of neighbor cell
>Reserved
3
T
PS
4 6.6.9 LTE ML1 Idle Meas serving Cell Measurements subpacket
om 23
Field Description
SUBPKT_HDR
.c 3: Described in Section 6.6.1
sn 5:5
i-n t 0
Reserved
or 5 a
Inst Measured RSRQ In units of dBx16, range -30 to 0 dB

r.h .0
ca .01
Inst Measured RSRP In units of dBx16, range -140 to -44 dBm

Reserved
os 12
Inst Measured RSSI In units of dBx16, range -140 to -44 dBm

20
Display_avg 0x1 means display the average values, 0x0 means do not
display the averages
Reserved
Avg Measured RSRQ In units of dBx16, range -30 to 0 dB
Reserved
Avg Measured RSRP In units of dBx16, range -140 to -44 dBm
Reserved
Avg Measured RSSI In units of dBx16, range -140 to -44 dBm
Reserved
Reserved
End of REL 9 fields

1 6.6.10 LTE ML1 idle meas intra frequency blacklist cells subpacket
2
Field Description
Num_black_listed_cells Range is 0 to 16
Reserved
>Start pci of blacklisted cell range Range is 0 to 504
>End pci of blacklisted cell range Range is 0 to 504
If end pci is same as start pci then there is only one black
listed cell, else it is a range from start pci until end pci
(included)
Why not have this as a just the blacklisted pci[] The given
structure would help only if the pci values are contiguous
T
3
PS
om 23
4 6.6.11 LTE_ML1 Idle mode reselection measurements common
.c 3:
5 parameters subpacket sn 5:5
6
i-n t 0
Field Description
or 5 a

(ID = 0xA, Version = 1)
r.h .0
Serving cell EARFCN Range is 0 to 39649

ca .01
Serving cell physical cell ID Range is 0 to 504

os 12
Current UE mobility state

20
Priority categories evaluated Bitmask of which priority categories have been evaluated
Reserved
7

1 6.6.12 LTE ML1 Idle mode reselection measurements LTE frequency

2 subpacket
3
Field Description
(ID = 0xB, Version = 1)
EARFCN Range is 0 to 39649
Treselection In units of seconds; range is 0 to 7
Qoffset_frequency
Priority Range is 0 to 7
# of cells evaluated Range is 1 to 16
Reserved
T
>Neighbor cell physical cell ID Range is 0 to 504
PS
>Neighbor cell Srxlev In units of dB, range -30 to 50 dB
om 23
>RSSI Instantaneous In units of dBx16, range -140 to -44 dBm
.c 3:
>Reserved sn 5:5
>RSRP Average In units of dBx16, range -140 to -44 dBm
i-n t 0
>RSRP Instantaneous In units of dBx16, range -140 to -44 dBm

>RSRQ Average In units of dBx16, range -30 to 0 dB
or 5 a
>Reserved
r.h .0
>RSRQ Instantaneous In units of dBx16, range -30 to 0 dB

ca .01
>Neighbor cell Qoffset In units of dB.

os 12
>Neighbor cell Rank Range is -164 to -20

20
>Neighbor cell Treselection In units of seconds; range is 0 to 63

>Reserved
4

1 6.6.13 LTE ML1 idle meas CDMA config subpacket

Field Description
(ID = 0xC, Version = 1)
CDMA window size CDMA window size; range is 0 to 15
Reserved
HRPD cell reselection parameters See following table
1X cell reselection parameters See following table
2 Table 6-1 CDMA cell reselection parameters
Field Description
T
PS
Tresel Range is 0 to 7
Tresel medium scaling factor
om 23
Tresel high scaling factor
.c 3:
sn 5:5
Number of band classes Number of band class configurations; range 0 to 32
Number of neighbors Number of CDMA neighbors; range is 0 to 32
i-n t 0
Reserved
or 5 a
CDMA Band class list (1 to 32) See below

r.h .0
CDMA Neighbor list (1 to 32) See below

ca .01
Table 6-2 CDMA band class information

os 12
3
20
Field Description
Band class Range is 0 to 31
Cell reselection priority Range is 0 to 7
ThreshX high Range is 0 to 63
ThreshX low Range is 0 to 63
5 Table 6-3 CDMA neighbor information

6
Field Description
Band Range is 0 to 31
Reserved
Channel Range is 0 to 2047
Pilot ID Range is 0 to 511

1 6.6.14 LTE ML1 HRPD results subpacket

2
Field Description
(ID = 0xD, Version = 1)
Number of pilots Range is (0 to 32)
Band Range is (0 to 31)
Channel Range is (0 to 2047)
HRPD pilot results list (1 to 32) See below
3 Table 6-4 HRPD pilot results parameters

4
T
Field Description
PS
Pilot ID Range is (0 to 511)
om 23
Strength (dB) Strength in half-dB units
.c 3:
Strength (linear) Strength in linear ecio
sn 5:5
5
i-n t 0
or 5 a
6 6.6.15 LTE ML1 HRPD MDB subpacket

7
r.h .0
ca .01
Field Description
Reserved
os 12
8
20
9 Table 6-5 HRPD layer parameters

10
Field Description
Reserved
11
12 Table 6-6 HRPD pilot parameters

13
Field Description
Reserved
14

1 6.6.16 LTE ML1 CDMA system time subpacket

2
Field Description
(ID = 0xF, Version = 1)
E-ARFCN LTE channel CDMA system time is for; range is 0 to
39649)
Physical cell ID LTE cell ID CDMA system time is for; range is 0 to 504)
LTE SFN LTE SFN boundary at the end of the SI-window in which
SIB8 is sent
Synchronized Whether the LTE system is synchronized
Reserved
CDMA system time CDMA system time
LTE RTC LTE RTC value time-synced with CDMA system time
T
PS
6.6.17 LTE ML1 serving cell measurement result subpacket
om 23
3
4
.c 3:
sn 5:5
5
i-n t 0
Field Description
or 5 a

r.h .0

ca .01
earfcn Cell Frequency. Range: 0 to 39649

os 12
phy_cell_id Physical Cell ID. Range: 0 to 504

20
reserved
current_sfn Range: 0 to 1023
cell_timing[0] Range: 0 to 307199
reserved
cell_timing[1] Range: 0 to 307199
cell_timing_sfn[0] Range: 0 to 1023
reserved
cell_timing_sfn[1] Range: 0 to 1023
Reserved
Reserved
inst_rsrp_rx[1] In units of dBx16, range -140 to -40 dBm..
Reserved
Reserved
Inst_measured_rsrp In units of dBx16, range -140 to -40 dBm
Reserved
Reserved
inst_rsrq_rx[0] In units of dBx16, range is -30dB to 0dB.
Reserved
inst_rsrq_rx[1] In units of dBx16, range is -30dB to 0dB.

Field Description
Reserved
inst_rsrq In units of dBx16, range is -30dB to 0dB.
reserved
Reserved
inst_rssi_rx[0] In units of dBx16, range -110 to -10 dBm
inst_rssi_rx[1] In units of dBx16, range -110 to -10 dBm
inst_rssi In units of dBx16, range -110 to -10 dBm
reserved
Reserved
res_freq_error Residual frequency error
Reserved
sinr_rx[0] In units of dBx4, range -20 to 30 dBm
T
sinr_rx[1] In units of dBx4, range -20 to 30 dBm
PS
reserved
om 23
Reserved
.c 3:
sn 5:5
1 6.6.18 LTE ML1 Idle mode neighbor cell measurement request
i-n t 0
2 subpacket
or 5 a
3
r.h .0
Field Description
ca .01

(ID = 0x1A, Version = 1)
os 12
earfcn Range: 0 to 65535

20
num_cells Range: 0 to 16
num_rx_ant Either 1 or 2
duplexing_mode
reserved
>cell id Range: 0 to 504
>cp_type cell cyclic prefix type enum
>enb_tx_ant Number of Tx antennas
Can either be 1 or 2
>ttl_enable True/False
>ftl_enable True/False
>reserved
>ftl_cumu_freq_offset Cumulative freq offset in Hz
>frame_bdry_ref_time[0] Frame bounrary ref time 0. Range: 0 to 0xFFFFFFFF
>frame_bdry_ref_time[1] Frame bounrary ref time 1. Range: 0 to 0xFFFFFFFF
>total_timing_adj_cir[0] Total timing adj to CIR 0. Range: 0 to 0xFFFF
>total_timing_adj_cir[1] Total timing adj to CIR 1. Range: 0 to 0xFFFF

1 6.6.19 LTE ML1 neighbor cell measurement results subpacket

2

3
Field Description
num_cells Range: 0 to 16
cnt_swrp Range: 1 to 4
duplexing_mode
Reserved
> ncell_id Range: 0 to 503
T
PS
> ftl_cumu_freq_offset Cumulative frequency offset. Range: 0 to 0xFFFF
> reserved
om 23
>inst_rsrp_rx[0] In units of dBx16, range -140 to -40 dBm
.c 3:
>reserved
sn 5:5
>inst_rsrp_rx[1] In units of dBx16, range -140 to -40 dBm
i-n t 0
>reserved
or 5 a
>inst_rsrp In units of dBx16, range -140 to -40 dBm

>reserved
r.h .0
ca .01
>inst_rsrq_rx[0] In units of dBx16, range is -30dB to 0dB.

> Reserved
os 12
>inst_rsrq_rx[1] in units of dBx16, range is -30dB to 0dB.

20
>reserved
> Reserved
>inst_rsrq In units of dBx16, range is -30dB to 0dB.
>reserved
>inst_rssi_rx[0] In units of dBx16, range -110 to -10 dBm
>reserved
>inst_rssi_rx[1] In units of dBx16, range -110 to -10 dBm
>inst_rssi In units of dBx16, range -110 to -10 dBm
>reserved
> frame_bdry_ref_time[0] Frame boundary ref time 0. Range: 0 to 0xFFFFFFFF
> frame_bdry_ref_time[1] Frame boundary ref time 1. Range: 0 to 0xFFFFFFFF
> total_timing_adj_cir[0] Total timing adj to CIR 0. Range: 0 to 0xFFFF

1 6.6.20 LTE ML1 neighbor cell search request subpacket

2
Field Description
(ID = 0x1C, Version = 1)
num_blocked_cells Range: 0 to 16
num_hf Number of half frames. Range: 1 – 8
hf_gap Gap between 2 successive half frames. Range: 0 to 4
max_sss_pks_per_pss Max SSS peaks per PSS. Range: 1 to 5
cp_type Cell Cyclic Prefix Type enum:
num_sf_srch_win Number of SF search window. Range: 1 to 10
max_results Max number of results. Range: 1 to 16
neighbor_black_list_index Index to the neighbor search black list enum
T
rx_ant_bit_mask
PS
srch_pruning_enum Search pruning enum
om 23
srch_sys_sync_enum Search system selection: (Async vs sync)
.c 3:
srch_fdd_tdd_mode LTE mode selection enum (FDD/TDD)
sn 5:5
reserved
> cell_id Range: 0 to 503
i-n t 0
or 5 a
6.6.21 LTE ML1 neighbor cell search response subpacket

r.h .0
3
ca .01
Field Description
os 12

20
(ID = 0x1D, Version = 1)

neigh_black_list_index Index to neighbor black list .Range: 0 – 3
num_detected_ncells Num of detected neighbor cells. Range: 0 – 8
reserved
engy_est0 Range: 0 to 7FFF
rx_ant_mask Bit 0 = Rx Ant 0
Bit 1 = Rx Ant 1
engy_est1 Range: 0 to 7FFF
srch_abort_flag Bit 0: No abort happened
Bit 1: Search aborted
> frame_bndry 64-bit frame boundary RTC counter higher 32 bits
> frame_bndry 64-bit frame boundary RTC counter lower 32 bits
> sss_corr_value Range: 0 to 0xFFFF_FFFF
> pss_corr_value Range: 0 to 0xFFFF
> cell_id Range: 0 to 503
> cp_type Cell Cyclic Prefix Type enum:
>Reserved
> freq_offset_est Initial pss based frequency offset (signed)
> Reserved

1 6.6.22 LTE ML1 connected neighbor meas request subpacket

2
Field Description
(ID = 0x1E, Version = 1)
num_ncells Num of neighbor cells. Range: 1 to 16
num_rx_ant Can either be 1 or 2
reserved
conn_params Parameters common to all neighbor cells in Connected
mode (see Table 6-7)
> cell id Range: 0 to 503
> cp_type Cell Cyclic Prefix Type enum:
> eNb_tx_ant Number of Tx antennas eNb uses. Can either be 1 or 2
T
PS
> ttl_enable TTL enable/disable
> ftl_enable FTL enable/disable
om 23
> Reserved
> ftl_cumu_freq_offset
.c 3:
Cumulative frequency offset. Range: 0 to 0xFFFF. Valid
sn 5:5
only if ftl_enable is TRUE
i-n t 0
> frame_bdry_ref_time[0] Frame bounrary ref time 0. Range: 0 to 0xFFFFFFFF. Valid

only if ttl_enable is TRUE
or 5 a
> frame_bdry_ref_time[1] Frame bounrary ref time 1. Range: 0 to 0xFFFFFFFF. Valid

r.h .0
only if ttl_enable is TRUE

ca .01

os 12
> total_timing_adj_cir[0] Total timing adj to CIR 0. Range: 0 to 0xFFFF. Valid only if
ttl_enable is TRUE
20
3 Table 6-7 Connected mode common neighbor cell parameters

Field Description
swrp SW reporting period in units of milliseconds, only 40, 80,
or 160 are valid
sp Scheduling period in units of milliseconds, only 40, 80, or
160 are valid
ocassion Ncell occasion enum:
num_sp_per_mp Num of scheduling period per measurement period. Ony
values 1, 2, and 4 are valid
gap_duration Only 7 ms is valid (6, 7, or 8) Cannot be more than 15 ms
gap_mask
Reserved
4 6.6.23 LTE ML1 connected neighbour measurement result subpacket

5 This subpacket has the same structure as LTE ML1 neighbor cell meas result subpacket (see
6 Section 6.6.19). ID = 0x1F, Version = 1.

1 6.6.24 LTE ML1 full frequency scan response subpacket

2
Field Description
scale Scale value for ML to adjust its noise threshold
Center_freq Center frequency (N_DL channel number) to be returned
in Confirmation
Range: 0 to 65535
Num_entries Number of entries in the result arrays
Range: 0 - 200
Full Frequency Scan Bandwidth FFS BW enum:
Range: 0 - 5
duplexing_mode
T
Reserved
PS
Following information is needed for band scan plot. All of the below except energy_estimates will be 0s if
om 23
plot info not available
Scan_num Scan number. ID for a scan, since multiple scans for each
.c 3: band are possible. Range is 0 to 65535.

sn 5:5
Band The Band to camp on; range is 1 to 40
i-n t 0
Num_scan_sets Number of scan sets for this band

or 5 a
Curr_scan_set The number of current scan set. Range is 1 to

num_scan_sets
r.h .0
Start_idx Index in energy_estimate from which plotting should begin

ca .01
End_idx Index in energy_estimate at which plotting should end

os 12
Start_freq Freq corresponding to start_idx. Range: 0 to 65535

20
Reserved
>Energy_estimate Energy estimate value (uint132)
3 6.6.25 LTE ML1 list frequency scan response subpacket

4
Field Description
>SUBPKT_HDR Described in Section 6.6.1
>scale Scale value for ML to adjust its noise threshold
>center_freq Range: 0 to 65535
>list frequency scan bandwidth Range: 0 - 5
>duplexing_mode
>reserved
>Energy_estimate Energy estimate value (uint32)

1 6.6.26 LTE ML1 Idle meas WCDMA LTE config subpacket

Field Description
T_reselection T reslection value 0…7
Sf_medium
Sf_high
num_wcdma_freq 0..15
For each frequency display the following
>Frequency 0..65535
>Cell reselection priority 0..7 value 0 is lowest priority
T
>Threshold_high 0..31
PS
>Threshold_low 0..31
om 23
>Q_rx_lev_min_actual -60..-13
.c 3:
>P_max sn 5:5-50..33
>Q_qual_min -24..0
i-n t 0
or 5 a
r.h .0
ca .01
os 12
20

1 6.7 LTE ML1 BPLMN Log Packets
2 6.7.1 List of BPLMN log packets

3 The following table summarizes the BPLMN Log Packets
4 List of MAC Log Packets
5
Log Packet ID Log Packet Name Section

0xB1A0 BPLMN Start Request 6.7.2
0xB1A1 BPLMN Cell Request 6.7.3
0xB1A2 BPLMN Cell Confirm 6.7.4
T
0xB1A3 BPLMN Time Available Indication 6.7.5
PS
0xB1A4 BPLMN Complete Indication 6.7.6
0xB1A5 BPLMN Stop Request 6.7.7
om 23
0xB1A6 BPLMN Stop Confirm 6.7.8
.c 3:
sn 5:5
6.7.2 TE ML1 BPLMN START REQUEST (LOG CODE: 0xB1A0)
i-n t 0
6
or 5 a
Field Description
r.h .0

ca .01

os 12
Reserved
20
new_req status of the current request

0…1
req_type
start_now Indication to Start immediately or not
num_chans Number of frequency included in this request
Max value = 63
num_b ands 0…63
num_black_freqs 0….63
Reserved Make it 16 bit aligned
For each BPLMN Channel from 0 to 63
> Chans EARFCN Number 0…65535
> Bandwidth Values of Bandwidth 6… 100
> Reserved
For each of the bands
> Band num 0….63, note that 64*6 bits should already be aligned, so
reserved bits here
> Reserved
For each black frequencies 0 to 63
>> black_freqs In units of 100Khz
>> irat_lte_plmn_time_allowed 0….63

1 6.7.3 LTE ML1 BPLMN CELL REQUEST (LOG CODE: 0xB1A1 )

2
Field Description

Reserved
Freq The Frequency the cell is on
Cell_id The Cell ID
barred_status Type of BarredD
Reserved
T
Cell Selection Criteria
PS
q_rxlevmin Minimum Rx level to camp on cell
om 23
q_rxlevmin_offset Range: 0 to 8
.c 3:
p_max sn 5:5
q_qualmin (Release 9 only) Range is -34 dB to -3 dB, in step of 1 dB.
i-n t 0
0x20 = NP
or 5 a
q_qualmin_offset (Release 9 only) Range: 0 to 8

r.h .0
Reserved
ca .01
End of REL 9 fields

os 12
6.7.4 LTE ML1 BPLMN CELL CONFIRM (LOG CODE: 0xB1A2)

20
Field Description
Reserved
freq The Frequency the cell is on
rsrp The measurement of RSRP
bw LTE support bandwidths
cell_id Physical cell ID type Range: 0..503
Reserved
srxlev_calculated Whether Srxlev is calculated or not
srxlev the Srxlev value
Reserved
squal_calculated (Release 9 only) Whether Squal is calculated or not
squal (Release 9 only) the Squal value
Reserved
End of REL 9 fields

1 6.7.5 LTE ML1 BPLMN TIME AVAILABLE INDICATION (LOG CODE:

2 0xB1A3)
Field Description
Reserved
time_avail The time available for LTE to IRAT PLMN search
3 6.7.6 LTE ML1 BPLMN COMPLETE INDICATION (LOG CODE: 0xB1A4)

Field Description
T
PS
om 23
Reserved
.c 3:
sn 5:5
status The Status of the BPLMN search
srv_cell_avail A flag to indicate whether serving cell info available
i-n t 0

or 5 a

r.h .0
Reserved
ca .01

os 12

20
Reserved
Reserved
Reserved
End of REL 9 fields

1 6.7.7 LTE ML1 BPLMN STOP REQUEST LOG (LOG CODE: 0xB1A5)
Field Description

Reserved
2 6.7.8 LTE ML1 BPLMN STOP CONFIRM LOG (LOG CODE: 0xB1A6)
Field Description
T
PS
om 23
Reserved
status Indicates the BPLMN has completely stopped or not
.c 3:
sn 5:5
srv_cell_meas_avail a flag to indicate whether serving cell is available
i-n t 0

or 5 a
Reserved
r.h .0

ca .01

os 12
Reserved
20

Reserved
Reserved
End of REL 9 fields

1 7 MAC Layer
2 7.1 Log packets

3 MAC log packets have log codes from 0xB060 through 0xB067. Each log packet contains the
4 following:
5  Log packet definition – Unique definition for each log packet; see Section 7.1.2 to 7.1.8 for
6 details.
T
PS
7  Log packet structure – Shared structure used by MAC log packets; see Section 7.2 for details.
 Subpackets for MAC – Unique subpacket Identified by subpacket ID; each packet may
om 23
8
9 contain one or more subpackets; see Section 7.2.1 to 7.2.10 for details.
.c 3:
sn 5:5
10 7.1.1 MAC log packet structure
i-n t 0
11
or 5 a
Field Description
r.h .0

ca .01

os 12
packet
20
Reserved Reserved
this field
12
13 7.1.2 List of MAC log packets

14 The following table summarizes the MAC Log Packets.
15 Table 7-1 List of MAC Log Packets

Log Packet
Log Packet Name Internal/External Section
ID
0xB060 MAC Configuration External 7.1.3
0xB061 MAC RACH trigger External 7.1.4
0xB062 MAC RACH Attempt External 7.1.5
0xB063 MAC DL Transport Block External 7.1.6
0xB064 MAC UL Transport Block External 7.1.7
0xB067 MAC UL Tx Statistics External 7.1.8

MAC Layer
1 7.1.3 LTE MAC configuration (LOG_CODE 0xB060)

2 This log packet will be generated each time MAC receives a configuration from RRC.
3 This log packet uses the:
4 Log packet structure described in Section 7.2.
6 – MAC cfg type subpacket (described in Section 7.2.2)
7 – MAC DL cfg subpacket (described in Section 7.2.3)
8 – MAC RACH cfg subpacket (described in Section 7.2.4)
9 – MAC UL cfg subpacket (described in Section 7.2.5)
10 – MAC LC info subpacket (described in Section 7.2.6)
T
PS
11 7.1.4 LTE MAC RACH trigger (LOG_CODE 0xB061)
om 23
12 This log packet will be logged whenever the RACH procedure is triggered.
.c 3:
13 This log packet uses the: sn 5:5
i-n t 0

or 5 a
16 – MAC RACH cfg subpacket (described in Section 7.2.4)

r.h .0
– MAC RACH reason subpacket (described in Section 7.2.7)

ca .01
17
os 12
18 7.1.5 LTE MAC RACH attempt (LOG_CODE 0xB062)

20
19 This will be logged for each attempt of the RACH. The packet could either contain all the
20 message entries (MSG1, MSG2, MSG3, and MSG4) or could be a subset of these depending on
21 at what stage this particular RACH attempt passed or failed. This could also be a subset when it is
22 a contention based RACH procedure.
26 – MAC RACH attempt subpacket (described in Section 7.2.8)
27 7.1.6 LTE MAC DL transport block (LOG_CODE 0xB063)

28 This is an accumulated log packet. The packet will be logged every N Subframes, where N is a
29 constant determined in the AMSS. Each entry will be populated when the transport block is
30 transmitted on the uplink. See Figure 7-1.

MAC Layer
R/R/E/LCID
sub-header
R/R/E/LCID[/F/L]
sub-header
R/R/E/LCID/F/L
sub-header
R/R/E/LCID/F/L
sub-header
... R/R/E/LCID/F/L
sub-header
R/R/E/LCID padding
sub-header
MAC header
MAC Control
element 1
MAC Control
element 2
MAC SDU ... MAC SDU
Padding
(opt)
MAC payload
1
2 Figure 7-1 MAC PDU
T
All entries until the beginning of the first MAC SDU would be logged. Diag/APEX will interpret
PS
3
4 the fields and print out the corresponding elements. The logging will be in terms of the raw bytes.
om 23
Log packet structure described in Section 7.2.
.c 3:
6
sn 5:5
i-n t 0
– MAC DL TB subpacket (described in Section 7.2.8)

or 5 a
8
r.h .0
7.1.7 LTE MAC UL transport block (LOG_CODE 0xB064)

ca .01
This is an accumulated log packet. The packet will be logged every N Subframes, where N is a
os 12
10
11 constant determined in the AMSS. Each entry will be populated when the transport block is
20
12 transmitted on the Uplink.

13 All entries until the beginning of the first MAC SDU would be logged. Diag/APEX will interpret
14 the fields and print out the corresponding elements. The logging will be in terms of the raw bytes.
18 – MAC UL TB subpacket (described in Section 7.2.10)
19 7.1.8 LTE MAC UL Tx Statistics (LOG_CODE 0xB067)

20 The statistics could be accumulated over a period of 100 ms. All the averaging is expected to be
21 done by the post processing tool (APEX).
25 – MAC UL Tx Stats subpacket (described in Section 7.2.11)

MAC Layer
1 7.2 MAC log subpackets

2 This section lists all the subpackets
3 7.2.1 MAC Log subpacket structure

4 Each MAC subpacket has a Subpacket header.
Field Description
skipped
to skip the subpacket and decode the next Subpacket.
T
This field shall be a multiple of 4. If the subpacket structure
PS
is not a multiple of 4, padding will be automatically added
at Subpacket creation. Consequently, if the subpacket size
om 23
is larger than the parsing tool expects, but it is an ID and
.c 3:
sn 5:5
i-n t 0
and version
or 5 a
Table 7-2 MAC log subpacket identifier

r.h .0
5
ca .01
Subpacket name Subpacket ID

os 12
MAC cfg type sub packet 0x00

20
MAC DL cfg sub packet 0x01

MAC UL cfg sub packet 0x02
MAC RACH cfg sub packet 0x03
MAC LC info sub packet 0x04
MAC RACH reason sub packet 0x05
MAC RACH attempt sub packet 0x06
MAC DL TB sub packet 0x07
MAC UL TB sub packet 0x08
MAC QoS internal sub packet 0x09
MAC buf status internal sub packet 0x0A
MAC UL Tx stats sub packet 0x0B
6 7.2.2 MAC cfg type subpacket

7 The following format defines the subpacket version 1 of the MAC cfg type subpacket.
Field Description
CFG_REASON Configuration reasons:
CFG_BITMASK Configuration bitmasks:

MAC Layer
1 7.2.3 MAC DL cfg subpacket

2 The following format defines the subpacket version 1 of the MAC DL cfg subpacket.
3
Field Description
SUBPKT_HDR Subpacket header structure as described in Section 7.2.2
TA TIMER TA timer value.
0xFFFF indicates invalid timer value
4
5 7.2.4 MAC RACH cfg subpacket

6 The following format defines the subpacket version 2 of the MAC RACH cfg subpacket.
7
Field Description
T
PS
PREAMBLE_INIT_POWER Signed 16 bit integer in units of dB
om 23
POWER_RAMPING_SETUP Step power. In units of dB; range is 0 to 255
.c 3:
sn 5:5
RA_INDEX1 ra_index1 = sizeOfRA-PreamblesGroupA. GroupA is from
1 to ra_index1; range is 1 to 64.
i-n t 0
RA_INDEX2 ra_index2 = numberOfRA-Preambles. GroupB =

(ra_index1 + 1) to ra_index2. Note that in case there is not
or 5 a
GroupB, then ra_index1 = ra_index2; range is 1 to 64.

r.h .0
PREAMBLE_TRANS_MAX MAX preamble attempts

ca .01
CONT_RESOL_TIMER Contention timer in milliseconds

os 12
MSG_SIZE_GROUP_A Threshold message size to select which RA group

20
GROUP B Power OFFSET Group B power offset.

Unsigned integer in units of dB. Currently, spec only
defines one value –infinity. The value 0 means –infinity.
PMAX This indicates the Pmax to be used in the target cell. If
absent the UE applies the maximum power according to
the UE capability
Signed 16 bit integer in units of dB.
DELTA PREAMBLE MSG3 Delta preamble Power for message 3.
Signed 16 bit integer in units of dB.
PRACH_CONFIG Random Access Preamble timing for preamble format
Range is 0 to 15
CS_ZONE_LENGTH Cyclic Shifts for various preamble formats
LOG_ROOT_SEQ_INDEX Logical Root ZadOFF-Chu Sequence number for various
preamble formats
PRACH_FREQ_OFFSET PRACH Frequency offset for MSG1
HIGH_SPEED_FLAG Controls grouping of preamble sequences in two sets, to
differentiatea high speed UE from normal
MAX_RETX_MSG3 Maximum number of HARQ re-transmissions from UE for
RACH message3
RA_RSP_WIN_SIZE Window size for reception of RACH message2 in
milliseconds

MAC Layer
1 7.2.5 MAC UL cfg subpacket

2 The following format defines the subpacket version 1 of the MAC UL cfg subpacket.
3
Field Description
SR_RESOURCE_PRESENT indicated if SR recourse is available or not
SR_PERIODICITY Periodicity of triggering SR in milliseconds
BSR_TIMER BSR periodicity timer in milliseconds.
0xFFFF indicates invalid number
SPS NUM TX RELEASE Number of sending padding PDU to release SPS.
RETXED BSR TIMER Robustness BSR timer in milliseconds.
T
4
PS
7.2.6 MAC LC info type subpacket
om 23
5
.c 3:
6 The following format defines the subpacket version 1 of the MAC LC info type subpacket.
sn 5:5
7
i-n t 0
Field Description
or 5 a

NUM_DELETED_LC Number of LC to be deleted; range is 0 to 32
r.h .0
ca .01
>LC_ID Logical channel ID

NUM_ADDMOD_LC Number of added or modified logical channel; range is 0 to
os 12
32
20
>>LC_ID Logical channel ID

>>PBR Priority bite rate in Kbyte/s
>>PRIORITY Priority Level; range is 1 to 15. Lower value means higher
priority.
>>LC_GROUP BSR reporting LC group.
Range is 0 to 3
>>TOKEN_BUCKET_SIZE Token bucket max size in bytes

MAC Layer
1 7.2.7 MAC RACH reason subpacket

2 The following format defines the subpacket version 1 of the MAC RACH reason subpacket.
3
Field Description
RACH_REASON Enumeration of one of five possible causes due to which
RACH was triggered
 Connection Request
 Radio Link Failure
 UL Data Arrival
 DL Data Arrival
 Handover
RACH_MATCHING_ID The UE_ID that will be matched for contention resolution in
T
case of CONTENTION_BASED RACH Procedure. This
PS
field will NOT be valid incase of CONTENTION_FREE
RACH procedure
om 23
RACH_CONTENTION TRUE indicates if is contention based RACH procedure
.c 3:
sn 5:5 and FALSE indicates otherwise.
 0x0 – Contention-free RACH procedure
 0x1 – Contention-based RACH procedure
i-n t 0
PREAMBLE Preamble chosen in case of contention based. And this will

or 5 a
refer to the dedicated preamble configured to MAC incase

of contention free RACH. A value of 0xFF will indicate that
r.h .0
there is no dedicated PREAMLE

ca .01
PREAMBLE RA MASK Preamble RA index mask. It ranges from 0-15. It should be

os 12
ignored if there is no dedicated PREAMBLE

MSG3_SIZE Size of MSG3 based on which the group would be chosen.
20
ONly applicable for contention based RACH

GROUP_CHOSEN Refers to the group A or group B from which the preamble
was picked.
RADIO_CONDN Gives the value of the pathloss as a result of call to the L1
API.
In units of dB. 0-255
CRNTI If the UE is in connected mode then this indicates the
CRNTI of the UE.
4

MAC Layer
1 7.2.8 MAC RACH attempt subpacket

2 The following format defines the sub packet version 2 of the MAC RACH attempt sub packet.
3
Field Description
SUBPKT_HDR Subpacket header structure as described in
section 4.2.1
RETX_COUNTER The below fields represent the values
corresponding to the RACH attempt number
RACH_RESULT Enum defining
CONTENTION_PROCEDURE TRUE indicates if is contention based RACH
procedure and FALSE indicates otherwise.
0x0 – Contention Free RACH procedure
0x1 – Contention Based RACH procedure
T
PS
RACH_MSG_BMASK Bitmask to indicate which of MSG 1, 2, 3 are
actually present
om 23
LSB B0 – MSG 1
LSB B1 – MSG 2
.c 3: LSB B2 – MSG 3
sn 5:5
The following fields are present if the RACH_MSG_BMAST indicates MSG1 is present
i-n t 0
>RACH_MSG1_PREAMBLE_INDEX Index is in the range 0 to 63

or 5 a
>RACH_MSG1_PREAMBLE_INDEX_MASK Range is 0-15. 0xFF means invalid.

r.h .0
> RACH MSG1 PREAMBLE POWER OFFSET OFFset of the message 1 preamble power, given
ca .01
as: Init OFFset + (Stepsize * Preamble number)

Signed Integer in units of dB
os 12
20
>RACH_MSG2_BACKOFF_VAL BackOFF value in ms. Default backOFF value is 0

ms
>RACH_MSG2_RESULT TRUE indicates that the RAPID received in the DL
matched with the one the UE sent.FALSE
otherwise. Incase of FALSE then no further entries
in this whole big structure are valid. If it is a CF
RACH then if MSG2 is successful then the RACH
procedure terminates there. 0xFF indicates that
this field is not applicable
>RACH_MSG2_TCRNTI Temp CRNTI received in MSG2 if the MSG2 was
successfully received (meaning RAPID passed).
0xFFFF indicates that this field is not applicable
>RACH_MSG2_TA_VALUE Timing Adjustment value received. 0xFFFF
indicates that this field is not applicable
> RACH_MSG3_GRANT_RAW LSB0 to 20: Raw grant value sent in message 3
>RACH_MSG3_GRANT Grant in bytes
> RACH_MSG3_HARQ_ID Harq ID where the data would be transmitted from
>RACH_MSG3_MAC_PDU Maximum of up to 10 bytes of MCE and MAC sub-
headers would be logged.
4

MAC Layer
1 7.2.9 MAC DL TB subpacket

2 The following format defines the subpacket version 1 of the MAC DL TB subpacket.
3
Field Description
NUM_SAMPLES Number of samples collected in this log packet; range is 1
to 50.
For each sample from 1 to 50:
>HARQ_ID Identifies the HARQ on which the data was received
>RNTI_TYPE Identifies the RNTI type for which this data was addressed.
Value encoded as follows:
>SFN Sub/System Frame Number, defined as
T
PS
> DL_TBS Transport block size assigned to the UE for data reception
om 23
on the DL
.c 3:
>NUM_RLC_PDUS Number of RLC PDUs
sn 5:5
>NUM_PADDING_BYTES Number of bytes of padding
i-n t 0
>MAC_HDR_LEN_LOGGED Length of the MAC HEADER logged (max 15 bytes)

or 5 a
>MAC_HEADER Entire header in raw bytes until the beginning of the first
MAC SDU
r.h .0
4
ca .01
os 12
5 7.2.10 MAC UL TB subpacket

20
6 The following format defines the subpacket version 1 of the MAC UL TB subpacket.
7
Field Description
NUM_SAMPLES Number of samples collected in this log packet
UL_TB_INFO_PER_SAMPLE Array of structures for as many samples as listed above
>HARQ_ID Identifies the HARQ on which the data was received
>RNTI_TYPE Identifies the RNTI type for which this data was addressed.
Value encoded as follows:
>SFN Sub/System Frame Number, defined as
>UL_GRANT Uplink grant in bytes
>NUM_RLC_PDUS Number of RLC PDUs
>NUM_PADDING_BYTES Number of bytes of padding
>BSR EVENT What event triggered the BSR:
> TYPE OF BSR TRIGGERED Specifies the BSR format sending out is of type:
>MAC_HDR_LEN_LOGGED Length of the MAC header which is logged <= 15 bytes
>MAC_HEADER Entire header in raw bytes until the beginning of the first
MAC SDU
8

MAC Layer
1 The SFN field provides the system frame number and the Subframe number. The coding of this
2 field is a shown in Figure 7-2.
3
4 Bit 15 Bit3 Bit 0

4 bits Subframe
12 bits System Frame Number
number (0 to 9)
5 Figure 7-2 Coding of the SFN field
6 7.2.11 MAC UL Tx stats subpacket

7 The following format defines the subpacket version 1 of the MAC UL Tx stats subpacket.
8
Field Description
T
PS
NUM_SAMPLES Number of samples collected
om 23
NUM_PADDING_BSRs Number of times padding BSRs were sent
NUM_REGULAR_BSRs Number of times regular BSRs were sent
.c 3:
sn 5:5
NUM_PERIODIC_BSR Number of times periodic BSRs were sent
NUM_CANCEL_BSR Number of times the BSR was cancelled
i-n t 0
GRANT_RECEIVED Grant received in terms of Bytes

or 5 a
GRANT_UTILIZED Grant utilized in terms of Bytes

r.h .0
ca .01
9
os 12
20

1 8 RLC Layer
2 8.1 Log packets

3 RLC log packets have log codes ranging from 0xB080 through 0xB09F. Some of the log codes
4 are reserved for future use. Each log packet described in this chapter contains the following:
5  Log packet definition – Unique definition for each log packet.
 Log packet structure – Shared structure used by all RLC log packets.
T
6
PS
7  Subpackets for RLC – Unique subpacket Identified by subpacket ID; each packet may
contain one or more subpackets.
om 23
8
8.1.1 RLC log packet structure .c 3:

sn 5:5
9
10 All RLC log packets follow the top level common log packet format:
i-n t 0
or 5 a
11
Field Description
r.h .0
ca .01

os 12

20
packet
Reserved Reserved
this field
12
13 8.1.2 List of RLC log packets

14 The following table summarizes the RLC Log Packets.
15 Table 8-1 List of RLC Log Packets

Log Packet
ID
0xB081 RLC DL Configuration External 8.1.3
0xB082 RLC DL AM ALL PDU External 8.1.4
0xB083 RLC DL AM Control PDU External 8.1.5
0xB084 RLC DL AM Polling PDU External 8.1.6
0xB085 RLC DL AM Signaling PDU External 8.1.7
0xB086 RLC DL UM Data PDU External 8.1.8
0xB087 RLC DL Statistics External 8.1.9

RLC Layer
Log Packet
ID
0xB091 RLC UL Configuration External 8.1.10
0xB092 RLC UL AM ALL PDU External 8.1.11
0xB093 RLC UL AM Control PDU External 8.1.12
0xB094 RLC UL AM Polling PDU External 8.1.13
0xB095 RLC UL AM Signaling PDU External 8.1.14
0xB096 RLC UL UM Data PDU External 8.1.15
0xB097 RLC UL Statistics External 8.1.16
1
2 8.1.3 LTE RLC DL configuration (LOG_CODE 0xB081)

3 This log packet will be generated each time RLC DL receives a configuration from RRC.
T
PS
om 23
5 Log packet structure described in Section 8.1.1.
.c 3:
sn 5:5
7 – RLC DL configuration log subpacket as described in Section 8.3.2.
i-n t 0
or 5 a
8 8.1.4 LTE RLC DL AM All PDU (LOG_CODE 0xB082)

r.h .0
9 For logging all data AM PDUs for AM SRB as well as DRB received on DL.
ca .01
os 12
10 NOTE: The structure presented in this packet is reused for all RLC OTA logging for AM logical
channels, so that the same parsing engine can be used.
20
11
12 This packet is logged every time RLC processes a number of PDUs, typically every 40 ms when
13 there is data activity. The log packet is generated separately for each RB. However each log
14 packet accumulates multiple RLC PDUs per RB.
18 – RLC DL PDU log subpacket as described in Section 8.3.3
19 NOTE: Implementation related notes regarding the logging of AM PDU log packets
20 The RLC payload is typically ciphered, which means only the RLC headers can be parsed in a
21 meaningful manner.

RLC Layer
1 8.1.5 LTE RLC DL AM control PDU (LOG_CODE 0xB083)

2 For logging only AM control PDUs for SRBs and DRBs received on DL. AM control PDUs are
3 submitted to DIAG under RLC DL AM All PDU log code. Log parser will look at the “log mask”
4 field in the PDU subpacket to determine if RLC DL AM Control PDU log is enabled.
5 NOTE: RLC DL AM Control PDU log code (0xB083) is never used to submit control PDUs to DIAG.
6 Log packet structure is the same as for RLC DL AM Data PDU Logging in section 8.1.4.
7 8.1.6 LTE RLC DL AM polling PDU (LOG_CODE 0xB084)

8 For logging only AM data PDUs for SRB and DRB received on DL in which poll bit is set.
9 Polling PDUs are submitted to DIAG under RLC DL AM All PDU log code. Log parser will look
at the “log mask” field in the PDU subpacket to determine if RLC DL AM Polling PDU log is
T
10
PS
11 enabled.
om 23
12 NOTE: RLC DL AM Polling PDU log code (0xB084) is never used to submit polling PDUs to DIAG.
.c 3:
sn 5:5
13 Log packet structure is the same as for RLC DL AM Data PDU Logging in Section 8.1.4.
i-n t 0
8.1.7 LTE RLC DL AM signaling PDU (LOG_CODE 0xB085)

or 5 a
14
For logging only AM SRB control and data PDUs received on DL. AM signaling PDUs are
r.h .0
15
submitted to DIAG under RLC DL AM All PDU log code. Log parser will look at the “log mask”
ca .01
16
17 field in the PDU subpacket to determine if RLC DL AM Signaling PDU log is enabled.
os 12
20
18 NOTE: RLC DL AM Signaling PDU log code (0xB085) is never used to submit signaling PDUs to
19 DIAG.
21 8.1.8 LTE RLC DL UM data PDU (LOG_CODE 0xB086)

22 For logging all data UM PDUs for UM SRB as well as DRB sent on DL.
23 Log packet structure is the same as RLC DL AM Data PDU Logging in Section 8.1.4.
24 8.1.9 LTE RLC DL statistics (LOG_CODE 0xB087)

25 To be logged every 1.28 sec, or any time a radio bear is released
29 – Subpacket for DL statistics (since last RLC re-establishment) as described in
30 Section 8.3.4
31 – Subpacket for DL statistics (cumulative) as described in Section 8.3.4.

RLC Layer
1 8.1.10 LTE RLC UL configuration (LOG_CODE 0xB091)

2 This log packet will be generated each time RLC UL receives a configuration from RRC.
4 Log packet structure described in Section8.3.4.
6 – RLC UL configuration log subpacket as described in Section :
7 8.1.11 LTE RLC UL AM all PDU (LOG_CODE 0xB092)

8 For logging all control and data AM PDUs for SRB as well as DRB sent on UL.
T
10 8.1.12 LTE RLC UL AM control PDU (LOG_CODE 0xB093)
PS
11 For logging only AM control PDUs for SRBs and DRBs sent on UL. AM control PDUs are
om 23
12 submitted to DIAG under RLC UL AM All PDU log code. Log parser will look at the “log mask”
.c 3:
13 field in the PDU subpacket to determine if RLC UL AM Control PDU log is enabled.
sn 5:5
14 NOTE: RLC UL AM Control PDU log code (0xB093) is never used to submit control PDUs to DIAG.
i-n t 0
or 5 a
r.h .0
ca .01
16 8.1.13 LTE RLC UL AM polling PDU (LOG_CODE 0xB094)

os 12
17 For logging only AM data PDUs for SRB and DRB sent on UL in which poll bit is set. Polling
PDUs are submitted to DIAG under RLC UL AM All PDU log code. Log parser will look at the
20
18
19 “log mask” field in the PDU subpacket to determine if RLC UL AM Polling PDU log is enabled.
20 NOTE: RLC UL AM Polling PDU log code (0xB094) is never used to submit polling PDUs to DIAG.
22 8.1.14 LTE RLC UL AM signaling PDU (LOG_CODE 0xB095)

23 For logging only AM SRB control and data PDUs sent on UL. AM signaling PDUs are submitted
24 to DIAG under RLC UL AM All PDU log code. Log parser will look at the “log mask” field in
25 the PDU subpacket to determine if RLC UL AM Signaling PDU log is enabled.
26 NOTE: RLC UL AM Signaling PDU log code (0xB095) is never used to submit signaling PDUs to
27 DIAG.
29 8.1.15 LTE RLC UL UM data PDU (LOG_CODE 0xB096)

30 For logging all data UM PDUs for UM SRB as well as DRB sent on UL.

RLC Layer
1 8.1.16 LTE RLC UL statistics (LOG_CODE 0xB097)

2 To be logged every 1.44 sec, or anytime a radio bearer is released
6 – Subpacket for UL statistics (since last RLC re-establishment) as described in
7 Section 8.3.7
8 – Subpacket for UL statistics (cumulative) as described in Section 8.3.7
9 8.2 Logging design motivation

10 As mentioned above (Section 5.1), some log code IDs such as for RLC UL/DL polling, signaling
T
11 and control are typically not used to submit log packets to DIAG. These log packets are submitted
PS
12 to the DIAG under RLC UL/DL AM All PDU log code ID. Following are the reasons for such a
13 design choice:
om 23
1. Having a common log buffer for control, signaling and polling log packets is memory
.c 3:
14
efficient. Having three separate log buffers will increase memory requirements in RLC. As a
sn 5:5
15
16 result, all three log packets are submitted under a common log code ID i.e. AM All PDU log
i-n t 0
17 code.
or 5 a
18 2. Also, these three log packets are interdependent. For example: a signaling control PDU would
result in logging the same PDU twice under signaling log code as well as under control log
r.h .0
19
code. Similarly for signaling polling PDU. This results in wastage of DIAG bandwidth.
ca .01
20
21 Current logging approach makes sure a particular PDU is logged only once, by using a single
os 12
22 log code ID for all three log packets.

20
23 8.3 RLC log subpackets

24 This section lists all the subpackets
25 8.3.1 RLC log subpacket structure

26 Each RLC subpacket has a subpacket header.
27
Field Description
skipped

RLC Layer
Field Description
subpacket creation. Consequently, if the subpacket size is
and version
1 Table 8-2 RLC log subpacket identifier

2
T
PS
RLC DL config sub packet 0x40
om 23
RLC DL PDU sub packet 0x41
.c 3:
RLC DL statistics sub packet sn 5:5 0x42
RLC UL config sub packet 0x45
i-n t 0
RLC UL PDU sub packet 0x46

or 5 a
RLC UL statistics sub packet 0x47

r.h .0
ca .01
3 8.3.2 RLC DL config subpacket

os 12
4 The following format defines the subpacket version 1 of the RLC DL config subpacket.
20
Field Description
CFG_REASON Configuration reason
ARRAY_SIZE Dimension of the array. This is needed to correctly parse
the rest of this subpacket.
NUM_RELEASED_RB Number of released radio bearers
> RB_CFG_IDX CFG_IDX of the radio bearers to be released
NUM_ADDED_MODIFIED_RB Number of added/modified radio bearers
> RB_CFG_IDX CFG_IDX of the radio bearers to be added or modified
> ACTION Action on the radio bearer
NUM_ACTIVE_RB Total number of active radio bearers after the configuration
is applied
> RB_MODE Radio bearer mode [1:AM 2:UM]
> LC_ID Logical channel ID
> RB_ID Radio bearer ID
> RB-CFG_IDX Unique radio bearer configuration index
> RB_TYPE Radio bearer type:
> IF RB_MODE indicates AM configuration
>> T_REORDERING T_reordering timer in milliseconds

RLC Layer
Field Description
>> T_STATUS_PROHIBIT T_status_prohibit timer in milliseconds
> IF RB_MODE indicates UM configuration
>> T_REORDERING T_reordering timer in milliseconds
>> SN_FIELD_LENGTH Sequence length in bits:
1 8.3.3 RLC DL PDU subpacket

2 The following format defines the subpacket version 3 of the RLC DL PDU subpacket.
3
Field Description
RB_CFG_IDX unique radio bearer configuration index [0, 34]
T
RB_MODE Logical channel mode: [1:AM, 2:UM]
PS
SN_FIELD_LENGTH Indicates whether 5 or 10 bit SN is used.
om 23
RESERVED Shall be ignored
.c 3:
sn 5:5
LOG_MASK Each bit in log_mask indicates if a particular log packet is
enabled or not. Bit 0 is the Least Significant Bit (LSB).
i-n t 0
VR_R Part of state of the receiver as specified in [S8]

or 5 a
VR_X Part of state of the receiver as specified in [S8]

VR_MS Part of state of the receiver as specified in [S8]
r.h .0
ca .01
VR_H Part of state of the receiver as specified in [S8]

NUM_PDUS Number of PDUs logged
os 12
For each PDU as indicated by NUM_PDUS:

20
> SFN System frame number when the PDU is logged. Bit 0 is
the Least Significant Bit (LSB)
Display should be sys_fn first, followed by sub_fn. If
reserved bits i.e. Bit14-Bit15 are set to “00”, sys_fn and
sub_fn value is printed, else “N/A” (Not Available) is
printed next to both
> PDU_SIZE PDU size in octets of each PDU
> LOGGED_BYTES Number of bytes logged
>STATUS Status of the received RLC PDU
> LOG_BUF The entire RLC header is logged; for control PDUs, the
entire PDU is logged; logged data is in network byte order
i.e. big endian; the format of the PDU is specified in [S8]
4

RLC Layer
1 8.3.4 RLC DL statistics subpacket

2 The following format defines the subpacket version 2 of the RLC DL statistics subpacket.
SUBPKT_HDR Sub-packet header structure as described in Section 8.3.1
NUM_RB Indicates the number of radio bearer logged in this log
packet
RLC_PDCP_Q_FULL_CNT Number of times the RLC to PDCP queue is full; it should
be 0 at all times
RLCDL_ERROR_CNT Number of RLCDL errors that occurred during the current
call
MODE Logical Channel Mode (AM or UM)
T
NUM_RST Total Number of rlc re-establishments since radio bearer
PS
bactivation
NUM_DATA_PDU Total Number of RLC data PDUs received
om 23
DATA_PDU_BYTES Total RLC Data PDUs in Bytes received
NUM_STATUS_RXED
.c 3: Total Number of RLC status PDUs received andforwarded
sn 5:5
to uplink
i-n t 0
STATUS_RXED_BYTES Total Number of RLC status PDUs received in bytes,

forwarded to uplink
or 5 a
NUM_INVALID_PDU Total Number of invalid RLC PDU received

r.h .0
INVALID_PDU_BYTES Total Number of invalid PDU in bytes received

ca .01
NUM_RETX_PDU Total Number of retransmitted PDUs from receiver

os 12
perspective. Note that only the transmitter knows the real

number.
20
RETX_PDU_BYTES Total Number of retransmitted PDUs in bytes from receiver

perspective. Note that only the transmitter knows the real
number.
NUM_DUP_PDU Total Number of complete duplicate RLC PDUs received.
A PDU is defined as a complete duplicate if no segment of
the PDU can be used in reassembly.
NUM_DUP_BYTES Total Number of complete duplicate bytes received. A PDU
is defined as a complete duplicate if no segment of the
PDU can be used in reassembly.
NUM_DROPPED_PDU Total Number of PDUs dropped, excluding dup
DROPPED_PDU _BYTES Total Number of bytes dropped, excluding dup
NUM_DROPPED_PDU_FC Total Number of PDUs dropped due to flow control
DROPPED_PDU _BYTES_FC Total Number of bytes dropped due to flow control
NUM_SDU Total Number of RLC SDUs reassembled
NUM_SDU_BYTES Total Number of bytes reassembled
NUM_NONSEQ_SDU Total Number of Out of Order SDUs forwarded to PDCP
during rlc re-establishment
NUM_CTRL_PDU Total Number of Control PDUs sent
NUM_COMP_NACK Total Number of Complete RLC PDU NACKs sent
NUM_SEGM_NACK Total Number of RLC Segments NACK sent
NUM_T_REORD_EXP Total Number of times t_reordering timer expired

RLC Layer

RESERVED Reserved field. Shall be ignored.
NUM_DATA_PDU_RST Number of RLC data PDUs received since the last RLC re-
establishment
DATA_PDU_BYTES_RST RLC Data PDUs in Bytes received since the last RLC re-
establishment
NUM_STATUS_RXED_RST Number of RLC status PDUs received andforwarded to
uplink since the last RLC re-establishment
STATUS_RXED_BYTES_RST Number of RLC status PDUs received in bytes, forwarded
to uplink since the last RLC re-establishment
NUM_INVALID_PDU_RST Number of invalid RLC PDU received since the last RLC
re-establishment
INVALID_PDU_BYTES_RST Number of invalid PDU in bytes received since the last
RLC re-establishment
NUM_RETX_PDU_RST Total Number of retransmitted PDUs since the last RLC re-
T
establishment from receiver perspective. Note that only the
PS
transmitter knows the real number.
RETX_PDU_BYTES_RST Total Number of retransmitted PDUs in bytes since the last
om 23
RLC re-establishment from receiver perspective. Note that
.c 3:
only the transmitter knows the real number.
sn 5:5
NUM_DUP_PDU_RST Number of complete duplicate RLC PDUs received since
the last RLC re-establishment A PDU is defined as a
i-n t 0
complete duplicate if no segment of the PDU can be used

or 5 a
in reassembly
NUM_DUP_BYTES_RST Number of complete duplicate bytes received since the last
r.h .0
RLC re-establishment A PDU is defined as a complete

ca .01
duplicate if no segment of the PDU can be used in

reassembly.
os 12
NUM_DROPPED_PDU_RST Number of PDUs dropped since the last RLC re-

20
establishment, excluding dup

DROPPED_PDU _BYTES_RST Number of bytes dropped since the last RLC re-
establishment excluding dup
NUM_DROPPED_PDU_FC_RST Total Number of PDUs dropped since the last RLC re-
establishemnt due to flow control
DROPPED_PDU _BYTES_FC_RST Total Number of bytes dropped since the last RLC re-
establishment due to flow control
NUM_SDU_RST Total Number of RLC SDUs forwarded to PDCP since the
last RLC re-establishment
NUM_SDU_BYTES_RST Number of bytes forwarded to PDCP since the last RLC re-
establishment
NUM_NONSEQ_SDU_RST Number of Out of Order SDUs forwarded to PDCP during
rlc re-establishment since the last RLC re-establishment
NUM_CTRL_PDU_RST Number of Control PDUs sent since the last RLC re-
establishment
NUM_COMP_NACK_RST Number of Complete RLC PDU NACKs sent since the last
RLC re-establishment
NUM_SEGM_NACK_RST Number of RLC Segments NACK sent since the last RLC
re-establishment
NUM_T_REORD_EXP_RST Total Number of times t_reordering timer expired since the
last RLC re-establishment

RLC Layer
1 NOTE: RLC DL throughput for a radio bearer can be calculated by the following: DATA_PDU_BYTES
2 + STATUS_RXED_BYTES + INVALID_PDU_BYTES. The grand total RLC DL throughput
3 should be the summation of all active radio bearers.
4 8.3.5 RLC UL config subpacket

5 The following format defines the subpacket version 1 of the RLC UL config subpacket.
6
Field Description
ARRAY_SIZE Dimension of the array. This is needed to correctly parse
T
PS
om 23
> ACTION Action on the radio bearer:
.c 3:
sn 5:5
is applied
i-n t 0
> RB_MODE Radio bearer mode [1:AM 2:UM]

or 5 a
> LC_ID Logical channel ID

r.h .0

ca .01

> RB_TYPE Radio bearer type
os 12
> IF RB_MODE indicates AM configuration

20
>> POLL_BYTE poll_byte constant [0xffffffff:infinite]

>> POLL_PDU poll_pdu constant [0xffff:infinite]
>> T_POLL_RETRANSMIT T_poll_retransmit timer in milliseconds
>> MAX_RETX_THRESHOLD maximum number of transmission
> IF RB_MODE indicates UM configuration
>> SN_FIELD_LENGTH Sequence length in bits
7

RLC Layer
1 8.3.6 RLC UL PDU subpacket

2 The following format defines the subpacket version 3 of the RLC UL PDU subpacket.
3
Field Description
RB_MODE Logical channel mode: [1:AM, 2:UM]
SN_FIELD_LENGTH Indicates whether 5 or 10 bit SN is used.
LOG_MASK Each bit in log_mask indicates if a particular log packet is
enabled or not. Bit 0 is the Least Significant Bit (LSB).
VT_A Part of state of the transmitter as specified in [S8]
T
VT_S Part of state of the transmitter as specified in [S8]
PS
PDU_WITHOUT_POLL Part of state of the transmitter as specified in [S8]
om 23
BYTE_WITHOUT_POLL Part of state of the transmitter as specified in [S8]
.c 3:
POLL_SN sn 5:5 Part of state of the transmitter as specified in [S8]
NUM_PDUS Number of PDUs logged.
i-n t 0

or 5 a
> SFN System frame number when the PDU is logged.

Bit 0 is the Least Significant Bit (LSB)
r.h .0

ca .01
reserved bits, i.e., Bit14-Bit15 are set to 00, sys_fn and

sub_fn value is printed, else N/A (Not Available) is printed
os 12
next to both
20
> PDU_SIZE PDU size in octets of each PD.

> LOGGED_BYTES Number of bytes logged
>RESERVED Shall be ignored
> LOG_BUF The entire RLC header is logged; for control PDUs, the
entire PDU is logged; logged data is in network byte order,
i.e., big endian; the format of the PDU is specified in [S8]
4

RLC Layer
1 8.3.7 RLC UL statistics subpacket

2 The following format defines the subpacket version 1 of the RLC UL statistics subpacket.
3

NUM_RB Indicates the number of logical channels logged in this log
packet
RLCUL_ERROR_CNT Number of RLCUL errors that occurred during the current
call.
For each logical channel as per the value of NUM_RB:
MODE Logical Channel Mode (0 for UM, 1 for AM)
T
NUM_RST Total Number of rlc re-establishment during this call
PS
NUM_NEW_DATA_PDU Total Number of New RLC data PDUs transmitted
om 23
NUM_NEW_DATA_PDU_BYTES Total Number of New Data PDU Bytes
transmitted,including RLC headers
NUM_SDU
.c 3: Total Number of RLC SDUs transmitted
sn 5:5
NUM_SDU_BYTES Total Number of RLC SDU bytes transmitted.
i-n t 0
NUM_CTRL_PDU_TX Total Number of RLC control PDUs transmitted

or 5 a
NUM_CTRL_PDU_BYTES_TX Total Number of RLC control PDU bytes transmitted

r.h .0
NUM_RETX_PDUS Total Number of RLC PDUs re-transmitted

ca .01
NUM_RETX_PDU_BYTES Total Number of PDU Bytes re-transmitted

NUM_CTRL_PDU_RX Total Number of Control PDUs received
os 12
NUM_COMP_NACK Total Number of Complete RLC PDU NACKs received

20
NUM_SEGM_NACK Total Number of NACKs for RLC Segments received

NUM_INVALID_CTRL_PDU_RX Total Number of invalid control PDU received
NUM_POLL Total Number of RLC PDUs transmitted with Poll Bit set
NUM_T_POLL_RETX_EXPIRY Total Number of times T_poll_retransmit timer expired
NUM_NEW_DATA_PDU_RST Number of New RLC data PDUs transmitted since last rlc
re-establishment
NUM_NEW_DATA_PDU_BYTES_RST Number of New Data PDU Bytes transmitted since last rlc
re-establishment
NUM_SDU_RST Number of RLC SDUs transmitted since last rlc re-
establishment
NUM_SDU_BYTES_RST Total Number of RLC SDU bytes transmitted since last rlc
re-establishment
NUM_CTRL_PDU_TX_RST Total Number of RLC control PDUs transmitted since
last rlc re-establishment
NUM_CTRL_PDU_BYTES_TX_RST Total Number of RLC control PDU bytes transmitted since
NUM_RETX_PDUS_RST Number of RLC PDUs re-transmitted since last rlc re-
establishment
NUM_RETX_PDU_BYTES_RST Number of PDU Bytes re-transmitted since last rlc re-
establishment

RLC Layer

NUM_CTRL_PDU_RX_RST Number of Control PDUs received since last rlc re-
establishment
NUM_COMP_NACK_RST Number of Complete RLC PDU NACKs received since
NUM_SEGM_NACK_RST Number of NACKs for RLC Segments received since last
rlc re-establishment
NUM_INVALID_CTRL_PDU_RX_RST Total Number of invalid control PDU received since last
rlc re-esbablishment
NUM_POLL_RST Number of RLC PDUs transmitted with Poll Bit set since
NUM_T_POLL_RETX_EXPIRY_RST Total Number of times T_poll_retransmit timer expired
since last rlc re-establishment
T
PS
1 NOTE: RLC UL throughput for a radio bearer can be calculated by the following:
2 NUM_NEW_DATA_PDU_BYTES + NUM_CTRL_PDU_BYTES +
om 23
3 NUM_RETX_PDU_BYTES.
The grand total RLC UL throughput should be the summation of all active radio bearers
.c 3:
4 sn 5:5
5
i-n t 0
or 5 a
r.h .0
ca .01
os 12
20

1 9 PDCP Layer
2 9.1 Log packets

3 PDCP log packets have log codes ranging from 0xB0A0 through 0xB0BF. Some of the log codes
4 are reserved for future use. Each log packet described in this chapter contains the following:
5  Log packet definition – Unique definition for each log packet.
Log packet structure – Shared structure used by all PDCP log packets.
T
6 
PS
7  Subpackets for PDCP – Unique subpacket Identified by subpacket ID; each packet may
contain one or more subpackets.
om 23
8
.c 3:
sn 5:5
9 9.1.1 PDCP log packet structure
All PDCP log packets follow the top level common log packet format:
i-n t 0
10
or 5 a
11
r.h .0
Field Description
ca .01

os 12

20
packet
Reserved Reserved
this field
12
13 9.1.2 List of PDCP log packets

14 The following table summarizes the PDCP Log Packets.
15 List of PDCP Log Packets
16
Log Packet
ID
0xB0A0 PDCP DL Config External 9.1.3
0xB0A1 PDCP DL Data PDU External 9.1.4
0xB0A2 PDCP DL Control PDU External 9.1.5
0xB0A3 PDCP DL Cipher Data PDU External 9.1.6
0xB0A4 PDCP DL Statistics External 9.1.7
0xB0A5 PDCP DL SRB Integrity Data PDU External 9.1.8
0xB0B0 PDCP UL Config External 9.1.9

PDCP Layer
Log Packet
ID
0xB0B2 PDCP UL Control PDU External 9.1.10
0xB0B3 PDCP UL Cipher Data PDU External 9.1.11
0xB0B4 PDCP UL Statistics External 9.1.12
0xB0B5 PDCP UL SRB Integrity Data PDU External 9.1.13
1
2 9.1.3 LTE PDCP DL config (LOG_CODE 0xB0A0)

3 This log packet will be generated each time PDCP DL receives a configuration from RRC.
T
This packet will include a minimum of:
PS
6
7 – PDCP DL config log sub packet as described in Section 9.2.2
om 23
9.1.4 LTE PDCP DL data PDU (LOG_CODE 0xB0A1) .c 3:
sn 5:5
8
For logging all data PDUs received on DL.

i-n t 0
9
or 5 a
10 This packet is logged every time PDCP processes a number of PDUs, typically every 100 ms
11 when there is data activity. The log packet is generated separately for each logical channel.
r.h .0
12 However each log packet accumulates multiple PDCP PDUs per RB.
ca .01

os 12

20

16 PDCP PDU sub packet as described in Section 9.2.4
17 9.1.5 LTE PDCP DL control PDU (LOG_CODE 0xB0A2)

18 For logging all PDCP control PDUs sent on DL. Log packet structure is the same as for PDCP
19 DL Data PDU Logging in section 9.2.4.The whole DL control PDU is logged in PDU Subpacket.

PDCP Layer
1 9.1.6 LTE PDCP DL cipher data PDU (LOG_CODE 0xB0A3)

2 For logging all data PDUs received on DL, including ciphering information. This log packet
3 includes everything of the regular PDCP DL Data PDU log packet, and adds ciphering
4 information on top of that. If this packet is enabled, then the regular PDCP DL Data PDU logging
5 is disabled.
7 when there is data activity. The log packet is generated separately for each logical channel.
8 However each log packet accumulates multiple PDCP PDUs per RB.
T
12 – PDCP PDU with Ciphering sub packet as described in Section 9.2.5
PS
om 23
13 9.1.7 LTE PDCP DL statistics (LOG_CODE 0xB0A4)
14
.c 3:
To be logged every 500ms, re-establishment, reconfig and release
sn 5:5
i-n t 0

or 5 a

r.h .0
ca .01
18 – Subpacket for DL statistics (since last PDCP re-establishment) as described in Section

19 6.2.6
os 12
– Subpacket for DL statistics (cumulative) as described in Section 9.2.8

20
20
21 9.1.8 LTE PDCP DL SRB integrity data PDU (LOG_CODE 0xB0A5)

22 For logging integrity protected SRB data PDUs received on DL.
24 when there is data activity. A single log packet is generated for all logical channels.
26 Log packet structure described in Section 9.2.6
27 9.1.9 LTE PDCP UL config (LOG_CODE 0xB0B0)

28 This log packet will be generated each time PDCP DL receives a configuration from RRC.
32 – PDCP DL config log sub packet as described in Section 9.2.3

PDCP Layer
1 9.1.10 LTE PDCP UL control PDU (LOG_CODE 0xB0B2)

2 For logging all PDCP control PDUs sent on UL.
3 For logging all PDCP control PDUs sent on UL. Log packet structure is the same as for PDCP
4 DL Data PDU Logging in section 9.2.4.The whole UL control PDU is logged in PDU Subpacket.
5 9.1.11 LTE PDCP UL cipher data PDU (LOG_CODE 0xB0B3)

6 For logging all data PDUs received on UL, including ciphering information. This log packet
7 includes everything of the regular PDCP UL Data PDU log packet, and adds ciphering
8 information on top of that. If this packet is enabled, then the regular PDCP UL Data PDU logging
9 is disabled.
T
PS
om 23
–
.c 3:
PDCP PDU with Ciphering sub packet as described in Section 9.2.5
15
sn 5:5
i-n t 0
16 9.1.12 LTE PDCP UL statistics (LOG_CODE 0xB0B4)

or 5 a
17 To be logged every 500ms, re-establishment, reconfig and release

r.h .0
ca .01

os 12

20

21 – Subpacket for UL statistics (since last PDCP re-establishment) as described in Section
22 9.2.9
23 – Subpacket for UL statistics (cumulative) as described in Section 9.2.9
24 9.1.13 LTE PDCP UL SRB integrity data PDU (LOG_CODE 0xB0B5)

25 For logging integrity protected SRB data PDUs received on UL.
29 – Log packet structure described in Section 9.2.7

PDCP Layer
1 9.2 PDCP log subpackets

2 This section lists all the PDCP subpackets
3 9.2.1 PDCP log subpacket structure

4 Each PDCP subpacket has a subpacket header.
5
Field Description
skipped
T
PS
om 23
.c 3:
sn 5:5 subpacket creation. Consequently, if the subpacket size is
i-n t 0

or 5 a
r.h .0
and version
ca .01
6
os 12
7 Table 9-1 PDCP log subpacket identifier

20

PDCP DL config sub packet 0xC0
PDCP UL config sub packet 0xC1
PDCP PDU sub packet 0xC2
PDCP cipher pdu sub packet 0xC3
PDCP DL statistics sub packet 0xC4
PDCP UL statistics sub packet 0xC5

PDCP Layer
1 9.2.2 PDCP DL config subpacket

2 The following format defines the subpacket version 1 of the PDCP DL config subpacket.
3
Field Description
Security Configuration for the UE
> SRB Cipher Algo SRB Cipher Algo
> SRB Cipher Key Index SRB Cipher Key Index(internal key index that points to the
actual key)
> SRB Integrity Algo SRB Integrity Algo
> SRB Integrity Key Index SRB Integrity Key Index(internal key index that points to
T
the actual key)
PS
> DRB Cipher Algo DRB Cipher Algo
om 23
> DRB Cipher Key Index DRB Cipher Key Index(internal key index that points to the
actual key)
ARRAY_SIZE
.c 3:
Dimension of the array. This is needed to correctly parse
sn 5:5
i-n t 0

or 5 a

r.h .0
ca .01

os 12

20
is applied
> EPS_ID EPS ID
> RB_MODE Radio bearer mode
> SN_LENGTH Indicates whether 5 or 7 or 12 bit PDCP SN is used.
> Status_report Whether status report is enabled or not
> ROHC_MAX_CID ROHC MAX CID
> ROHC_MASK ROHC MASK for enabled ROHC profile
4

PDCP Layer
1 9.2.3 PDCP UL config subpacket

2 The following format defines the subpacket version 1 of the PDCP UL config subpacket.
3
Field Description
Security Configuration for the UE
> SRB Cipher Algo SRB Cipher Algo
> SRB Cipher Key Index SRB Cipher Key Index(internal key index that points to the
actual key)
> SRB Integrity Algo SRB Integrity Algo
> SRB Integrity Key Index SRB Integrity Key Index(internal key index that points to
T
the actual key)
PS
> DRB Cipher Algo DRB Cipher Algo
om 23
> DRB Cipher Key Index DRB Cipher Key Index(internal key index that points to the
actual key)
ARRAY_SIZE
.c 3:Dimension of the array. This is needed to correctly parse
sn 5:5
i-n t 0

or 5 a
> RELEASED_RB CFG_IDX of radio bearers to be released

r.h .0
ca .01

os 12

20
is applied
For each active RB as indicated by the field NUM_ACTIVE_RB
> EPS_ID EPS ID
> RB_MODE Radio bearer mode
> SN_LENGTH Indicates whether 5 or 7 or 12 bit PDCP SN is used.
> Discard timer Discard Timer in milliseconds, 0 means not configured
> ROHC_MAX_CID ROHC MAX CID
> ROHC_MASK ROHC MASK for enabled ROHC profile
4 9.2.4 PDCP PDU subpacket

5 The following format defines the subpacket version 1 of the PDCP PDU subpacket.
6
Field Description
RB_CFG_IDX CFG_IDX of the radio bearers

PDCP Layer
Field Description
MODE Radio Bearer Mode (1 for AM, 2 for UM)
SN_LENGTH Indicates whether 5 or 7 or 12 bit PDCP SN is used.
> PDU_SIZE PDU size in octets of each PDU.
> LOGGED_BYTES Number of bytes of raw header logged
> SFN System frame number when the PDU is logged. Bit 0 is the
Least Significant Bit (LSB).
printed next to both.
> LOG_BUF The first N bytes of the payload of this PDCP PDU
(Including header) as indicated by LOGGED_BYTES.
T
Logged data is in network byte order i.e. big endian.
PS
om 23
1 9.2.5 PDCP PDU subpacket with ciphering
.c 3:
sn 5:5
2 The following format defines the subpacket version 1 of the PDCP PDU subpacket with
3 ciphering.
i-n t 0
4
or 5 a
Field Description
r.h .0
SUBPKT_HDR Subpacket header structure as described in Section

ca .01
8.3.1
Reserved
os 12
SRB_CIPHER_ALGO Ciphering algo for SRBs

20
DRB_CIPHER_ALGO Ciphering algo for DRBs

> RB_CFG_INFO RB configuration information related to this pdu
Bit0 is Least Significant Bit (LSB)
> LOGGED_BYTES Number of bytes of the PDU getting logged
> SFN System Frame Number when the PDU is logged.
Bit 0 is the Least Significant Bit (LSB).
printed next to both.
> COUNT PDCP count used to decipher
> LOG_BUF The first N bytes of the PDCP PDU (including header)
as indicated by LOGGED_BYTES. Logged data is in
network byte order i.e. big endian.
5

PDCP Layer
1 9.2.6 PDCP DL SRB integrity pdu subpacket

2 The following format defines the sub packet version 1 of the PDCP DL PDU sub packet with
3 integrity.
4

Reserved
SRB_INTEGRITY_ALGO Integrity algo for SRBs
T
PS
> LOGGED_BYTES Number of bytes of the PDU getting logged. For integrity log
packet the complete pdu or first 1024 bytes are logged.
om 23
.c 3:
Display should be sys_fn first, followed by sub_fn. If reserved bits
sn 5:5
i.e. Bit14-Bit15 are set to “00”, sys_fn and sub_fn value is printed,
else “N/A” (Not Available) is printed next to both.
i-n t 0
> COUNT PDCP count

or 5 a
>RECEIVED_MAC-I Deciphered MAC-I value received from the network

r.h .0
>COMPUTED_MAC-I MAC-I value computed by the UE

ca .01
> LOG_BUF The first N bytes of the PDCP PDU (including header) as
indicated by LOGGED_BYTES. Logged data is in network byte
os 12
order i.e. big endian.

20

PDCP Layer
1 9.2.7 PDCP UL SRB integrity pdu subpacket

2 The following format defines the sub packet version 1 of the PDCP UL PDU sub packet with
3 integrity.

Reserved
SRB_INTEGRITY_ALGO Integrity algo for SRBs
T
PS
> LOGGED_BYTES Number of bytes of the PDU getting logged. For integrity log
packet the complete pdu or first 1024 bytes are logged.
om 23
> COUNT
.c 3:
PDCP count
sn 5:5
>COMPUTED_MAC-I MAC-I value computed by the UE
i-n t 0
> LOG_BUF The first N bytes of the PDCP PDU (including header) as
or 5 a
indicated by LOGGED_BYTES. Logged data is in network

byte order i.e. big endian.
r.h .0
ca .01
4 9.2.8 PDCP DL statistics subpacket

os 12
The following format defines the subpacket version 1 of the PDCP DL statistics subpacket.
20

NUM_RB Indicates the number of radio bearer logged in this log packet
NUM_ERRORS Total Number of PDCP DL Errors Reported
PDCP_HDR_LEN PDCP Header Length in bytes
NUM_RST Total Number of PDCP re-establishments since radio bearer
activation
NUM_FLOW_CTRL_TRIGGER Number of timer flow control is trigger
NUM_DATA_PDU_RX Total Number of PDCP Data PDUs received
NUM_DATA_PDU_RX_BYTES Total Number of PDCP Data PDU Data Bytes received
NUM_CONTROL_PDU_RX Total Number of PDCP Control PDUs received
NUM_CONTROL_PDU_RX_BYTES Total Number of PDCP Control PDU Data Bytes received
NUM_CONTROL_PDU_GEN Total Number of PDCP Control PDUs generated
NUM_CONTROL_PDU_GEN_BYTES Total Number of PDCP Control PDUs Bytes generated
NUM_STATUS_REPORT Total Number of PDCP status report control PDU received
CONTROL_PDU_RX

PDCP Layer

NUM_ROHC_CONTROL_PDU_RX Total Number of PDCP ROHC control PDUs received
NUM_PDU_ROHC_FAIL Total Number of PDCP PDUs ROHC decompression failed
NUM_PDU_INTEGRITY_FAIL Total Number of PDCP PDUs integrity verification failed
NUM_MISSING_SDU_TO_UPPER_ Total Number of PDCP missing SDUs when SDUs are
LAYER delivered to upper layer
NUM_MISSING_SDU_FROM_LOW_ Total Number of PDCP missing SDUs from RLC when
LAYER reestablishment happen
NUM_PDU_DUPS Total Number of PDCP duplicated PDUs
NUM_PDU_DUPS_BYTES Total Number of PDCP duplicated PDUs bytes
NUM_PDU_OUT_OF_WIN Total Number of PDCP out of window PDUs
NUM_PDU_OUT_OF_WIN_BYTES Total Number of PDCP out of window PDUs bytes
NUM_PDU_INVALID Total Number of PDCP invalid PDUs
NUM_PDU_INVALID_BYTES Total Number of PDCP invalid PDUs bytes
T
PS
NUM_FLOW_CTRL_TRIGGER_RST Number of timer flow control is trigger since last
om 23
reestablishment
.c 3:
NUM_DATA_PDU_RX_RST Total Number of PDCP Data PDUs received since last
sn 5:5
reestablishment
NUM_DATA_PDU_RX_BYTES_RST Total Number of PDCP Data PDU Data Bytes received since
i-n t 0
last reestablishment
or 5 a
NUM_CONTROL_PDU_RX_RST Total Number of PDCP Control PDUs received since last

reestablishment
r.h .0
ca .01
NUM_CONTROL_PDU_RX_BYTES_R Total Number of PDCP Control PDU Data Bytes received since
ST last reestablishment
os 12
NUM_CONTROL_PDU_GEN_RST Total Number of PDCP Control PDUs generated since last

20
reestablishment
NUM_CONTROL_PDU_GEN_ Total Number of PDCP Control PDUs Bytes generated since
BYTES_RST last reestablishment
NUM_STATUS_REPORT Total Number of PDCP status report control PDU received
CONTROL_PDU_RX_RST since last reestablishment
NUM_ROHC_CONTROL_PDU_RX_ Total Number of PDCP ROHC control PDUs received since last
RST reestablishment
NUM_PDU_ROHC_FAIL_RST Total Number of PDCP PDUs ROHC decompression failed
since last reestablishment
NUM_PDU_INTEGRITY_FAIL_RST Total Number of PDCP PDUs integrity verification failed since
NUM_MISSING_SDU_TO_UPPER_ Total Number of PDCP missing SDUs when SDUs are
LAYER_RST delivered to upper layer since last reestablish
NUM_MISSING_SDU_FROM_LOW_ Total Number of PDCP missing SDUs from RLC for last
LAYER_RST reestablishment
NUM_PDU_DUPS_RST Total Number of PDCP duplicated PDUs since last
reestablishment
NUM_PDU_DUPS_BYTES_RST Total Number of PDCP duplicated PDUs bytes since last
reestablishment
NUM_PDU_OUT_OF_WIN_RST Total Number of PDCP out of window PDUs since last
reestablishment
NUM_PDU_OUT_OF_WIN_BYTES_ Total Number of PDCP out of window PDUs bytes since last
RST reestablishment

PDCP Layer

NUM_PDU_INVALID_RST Total Number of PDCP invalid PDUs since last reestablishment
NUM_PDU_INVALID_BYTES_RST Total Number of PDCP invalid PDUs bytes since last
reestablishment
1 NOTE: PDCP DL throughput for a radio bearer can be calculated by the following:
2 NUM_DATA_PDU_RX_BYTES + NUM_CONTROL_PDU_RX_BYTES +
3 NUM_PDU_INVALID_BYTES. The grand total PDCP DL throughput should be the summation
4 of all active radio bearers.
5 9.2.9 PDCP UL statistics subpacket

6 The following format defines the subpacket version 1 of the PDCP DL statistics subpacket.
T
PS
om 23
.c 3:
NUM_RB Indicates the number of radio bearer logged in this log packet
sn 5:5
NUM_ERRORS Total Number of PDCP UL Errors Reported
i-n t 0

or 5 a

r.h .0
PDCP_HDR_LEN PDCP Header Length in bytes

ca .01
NUM_RST Total Number of PDCP re-establishments since radio bearer

activation
os 12
NUM_FLOW_CTRL_TRIGGER Number of timer flow control is trigger

20
NUM_DATA_PDU_TX Total Number of PDCP Data PDUs transmitted

NUM_DATA_PDU_TX_BYTES Total Number of PDCP Data PDU Data Bytes transmitted
NUM_CONTROL_PDU_TX Total Number of PDCP Control PDUs transmitted
NUM_CONTROL_PDU_TX_BYTES Total Number of PDCP Control PDU Data Bytes transmitted
NUM_STATUS_REPORT Total Number of PDCP status report control PDU transmitted
CONTROL_PDU_TX
NUM_ROHC_FAIL Total Numer pf PDCP ROHC compression fail
NUM_ROHC_CONTROL_PDU_TX Total Number of PDCP ROHC control PDUs transmitted
NUM_DISCARD_SDU Total Number of PDCP SDUs Discarded (Timer Discard)
NUM_DISCARD_SDU_BYTES Total Number of PDCP SDUs Discarded bytes (Timer Discard)
NUM_PDU_HO_RE_TX Total Number of PDCP PDUs retransmitted
NUM_PDU_HO_RE_TX_BYTES Total Number of PDCP PDUs bytes retransmitted
NUM_FLOW_CTRL_TRIGGER_RST Number of timer flow control is trigger since last
reestablishment
NUM_DATA_PDU_TX_RST Total Number of PDCP Data PDUs transmitted since last
reestablishment
NUM_DATA_PDU_TX_BYTES_RST Total Number of PDCP Data PDU Data Bytes transmitted

PDCP Layer

NUM_CONTROL_PDU_TX_RST Total Number of PDCP Control PDUs transmitted since last
reestablishment
NUM_CONTROL_PDU_TX_BYTES_ Total Number of PDCP Control PDU Data Bytes transmitted
RST since last reestablishment
NUM_STATUS_REPORT Total Number of PDCP status report control PDU transmitted
CONTROL_PDU_TX_RST since last reestablishment
NUM_ROHC_FAIL_RST Total Numer pf PDCP ROHC compression fail since last
reestablishment
NUM_ROHC_CONTROL_PDU_TX_ Total Number of PDCP ROHC control PDUs transmitted since
RST last reestablishment
NUM_DISCARD_SDU_RST Total Number of PDCP SDUs Discarded (Timer Discard) since
NUM_DISCARD_SDU_BYTES_RST Total Number of PDCP SDUs Discarded bytes (Timer Discard)
T
NUM_PDU_HO_RE_TX_RST Total Number of PDCP PDUs retransmitted since last
PS
reestablishment
NUM_PDU_HO_RE_TX_BYTES_RST Total Number of PDCP PDUs bytes retransmitted since last
om 23
reestablishment
RESERVED
.c 3:
Shall be ignored
sn 5:5
i-n t 0
1 NOTE: PDCP UL throughput for a radio bearer can be calculated by the following:
or 5 a
2 NUM_DATA_PDU_TX_BYTES + NUM_CONTROL_PDU_TX_BYTES -
3 NUM_DISCARD_SDU_BYTES.
r.h .0
4 The grand total PDCP UL throughput should be the summation of all active radio bearers. Also
ca .01
5 note that the throughput account for data submitted to RLC, may not be acutally transmitted out
os 12
6 of the UE.
20

1 10 RRC Layer
2 10.1 LTE OTA message (LOG_CODE 0xB0C0)

3 This is the log record for messages sent or received over the air. This logs all messages except the
4 MIB. The log record is generated when an OTA message is sent or received.
5 The following format defines the subpacket version 1 of the LTE RRC OTA log packet.
Field Description
T
VERSION Log packet version number; range is 0 to 255.
PS
RRC_REL RRC release number
om 23
RRC_VER RRC version number; if 8.x.y, left 4 bits are for x, right 4 bits are
.c 3:
for y
sn 5:5
RB_ID Radio bearer on which the message was sent/received
i-n t 0
PHYSICAL CELL ID Physical cell ID; range is 0 to 503

or 5 a
FREQ E-ARFCN; range is 0 to 65535

SFN SFN on which this message was sent.
r.h .0
Bit 0 is the Least Significant Bit (LSB).

ca .01
Value is N/A if message type is DL_DCCH, UL_CCCH or

os 12
UL_DCCH, in which case the system and Subframe number are

both logged as 0
20
Valid value if message is BCCH_DL_SCH, PCCH or DL_CCCH

PDU_NUM Identifies message type (UL_DCCH/DL_CCCH/ to) – used for
decoding message.
ENCODED_MSG_LEN Length of the ASN.1 encoded message.
ENCODED_MSG ASN.1 encoded message sent/received
6 10.2 LTE MIB message (LOG_CODE 0xB0C1)

7 This log record contains information about the MIB. The log packet is generated whenever the
8 MIB is updated.
Field Description
PHYSICAL CELL ID Physical cell ID; range is 0 to 503
FREQ E-ARFCN; range is 0 to 65535
SFN SFN on which MIB was received; range is 0 to 1023
This is only the 10-bit system frame number (does not contain
the Subframe number)
NUM_TX_ANTENNAS Number of Tx antennas detected
DL BANDWIDTH Downlink bandwidth

RRC Layer
1 10.3 LTE serving cell info (LOG_CODE 0xB0C2)

2 This structure is for logging cell info. This will be logged every time the serving cell changes and
3 every time there is a SI update.
4 NOTE: On a cell change, this is logged only when MIB, SIB1 & SIB2 have been received on the new
5 cell. So in case of back to back handovers, if UE moves on to another cell (cell B) before
6 receiving MIB, SIB1 & SIB2 on a cell (cell A), that cell (cell A) will not be logged.
Field Description
PHYSICAL CELL ID Physical cell ID
DL FREQ Downlink frequency as E-ARFCN; range is 0 to 65535
T
UL FREQ Uplink frequency as E-ARFCN; range is 0 to 65535
PS
DL BANDWIDTH
om 23
UL BANDWIDTH
CELL IDENTITY Cell Identity received in SIB1; range is 0 to 268435455
.c 3:
sn 5:5
TRACKING AREA CODE Tracking area code; range is 0 to 65535
FREQ BAND INDICATOR Frequency band indicator; range is 1 to 64
i-n t 0
Information related to the selected PLMN

or 5 a
MCC MCC part of the PLMN

r.h .0
NUM OF MNC DIGITS Number of digits in the MNC; range is 2-3

ca .01
MNC MNC part of the PLMN

os 12
ALLOWED ACCESS Allowed access on the cell based on network select mode
indicated by NAS
20
8 10.4 LTE PLMN Search Request (LOG_CODE 0xB0C3)

9 This structure is for logging PLMN Search Request from NAS or from 3GPP RATs.
10
Field Description
NETWORK_SELECT_MODE Allowed access on the cell based on network select mode
indicated by NAS
SEARCH_TYPE Service Search type indicated by NAS.
NUM_RATS Max count 15
RAT_LIST – contains 15 entries of the following elements of which only NUM_RATS entries are valid
>RAT
> Reserved
>BAND_CAP Bands supported by the RAT

RRC Layer
Field Description
NUM_PLMNs Max count 256
PLMN_LIST – contains 256 entries of the following elements of which only NUM_PLMNS entries are valid
>RAT
>PLMN
1 10.5 LTE PLMN Search Response (LOG_CODE 0xB0C4)

2 This structure is for logging the PLMN search results sent to NAS or 3GPP RATs.
3
Field Description
T
PS
om 23
RAT Active RAT
.c 3:
SEARCH_STATUS sn 5:5
Reserved
i-n t 0
NUM_PLMNs Max count 40

PLMN_LIST – contains 40 entries of the following elements of which only NUM_PLMNS entries are valid
or 5 a
>RAT
r.h .0
>PLMN
ca .01
os 12
20

1 11 NAS Layer
2 11.1 ESM sublayer
3 11.1.1 LTE NAS ESM security protected OTA incoming msg

4 (LOG_CODE 0xB0E0)
This log record is generated when an ESM OTA message is received. The message format can be
T
5
PS
6 found in 3GPP TS 24.301, in chapter 9.
7
om 23
Field Description
Raw Data
.c 3: Incoming session management message
sn 5:5
i-n t 0
11.1.2 LTE NAS ESM security protected OTA outgoing msg

or 5 a
9 (LOG_CODE 0xB0E1)
r.h .0
ca .01
10 This log record is generated after applying security protection (ciphering) when sending the
11 outgoing ESM OTA message. The message format can be found in 3GPP TS 24.301, in
os 12
12 chapter 9.
20
Field Description
Raw Data Outgoing session management message
13 11.1.3 LTE NAS ESM plain OTA incoming msg (LOG_CODE 0xB0E2)
14 This log record is generated after security is removed (deciphered) on the received ESM OTA
15 message. The message format for the particular OTA ESM message can be found in 3GPP TS
16 24.301, in chapter 8.3.
Field Description
LOG_VERSION Log packet version number; range is 0 to 255.
STD_VERSION NAS release number
STD_VERSION_MAJOR NAS version major number
STD_VERSION_MINOR NAS version minor number
Raw Data Incoming session management message
17

NAS Layer
1 11.1.4 LTE NAS ESM plain OTA outgoing msg (LOG_CODE 0xB0E3)
2 This log record is generated before applying security protection (ciphering) to the outgoing ESM
3 OTA message. The message format for the particular OTA ESM message can be found in 3GPP
4 TS 24.301, in chapter 8.3.
5
Field Description
6
T
PS
7 11.1.5 LTE NAS ESM Bearer Context state (LOG_CODE 0xB0E4)
om 23
8 This log packet provides information about the ESM context state. This log record is generated
.c 3:
9 when the ESM context state changes. This log record is generated whenever Bearer context state
sn 5:5
10 changes.
11
i-n t 0
Field Description
or 5 a

r.h .0

ca .01
BEARER_ID ID of the bearer context

os 12
BEARER_STATE Bearer state:

20
CONNECTION_ID Connection ID associated with the bearer

12
13 11.1.6 LTE NAS ESM bearer context info (LOG_CODE 0xB0E5)

14 This log packet provides detailed information about the ESM context state. This log record is
15 generated when the ESM context state changes. This log record is generated when the bearer
16 context is active for the first time or when the context is modified.
17
Field Description
Context Type Default or Dedicated
BEARER_ID ID of the bearer context
BEARER_STATE Bearer state
CONNECTION_ID Connection ID associated with the bearer
SDF_ID Service Data Flow ID
LBI_VALID TRUE or FALSE
LBI Linked Bearer Identity i.e. default bearer context to which
this belongs to.

NAS Layer
Field Description
RB_ID Radio bearer ID that corresponds to the EPS Bearer ID of
the context
EPS_QOS EPS QoS Information – To be interpreted as per the Qos
table below in that order. For interpretation of the values
refer section 9.9.4.3 of the spec TS 24.301
1
2 *Interpret and print only “Length” number of bytes in the order of the fields listed in the table
3 below.
4 *For interpretation of the values refer section 9.9.4.3 of the spec TS 24.301
5 Table 11-1 EPS_QOS format

Field Name Length
T
Length 1
PS
qci 1
om 23
max_bit_rate_ul 1
.c 3:
max_bit_rate_dl 1
sn 5:5
gbr_ul 1
gbr_dl 1
i-n t 0
max_bit_rate_ul_ex 1
or 5 a
max_bit_rate_dl_ex 1
r.h .0
gbr_ul_ex 1
ca .01
gbr_dl_ex 1
os 12
6
20
7 11.1.7 LTE NAS ESM Procedure state (LOG_CODE 0xB0E6)

8 This log packet provides information about the ESM procedure state. This log record is generated
9 when an ESM procedure is initiated. This log record is generated when a procedure is activated
10 by UE.
11
Field Description
INSTANCE_ID ID of the procedure
PROC_STATE Procedure state:
PTI Procedure transaction Identifier
SDF_ID Service Data Flow associated with this procedure
PENDING_MSG Pending message ID
12

NAS Layer
1 11.2 EMM sublayer
2 11.2.1 LTE NAS EMM security protected OTA incoming msg

3 (LOG_CODE 0xB0EA)
4 This log record is generated when an EMM OTA message is received. The message format can
5 be found in 3GPP TS 24.301, in chapter 9.
6
Field Description
Raw Data Incoming mobility management message
7
8 11.2.2 LTE NAS EMM security protected OTA outgoing msg
T
9 (LOG_CODE 0xB0EB)
PS
10 This log record is generated after applying security protection to (ciphering) the outgoing EMM
om 23
11 OTA message. The message format can be found in 3GPP TS 24.301, in chapter 9.
.c 3:
12
sn 5:5
Field Description
i-n t 0
Raw Data Outgoing mobility management message

or 5 a
13
r.h .0
ca .01
14 11.2.3 LTE NAS EMM plain OTA incoming msg (LOG_CODE 0xB0EC)
os 12
15 This log record is generated after security is removed (deciphered) on the received EMM OTA
20
16 message. The message format for the particular OTA EMM message can be found in 3GPP TS
17 24.301, in chapter 8.2.
18
Field Description

Raw Data Incoming session management message
19

NAS Layer
1 11.2.4 LTE NAS EMM plain OTA outgoing msg (LOG_CODE 0xB0ED)
2 This log record is generated before applying security protection (ciphering) to the outgoing EMM
3 OTA message. The message format for the particular OTA EMM message can be found in 3GPP
4 TS 24.301, in chapter 8.2.
5
Field Description
T
6
PS
om 23
7 11.2.5 LTE NAS EMM state (LOG_CODE 0xB0EE)
.c 3:
8 This log packet provides information about the EMM state. This log record is generated when the
sn 5:5
9 EMM state changes. EMM State machine is described in 3GPP TS 24.301 V8.0.0, in
chapter 5.1.3.
i-n t 0
10
11
or 5 a
Field Description
r.h .0

ca .01

os 12
EMM state Current EMM state

20
EMM sub-state Current EMM sub-state

PLMN ID Current PLMN ID that the EMM is trying to update with or
attached to. For PLMN ID format see the following table
GUTI_Valid GUTI is valid or not(GUTI_VALID or GUTI_INVALID)
GUTI Globally Unique Temporary Identifier
lte_nas_emm_guti_type
12
8 7 6 5 4 3 2 1
MCC digit 2 MCC digit 1 octet 2
MNC digit 3 MCC digit 3 octet 3
MNC digit 2 MNC digit 1 octet 4
13 PLMN ID Format

NAS Layer
1 EMM state table description is below.

2
EMM_NULL : 0
EMM_DEREGISTERED : 1
EMM_REGISTERED_INITIATED : 2
EMM_REGISTERED :3
EMM_TRACKING_AREA_UPDATING_INITIATED : 4
EMM_SERVICE_REQUEST_INITIATED : 5
EMM_DEREGISTERED_INITIATED:6 EMM_INVALID_STATE : 7
3 EMM state table

4 If EMM_state is Deregistered (1), then EMM_substate
5
EMM_DEREGISTERED_NO_IMSI : 0
T
EMM_DEREGISTERED_PLMN_SEARCH : 1
PS
EMM_DEREGISTERED_ATTACH_NEEDED : 2
EMM_DEREGISTERED_NO_CELL_AVAILABLE : 3
om 23
EMM_DEREGISTERED_ATTEMPTING_TO_ATTACH : 4
.c 3:
EMM_DEREGISTERED_NORMAL_SERVICE : 5
sn 5:5
EMM_DEREGISTERED_LIMITED_SERVICE : 6
i-n t 0
6
or 5 a
7 If EMM_state is EMM_REGISTERED(2) , then EMM_substate

8
r.h .0
EMM_REGISTERED_NORMAL_SERVICE : 0
ca .01
EMM_REGISTERED_UPDATE_NEEDED : 1
os 12
EMM_REGISTERED_ATTEMPTING_TO_UPDATE : 2
EMM_REGISTERED_NO_CELL_AVAILABLE : 3
20
EMM_REGISTERED_PLMN_SEARCH : 4
EMM_REGISTERED_LIMITED_SERVICE : 5
9
10 If EMM_state EMM_REGISTERED_INITIATED (2) then EMM_substate

11
EMM_WAITING_FOR_NW_RESPONSE : 0
EMM_WAITING_FOR_ESM_RESPONS : 1
12
13 For EMM_TRACKING_AREA_UPDATING_INITIATED and

14 EMM_SERVICE_REQUEST_INITIATED states the substates of EMM_REGISTERED are
15 valid.
16
EMM_REGISTERED_NORMAL_SERVICE : 0
EMM_REGISTERED_UPDATE_NEEDED : 1
EMM_REGISTERED_ATTEMPTING_TO_UPDATE : 2
EMM_REGISTERED_NO_CELL_AVAILABLE : 3
EMM_REGISTERED_PLMN_SEARCH : 4
EMM_REGISTERED_LIMITED_SERVICE : 5
17

NAS Layer
1 For EMM_DEREGISTERED_INITIATED, EMM_NULL and EMM_INVALID_STATE,

2 EMM_substate does not apply.
3 GUTI_Valid = 1 means GUTI is valid(GUTI_VALID) and GUTI_Valid =0 means GUTI is
4 invalid(GUTI_INVALID)
5 Any other value interpret it as GUTI_INVALID.
6 If GUTI is valid(GUTI_VALID) interpret and display the GUTI as described below.
7 lte_nas_emm_guti_type is described as below
8
Field
UE_ID
PLMN
MME_GROUP_ID
MME_CODE
T
PS
M_TMSI
om 23
9 lte_nas_emm_guti_type format
.c 3:
10 UE_ID = 1 means IMSI_ID and UE_ID =6 means GUTI_ID
sn 5:5
11 PLMN as per the PLMN format table mentioned above
i-n t 0
12 MME_GROUP_ID interpret/display as an array of bytes

or 5 a
13 M_TMSI interpret/display as an array of bytes

r.h .0
ca .01
14
os 12
11.2.6 LTE NAS EMM USIM card mode (LOG_CODE 0xB0EF)

20
15
16 This log packet provides information about the USIM card as known to EMM. This log record is
17 generated when EMM gets the sim-available request from the REG and EMM reads the USIM
18 contents.
19
Field Description
Card_mode USIM card mode (Values will be provided later)
LTE related service supported LTE service is supported or not. TRUE(1) or FALSE(0)
IMSI [S14]
EPSLOCI 4.2.91 in [S13]
20

NAS Layer
1 11.2.7 LTE NAS EMM USIM service table (LOG_CODE 0xB0F5)

2 This log packet describes the Service available to the UE. Refer to 4.2.8 in [S13] EFEPSNSC.
3 This log record is generated when the USIN is read on power up and when the sim available
4 request is received from the REG.
5
Field Description
Services n°1 to n°8 Refer to 4.2.8 in [S13] EF UST
T
PS
om 23
.c 3:
Refer to 4.2.8 in [S13] EF UST
sn 5:5
Services n°57 to n°64
i-n t 0

or 5 a

r.h .0
ca .01
os 12
20

NAS Layer
1 11.2.8 LTE NAS EMM Forbidden TAI list (LOG_CODE 0xB0F6)

2 This log packet provides information about the forbidden TAI list for roaming and service
3 purposes.
4 This is logged whenever any of the forbidden TAI list for roaming and forbidden TAI list for
5 service changes. These may change due to tracking area update, service acquisition and
6 authentication procedures.
7
Field Description
Forbidden TAI list for roaming Forbidden TAI list for roaming
lte_nas_tai_lst2_type
T
Forbidden TAI list for service Forbidden TAI list for service
PS
om 23
8 lte_nas_tai_lst2_type is described below. The tool should interpret tai_lst_length no. of
.c 3:
9 lte_nas_tai_lst1_type records for each of the Field in the table above.
sn 5:5
10
Field
i-n t 0
tai_lst_length
or 5 a
r.h .0
5*tai_lst_length
ca .01
11 lte_nas_tai_lst2_type
os 12
PLMN + TAC combined together is 5 bytes.

20
12
13 lte_nas_tai_lst1_type is described below.

14
Field
PLMN
TAC
15 lte_nas_tai_lst1_type
16 PLMN to be interpreted as follows.
17
8 7 6 5 4 3 2 1
MCC digit 2 MCC digit 1 octet 1
MNC digit 3 MCC digit 3 octet 2
MNC digit 2 MNC digit 1 octet 3
18 PLMN ID Format

1 12 Call Manager
2 12.1 CM phone event (LOG_CODE 0x1273)

3 This holds information for the CM phone event.
Field Description
VERSION Specifies the log packet version (version = 3 for the log packet
structure described below)
PH_EVENT Specifies the phone event; see [Q3] for values
T
PS
IS_IN_USE Indicates whether phone is currently in use
OPRT_MODE Specifies the current operating mode:
om 23
TEST_CONTROL_TYPE Specifies the current test control type:
.c 3:
CDMA_LOCK_MODE Indicates whether phone is CDMA locked until power cycle:
sn 5:5
ANSWER_VOICE Answer incoming voice call:
i-n t 0
MODE_PREF Indicate current mode preference:

or 5 a
PREF_TERM Specifies the current preference term:

ACQ_ORDER_PREF Specifies the acquisition order preferred by the client:
r.h .0
ca .01
SRV_DOMAIN_PREF Specifies the service domain preferred by the client:

BAND_PREF Indicates current band preference
os 12
BAND_PREF Specifies the bit mask

20
ROAM_PREF Specifies the current roam preference; bit mask

NAM_SEL Specifies the NAM selection
CURR_NAM Indicates the current NAM
PACKET_STATE Specifies the current packet state:
HYBR_PREF Specifies the hybrid preference:
NETWORK_SEL_MODE_ Specifies the network selection mode selected by the client:
PREF
PLMN Specifies the identifier of the PLMN to be selected manually;
see [Q3] for format description
USER_PREF_NETWORKS Specifies the user-preferred network list; see [Q3] for format
description
AVAILABLE_NETWORKS Specifies the available networks; see [Q3] for format
description
IS_CDMA_SUBSCRIPTION_ Specifies the whether the CDMA subscription/provisioning
AVAILABLE information is available
IS_GW_SUBSCRIPTION_ Specifies the whether the GSM/WCDMA
AVAILABLE subscription/provisioning information is available
RTRE_CONFIG Specifies the current RTRE configuration:
RTRE_CONTROL Specifies the current RTRE control:
ORIG_SRV_DOMAIN_PREF Specifies the service domain preference for PS attach/detach
commands:

Call Manager
Field Description
DDTM_PREF Specifies the DDTM preference:
CUR_DDTM_STATUS Specifies the current DDTM status
DDTM_ACT_MASK Specifies the DDTM action mask settings; bit mask values
are:
DDTM_NUM_SRV_OPT Specifies the number of DDTM options specified
DDTM_SRV_OPT_LIST Specifies the list of service options whose pages have to be
ignored
CPHS_ALLOWED Specifies the common PCN handset specifications:
ALS_ALLOWED Specifies the whether alternate line service (ALS) operations
are currently allowed for this phone
LINE Specifies the currently selected line:
LINE_SWITCHING Specifies the line switching:
REQUESTING_CLIENT_ID Specifies the requesting client ID
T
PS
CDMA_CAPABILITY Specifies the IS-2000 status message; see [Q3] for format
description
om 23
MSM_ID Specifies the MSM that generated this event:
.c 3:
ORIG_DDTM_ACT_MASK Specifies the DDTM action mask settings used during
origination
sn 5:5
Present only if VERSION is 2 or above
i-n t 0
or 5 a
1 12.1.1 Phone event

r.h .0
This section describes the enum values for PH_EVENT.

ca .01
Enum
os 12
End reason Comments

value
20
0 CM_PH_EVENT_OPRT_MODE Specifies the operating mode was

changed
1 CM_PH_EVENT_TEST_CONTROL_TYPE Specifies the operating mode type needs
to be updated
2 CM_PH_EVENT_SYS_SEL_PREF Specifies the system selection preference
was changed
3 CM_PH_EVENT_ANSWER_VOICE Specifies the answer voice as data was
changed; CDMA only
4 CM_PH_EVENT_NAM_SEL Specifies the NAM selection was
changed; CDMA only
5 CM_PH_EVENT_CURR_NAM Specifies the current NAM was changed;
CDMA only
6 CM_PH_EVENT_IN_USE_STATE Specifies the in-use state was changed
7 CM_PH_EVENT_CDMA_LOCK_MODE Specifies the CDMA lock mode was
changed; CDMA only
8 CM_PH_EVENT_UZ_CHANGED Specifies the user zone selection was
changed; CDMA only
9 CM_PH_EVENT_MAINTREQ Specifies the CDMA maintenance
required command; CDMA only
10 CM_PH_EVENT_STANDBY_SLEEP Specifies the entering powerdown sleep
mode

Call Manager
Enum
End reason Comments
value
11 CM_PH_EVENT_STANDBY_WAKE Specifies the exiting powerdown sleep
mode
12 CM_PH_EVENT_INFO Specifies the phone information this event
sent only to the client that requested this
information through
cm_ph_cmd_get_ph_info
13 CM_PH_EVENT_PACKET_STATE Specifies the packet state was changed;
CDMA only
14 CM_PH_EVENT_INFO_AVAIL Specifies the phone information now
available; automatically generated after a
client does activation
15 CM_PH_EVENT_SUBSCRIPTION_AVAILABLE Specifies the subscription information
available
16 CM_PH_EVENT_SUBSCRIPTION_NOT_ Specifies the subscription information is
T
PS
AVAILABLE not available
17 CM_ PH_EVENT_SUBSCRIPTION_CHANGED Specifies the subscription information
om 23
changed
.c 3:
18 CM_PH_EVENT_AVAILABLE_NETWORKS_ Specifies the requested available
CONF networks are available;
sn 5:5
GSM/WCDMA/LTE only
i-n t 0
19 CM_PH_EVENT_PREFERRED_NETWORKS_ Specifies the requested preferred

CONF networks are available;
or 5 a
GSM/WCDMA/LTE only
r.h .0
20 CM_PH_EVENT_FUNDS_LOW Specifies the funds running low;

ca .01
GSM/WCDMA/LTE only
21 CM_PH_EVENT_WAKEUP_FROM_STANDBY Specifies the command is sent to lower
os 12
layers to wake up from deep sleep

20
(standby)
22 CM_PH_EVENT_NVRUIM_CONFIG_CHANGED Specifies the RTRE configuration
changed; CDMA only
23 CM_PH_EVENT_PREFERRED_NETWORKS_ Specifies the requested preferred
SET networks were written to (U)SIM;
GSM/WCDMA only
24 CM_PH_EVENT_DDTM_PREF Specifies the DDTM preference change
25 CM_PH_EVENT_PS_ATTACH_FAILED Specifies the packet service attach failed
26 CM_PH_EVENT_RESET_ACM_COMPLETED Specifies the ACM reset on (U)SIM;
GSM/WCDMA/LTE only
27 CM_PH_EVENT_SET_ACMMAX_COMPLETED Specifies the value written to the (U)SIM;
GSM/WCDMA/LTE only
28 CM_PH_EVENT_CDMA_CAPABILITY_UPDATED Specifies the CDMA capability updated
29 CM_PH_EVENT_LINE_SWITCHING Specifies the in switching setting updated
30 CM_PH_EVENT_SELECTED_LINE Specifies the selected line setting updated
31* CM_PH_EVENT_SECONDARY_MSM Specifies the invoke event callback even if
the event is from secondary MSM
32** CM_PH_EVENT_TERMINATE_GET_NETWORKS Specifies the current get network request
terminated
33** CM_PH_EVENT_DDTM_STATUS Specifies the DDTM status changed

Call Manager
Enum
End reason Comments
value
*This value is present only if feature FEATURE_UMTS_1X_HANDOVER_1XMSM or FEATURE_UMTS_
1X_HANDOVER_UMTSMSM is defined.
**If both FEATURE_UMTS_1X_HANDOVER_1XMSM and FEATURE_UMTS_1X_HANDOVER_
UMTSMSM are not defined, decrement the value by 1.
1
2 12.1.2 PLMN
Field Description
IDENTITY Specifies the PLMN ID
3
12.1.3 USER_PREF_NETWORKS
T
4
PS
Field Description
om 23
LENGTH Specifies the number of PLMNs in the list
.c 3:
INFO Specifies the PLMN information; see [Q3] for format description
sn 5:5
5
i-n t 0
12.1.3.1 INFO
or 5 a
Field Description
r.h .0
ca .01
PLMN Specifies the PLMN ID

ACCESS_TECH Specifies the access technology:
os 12
7
20
8 12.1.4 AVAILABLE_NETWORKS
Field Description
LENGTH Specifies the number of PLMNs in the list
INFO Specifies the PLMN information; see [Q3] for format description
9
10 12.1.4.1 INFO
Field Description
PLMN Specifies the PLMN ID
RAT Specifies the radio access technology of the PLMN
PLMN_SERVICE_ Specifies the type of service:
CAPABILITY
PLMN_FORBIDDEN Specifies whether the PLMN is forbidden
LIST_CATEGORY Specifies the type of PLMN:
SIGNAL_QUALITY Specifies the signal quality of the PLMN:
SIGNAL_STRENGTH Specifies the PLMN signal strength
11

Call Manager
1 12.1.5 CDMA_CAPABILITY
Field Description
TYPE Specifies the message type
PAYLOAD_LEN Specifies the message payload length in bits
PAYLOAD Specifies the message payload
2
3 12.2 CM call event (LOG_CODE 0x12C1)

4 This holds information for the CM call event.
Field Description
VERSION Specifies the log packet version (version – 3 for the log packet
T
CALL_EVENT Specifies the call event; see [Q3] for values
PS
CALL_CLIENT_ID Specifies the originating/answering client ID
om 23
CALL_ID Specifies the call ID
CALL_STATE Specifies the Call state
.c 3:
sn 5:5
CALL_TYPE Specifies the call type
NUM Specifies the number buffer; see [Q3] for format description
i-n t 0
REDIRECTING_NUMBER Specifies the redirecting number; see [Q3] for format description
or 5 a
ALPHA Specifies the tag to be displayed; see [Q3] for format description
r.h .0
SIGNAL Specifies the alert signal information; see [Q3] for format
ca .01
description
END_STATUS Specifies the call end status; see [Q3] for values
os 12
NUM_CALL_IDS_ENDED Specifies the number of calls ended

20
END_PARAMS Specifies the call end information; see [Q3] for format description
SYS_MODE Specifies which system call is made; values are:
CALL_CONNECT_TIME Specifies the time call was connected
CALL_END_TIME Specifies the time call was ended
BYTES_RECEIVED Specifies the number of bytes received for PS data call
BYTES_TRANSMITTED Specifies the number of bytes transmitted for PS data call
LINE Specifies the line being used for the call (voice calls only):
REQUESTING_CLIENT_ Specifies the requesting client’s ID
ID
MSM_ID Specifies which MSM generated this event; values are:
DIRECTION Holds the direction of the current call; values are:
5 12.2.1 Call event

6 This section describes the enum values for CALL_EVENT.
Enum
Event Comments
value
0 CM_CALL_EVENT_ORIG Specifies the phone originated a call

Call Manager
Enum
Event Comments
value
1 CM_CALL_EVENT_ANSWER Specifies the incoming call was answered
2 CM_CALL_EVENT_END_REQ Specifies the started the end process; GW only
3 CM_CALL_EVENT_END Specifies the originated/incoming call was ended
4 CM_CALL_EVENT_SUPS Specifies the phone sent Flash/Flash with
information to BS
5 Specifies the phone received an incoming call
6 CM_CALL_EVENT_CONNECT Specifies the priginated/incoming call was
connected
7 CM_CALL_EVENT_SRV_OPT Specifies the service option changed while in a
call; CDMA only
8 CM_CALL_EVENT_PRIVACY Specifies the privacy mode changed while in a
call; CDMA only
T
9 CM_CALL_EVENT_PRIVACY_PREF Specifies the privacy mode preference changed
PS
10 CM_CALL_EVENT_CALLER_ID Specifies the caller ID information was received
from BS; CDMA only
om 23
11 CM_CALL_EVENT_ABRV_ALERT Specifies the CMDA/AMPS abbreviated alert;
.c 3:
sn 5:5 CDMA only
12 CM_CALL_EVENT_ABRV_REORDER Specifies the AMPS abbreviated reorder; CDMA
only
i-n t 0
13 CM_CALL_EVENT_ABRV_INTERCEP Specifies the AMPS abbreviated intercept; CDMA

or 5 a
T only
r.h .0
14 CM_CALL_EVENT_SIGNAL Specifies the signal information was received

from BS
ca .01
15 CM_CALL_EVENT_DISPLAY Specifies the display information was received

os 12
from BS; CDMA only

20
16 CM_CALL_EVENT_CALLED_PARTY Specifies the called party information was

received from BS; CDMA only
17 CM_CALL_EVENT_CONNECTED_ Specifies the connected number information was
NUM received from BS
18 CM_CALL_EVENT_INFO Specifies the call information for this event only;
sent to the client that requested this information
through cm_call_cmd_get_call_info
19 CM_CALL_EVENT_EXT_DISP Specifies the extended display was received from
BS; CDMA only
20 CM_CALL_EVENT_NDSS_START Specifies the start NDSS redirection; CDMA only
21 CM_CALL_EVENT_NDSS_CONNECT Specifies the call was reconnected due to NDSS;
CDMA only
The following are for FEATURE_JCDMA
22 CM_CALL_EVENT_EXT_BRST_INTL Specifies the extended burst type – international
23 CM_CALL_EVENT_NSS_CLIR_REC Specifies the national supplementary services –
CLIR
24 CM_CALL_EVENT_NSS_REL_REC Specifies the national supplementary services –
release
25 CM_CALL_EVENT_NSS_AUD_CTRL Specifies the national supplementary services –
audio control
26 CM_CALL_EVENT_L2ACK_CALL_ Specifies the call hold
HOLD

Call Manager
Enum
Event Comments
value
The following are for WCDMA/GSM
27 CM_CALL_EVENT_SETUP_IND Specifies the phone received a setup indicator
message from BS
28 CM_CALL_EVENT_SETUP_RES Specifies the setup response was sent
29 CM_CALL_EVENT_CALL_CONF Specifies the call origination has been accepted
The following are for WCDMA/GSM PS Data
30 CM_CALL_EVENT_PDP_ACTIVATE_ Specifies the phone received incoming PDP call
IND
31 CM_CALL_EVENT_PDP_ACTIVATE_ Specifies the response to incoming PDP was
RES sent
32 CM_CALL_EVENT_PDP_MODIFY_ Specifies the PDP modify request was sent
REQ
T
33 CM_CALL_EVENT_PDP_MODIFY_IN Specifies the phone received PDP modify
PS
D indication from BS
34 CM_CALL_EVENT_PDP_MODIFY_R Specifies the phone received PDP modify
om 23
EJ rejection from BS
.c 3:
35 CM_CALL_EVENT_PDP_MODIFY_
sn 5:5 Specifies the phone received PDP modify
CONF confirmation from BS
36 CM_CALL_EVENT_RAB_REL_IND Specifies the phone received RAB release
i-n t 0
indication from BS
or 5 a
37 CM_CALL_EVENT_RAB_REESTAB_ Specifies the phone received RAB reestablish

IND indication from BS
r.h .0
38 CM_CALL_EVENT_RAB_REESTAB_ Specifies the RAB reestablish request was sent

ca .01
REQ
os 12

CONF confirm from BS
20

REJ reject from BS
41 CM_CALL_EVENT_RAB_REESTAB_ Specifies the RAB reestablishment failed
FAIL
1
42 CM_CALL_EVENT_PS_DATA_ Specifies the PS data available request was sent
AVAILABLE
2
43 CM_CALL_EVENT_MNG_CALLS_ Specifies the confirmation for multiparty calls
CONF
2
44 CM_CALL_EVENT_CALL_BARRED Specifies the call barred notification
2
45 CM_CALL_EVENT_CALL_IS_WAITIN Specifies the call in waiting notification
G
2
46 CM_CALL_EVENT_CALL_ON_HOLD Specifies the call on hold notification
2
47 CM_CALL_EVENT_CALL_RETRIEVE Specifies the call retrieved notification
D
2
48 CM_CALL_EVENT_ORIG_FWD_ Specifies the originated call may be forwarded
STATUS notification to forwarding subscriber
2
49 CM_CALL_EVENT_CALL_ Specifies the call forwarded notification to
FORWARDED forwarding subscriber
2
50 CM_CALL_EVENT_CALL_BEING_ Specifies the call being forwarded notification to
FORWARDED calling subscriber

Call Manager
Enum
Event Comments
value
2
51 CM_CALL_EVENT_INCOM_FWD_ Specifies the incoming forwarded call notification
CALL forwarded to subscriber
2
52 CM_CALL_EVENT_CALL_ Specifies the call restricted notification
RESTRICTED
2
53 CM_CALL_EVENT_CUG_INFO_ Specifies the call forward CUG notification
RECEIVED
2
54 CM_CALL_EVENT_CNAP_INFO_ Specifies the caller name information notification
RECEIVED
2
55 CM_CALL_EVENT_EMERGENCY_ Specifies the voice call was converted into
FLASHED emergency call
2
56 CM_CALL_EVENT_PROGRESS_ Specifies the call origination progress indication
INFO_IND
2
57 CM_CALL_EVENT_CALL_ Specifies the call deflection notification
T
DEFLECTION
PS
2
58 CM_CALL_EVENT_TRANSFERRED_ Specifies the call transfer notification
CALL
om 23
2
59 CM_CALL_EVENT_EXIT_TC Specifies the traffic channel has been torn down;
.c 3:
sn 5:5 CDMA only
2
60 CM_CALL_EVENT_REDIRECTING_ Specifies the redirecting number information
NUMBER record event; CDMA only
i-n t 0
2
61 CM_CALL_EVENT_PDP_PROMOTE_ Specifies the obsolete with definition of
or 5 a
IND CM_API_SEC_PDP; clients check

CM_API_SEC_PDP for SEC PDP support;
r.h .0
secondary context being promoted to primary

ca .01
2
62 CM_CALL_EVENT_UMTS_CDMA_ Specifies the initiate the UMTS to 1X handoff
os 12
HANDOVER_START
2
20
63 CM_CALL_EVENT_UMTS_CDMA_ Specifies the UMTS to 1X handoff completed

HANDOVER_END
2,3
64 CM_CALL_EVENT_SECONDARY_ Specifies the event callback even if the event is
MSM from secondary MSM
2,4
65 CM_CALL_EVENT_ORIG_MOD_TO_ Specifies the origination command was modified
SS to SS due to call control
3,4
66 CM_CALL_EVENT_USER_DATA_IND Specifies the user data from remote side
3,4
67 CM_CALL_EVENT_USER_DATA_ Specifies the lower layers to stop sending user
CONG_IND data
3,4
68 CM_CALL_EVENT_MODIFY_IND Specifies the network-requested modification of
VTto-voice and vice-versa
3,4
69 CM_CALL_EVENT_MODIFY_REQ Specifies the request sent to do modification of
VTto-voice and vice-versa
3,4
70 CM_CALL_EVENT_LINE_CTRL Specifies the CM_LINE_CTRL_F report event
1. This value is present only if feature FEATURE_PS_DORMANT_PWR_SAVE is not defined.
2. If feature FEATURE_PS_DORMANT_PWR_SAVE is defined then decrement the value by 1.
3. This value is present only if feature FEATURE_UMTS_1X_HANDOVER_1XMSM or
FEATURE_UMTS_1X_HANDOVER_UMTSMSM is defined.
4. If both FEATURE_UMTS_1X_HANDOVER_1XMSM and FEATURE_UMTS_1X_HANDOVER_
UMTSMSM are not defined, decrement the value by 1.

Call Manager
1 12.2.2 Call end

2 This section describes the enum values for END_STATUS.
Enum
End reason Comments
value
0 CM_CALL_END_OFFLINE Specifies the phone is offline
20 CM_CALL_END_CDMA_LOCK Specifies the phone is CDMA-locked until power
cycle; CDMA only
21 CM_CALL_END_NO_SRV Specifies the phone has no service
22 CM_CALL_END_FADE Specifies the call has ended abnormally; CDMA
only
23 CM_CALL_END_INTERCEPT Specifies the received intercept from BS;
origination only; CDMA only
24 CM_CALL_END_REORDER Specifies the received reorder from BS;
origination only; CDMA only
T
PS
25 CM_CALL_END_REL_NORMAL Specifies the received release from BS; no reason
given
om 23
26 CM_CALL_END_REL_SO_REJ Specifies the received release from BS; SO reject;
.c 3:
sn 5:5 CDMA only
27 CM_CALL_END_INCOM_CALL Specifies the received incoming call from BS
28 CM_CALL_END_ALERT_STOP Specifies the received alert stop from BS;
i-n t 0
incoming only; CDMA only

or 5 a
29 CM_CALL_END_CLIENT_END Specifies the client ended call

r.h .0
30 CM_CALL_END_ACTIVATION Specifies the received end activation; OTASP call

only; CDMA only
ca .01
31 CM_CALL_END_MC_ABORT Specifies the MC aborted

os 12
origination/conversation; CDMA only

20
32 CM_CALL_END_MAX_ACCESS_ Specifies the maximum access probes

PROBE transmitted; CDMA only
33 CM_CALL_END_PSIST_NG Specifies the persistence test failure;
FEATURE_JCDMA only; CDMA only
34 CM_CALL_END_UIM_NOT_PRESENT Specifies the R-UIM not present
35 CM_CALL_END_ACC_IN_PROG Specifies the access attempt already in progress
36 CM_CALL_END_ACC_FAIL Specifies the access failure for reason other than
the above
37 CM_CALL_END_RETRY_ORDER Specifies the received retry order; origination only;
IS- 2000; CDMA only
38 CM_CALL_END_CCS_NOT_ Specifies the concurrent service not supported by
SUPPORTED_BY_BS BS
39 CM_CALL_END_NO_RESPONSE_ Specifies the no response received from BS
FROM_BS
40 CM_CALL_END_REJECTED_BY_BS Specifies the call rejected by BS; CDMA only
41 CM_CALL_END_INCOMPATIBLE Specifies the concurrent services requested not
compatible; CDMA only
42 CM_CALL_END_ACCESS_BLOCK Specifies the access is blocked by BS; CDMA
only
43 CM_CALL_END_ALREADY_IN_TC Specifies the corresponds to CM_CALL_ORIG_
ERR_ALREADY_IN_TC

Call Manager
Enum
End reason Comments
value
44 CM_CALL_END_EMERGENCY_ Specifies the call is ending due to emergency call
FLASHED that is flashed over this call; CDMA only
45 CM_CALL_END_USER_CALL_ORIG_ Specifies the CM is ending GPS call in favor of a
DURING_GPS user call
46 CM_CALL_END_USER_CALL_ORIG_ Specifies the CM is ending SMS call in favor of a
DURING_SMS user call
47 CM_CALL_END_USER_CALL_ORIG_ Specifies the CM is ending data call in favor of an
DURING_DATA emergency call
48 CM_CALL_END_REDIR_OR_ Specifies the call rejected because of redirection
HANDOFF or handoff
GSM/WCDMA
100 CM_CALL_END_LL_CAUSE Specifies the received reason from lower layer,

look in cc_cause
T
PS
101 CM_CALL_END_CONF_FAILED Specifies the call origination request failed
102 CM_CALL_END_INCOM_REJ Specifies the client rejected the incoming call
om 23
103 CM_CALL_END_SETUP_REJ Specifies the client rejected the setup_ind
.c 3:
104 CM_CALL_END_NETWORK_END Specifies the network ended the call, look in
sn 5:5
cc_cause; WCDMA/GSM only
i-n t 0
105 CM_CALL_END_NO_FUNDS Specifies the GSM/WCDMA/LTE only

106 CM_CALL_END_NO_GW_SRV Specifies the GWM/WCDMA/LTE only; phone has
or 5 a
no service
r.h .0
107 CM_CALL_END_NO_CDMA_SRV 1X only; phone has no service

ca .01
108 CM_CALL_END_NO_FULL_SRV Full service unavailable

os 12
109 CM_CALL_END_MAX_PS_CALLS Resources not available to handle new MO/MT

PS call
20
1xEV-DO
150 CM_CALL_END_CD_GEN_OR_BUSY Abort connection setup due to reception of

ConnectionDeny message with deny code =
general or network busy
151 CM_CALL_END_CD_BILL_OR_AUTH Abort connection setup due to reception of a
ConnectionDeny message with deny code =
billing or authentication failure
152 CM_CALL_END_CHG_HDR Change 1xEV-DO system due to redirection or
PRL not preferred
153 CM_CALL_END_EXIT_HDR Exit 1xEV-DO due to redirection or PRL not
preferred
154 CM_CALL_END_HDR_NO_SESSION No 1xEV-DO session
155 CM_CALL_END_CM_COLLOC_ACQ_ For internal CM use only; fail to acquire collocated

FAIL 1xEV-DO for origination
156 CM_CALL_END_HDR_ORIG_DURING Used if CM is ending an 1xEV-DO call origination
_GPS_FIX in favor of GPS fix
157 CM_CALL_END_HDR_CS_TIMEOUT Connection setup timeout
158 CM_CALL_END_HDR_RELEASED_ CM released 1xEV-DO call so that 1X call can
BY_CM continue
159 CM_CALL_END_HOLD_DBM_IN_ CM will hold the 1xEV-DO origination to allow 1X
PROG SMS to end

Call Manager
Enum
End reason Comments
value
160 CM_CALL_END_NO_HYBR_HDR_SR Mobile has no hybrid 1xEV-DO service
V
161 CM_CALL_END_HDR_NO_LOCK_ Call ended because 1xEV-DO did not obtain the
GRANTED RF lock
Videotelephony call
301 CM_CALL_END_VIDEO_CONN_ Modem released the call after the modem had
been connected
302 CM_CALL_END_VIDEO_SETUP_ Call setup failed while trying to set up the modem
FAILURE
303 CM_CALL_END_VIDEO_PROTOCOL Video protocol closed after the video protocol
_ setup was done
CLOSED
304 CM_CALL_END_VIDEO_PROTOCOL Video protocol setup failed
T
_
PS
SETUP_FAILURE
om 23
305 CM_CALL_END_INTERNAL_ERROR CM internal error other than any of the above
.c 3:
1
sn 5:5
i-n t 0
or 5 a
r.h .0
ca .01
os 12
20

Call Manager
1 12.2.3 NUM
2 Depending on the call event, this field will have different numbers.
Call event Contents of number buffer
CM_CALL_EVENT_ORIG Specifies the dialed digit string
CM_CALL_EVENT_FLASH Specifies the dialed digit string
CM_CALL_EVENT_INCOM Specifies the caller ID string
CM_CALL_EVENT_CALLER_ID Specifies the caller ID string
3
Field Description
BUF Specifies the number buffer
LEN Specifies the length of the number stored
T
DIGIT_MODE Specifies the origination digit mode; values are:
PS
NUMBER_TYPE Specifies the number type
om 23
NUMBER_PLAN Specifies the numbering plan
.c 3:
PI Specifies the presentation indicator
sn 5:5
SI Specifies the screening indicator
SUBADDR Specifies the subaddress; see [Q3] for format description
i-n t 0
4
or 5 a
r.h .0
ca .01
os 12
20

Call Manager
1 12.2.3.1 SUBADDR
Field Description
EXTENSION_BIT Specifies the extension bit
SUBADD_TYPE Specifies the type of subaddress;
ODD_EVEN_IND Specifies whether even or odd bits;
NUM_CHAR Specifies the number of characters in subaddress array
CHARI Specifies the array of subaddress digits
2
3 12.2.4 REDIRECTING_NUMBER
Field Description
T
NUM Specifies the number that is redirecting
PS
REDIRECTING_REASON Specifies the redirecting reason
om 23
4
.c 3:
sn 5:5
5 12.2.5 ALPHA
i-n t 0
Field Description
or 5 a
BUF Specifies the alpha tag buffer

r.h .0
LEN Specifies the tag length

ca .01
os 12
12.2.6 SIGNAL
20
Field Description
IS_SIGNAL_INFO_AVAIL Specifies whether the signal information is available
SIGNAL_TYPE Signal type
ALERT_PITCH Specifies the alert pitch
SIGNAL Specifies which tone signal to use
7 12.2.7 END_PARAMS
Field Description
CALL_ID Specifies the call ID to end
INFO_TYPE Specifies the mode type; values are:
0 – CDMA
1 – GSM/WCDMA circuit-switched
2 – GSM/WCDMA/LTE packet-switched
END_PARAMS Specifies the mode-specific end parameters; see [Q3] for format
description

Call Manager
1 12.2.7.1 Mode-specific END_PARAMS

Field Description
GW_CS_END Specifies the GSM/WCDMA circuit-switched end parameters
See GW_CS_END below for format description.
GW_PS_END Specifies the GSM/WCDMA/LTE packet-switched end parameters
See GW_PS_END below for format description.
CDMA_END Specifies the CDMA call end parameters
See CDMA_END below for format description.
2 12.2.7.1.1 GW_CS_END
Field Description
RESERVED Specifies the reserved for future use
T
PS
3 12.2.7.1.2 GW_PS_END
om 23
Field Description
.c 3:
NSAPI Specifies the network service access point indicator; see [Q3] for
sn 5:5
format description
i-n t 0
TEAR_DOWN_IND Specifies the teardown indicator; see [Q3] for format description
CAUSE Specifies the cause for ending the call; values are:
or 5 a
4
r.h .0
ca .01
5 12.2.7.1.3 NSAPI
os 12
Field Description
20
VALID Specifies the valid flag

NSAPI Specifies the NSAPI
6
7 12.2.7.1.4 TEAR_DOWN_IND
Field Description
VALID Specifies the valid flag
TI_FLAG Specifies the TI flag
8
9 12.2.7.1.5 CDMA_END
Field Description
END_REASON_INCLUDED Specifies the end reason included or not
END_REASON Specifies the end reason;
10
11 12.3 CM serving system event (LOG_CODE 0x134F)

12 This section contains information for the CM Serving System event.

Call Manager
Field Description
VERSION Specifies the log packet version (version = 8 for the log packet
SS_EVENT Specifies the serving system event; refer to [Q3]
1
CHANGED_FIELDS Specifies the bit mask of changed fields; refer to [Q3]
SRV_STATUS Specifies the serving status of the system
SRV_DOMAIN Specifies the service domain registered on the system
SRV_CAPABILITY Specifies the service domain registered on the system
SYS_MODE Specifies the system mode
ROAM_STATUS Specifies the roam status
2
SYS_ID Specifies the SYS_ID; refer to [Q3]
IS_SYS_FORBIDDEN Specifies whether the system is forbidden
IS_COLLOC Specifies whether the system is collocated
T
RSSI Specifies the RSSI in positive dBm, i.e., 75 means -75 dBm
PS
ECIO Specifies the ECIO in negative 0.5 dBm, i.e.,
63 means -31.5 dBm
om 23
IO Specifies the IO, valid in 1xEV-DO-only operation
SINR
.c 3:
SINR, valid only when sys_mode is 1xEV-DO; SINR range is 0 to 8;
sn 5:5
level 8 represents highest SINR
i-n t 0
PS_DATA_SUSPEND Specifies whether the current PS data service has been suspended
or 5 a
HDR_HYBRID Specifies whether the system is hybrid

HDR_SRV_STATUS Serving status of the 1xEV-DO system
r.h .0
HDR_ROAM_STATUS Roam status of the 1xEV-DO system

ca .01
HDR_RSSI Specifies the 1xEV-DO RSSI in positive dBm, i.e.,

os 12
75 means -75 dBm

20
HDR_ECIO Specifies the 1xEV-DO ECIO Ec/Io range is

5 (-31.5 dB) to 512 (0 dB)
HDR_IO Specifies the 1xEV-DO IO, range is -106 dBm to
-21 dBm
HDR_SINR Specifies the 1xEV-DO SINR, range is 0 to 8; level 8 represents
highest SINR
PREV_IDLE_DIGITAL_ Previous Idle Digital mode
MODE
CUR_IDLE_DIGITAL_ Specifies the current Idle Digital mode
MODE
MODE_INFO Specifies the refer to [Q3]
HYBR_HDR_BCMCS_ Specifies whether the 1xEV-DO system is configured to support
SRV_SUPPORTED BCMCS service
SS_MAIN_BCMCS_ Specifies whether the main system is configured to support BCMCS
SRV_SUPPORTED service
REQUESTING_ Requesting client ID
CLIENT_ID
3
MSM_ID Specifies the MSM that generated this event
4
WLAN_RSSI Specifies the WLAN RSSI in positive dBm, i.e.,
75 means -75 dBm
4
WLAN_SRV_STATUS Specifies the serving status of the WLAN system
4
WLAN_BSS_INFO Specifies the WLAN system Information; refer to [Q3]

Call Manager
Field Description
4
WLAN_STATS Specifies the WLAN stats; refer to [Q3]
CIPHER_DOMAIN Specifies the ciphering on CS or PS domain or both
MAIN_THR_STATUS Specifies the DCTM status on the main system; refer to [Q3]
HDR_THR_STATUS Specifies the DCTM status on the 1xEV-DO system; refer to [Q3]
2
HDR_SYS_ID Specifies the 1xEV-DO SYS_ID; refer to [Q3]
CURR_UPTIME Specifies the current uptime in seconds
5
PSIST Specifies the 1X Psist setting
1 12.3.1 Serving system event

Enum
Events Comment
value
T
0 CM_SS_EVENT_SRV_CHANGED Specifies the serving system information
PS
changed
om 23
1 CM_SS_EVENT_RSSI Specifies the RSSI value changed
.c 3:
2 CM_SS_EVENT_INFO Specifies the serving system information sent to
the requesting client
sn 5:5
3 CM_SS_EVENT_REG_SUCCESS Specifies the registration success
i-n t 0
4 CM_SS_EVENT_REG_FAILURE Specifies the registration failure

or 5 a
5 CM_SS_EVENT_HDR_RSSI Specifies the 1xEV-DO RSSI value changed

r.h .0
6 CM_SS_EVENT_WLAN_RSSI Specifies the WLAN RSSI value changed

ca .01
7 CM_SS_EVENT_SRV_NEW Specifies the serving system information

changed
os 12
8 CM_SS_EVENT_SECONDARY_MSM Specifies the invoke event callback even if the

20
event is from secondary MSM; used by thin client

CM layer to call client callbacks for events from
secondary MSM
9 CM_SS_EVENT_PS_DATA_AVAIL Specifies the PS data available
10 CM_SS_EVENT_PS_DATA_FAIL Specifies the failed to resume PS data
11 CM_SS_EVENT_PS_DATA_SUCCESS Specifies the successful in resuming PS data
12 CM_SS_EVENT_WLAN_STATS Specifies the update in WLAN stats
13 CM_SS_EVENT_ORIG_THR_TBL_ Specifies the call origination throttle table
UPDATE updated
2

Call Manager
1 12.3.2 Changed fields

Bit #
Mark Comments
set
0 CM_SS_SID_MASK Specifies the SID changed
1 CM_SS_NID_MASK Specifies the NID changed
2 CM_SS_REG_ZONE_MASK Specifies the registration zone changed
3 CM_SS_PACKET_ZONE_MASK Specifies the racket zone changed
4 CM_SS_BS_P_REV_MASK Specifies the rase station P-Rev changed
5 CM_SS_P_REV_IN_USE_MASK Specifies the P-Rev in use changed
6 CM_SS_CCS_SUPPORTED_MASK Specifies the concurrent services supported
value changed
7 CM_SS_SRV_STATUS_MASK Specifies the serving status changed
T
PS
8 CM_SS_SRV_DOMAIN_MASK Specifies the service domain changed
9 CM_SS_SRV_CAPABILITY_MASK Specifies the systems service capability changed
om 23
10 CM_SS_SYS_MODE_MASK Specifies the system mode changed
11 CM_SS_ROAM_STATUS_MASK
.c 3: Specifies the roaming status changed
sn 5:5
12 CM_SS_SYS_ID_MASK Specifies the SYS_ID changed
i-n t 0
13 CM_SS_SRV_IND_MASK Specifies the service indicator changed

or 5 a
14 CM_SS_MOBILITY_MGMT_MASK Specifies the mobility management changed

15 CM_SS_IDLE_DIGITAL_MODE_MASK Specifies the idle Digital mode changed
r.h .0
ca .01
16 CM_SS_SIM_STATE_MASK Specifies the SIM card status changed

17 CM_SS_PLMN_FORBIDDEN_MASK Specifies the forbidden PLMN/system
os 12
CM_SS_SYS_FORBIDDEN_MASK
20
18 CM_SS_PS_DATA_SUSPEND_MASK Specifies the PS data suspend changed

19 CM_SS_UZ_CHANGED_MASK Specifies the UZ values changed
20 CM_SS_HDR_SRV_STATUS_MASK Specifies the 1xEV-DO serving status changed
21 CM_SS_HDR_ROAM_STATUS_MASK Specifies the 1xEV-DO roaming status changed
22 CM_SS_MAIN_BCMCS_SRV_ Specifies the BCMCS service supported value
SUPPORTED_MASK changed
23 CM_SS_MAIN_BCMCS_SRV_STATUS_ Specifies the BCMCS service status on 1X
MASK changed
24 CM_SS_HYBR_HDR_BCMCS_SRV_ Specifies the BCMCS service supported value
Specifies the SUPP ORTED_MASK for 1xEV-DO changed
25 CM_SS_HYBR_HDR_BCMCS_SRV_ Specifies the BCMCS service status on 1xEV-
STATUS_MASK DO changed
26 CM_SS_BASE_STATION_PARMS_ Specifies the base station parameters changed
CHGD_MASK
27 CM_SS_WLAN_SRV_STATUS_MASK Specifies the WLAN serving status changed
28 CM_SS_WLAN_BSS_INFO_MASK Specifies the WLAN BSS information changed
29 CM_SS_ORIG_THR_STATUS_MASK Specifies the origination throttle status changed
30 CM_SS_HDR_SYS_ID_MASK Specifies the 1xEV-DO SYS_ID changed
2

Call Manager
1 12.3.3 SYS_ID
Field Description
ID_TYPE Specifies the SYS_ID type
ID Refer to [Q3]
2 12.3.3.1 ID
Field Description
IS95 Refer to [Q3]
IS856 Specifies the IS-856 System ID
PLMN Refer to [Q3]
SSID Refer to [Q3]
T
PLMN_LAC Refer to [Q3]
PS
om 23
3 12.3.3.2 IS95
.c 3:
sn 5:5
Field Description
SID Specifies the system ID
i-n t 0
NID Specifies the network ID

or 5 a
r.h .0
12.3.3.3 PLMN
ca .01
Field Description
os 12
IDENTITY Specifies the identity of the PLMN

20
6 12.3.3.4 SSID
Field Description
LEN Specifies the length of SSID; if LEN = 0 SSID, is broadcast
SSID
SSID SSID of the WLAN system
7 12.3.3.5 PLMN_LAC
Field Description
PLMN PLMN, refer to [Q3]
LAC Get comments

Call Manager
1 12.3.4 MODE_INFO
Field Description
GW_INFO Specifies the GSM/WCDMA/LTE mode information; refer to
[Q3]
CDMA_INFO Specifies the CDMA mode information; refer to [Q3]
2 12.3.4.1 GW_INFO
Field Description
BIT_ERR_RATE Specifies the it error rate/Rx quality in GSM
SIM_STATE Current state of the SIM
T
PLMN_FORBIDDEN Specifies the indicates whether the PLMN is forbidden
PS
MM_INFORMATION Specifies the mobility management information; refer to [Q3]
om 23
3
.c 3:
4 12.3.4.1.1 MM_INFORMATION sn 5:5
Field Description
i-n t 0
PLMN_AVAIL Specifies the indicates whether PLMN is available

or 5 a
FULL_NAME_AVAIL Specifies the indicates whether full name is available

r.h .0
SHORT_NAME_AVAIL Specifies the indicates whether short name is available

ca .01
UNIV_TIME_AND_TIME_ZONE_AVAIL Specifies the indicates whether universal time and time zone
os 12
information is available
20
TIME_ZONE_AVAIL Specifies the indicates whether time zone information is

available
LSA_IDENTITY_AVAIL Specifies the indicates whether LSA identity is available
DAYLIGHT_SAVING_ADJ_AVAIL Specifies the indicates whether daylight saving adjustment
information is available
PLMN Specifies the PLMN information; refer to [Q3]
FULL_NAME Specifies the full name; refer to [Q3]
SHORT_NAME Specifies the short name; refer to [Q3]
UNIV_TIME_AND_TIME_ZONE Specifies the universal time and time zone; refer to [Q3]
TIME_ZONE Specifies the time zone
LSA_IDENTITY Specifies the LSA identity; refer to [Q3]
DAYLIGHT_SAVING_ADJ Specifies the daylight saving adjustment
5

Call Manager
1 12.3.4.1.2 FULL_NAME
Field Description
LENGTH Specifies the number of characters in the full name
CODING_SCHEME Specifies the coding scheme used to encode the full name of
the network
ADD_COUNTRY_INITIALS Indicates whether MS should add the country initials to the full
name of the network
NAME Full name of the network
2
3 12.3.4.1.3 SHORT_NAME
Field Description
T
PS
LENGTH Specifies the number of characters in the full name
CODING_SCHEME Specifies the coding scheme used to encode the full name of
om 23
the networ
.c 3:
ADD_COUNTRY_INITIALS Indicates whether MS should add the country initials to the full
sn 5:5
name of the network
NAME Specifies the full name of the network
i-n t 0
4
or 5 a
12.3.4.1.4 UNIV_TIME_AND_TIME_ZONE
r.h .0
5
ca .01
6 Each field is received as Binary Coded Digits as specified in [S12] and [S15].
os 12
Field Description
20
YEAR Specifies the year

MONTH Specifies the month
DAY Specifies the day
HOUR Specifies the hour
MINUTE Specifies the minute
SECOND Specifies the second
TIME_ZONE Specifies the time zone
7
8 12.3.4.1.5 LSA_IDENTITY
Field Description
TYPE Specifies the localized service area identity type
IDENTITY Specifies the identity of the LSA
9
10 12.3.4.1.6 CDMA_INFO

Call Manager
1 12.3.4.1.7 UZ_NAME
Field Description
UZ_NAME_ENCODING Specifies the encoding scheme
UZ_NAME_N_OCTETS Specifies the number of octets
UZ_NAME Specifies the UZ name
2
3 12.3.5 WLAN_BSS_INFO
Field Description
CHAN Specifies the channel on which this BSS provides service
T
BAND Specifies the band in which this BSS provides service
PS
BSS_TYPE Specifies the type of BSS
om 23
BSSID BSS ID
SSID Specifies the SS ID refer to [Q3]
.c 3:
sn 5:5
RSSI Specifies the measured RSSI of the BSS
TECH Specifies the WLAN technology in use
i-n t 0
or 5 a
4 12.3.6 WLAN_BSS_STATS
r.h .0
ca .01
Field Description
os 12
CURRENT_XMIT_RATE Specifies the Xmit rate of the last packet successfully

20
transmitted
TOTAL_TX_BYTES Specifies the number of bytes transmitted over the WLAN
interface
TOTAL_RX_BYTES Specifies the number of bytes received over the WLAN
interface
5 12.3.7 MAIN_THR_STATUS/HDR_THR_STATUS
Field Description
SS_THR_STATUS Specifies the throttle status of the current SS
THR_UPTIME Specifies the throttling time period
IDX Specifies the index in the throttle_time table; used internally
by CM to keep track of the next throttle time increment
CALL_STATUS Specifies the call status

1 13 Other DIAG Requirement
2 13.1 LTE on-demand log

3 When the DM sends a LTE ON Demand Log request message, the AMSS checks for each log
4 code in the request message, whether the log code is enabled and registered for on-demand
5 logging, in which case that log packet is triggered. The LTE ON Demand Log response message
6 will indicate the status for each log packet requested.
T
PS
7 NOTE: This packet does not change the logging configuration, and does not guarantee data logging.
om 23
13.1.1 LTE on-demand log request
.c 3:
8 sn 5:5
9
Field Description
i-n t 0
CMD_CODE (xx/0xXX) Message ID – the DM sets CMD_CODE to 120 for this

or 5 a
message.
r.h .0
NUM_LOG_CODE Number of log codes requested in this message (Max.

ca .01
TBD)
LOG_CODE Log code requested
os 12
20
10 13.1.2 LTE on-demand log response

11
Field Description
CMD_CODE (xx/0xXX) Message ID – the DM sets CMD_CODE to 120 for this
message.
NUM_LOG_CODE Number of log codes requested in this message (Max.
TBD)
For each log code as indicated by the NUM_LOG_CODE field
LOG_CODE Log code received
STATUS Specified the status returned by the AMSS:
12


Qcomm LTE Log Packet Information 80 VP457 5 C LTE LPID PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Qcomm LTE Log Packet Information 80 VP457 5 C LTE LPID PDF

Uploaded by

Copyright:

Available Formats

QCT Tools Log Packet Information for

Long Term Evolution (LTE)

Qualcomm Confidential and Proprietary

subsidiary of Qualcomm without the express approval of Qualcomm’s Configuration Management.

Copyright © 2010-2011 QUALCOMM Incorporated.

2.2.1.2 Frame check.......................................................................................... 19

2.2.1.3 Ending flag ........................................................................................... 19

3 Packet Definitions ......................................................................................... 20

3.1 Streaming diagnostic communications enhancements ................................................ 20

3.2 Error handling ............................................................................................................. 21

3.3 General version number response (cmd_code 0) ........................................................ 21

80-VP457-5 C 2 Qualcomm Confidential and Proprietary

3.5.9.1 Status request ........................................................................................ 25

3.5.22 Clear WCDMA Diag statistics (cmd_code 27) ............................................. 33

3.5.22.1 Clear WCDMA Diag statistics request ............................................... 33

3.5.24 Reserved (cmd_code 29) ............................................................................... 33

3.5.25 Reserved (cmd_code 30) ............................................................................... 33

3.5.26 Reserved (cmd_code 31) ............................................................................... 33

3.5.27 Write fbiBER_Threshold reserved (cmd_code 32) ....................................... 33

80-VP457-5 C 3 Qualcomm Confidential and Proprietary

3.6.6.2 Port input response ............................................................................... 38

3.6.15.1 Bad length response ............................................................................ 43

3.6.16 Bad mode (cmd_code 24) .............................................................................. 43

3.6.16.1 Bad mode response ............................................................................. 43

3.6.17 Diag version (cmd_code 28) .......................................................................... 44

3.6.17.1 Diag version request ........................................................................... 44

3.6.18 Timestamp (cmd_code 29) ............................................................................ 44

80-VP457-5 C 4 Qualcomm Confidential and Proprietary

3.6.24.2 Nonvolatile item write response ......................................................... 51

3.6.31.1 Switch to downloader request............................................................. 55

3.6.32 Service programming code (cmd_code 65) ................................................... 56

3.6.32.1 Service programming code request .................................................... 56

3.6.32.2 Service programming code response .................................................. 56

3.6.33 Bad SPC mode (cmd_code 66) ...................................................................... 56

3.6.34 Serial mode change (cmd_code 68) ............................................................... 56

80-VP457-5 C 5 Qualcomm Confidential and Proprietary

3.6.36.15 Iterative directory list operation........................................................ 63

3.6.47.3 Common data structures for operations .............................................. 67

3.6.47.4 Logging range structure ...................................................................... 67

3.6.47.6 Disable logging operation response .................................................... 68

3.6.47.7 Retrieve logging ID ranges operation ................................................. 68

3.6.47.8 Set logging mask operation ................................................................ 68

3.6.48 Log on demand message (cmd_code 120) ..................................................... 68

4 Log Record Structure .................................................................................... 70

5 Lower Layer (LL1) .......................................................................................... 71

80-VP457-5 C 6 Qualcomm Confidential and Proprietary

5.3.4 LTE LL1 antenna correlation results (LOG_CODE 0xB120) ......................... 80

6.1.4 LTE ML1 uplink dedicated configuration (LOG_CODE 0xB163) ................. 97

6.1.7 LTE ML1 PRACH configuration (LOG_CODE 0xB166) ............................ 105

80-VP457-5 C 7 Qualcomm Confidential and Proprietary

6.4.2.1 Measurement configuration subpackets details .................................. 125

6.5.10.1 Reselection candidate substructure ................................................... 138

6.5.10.2 LTE cell structure (CandIDate RAT Type = 0) ................................ 138

80-VP457-5 C 8 Qualcomm Confidential and Proprietary

6.7 LTE ML1 BPLMN Log Packets ............................................................................... 159

6.7.1 List of BPLMN log packets ........................................................................... 159

6.7.5 LTE ML1 BPLMN TIME AVAILABLE INDICATION (LOG CODE:

0xB1A3) ................................................................................................................. 161

7 MAC Layer .................................................................................................... 163

80-VP457-5 C 9 Qualcomm Confidential and Proprietary

7.2.7 MAC RACH reason subpacket ...................................................................... 169

8 RLC Layer..................................................................................................... 173

8.1.15 LTE RLC UL UM data PDU (LOG_CODE 0xB096)................................. 176