CdmaCorePrinciple Opt

Course 120+ Section I
CDMA
CDMA Core
Core Principles
Principles
October, 2007
120v5 (c) 2007 Scott Baxter
Course 120+: 1
Forward Link Signals of a 3-sector CDMA Site

Using Only One Carrier Frequency
PN OFFSET
October, 2007
PN OFFSET
Course 120+: 2

Each sectors signal uses the PN Short code but with a unique timing delay.
To hear this sector, a mobile makes the short PN code in step with this sector.
PN OFFSET
October, 2007
PN OFFSET
Course 120+: 3

Inside the signal of one sector, every users call or data session has its own
private Walsh code. The administrative Pilot, Sync, and Paging channels
also have their own Walsh codes. There are 64 or 128 Walsh codes available,
depending on configuration. Each sector is completely free to use its own
walsh codes any way it wishes.
PN OFFSET
October, 2007
PN OFFSET
Course 120+: 4

Inside the signal of one sector, every users call or data session has its own
private Walsh code. The administrative Pilot, Sync, and Paging channels
also have their own Walsh codes. There are 64 or 128 Walsh codes available,
depending on configuration. Each sector is completely free to use its own
walsh codes any way it wishes.
PN OFFSET
PN OFFSET
All the sectors of this base station are on the same frequency, and the
bandwidth of the transmitted signals are about 1.25 MHz.
October, 2007
Course 120+: 5
The Capacity of One Carrier
PN OFFSET
PN OFFSET
PN
OFFSET
CARRIER FREQUENCY #1
If the inherent capacity of one carrier is not enough to meet traffic demand,
additional carrier frequencies can be added to sectors as desired.
October, 2007
Course 120+: 6
More Carriers for More Capacity

PN OFFSET
PN OFFSET
PN
OFFSET
PN OFFSET
PN OFFSET
PN
OFFSET
PN OFFSET
PN OFFSET
PN
OFFSET
Several methods are available to dynamically assign the mobiles among the
available carriers.
October, 2007
Course 120+: 7
CDMA Mobile Transmit (Reverse Link)
The forward link and reverse links are on different frequencies.

In the 1900 MHz. band, the duplex separation is 80 MHz.
In the 800/900 MHz. bands, the duplex separation is 45 MHz.
The mobiles transmit on the low frequency of the pair.
Each mobile uses the PN Long Code at a unique timing shift different from any
other mobile. This allows the mobile to be heard by the correct sector or
combination of sectors without conflict from any other mobile.
October, 2007
Course 120+: 8
Different Mobiles on Different Carriers
Each mobile transmits 80 MHz. below the forward link carrier it is using. The
noise level on each carrier is caused just by the mobiles on that carrier.
October, 2007
Course 120+: 9
CDMA: Using A New Dimension

Q All CDMA users occupy the same frequency
at the same time! Frequency and time are
not used as discriminators
Q CDMA operates by using CODING to
discriminate between users
Q CDMA interference comes mainly from
nearby users
Q Each user is a small voice in a roaring
crowd -- but with a uniquely recoverable
code
Raw RF of one channel vs all the energy

Our end-result Traffic Channel bit power vs noise
We watch Ec/Io because it is available use it for deciding handoff partners
October, 2007
CDMA
Figure of Merit: C/I

(carrier/interference ratio)
AMPS: +17 dB
TDMA: +14 to +17 dB
GSM: +7 to 9 dB.
CDMA: -10 to -17 dB.
CDMA: Eb/No ~+6 dB.
CDMA: Ec/Io >-14 dB.
Course 120+: 10
DSSS Spreading: Time-Domain View

Input A: Users Data
At Originating Site:
Q Input A: Users Data @
19,200 bits/second
Q Input B: Walsh Code #23
@ 1.2288 Mcps
Q Output: Spread
spectrum signal
Input B: Spreading Code
Q Input A: Received
spread spectrum signal
Q Input B: Walsh Code #23
@ 1.2288 Mcps
Q Output: Users Data @
19,200 bits/second just
as originally sent
October, 2007
XOR
Exclusive-OR
Gate
Spread Spectrum Signal
via air interface
At Destination Site:
Originating Site
Input A: Received Signal
Input B: Spreading Code
Destination Site
XOR
Exclusive-OR
Gate
Output: Users Original Data
Drawn to actual scale and time alignment

Course 120+: 11
Spreading from a Frequency-Domain View
Q Traditional technologies try

to squeeze signal into
minimum required
bandwidth
Q CDMA uses larger
bandwidth but uses
resulting processing gain to
increase capacity
TRADITIONAL COMMUNICATIONS SYSTEM

Spread
Spectrum
Narrowband
Signal
Slow
Information
Sent
TX
Slow
Information
Recovered
RX
SPREAD-SPECTRUM SYSTEM
Wideband
Signal
Slow
Information
Sent
Slow
Information
Recovered
TX
Fast
Spreading
Sequence
RX
Fast
Spreading
Sequence
Spread Spectrum Payoff:

Processing Gain
October, 2007
Course 120+: 12
Claude Shannon:
The Einstein of Information Theory
Q The core idea that makes CDMA
possible was first explained by
Claude Shannon, a Bell Labs
research mathematician
Q Shannon's work relates amount
of information carried, channel
bandwidth, signal-to-noise-ratio,
and detection error probability
It shows the theoretical
upper limit attainable
In 1948 Claude Shannon published his landmark
paper on information theory, A Mathematical
Theory of Communication. He observed that
"the fundamental problem of communication is
that of reproducing at one point either exactly or
approximately a message selected at another
point." His paper so clearly established the
foundations of information theory that his
framework and terminology are standard today.
Shannon died Feb. 24, 2001, at age 84.
October, 2007
SHANNONS
CAPACITY EQUATION
C = B log2 [
1+
S
N
B = bandwidth in Hertz
C = channel capacity in bits/second
S = signal power
N = noise power
Course 120+: 13
Modulation Techniques of 1xEV Technologies

Q 1xEV, 1x Evolution, is a family of alternative
fast-data schemes that can be implemented on a
1x CDMA carrier.
Q 1xEV DO means 1x Evolution, Data Only,
originally proposed by Qualcomm as High Data
Rates (HDR).
Up to 2.4576 Mbps forward, 153.6 kbps
reverse
A 1xEV DO carrier holds only packet data,
and does not support circuit-switched voice
Commercially available in 2003
Q 1xEV DV means 1x Evolution, Data and Voice.
Max throughput of 5 Mbps forward, 307.2k
reverse
Backward compatible with IS-95/1xRTT
voice calls on the same carrier as the data
Not yet commercially available; work
continues
Q All versions of 1xEV use advanced modulation
techniques to achieve high throughputs.
October, 2007
QPSK
CDMA IS-95,
IS-2000 1xRTT,
and lower rates
of 1xEV-DO, DV
16QAM
1xEV-DO
at highest
rates
64QAM
1xEV-DV
at highest
rates
Course 120+: 14
Digital Modulation Systems

Q Each symbol of a digitally
modulated RF signal conveys
a number of bits of information
determined by the number
of degrees of modulation
freedom
Q More complex modulation
schemes can carry more bits
per symbol in a given
bandwidth, but require better
signal-to-noise ratios
Q The actual number of bits per
second which can be
conveyed in a given bandwidth
under given signal-to-noise
conditions is described by
Shannons equations
October, 2007
Modulation
Scheme
Shannon Limit,
BitsHz
BPSK
QPSK
8PSK
16 QAM
32 QAM
64 QAM
256 QAM
1 b/s/hz
2 b/s/hz
3 b/s/hz
4 b/s/hz
5 b/s/hz
6 b/s/hz
8 b/s/hz
SHANNONS
CAPACITY EQUATION
C = B log2 [
1+
S
N
B = bandwidth in Hertz
C = channel capacity in bits/second
S = signal power
N = noise power
Course 120+: 15
The CDMA Spread Spectrum Payoff:

Would you like a lump-sum, or monthly payments?
Q Shannon's work suggests that a certain
bit rate of information deserves a
certain bandwidth
Q If one CDMA user is carried alone by a
CDMA signal, the processing gain is
large - roughly 21 db for an 8k vocoder.
Each doubling of the number of
users consumes 3 db of the
processing gain
Somewhere above 32 users, the
signal-to-noise ratio becomes
undesirable and the ultimate
capacity of the sector is reached
Q Practical CDMA systems restrict the
number of users per sector to ensure
processing gain remains at usable
levels
October, 2007
CDMA Spreading Gain

Consider a user with a 9600
bps vocoder talking on a
CDMA signal 1,228,800 hz
wide. The processing gain is
1,228,800/9600 = 128, which
is 21 db. What happens if
additional users are added?
# Users Processing Gain

1
21 db
18 db
15 db
12 db
16
9 db
32
6 db
64..Uh, Regis, can I just

take the money I've already
won, and go home now?
Course 120+: 16
CDMA Uses Code Channels

Q A CDMA signal uses many chips to convey just
one bit of information
Q Each user has a unique chip pattern, in effect a
code channel
Q To recover a bit, integrate a large number of
chips interpreted by the users known code
pattern
Q Other users code patterns appear random and
integrate in a random self-canceling fashion,
dont disturb the bit decoding decision being
made with the proper code pattern
Building a
CDMA Signal
Bits
from Users Vocoder
Forward Error
Correction
Symbols
Coding and
Spreading
Chips
October, 2007
Course 120+: 17
CDMA In Action: Multiple Users on a Sector

QPSK RF
Users
Analog
Summing
1
if 0 =
if 1 =
BTS
Demodulated
Received
CDMA Signal
Despreading Sequence
(Locally Generated, =0)
Received energy: Correlation
matches
opposite
Decision:
+10
-26
Time
Integration
Matches!
(=0) 1
Opposite
( =1)
-16
This figure illustrates the basic technique of

CDMA signal generation and recovery.
The actual coding process used in IS-95 CDMA includes
a few additional layers, as well see in following slides.
October, 2007
Course 120+: 18
Spreading: What we do, we can undo

ORIGINATING SITE
DESTINATION
Spread Data Stream
Input
Data
Recovered
Data
Spreading
Sequence
Spreading
Sequence
Q Sender combines data with a fast spreading sequence, transmits

spread data stream
Q Receiver intercepts the stream, uses same spreading sequence
to extract original data
October, 2007
Course 120+: 19
Shipping and Receiving via CDMA
Mailer
FedEx
Data
Receiving
FedEx
Shipping
Mailer
Data
Q Whether in shipping and receiving, or in CDMA, packaging is

extremely important!
Q Cargo is placed inside nested containers for protection and to
allow addressing
Q The shipper packs in a certain order, and the receiver unpacks in
the reverse order
Q CDMA containers are spreading codes
October, 2007
Course 120+: 20
CDMAs Nested Spreading Sequences

ORIGINATING SITE
X+A
DESTINATION
Spread-Spectrum Chip Streams

X+A+B
X+A+B+C
X+A+B
X+A
Input
Data
Recovered
Data
X
Spreading Spreading Spreading
Sequence Sequence Sequence
Spreading Spreading Spreading

Sequence Sequence Sequence
Q CDMA combines three different spreading sequences to create

unique, robust channels
Q The sequences are easy to generate on both sending and receiving
ends of each link
Q What we do, we can undo
October, 2007
Course 120+: 21
The Walsh Codes

WALSH CODES
Q 64 Magic Sequences, each 64 chips long

Q Each Walsh Code is precisely Orthogonal
with respect to all other Walsh Codes
its simple to generate the codes, or
theyre small enough to use from ROM
Unique Properties:
Mutual Orthogonality
EXAMPLE:
Correlation of Walsh Code #23 with Walsh Code #59
#23
#59
Sum
0110100101101001100101101001011001101001011010011001011010010110
0110011010011001100110010110011010011001011001100110011010011001
0000111111110000000011111111000011110000000011111111000000001111
Correlation Results: 32 1s, 32 0s: Orthogonal!!
#
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
---------------------------------- 64-Chip Sequence -----------------------------------------0000000000000000000000000000000000000000000000000000000000000000

0101010101010101010101010101010101010101010101010101010101010101
0011001100110011001100110011001100110011001100110011001100110011
0110011001100110011001100110011001100110011001100110011001100110
0000111100001111000011110000111100001111000011110000111100001111
0101101001011010010110100101101001011010010110100101101001011010
0011110000111100001111000011110000111100001111000011110000111100
0110100101101001011010010110100101101001011010010110100101101001
0000000011111111000000001111111100000000111111110000000011111111
0101010110101010010101011010101001010101101010100101010110101010
0011001111001100001100111100110000110011110011000011001111001100
0110011010011001011001101001100101100110100110010110011010011001
0000111111110000000011111111000000001111111100000000111111110000
0101101010100101010110101010010101011010101001010101101010100101
0011110011000011001111001100001100111100110000110011110011000011
0110100110010110011010011001011001101001100101100110100110010110
0000000000000000111111111111111100000000000000001111111111111111
0101010101010101101010101010101001010101010101011010101010101010
0011001100110011110011001100110000110011001100111100110011001100
0110011001100110100110011001100101100110011001101001100110011001
0000111100001111111100001111000000001111000011111111000011110000
0101101001011010101001011010010101011010010110101010010110100101
0011110000111100110000111100001100111100001111001100001111000011
0110100101101001100101101001011001101001011010011001011010010110
0000000011111111111111110000000000000000111111111111111100000000
0101010110101010101010100101010101010101101010101010101001010101
0011001111001100110011000011001100110011110011001100110000110011
0110011010011001100110010110011001100110100110011001100101100110
0000111111110000111100000000111100001111111100001111000000001111
0101101010100101101001010101101001011010101001011010010101011010
0011110011000011110000110011110000111100110000111100001100111100
0110100110010110100101100110100101101001100101101001011001101001
0000000000000000000000000000000011111111111111111111111111111111
0101010101010101010101010101010110101010101010101010101010101010
0011001100110011001100110011001111001100110011001100110011001100
0110011001100110011001100110011010011001100110011001100110011001
0000111100001111000011110000111111110000111100001111000011110000
0101101001011010010110100101101010100101101001011010010110100101
0011110000111100001111000011110011000011110000111100001111000011
0110100101101001011010010110100110010110100101101001011010010110
0000000011111111000000001111111111111111000000001111111100000000
0101010110101010010101011010101010101010010101011010101001010101
0011001111001100001100111100110011001100001100111100110000110011
0110011010011001011001101001100110011001011001101001100101100110
0000111111110000000011111111000011110000000011111111000000001111
0101101010100101010110101010010110100101010110101010010101011010
0011110011000011001111001100001111000011001111001100001100111100
0110100110010110011010011001011010010110011010011001011001101001
0000000000000000111111111111111111111111111111110000000000000000
0101010101010101101010101010101010101010101010100101010101010101
0011001100110011110011001100110011001100110011000011001100110011
0110011001100110100110011001100110011001100110010110011001100110
0000111100001111111100001111000011110000111100000000111100001111
0101101001011010101001011010010110100101101001010101101001011010
0011110000111100110000111100001111000011110000110011110000111100
0110100101101001100101101001011010010110100101100110100101101001
0000000011111111111111110000000011111111000000000000000011111111
0101010110101010101010100101010110101010010101010101010110101010
0011001111001100110011000011001111001100001100110011001111001100
0110011010011001100110010110011010011001011001100110011010011001
0000111111110000111100000000111111110000000011110000111111110000
0101101010100101101001010101101010100101010110100101101010100101
0011110011000011110000110011110011000011001111000011110011000011
0110100110010110100101100110100110010110011010010110100110010110
In CDMA2000, user data comes at various speeds, and different lengths of walsh codes can exist.
See Course 332 for more details on CDMA2000 1xRTT fast data channels and additional Walsh codes.
October, 2007
Course 120+: 22
How the PN Codes Are Made, Why They Work

An Ordinary Shift Register
Q The CDMA PN (pseudo-random)

codes are generated in small shift
registers that dont require much
circuitry or much battery power
Q Tapped shift register generates a wild,
self-mutating sequence 2N-1 chips
long (N=register length)
Such sequences match if
compared in step (no-brainer, any
sequence matches itself)
Such sequences appear
approximately orthogonal if
compared with themselves not
exactly matched in time
false correlation typically <2%
Q The Short PN code is used to make
sectors different from each other
Q The Long PN code is used to make
each mobiles signal different from
other mobiles
October, 2007
Sequence repeats every N chips,

where N is number of cells in register
A Tapped, Summing Shift Register
Sequence repeats every 2N-1 chips,

where N is number of cells in register
A Special Characteristic of Sequences
Generated in Tapped Shift Registers
Compared In-Step: Matches Itself
Sequence:
Self, in sync:
Sum:
Complete Correlation: All 0s
Compared Shifted: Little Correlation

Sequence:
Self, Shifted:
Sum:
Practically Orthogonal: Half 1s, Half 0s
Course 120+: 23
The Short PN Code makes Sectors Different

Original IS-95 CDMA PN Scrambling
32,768 chips long
26-2/3 ms.
(75 repetitions in 2 sec.)
I
Q
I-sequence
Walsh
users
symbols
RF: cos t
Same
information
duplicated
on I and Q
Q-sequence
Short PN
Scrambling
QPSKmodulated
RF
Output
RF: sin t
QPSK
Serial to
Parallel
Output
Q The short PN code consists of

two PN Sequences, I and Q, each
New CDMA2000 1x Complex Scrambling
32,768 chips long
RF:
Generated in similar but
cos t
differently-tapped 15-bit shift
I-sequence +
registers
users
Walsh
symbols
the two sequences scramble
+
the information on the I and Q
Different
phase channels
+
Information
Q-sequence
on I and Q
Q Figures to the right show how one
sin t
users channel is built at the bTS
RF
Complex Scrambling
October, 2007
Course 120+: 24
The Long PN Code Makes Mobiles Different

LONG CODE STATE REGISTER dynamic contents, zero timing shift
clock
MASK REGISTER unique steady contents cause unique timing shift

SUMMER holds dynamic modulo-2 sum of LC State and Mask registers
Each clock cycle, all the Summer bits are

added into a single-bit modulo-2 sum
The shifted Long Code emerges, chip by chip!
Q Every phone and every BTS channel element has a Long Code generator
Long Code State Register makes long code at system reference timing
A Mask Register holds a user-specific unique pattern of bits
Q Each clock pulse drives the Long Code State Register to its next state
State register and Mask register contents are added in the Summer
Summer contents are modulo-2 added to produce just a single bit output
Q The output bits are the Long Code, but shifted to the users unique offset
October, 2007
Course 120+: 25
Different Masks Produce

Different Long PN Offsets
TRAFFIC CHANNEL NORMAL
USING THE PUBLIC LONG CODE MASK
LONG CODE STATE REGISTER
PERMUTED ESN
fixed
SUMMING REGISTER
TRAFFIC CHANNEL PRIVATE

USING THE PRIVATE LONG CODE MASK
calculated PRIVATE LONG CODE MASK

SUMMING REGISTER
ACCESS CHANNEL (IDLE MODE)

USING THE ACCESS CHANNEL LONG CODE MASK
fixed
AC# PC#
BASE_ID
SUMMING REGISTER
October, 2007
PILOT PN
Q Ordinary mobiles use their ESNs and

the Public Long Code Mask to
produce their unique Long Code PN
offsets
main ingredient: mobile ESN
Q Mobiles needing greater privacy use
the Private Long Code Mask
instead of 32-bit ESN, the mask
value is produced from SSD
Word B in a calculation similar to
authentication
Q Each BTS sector has an Access
Channel where mobiles transmit for
registration and call setup
the Access Channel Long Code
Mask includes Access Channel
#, Paging Channel #, BTS ID,
and Pilot PN
The BTS transmits all of these
parameters on the Paging
Channel
Course 120+: 26
IS-95
IS-95 CDMA
CDMA Forward
Forward and
and
Reverse
Reverse Channels
Channels
October, 2007
Course 120+: 27
The Channels of 2G IS-95 CDMA
BTS
Sector has a Short PN Offset
FORWARD CHANNELS
REVERSE CHANNELS
Walsh 0:
PILOT
Walsh 32:
SYNC
Walsh 1:
PAGING
Walsh n:
TRAFFIC
ACCESS
A Long PN Offset
TRAFFIC
A Long PN Offset
Q Existing IS-95A/JStd-008 CDMA offers one radio configuration

using just the channels shown above
Q IS-2000 CDMA is backward-compatible with this IS-95, but offers
additional radio configurations with additional channels
These additional modes are called Radio Configurations
IS-95 Rate Set 1 and 2 are IS-2000 Radio Configurations 1 & 2
October, 2007
Course 120+: 28
The Code Channels of 1xRTT Rev. 0

REVERSE CHANNELS
FORWARD CHANNELS
F-Pilot
Same coding as IS-95B,

Backward compatible
Includes Power
Control Subchannel
F-Sync

Backward compatible
1 to 7
PAGING

Backward compatible
Access Channel
(IS-95B compatible)
Enhanced
Access Channel
0 to 8
F-BCH
0 to 3
F-QPCH
Quick Paging Channel
F-CPCCH
Common
Power Control Channel
How many 1
Possible:
1
0 to 4
BTS
0 to 7
0 to 7
Users:
0 to many
1
Broadcast Channel
F-CACH
Common
Assignment Channel
F-CCCH
Common
Control Channels
F-TRAFFIC
F-FCH
Forward
Traffic Channels
Fundamental Channel
Dedicated
Control Channel
0 or 1
F-DCCH
0 to 7
F-SCH IS-95B only Channels IS-95B only
0 to 2
F-SCH
Supplemental
Supplemental
Channels RC3,4,5
Common
Control Channel
R-Pilot 1
R-ACH or
R-EACH
R-CCCH 0 or 1
R-TRAFFIC
Reverse Fundamental
Channel (IS95B comp.)
Dedicated
Control Channel
Reverse
Supplemental Channel
R-FCH 1
R-DCCH 0 or 1
R-SCH 0 to 2
Q CDMA2000 1xRTT has a rich

variety of traffic channels for
voice and fast data
Q There are also optional
additional control channels
for more effective operation
See Course 332 for more details.
October, 2007
Course 120+: 29
Spreading Rates & Radio Configurations

Spreading
Rate
SR1
1xRTT
1 carrier
1.2288
MCPS
SR3
3xRTT
Fwd:
3 carriers
1.2288
MCPS
Rev:
3.6864
MCPS
Forward Link
Radio
Configuration
Data
Rates
Data
Rates
Radio
Configuration
Reverse Link
Required. IS-95B Compatible

No CDMA2000 coding features
RC1
9600
9600
RC1
Required. IS-95B Compatible

Compatible with IS-95B RS2

RC2
14400
14400
RC2
Compatible with IS-95B RS2

Quarter-rate convolutional or
Turbo Coding, base rate 9600
RC3
RC3
Quarter rate convolutional or

Turbo coding; Half rate
convolutional or Turbo coding;
base rate 9600
RC4
Quarter rate convolutional or

RC5
Required. or 1/3 convolutional

or Turbo coding, base rate 9600
RC6
or convolutional or Turbo
encoding, base rate 14400
Half-rate convolutional or
RC4
Quarter-rate convolutional or
RC5
1/6 rate convolutional

RC6
Required. 1/3 rate convolutional

RC7
or 1/3 rate convolutional or

Turbo coding, base rate 14400
RC8
or 1/3 rate convolutional or

Turbo encoder, base rate 14400
October, 2007
RC9
9600
153600
9600
9600
153600
307200
307200
14400
14400
230400
230400
9600
307200
9600
614400
14400
460800
14400
1036800
9600
307200
614400
14400
460800
1036800
Course 120+: 30
Walsh Codes in 1xRTT

2G VOICE AND DATA
One Symbol of Information
19,200 symbols/second
DATA
SYMBOLS
WALSH
CODE
1,228,800 walsh chips/second

64 chips of Walsh Code
Data Rates are different, but

Chip Rates must stay the same!
3G 153.6 kb/s DATA

One Symbol of Fast Data
307,200 symbols/second
DATA
SYMBOLS
WALSH
CODE
4 Chips of Walsh Code
October, 2007
1,228,800 walsh chips/second
Course 120+: 31
General Development of the Walsh Codes

WALSH
# 1-Chip
0 0
WALSH
# 2-Chips
0 00
1 01
WALSH
#
0
1
2
3
4-Chips
0000
0101
0011
0110
2x2 4x4
WALSH
#
0
1
2
3
4
5
6
7
8-Chips
00000000
01010101
00110011
01100110
00001111
01011010
00111100
01101001
8x8
WALSH
#
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
---- 16-Chips ------0000000000000000

0101010101010101
0011001100110011
0110011001100110
0000111100001111
0101101001011010
0011110000111100
0110100101101001
0000000011111111
0101010110101010
0011001111001100
0110011010011001
0000111111110000
0101101010100101
0011110011000011
0110100110010110
16x16
Walsh Code Names

W1232 = Walsh Code #12, 32 chips long.
Walsh Level Mapping

The Walsh Codes shown here are in logical
state values 0 and 1.
Walsh Codes also can exist as physical
bipolar signals. Logical zero is the signal
value +1 and Logical 1 is the signal value -1.
Mapping: Logical 0,1 > +1, -1 Physical
WALSH CODES
#
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
----------- 32-Chip Sequence ------------00000000000000000000000000000000

01010101010101010101010101010101
00110011001100110011001100110011
01100110011001100110011001100110
00001111000011110000111100001111
01011010010110100101101001011010
00111100001111000011110000111100
01101001011010010110100101101001
00000000111111110000000011111111
01010101101010100101010110101010
00110011110011000011001111001100
01100110100110010110011010011001
00001111111100000000111111110000
01011010101001010101101010100101
00111100110000110011110011000011
01101001100101100110100110010110
00000000000000001111111111111111
01010101010101011010101010101010
00110011001100111100110011001100
01100110011001101001100110011001
00001111000011111111000011110000
01011010010110101010010110100101
00111100001111001100001111000011
01101001011010011001011010010110
00000000111111111111111100000000
01010101101010101010101001010101
00110011110011001100110000110011
01100110100110011001100101100110
00001111111100001111000000001111
01011010101001011010010101011010
00111100110000111100001100111100
01101001100101101001011001101001
32x32
Q All Walsh codes can be built to any size from a

single zero by replicating and inverting
Q All Walsh matrixes are square -- same number
of codes and number of chips per code
October, 2007
WALSH CODES
#
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
---------------------------------- 64-Chip Sequence -----------------------------------------0000000000000000000000000000000000000000000000000000000000000000

0101010101010101010101010101010101010101010101010101010101010101
0011001100110011001100110011001100110011001100110011001100110011
0110011001100110011001100110011001100110011001100110011001100110
0000111100001111000011110000111100001111000011110000111100001111
0101101001011010010110100101101001011010010110100101101001011010
0011110000111100001111000011110000111100001111000011110000111100
0110100101101001011010010110100101101001011010010110100101101001
0000000011111111000000001111111100000000111111110000000011111111
0101010110101010010101011010101001010101101010100101010110101010
0011001111001100001100111100110000110011110011000011001111001100
0110011010011001011001101001100101100110100110010110011010011001
0000111111110000000011111111000000001111111100000000111111110000
0101101010100101010110101010010101011010101001010101101010100101
0011110011000011001111001100001100111100110000110011110011000011
0110100110010110011010011001011001101001100101100110100110010110
0000000000000000111111111111111100000000000000001111111111111111
0101010101010101101010101010101001010101010101011010101010101010
0011001100110011110011001100110000110011001100111100110011001100
0110011001100110100110011001100101100110011001101001100110011001
0000111100001111111100001111000000001111000011111111000011110000
0101101001011010101001011010010101011010010110101010010110100101
0011110000111100110000111100001100111100001111001100001111000011
0110100101101001100101101001011001101001011010011001011010010110
0000000011111111111111110000000000000000111111111111111100000000
0101010110101010101010100101010101010101101010101010101001010101
0011001111001100110011000011001100110011110011001100110000110011
0110011010011001100110010110011001100110100110011001100101100110
0000111111110000111100000000111100001111111100001111000000001111
0101101010100101101001010101101001011010101001011010010101011010
0011110011000011110000110011110000111100110000111100001100111100
0110100110010110100101100110100101101001100101101001011001101001
0000000000000000000000000000000011111111111111111111111111111111
0101010101010101010101010101010110101010101010101010101010101010
0011001100110011001100110011001111001100110011001100110011001100
0110011001100110011001100110011010011001100110011001100110011001
0000111100001111000011110000111111110000111100001111000011110000
0101101001011010010110100101101010100101101001011010010110100101
0011110000111100001111000011110011000011110000111100001111000011
0110100101101001011010010110100110010110100101101001011010010110
0000000011111111000000001111111111111111000000001111111100000000
0101010110101010010101011010101010101010010101011010101001010101
0011001111001100001100111100110011001100001100111100110000110011
0110011010011001011001101001100110011001011001101001100101100110
0000111111110000000011111111000011110000000011111111000000001111
0101101010100101010110101010010110100101010110101010010101011010
0011110011000011001111001100001111000011001111001100001100111100
0110100110010110011010011001011010010110011010011001011001101001
0000000000000000111111111111111111111111111111110000000000000000
0101010101010101101010101010101010101010101010100101010101010101
0011001100110011110011001100110011001100110011000011001100110011
0110011001100110100110011001100110011001100110010110011001100110
0000111100001111111100001111000011110000111100000000111100001111
0101101001011010101001011010010110100101101001010101101001011010
0011110000111100110000111100001111000011110000110011110000111100
0110100101101001100101101001011010010110100101100110100101101001
0000000011111111111111110000000011111111000000000000000011111111
0101010110101010101010100101010110101010010101010101010110101010
0011001111001100110011000011001111001100001100110011001111001100
0110011010011001100110010110011010011001011001100110011010011001
0000111111110000111100000000111111110000000011110000111111110000
0101101010100101101001010101101010100101010110100101101010100101
0011110011000011110000110011110011000011001111000011110011000011
0110100110010110100101100110100110010110011010010110100110010110
64x64
Course 120+: 32
Walsh Code Trees and Interdependencies

W316 0110 0110 0110 0110
8
W3
W332 0110 0110 0110 0110 0110 0110 0110 0110

W1932 0110 0110 0110 0110 1001 1001 1001 1001
0110 0110
16 0110
W11
W1132 0110 0110 1001 1001 0110 0110 1001 1001

0110 1001 1001
W2732 0110 0110 1001 1001 1001 1001 0110 0110
W34 0110
W716 0110 1001 0110 1001
8
W7
W732 0110 1001 0110 1001 0110 1001 0110 1001

W2332 0110 1001 0110 1001 1001 0110 1001 0110
0110 1001
16 0110
W15
W1532 0110 1001 1001 0110 0110 1001 1001 0110

1001 1001 0110
W3132 0110 1001 1001 0110 1001 0110 0110 1001
W364
W3564
W1964
W5164
W1164
W4364
W2764
W5964
W764
W3964
W2364
W5564
W1564
W4764
W3164
W6364
Q Entire Walsh matrices can be built by replicating and inverting -- Individual

Walsh codes can also be expanded in the same way.
Q CDMA adds each symbol of information to one complete Walsh code
Q Faster symbol rates therefore require shorter Walsh codes
Q If a short Walsh code is chosen to carry a fast data channel, that walsh
code and all its replicative descendants are compromised and cannot be
reused to carry other signals
Q Therefore, the supply of available Walsh codes on a sector diminishes
greatly while a fast data channel is being transmitted!
Q CDMA2000 Base stations can dip into a supply of quasi-orthogonal codes
if needed to permit additional channels during times of heavy loading
October, 2007
Course 120+: 33
Forward Link Walsh Codes in 1xRTT
This way of arranging Walsh codes is called bit reversal order. It shows each
Walsh codes parents and children. Remember, we cannot use any Walsh code if
another Walsh code directly above it or below it is in use.
4 chips
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
8 chips
16 chips
76.8
ksps
76,800
sps
76.8
ksps
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
31 Code#
38.4k
38,400
sps
15
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
32 chips
63
31
47
15
55
23
39
7
59
27
43
11
51
19
35
3
61
29
45
13
53
21
37
5
57
25
41
9
49
17
33
1
62
30
46
14
54
22
38
6
58
26
42
10
50
18
34
2
60
28
44
12
52
20
36
4
56
24
40
8
48
16
32
0
Sync
Pilot
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
Paging 7
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
Paging 3
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
Paging 5
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
Paging
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
PCH 6
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
PCH 2
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
PCH 4
19.2k
19.2k
19.2k
19.2k
19,200
sps
64 chips
127
63
95
31
111
47
79
15
119
55
87
23
103
39
71
7
123
59
91
27
107
43
75
11
115
51
83
19
99
35
67
3
125
61
93
29
109
45
77
13
117
53
85
21
101
37
69
5
121
57
89
25
105
41
73
9
113
49
81
18
97
33
65
1
126
62
94
30
110
46
78
14
118
54
86
22
102
38
70
6
122
58
90
26
106
42
74
10
114
50
82
18
98
34
66
2
124
60
92
28
108
44
76
12
116
52
84
20
100
36
68
4
120
56
88
24
104
40
72
8
112
48
80
16
96
32
64
0
QPCH
QPCH
QPCH
TX Div PIlot
9,600
4,800
2,400
sps
128 chips
Course 120+: 34
October, 2007
76.8
ksps
76.8
ksps
Code#
Code#
76.8
ksps
76.8
ksps
Code#
Code#
76.8
ksps
76.8
ksps
23
30
Code#
76.8
ksps
7
14
15
76.8
ksps
27
22
7
14
11
6
11
6
19
26
3
10
3
10
13
2
29
18
5
12
13
2
9
4
21
28
153,600
sps
8
5
12
F-SCH
153.6 ksps
0
25
20
F-SCH
153.6 ksps
F-SCH
153.6 ksps
9
4
F-SCH
153.6 ksps
F-SCH
153.6 ksps
Code#
F-SCH
153.6 ksps
17
24
7
6
1
8
3
2
Code#
16
Code# 0
5
1
4
0
Code#
307200
sps
F-SCH
307.2 ksps
F-SCH
307.2 ksps
Code#
3
1
2
0
Code#
A Possible 1xRTT RC3 BTS Dynamic State:
1 F-SCH, 39 IS-95/1xRTT RC3 Voice Users, 4 Active+12 Dormant Data Users

But it takes seconds to move various data users from Dormant to Active!
Data users will get 153 kb/s peak, ~9 kb/s average, but latency will be high.
4 chips
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
16 chips
76.8
ksps
8 chips
76.8
ksps
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
F-FCHs
Data
RC3 Voice
38.4k
38.4k
38.4k
RC3 Voice
38.4k
38.4k
38.4k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
Paging
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
RC3 Voice
64 chips
Sync
Pilot
F-FCHs 9.6k
31 Code#
38.4k
63
31
47
15
55
23
39
7
59
27
43
11
51
19
35
3
61
29
45
13
53
21
37
5
57
25
41
9
49
17
33
1
62
30
46
14
54
22
38
6
58
26
42
10
50
18
34
2
60
28
44
12
52
20
36
4
56
24
40
8
48
16
32
0
F-FCHs 9.6k
38,400
sps
15
32 chips
19,200
sps
F-FCHs 9.6k
76,800
sps
76.8
ksps
127
63
95
31
111
47
79
15
119
55
87
23
103
39
71
7
123
59
91
27
107
43
75
11
115
51
83
19
99
35
67
3
125
61
93
29
109
45
77
13
117
53
85
21
101
37
69
5
121
57
89
25
105
41
73
9
113
49
81
18
97
33
65
1
126
62
94
30
110
46
78
14
118
54
86
22
102
38
70
6
122
58
90
26
106
42
74
10
114
50
82
18
98
34
66
2
124
60
92
28
108
44
76
12
116
52
84
20
100
36
68
4
120
56
88
24
104
40
72
8
112
48
80
16
96
32
64
0
QPCH
QPCH
QPCH
TX Div PIlot
9,600
4,800
2,400
sps
128 chips
Course 120+: 35
October, 2007
76.8
ksps
76.8
ksps
Code#
Code#
F-SCH
307.2 ksps
Code#
Code#
76.8
ksps
76.8
ksps
23
30
Code#
76.8
ksps
7
14
15
76.8
ksps
27
22
7
14
11
6
11
6
19
26
3
10
3
10
13
2
29
18
5
12
13
2
9
4
21
28
153,600
sps
8
5
12
F-SCH
153.6 ksps
0
25
20
F-SCH
153.6 ksps
F-SCH
153.6 ksps
9
4
F-SCH
153.6 ksps
F-SCH
153.6 ksps
Code#
F-SCH
153.6 ksps
17
24
7
6
1
8
3
2
Code#
16
Code# 0
5
1
4
0
Code#
307200
sps
F-SCH 153K RC3

F-SCH
307.2 ksps
Code#
3
1
2
0
Code#
Mature 1xRTT Mixed-Mode Voice and Data:

1 RC3/RC4 Shared F-SCH, 20 RC3 Voice Users, 38 RC4 Voice Users,
4 Active+12 Control-Hold RC3 and RC4 Data Users
16 data users time-share 2 F-DCCH for Control Hold state. Data users will get
38.4, 76.4, 153.6 or 307.2 kb/s peak, ~9 or 19 kb/s average, good latency. Fwd power tight!
Code#
4 chips
0
16 chips
F-SCH
153.6 ksps
F-SCH
153.6 ksps
F-SCH
153.6 ksps
12
10
14
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
21
13
29
19
11
27
23
15
31 Code#
38.4k
38.4k
25
63
31
47
15
55
23
39
7
59
27
43
11
51
19
35
3
61
29
45
13
53
21
37
5
57
25
41
9
49
17
33
1
62
30
46
14
54
22
38
6
58
26
42
10
50
18
34
2
60
28
44
12
52
20
36
4
56
24
40
8
48
16
32
0
F-FCHs 9.6k
RC3 Voice
RC3 Voice
F-FCHs 9.6k
RC3 Voice
????
127
63
95
31
111
47
79
15
119
55
87
23
103
39
71
7
123
59
91
27
107
43
75
11
115
51
83
19
99
35
67
3
125
61
93
29
109
45
77
13
117
53
85
21
101
37
69
5
121
57
89
25
105
41
73
9
113
49
81
18
97
33
65
1
126
62
94
30
110
46
78
14
118
54
86
22
102
38
70
6
122
58
90
26
106
42
74
10
114
50
82
18
98
34
66
2
124
60
92
28
108
44
76
12
116
52
84
20
100
36
68
4
120
56
88
24
104
40
72
8
112
48
80
16
96
32
64
0
QPCH
QPCH
QPCH
TX Div PIlot
128 chips
F-FCHs
F-DCCHs
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
Paging
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
Sync
Pilot
64 chips
F-FCHs 9.6k
F-FCHs 9.6k
RC4 Voice
October, 2007
F-FCHs 9.6k
RC4 Voice
38,400
sps
Code#
19,200
sps
Code#
9,600
4,800
2,400
sps
F-FCHs 9.6k
RC4 Voice
76,800
sps
38.4k
38.4k
ns
io
38.4k
17
38.4k
38.4k
76.8
ksps
38.4k
30
76.8
ksps
t
na
14
76.8
ksps
38.4k
22
Code#
38.4k
15
38.4k
26
38.4k
10
11
38.4k
18
38.4k
13
38.4k
28
Code#
153,600
sps
38.4k
12
307200
sps
F-SCH
153.6 ksps
38.4k
20
F-SCH
153.6 ksps
38.4k
38.4k
24
38.4k
32 chips
38.4k
16
5
F-SCH
153.6 ksps
38.4k
Code# 0
bi
m
Co
Or
Code#
F-SCH 153K RC3

F-SCH
or
ksps RC4
F-SCH307.2
307K
8 chips
Code#
Code#
F-SCH
307.2 ksps
Code#
Code#
Course 120+: 36
Reverse Link Walsh Codes in 1xRTT

Code#
2 chips
If a Walsh Code is used, the other walsh

codes directly under it cannot be used.
R-SCH 1 (max speed)
Code#
4 chips
0
614400
sps
3
Code#
R-SCH 1 (1/2 speed)
8 chips
Code#
R-SCH 2 (max speed)
Code#
Code#
Code#
R-SCH 2
speed
0
16 chips
Pilot DCCH
FCH
& Pwr if
Ctrl used
12
10
14
153600
sps
1
13
11
15
Code#
76800
sps
available
Q A 1xRTT mobile may transmit several channels at the same time for
example, R-FCH and Pilot and R-SCH.
the mobile uses steady walsh codes as channels much like a BTS
Q All mobiles use the same Walsh codes for the same functions
Q notice the two possible speeds of R-SCH 1 and R-SCH 2
October, 2007
307200
sps
Course 120+: 37
Some
Some Other
Other Internal
Internal Processes
Processes
Vocoding,
Vocoding, Multiplexing,
Multiplexing, Power
Power Control
Control
October, 2007
Course 120+: 38
Variable Rate Vocoding & Multiplexing

DSP QCELP VOCODER
20ms Sample
Q Vocoders compress speech, reduce bit
Pitch
rate, greatly increasing capacity
Filter
Q CDMA uses a superior Variable Rate
Codebook
Vocoder
FeedCoded Result
back Formant
full rate during speech
Filter
low rates in speech pauses
increased capacity
bits
Frame Sizes
more natural sound
192/288
Full Rate Frame
Q Voice, signaling, and user secondary 96/144 1/2 Rate Frame
data may be mixed in CDMA frames
48/72 1/4 Rt.
24/36
1/8
Frame Contents: can be a mixture of

Primary
Signaling Secondary
Traffic
(System
(On-Air
(Voice or
data)
October, 2007
Messaging)
activation, etc)
Course 120+: 39
How Power Control Works
REVERSE LINK POWER ADJUSTMENT

BSC
Bad FER?
Raise Setpoint
BTS
Stronger than
setpoint?
Eb/No
Setpoint
Reverse Link
RX RF Digital
Open
Loop Closed
Loop
TX RF Digital
MOBILE
TXPO = -(RXdbm) -C
October, 2007
Course 120+: 40

BSC
Bad FER?
Raise Setpoint
BTS
Stronger than
setpoint?
Eb/No
Setpoint
Reverse Link
IS-95,
1xRTT
800 Power Control Bits per second!
ALL SAME METHOD
October, 2007
RX RF Digital
Open
Loop Closed
Loop
TX RF Digital
MOBILE
TXPO = -(RXdbm) -C + TXGA
Course 120+: 41

BSC
Bad FER?
Raise Setpoint
BTS
Stronger than
setpoint?
Eb/No
Setpoint
RX RF Digital
Open
Loop Closed
Loop
TX RF Digital
Reverse Link
IS-95,
1xRTT
ALL SAME METHOD
FORWARD LINK POWER ADJUSTMENT

BSC
Voc- Selecoder
tor
October, 2007
Pilot
Sync
Paging
User 1
User 2
User 3
BTS (1 sector)
DGU
Transmitter,
Sector X
I Q
Short PN
MOBILE
MOBILE
Forward Link
Course 120+: 42

BSC
Bad FER?
Raise Setpoint
BTS
Stronger than
setpoint?
Eb/No
Setpoint
RX RF Digital
Open
Loop Closed
Loop
TX RF Digital
Reverse Link
IS-95,
1xRTT
ALL SAME METHOD

BSC
Voc- Selecoder
tor
Pilot
Sync
Paging
User 1
User 2
User 3
BTS (1 sector)
DGU
Transmitter,
Sector X
I Q
Short PN
MOBILE
MOBILE
Forward Link
Bad Frame
PMRM POWER MEAS. REPORT MSG 2 bad in last 4, Help!! Counter
IS-95 RS1
Method
S L O W ~ 1 sec. typical
October, 2007
Course 120+: 43

BSC
Bad FER?
Raise Setpoint
BTS
Stronger than
setpoint?
Eb/No
Setpoint
RX RF Digital
Open
Loop Closed
Loop
TX RF Digital
Reverse Link
IS-95,
1xRTT
ALL SAME METHOD

BSC
Voc- Selecoder
tor
Pilot
Sync
Paging
User 1
User 2
User 3
MOBILE
BTS (1 sector)
DGU
Transmitter,
Sector X
I Q
Short PN
MOBILE
Forward Link
FASTER ~ 100 ms reaction

FEI Bits Mark Bad Frames Received
October, 2007
FEI Bits
IS-95 RS2
Method
Course 120+: 44

BSC
Bad FER?
Raise Setpoint
BTS
Stronger than
setpoint?
Eb/No
Setpoint
RX RF Digital
Open
Loop Closed
Loop
TX RF Digital
Reverse Link
IS-95,
1xRTT
ALL SAME METHOD

BSC
Voc- Selecoder
tor
Pilot
Sync
Paging
User 1
User 2
User 3
MOBILE
BTS (1 sector)
DGU
Transmitter,
Sector X
I Q
Short PN
MOBILE
Forward Link
FASTEST ~ 4 ms reaction
POWER CONTROL BITSTREAM RIDING ON MOBILE PILOT
October, 2007
Eb/No
Setpoint
1xRTT
Method
Course 120+: 45

BSC
Bad FER?
Raise Setpoint
BTS
Stronger than
setpoint?
Eb/No
Setpoint
RX RF Digital
Open
Loop Closed
Loop
TX RF Digital
Reverse Link
IS-95,
1xRTT
ALL SAME METHOD

BSC
Voc- Selecoder
tor
Pilot
Sync
Paging
User 1
User 2
User 3
MOBILE
BTS (1 sector)
DGU
Transmitter,
Sector X
I Q
Short PN
Forward Link
Bad Frame
PMRM POWER MEAS. REPORT MSG 2 bad in last 4, Help!! Counter
October, 2007
MOBILE
FEI Bits Mark Bad Frames Received
FEI Bits
POWER CONTROL BITSTREAM RIDING ON MOBILE PILOT
Eb/No
Setpoint
IS-95 RS1
Method
IS-95 RS2
Method
1xRTT
Method
Course 120+: 46
Details of Reverse Link Power Control

Q TXPO Handset Transmit Power
Actual RF power output of the
handset transmitter, including
combined effects of open
loop power control from
receiver AGC and closed
loop power control by BTS
cant exceed handsets
maximum (typ. +23 dBm)
Subscriber Handset
BTS
LNA
DUP
TXPO
Rake
R
IF
LO
Viterbi
Decoder
Open Loop
Closed Loop Pwr Ctrl

IF
Long PN
x
IF Mod
x
x
Q
Orth
Mod
Vocoder
FEC
<<Transmitter
Typical TXPO:
+23 dBm in a coverage hole
0 dBm near middle of cell
-50 dBm up close to BTS
C = +73 for 800 MHz. systems

= +76 for 1900 MHz. systems
October, 2007
PA
LO
x
Q TXGA Transmit Gain Adjust

Sum of all closed-loop
power control commands
from the BTS since the
beginning of this call
Receiver>>
0 dB
Typical Transmit Gain Adjust
-10 dB
-20 dB
Time, Seconds
Course 120+: 47
CDMA
CDMA Network
Network Architecture
Architecture
October, 2007
Course 120+: 48
Structure of a Typical CDMA System

HLR Home Location Register
(subscriber database)
CUSTOMER
SERVICE
BASE STATIONS
Voice Mail System
PSTN
Local Carriers
Long Distance
Carriers
October, 2007
BASE STATION
CONTROLLER
SWITCH
Mobile Telephone
Switching Office
ATM Link
to other CDMA
Networks
(Future)
Course 120+: 49
Voice Call Path through the CDMA Network

MTX
GPS
BSC-BSM
BTS
GPS
GPSR
SLM
CM
GPSR
BSM
TFU1
DMS-BUS
LPP
DISCO 1
CDSU
Packets
CDSU
DISCO 2
DS0 in T1
DTCs
Vocoders
Selectors
Ch. Card
TFU
ACC
CDSU
CDSU
CDSU
SBS
IOC
CDSU DISCO
CDSU
CDSU
LPP ENET
CDSU
Vocoder,
Selector
Txcvr
A
Txcvr
B
Txcvr
C
RFFE
A
RFFE
B
RFFE
C
Chips
Channel
Element
RF
PSTN
October, 2007
Course 120+: 50
1x Data Call Path through the CDMA Network

MTX
GPS
BSC-BSM
BTS
GPS
GPSR
SLM
CM
GPSR
BSM
TFU1
DMS-BUS
LPP
DISCO 1
CDSU
Packets
CDSU
DISCO 2
DTCs
CDSU
Vocoders
Selectors
R-P
October, 2007
Txcvr
A
Txcvr
B
Txcvr
C
RFFE
A
RFFE
B
RFFE
C
Chips
Channel
Elements
RF
(FCH, SCH)
PSTN Interface
Internet
VPNs
TFU
ACC
Selector
SBS
Ch. Card
CDSU
CDSU
IOC
CDSU DISCO
CDSU
CDSU
LPP ENET
CDSU
PDSN
Course 120+: 51
The
The Data
Data Side
Side of
of 3G
3G Networks
Networks
October, 2007
Course 120+: 52
Original 2nd Generation CDMA Voice Networks
rf
(C)BSC or
Access Manager
Switch
PSTN
t1
t1
CIRCUIT-SWITCHED VOICE TRAFFIC
14400 bps max
BTS
SEL
t1
CE
POINT-TO-POINT PACKETS
Handset
Q 2nd Generation CDMA Networks were designed primarily to handle voice

Q The CDMA voice conversations 20-ms frames are carried as packets
between mobile and the Selector
The selector assembles frames being sent to the mobile and
disassembles frames coming from the mobile
Frame contents normally include voice and occasional signaling; may
also include data if additional equipment is included (not shown)
Q The vocoders in the BSC and the mobile convert the packet stream into
continuous DS-0 audio for the end-users
The MSC makes a circuit-switched connection for call
October, 2007
Course 120+: 53
Simple IP Network
Simple IP
IP Based
transport to
data networks
Dynamic/static
connection
from local
PDSN
No mobility
beyond serving
PDSN
FAST IP PACKET TRAFFIC

Internet
VPNs
T
AAA
Authentication
Authorization
Accounting
PDSN
(C)BSC/Access Manager
Switch
PSTN
t1
t1
CIRCUIT-SWITCHED VOICE TRAFFIC
rf
R-P Interface
SEL
t1
Fast!
BTS
CE
POINT-TO-POINT PACKETS
Wireless
Mobile Device
Q In a Simple IP network, the mobile is able to connect to the external

packet networks directly through the PDSN attached to the local BSC
Q The IP address for the internet connection is assigned by the local
PDSN from the pool of addresses available to it
Q If the mobile moves into a different network, the data session ends
The mobile can establish an entirely new connection through the
new network, if desired
October, 2007
Course 120+: 54
Mobile IP Network
Private IP
Networks
Internet
Regional
Data
Center
Home
Agent
Home
Agent
AAA
Server
Operator's Private Network

Nortel System
Lucent System
IP Data
PDSN
FA
IP Data
Switch
Voice
PSTN
October, 2007
IP Data
PCF
PDSN
FA
RP Interface
BSC
Motorola System
RP
PDSN/FA
RP
CBSC
Access
Mgr.
Switch
Voice
PSTN
Switch
Voice
PSTN
Course 120+: 55
Mobile IP and Secure Tunneling: Mail Analogy
Just like
Home!
Foreign
Agent
Mobile IP is a packetforwarding
arrangement that
allows the mobile user
to send and receive
packets just as if they
were physically present
at their home agent
location.
Home
Agent
Secure Tunneling
Forward and Reverse
Mobile
User
October, 2007
FedEx
FedEx
Encapsulation
158766
158774
158782
158790
158767
158775
158783
158791
158768
158776
158784
158792
158785
158793
158769
158770
158778
158786
158794
158771
158779
158787
158795
158772
158780
158788
158796
158773
158781
158789
158797
This box is the

mobile user's
Postal address
Course 120+: 56
Chapter 2
Call
Call Processing
Processing
and
and Layer
Layer 33 Messages
Messages
October, 2007
Course 120+: 57
Messages in CDMA
Q In CDMA, most call processing events are driven by messages
Q Some CDMA channels exist for the sole purpose of carrying
messages; they never carry users voice traffic
Sync Channel (a forward channel)
Paging Channel (a forward channel)
Access Channel (a reverse channel)
Forward or Reverse Dedicated Control Channels
On these channels, there are only messages, not voice or data
Q Some CDMA channels exist just to carry user traffic
Forward Fundamental and Supplemental Channels
Reverse Fundamental and Supplemental Channels
On these channels, most of the time is filled with traffic and
messages are sent only when there is something to do
Q All CDMA messages have very similar structure, regardless of the
channel on which they are sent
October, 2007
Course 120+: 58
Taking Apart a CDMA Layer-3 Message

Q CDMA messages on both forward
and reverse traffic channels are
normally sent via dim-and-burst
Q Messages include many fields of
binary data
Q The first byte of each message
identifies message type: this allows
the recipient to parse the contents
Q To ensure no messages are
missed, all CDMA messages bear
serial numbers and important
messages contain a bit requesting
acknowledgment
Q Messages not promptly
acknowledged are retransmitted
several times. If not acknowledged,
the sender may release the call
Q Field data processing tools capture
and display the messages for study
EXAMPLE:
A POWER MEASUREMENT
REPORT MESSAGE
Length
(in bits)
Field
MSG_TYPE (00000110)
ACK_SEQ
MSG_SEQ
ACK_REQ
ENCRYPTION
ERRORS_DETECTED
POWER_MEAS_FRAMES
10
LAST_HDM_SEQ
NUM_PILOTS
NUM_PILOTS occurrences of this field:

PILOT_STRENGTH
RESERVED (0s)
October, 2007
6
0-7
Course 120+: 59
Message Vocabulary: Acquisition & Idle States

Pilot Channel
Sync Channel
No Messages
Sync Channel Msg
Paging Channel
Access Parameters Msg
General Page Msg
System Parameters Msg
Order Msg
BTS
Access Channel
Registration Msg
Order Msg
Mobile Station Acknowldgment
Long Code Transition Request
SSD Update Confirmation
many others..
CDMA Channel List Msg
Base Station Acknowledgment

Lock until Power-Cycled
Maintenance required
many others..
Extended System
Parameters Msg
Channel Assignment
Msg
Origination Msg
Extended Neighbor
List Msg
Feature Notification Msg
Page Response Msg
Global Service
Redirection Msg
Authentication
Challenge Msg
Authentication Challenge
Response Msg
Service Redirection Msg
Status Request Msg
Status Response Msg
SSD Update Msg
TMSI Assignment Msg
TMSI Assignment
Completion Message
Null Msg
Data Burst Msg
Data Burst Msg
October, 2007
Course 120+: 60
Message Vocabulary: Conversation State

Forward Traffic Channel
Order Msg
Base Station Acknowledgment
Base Station Challenge
Confirmation
Message Encryption Mode
Alert With
Information Msg
Reverse Traffic Channel
Service Request Msg
Service Request Msg
Origination
Continuation Msg
Authentication
Challenge Msg
Service Response Msg
Service Response Msg
Authentication Challenge
Response Msg
TMSI Assignment Msg
Service Connect Msg
Service Connect
Completion Message
TMSI Assignment
Completion Message
Send Burst DTMF Msg
Service Option
Control Msg
Service Option Control

Message
Send Burst DTMF Msg
Set Parameters Msg
Status Request Msg
Status Response Msg
Parameters Response
Message
Power Control
Parameters Msg.
Flash With
Information Msg
Flash With
Information Msg
Power Measurement
Report Msg
Retrieve Parameters Msg
Data Burst Msg
Data Burst Message
Order Message
Analog Handoff
Direction Msg
Extended Handoff
Direction Msg
Pilot Strength
Measurement Msg
SSD Update Msg
Neighbor List
Update Msg
Handoff Completion Msg
Mobile Station
Registered Msg
In-Traffic System
Parameters Msg
October, 2007
Mobile Sta. Acknowledgment

Long Code Transition
Request
SSD Update Confirmation
Connect
Course 120+: 61
Traffic Correlator
PN xxx Walsh xx
AGC
Duplexer
RF
Open Loop
RF
Transmitter
RF Section
October, 2007
Traffic Correlator
PN xxx Walsh xx
bits
Symbols
time-aligned
Receiver
RF Section
IF, Detector
control
Traffic Correlator
PN xxx Walsh xx
power
Chips
Digital
Rake Receiver
Symbols
Traffic Correlator
PN xxx Walsh xx
summing
Whats In a Handset? How does it work?
Viterbi Decoder,
Convl. Decoder,
Demultiplexer
Packets
Audio
Messages
Pilot Searcher
PN xxx Walsh 0
CPU
Vocoder
Transmit Gain Adjust

Transmitter
Digital Section
Audio
Messages
Long Code Gen.

Course 120+: 62
Let's
Let's Acquire
Acquire The
The System!
System!
October, 2007
Course 120+: 63
1. Find the Strongest Pilot!

PN 168
BTS
W0
PILOT
TIME
#2 unassigned
#3 unassigned
#4 unassigned
Pilot Searcher
SCAN
Find Strongest
Rake Receiver
#1 unassigned
Ec/Io
Q The pilot searcher of the phone spends about 3.4 seconds measuring the
pilot strength at every possible PN delay, in miniscule 1/8 chip delay steps,
to see how much energy is being received from every nearby sector
Q The sector with the strongest pilot is chosen
0
Pilot Searcher Scans the Entire Range of PNs
-20
Chips 0
PN 0
October, 2007
32K
512
Course 120+: 64
2. Read the Sync Channel Message

PN 168
BTS
The Sync Channel is a

Sesame Street for mobiles!
W32
SYNC
W0
PILOT
SYN SYN SYN SYN SYN SYN SYN SYN SYN SYN SYN SYN SYN SYN SYN SYNSYN
Rake Receiver
#1 PN168+0 W32
#3 PN168+9 W32
#4 PN168+5 W32
Pilot Searcher
Stay Locked!
#2 PN168+2 W32
Read Sync Ch. Msg
TIME
SYNC CHANNEL MESSAGE
Q Great! We found a signal. Now we know:

The strongest pilot available
The exact timing of this pilot
Q We do NOT yet know
This pilots PN offset
20 msec frame timing of channels
Long Code State
Q The SYNC channel is a special channel timed
exactly in step with the short PN sequence
It tells us all these unknown quantities
October, 2007
MSG_LENGTH, 28, 28 octets

MSG_TYPE, 1, Sync Channel Message
P_REV, 6, IS-2000 Revision 0
MIN_P_REV, 1, J-STD-008
SID 995,
NID 3,
PILOT_PN 240
LC_STATE, 0x00 25 93 12 7C FA,
SYS_TIME, 0x02 20 34 B7 53,
10/23/2001 11:02:54
LP_SEC, 13,
LTM_OFF, 54, -660 minutes
DAYLT, 1, Yes
PRAT, 1, 4800 bps
CDMA_FREQ, 274 (IS-95)
EXT_CDMA_FREQ, 274 (1xRTT)
SR1_BCCH_SUPPORTED, 0
SR3_INCL, 0, No
RESERVED, 0,
Course 120+: 65
4. Is This the Right System to Use?

Scan the PRL for Anything Better
SYSTEM TABLE
October, 2007
ACQUISITION TABLE
NEG/
NID PREF
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
GEO
NEW
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
NEW
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
a GEO GROUP
Q Its not enough just to find a

CDMA signal
We want the CDMA
signal of our own system
or a favorite roaming
partner
Q Phones look in the PRL to
see if there is a more
preferred signal than
whatever they find first
They check frequencies
in the Acquisition Table
until they find the best
system, or look down the
list level by level
SID
4144
4812
205
208
208
342
342
478
1038
1050
1058
1375
1385
143
143
4103
4157
312
444
444
1008
1012
1014
1688
113
113
179
179
465
2119
2094
1005
1013
a GEO GROUP
Roaming List Type:

IS-683A
Preferred Only:
FALSE
Default Roaming Indicator:
0
Preferred List ID:
10018
INDEX
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
Climb!
ROAMING LIST
ACQ ROAM
PRI INDEX IND
SAME 13
1
MORE 21
1
SAME
4
0
MORE 37
0
SAME
4
0
MORE 37
0
SAME
4
0
SAME
4
0
SAME
4
0
SAME
4
0
SAME
4
0
SAME
4
0
MORE
4
0
MORE 37
0
MORE
4
0
SAME
3
1
MORE
2
1
SAME
4
0
MORE 37
0
SAME
4
0
SAME
4
0
SAME
4
0
SAME
4
0
MORE
4
0
MORE 37
0
SAME
4
0
MORE 37
0
SAME
4
0
SAME
4
0
MORE
4
0
MORE
4
0
SAME
4
0
SAME
4
0
INDEX ACQ TYPE

0
6
1
6
2
6
3
6
4
1
5
6
6
6
7
6
8
6
9
6
10
6
11
6
12
6
13
6
14
6
15
6
16
6
17
6
18
6
19
6
20
6
21
6
22
6
23
6
24
6
25
6
26
6
27
1
28
1
29
5
30
5
31
5
32
5
33
5
34
5
35
4
36
4
37
4
38
6
39
6
40
6
41
6
42
6
43
6
44
6
45
6
46
6
CH1
500
575
50
25
Both
450
675
250
550
75
200
425
500
500
650
25
425
200
825
350
750
325
1150
350
25
50
500
A
B
A
B
C
D
E
F
A
B
Both
350
25
675
850
650
450
325
150
1025
CH2
425
625
100
200
CH3
825
500
75
350
CH4
575
425
475
375
CH5 CH6 CH7 CH8 CH9

850 325 625
500
500
50
375
50
250
500
575
625
500
50
550
50
850
325
725
725
1175
875
1175
200
1075
350
600
175
425
175
175
575
475
350
675
375
225
175
925
375
775
350
575
575
650
475
625
250
50
25
25
50
25
350
725
375
325
675
375
75
250
750
250
325
825
25
850
375 1175
200 75 175 250
100 250 75
825
825
100
600
750
850 1175 775
825
725
850 175 250

50 475 175 250
650
775 575 725 425
425 50 575
175
775
675
25
1175 725 600 100
750
375
775 425 575 625
475
350 375 1025 1050 1075
475 625 675
1050 1075
PRL: Preferred Roaming List

Programmed into each phone by the system
operator; can be updated over the air.
Course 120+: 66
3. The Timing Shift: Adjust all Internal Clocks

PN 168
End of SCH
SuperFrame
BTS
W32
SYNC
W0
PILOT
Ref Time
TIME
+320 ms
Rake Receiver
#1 unassigned
#3 unassigned
Pilot Searcher
-PN
168
The
Timing
Change
#4 unassigned
Stay Locked!
#2 unassigned
Q This timeline shows each step as the mobile acquires the system
Q First search all PNs to find the strongest pilot
Q Read the Sync Channel Message to learn times and LC state
The times and state refer to a future moment 320 ms after the end of the
Sync Channel superframe, minus the BTS PN offset. This waiting period
is called the Timing Change.
October, 2007
Course 120+: 67
5. Collect the Configuration Messages!

Collect all the Configuration Messages
(all config.messages are repeated every 1.28 sec)
PN 168
ACK SYS ChASN CHN XSYS NBR ChASN GSRM APM ACK GPAG ACK
W1 PAGING
BTS
W32
SYNC
W0
PILOT
Ref Time
TIME
Access
Parameters
Message
Global Service
** Redirection
Message
Neighbor
** List
Message
Pilot Searcher
Extended
System
Parameters
Message
#4 PN168+5 W1
** CDMA
Channel
List Message
#3 PN168+9 W1
Stay Locked!
#2 PN168+2 W1
System
Parameters
Message
Rake Receiver
#1 PN168+0 W1

Absorb and store all their parameters.
Q The Configuration Messages tell the mobile everything it needs to know to

successfully operate on the system
Access Parameters Message (how to behave on the access channel)
System Parameters Message (registration, handoff, window settings)
Extended System Parameters Message (how to identify; packet details)
Channel List Message (list of all carrier frequencies on this sector)
Neighbor List Message (list of nearby sectors to watch out for)
Global Service Redirection Message (dont stay here - go over there)
October, 2007
Course 120+: 68
6. Welcome! Just Monitor the Paging Channel

PN 168
W1 PAGING
BTS
W32
SYNC
W0
PILOT
Ref Time
TIME
Now monitor the
Paging Channel
for any
incoming calls
or messages
Rake Receiver
#1 PN168+0 W1
#2 PN168+2 W1
#3 PN168+9 W1
#4 PN168+5 W1
Pilot Searcher
Q Listen to see if you get any incoming calls or short messages!
October, 2007
Course 120+: 69
Review: All The Steps Thus Far

(all config.messages are repeated every 1.28 sec)
End of SCH
SuperFrame
PN 168
W1 PAGING
BTS
W32
SYNC
W0
PILOT
Ref Time
TIME
+320 ms
Access
Parameters
Message
Global Service
** Redirection
Message
Neighbor
** List
Message
Extended
System
Parameters
Message
Pilot Searcher
The
Timing
Change
#4 PN168+5 W1
-PN
168
** CDMA
Channel
List Message
#3 PN168+9 W1
Stay Locked!
#2 PN168+2 W1
System
Parameters
Message
Rake Receiver
#1 PN168+0 W1
Now monitor the

Paging Channel
for any
incoming calls
or messages

Absorb and store all their parameters.
Q This timeline shows each step as the mobile acquires the system
Q First search all PNs to find the strongest pilot
Q Read the Sync Channel Message to learn times and LC state
The times and state refer to a future moment 320 ms after the end of the
Sync Channel superframe, minus the BTS PN offset. This waiting period
is called the Timing Change.
Q Listen to the paging channel and collect all the configuration messages
Q Now the mobile can begin normal page monitoring operation
October, 2007
Course 120+: 70
Registration: Mobile, Sign In Please
BTS
W1
PAGING KSAKX KPCKGKSAKXPNKPPCKGKSAKXPNKPPCKGKSAKXPNKPPCKGSAKXPNGKSAKXPNKGKSAKXPG

NSA
W32
SYNC SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
W0
PILOT
TIME
ACCESS CHANNEL
R
20 sec.
20 seconds after system acquisition, the mobile
sends a Registration Message on the access
channel.
The BTS sends an ACK

on the Paging Channel.
The mobile is now
Registered and can begin
slotted mode paging.
Q After acquiring the system, the mobile must register

This allows the current system to update the HLR with the mobiles
location, so incoming calls can be delivered here
It also allows the mobile to tell the system if it wants to do slotted
mode paging, and if so, what Slot Cycle Index.
Q A holdoff timer delays initial registration 20 seconds after acquisition
This avoids needless registration by mobiles just being turned on to
check who is the owner, or other short power-on/off uses
Q Registration has many different controlling parameters, all declared by the
system on the paging channel in the System Parameters Message
October, 2007
Course 120+: 71
Stretch Your Battery! IS-95 Slotted Mode Paging
BTS
W1
Mobile listens during its slot, every cycle

NSA
PAGING KGKSAKKGCKGKSAKXPNKPPCKGKSAKXPNKPPCKGKSGKXPNKPPCKGSAKXPNGKSAKXPNKGKSAKXPG
W32
W0
PILOT
TIME
Rake Receiver
#1 PN168+0 W1
P
E
E
L
S
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 1 2 3 4 5
#3 PN168+9 W1
#4 PN168+5 W1
1 Slot Cycle
1 Slot Cycle
#2 PN168+2 W1
Battery
Drain
1 Slot
80 ms
Pilot Searcher
Q Slotted Mode Paging is a battery-saving trick

After registering with the system, the mobile
goes into sleep mode with low battery drain
It wakes on a schedule to listen for pages
Q Page slots are 80 ms. Long
Q Slot cycles can be set to many lengths
Q Longer cycles give better battery life, but introduce
longer possible delays in call delivery
Q Each mobile uses Hashing with its IMSI and SCI
to determine which slot it should always monitor
October, 2007
Each mobile has a preferred SCI

programmed by the vendor. The system
also declares a maximum slot cycle
index, which mobiles may not exceed.
Slot Cycle
Index (SCI)
Number Slots
in Cycle
Length of
Cycle, sec.
16
1.28 sec.
32
2.56 sec.
64
5.12 sec.
128
10.24 sec.
256
20.48 sec.
512
40.96 sec.
1024
81.92 sec.
2048
163.84 sec.
Course 120+: 72
Even Better: CDMA2000 Slotted Mode Paging

Using the Quick Paging Channel (QPCH)
W1
BTS
Mobile listens to PCH only when QPCH requires

NSA
PAGING KGKSAKKGCKGKSAKXPNKPPCKGKSAKXPNKPPCKGKSGKXPNKPPCKGSAKXPNGKSAKXPNKGKSAKXPG
W48
QPCH
W32
W0
PILOT
TIME
Rake Receiver
#1 PN168+0 W1
er
p
e W1P
#3 PN168+9
De E
#2 PN168+2 W1
E
L
S
#4 PN168+5 W1
Paging Channel Slots

Paging Channel Slots
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 1 2 3 4 5
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 1 2 3 4 5 6
Battery
Drain
QPCH Slots
QPCH Slots
Pilot Searcher
Q IS-95 mobiles must monitor their PCH

slots during every slot cycle
Must wake up 1000s of times per
hour and run high-drain message
parsers, even if they are not paged
Q The Quick Paging Channel (QPCH) is a
simpler bitstream which notifies a 1xRTT
mobile to monitor the PCH, only when a
page is coming for its IMSI group
There are at least xx IMSI groups. A
mobile knows its group by hashing.
October, 2007
Mobile hashes using its IMSI to

recognize which indicator bits it should
monitor. If the bits are on, the mobile
wakes up and listen to the next PCH
slot somebody watching those bits
will be paged.
PCH SLOT
GenPG
QPCH SLOT
20
ms
80 ms
80 ms
100 ms
Course 120+: 73
Idle Mode Handoff

Q An idle mobile always uses the best available signal
In idle mode, it isnt possible to do soft handoff and listen to multiple
sectors or base stations at the same time -- the paging channel
information stream is different on each sector, not synchronous -- just
like ABC, NBC, CBS, and CNN TV news programs arent in word-sync
for simultaneous viewing
Since a mobile cant combine signals, the mobile must switch quickly,
always enjoying the best available signal
Q The mobiles pilot searcher is constantly checking neighbor pilots
Q A Mobile might change pilots for either of two reasons:
It notices another pilot at least 3 db stronger than the current active
pilot, and it stays this good continuously for at least five seconds:
mobile switches at end of the next superframe
Mobile loses the current paging channel. If another signal is better
than the old active sector, change immediately to the new one.
Q On the new paging channel, if the mobile learns that registration is
required, it re-registers on the new sector
October, 2007
Course 120+: 74
Ec/Io
Idle Mode on the Paging Channel:

Meet the Neighbors, track the Strongest Pilot
All PN Offsets
-20
SRCH_WIN_A
Chips 0
PN 0
Mobile Rake RX
F1 PN168 W01
Active Pilot
Rake Fingers
SRCH_WIN_N
Reference PN
n
o
p
32K
512
F2 PN168 W01
F3 PN168 W01
Srch PN??? W0
The phones pilot searcher constantly checks

the pilots listed in the Neighbor List Message
Neighbor Set
If the searcher ever notices a neighbor pilot substantially stronger than

the current reference pilot, it becomes the new reference pilot
and the phone switches over to its paging channel on the next superframe.
This is called an idle mode handoff.
October, 2007
Course 120+: 75
Receiving
Receiving An
An Incoming
Incoming Call
Call
October, 2007
Course 120+: 76
Incoming Call Termination Voice

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
W23 TRAFFIC
W1 PAGING KGGenPag
KS
PCGKSPKGACKKPC CHasn KPNKPPCKGKSGKXPNKPPCKGSAKXPNGKSAKXPNKGKSAKXPG
NSAGSAKXPNGKSAK
W32
BTS
W0
SYNC S SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
PILOT
TIME
ACCESS
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
October, 2007
Course 120+: 77

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
W23 TRAFFIC
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
October, 2007
Course 120+: 78

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
W23 TRAFFIC
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
Im here! What
should I do?
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
October, 2007
Course 120+: 79

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
W23 TRAFFIC
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
Im here! What
should I do?
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
October, 2007
Course 120+: 80

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
W23 TRAFFIC
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
Im here! What
should I do?
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
October, 2007
Course 120+: 81

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
Im here! What
should I do?
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
October, 2007
Course 120+: 82

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
Im here! What
should I do?
I see
frames!
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
Course 120+: 83

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
I see
frames!
W23 TRAFFIC
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
Im here! What
should I do?
I see
frames!
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
Course 120+: 84

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
Im here! What
should I do?
I see
frames!
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
Course 120+: 85

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
ACK
Im here! What
should I do?
I see
frames!
I see you,
too!
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
Course 120+: 86

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
SVCcon
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
ACK
Im here! What
should I do?
I see
frames!
I see you,
too!
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
Course 120+: 87

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
SVCcon
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
ACK
Im here! What
should I do?
I see
frames!
I see you,
too!
SVCncmp
I accept.
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
Course 120+: 88

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
OK! Then start

ringing and
show this:
615-300-0124
SVCcon
Alert/Inf
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
ACK
Im here! What
should I do?
I see
frames!
I see you,
too!
SVCncmp
I accept.
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
Course 120+: 89

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
OK! Then start

ringing and
show this:
615-300-0124
SVCcon
Alert/Inf
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
ACK
Im here! What
should I do?
I see
frames!
I see you,
too!
SVCncmp
I accept.
ACK
I am.
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
Course 120+: 90

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
OK! Then start

ringing and
show this:
615-300-0124
SVCcon
Alert/Inf
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
ACK
Im here! What
should I do?
I see
frames!
I see you,
too!
#3 PN168+9 W23
#4 PN168+5 W23
I accept.
ACK Con
I am.
My owner answered!
Connect the audio.
SEND
Pilot Searcher
October, 2007
SVCncmp
Course 120+: 91

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
OK! Then start

ringing and
show this:
615-300-0124
SVCcon
OK.
Alert/Inf
ACK V
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
ACK
Im here! What
should I do?
I see
frames!
I see you,
too!
#3 PN168+9 W23
#4 PN168+5 W23
I accept.
ACK Con
I am.
My owner answered!
Connect the audio.
SEND
Pilot Searcher
October, 2007
SVCncmp
Course 120+: 92
Making
Making an
an Outgoing
Outgoing Call!
Call!
October, 2007
Course 120+: 93
Outgoing Call Origination IS-95 Voice

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
W23 TRAFFIC
W1 PAGING KGKSPCGGPCGKSPKGACKKPC CHasn KPNKPPCKGKSGKXPNKPPCKGSAKXPNGKSAKXPNKGKSAKXPG
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
The mobile user dials,

Then presses SEND.
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
October, 2007
6 1 5 5 5 5 1 2 3 4
SEND
Course 120+: 94

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
W23 TRAFFIC
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
October, 2007
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
6 1 5 5 5 5 1 2 3 4
SEND
Course 120+: 95

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
I hear you.
Just a moment.
W23 TRAFFIC
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
October, 2007
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
6 1 5 5 5 5 1 2 3 4
SEND
Course 120+: 96

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
I hear you.
Just a moment.
W23 TRAFFIC
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
October, 2007
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
6 1 5 5 5 5 1 2 3 4
SEND
Course 120+: 97

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Your channel
Is ready!
Walsh 23
I hear you.
Just a moment.
W23 TRAFFIC
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
October, 2007
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
6 1 5 5 5 5 1 2 3 4
SEND
Course 120+: 98

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Your channel
Is ready!
Walsh 23
I hear you.
Just a moment.
W23 TRAFFIC
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
6 1 5 5 5 5 1 2 3 4
SEND
Course 120+: 99

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Your channel
Is ready!
Walsh 23
I hear you.
Just a moment.
I see
frames!
W23 TRAFFIC
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
6 1 5 5 5 5 1 2 3 4
SEND
Course 120+: 100

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Your channel
Is ready!
Walsh 23
I hear you.
Just a moment.
W23 TRAFFIC
I see
frames!
I see you!
ACK

NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
6 1 5 5 5 5 1 2 3 4
SEND
Course 120+: 101

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Your channel
Is ready!
Walsh 23
I hear you.
Just a moment.
W23 TRAFFIC
I see
frames!
I see you!
ACK

NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
ACK
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
I see you,
too!
6 1 5 5 5 5 1 2 3 4
SEND
Course 120+: 102

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Your channel
Is ready!
Walsh 23
I hear you.
Just a moment.
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
SVCcon

NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
ACK
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
I see you,
too!
6 1 5 5 5 5 1 2 3 4
SEND
Course 120+: 103

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Your channel
Is ready!
Walsh 23
I hear you.
Just a moment.
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
SVCcon

NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
ACK
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
I see you,
too!
SVCncmp
I accept.
6 1 5 5 5 5 1 2 3 4
SEND
Course 120+: 104

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Your channel
Is ready!
Walsh 23
I hear you.
Just a moment.
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
SVCcon
OK!
ACK

NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
ACK
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
I see you,
too!
SVCncmp
I accept.
6 1 5 5 5 5 1 2 3 4
SEND
Course 120+: 105

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Your channel
Is ready!
Walsh 23
I hear you.
Just a moment.
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
SVCcon
OK!
ACK
Voice conversation

NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
ACK
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
I see you,
too!
SVCncmp
Voice conversation
I accept.
6 1 5 5 5 5 1 2 3 4
SEND
Course 120+: 106
Downloading
Downloading Data
Data on
on aa
Forward
Forward Link
Link Supplemental
Channel
October, 2007
Course 120+: 107
Forward Supplemental Channel Assignment

Mobile: Watch
Walsh Code 2
Starting in 320 ms
For 1000 ms.
PN 168
BTS
W2
F-SCH
W23
F-FCH
Mobile: Watch
Walsh Code 2
Starting in 320 ms
For 1000 ms.
Supplemental
Channel Burst
ESCAM
Supplemental
Channel Burst
ESCAM
W1
PAGING KGKSAKKNKGGKSKPG
NSASPPCKGKSAKGKSAKKNKGGKSKPG
NSASPPCK
W32
SYNC SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
W0
PILOT
TIME
ACCESS CHANNEL
R-FCH
October, 2007
Course 120+: 108
Uploading
Uploading Data
Data on
on aa
Reverse
Reverse Link
Link Supplemental
Channel
October, 2007
Course 120+: 109
Reverse Supplemental Channel Assignment

Mobile: Send
Walsh Code 1
Starting in 320 ms
For 1000 ms.
W23
PN 168
BTS
Mobile: Send
Walsh Code 1
Starting in 320 ms
For 1000 ms.
ESCAM
F-FCH
ESCAM
W1
NSASPPCK
W32
W0
PILOT
TIME
ACCESS CHANNEL
R-FCH
SCRM
Supplemental
Channel Burst
R-SCH
System: I need to
Send you the
Following blocks:
October, 2007
SCRM
Supplemental
Channel Burst
System: I need to
Send you the
Following blocks:
Course 120+: 110
Ending
Ending A
A Call
Call
October, 2007
Course 120+: 111
Normal End of Call

W23
BTS
TRAFFIC
Voice
RELnorm
W1
NSASPPCKGKSA
ACK SYS ChASN CHN XSYS NBR
W32
SYNC SSSSSSSSSSSSSSSSSSSSSSSSSSS
SYN SYN SYN SYN SYN SYN SYN SYN SYN
W0
SCAN Ref Time
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
MOBILE REACQUIRES SYSTEM NORMALLY

Voice
RELnoRsn
Q When a call ends normally, it is because the caller on one side of the
conversation decided to hang up
Q The side ending the call sends a Release Normal order
Q The other side sends a Release No reason order
It may send an acknowledgment first, if it cannot give the release
order immediately
Q After the system receives a release order from the mobile, it releases the
resources it used for the call
Q After the mobile receives a release order from the base station, it stops
listening to the traffic channel and freshly reacquires the system
October, 2007
Course 120+: 112
Abnormal End of Call Forward Link Failure

W23
BTS
TRAFFIC
Voice
5s timer
All bad frames
W1
NSASPPCKGKSA
ACK SYS ChASN CHN XSYS
W32
SYNC SSSSSSSSSSSSSSSSSSSSSSSSSSS
SYN SYN SYN SYN SYN SYN SYN SYN
W0
SCAN Ref Time
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
MOBILE REACQUIRES SYSTEM, if available

Voice
Mute! No pc
5s timer
Q The mobile is always counting and tracking the bad frames it

receives on the forward link
Q Forward Link Fade Timer: If the mobile does not receive any good
frames during a 5-second period, it aborts the call
Q If a mobile receives 10 consecutive bad frames, it mutes its
transmitter until at least 2 consecutive good frames are heard
If the mobile stays muted 5 seconds, the BTS will release too
Q After a call ends for any reason, the mobile tries to reacquire the
system, making an independent cold start
October, 2007
Course 120+: 113
Abnormal End of Call Reverse Link Failure

W23
BTS
TRAFFIC
Voice
RELnoRsn
W1
NSASPPCKGKSAAKSKPG
NSAS
ACK SYS ChASN CHN XSYS
W32
SYNC SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
SYN SYN SYN SYN SYN SYN SYN SYN
W0
SCAN Ref Time
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
MOBILE REACQUIRES SYSTEM, if available

Voice
All bad frames

5s timer
Q The BTS is always counting and tracking the bad frames it

receives on the reverse link from the mobile
Q Reverse Link Fade Timer: If the BTS does not receive any good
frames during a 5-second period, it releases the call
Q After a call ends for any reason, the mobile tries to reacquire the
system, making an independent cold start
October, 2007
Course 120+: 114
Feature
Feature Notification:
Notification:
You
You Have
Have Voicemail!
Voicemail!
October, 2007
Course 120+: 115
Feature Notification
FEATURE NOTIFICATION MESSAGE
98/06/30 21:16:44.368 [PCH] Feature Notification Message
MSG_LENGTH = 144 bits
MSG_TYPE = Feature Notification Message
ACK_SEQ = 0
MSG_SEQ = 0
ACK_REQ = 1
VALID_ACK = 0
ADDR_TYPE = IMSI
ADDR_LEN = 56 bits
IMSI_CLASS = 0
IMSI_CLASS_0_TYPE = 3
RESERVED = 0
MCC = 302
IMSI_11_12 = 00
IMSI_S = 9055170325
RELEASE = 0
RECORD_TYPE = Message Waiting
RECORD_LEN = 8 bits
MSG_COUNT = 1
RESERVED = 0
The Feature Notification Message on

the Paging Channel tells a specific
mobile it has voice messages waiting.
There are other record types to notify
the mobile of other features.
MOBILE STATION ACKNOWLEDGMENT

The mobile confirms it has received the
notification by sending a Mobile Station
Acknowledgment Order on the access
channel.
October, 2007
Course 120+: 116
The
The Rules
Rules of
of Soft
Soft Handoff
Handoff
October, 2007
Course 120+: 117
The Complete Rules of Soft Handoff

PILOT SETS
Active
6 6
Candidate 5 10
Neighbor 20 40
Remaining
HANDOFF
PARAMETERS
T_ADD
T_DROP
T_TDROP
T_COMP
Exercise: How does a pilot

in one set migrate into
another set, for all cases?
Identify the trigger, and the
messages involved.
Course 120+: 118
# Reqd`. By Std.
IS-95B/
1xRTT
October, 2007
IS-95/
J-Std008
Q The Handset considers pilots in sets

Active: pilots of sectors actually in use
Candidates: pilots mobile requested, but
not yet set up & transmitting by system
Neighbors: pilots told to mobile by system,
as nearby sectors to check
Remaining: any pilots used by system but
not already in the other sets (div. by PILOT_INC)
Q Handset sends Pilot Strength Measurement
Message to the system whenever:
It notices a pilot in neighbor or remaining set
exceeds T_ADD
An active set pilot drops below T_DROP for
T_TDROP time
A candidate pilot exceeds an active by
T_COMP
Q The System may set up all requested handoffs,
or it may apply special manufacturer-specific
screening criteria and only authorize some
Handoffs
Handoffs and
and
Pilot
Pilot Set
Set Management
Management
Here are some example handoffs, showing the way the
handoff parameters are applied.
October, 2007
Course 120+: 119
SYSTEM ACQUISITION
0
Strongest
-3
At turn-on, and after the end of every call, a mobile

makes a fresh attempt to acquire the system. It scans
all the PN offsets in tiny steps to be sure no pilot
signal is missed. After the scan is complete, the
mobile locks to the strongest pilot it has found.
EC/IO db.
-6
-10
-15
-20
-25
54
October, 2007
102
134
200
248
300
328
396
416
420
488
504
120
IDLE MODE
The strongest pilot is now the only Active pilot.

The mobile puts its rake fingers on this PN and decodes
Walsh Code 32, the Sync channel.
The Sync channel announces the system (SID) and
network (NID); how to make the long code properly
synchronized (Long Code State); and when the 20 ms.
frames begin on the Paging and traffic channels.
Now the mobile knows how to receive the paging channel!
0
-3
EC/IO db.
-6
It begins continuously listening to the paging channel.

Soon it receives the neighbor list message.
-10
Neighbor
Neighbor
Active Pilot
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
-15
54
102
134
200
248
300
328
396
416
420
488
504
-20
-25
October, 2007
121
IDLE MODE
HANDOFF
0
-3
-6
In idle mode, listening to the paging channel, the mobile can have only
one active pilot at a time. Soft handoff is not possible during idle mode,
since the messages on one sectors paging channel do not match the
messages on another sectors paging channel.
The mobiles pilot searcher is continuously checking
both the active pilot (to keep the rake fingers aligned
on the best multipath signals) and the neighbor pilots.
If a neighbor pilot is noticed at least 3 db stronger than
the current active pilot, and it remains so for 5
seconds, the mobile just stops listening to the old
active and the stronger neighbor becomes the new
(Settable parameters)
active pilot. If the current active pilot should fade and
the mobile loses the paging channel, it is allowed to
switch to another stronger sector immediately without
waiting 5 seconds.
Neighbor
former Active Pilot
Neighbor
New Active Pilot
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
-10
Neighbor
EC/IO db.
3 Db, 5 sec.
54
102
134
200
248
300
328
396
416
420
488
504
-15
-20
-25
The system does not even know the mobile has done an idle mode handoff, since no
messages are exchanged. The mobile just starts listening to a different sector!
Of course, if the mobile notices that the new sector has a different SID or NID from the old
sector, it will register to let the new system know it has arrived.
October, 2007
122
IN CALL
0
SEE ADDITIONAL
PILOTS >T_ADD,
SEND PSMM!!
-3
When a mobile begins a call, it has only one active pilot the same
sector it was listening to in idle mode. It remembers the same neighbor
list from its idle time.
During a call, the mobiles pilot searcher is scanning alternately the
active pilot and each pilot on the neighbor list.
If the mobile notices any pilots with EC/IO above T_Add, it will
immediately send a PSMM to the system, asking for handoff with them.
-6
PN134, -10, keep;
PN102, -11.5, keep
-10
Neighbor above T_Add
Neighbor
Active Pilot
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
-15
T_ADD
-13
54
102
134
200
248
300
328
396
416
420
488
504
T_DROP
-20
-25
BTS
Neighbor
EC/IO db.
PSMM: PN248, -5, keep;
October, 2007
123
IN CALL
0
-3
WAIT
for EHDM
After the mobile has sent the PSMM, the newly-requested pilots are
considered Candidates. The mobile cannot begin listening to them
yet, because they do not have channel elements set up yet to simulcast
the traffic channel, and the mobile must also be told which walsh codes
have been assigned for it to listen to.
The mobile patiently waits for the Extended Handoff Direction Message.
-10
Neighbor
Active Pilot
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
T_DROP
Requested Candidate
-15
T_ADD
Requested Candidate
-13
Neighbor
EC/IO db.
-6
54
102
134
200
248
300
328
396
416
420
488
504
-20
-25
October, 2007
124
IN CALL
0
-3
RECEIVE
EHDM
With approximately 500 ms after sending the PSMM, the mobile receives
the Extended Handoff Direction Message (EHDM). The base station has
authorized the handoff on all the requested sectors, and included the
walsh codes the mobile must know in order to hear the sectors.
After beginning to use the new pilots, the mobile confirms by sending a
Handoff Completion Message. Then the system sends the mobile a new
Neighbor List Update message.
-6
PN134, W08;
PN102, W52
-10
Neighbor
Active Pilot
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
T_DROP
Active Pilot
-15
T_ADD
Active Pilot
-13
54
102
134
200
248
300
328
396
416
420
488
504
-20
-25
BTS
Neighbor
EC/IO db.
EHDM: PN248, W14;
October, 2007
125
IN CALL
0
AN ACTIVE PILOT
FALLS BELOW
T_DROP
One of the active pilots, PN134, has faded below T_Drop.

The mobile puts PN134 on a probation watch waiting to see if it
remains below T_Drop for T_TDrop seconds .
-3
T_TDrop
-10
Neighbor
Active Pilot
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
T_DROP
Active Pilot
-15
Active Pilot
-13
T_ADD
Neighbor
EC/IO db.
-6
54
102
134
200
248
300
328
396
416
420
488
504
-20
-25
October, 2007
126
IN CALL
0
PILOT RECOVERS,
REMAINS ACTIVE
If PN134 recovers, becoming stronger than T_Drop before the T_TDrop

time has passed, the mobile forgives its earlier weakness and will not
send a PSMM to request any change.
-3
<T_TDrop
-10
Neighbor
Active Pilot
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
T_DROP
Active Pilot
-15
Active Pilot
-13
T_ADD
Neighbor
EC/IO db.
-6
54
102
134
200
248
300
328
396
416
420
488
504
-20
-25
October, 2007
127
IN CALL
0
-3
AN ACTIVE PILOT
FALLS BELOW
T_DROP
AGAIN
T_TDrop
-10
Neighbor
Active Pilot
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
T_DROP
Active Pilot
-15
Active Pilot
-13
T_ADD
Neighbor
EC/IO db.
-6
54
102
134
200
248
300
328
396
416
420
488
504
-20
-25
PN134 has faded below T_Drop again.

The mobile puts PN134 on a probation watch waiting to see if it
remains below T_Drop for T_TDrop seconds .
October, 2007
128
IN CALL
0
-3
T_ADD
BTS
Active Pilot
Neighbor
Active Pilot
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
T_DROP
54
102
134
200
248
300
328
396
416
420
488
504
-20
-25
PN134, -16, drop;

PN102, -11.5, keep
Active Pilot
-15
PSMM: PN248, -5, keep;
-10
-13
>T_TDrop
Neighbor
EC/IO db.
-6
PILOT REMAINS
BELOW T_DROP
FOR T_TDROP
SECONDS.
SEND PSMM
TO REMOVE!
If PN134 remains below T_Drop for T_TDrop seconds, the mobile sends
a PSMM requesting to drop it from the handoff.
October, 2007
129
IN CALL
0
-3
The mobile waits for an Extended Handoff Direction Message (EHDM),

giving permission to drop the pilot from the Active set.
WAIT FOR
EHDM
-10
Neighbor
Active Pilot
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
T_DROP
Active Pilot
-15
T_ADD
Active Pilot
-13
Neighbor
EC/IO db.
-6
54
102
134
200
248
300
328
396
416
420
488
504
-20
-25
October, 2007
130
IN CALL
0
-3
-6
PN134 is now dropped from the Active set, and becomes a neighbor.
The mobile continues with Active pilots PN102 and PN248.
Receive
EHDM,
Drop
Pilot
EHDM: PN248, W14;

BTS
Neighbor
Active Pilot
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
Neighbor
T_DROP
Neighbor
-15
T_ADD
Active Pilot
-13
Neighbor
EC/IO db.
PN102, W52
-10
54
102
134
200
248
300
328
396
416
420
488
504
-20
-25
October, 2007
131
PSMM: PN248, -5, keep; PN300, -3.5, keep;
IN CALL
0
PN134, -10.5, keep; PN488, -10.5, keep;

PN102, -11.5, keep; PN328, -11.5, keep;
PN200, -12, keep; PN396, -12.5, keep;
PN420, -12, keep; PN504, -12, keep BTS
SEE ADDITIONAL
PILOTS >T_ADD,
SEND PSMM!!
-3
-10
Active Pilot
Neighbor
-15
T_ADD
Active Pilot
-13
Neighbor
EC/IO db.
-6
54
102
134
200
248
300
328
396
416
420
488
504
T_DROP
-20
-25
The mobile has just noticed several neighbor pilots have risen above T_ADD. It will immediately send a
PSMM requesting to add them in handoff. It quickly sends a PSMM requesting handoff with them.
October, 2007
132
IN CALL
0
-3
WAIT
for EHDM
-10
Requested Candidate
Active Pilot
Requested Candidate
Requested Candidate
Requested Candidate
Neighbor
Requested Candidate
Requested Candidate
Requested Candidate
T_DROP
Requested Candidate
-15
T_ADD
Active Pilot
-13
Neighbor
EC/IO db.
-6
54
102
134
200
248
300
328
396
416
420
488
504
-20
-25
October, 2007
133
IN CALL
0
-3
EHDM: PN300, W31; PN248, W14;

PN134, W08; PN488, W10;
PN328, W27; PN102, W52
RECEIVE
EHDM
BTS
-10
Active Pilot
Unassigned Candidate
Active Pilot
Active Pilot
Active Pilot
Neighbor
Active Pilot
-15
T_ADD
Active Pilot
-13
Neighbor
EC/IO db.
-6
54
102
134
200
248
300
328
396
416
420
488
504
T_DROP
-20
-25
The mobile receives the Extended Handoff Direction Message, and implements the handoff with the pilots
listed in the message. The BSC has chosen the strongest six pilots requested in the previous PSMM. Only
the strongest 6 signals requested by the mobile are chosen to be active.
PN 200, PN396, PN420 and PN504 are Unassigned Candidates.
October, 2007
134
IN CALL
0
PN134, -10.5, keep; PN488, -10.5, keep;

PN102, -11.5, keep; PN328, -11.5, keep;
PN200, -12, keep; PN396, -12.5, keep;
PN416, -10.5, keep; PN420, -12, keep; BTS
PN504, -12, keep
SEE ADDITIONAL
PILOTS >T_ADD,
SEND PSMM!!
-3
-10
Active Pilot
Requested Candidate
Active Pilot
Active Pilot
Active Pilot
Requested Candidate
Requested Candidate
Active Pilot
Requested Candidate
-15
T_ADD
Active Pilot
-13
Neighbor
EC/IO db.
-6
54
102
134
200
248
300
328
396
416
420
488
504
T_DROP
-20
-25
The mobile notices that PN416 has just grown stronger, and is now above T_Add. It sends a PSMM
requesting handoff with it and the other 10 signals above T_Add.
October, 2007
135
IN CALL
0
-3
WAIT
for EHDM
-10
Requested Candidate
Active Pilot
Active Pilot
Active Pilot
Requested Candidate
Requested Candidate
Requested Candidate
Active Pilot
Requested Candidate
T_DROP
Active Pilot
-15
T_ADD
Active Pilot
-13
Neighbor
EC/IO db.
-6
54
102
134
200
248
300
328
396
416
420
488
504
-20
-25
October, 2007
136
IN CALL
0
-3
EHDM: PN300, W31; PN248, W14;

PN134, W08; PN488, W10;
PN416, W52; PN396, W34
RECEIVE
EHDM
BTS
-10
Active Pilot
Active Pilot
Active Pilot
Active Pilot
Active Pilot
Active Pilot
-15
T_ADD
-13
Neighbor
EC/IO db.
-6
54
102
134
200
248
300
328
396
416
420
488
504
T_DROP
-20
-25
The mobile receives the Extended Handoff Direction Message, and implements the handoff with the pilots
listed in the message. The BSC has chosen the strongest six pilots requested in the previous PSMM. Only
the strongest 6 signals requested by the mobile are chosen to be active.
Notice that PN416 replaces PN102. PN102, PN200, PN396, PN420 and PN504 are Unassigned Candidates.
October, 2007
137
IN CALL
0
-3
PN134, -10.5, keep; PN488, -10.5, keep;

PN102, -11.5, keep; PN328, -14, keep;
PN200, -12, keep; PN396, -10, keep;
PN416, -10.5, keep; PN420, -12, keep; BTS
PN504, -12, keep
Notice T_COMP
trigger, send
EHDM
-6
-10
Requested Candidate
Active Pilot
Active Pilot
Active Pilot
Requested Candidate
Active Pilot
Requested Candidate
Active Pilot
Requested Candidate
T_DROP
Active Pilot
-15
T_ADD
Requested Candidate
-13
Neighbor
EC/IO db.
T_COMP
54
102
134
200
248
300
328
396
416
420
488
504
-20
-25
Suppose T_COMP = 4 db. The mobile notices that the strongest candidate, PN396, has grown T_COMP db
stronger than the weakest active pilot, PN328.
This triggers the mobile to send a new PSMM including all the pilots above T_ADD. All of them were already
either actives or candidates, but the new PSMM includes the new current strength of each pilot.
October, 2007
138
IN CALL
0
-3
WAIT
for EHDM
Both before and after the mobile sends the PSMM, the active pilots are
the same and the candidate pilots are the same. The mobile patiently
waits for the Extended Handoff Direction Message, which may cause
some of the pilots to change sets.
-6
-10
Requested Candidate
Active Pilot
Active Pilot
Active Pilot
Requested Candidate
Active Pilot
Requested Candidate
Active Pilot
Requested Candidate
T_DROP
Active Pilot
-15
T_ADD
Requested Candidate
-13
Neighbor
EC/IO db.
T_COMP
54
102
134
200
248
300
328
396
416
420
488
504
-20
-25
October, 2007
139
IN CALL
0
-3
EHDM: PN300, W31; PN248, W14;

PN134, W08; PN488, W10;
PN416, W52; PN328, W27
RECEIVE
EHDM
BTS
-10
Active Pilot
Active Pilot
Active Pilot
Active Pilot
Active Pilot
Active Pilot
-15
T_ADD
-13
Neighbor
EC/IO db.
-6
54
102
134
200
248
300
328
396
416
420
488
504
T_DROP
-20
-25
Notice that PN396 has become Active, replacing PN328.
October, 2007
140
A
A Soft
Soft Handoff
Handoff
October, 2007
Course 120+: 141
Basic Soft/Softer Handoff

BTS A
BSC
BTSC
ctrl
PN 344
BTS
PN 168
BTS
W41
TRAFFIC
W1
PAGING
W32
SYNC
W0
PILOT
W23
TRAFFIC
BTS B
BTSC
W1
NSASPPCK
W32
W0
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
Rake Receiver
#1 PN168+0 W23
!!
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
October, 2007
Course 120+: 142

BTS A
BSC
BTSC
ctrl
PN 344
BTS
PN 168
BTS
BTS B
BTSC
W41
TRAFFIC
W1
PAGING
GGKSKPG
NSASPPCK
W32
SYNC
SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
W0
PILOT
W23
TRAFFIC
W1
NSASPPCK
W32
W0
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
Rake Receiver
#1 PN168+0 W23
!!
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Wow! PN344
is above
T_ADD!
Pilot Searcher
October, 2007
Course 120+: 143

BTS A
BSC
BTSC
ctrl
PN 344
BTS
PN 168
BTS
BTS B
BTSC
W41
TRAFFIC
W1
PAGING
GGKSKPG
NSASPPCK
W32
SYNC
W0
PILOT
W23
TRAFFIC
W1
NSASPPCK
W32
W0
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
PSMM
Rake Receiver
#1 PN168+0 W23
!!
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Wow! PN344
is above
T_ADD!
Hey system! I want:

PN168 (ref), -6, keep
PN344, -11, keep
Pilot Searcher
October, 2007
Course 120+: 144

BTS A
BSC
BTSC
ctrl
BTS B
BTSC
I hear you.
Hang on
PN 344
BTS
PN 168
BTS
W41
TRAFFIC
W1
PAGING
GGKSKPG
NSASPPCK
W32
SYNC
W0
PILOT
W23
TRAFFIC
ACK
W1
NSASPPCK
W32
W0
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
PSMM
Rake Receiver
#1 PN168+0 W23
!!
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Wow! PN344
is above
T_ADD!
Hey system! I want:

PN344, -11, keep
Pilot Searcher
October, 2007
Course 120+: 145

BTS A
BSC
BTSC
ctrl
BTS B
BTSC
I hear you.
Hang on
PN 344
BTS
PN 168
BTS
W41
TRAFFIC
W1
PAGING
GGKSKPG
NSASPPCK
W32
SYNC
W0
PILOT
W23
TRAFFIC
ACK
W1
NSASPPCK
W32
W0
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
PSMM
Rake Receiver
#1 PN168+0 W23
!!
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Wow! PN344
is above
T_ADD!
Hey system! I want:

PN344, -11, keep
Pilot Searcher
October, 2007
Course 120+: 146

BTS A
BSC
BTSC
ctrl
BTS B
I hear you.
Hang on
PN 344
BTS
PN 168
BTS
BTSC
OK! You can use:

PN 168 W23
PN 344 W41
EHDM
W41
TRAFFIC
W1
PAGING
GGKSKPG
NSASPPCK
W32
SYNC
W0
PILOT
W23
TRAFFIC
ACK
EHDM
W1
NSASPPCK
W32
W0
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
PSMM
Rake Receiver
#1 PN168+0 W23
!!
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Wow! PN344
is above
T_ADD!
Hey system! I want:

PN344, -11, keep
Pilot Searcher
October, 2007
Course 120+: 147

BTS A
BSC
BTSC
ctrl
BTS B
I hear you.
Hang on
PN 344
BTS
PN 168
BTS
BTSC
OK! You can use:

PN 168 W23
PN 344 W41
EHDM
W41
TRAFFIC
W1
PAGING
GGKSKPG
NSASPPCK
W32
SYNC
W0
PILOT
W23
TRAFFIC
ACK
EHDM
W1
NSASPPCK
W32
W0
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
PSMM
ACK
Rake Receiver
#1 PN168+0 W23
!!
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Wow! PN344
is above
T_ADD!
Hey system! I want:

PN344, -11, keep
OK
Pilot Searcher
October, 2007
Course 120+: 148

BTS A
BSC
BTSC
ctrl
BTS B
I hear you.
Hang on
PN 344
BTS
PN 168
BTS
BTSC
OK! You can use:

PN 168 W23
PN 344 W41
EHDM
W41
TRAFFIC
W1
PAGING
GGKSKPG
NSASPPCK
W32
SYNC
W0
PILOT
W23
TRAFFIC
ACK
EHDM
W1
NSASPPCK
W32
W0
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
PSMM
ACK
HOcomp
Rake Receiver
#1 PN344+0 W41
!!
#2 PN168+0 W23
#3 PN168+9 W23
#4 PN168+5 W23
Wow! PN344
is above
T_ADD!
Hey system! I want:

PN344, -11, keep
OK
Great! Im using
PN168 + PN344
Pilot Searcher
October, 2007
Course 120+: 149

BTS A
BSC
BTSC
ctrl
BTS B
I hear you.
Hang on
PN 344
BTS
PN 168
BTS
BTSC
OK! You can use:

PN 168 W23
PN 344 W41
OK
EHDM
ACK
W41
TRAFFIC
W1
PAGING
GGKSKPG
NSASPPCK
W32
SYNC
W0
PILOT
W23
TRAFFIC
ACK
EHDM
ACK
W1
NSASPPCK
W32
W0
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
PSMM
ACK
HOcomp
Rake Receiver
#1 PN344+0 W41
!!
#2 PN344+3 W41
#3 PN168+2 W23
#4 PN168+5 W23
Wow! PN344
is above
T_ADD!
Hey system! I want:

PN344, -11, keep
OK
Great! Im using
PN168 + PN344
Pilot Searcher
October, 2007
Course 120+: 150

BTS A
BSC
BTSC
ctrl
BTS B
I hear you.
Hang on
PN 344
BTS
PN 168
BTS
BTSC
OK! You can use:

PN 168 W23
PN 344 W41
OK
EHDM
ACK
OK. Heres your new

Neighbor list:
PN164 PN172 PN340
PN420 PN084 PN132
PN434 PN504 PN016
PN028 PN508 PN372
NLum
W41
TRAFFIC
W1
PAGING
GGKSKPG
NSASPPCK
W32
SYNC
W0
PILOT
W23
TRAFFIC
ACK
EHDM
ACK
NLum
W1
NSASPPCK
W32
W0
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
PSMM
ACK
HOcomp
Rake Receiver
#1 PN344+0 W41
!!
#2 PN344+3 W41
#3 PN168+2 W23
#4 PN168+5 W23
Wow! PN344
is above
T_ADD!
Hey system! I want:

PN344, -11, keep
OK
Great! Im using
PN168 + PN344
Pilot Searcher
October, 2007
Course 120+: 151

BTS A
BSC
BTSC
ctrl
BTS B
I hear you.
Hang on
PN 344
BTS
PN 168
BTS
BTSC
OK! You can use:

PN 168 W23
PN 344 W41
OK
EHDM
ACK
OK. Heres your new

Neighbor list:
PN164 PN172 PN340
PN420 PN084 PN132
PN434 PN504 PN016
PN028 PN508 PN372
NLum
W41
TRAFFIC
W1
PAGING
GGKSKPG
NSASPPCK
W32
SYNC
W0
PILOT
W23
TRAFFIC
ACK
EHDM
ACK
NLum
W1
NSASPPCK
W32
W0
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
PSMM
ACK
HOcomp
ACK
Rake Receiver
#1 PN344+0 W41
!!
#2 PN344+3 W41
#3 PN168+2 W23
#4 PN168+5 W23
Wow! PN344
is above
T_ADD!
Hey system! I want:

PN344, -11, keep
OK
Great! Im using
PN168 + PN344
OK
Pilot Searcher
October, 2007
Course 120+: 152
Ec/Io
Handoff Example
All PN Offsets
-20
Chips
10752
PN 0
14080
32002
168 220
Active Pilot
Mobile Rake RX
F1 PN168 W61
Rake Fingers
F2 PN168 W61
F3 PN168 W61
Srch PN??? W0
Reference PN
T_ADD
n
o
p
500 512
The call is already in progress.

PN 168 is the only active signal,
and also is our timing reference.
Continue checking the neighbors.
Neighbor Set
If we ever notice a neighbor with Ec/Io above T_ADD,

ask to use it! Send a Pilot Strength Measurement Message!
October, 2007
32K
Course 120+: 153
Ec/Io
Handoff Now In Effect, but still check Pilots!

All PN Offsets
-20
Chips
10752
PN 0
14080
168 220
n
F1 PN168 W61
F3 PN220 W20
Rake Fingers
T_DROP
Srch PN??? W0
Reference PN
Neighbor Set
T_ADD
Continue checking each ACTIVE pilot. If any are less than T_DROP and remain
so for T_TDROP time, send Pilot Strength Measurement Message, DROP IT!!
Continue looking at each NEIGHBOR pilot. If any ever rises above T_ADD, send
Pilot Strength Measurement Message, ADD IT!
October, 2007
32K
500 512
Active Set
Mobile Rake RX
F2 PN500 W50
32002
Course 120+: 154
Ec/Io
The Complete Picture of Handoff & Pilot Sets

All PN Offsets
-20
Chips 0
PN 0
Rake Fingers
SRCH_WIN_A
T_DROP
T_ADD
SRCH_WIN_A
Active Set
Pilots of sectors
now used for
communication
T_DROP
Reference PN
Candidate Set
SRCH_WIN_N
Pilots requested
by mobile but not
set up by system
32K
512
Mobile Rake RX
F1 PN168 W61
F2 PN500 W50
F3 PN220 W20
Srch PN??? W0
Neighbor Set
Pilots suggested
by system for
more checking
Remaining Set
All other pilots divisible by PILOT_INC but not

presently in Active, Candidate, or Neighbor sets
T_ADD
SRCH_WIN_R
October, 2007
Course 120+: 155
Meet
Meet the
the CDMA
CDMA
Performance
Performance Indicators
Indicators
October, 2007
Course 120+: 156
CDMA Performance Indicators

Q A Flight Data Recorder logs aircraft operational settings. Its CDMA
equivalent is a file of RF performance indicators captured by drive-test
equipment.
Q Key CDMA parameters and measurements show the condition of the RF
environment. They are the primary gauges used to guide CDMA
optimization and troubleshooting
some indicate uplink conditions, some downlink, and some, both.
these parameters are collected primarily at the subscriber end of the
link, and thus are easy to capture using readily available commercial
equipment without requiring assistance at the BSC
Q Understanding these parameters and their important implications requires
basic knowledge in several subject areas:
General: RF units, transmitter and receiver basics
CDMA and spread-spectrum signal characteristics
channel definitions
power control systems
basic CDMA call processing flow
signal behavior characteristics in noise and interference
October, 2007
Course 120+: 157
Indicator #1: FER

Q FER Frame Erasure Rate
on forward channel
(realized at Handset)
on reverse channel
(realized at base station)
FER is an excellent call
quality summary statistic
Forw
R ev
ar d
er se
0 2 5
100
FER
%
Q FER is the end-result of the whole transmission link

if FER is good, then any other problems arent having much
effect
if FER is bad, thats not the problem - it is just the end-result of
the problem
we must investigate other indicators to get a clue what is
going on
October, 2007
Course 120+: 158
Indicator #2: Received Power at the Handset
Handset Receiver
BW
~30
MHz.
LNA
x
LO
IF
-40
Rake
R
overload>>
RX Level
R
BW
1.25
S
MHz.
RX Level
(from AGC)
-90
-105
<<too weak
Q Mobile Receive Power

usually expressed in dBm
measured derived from
handset IF AGC voltage
broadband, unintelligent
measurement: includes all
RF in the carrier bandwidth
regardless of source, not
just RF from serving BTS
Q Receive power is important, but its exact value isnt critical

too much received signal (-35 dbm or higher) could drive the
phones sensitive first amplifier into overload, causing intermod
and code distortion on received CDMA signals
too little received signal (-105 or weaker) would leave too much
noise in the signal after de-spreading, resulting in symbol errors,
bit errors, bad FER, and other problems
October, 2007
Course 120+: 159
Indicator #3, Ec/Io - What does it mean?

Q Why cant we just use the handsets
received power level to guide
handoffs?
Because it is a simple total RF
power measurement, the total of
all sectors reaching the mobile
Handset Receiver
BW
~30
MHz.
LNA
x
LO
IF
Rake
R
R
BW
1.25
S
MHz.
RX Level
(from AGC)
Q We need a way to measure the signal strength of each sector

individually, and we must be able to measure it quickly and simply
Q The solution is to use each sectors pilot (Walsh 0) as a test signal
to guide handoffs
At the mobile, if the pilot of a certain sector is very strong and
clean, that means we also should be able to hear a traffic
channel on that sector, so handoff would be a good idea
if the pilot of a certain sector is weak, then we probably wont
be able to get much benefit from using a traffic channel on that
sector
October, 2007
Course 120+: 160
How Ec/Io Varies with Traffic Loading
October, 2007
Ec/Io = (2/4)
= 50%
= -3 db.
Paging
Sync
Pilot
1.5w
0.5w
2w
EC
I0
Heavily Loaded
Ec/Io = (2/10)
= 20%
= -7 db.
Traffic Channels
Q Each sector transmits a certain

amount of power, the sum of:
pilot, sync, and paging
any traffic channels in use
at that moment
Q Ec/Io is the ratio of pilot power
to total power
On a sector with nobody
talking, Ec/Io is typically
about 50%, which is -3 db
On a sector with maximum
traffic, Ec/Io is typically
about 20%, which is -7 db.
Light Traffic Loading
Paging
Sync
Pilot
6w
I0
1.5w
0.5w
2w
EC
Course 120+: 161
How Ec/Io varies with RF Environment
Io = -90 dbm
Ec = -96 dbm
Ec/Io = -6 db
Traffic
Channels
Q In a clean situation, one

sector is dominant and the
mobile enjoys an Ec/Io just
as good as it was when
transmitted
Q In pilot pollution, too many
sectors overlap and the
mobile hears a soup made
up of all their signals
Io is the power sum of all
the signals reaching the
mobile
Ec is the energy of a
single sectors pilot
The large Io overrides the
weak Ec; Ec/Io is low!
One Sector Dominant
Paging
Sync
Pilot
I0
1.5w
0.5w
2w
EC
Many Sectors, Nobody Dominant
Io = 10 signals
each -90 dbm
= -80 dbm
Ec of any one
sector = -96
Ec/Io = -16 db
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
October, 2007
4w
BTS10
BTS9
BTS8
BTS7
BTS6
BTS5
I0
BTS4
BTS3
BTS2
BTS1
EC
Course 120+: 162
Ec/Io and Pilot Pollution

Q When multiple sectors are
about the same strength,
and there is no dominant
server, we call this pilot
pollution
Q To get acceptable reception
during pilot pollution, the
mobile must be using a
majority of the sectors it is
hearing. This causes too
much soft handoff and
consumes capacity.
Q Overcoming pilot pollution
requires careful coverage
control of the related
sectors
Q EcIoPlay.xls is a good tool
for experimenting
October, 2007
Ec/Io value
at each
BTS TX
Io
-3
-80.0
Signal
Strength Ec/Io
-90
-13.0 1
-90
-13.0 2
-90
-13.0 3
-90
-13.0 4
-90
-13.0 5
-90
-13.0 6
-90
-13.0 7
-90
-13.0 8
-90
-13.0 9
-90
-13.0 10
-80.0 Sum Power
Too Many Similar Signals!

Ec/Io of each is very poor
Ec/Io of Multiple CDMA Signals
P
t
o
l
Pi
1
Ec/Io value
at each
Io
BTS TX
-3
-73.9
Signal
Strength Ec/Io
-90
-19.1 1
-90
-19.1 2
-90
-19.1 3
-90
-19.1 4
-75
-4.1 5
-90
-19.1 6
-90
-19.1 7
-90
-19.1 8
-90
-19.1 9
-90
-19.1 10
-73.9 Sum Power
n
o
i
t
ollu
10
10
No Problem!
Great Signal.
Ec/Io of Multiple CDMA Signals
Course 120+: 163
Ec/Io and Pilot Pollution: Handoff Effects

Q This second workbook in EcIoPlay.xls demonstrates the benefits of soft
handoff and the concept of composite (combined) Ec/Io during soft
handoff.
Ec/Io, Handoff, and Rake Finger Pilot Status
%
Overhead
Power
%Pilot
Power
10%
20%
Nominal
Max
Sum RF Comp Max #
Power Power osite
Lockable Rake
W
Io
Ec/Io Fingers
16
-77.2
-4.8
Traffic
Trans Path
Loading mitted Loss,
Signal
%
Ec/Io dB
Strength Ec/Io
0%
-3.0
120
-84.9
-10.8
0%
-3.0
120
-84.9
-10.8
0%
-3.0
120
-84.9
-10.8
0%
-3.0
120
-84.9
-10.8
0%
-3.0
120
-84.9
-10.8
0%
-3.0
120
-84.9
-10.8
0%
-3.0
200 -164.9
-90.8
0%
-3.0
200 -164.9
-90.8
0%
-3.0
200 -164.9
-90.8
0%
-3.0
200 -164.9
-90.8
0%
-3.0
200 -164.9
-90.8
0%
-3.0
200 -164.9
-90.8
0%
-3.0
200 -164.9
-90.8
0%
-3.0
200 -164.9
-90.8
Relative Energies of Multiple CDMA Signals
Max #
Pilots in
Soft
Handoff
Pilot Energy
T_ADD
6
Sync, Paging, Traf fic
-13
0.9
0.8
Rake
Rake
Rake
Rake
Locked
Locked
Locked
Locked
Handoff
Handoff
Handoff
Handoff
Handoff
Handoff
Interferor
Interferor
Interferor
Interferor
Interferor
Interferor
Interferor
Interferor
Interferor
Interferor
1
2
3
4
5
6
7
8
9
10
11
12
13
14
0.7
0.6
0.5
0.4
0.3
0.2
0.1
0
1
Only grey-shaded fields can be changed. Other fields calculate automatically.

To unlock all cells, select TOOLS>PROTECTION>UNPROTECT SHEET.
October, 2007
10
11
12
13
14
Ind ivi d ual Sig nal s
Course 120+: 164
Indicator #4: Handset Transmitter Power

Q TXPO Handset Transmit Power
Actual RF power output of the
handset transmitter, including
combined effects of open
loop power control from
receiver AGC and closed
loop power control by BTS
cant exceed handsets
maximum (typ. +23 dBm)
Subscriber Handset
BTS
Receiver>>
LNA
DUP
TXPO
PA
LO
x
Rake
R
IF
LO
Viterbi
Decoder
Open Loop
Closed Loop Pwr Ctrl

IF
Long PN
x
IF Mod
x
x
Q
Orth
Mod
Vocoder
FEC
<<Transmitter
Typical TXPO:
+23 dBm in a coverage hole

0 dBm near middle of cell
-50 dBm up close to BTS
Q What is the right power TX level? Whatever the BTS asks for!
As long as closed loop control is working, the phones opinion
isnt the last word. Just do what the BTS wants!!
However, if the BTS ever asks the phone to do the impossible,
something is wrong (lower than -60 dbm, higher than +23 dbm)
October, 2007
Course 120+: 165
Indicator #5: Transmit Gain Adjust

Q What is Closed Loop Transmit Gain Adjust (TXGA)?
The power correction the base station is asking the mobile to
make right now, in real-time
At the beginning of a call, before the power control bits begin, it
is zero. Then the power control bits begin, 800 per second.
During a call, TXGA is the running total of all the power control
bits which have been received thus far.
Each power control bit asks for a 1 db correction, up or down
Each power control bit is based on the base stations latest new
decision: mobile is too strong, or mobile is too weak -- there is
no cumulative error, since each decision is fresh
0 dB

Typical Transmit Gain Adjust
-10 dB
-20 dB
October, 2007
Time, Seconds
Course 120+: 166
Closed Loop Power Control Dynamics

Q The figures at right show the
power control reactions to a
sudden change in path loss
Q The sudden change in path loss
causes a sudden change in
handset received signal
Q Both open loop and closed loop
control race to get the phone
back to the right new power and
succeed in about 10 milliseconds
Q Open loop continues to approach
the correct value better and better
on its own
Q 40 milliseconds later, no net
closed loop correction is needed.
October, 2007
Course 120+: 167
Problem
Problem Signatures
Signatures
October, 2007
Course 120+: 168
Signatures of Common Conditions

Q The key CDMA RF Performance
Indicators provide powerful clues
in cause-and-effect analysis for
understanding problem conditions
Q There are many common
conditions which are easy to
recognize from their characteristic
signatures -- unique
relationships among the key
indicators which are observed
when these conditions exist
Q We will use the simplified format
shown at right to display the key
indicators for each of several
interesting cases.
October, 2007
SIGNATURE:
GOOD CALL
FFER
100%
RXL
EC/IO
TxGa
+23
+25
-30
TxPo
+10
-40
+10
-6
-10
0
-10
50%
-20
-30
-10
-15
10%
5%
2%
0%
FFER
BTS
-40
-90
-20
-100
-110
RXL
-20
-25
EC/IO
TxGa
-50
TxPo
Messaging
Course 120+: 169
Signature of a Successful Call
Q If the mobile station originates

successfully, remains in service
area, and makes normal release,
data will show:
SIGNATURE:
GOOD CALL
FFER
100%
RXL
EC/IO
+10
Good Messaging
-10
-20
-30
-10
-15
10%
5%
2%
0%
FFER
Parsed message files will

contain a full set of normal
messages.
October, 2007
-10
50%
Transmit power < +20 dBm
+10
-6
Receive power > -100 dBm

Normal Transmit Gain Adjust
(actual value depends on site
configurations, loading &
NOM_PWR setting)
+23
+25
-30
TxPo
-40
Low forward FER

Good Ec/Io (> -12 dB)
TxGa
BTS
-40
-90
-20
-100
-110
RXL
-20
-25
EC/IO
TxGa
-50
TxPo
Messaging
Course 120+: 170
Signature of a Dropped Call in Poor Coverage

SIGNATURE:
Q If a mobile station is taken out
of the service area or into a
coverage hole, and only data
from the mobile station is
available, the log files will show
the following characteristics:
DROPPED CALL, BAD COVERAGE

FFER
100%
RXL
EC/IO
TxGa
+23
+25
-30
TxPo
+10
-40
+10
-6
-10
High forward FER

Low receive power (<-100
dBm)
-20
-30
-10
-15
Low Ec/Io (< -10 dB)

Higher-than-normal Transmit
Gain Adjust (actual value depends
on site configurations, loading,
NOM_PWR setting)
Higher-than-normal transmit
power (> +20 dBm)
Poor messaging on both links
October, 2007
-10
50%
10%
5%
2%
0%
FFER
BTS
-40
-90
-20
-100
-110
RXL
-20
-25
EC/IO
TxGa
-50
TxPo
Messaging
Course 120+: 171
Signature of Forward Link Interference

Q Characteristics of data for a phone
experiencing forward link
interference from a source other
than the current BTS:
High forward FER

Good receive power (> -100 dBm)
Low Ec/Io (< -10 dB)
Higher-than-normal Transmit Gain
Adjust
Normal transmit power (< +20
dBm)
Poor forward link messaging
unreliable at best and may be
the actual cause of the drop.
SIGNATURE:
FORWARD LINK INTERFERENCE
FFER
100%
EC/IO
TxGa
+23
+25
-30
TxPo
+10
-40
+10
-6
-10
0
-10
50%
-20
-30
-10
-15
10%
5%
2%
0%
FFER
BTS
October, 2007
RXL
-40
-90
-20
-100
-110
RXL
-20
-25
EC/IO
TxGa
-50
TxPo
Messaging
Course 120+: 172
A CDMA Drop Example: Forward Link Case

Q A mobile using Site A comes
down the highway and
suddenly begins to see the
signal of Site B
Q If the mobile begins soft
handoff with site B, everything
continues to go well
Q If the mobile cannot begin
handoff with B for any reason,
the call is doomed
site Bs signal will override
site As signal, making it
unreadable
as soon as the FER goes
too high, a fade timer will
start the the mobile will
eventually die
October, 2007
FORWARD LINK DIES

ns
o
i
t
uc
r
t
s
B
Ob
A
BTS
BTS
l
ve
a
Tr
B grows stronger and stronger.

Mobiles open-loop instinct is to transmit
weaker; closed-loop correction from A
goes higher and higher, maintaining the
mobile at the right power.
Finally B obscures A, which disappears
in an explosion of FER. The mobile
mutes since it cant hear power control
bits, and a fade timer or message timer
kills the call in a few seconds.
Course 120+: 173
Signature of Reverse Link Interference

Q Characteristics of data for a phone
whose BTS has a raised noise
floor due to reverse link
interference
Good forward FER

Good receive power (> -100 dBm)
Good Ec/Io (> -10 dB)
Higher-than-normal Transmit Gain
Adjust
Higher-than-normal transmit power
(< +20 dBm)
Poor reverse link messaging
in the message files, youll
see repeats of messages on
the forward link and reverse
link
October, 2007
SIGNATURE:
REVERSE LINK INTERFERENCE
FFER
100%
RXL
EC/IO
TxGa
+23
+25
-30
TxPo
+10
-40
+10
-6
-10
0
-10
50%
-20
-30
-10
-15
10%
5%
2%
0%
FFER
BTS
-40
-90
-20
-100
-110
RXL
-20
-25
EC/IO
TxGa
-50
TxPo
Messaging
Course 120+: 174
A CDMA Drop Example: Reverse Link Case

Q When a cell is penetrated by a
mobile not under its own
power control, bad things
happen!
The foreign mobile is being
power controlled by a
more distant cell, so it is
transmitting louder than
appropriate
the local mobiles must
power up in a deadly race
to keep up with the
interferor
local mobiles can still hear
the cell fine; the forward
link is just great, to the
very end
October, 2007
REVERSE LINK DIES

B
ns
o
i
t
uc
r
t
s
Ob
BTS
l
ve
a
Tr
It was a beautiful day in the neighborhood

for all the mobiles on site B until the grim
reaper arrived, transmitting at high power
to maintain its link with distant Cell A.
Cell B tried to power up each of its
individual mobiles so they would be
received as strong as the new interferor,
but mobiles more distant than the
interferor just couldnt keep up, and died.
Eventually the interferor died from
forward link interference, too.
If only the interferor had a soft handoff, all
of this violence could have been avoided.
Course 120+: 175
Solving the #1 Death Scenario: Failed Handoff

What Went Wrong??!
Steps in the Handoff Process
see
Mobiles searcher notices

the needed new pilot
ask
Mobile sends PSMM

requesting handoff
System sets up the handoff:

channel elements
do
forward power
BTS space in packet pipes
Simulcasting begins!
Now the system can hear
the mobile better!
tell
System tells mobile how to

hear the new sectors:
BTS Handoff Direction Message
Now the mobile can hear
the system better, too!
ok!
tell
Mobile confirms completion:

Handoff Completion Message
System makes new neighbor list,
sends to mobile: Neighbor List
BTS Update Message
October, 2007
s
FORWARD LINK
on DIES A
i
t
BTS
ruc
B b st
l
BTS O
ve
a
Tr
s
REVERSE LINK DIES
on
i
t
uc
B bstr
BTS O
el
v
a
Tr
Q Why didnt the mobile ask for handoff?

New sector not on neighbor list
Neighbor Search Window too Small?
BTS in island mode, wrong PN?
Q Why didnt the BTS set up the handoff?
Old BTS didnt hear mobile rev link
interf?
No resources available on new BTS?
T-1 unstable, messages lost
Q Why didnt the mobile do the handoff?
Couldnt hear BTS, Fwd link interf?
Course 120+: 176
Search
Search Windows
Windows and
and
PN
PN Planning
Planning
October, 2007
Course 120+: 177
What are "Search Windows"?

Q New pilots usually seem earlier or later
than their official PNs from the neighor list
Some have come from nearer, some
from farther, than the reference PN
Q A mobile must look for pilot energy through
a range of chips earlier and later than the
exact expected PN offset of the signal it is
trying to measure
Q These "tolerance" ranges are called
"Search Windows"
SRCH_WIN_A applies to active and
candidate pilots
SRCH_WIN_N applies to neighbors
SRCH_WIN_R applies to remaining
Q Search windows are chosen by RF
engineers and transmitted to the mobile in
messages from the BTS
October, 2007
PN360
10 KM
41 chips
+41
PN200
2 KM
8 chips
360
+8
360+33c
SRCH_WIN_N
Course 120+: 178
What are the Available Search Window Values?

SRCH_WIN_val Width, Chips
Q Search windows can't be set to the exact number

of chips desired; each window can be set to a
value from the list at right
Q Remember the widths are total and apply with the
mobile's reference at the center.
For example, SRCH_WIN_N = 10 means
when the mobile is checking for neighbor
pilots, it will search a range 100 chips wide,
centered on what it thinks is the reference PN.
The mobile will search from 50 chips
earlier to 50 chips later than the exact PN
it expects to find
Q Search windows should be wide enough to include
needed signals, but not unnecessarily wide
Grossly over-wide search windows will slow
down the mobiles' overall pilot searching
speed
October, 2007
4 (2)
6 (3)
8 (4)
10 (5)
14 (7)
20 (10)
28 (14)
40 (20)
60 (30)
80 (40)
10
100 (50)
11
130 (65)
12
160 (80)
13
226 (113)
14
330 (165)
15
452 (226)
Course 120+: 179
Search Window Settings: Neighbor Set

Neighbor Search Window
Example
Q The neighbor search window must be set

wide enough to include the energy of any
needed neighbor pilot
Q The mobile at right is using PN200 as its
reference (and only active) pilot
Q To the mobile, the pilot of neighbor sector
PN360 seems 33 chips late
Q SRCH_WIN_N must be set to at least 2 x
33 = 66 chips wide so the PN360 pilot can
be noticed by the mobile
Q The closest search window setting above
66 chips is SRCH_WIN_N = 9, which is 80
chips wide
PN360
Neighbor
Sector
10 KM
41 chips
+41
PN200
2 KM
8 chips
Active
Sector
October, 2007
360
+8
360+33c
SRCH_WIN_N
Course 120+: 180
Worst-Case Wide Neighbor Window Situation

BTS A
BTS B
1/2
mile
12 miles
Q In some terrain, it is possible for a mobile to be very close to one BTS

and far from another BTS, yet need them both in soft handoff
Q This occurs when local terrain or buildings obstruct the signal of the near
BTS, making it much weaker than normal
The far BTS may have much more favorable conditions, such as an
over-water path
The signals of the two BTSs may seem equally strong!
Q Almost the entire distance between the BTSs appears as timing skew
If near BTS is reference PN, distant BTS is late this number of chips
If far BTS is reference PN, near BTS is late by this number of chips
October, 2007
Course 120+: 181
Safe Initial Neighbor Search Window Value

Determining Safe
Q Examine a cell map for an area of your system
Initial SRCH_WIN_N
Q Identify the farthest-apart pair of cells likely to
be used in soft handoff
F
D
Their distance separation determines
maximum timing skew a mobile could ever
E
possibly encounter in this part of the
B
system
11.5 KM
Q Calculate the timing skew in chips
C
A
6.7 chips times miles or 4.1 chips times
kilometers
Required Window
Safe required window size = two times the
= 4.1 x 11.5 x 2 = 94.3 chips
skew
SRCH_WIN_N = 10
Q Refer to table to convert required window size If locations
exist near site A
in chips to required value of SRCH_WIN_N
where mobiles are in handoff with
site F, mobiles could encounter
Q After thorough drive-test data is available, it
neighbor pilot timing skews as
may be possible to reduce SRCH_WIN_N if
large as the A-F distance. If
locked to A, F looks late by this
observed delay spread is significantly
amount. If locked to F, A looks
narrower than the window
early by this amount. Window
must be twice the skew value.
October, 2007
Course 120+: 182
Search Window Settings: Remaining Set

Q Remaining set search window size is
determined by maximum possible timing
skew in the same way as for neighbor set
window
Q Recommended SRCH_WIN_R is one or two
steps greater than SRCH_WIN_N
Q Remaining set pilots can be requested by the
mobile in a PSMM but the system cannot
assign traffic channels since it uses the
Neighbor Pilot Database as its crossreference for identification of their base
stations
Q There is still value in allowing mobiles to find
and request remaining pilots, since the
requests help system RF engineers identify
missing pilots that should be added to the
neighbor lists of various sectors
October, 2007
F
E
11.5 KM
A
Course 120+: 183
Search Window Initial Settings: Active Set
October, 2007
Active Search Window

40 chips wide (typical)
-20
+20
Ec/Io
Q Neighbor and Remaining search window

centers are indexed against the mobiles
Reference PN
Q Each active search window is different a
floating window centered over the earliest
observed multipath energy during the previous
mobile searcher scan of that individual pilot
Q Active search windows need not accommodate
distance-based timing skews they float
centered on their respective pilots!
Q The only timing variations they must
accommodate are multipath delay spreads
Q Multipath delay spreads are determined by
terrain and clutter-driven scattering and
reflection of the signal
Q Measurements are better than predictions to
set SRCH_WIN_A
Earliest Detected
Multipath
The earliest arriving multipath
seen by the mobile during this
searcher sweep will be used
as the center of this active
window on the next searcher
sweep! This makes each
active search window "track"
individually with its pilot.
Course 120+: 184
SRCH_WIN_A Settings from Measurements
Q
Q
Q
Q
Typical active set delay spread from actual drive-tests

Notice the narrow distribution of energy!
28-chip width, SRCH_WIN_A = 6, is enough for this case
Drive-test your own system to determine your own value of spread
It is determined by the signal-scattering characteristics of your terrain
October, 2007
Course 120+: 185
The Potential for PN Problems and Conflicts

Q After seeing the skewing effects of propagation, it is easy to
anticipate problems of PN confusion and misidentification!
There are many different kinds of possible PN problems:
Q Two same-PN base stations with areas of coverage overlap
Mobiles can't distinguish them, experience horrible FER
Q Combining unintended signals into the handoff mix being heard
The new signals cause interference instead of helping
Q Mistaken identity of signals when requesting handoff
The wrong base station is added, the mobile can't hear it
Q Running out of available PNs due to bad parameter choices
Fortunately, these problems can be avoided by careful planning!
October, 2007
Course 120+: 186
Co-Active PN Demodulation Errors

ACTIVE SEARCH WINDOW
BTS A
PN 142
BTS B
PN 142
x miles
x miles
Q Mobile is midway between two BTSs with the same PN, in a call on BTS A
Q PN energy of BTS A and B is indistinguishable in active search window
Q Rake fingers may be assigned to both A and B energy
If the walsh code used on A also happens to be in use by someone on
BTS B, demodulation of B will cause severe FER
The mobile audio will frequently clip and mute, and the call may drop
All the while, the phone will see very good Ec/Io since both A and B
are recognized as good energy!
Q Solution: Two different BTS covering the same area should never have
the same PN offset. Change the PN offset for one of the sectors involved.
October, 2007
Course 120+: 187
Adjacent-Active-PN Demodulation Errors

BTS A
PN 100
BTS B
PN 99
1 mile
11 miles
Q Mobile is in a call on BTS A from 1 mile away; A is the reference PN

Q The signal from BTS B on PN 99 travels 11 miles to the mobile and is
approximately as strong as BTS A due to terrain effects
Q Due to propagation delay, the signal of B is skewed and falls inside the
active search window of the mobile for A
A and B energy are indistinguishable to the mobile
Rake fingers may be assigned to both A and B multipaths
If the walsh code used by the mobile on A also is in use by someone
else on B, the mobile may demodulate their symbols and combine
them with its own symbols from BTS A
This would cause severe FER and possibly a dropped call
Q Solution: The PNs of the two BTSs are too close together. Use a different
PN offset for BTS B.
October, 2007
Course 120+: 188
PILOT_INC Helps Avoid PN Problems

Q Imagine a network with base stations spaced
approximately 10 miles apart - this is 1 PN offset!
Q Recall if we use adjacent PNs for adjacent base
stations, there will be locations where their PNs are
close together or even indistinguishable
Q It would be smart to assign PNs farther apart!
Q If properly set, PILOT_INC can prevent this problem
Only PNs divisible by PILOT_INC are allowed to
be assigned to sectors
Q PILOT_INC can be chosen from 1 to 16
If too small, interfering PNs can be assigned
If too large, the pool of available PNs is small
Q PILOT_INC is set based on the density of cells
3 or 4 in typical cities with suburban density
2 in dense urban environments
6 or 8 in very rural areas
October, 2007
Course 120+: 189
Adjacent-Neighbor PN Recognition Errors

BTS A
PN 100
20 miles
BTS
BTS G
PN 198
BTS
NEIGHBOR SEARCH WINDOW
mo
un
tai
ns
BTS F
PN 200
BTS
Q Mobile is in a call on BTS A, PN 100

Q Mobile checks neighbor PN 200 to see if handoff needed with BTS F
Q Energy from distant BTS G on PN 198 is skewed so that it falls in the
neighbor search window for PN 200; mobile asks for handoff with F
Q The system sets up a traffic channel on BTS F - but mobile hears G!
Q If the walsh code assigned on F happens also to be in use on G, the mobile
may put a rake finger on it and include it in the mix
Severe FER and a possible dropped call will result!
Q Solution: Careful RF design to avoid such "pockets" of distant coverage
If signal of G can't be reduced by RF methods, assign it to a different PN
October, 2007
Course 120+: 190
Sector PN Assignments:
Consecutive Assignment
Q Use only PNs divisible by PILOT_INC.
PILOT_INC is chosen large enough to
prevent aliasing of pilots in adjacent cells
Q Assign PNs in sequence to the sectors of all
the base stations
Q Common Usage: This is the typical default
method used in Nortel and Motorola CDMA
networks
Q Advantage
Simple assignment
When adjacent PNs are observed in the
field, they are known to be from sister
sectors of the same BTS or from nearby
BTSs
October, 2007
12
96
88
24
92
20
84
108
100
76
80
36
104
112
116
28
32
72
120
16
64
68
48
40
44
60
52
56
Course 120+: 191
Sector PN Assignments:
Segment Assignment
Q Assign only PNs divisible by PILOT_INC
PILOT_INC is chosen to avoid aliasing
Q Different ranges of PN values are reserved
First 1/3 of PN offsets for alpha sectors
Second 1/3 of PN offsets for beta sectors
Third 1/3 of PN offsets for gamma sectors
Q Although 512/3 = 170.666, the value 168 is
usually used for the inter-sector PN increment
Q Common Usage: default in Lucent networks
Q Advantage: In the field, interference is
suddenly noticed from PN 468. Quickly, what
is the source of it?
Definitely some cells gamma sector!
October, 2007
340
368
32
172
344
200
176
364
372
36
28
196
348
204
40
208
12
180
360
376
24
192
352
16
184
356
20
188
Course 120+: 192
PN Reuse Explorations
October, 2007
Course 120+: 193
PN Reuse Symmetrical N=37 Pattern
October, 2007
Course 120+: 194
PN Symmetrical N=37 Reuse Pattern Exploded View
October, 2007
Course 120+: 195
Chapter 3
Performance
Performance Optimization
Optimization
and
and Optimization
Optimization Tools
Tools
October, 2007
Course 120+: 196
What is Performance Optimization?

Q Performance Optimization involves design and modification of the network,
gathering and analysis of data, adjustments to network parameters, and
constant evaluation of current network conditions
The work includes complex design and simulations, nuts-and-bolts call
processing troubleshooting and hardware testing, to growth
management and planning
Q System Performance Optimization includes many different smaller
processes at many points during a systems life
Evaluating the system design with simulation tools to evaluate the
performance and capacity of the system
Finding workarounds for design issues (cant build a crucial site, too
much overlap/soft handoff, coverage holes, etc.)
cluster testing and cell integration to ensure new BTS hardware
works, datafill is proper, and call processing is normal
fine-tuning system parameters for the best possible call performance
Fixing root causes of specific problems and customer complaints
carefully watching system traffic growth and managing the problems it
causes - implementing short-term fixes to ease hot spots, and
recognizing problems before they become critical
Q It takes many different skills and perspectives to optimize wireless networks
October, 2007
Course 120+: 197
Performance Optimization Phases/Activities

Phase
Drivers/Objectives
Activities
Main Tools
Success Indicators
RF Design and
Cell Planning
Cover desired area;

have capacity for
anticipated traffic
Plan cells to effectively cover

as needed and divide traffic
load appropriately
Prop. Models,
Test Transmitters,
planning tools
Model results
New Cluster
Testing and
Cell Integration
Ensure cells properly

constructed and
configured to give
normal performance
Drive-test: coverage, all

handoff boundaries, all call
events and scenarios
Drive-test tools;
cell diagnostics and
hardware test
All handoffs occur;

all test cases
verified
Solve Specific
Performance
Problems
Identify problems
from complaints or
statistics; fix them!
Detect, Investigate, Resolve

performance problems
Drive-test tools,
system stats,
customer reports
Identified
problems are
resolved
Well-System
Performance
Management
Ensure present plant

is giving best possible
performance
Watch stats: Drops, Blocks,

Access Failures; identify/fix hot
spots
System statistics
Acceptable levels
and good trends
for all indicators
Capacity
Optimization
Manage congested
areas for most
effective performance
Watch capacity indicators;

identify problem areas, tune
parameters & configuration
Smart optimization
of parameters;
system statistics
Stats-Derived
indicators; carried
traffic levels
Traffic analysis and

trending tools;
prop. models for
cell spliiting; carrier
additions
Sectors are
expanded soon
after first signs of
congestion;
capital budget
remains within
comfortable
bounds
Growth
Management:
Optimizing both
Performance
and Capital
Effectiveness
Q hello
October, 2007
Overall traffic
increases and
congestion;
competition for capital
during tight times
Predict sector and area

exhaustion: plan and validate
effective growth plan, avoid
integration impact
Course 120+: 198
Good Performance is really Simple!!
BTS
BTS
BTS C
BTS B
BTS A
Ec/Io
BTS
FORWARD
available LINK
power
Traffic
Channels
In use
Paging
Sync
Pilot
October, 2007
Q Although there are many phases of optimization

activities, good performance is really just
compliance with a very simple idea
Q One, Two, or Three good signals in handoff
Composite Ec/Io > -10 db
Q Enough capacity for the offered traffic
No resource problems
-10
In principle, a COW next door can
solve almost any CDMA problem!
Reality Check:
1. But who has enough regular cells OR cows or money to
fix every problem location?!!
2. Problems occur in the areas between cells dominant
coverage. Adding a cow only pushes the problems
out to its own boundary with other cells.
Conclusion: We need to design better, and to use our
existing cells more effectively. We need to provide
one, two, or three dominant signals everywhere.
Course 120+: 199
Bad Performance Has Many Causes

+41
+8
360
A
360+33c
BTS
B
BTS
BTS Sector Transmitter
No
Available
Power!
Traffic
Channels
In Use
Paging
Sync
Pilot
BTS Rx Pwr
Overload
CEs
Vocoders
Selectors
BTS A
PN 100
BTS B
PN 99
1 mile
11 miles
October, 2007
Q Weak Signal / Coverage Hole

Q Pilot Pollution
Excessive Soft Handoff
Q Handoff Failures, Rogue mobiles
Missing Neighbors
Search Windows Too Small
BTS Resource Overload / No Resources
No Forward Power, Channel
Elements
No available Walsh Codes
No space in Packet Pipes
Q Pilot Surprise ambush; Slow Handoffs
Q PN Plan errors
Q Slow Data Problems: RF or IP congestion
Q Improper cell or reradiator configuration
Q Hardware and software failures
Q But on analysis, all of these problems bad
effects happen because the simple few-signal
ideal CDMA environment isnt possible.
Course 120+: 200
Early Assessment and RF Optimization Steps

Q RF Coverage Control
try to contain each sectors coverage, avoiding gross spillover into
other sectors
tools: PN Plots, Handoff State Plots, Mobile TX plots
Q Neighbor List Tuning
try to groom each sectors neighbors to only those necessary but be
alert to special needs due to topography and traffic
tools: PSMM data from mobiles; propagation prediction
Q Search Window Settings
find best settings for SRCH_WIN_A, _N, _R
especially optimize SRCH_WIN_A per sector using collected finger
separation data; has major impact on pilot search speed
Repeat as necessary until no large problems remain
Q Access Failures, Dropped Call Analysis
finally, iterative corrections until within numerical goals
Q IP Data Performance Assessment
Identify, manage, resolve latency and throughput issues
Getting these items into shape provides a solid baseline and foundation for
comparison, tracking, and planning in the future.
October, 2007
Course 120+: 201
Performance Monitoring/Growth Management

Q Benchmark Existing Performance from system-side data
Dropped Call %, Access Failure %, traffic levels
Q Identify Problem Cells and Clusters
weigh cells and clusters against one another
Investigate and resolve any problems, using field drive data if needed
Q Look for signs of Overload
TCE or Walsh minutes -- excessive ? Soft handoff excessive?
Required number of channel elements -- excessive?
Forward Power Overloads: Originations, Handoffs blocked
Q Traffic Trending and Projection
track busy-hour traffic on each sector; predict exhaustion
develop plan for expansion and capacity relief
split cells, multi-sector expansions, multiple carriers
Q Use high-level simulation tools to gain insight into user statistics
Compare different cell configurations against statistically generated
traffic simulations to identify what works best, and try it out!
This process never ends. The community, the system, and the customers are
always growing and presenting new problems and capacity needs.
October, 2007
Course 120+: 202
CDMA Problems, Causes, and Cures

PROBLEMS
Q Excessive Access Failures
Q Excessive Dropped Calls
Q Forward Link Interference
Q Slow Handoff
Q Handoff Pilot Search Window Issues
Q PN Planning Considerations
Q Excessive Soft Handoff
Q Grooming Neighbor Lists
Q Software Bugs, Protocol Violations
EXAMPLES
Q Normal Call
Q Dropped Call - Coverage
Q Dropped Call - Neighbor List
Q Dropped Call - Search Window
October, 2007
Course 120+: 203
Analyzing
Analyzing System-Side
System-Side Data
Data
October, 2007
Course 120+: 204
Resources on System and Switch Data

Q CDMA networks are complex, including large conventional telephone
switches, high-capacity CDMA system peripherals such as BSCs, CBSCs,
and Access Managers, and many base stations (BTSs) which are usually
multi-carrier
A network is literally a CITY of processors and software
Q The specific performance statistics and event counters ('peg counts') are
best described in official documentation from the network manufacturers
However, current documentation always seems to lag behind cuttingedge hardware and software releases
Q Each manufacturer publishes help on its own hardware & software:
Lucent: Wireless Networks Systems Documentation CDs
Application notes; many good training courses
Nortel: Helmsman CD, documents, training courses
Motorola: Planning Guides, documents, training courses
Q This course focuses on the generic key indications to observe, and the
analytical skills and perspective necessary for optimization
The manufacturers' documentation will describe the actual counters
and measurements available from your network
October, 2007
Course 120+: 205
Percent
Total Blocked Call Percentage Example

Total Block Call Percentage
8.0%
7.5%
7.0%
6.5%
6.0%
Blkd
5.5%
5.0%
4.5%
4.0%
3.5%
3.0%
2.5%
2.0%
1.5%
1.0%
Date
Q This is an example of a cumulative system-wide total blocked call

percentage chart maintained in one market
October, 2007
Course 120+: 206
Percent
Dropped Call Percentage Tracking Example
Total Drop Call Percentage

5.0%
4.5%
%Drops
4.0%
3.5%
3.0%
2.5%
2.0%
1.5%
1.0%
0.5%
0.0%
Date
Q Dropped call percentage tracking by one market

October, 2007
Course 120+: 207
Total System Daily MOU Example
MOU
Daily Total System MOU
300000
Daily Total System MOU
250000
200000
150000
100000
50000
Date
Q Total system daily MOU plotted by one market

October, 2007
Course 120+: 208
Top Ten Performance Tracking Example

Call Attempts
3000
2500
2000
1500
1000
500
108.1
43.3
108.2
1.3
Sector
102.2
137
130
65
101
83
49
30
24
46
31
7.5
5.1
5.1
4.5
4.3
3.0
2.9
2.8
2.6
1.9
136
130
65
101
83
49
30
24
45
31
7.4
5.1
5.1
4.5
4.3
3.0
2.9
2.8
2.6
1.9
110
145
90
93
66
66
58
112
83
81
6.0
5.7
7.0
4.1
3.4
4.1
5.7
13.1
4.8
5.0
8.0
7.0
6.0
5.0
4.0
3.0
2.0
1.0
0.0
Sector
26.3
84.5
87.2
85.7
89.9
90.7
91.6
90.2
81.6
91.3
91.7
% Blocked Calls
64.1
1549
2234
1098
2017
1743
1486
926
698
1589
1495
%Acc Drop %Drop

Fail Calls Calls
63.2
1833
2561
1282
2244
1922
1623
1027
855
1740
1630
Acc
Fail
1.2
Call %Call Block %Blck

Call Att Succ Succ Calls Calls
2.1
93Z
13X
57Z
2X
1Y
57Y
93X
35Z
30Y
1Z
Call Attempts
63.3
64.3
6.1
63.3
2.1
1.2
63.2
64.1
26.3
108.2
1.3
5.7
4.1
3.4
6.0
4.8
5.0
4.1
4.3
3.6
3.6
6.1
MSC
Site
145
93
66
110
83
81
66
70
54
53
September 5, 1997
% Blocked Calls
Eng
Site
5.1
4.5
4.3
7.4
2.6
1.9
3.0
1.1
1.8
0.3
63.2
130
101
83
136
45
31
49
18
27
4
1.3
5.1
4.5
4.3
7.5
2.6
1.9
3.0
1.1
1.8
0.3
108.2
130
101
83
137
46
31
49
18
27
4
64.3
87.2
89.9
90.7
84.5
91.3
91.7
91.6
92.6
93.1
94.8
1.2
2234
2017
1743
1549
1589
1495
1486
1495
1387
1410
2.1
2561
2244
1922
1833
1740
1630
1623
1615
1490
1488
%Acc Drop %Drop

Fail Calls Calls
6.1
13X
2X
1Y
93Z
30Y
1Z
57Y
4Y
30X
42Z
Acc
Fail
64.3
6.1
2.1
1.2
64.3
108.2
1.3
63.2
102.2
108.1
43.3
Call %Call Block %Blck

Call Att Succ Succ Calls Calls
Calls
MSC
Site
Eng
Site
Q Many markets use scripts or spreadsheet macros to produce

ranked lists of sites with heavy traffic, performance problems, etc.
October, 2007
Course 120+: 209
Bracketing: Fault Notification and Alarming

Historic Performance Data and Automatic Alarming
Q Some operators develop their

own software for monitoring
and tracking performance data
Q Each new 30-minute period is
compared against a six-week
average for that day and time
Q If the new value is outside
user-selectable tolerances
(typically +/- 30%), an alarm is
sent to operations personnel
By SMS or pager
Q The tolerance values can be
adjusted to produce
reasonable numbers of alarms
Typically 20-40 alarms per
day
October, 2007
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
SM TWT F S SM TWT F S SM TWT F S SM TWT F S SM TWT F S SM TWT F S SM TWT F S
TOO LOW
+30%
NORMAL
TOO HIGH
+30%
+30%
-30%
-30%
6-week average
-30%
If an important performance statistic varies

outside a user-specified range, an alarm message
is sent automatically to the performance specialist
responsible for that base station.
Course 120+: 210
Autonomous
Autonomous Data
Data Collection
Collection
By
By Subscriber
Subscriber Handsets
Handsets
October, 2007
Course 120+: 211
Autonomous Collection:
A New Way to See Network Performance
Collection Server
software download
collected data upload
data management, analysis
BTS
PDSN/Foreign Agent
Internet
VPNs
PDSN
Home Agent
Backbone
Network
SECURE TUNNELS
Authentication
Authorization
Accounting
AAA
BTS
T
R-P Interface
BTS
PSTN
t1
Switch
t1
v SEL
t1
BTS
Q An exciting new trend in network RF performance is to embed data

collection software on mobile platforms
Q Offers big advantages for RF optimization cost/effectiveness
October, 2007
Course 120+: 212
Using Autonomous Collection

Collection Server
software download
BTS
PDSN/Foreign Agent
BTS
Backbone
Internet
Network
T SECURE TUNNELS T
VPNs
PDSN Authentication
Authorization
R-P Interface
Home Agent Accounting AAA
BTS
PSTN
t1
Switch
t1 v
SEL
t1
(C)BSC/Access Manager BTS
Q A Server downloads software to a large population of subscriber mobiles

Q Mobiles collect on custom profiles
all or groups of mobiles can be enabled/disabled
new triggers can be rapidly developed and downloaded when desired
Q Mobiles upload compacted packets to server driven by custom triggers
may be immediately if needed, or at low-traffic pre-programmed times
collected data can include location/GPS/call event/L3
messaging/timestamps/etc.
Q Server manages data, provides filtering and reporting
Q Performance optimizers use terminals and post-processing software
October, 2007
Course 120+: 213
Advantages of Autonomous Collection

Q Mobile-reported data can be
location-binned
post-processing provides
visual identification of problem
areas
Q Collection can be rapidly enabled
per cell or area for immediate
investigation of problem reports
Q Requires less employee drive time
for collection
Q Customer mobiles cover area
more densely than drivetesters
Q Customer mobiles include inbuilding populations
Q Individual mobile identification can
be included with customer
permission for direct customer
service interaction
October, 2007
Course 120+: 214
Current Issues in Autonomous Collection

Collection Server
software download
BTS
PDSN/Foreign Agent
BTS
Backbone
Internet
Network
T SECURE TUNNELS T
VPNs
PDSN Authentication
Authorization
R-P Interface
Home Agent Accounting AAA
BTS
PSTN
t1
Switch
t1 v
SEL
t1
(C)BSC/Access Manager BTS
Q Requires extensive software capability to develop/manage

current progress is from specialty application consulting houses
Q Requires cooperation of handset vendor to effectively integrate software
onto handset platform
caution required to avoid negative call processing side-effects
Q Privacy issues involved if any user-specific data tracking
Q Additional network capacity required for large-scale reporting
October, 2007
Course 120+: 215
Introduction
Introduction to
to Field
Field
Optimization
Optimization Tools
Tools
October, 2007
Course 120+: 216
Introduction To CDMA Field Tools: Topics

Q Two Important Concepts
The Department Store Analogy - Tops-Down vs. Bottoms-Up
The Aeronautical Analogy - Accident Investigation Resources
Q Survey of CDMA Field Tools
Mobile Tools
Handsets - Maintenance Displays
October, 2007
Course 120+: 217
CDMA Field Test Tools

Field Collection Tools using Handset Data
Qualcomm
Motorola
Andrew
MDM, CAIT
Agilent
Comarco
PN Scanners
Agilent
Berkeley
Varitronics
Andrew
Qualcomm
DTI
TouchWave
TouchWave
Ericsson
TEMS
Q There are many commercial CDMA field test tools

Q Characteristics of many test tools:
capture data from data ports on commercial handsets
log data onto PCs using proprietary software
can display call parameters, messaging, graphs, and maps
store data in formats readable for post-processing analysis
small and portable, easy to use in vehicles or even on foot
Q A few considerations when selecting test tools:
does it allow integration of network and mobile data?
Cost, features, convenience, availability, and support
new tools are introduced every few months - investigate!
October, 2007
Course 120+: 218
Andrews Invex3G Tool

Q 100 MB ethernet connection to
PC
Q the eight card slots can hold
receivers or dual-phone cards
Q theres also room for two
internal PN scanners
Q Multiple Invex units can be
cascaded for multi-phone loadtest applications
Q Cards are field-swappable Users can reconfigure the unit
in the field for different tasks
without factory assistance
October, 2007
Course 120+: 219
Grayson Invex Playback Example

76.8
kb/s
This mobile is in a 4-way soft handoff

(four green FCH walsh codes
assigned) in the middle of a downlink
SCH burst. Notice walsh code #2, 8
chips long, is assigned as an SCH
but only on one sector, and the
downlink data speed is 76.8kb/s.
October, 2007
220

153.6
kb/s
This mobile is in a 2-way soft handoff

(two green FCH walsh codes
assigned) in the middle of a downlink
SCH burst. Notice walsh code #3, 4
chips long, is assigned as an SCH
but only on one sector, and the
downlink data speed is 153.6kb/s.
October, 2007
Course 120+: 221

F-SCH rates 153.6 kbps; R-SCH 76.8kbps
CDMA Status
PN Scanner Data
Current Data Task Status
October, 2007
Layer-3 Messages
222
Agilent Drive-Test Tools

Q Agilent offers Drive-Test tools
Serial interfaces for up to four
CDMA phones
A very flexible digital receiver
with several modes
Q PN Scanner
Fast, GPS-locked, can scan
two carrier frequencies
Q Spectrum Analyzer
Can scan entire 800 or 1900
mHz. Bands
Q Base-Station Over-Air Tester
(BOAT)
Can display all walsh channel
activity on a specific sector
Useful for identifying hardware
problems, monitoring
instantaneous traffic levels, etc.
Q Post-Processing tool: OPAS32
October, 2007
Course 120+: 223
PN Scanners
Q Why PN scanners? Because phones cant
scan remaining set fast enough, miss
transient interfering signals
Q Berkeley Varitronics
high-resolution, GPS-locked
full-PN scan speed 26-2/3 ms.
2048 parallel processors for very fast
detection of transient interferors
Q Agilent (formerly Hewlett-Packard)
high resolution, GPS-locked
full-PN scan speed 1.2 sec.
Integrated with spectrum analyzer and
phone call-processing tool
Q Andrew
lower-cost, low-end solution
full-PN scan speed 6.3 sec.
integrated with phone & call-processing
data collection tool
high-end version also available using
Berkeley Scanner
October, 2007
Course 120+: 224
Post-Processing Tools
Windcatcher
Analyzer
Interpreter
Post-Processing tools display drive-test files for detailed

analysis - Faster, more effective than studying data
playback with collection tools alone
Q Actix Analyzer
Imports/analyzes data from almost every brand of
drive-test collection tool
Q Andrew (formerly Grayson) Interpreter
Imports/analyzes data from Andrew Invex3G
Q Nortel RF Optimizer
Can merge/analyze drive-test and Nortel CDMA
system data
Q Xceed Technologies Windcatcher
Imports/analyzes data from almost every brand of
drive-test device
Q Xceed Technologies Vortex
Provides automated analysis of data from manual,
autonomous, and stand-alone sources
Q Verizon/Airtouch internal tool DataPro
October, 2007
Vortex
Course 120+: 225
Drive-Tests: Phones
Maintenance
Maintenance Features
Features of
of
CDMA
CDMA Handsets
Handsets
October, 2007
Course 120+: 226
Handsets as Tools: Simple but always Available!

Q Most CDMA handsets provide some form of maintenance display (Debug
Mode) as well as instrumentation access
all CDMA drive-test tools use handsets as their front-ends
Using the handset as a manual tool without Commercial Test Tools:
Q Enter the maintenance mode by special sequence of keystrokes
Q Displayed Parameters
PN Offset, Handset Mode, Received RF Level , Transmit Gain Adjust
Q Maintenance Display Applications
best serving cell/sector
simple call debugging (symptoms of weak RF, forward link
interference, etc.)
Q Handset Limitations during manual observation
no memory: real-time observations only; no access to messages or
call details; serving PN offset not updated during voice calls
October, 2007
Course 120+: 227
Interpreting Samsung Maintenance Display:

Acquisition, Idle, and Access States
Display toggles between:
System Identifier (SID)
Network Identifier (NID)
Transmit
Gain Adjust,
db
Reference
PN Offset
System Protocol
Revision Level
Radio Configuration
(Idle mode = 0, 0)
October, 2007
Slot Cycle Index
0 - Pilot Channel Acquisition Substate

1 - Sync Channel Acquisition Substate
2 - MS Idle State
3 - System Access State
4 - Traffic Channel State
5,6,7 - various call service options
Processing State
Debug Screen
S04274 SI2 2
T-56 D070-04
P0060 CH0350
PR6 RC0 0Z11
Receive
Power,
dbm
Ec/Io, db
(primary PN only)
Carrier Freq.
(Channel #)
V206T144L:02
Packet Zone ID
Course 120+: 228
Interpreting Samsung Maintenance Display:

Traffic Channel State
Transmit (RL)
Vocoder Rate
1 = 1/8
2 = 1/4
4 = 1/2
8 = Full
Transmit
Gain Adjust,
db
PN Offset
System Protocol
Revision Level
Service Option
Live Cumulative
FER
October, 2007
FCH
Receive (FL)
Vocoder Rate Walsh Code
0 - Pilot Channel Acquisition Substate

1 - Sync Channel Acquisition Substate
2 - MS Idle State
3 - System Access State
4 - Traffic Channel State
5,6,7 - various call service options
Processing State
Debug Screen
TE8 RE8 40 6
T-10 D070-04
P0060 CH0350
PR6 RC33 Z11
SO00003 G207
F001.54%L:02
Receive
Power,
dbm
Ec/Io, db
(primary PN only)
Carrier Freq.
(Channel #)
Packet Zone ID
Radio Configuration
(RC3, RC3 common)
Course 120+: 229
Denso Maintenance Display

Charging Battery Voltage
Average Battery Voltage
System ID
Network ID
RF Channel Frequency
Digital PN Offset
Number of Bad Frames
Number of Good Frames
Base Station coordinates
Current status of Rake Fingers
Active Pilot Set
Candidate Pilot Set
October, 2007
D
CBV: 3957
ABV: 3954 ABT: 031
ARF: 0000 CCL: 01
SID: 04157
NID: 00001
CH: 0100 RSSI: 093
DPN: 084 TX:-46
BFRM:0000000968
TFRM:0000135712
FER:% 000.71
LT: 036:06:36
LG: -086:45:36
EC: -16 -63 -63
PN: 084 084 084
FNGLK: Y Y N
WLSH: 01 01 01
ACT: 084 484 096
-01 -01 200
CND: 220 332 200
200 332 NGH: 076
080 340 068 196
O56 320 220 316
344 488 196 200
392 124 128 084
224 008 084
Average Battery Temperature
Received Signal Strength

Estimated Transmitter
Power Output
Frame Erasure Rate, Percent
Neighbor Pilot Set
Course 120+: 230
Sanyo SPC-4500 Maintenance Display

Q
Q
Q
Q
Q
Q
Q
Q
Q
October, 2007
Choose the following:

DISPLAY
OK
0
OK
Enter Code: 0 0 0 0 0 0
Debug Menu
SCREEN
OK
Course 120+: 231
Sanyo SPC-4900 Maintenance Display

Call Proc. State
Q
Q
Q
Q
Q
##
040793
select MENU/OK button
scroll to save Phone #
select
October, 2007
PN offset
Receive
Power
Io
Channel
Frequency
Course 120+: 232
The Motorola Q
Q Getting Into Maintenance Mode:
Enter # # 3 3 2 8 4 #
Press the green Talk button
A Field Test Mode screen will appear
Choose one:
A Call Status Screen <<< USE
(this is the main maintenance display)
B Field Test Menu
(this controls special test modes and
GPS/HDR settings)
C GPS data
(shows various GPS parameters)
D Debug Information
I/O register and error log display
Q Getting Out of Maintenance Mode:
Press EXIT at bottom of Field Test Mode screen
October, 2007
Course 120+: 233
Maintenance Display on the Motorola Q:

The CDMA Parameters
Strongest Active Pilot

PN
Ec/Io (-)
Number of
Actives
Number of
Candidates
Strongest Neighbor Pilot

PN
Ec/Io (-)
Transmit Power, dbm
Receive Power, dbm

Current Service Option
CDMA 111
186
84
NA
EVDO 100
111
OPN
Carrier
Channel #
60 1 20 P 50
120 0 IDL CE
H N/A 0.00 0
4139 43 6 2 0
120 0x785B64D2 5
79 -77 -128 128 7
ACC 0 70.11.225.186
SID
October, 2007
Number of
Neighbors
Band:
P=PCS, C=800
NID
Call Processing
State
Reason Last
Call Ended
# dropped calls
# total calls
Avg. FER
Course 120+: 234

CDMA Call Proc. States, Call End Reasons
8V 8K voice original
IL 8K loopback
8EV 8K EVRC
8S 8K SMS
13L 13K loopback
13S 13K SMS
8MO 8K Markov Old
DAT Data
8M 8K Markov New
13M 13K Markov New
13V 13K Voice
October, 2007
Call Processing States

CP CP Exit
RST CP Restart
RTC Restricted
PLT Pilot Acquisition
SYN Sync Acquisition
TIM Timing Change
BKS Background Sch
IDL Idle
OVD Overhead
PAG Paging
ORG Call Origination
SMS Short Message Svc
ORD Order Response
REG Registration
TCI Tfc Ch Initialization
WFO Waiting for Order
WFA Waiting for Answer
CON Conversation state
REL Release
NON No State
Last Call End Indicator

NI No Indication yet
MR Mobile Release
BR Base Sta. Release
TC Traffic Channel Lost
L2 Layer 2 Ack Fail
NC No Channel Assn Msg
N5 N5M failure
BS BS Ack failure
WO L3 WFO State Timeout
MP Max Probe Failure
PC Paging Channel loss
RR Reorder or Release on PCH
?? Unknown Condition
Course 120+: 235

The EVDO Parameters
UATI
Carrier
Channel #
PN
HDR Session State
CDMA 111
186
84
NA
EVDO 100
111
OPN
60 1 20 P 50
120 0 IDL CE
H N/A 0.00 0
4139 43 6 2 0
120 0x785B64D2 5
79 -77 -128 128 7
ACC 0 70.11.225.186
Receive
Power, dbm
October, 2007
IP Address
Course 120+: 236
Entering Maintenance Mode: Motorola StarTac

Contact your service provider to obtain your phones Master
Subscriber entity Lock (MSL). Then enter the following:
Q FCN 000000 000000 0 RCL You'll be prompted for your
MSL, enter it and press STO.
New prompts will appear, Press STO in response to
each prompt until no more appear. Dont delay continue quickly and enter:
Q FCN 0 0 * * T E S T M O D E STO
The display will briefly show US then just '.
Q Press 55#.
Step 1 will appear with its current setting displayed.
Press * to accept and move on to the next step. Repeat
for steps 2-8.
Q Step 9 (Option byte 2) is the only step requiring manual
changes. Enter 1 0 0 0 0 0 0 0 (The leftmost bit now set to
'1' is what enables test mode.)
Q Now press STO to accept the entry and exit back to the '
prompt.
Q Power off and back on.
Q You should now be in test mode!
October, 2007
Course 120+: 237
October, 2007
Course 120+: 238
Last Call Indicator

NI No Indication yet
MR Mobile Release
BR Base Sta. Release
TC Traffic Channel Lost
L2 Layer 2 Ack Fail
NC No Channel Assn Msg
N5 N5M failure
BS BS Ack failure
WO L3 WFO State Timeout
MP Max Probe Failure
PC Paging Channel loss
RR Reorder or Release on PCH
?? Unknown Condition
Battery
Local Time Condition
RX Power
Strongest Active
#
#
Channel
PN
Ec/Io Actives Neighbors Number
Strongest Neighbor
# Cand- Call Proc Last Call
Exit Reason
PN
Ec/Io idates
State
Rx Power Tx Power Last Call FER% # Drops
dbm
dbm (Io)
Current
# Calls
Service Option
SID
NID
Call Processing States ORG Call Origination
CP CP Exit
RST CP Restart
RTC Restricted
8V 8K voice original 13S 13K SMS
PLT Pilot Acquisition
IL 8K loopback
8MO 8K Markov Old SYN Sync Acquisition
TIM Timing Change
8EV 8K EVRC
DAT Data
Background Sch
8S 8K SMS
8M 8K Markov New BKS
IDL
13L 13K loopback
13M 13K Markov New OVD Idle
Overhead
13V
13K
Voice
PAG
October, 2007
120v5 (c) 2007 Scott Paging
Baxter
SMS Short Message Svc

ORD Order Response
REG Registration
TCI Tfc Ch Initialization
WFO Waiting for Order
WFA Waiting for Answer
CON Conversation state
REL Release
Course
NON
No120+:
State239
Motorola V120C Series

Q
Q
Q
Q
MENU 073887*
Enter 000000 for security code.
Scroll down to Test Mode.
Enter subscriber entity lock code
if required by your phone
Same maintenance display as

shown for Startac
October, 2007
Course 120+: 240
Motorola V60C
Q MENU 073887*
Q Enter 000000 for security
code.
Q Scroll down to Test Mode.
Q Enter subscriber entity lock
code if required by your phone
Same maintenance display as
shown for Startac
October, 2007
Course 120+: 241
Nokia 6185 Maintenance Display

Q Enter *3001#12345# MENU
Q Scroll down to Field test
Q Press Select
Q Scroll up to Enabled
Q Press OK
Q Power the phone off and on
Q You should now be in Field test mode
October, 2007
Course 120+: 242
Novatel Merlin C201 1xRTT Data Card

Q Enter # # D E B U G to enter maintenance mode.
Q To exit, just click OK box in the Debug window.
October, 2007
Course 120+: 243
Audiovox Thera Maintenance Mode Screens

How to enter
Debug Mode:
[ctrl] [D] [enter]
Advanced Usr Pwd:
##DEBUG [enter]
Protocol Statistics
October, 2007
Course 120+: 244
Sierra 580 1xEV-DO Rev 0 Aircard

Q To enter the maintenance display,
hover your cursor over the
Connection Manager main
indicator window or the Start
button and type ##debug.
Q The Network, Network 2, and HDR tabs provide the most useful
information on the air interface. The other tabs provide details of the
packet operations and error counters.
October, 2007
Course 120+: 245
Chapter 4
Multi-Carrier
Multi-Carrier Operation
Operation
Transitions
Transitions at
at System
System Boundaries
Boundaries
1x
1x Data
Data Performance
Performance
Additional
Additional Resources
Resources
October, 2007
Course 120+: 246
Its A
Multi-Carrier/Multi-System/Multi-Manufacturer
World!
Q Systems are forced to use multiple carriers to achieve needed traffic
capacity
Its important that the traffic load be divided between carriers
Q Physically adjacent friendly systems often desire to allow seamless mobile
operation across their borders, although they use different carrier
frequencies
Q Even within one large network, seamless mobile operation is desired
across serving switch boundaries
Q These situations are not completely solved in the original IS-95 CDMA
vision, so additional standards documents and additional proprietary
processes provide the needed functionality
IS-95: hashing or GSRMs can distribute idle mobiles among carriers
IS-41 - provides intersystem handoffs and call delivery
Proprietary algorithms can distribute in-call traffic among carriers
RF tricks and network proprietary algorithms can support inter-carrier
handoff
Q Multi-Carrier Operation is a complex sport
October, 2007
Course 120+: 247
Transitions at System Boundaries

IDLE
IDLE
IN-CALL
IN-CALL
Q Boundary types
between different operators
same frequency, different frequency, even different band
between different BSCs or Switches of Same Operator
same frequency, different frequency, even different band
between different carriers where number of carriers changes
same frequency, different frequency, even different band!
Q A reliable transition method must be planned for users in all
circumstances
all directions of approach
all modes of operation (idle, active voice call, dormant data session,
active data session)
October, 2007
Course 120+: 248
Foundation for Transition Troubleshooting

Q Multi-carrier and intersystem boundary transitions are complex
relationships between mobile, air interface, and system
to solve problems, its necessary to understand the basic actions of
mobile and the system
this information comes from the standard, summarized in the next
few slides
Q The mobiles actions are generic, defined by the standards, and
simpler/more specific than the steps taken by the system
A thorough knowledge of the mobile side is the easiest-to-get
resource for general troubleshooting of problems
Q For in-call transition troubleshooting, the systems generic and proprietary
algorithms must also be understood
artificial proprietary trigger mechanisms and internal system order
communications and IS-41 implementation
this information comes from manufacturer documentation
trunking and networking between adjoining systems
this information comes from operators own network design
October, 2007
Course 120+: 249
Foundation:
Foundation:
Understanding
Understanding Mobile
Mobile Actions
Actions
October, 2007
Course 120+: 250
Multi-Carrier Operation:
Mobiles Change Frequencies. When/Why/How?
Finding the System
Idle Mode
Call Start
In-Call Operation
Q There are many situations where a mobile should change

frequency
Finding a new system when turning on in a new location
Crossing a boundary and entering a new system when in idle
mode
Beginning a call on a sector that has more than one carrier
Crossing a boundary and entering a new system when in a call
Q Fortunately, there are defined triggers for all of these situations
October, 2007
Course 120+: 251
Finding the System
MRU
1025
650
25
125
250
175
384
100
375
675
625
825
PRL
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
Start at top
Of MRU and
Check until Look up found
A signal is Signal in PRL
found
And try to climb
To more preferred
Signal if available
October, 2007
Course 120+: 252
Idle Mode
Channel List Message
50, 125, 175
Hash and go!
October, 2007
Course 120+: 253
Idle Mode
Global Service
Redirection Message
ACCOLC:1111100000100000
GO TO CH. 225
If your ACCOLC is ON,
Go where they tell you!
October, 2007
Course 120+: 254
Idle Mode
Neighbor List Message

F1 PN240
F1 PN168
F1 PN336
F1 PN500
F1 PN372
F1 PN232
F2 PN240
F2 PN272
F3 PN240
F2 PN474
Check neighbors on
Other frequencies during
Unused paging slots.
If stronger than current
Active, do idle mode
Handoff to new frequencuy
October, 2007
Course 120+: 255
Idle Mode
50, 125, 175
Hash and go!
Global Service
Redirection Message
ACCOLC:1111100000100000
GO TO CH. 225
F1 PN240
F1 PN168
F1 PN336
F1 PN500
F1 PN372
F1 PN232
F2 PN240
F2 PN272
F3 PN240
F2 PN474
Check neighbors on
October, 2007
Course 120+: 256
Call Start
Getting Started:
Mobile sends
Page Response or
Origination Message
System evaluates
Present loading on
Each carrier and
Prepares a traffic
Channel on the
Carrier it prefers.
System sends channel
Assignment message
To the mobile
Mobile goes to the
Frequency it is told
Nortel: MCTA
Lucent: Pooling
Motorola: Pooling
October, 2007
Course 120+: 257
In-Call Operation
NORMAL SOFT HANDOFFS
Mobile monitors pilots
And sends PSMM to
Request handoffs
When it desires
No Frequency Changes
October, 2007
Course 120+: 258
In-Call Operation
HARD HANDOFFS
Mobile cannot see signals
On other frequencies.
System must use special
traps to trigger
And decide handoffs:
Pilot Beacons
PILOT
DATABASE
October, 2007
Course 120+: 259
In-Call Operation
HARD HANDOFFS
traps to trigger
Round-Trip Delay, or
Ec/Io and Quality Triggers
Border Cells
RTD rings
October, 2007
Course 120+: 260
In-Call Operation
And sends PSMM to
Request handoffs
When it desires
HARD HANDOFFS
traps to trigger
Pilot Beacons
PILOT
DATABASE
Border Cells
RTD rings
October, 2007
Course 120+: 261
Finding the System
Idle Mode
MRU
1025
650
25
125
250
175
384
100
375
675
625
825
PRL
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
XXX
Start at top
Of MRU and
Check until Look up found
A signal is Signal in PRL
found
And try to climb
To more preferred
Signal if available
50, 125, 175

Hash and go!
Global Service
Redirection Message
ACCOLC:1111100000100000
GO TO CH. 225
F1 PN240
F1 PN168
F1 PN336
F1 PN500
F1 PN372
F1 PN232
F2 PN240
F2 PN272
F3 PN240
F2 PN474
Check neighbors on
October, 2007
Call Start
Getting Started:
Mobile sends
Page Response or
Origination Message
System evaluates
Present loading on
Each carrier and
Prepares a traffic
Channel on the
Carrier it prefers.
System sends channel
Assignment message
To the mobile
Mobile goes to the
Frequency it is told
Nortel: MCTA
Lucent: Pooling
Motorola: Pooling
In-Call Operation
And sends PSMM to
Request handoffs
When it desires
HARD HANDOFFS
traps to trigger
Pilot Beacons
PILOT
DATABASE
Border Cells
RTD rings
Course 120+: 262
Hard Handoffs
Q Soft Handoff is the preferred mode in CDMA. Its diversity provides
excellent reliability and resistance to fading.
Q Soft Handoff is possible only if all these conditions are true:
the mobile is a one-frequency-at-a-time device, so all sectors in
handoff must be on the same carrier frequency
on the network side, all the base stations involved must have
packet paths in backhaul to the BSC/access manager currently
being used by the mobile. If more than one BSC/access
manager is involved, special packet links are required between
them
all new base stations being added in handoff must accept the
call using its current frame offset (rarely a concern)
Q If any of these conditions cannot be met, then the handoff must be
hard i.e., the mobile must give up its current links and quickly
jump to the new link or links
Q Notice that if the new target sector is on a different frequency than
the mobiles current call, the mobile will not even see its pilot and
will not know to request a handoff!
October, 2007
Course 120+: 263
Triggering Hard Handoffs in Traffic

Q Hard Handoffs during a mobiles call or data session can be
triggered by a variety of methods:
Pilot Beacon The mobile notices a rising pilot and sends a
Pilot Strength Measurement Message asking for handoff. The
system responds with an Extended Handoff Direction Message
with the Hard Handoff field enabled, and sending the mobile to
a different system or frequency.
Border-Cell Special Triggers Unknown to the mobile, it is now
using only one or more special sectors defined as border
sectors in the systems databases. Special tracking is going
on, either round-trip-delay measurement or Ec/Io reporting.
When the system decides the mobile has reached the trigger
conditions, it suddenly and without warning sends an Extended
Handoff Direction Message with the Hard Handoff field
enabled, sending the mobile to a different system or frequency
it is not unusual for the EHDM to list multiple target sectors
October, 2007
Course 120+: 264
Hard Handoff Messaging

(Beacon Trigger)
FORWARD TRAFFIC CHANNEL
BASE STATION
ACK. ORDER
EXTENDED HANDOFF
DIRECTION MSG.
NEW FORWARD TRAFFIC CH.

BASE STATION
ACK. ORDER
NEIGHBOR LIST
UPDATE MESSAGE.
IN-TRAFFIC SYS. PARAM.
MESSAGE (OPTIONAL)
October, 2007
REVERSE TRAFFIC CHANNEL

PILOT STRENGTH MEAS.
MSG. (BEACON SEEN)
MOBILE STATION
ACK. ORDER
NEW REVERSE TRAFFIC CH.

HANDOFF COMPLETION
MESSAGE
MOBILE STATION
ACK. ORDER
Course 120+: 265
Hard Handoff Messaging

(RTD Trigger)
FORWARD TRAFFIC CHANNEL
EXTENDED HANDOFF
DIRECTION MSG.
NEW FORWARD TRAFFIC CH.

BASE STATION
ACK. ORDER
NEIGHBOR LIST
UPDATE MESSAGE.
IN-TRAFFIC SYS. PARAM.
MESSAGE (OPTIONAL)
October, 2007
REVERSE TRAFFIC CHANNEL
MOBILE STATION
ACK. ORDER
NEW REVERSE TRAFFIC CH.

HANDOFF COMPLETION
MESSAGE
MOBILE STATION
ACK. ORDER
Course 120+: 266
f1
f1
October, 2007
Pilot
Traffic
Traffic
Traffic
Traffic
Traffic
Traffic
Traffic
IS-95
W0
wa
wb
wc
wd
wx
wy
wz
f2
Pilot
Traffic
Traffic
Traffic
Traffic
Traffic
Traffic
Traffic
IS-95
W0
wa
wb
wc
wd
wx
wy
wz
f3
Pilot
Traffic
Traffic
Traffic
Traffic
Traffic
Traffic
Traffic
IS-95
W0
wa
wb
wc
wd
wx
wy
wz
IS-95
f2
IS-95
f1
W0 Pilot
w1 Paging
wa
Data
w32 Sync
wx Traffic
wy Traffic
wz Traffic
f3
Pilot
Traffic
Traffic
Traffic
Traffic
Traffic
Traffic
Traffic
IS-95
W0
wa
wb
wc
wd
wx
wy
wz
f4
Pilot
Traffic
Traffic
Traffic
Traffic
Traffic
Traffic
Traffic
IS-95
W0
wa
wb
wc
wd
wx
wy
wz
Non-originating carriers
can carry more traffic!
W0 Pilot
w1 Paging
wa Traffic
wb Traffic
w32 Sync
wx Traffic
wy Traffic
wz Traffic
Basic Multi-Carrier
Operation
W0 Pilot
w1 Paging
wa Traffic
wb Traffic
w32 Sync
wx Traffic
wy Traffic
wz Traffic
W0 Pilot
w1 Paging
wa Traffic
wb Traffic
w32 Sync
wx Traffic
wy Traffic
wz Traffic
f2
f4
W0 Pilot
w1 Paging
wa Traffic
wb Traffic
w32 Sync
wx Traffic
wy Traffic
wz Traffic
f3
IS-95
W0 Pilot
w1 Paging
wa Traffic
wb Traffic
w32 Sync
wx Traffic
wy Traffic
wz Traffic
f4
W0 Pilot
w1 Paging
wa Traffic
wb Traffic
w32 Sync
wx Traffic
wy Traffic
wz Traffic
Many Network/Carrier Configurations are Possible!

Some Carriers may
support 1xRTT
1xRTT
IS-95
IS-95
IS-95
Course 120+: 267
CDMA2000
CDMA2000 1xRTT
1xRTT Systems
Systems
Data
Data Performance
Performance Optimization
Optimization
October, 2007
Course 120+: 268
The Big Picture:

IP Data Environment
T
PDSN
Home Agent
Backbone
Network
SECURE TUNNELS
Authentication
Authorization
Accounting
AAA
CDMA RF Environment
R-P Interface
BTS
PSTN
t1
t1
Switch
Traditional Telephony
SEL
t1
CE
CDMA IOS PPP
Coverage Holes
Pilot Pollution
Missing Neighbors
Fwd Pwr Ovld
Rev Pwr Ovld
Search Windows
Wireless
Island Cells
Mobile Device
Slow Handoff
Q 1xRTT services may include both traditional circuit-switched voice and

new fast IP data connections
A User's link is in multiple jeopardy, both radio and packet worlds
Q Radio environment portion
Problems: FER, drops, access failures, capacity woes
Causes: mainly in the RF world, because of mainly RF problems
Q Packet environment
Problems: Setup failures, dropped connections, low throughput
Causes: could be IP-related, or could be RF related
October, 2007
Course 120+: 269
IP Data Environment
Internet
VPNs
PDSN/Foreign Agent
#6 Indicator: Data Latency

IP Data Environment
T
PDSN
Home Agent
Backbone
Network
SECURE TUNNELS
Authentication
Authorization
Accounting
AAA
CDMA RF Environment
R-P Interface
BTS
PSTN
t1
t1
Switch
SEL
t1
CE
CDMA IOS PPP
Coverage Holes
Pilot Pollution
Missing Neighbors
Fwd Pwr Ovld
Rev Pwr Ovld
Search Windows
Wireless
Island Cells
Mobile Device
Slow Handoff
Q Latency can occur because of RF channel congestion or from

IP network causes
RF overload can delay availability of supplemental channels
IP network congestion can delay availability of packets
Q Ping and loopback tests with local PDSN and servers can
identify whether problem is in backbone network
Q Does latency correlate with independent evidence of RF
congestion?
October, 2007
Course 120+: 270
IP Data Environment
Internet
VPNs
PDSN/Foreign Agent
#7 Indicator: Data Throughput

IP Data Environment
T
PDSN
Home Agent
Backbone
Network
SECURE TUNNELS
Authentication
Authorization
Accounting
AAA
CDMA RF Environment
R-P Interface
BTS
PSTN
t1
t1
Switch
SEL
t1
CE
CDMA IOS PPP
Coverage Holes
Pilot Pollution
Missing Neighbors
Fwd Pwr Ovld
Rev Pwr Ovld
Search Windows
Wireless
Island Cells
Mobile Device
Slow Handoff
Q Throughput can be limited by RF and IP causes

Traditional RF problems limit capacity of the channel
Congestion in the IP network can limit speed of data available
Q Does low throughput correlate with independent RF indicators?
Q Does low throughput correlate with independent IP pings and tests?
October, 2007
Course 120+: 271
IP Data Environment
Internet
VPNs
PDSN/Foreign Agent
Data
Data Flow
Flow Management:
Management:
MAC/LAC
MAC/LAC Layer
Layer Operation
Operation
October, 2007
Course 120+: 272
System MAC/LAC Parameters

How is data flow managed?
Can I keep my FCH all the time?
Will my connection drop in a fade?
When is an SCH turned on for me?
How long will my SCH burst last?
What is the data rate of my SCH?
If I cant get a full-rate SCH, can I at
least get a lower-rate SCH?
Which kinds of traffic have priority?
Do some users have higher priority?
Active
T_active or
Release
Initialization
Traffic channel
Exists
Service Option
Connected
Control Channel
Exists
Control Channel
exists
Control Hold
T_suspend
T_hold
Packet Service Packet Service

Request
Deactivated
PPP Terminated
Release Sent!
Service Option
Connected
Control Channel Exists
Have New Data
to send!
Null
Reconnect
October, 2007
Q The answers to all these questions

are determined by MAC & LAC layer
processes and parameters
Q Each network manufacturer
implements some subset of the
MAC/LAC states and parameters
specified in the IS-2000 standard
Q Each manufacturer has its own
unique parameter set to control state
transitions
Q Most networks begin operation using
manufacturer-recommended defaults
as networks and applications
Suspended
mature, parameters will be fully
optimized
Q A basic knowledge of the
manufacturers proprietary
parameters gives very useful
insights into configuration and
Dormant
performance issues
PPP Terminated
Release Sent!
Course 120+: 273
MAC States
IP
Session
Internet
VPNs
Selector/
Channel
PPP
Svc Cfg (RLP)
Element
PDSN
Home Agent
Backbone
Network
SECURE TUNNELS
Authentication
Authorization
Accounting
AAA
(C)BSC/
Access Manager
Internet
VPNs
PDSN
Home Agent
Backbone
Network
SECURE TUNNELS
Authentication
Authorization
Accounting
AAA
(C)BSC/
Access Manager
Internet
VPNs
PDSN
Home Agent
Backbone
Network
SECURE TUNNELS
Authentication
Authorization
Accounting
AAA
(C)BSC/
Access Manager
Internet
VPNs
PDSN
Home Agent
Backbone
Network
SECURE TUNNELS
Authentication
Authorization
Accounting
AAA
(C)BSC/
Access Manager
October, 2007
PDSN/
Foreign BTS
Agent
R-P Interface
SEL
t1
CE
PDSN/
Foreign BTS
Agent
R-P Interface
State
F-TRAFFIC
F-FCH
ACTIVE
F-SCH
exit timer:
a few seconds
SCH driven
by traffic
F-TRAFFIC
F-DCCH
CONTROL
HOLD
R-TRAFFIC
R-FCH
R-SCH
SCH driven
by traffic
R-TRAFFIC
(Optional State)
SEL
t1
CE
PDSN/
Foreign BTS
Agent
t1
PAGING
R-P Interface
SEL
SUSPENDED
(Optional State)
exit timer: a few seconds
between data bursts
CE
PDSN/
Foreign BTS
Agent
intermittent
exit timer: a few seconds

very fast return to active state
R-P Interface
SEL
R-DCCH
PAGING
R-EACH
R-CCCH
intermittent
R-ACH
DORMANT
exit timer: minutes, hours
between data bursts
t1
today
R-EACH
R-CCCH
tomorrow
Course 120+: 274
PDSN/Foreign Agent
Forward Link SCH Scheduling

FCH or
data
FCH +
R-P
Interface
Buffer
SCH?
My F-SCH
Data Rate
BTS
CE
PCF SEL
t1
BTSC
Wireless
Mobile Device
Q The main bottleneck is the forward link itself: restricted by available

transmitter power and walsh codes
Q Each connected data User has a buffer in the PDSN/PCF complex
When waiting data in the buffer exceeds a threshold, the PDSN/PCF asks
the BTS for an F-SCH. Its data rate is limited by:
Available BTS forward TX power; available walsh codes; competition
from other users who also need F-SCHs; and mobile capability
When the buffer is nearly empty, the SCH ends; FCH alone
Occupancy timers and other dynamic or hard-coded triggers may apply
QOS (Quality of Service) rules also may be implemented, giving
preference to some users and some types of traffic
October, 2007
Course 120+: 275
Forward Link Events in a Typical User Session

Data volume in PDSN
buffer triggers SCH
assignment. SCH rate is
driven by amount of
data in buffer and
available TX power
sector can allocate.
Data volume
in buffer low,
SCH released.
Data flow
continues on
FCH until
complete.
Data volume in PDSN

buffer triggers SCH
driven by amount of
data in buffer and
available TX power
Data volume in buffer

low, SCH released.
Flow continues on FCH.
153.6
Data Rate, kbps
Data volume in PDSN

buffer triggers SCH
driven by amount of
data in buffer and
available TX power
76.8
Active
timer
runs out!
FCH drops.
Session is
dormant.
38.4
19.2
9.6
Act
Susp
Init
CHld
Dorm
Null
Rcon
Data volume
in buffer low,
SCH released.
Data flow
continues on
FCH until
complete.
No data,
FCH idle,
1200 bps
Mobile
ends
session.
TA
1.2
0
STATE
Session begins.
No data, FCH
idle, 1200 bps
Data in PDSN
buffer. Data
flow begins
on FCH
October, 2007
FCH
idle
1200
bps
No data,
FCH idle,
1200 bps
Data in PDSN
buffer. Data
flow begins
on FCH
QOS algorithm
gives SCH to
another user
briefly. Data
meanwhile
flows on FCH.
No data,
FCH idle,
1200 bps
Data in PDSN
buffer. Data
flow begins
on FCH
Channel Legend:
FundamentalSupplemental
Idle
Data
Data
Course 120+: 276
1x
1x Data
Data Tests
Tests and
and Optimization
Optimization
October, 2007
Course 120+: 277
So S L O W ! !
IP Data Environment
Backbone
Network
SECURE TUNNELS
PDSN
Home Agent
PDSN/Foreign Agent
Authentication
Authorization
Accounting
AAA
CDMA RF Environment
R-P Interface
BTS
PSTN
t1
Switch
t1
v SEL
t1
CDMA IOS PPP
CE
IP Data Environment
Internet
VPNs
Wheres My Data?!!
Coverage Holes
Pilot Pollution
Missing Neighbors
Fwd Pwr Ovld
Rev Pwr Ovld
Search Windows
Wireless
Island Cells
Mobile Device
Slow Handoff
Q Some sessions are tormented by long latency and slow throughput

Q Where is the problem? Anywhere between user and distant host:
Is the mobile users data device mis-configured and/or congested?
Is the BTS congested, with no power available to produce an SCH?
Poor RF environment, causing low rates and packet retransmission?
Congestion in the local IP network (PCU, R-P, PDSN FA)?
Congestion in the wireless operators backbone (OSSN) network?
Congestion in the PDSN HA?
Congestion in the outside-world internet or Private IP network?
Is the distant host congested, with long response times?
October, 2007
Course 120+: 278
Finding Causes of Latency and Low Throughput

Test
Server
IP Data Environment
Internet
VPNs
PDSN/Foreign Agent
Backbone
Network
SECURE TUNNELS
PDSN
Home Agent
Test
Server
Authentication
Authorization
Accounting
AAA
CDMA RF Environment
R-P Interface
BTS
PSTN
t1
Switch
t1
v SEL
t1
CDMA IOS PPP
CE
IP Data Environment
Test
Server
Coverage Holes
Pilot Pollution
Missing Neighbors
Fwd Pwr Ovld
Rev Pwr Ovld
Search Windows
Wireless
Island Cells
Mobile Device
Slow Handoff
Q IP network performance can be measured using test servers

Q Problems between mobile a local test server? The problem is local
check RF conditions, stats: poor environment, SCH blocking?
if the RF is clean, investigate BSC/PCU/R-P/PDSN-FA
Q Local results OK, problems accessing test server at PDSN-HA?
problem is narrowed to backbone network, or PDSN-HA
Q Results OK even through test server at PDSN-HA
then the problem is in the public layers beyond.
October, 2007
Course 120+: 279
Key
Key Features
Features and
and Structure
Structure of
of
1xEV-DO
1xEV-DO Rev.
Rev. 00 and
and Rev.
Rev. A
A
October, 2007
Course 120+: 280
A Quick Survey of Wireless Data Technologies

US CDMA
1xEV-DV
5000 - 1200 DL
307 - 153 UL
ETSI/GSM
MISC/NEW
WCDMA HSDPA
WI-MAX
12000 6000 kb/s
1xEV-DO A
WCDMA 1
3100 800 DL
1800 600 UL
2000 - 800 kb/s
1xEV-DO 0
384 250 kb/s
Flarion OFDM
1500 900 kb/s
WCDMA 0
2400 600 DL
153.6 76 UL
EDGE
1xRTT RC4
200 - 90 kb/s DL
45 kb/s UL
307.2 160 kb/s
1xRTT RC3
64 -32 kb/s
IS-95
14.4 9.6 kb/s
CELLULAR
IDEN
IS-136 TDMA
GPRS
40 30 kb/s DL
15 kb/s UL
153.6 80 kb/s
IS-95B
TD-SCDMA
In Development
GSM HSCSD
19.2 9.6 kb/s
CDPD
19.2 4.8 kb/s
discontinued
32 19.2 kb/s
AMPS Cellular
GSM CSD
9.6 4.8 kb/s
19.2 19.2 kb/s
9.6 4.8 kb/s

w/modem
PAGING
Mobitex
9.6 4.8 kb/s
obsolete
Q This summary is a work-in-progress, tracking latest experiences and reports from all the
high-tier (provider-network-oriented) 2G and 3G wireless data technologies
Q Have actual experiences to share, latest announced details, or corrections to the above?
Email to Scott@ScottBaxter.com. Thanks for your comments!
October, 2007
Course 120+: 281
Channel Structure of 1xEV-DO vs. 1xRTT

CHANNEL STRUCTURE
Q IS-95 and 1xRTT
many simultaneous users, each
with steady forward and reverse
traffic channels
transmissions arranged,
requested, confirmed by layer-3
messages with some delay
Q 1xEV-DO -- Very Different:
Forward Link goes to one user at a
time like TDMA!
users are rapidly time-multiplexed,
each receives fair share of
available sector time
instant preference given to user
with ideal receiving conditions, to
maximize average throughput
transmissions arranged and
requested via steady MAC-layer
walsh streams very immediate!
October, 2007
IS-95 AND 1xRTT

Many users simultaneous forward
and reverse traffic channels
PILOT
SYNC
PAGING
F-FCH1
F-FCH2
F-FCH3
W0
W32
W1
W17
W25
W41
F-SCH
W3
BTS
F-FCH4 W53
ATs
1xEV-DO
(Access Terminals)
AP
(Access Point)
1xEV-DO Forward Link
AP
Course 120+: 282
Power Management of 1xEV-DO vs. 1xRTT

IS-95: VARIABLE POWER
TO MAINTAIN USER FER
Maximum Sector Transmit Power
8
7
power
6
5
5
4
3
2
User 1
PAGING
SYNC
PILOT
time
1xEV-DO: MAX POWER ALWAYS,

DATA RATE OPTIMIZED
power
POWER MANAGEMENT
Q IS-95 and 1xRTT:
sectors adjust each users
channel power to maintain a
preset target FER
Q 1xEV-DO IS-856:
sectors always operate at
maximum power
sector output is timemultiplexed, with only one
user served at any instant
The transmission data rate is
set to the maximum speed
the user can receive at that
moment
time
October, 2007
Course 120+: 283
1xEV-DO Transmission Timing

Forward Link
Q All members of the CDMA family - IS-95, IS-95B,

1xRTT, 1xEV-DO and 1xEV-DV transmit
Frames
One Cycle of PN Short Code
IS-95, IS-95B, 1xRTT frames are usually 20
ms. long
1xEV-DO frames are 26-2/3 ms. long
same length as the short PN code
One 1xEV-DO Frame
each 1xEV-DO frame is divided into
1/16ths, called slots
Q The Slot is the basic timing unit of 1xEV-DO
forward link transmission
Each slot is directed toward somebody and
holds a subpacket of information for them
Some slots are used to carry the control
channel for everyone to hear; most slots are
intended for individual users or private groups
Q Users dont own long continuing series of slots
One Slot
like in TDMA or GSM; instead, each slot or small
string of slots is dynamically addressed to
whoever needs it at the moment
October, 2007
Course 120+: 284
Whats In a Forward Link Slot?

MAC
96
DATA
PILOT
64
DATA
MAC
PILOT
400 chips
SLOT
Slot 1024 chips
MAC
DATA
MAC
Slot 1024 chips
DATA
64
400 chips
400 chips
64
96
64
400 chips
Q The main cargo in a slot is the DATA being sent to a user

Q But all users need to get continuous timing and administrative
information, even when all the slots are going to somebody else
Q Twice in every slot there is regularly-scheduled burst of timing and
administrative information for everyone to use
MAC (Media Access Control) information such as power
control bits
a burst of pure Pilot
allows new mobiles to acquire the cell and decide to use it
keeps existing user mobiles exactly on sector time
mobiles use it to decide which sector should send them
their next forward link packet
October, 2007
Course 120+: 285
What if theres No Data to Send?

MAC
96
empty
PILOT
64
empty
MAC
PILOT
400 chips
SLOT
Slot 1024 chips
MAC
empty
MAC
Slot 1024 chips
empty
64
400 chips
400 chips
64
96
64
400 chips
Q Sometimes there may be no data waiting to be sent on a sectors

forward link
When theres no data to transmit on a slot, transmitting can be
suspended during the data portions of that slot
But---the MAC and PILOT must be transmitted!!
New and existing mobiles on this sector and surrounding
sectors need to monitor the relative strength of all the sectors
and decide which one to use next, so they need the pilot
Mobiles TRANSMITTING data to the sector on the reverse link
need power control bits
So MAC and PILOT are always transmitted, even in an empty
slot
October, 2007
Course 120+: 286
Forward Link Slots and Frames

MAC
96
DATA
PILOT
64
DATA
MAC
PILOT
400 chips
SLOT
Slot 1024 chips
MAC
DATA
MAC
Slot 1024 chips
DATA
64
400 chips
400 chips
64
96
64
400 chips
Slot
FRAME
1 Frame = 16 slots 32k chips 26-2/3 ms
Q Two Half-Slots make a Slot

Q 16 Slots make a frame
October, 2007
Course 120+: 287
Forward Link Frames and

Control Channel Cycles
Q A Control Channel Cycle is 16 frames (thats 426-2/3 ms, about 1/2
second)
Q The first half of the first frame has all of its slots reserved for possible use
carrying Control Channel packets
Q The last half of the first frame, and all of the remaining 15 frames, have
their slots available for ordinary use transmitting subpackets to users
Slot
FRAME
CONTROL
CHANNEL
USER(S) DATA CHANNEL
16-FRAME
CONTROL CHANNEL
CYCLE
16 Frames 524k chips 426-2/3 ms
Thats a lot of slots!

16 x 16 = 256
October, 2007
Course 120+: 288
Forward Link Frame and Slot Structure:

Big Picture Summary
MAC
96
DATA
PILOT
64
DATA
MAC
PILOT
400 chips
SLOT
Slot 1024 chips
MAC
DATA
MAC
Slot 1024 chips
DATA
64
400 chips
400 chips
64
96
64
400 chips
FRAME
CONTROL
CHANNEL
USER(S) DATA CHANNEL
16-FRAME
CONTROL CHANNEL
CYCLE
16 Frames 524k chips 426-2/3 ms
Q Slots make Frames and Frames make Control Channel Cycles!

October, 2007
Course 120+: 289
Reverse Link Frame and Slot Structure:

Big Picture Summary
Slot 1024 chips
Slot 1024 chips
SLOT
DATA
FRAME
1 Subframe
holds
1 Subpacket
Subframe
Subframe
Subframe
Q Reverse Link frames are the same length as forward link frames
Q The mobile does not include separate MAC and Pilot bursts
Its MAC and pilot functions are carried inside its signal by
simultaneous walsh codes
Q There is no need for slots for dedicated control purposes since the
mobile can transmit on the access channel whenever it needs
October, 2007
Course 120+: 290
Rev. A Reverse Channel Sub-Frame Structure

RRI
DATA CHANNEL
DRC CHANNEL
ACK
DSC
ACK
DSC
ACK
DSC
ACK
DSC
AUXILIARY PILOT CHANNEL

PILOT CHANNEL
1 Slot
1 Slot
1 Slot
1 Slot
1 Sub-Frame
Q The mobile transmits sub-packets occupying four reverse link

slots, called a reverse link sub-frame.
Q If multiple subpackets are required to deliver a packet, the
additional subpackets are spaced in every third subframe until
done
October, 2007
Course 120+: 291
EV-DO Rev. A Channels

IN THE WORLD OF CODES
MAC
just like IS-95
64
DRCLock
RPC
ARQ
W24
Auxiliary Pilot W2832
MAC
Wx16 Traffic
IC
FF
FORWARD
Access Channel
for session setup
from Idle Mode
Primary Pilot W016
MAC
Wx16 Control
Walsh
code
Data
Long PN offset
W264 Rev Activity
Public or Private
ACCESS
Pilot W016
Access
W064 Pilot
Long PN offset
REVERSE CHANNELS
A
TR
Access
Point
(AP)
FORWARD CHANNELS
RRI W416
DRC W816
DSC W1232
ACK W1232
Data
W12
Access
Terminal
(User
Terminal)
Traffic Channel
as used during
a data session
Walsh
code
Q The channels are not continuous like ordinary 1xRTT CDMA

Q Notice the differences between the MAC channels and the Rev. 0
MAC channels these are the heart of the Rev. 0/A differences
October, 2007
Course 120+: 292
Functions of Rev. A Forward Channels
AP
Access
Point
(AP)
Access terminals watch the Pilot to select

the strongest sector and choose burst speeds
W064 Pilot
MAC
W264 Rev Activity

just like IS-95
FORWARD
CHANNELS
64
DRCLock
RPC
ARQ
MAC
Each connected AT has MAC channel:

DRCLock indication if sector busy
RPC (Reverse Power Control)
ARQ to halt reverse link subpackets as
soon as complete packet is recovered
Wx16 Control
Wx16 Traffic
Walsh
code
The Reverse Activity Channel tells

ATs If the reverse link loading is
too high, requiring rate reduction
Traffic channels
carry user data to
one user at a time
The Control channel carries

overhead messages for idle ATs
but can also carry user traffic
400 chips
October, 2007
64 96 64
Slot 1024 chips
400 chips
400 chips
MAC
DATA
PILOT
DATA
MAC
MAC
PILOT
DATA
MAC
Forward Link Slot Structure (16 slots in a 26-2/3 ms. frame)

DATA
64 96 64
Slot 1024 chips
400 chips
Course 120+: 293
Functions of Rev. A Reverse Channels

The Pilot is used as a preamble
during access probes
Auxiliary Pilot W2832
MAC
IC
FF
DRC Data Rate Control channel

tells desired downlink speed
Access Channel
for session setup
from Idle Mode
Primary Pilot W016
A
TR
RRI reverse rate indicator tells

AP what rate is being sent by AT
Long PN offset
Auxiliary Pilot on traffic channel

allows synchronous detection
during high data rates
W24
Public or Private
Primary Pilot on traffic channel

allows synchronous detection
and also carries the RRI channel
Data
Access
ACCESS
Pilot W016
Long PN offset
Data channel during access

carries mobile requests
REVERSE CHANNELS
RRI W416
DRC W816
DSC W1232
ACK W1232
Data
W12
Access
Terminal
(User
Terminal)
Traffic Channel
as used during
a data session
Walsh
code
DSC Data Source Control channel

tells which sector will send burst
ACK channel allows AT to signal
successful reception of a packet
October, 2007
DATA channel during traffic

carries the ATs traffic bits
Course 120+: 294
AP
October, 2007
MACIndex
Walsh Code
Phase
Q Each active user on a sector is assigned a

unique 7-bit MAC index (64 MACs possible)
Q Each data packet begins with a preamble,
using the MAC index of the intended recipient
Q Five values of MAC indices are reserved for
multi-user packets
packets intended for reception by a group
for example, control channels
mobiles may have individual MAC indices
AND be simultaneously in various groups
this trick keeps payload size low even
for transmissions to groups
MACIndex
Walsh Code
Phase
Preamble Use
Not Used
76.8 kbps CCH
38.4 kbps CCH
Not Used
Available for
Forward
Traffic Channel
Transmissions
MACIndex
Walsh Code
Phase
MACIndex MAC Channel Use

0 and 1
Not Used
2
Not Used
3
Not Used
4
RA Channel
Available for RPC
and DRCLock
5-63
Channel
Transmissions
MACIndex
Walsh Code
Phase
The Rev. 0 MAC Index
0
2
4
6
8
10
12
14
16
18
20
22
24
26
28
30
32
34
36
38
40
42
44
46
48
50
52
54
56
58
60
62
1
3
5
7
9
11
13
15
17
19
21
23
25
27
29
31
33
35
37
39
41
43
45
47
49
51
53
55
57
59
61
63
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
Q
Q
Q
Q
Q
Q
Q
Q
Q
Q
Q
Q
Q
Q
Q
Q
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
Course 120+: 295
Q
Q
Q
Q
Q
Q
Q
Q
Q
Q
Q
Q
Q
Q
Q
Q
Rev. A MAC Index Values and Their Uses

MAC INDEX
MAC CHANNEL USE
0, 1
Not Used
2
Not Used
3
Not Used
4
RA Channel
5
RPC, DRC LOCK, ARQ
64 and 65
Not Used
66
Not Used
67
Not Used
68
Not Used
69
Not Used
70
Not Used
71
Not Used
6-63 and 72-127 RPC, DRC LOCK, ARQ
Q
Q
Q
Q
Q
PREAMBLE USE
Not Used
Control 76.8 kbps
Control 38.4 kbps
Not Used
Fwd TC if no Bcst
Not Used
Multi-User 128, 256, 512, 1024
Multi-User 2048
Multi-user 3072
Multi-User 4096
Multi-User 5120
Control 19.2, 38.4, 76.8
Fwd TC, Single User
PREAMBLE LENGTH
N/A
512
1024
N/A
Variable
N/A
256
128
64
64
64
1024
Variable
114 MAC indices are available for regular single-user packets

3 MAC indices are earmarked for control channel packets
5 MAC indices are reserved for mult-user packets
1 MAC index is reserved for broadcast packets, or single-users
4 MAC indices are not used due to conflicts with multiplexing patterns
October, 2007
Course 120+: 296
Rev. A MAC Index and I/Q Channel Contents
October, 2007
Course 120+: 297
Forward
Forward Link
Link Data
Data Transmission
Transmission
During
During an
an Established
Established Connection
Connection
October, 2007
Course 120+: 298
Transmission of a Packet over EV-DO

Data from PDSN for the Mobile
MP3, web page, or other content
Data Ready
AP
A user has initiated a1xEV-DO data session on their AT,

accessing a favorite website.
The requested page has just been received by the PDSN.
The PDSN and Radio Network Controller send a Data
Ready message to let the AT know it has data waiting.
October, 2007
Course 120+: 299

Data from PDSN for the Mobile
Data Ready
DRC: 5

A user has initiated a1xEV-DO data session on their AT,
accessing a favorite website.
The requested page has just been received by the PDSN.
The PDSN and Radio Network Controller send a Data
Ready message to let the AT know it has data waiting.
The AT quickly determines which of its active sectors is the
strongest. On the ATs DRC channel it asks that sector to
send it a packet at speed DRC Index 5.
The mobiles choice, DRC Index 5, determines everything:
The raw bit speed is 307.2 kb/s.
The packet will have 2048 bits.
There will be 4 subpackets (in slots 4 apart).
The first subpacket will begin with a 128 chip preamble.
October, 2007
AP
DRC
Modu- Preamble Payload Raw
C/I
Index Slots lation
Chips
Bits
kb/s
db
0x0 n/a QPSK
n/a
0
null rate
n/a
0x1 16 QPSK
1024
1024
38.4
-11.5
0x2
8
QPSK
512
1024
76.8
-9.2
0x3
4
QPSK
256
1024
153.6
-6.5
0x4
2
QPSK
128
1024
307.2
-3.5
0x5
4
QPSK
128
2048
307.2
-3.5
0x6
1
QPSK
64
1024
614.4
-0.6
0x7
2
QPSK
64
2048
614.4
-0.5
0x8
2
QPSK
64
3072
921.6
+2.2
0x9
1
QPSK
64
2048 1,228.8
+3.9
0xa
2 16QAM
64
4096 1,228.8
+4.0
0xb
1
8PSK
64
3072 1,843.2
+8.0
0xc
1 16QAM
64
4096 2,457.6 +10.3
0xd
2 16QAM
64
5120 1,536.0 in Rev. A
0xe
1 16QAM
64
5120 3,072.0 in Rev. A
Course 120+: 300

Data from PDSN for the Mobile PACKET
Data Ready
DRC: 5

2048 bits
Turbo Coder
Using the specifications for
+
+
the mobiles requested DRC
+
+ +
D
D
D
+
index, the correct-size packet
+
+
+
of bits is fed into the turbo
+
+ +
D
D
D
+
coder and the right number of
+
symbols are created.
Symbols
Interleaver
October, 2007
AP
DRC
C/I
Index Slots lation
Chips
Bits
kb/s
db
0x0 n/a QPSK
n/a
0
null rate
n/a
0x1 16 QPSK
1024
1024
38.4
-11.5
0x2
8
QPSK
512
1024
76.8
-9.2
0x3
4
QPSK
256
1024
153.6
-6.5
0x4
2
QPSK
128
1024
307.2
-3.5
0x5
4
QPSK
128
2048
307.2
-3.5
0x6
1
QPSK
64
1024
614.4
-0.6
0x7
2
QPSK
64
2048
614.4
-0.5
0x8
2
QPSK
64
3072
921.6
+2.2
0x9
1
QPSK
64
2048 1,228.8
+3.9
0xa
2 16QAM
64
4096 1,228.8
+4.0
0xb
1
8PSK
64
3072 1,843.2
+8.0
0xc
1 16QAM
64
4096 2,457.6 +10.3
0xd
2 16QAM
64
5120 1,536.0 in Rev. A
0xe
1 16QAM
64
5120 3,072.0 in Rev. A
Course 120+: 301

Data Ready
DRC: 5

2048 bits
Turbo Coder
+
+
+
+ +
D
D
D
+
+
+
+
+
+ +
D
D
D
+
+
Symbols
Interleaver
To guard against bursty errors

in transmission, the symbols
are completely stirred up in
a block interleaver.
October, 2007
Block Interleaver
AP
DRC
C/I
Index Slots lation
Chips
Bits
kb/s
db
0x0 n/a QPSK
n/a
0
null rate
n/a
0x1 16 QPSK
1024
1024
38.4
-11.5
0x2
8
QPSK
512
1024
76.8
-9.2
0x3
4
QPSK
256
1024
153.6
-6.5
0x4
2
QPSK
128
1024
307.2
-3.5
0x5
4
QPSK
128
2048
307.2
-3.5
0x6
1
QPSK
64
1024
614.4
-0.6
0x7
2
QPSK
64
2048
614.4
-0.5
0x8
2
QPSK
64
3072
921.6
+2.2
0x9
1
QPSK
64
2048 1,228.8
+3.9
0xa
2 16QAM
64
4096 1,228.8
+4.0
0xb
1
8PSK
64
3072 1,843.2
+8.0
0xc
1 16QAM
64
4096 2,457.6 +10.3
0xd
2 16QAM
64
5120 1,536.0 in Rev. A
0xe
1 16QAM
64
5120 3,072.0 in Rev. A
Course 120+: 302

Data Ready
DRC: 5

2048 bits
Turbo Coder
+
+
+
+ +
D
D
D
+
+
+
+
+
+ +
D
D
D
+
+
Symbols
Interleaver

The re-ordered stream of
symbols is now ready to
transmit.
October, 2007
Block Interleaver
Interleaved Symbols
AP
DRC
C/I
Index Slots lation
Chips
Bits
kb/s
db
0x0 n/a QPSK
n/a
0
null rate
n/a
0x1 16 QPSK
1024
1024
38.4
-11.5
0x2
8
QPSK
512
1024
76.8
-9.2
0x3
4
QPSK
256
1024
153.6
-6.5
0x4
2
QPSK
128
1024
307.2
-3.5
0x5
4
QPSK
128
2048
307.2
-3.5
0x6
1
QPSK
64
1024
614.4
-0.6
0x7
2
QPSK
64
2048
614.4
-0.5
0x8
2
QPSK
64
3072
921.6
+2.2
0x9
1
QPSK
64
2048 1,228.8
+3.9
0xa
2 16QAM
64
4096 1,228.8
+4.0
0xb
1
8PSK
64
3072 1,843.2
+8.0
0xc
1 16QAM
64
4096 2,457.6 +10.3
0xd
2 16QAM
64
5120 1,536.0 in Rev. A
0xe
1 16QAM
64
5120 3,072.0 in Rev. A
Course 120+: 303

Data Ready
DRC: 5
AP
2048 bits
Turbo Coder
+
+
+
+ +
D
D
D
+
+
+
+
+
+ +
D
D
D
+
+
Symbols
Block Interleaver
The re-ordered stream of
symbols is now ready to
transmit. The symbols are
divided into the correct
number of subpackets, which Interleaved Symbols
will occupy the same number
of transmission slots, spaced
four apart.
Its up to the AP to decide
when it will start transmitting
the stream, taking into account
any other pending subpackets
for other users, and
proportional fairness.
DRC
C/I
Index Slots lation
Chips
Bits
kb/s
db
0x0 n/a QPSK
n/a
0
null rate
n/a
0x1 16 QPSK
1024
1024
38.4
-11.5
0x2
8
QPSK
512
1024
76.8
-9.2
0x3
4
QPSK
256
1024
153.6
-6.5
0x4
2
QPSK
128
1024
307.2
-3.5
0x5
4
QPSK
128
2048
307.2
-3.5
0x6
1
QPSK
64
1024
614.4
-0.6
0x7
2
QPSK
64
2048
614.4
-0.5
0x8
2
QPSK
64
3072
921.6
+2.2
0x9
1
QPSK
64
2048 1,228.8
+3.9
0xa
2 16QAM
64
4096 1,228.8
+4.0
0xb
1
8PSK
64
3072 1,843.2
+8.0
0xc
1 16QAM
64
4096 2,457.6 +10.3
0xd
2 16QAM
64
5120 1,536.0 in Rev. A
0xe
1 16QAM
64
5120 3,072.0 in Rev. A
October, 2007
Subpacket 4
Subpacket 3
Subpacket 2
Subpacket 1
Interleaver
Course 120+: 304

Data Ready
DRC: 5
AP
2048 bits
Turbo Coder
When the AP is ready, the first
subpacket is actually
+
+
+
+ +
D
D
D
+
transmitted in a slot.
+
+
+
The first subpacket begins with
+
+ +
D
D
D
+
a preamble carrying the
+
users MAC index, so the Symbols
user knows this is the
start of its sequence of
subpackets, and how
Block Interleaver
many subpackets are in
the sequence..
The user keeps collecting
subpackets until either:
1)
it has been able to
reverse-turbo decode the Interleaved Symbols
packet contents early, or
2)
the whole schedule of
subpackets has been
transmitted.
DRC
C/I
Index Slots lation
Chips
Bits
kb/s
db
0x0 n/a QPSK
n/a
0
null rate
n/a
0x1 16 QPSK
1024
1024
38.4
-11.5
0x2
8
QPSK
512
1024
76.8
-9.2
0x3
4
QPSK
256
1024
153.6
-6.5
0x4
2
QPSK
128
1024
307.2
-3.5
0x5
4
QPSK
128
2048
307.2
-3.5
0x6
1
QPSK
64
1024
614.4
-0.6
0x7
2
QPSK
64
2048
614.4
-0.5
0x8
2
QPSK
64
3072
921.6
+2.2
0x9
1
QPSK
64
2048 1,228.8
+3.9
0xa
2 16QAM
64
4096 1,228.8
+4.0
0xb
1
8PSK
64
3072 1,843.2
+8.0
0xc
1 16QAM
64
4096 2,457.6 +10.3
0xd
2 16QAM
64
5120 1,536.0 in Rev. A
0xe
1 16QAM
64
5120 3,072.0 in Rev. A
Interleaver
Subpackets
SLOTS
October, 2007
Course 120+: 305
Hybrid
Hybrid ARQ:
ARQ:
Hybrid
Hybrid Repeat-Request
Repeat-Request Protocol
Protocol
October, 2007
Course 120+: 306
The Hybrid ARQ Process

CDMA2000 1xEV-DO
AP Access Point
CDMA2000 1xRTT
SYSTEM
Application layer
Application layer
LAC layer
LAC layer
MAC
layer
RLP Radio
Link Protocol
Physical
layer
MAC
layer
Physical
layer
RLP Radio
Link Protocol
AT Access Terminal
Application layer
Application layer
Stream layer
Stream layer
Session layer
Session layer
Connection layer
Connection layer
Security layer
Security layer
MAC layer
MAC layer
Physical
layer
F-FCH
R-FCH
HARQ
protocol
Physical
layer
HARQ
protocol
F-TFC repeats
R-ACK
Q In 1xRTT, retransmission protocols Q In 1xEV-DO, RLP functions are

typically work at the link layer
replicated at the physical layer
Radio Link Protocol (RLP)
HARQ Hybrid Repeat Request Protocol
communicates using
fast physical layer ACK bits
signaling packets
Chase Combining of multiple
lost data packets arent
repeats
recognized and are
unneeded repeats pre-empted
discarded at the decoder
by positive ACK
Q This method is slow and wasteful! Q This method is fast and efficient!
October, 2007
Course 120+: 307
Forward Link Multislot ARQ, Normal Termination

User A
Packet 0
Subpacket 0
AP
diff. diff. diff.

user user user
A
0
1
diff. diff. diff.

user user user
A
0
2
diff. diff. diff.

user user user
A
0
3
diff. diff. diff.

user user user
A
1
0
F-Traffic
AT
R-DRC
One Slot
Q
Q
Q
Q
NAK
NAK
NAK
c
de
id
pr
e
NA par
K e
de
id
de
co
c
de
pr
e
NA par
K e
de
id
de
co
c
de
pr
e
NA par
K e
de
id
de
co
c
de
pr
e
NA par
K e
de
co
R-ACK
de
1/2 Slot
offset
e
AK!
AT selects sector, sends request for data

AP starts sending next packet, one subpacket at a time
After each subpacket, AT either NAKs or AKs on ACK channel
In this example,
AP transmits all 4 scheduled subpackets of packet #0 before
the AT is finally able to decode correctly and send AK
then the AP can begin packet #1, first subpacket
October, 2007
Course 120+: 308
Forward Link Multislot ARQ, Early Termination

User A
Packet 0
Subpacket 0
AP
diff. diff. diff.

user user user
A
0
1
diff. diff. diff.

user user user
A
1
0
diff. diff. diff.

user user user
A
1
1
diff. diff. diff.

user user user
A
2
0
F-Traffic
AT
R-DRC
One Slot
Q
Q
Q
Q
NAK
AK!
NAK
c
de
id
pr
e
NA par
K e
de
id
de
co
c
de
pr
e
NA par
K e
de
id
de
co
c
de
pr
e
NA par
K e
de
id
de
co
c
de
pr
e
NA par
K e
de
co
R-ACK
de
1/2 Slot
offset
e
AK!
AT selects sector, sends request for data

AP starts sending next packet, one subpacket at a time
After each subpacket, AT either NAKs or AKs on ACK channel
In this example,
AT is able to successfully decode packet #0 after receiving
only the first two subpackets
AT sends ACK. AP now continues with first subpacket of
packet #1
October, 2007
Course 120+: 309
Multiple ARQ Instances

bits
Data
Packets
symbols
Encoding
Interand
leaving
Scrambling
Forward
Packet 0
Subpackets
Packet
Subpacket
0
0
1.
0
2.
0
3.
0
0
1
1.
1
2.
1
3.
1
0
2
1.
2
2.
2
3.
2
0
3
1.
3
2.
3
3.
3
Traffic
Channel
One Slot
Q Definition: Number of ARQ Instances

the maximum number of packets that may be in transit simultaneously
sometimes also called the number of ARQ channels
Q This figure and the preceding page appear to show 4 ARQ instances
Q Packets in the different ARQ instances
may be for the same user (the most common situation)
may be for different users (determined by QOS and scheduling)
Q Destination mobile knows its packets by their preamble
October, 2007
Course 120+: 310

bits
Data
Packets
symbols
Encoding
Interand
leaving
Scrambling
Forward
Packet 0
Packet 1
Subpackets
Subpackets
Packet
Subpacket
0
0
1.
0
2.
0
3.
0
0
1
1.
1
2.
1
3.
1
0
2
1.
2
2.
2
3.
2
0
3
1.
3
2.
3
3.
3
Traffic
Channel
One Slot

October, 2007
Course 120+: 311

bits
Data
Packets
symbols
Encoding
Interand
leaving
Scrambling
Forward
Packet 0
Packet 1
Packet 2
Subpackets
Subpackets
Subpackets
Packet
Subpacket
0
0
1.
0
2.
0
3.
0
0
1
1.
1
2.
1
3.
1
0
2
1.
2
2.
2
3.
2
0
3
1.
3
2.
3
3.
3
Traffic
Channel
One Slot

October, 2007
Course 120+: 312

bits
Data
Packets
symbols
Encoding
Interand
leaving
Scrambling
Forward
Packet 0
Packet 1
Packet 2
Packet 3
Subpackets
Subpackets
Subpackets
Subpackets
Packet
Subpacket
0
0
1.
0
2.
0
3.
0
0
1
1.
1
2.
1
3.
1
0
2
1.
2
2.
2
3.
2
0
3
1.
3
2.
3
3.
3
Traffic
Channel
One Slot

October, 2007
Course 120+: 313
Link Rates and Packet/Subpacket Formats

FORWARD LINK
DRC
Index Slots
0x0 n/a
0x1 16
0x2
8
0x3
4
0x4
2
0x5
4
0x6
1
0x7
2
0x8
2
0x9
1
0xa
2
0xb
1
0xc
1
0xd
2
0xe
1

C/I
lation
Chips
Bits
kb/s
db
QPSK
n/a
0
null rate
n/a
QPSK
1024
1024
38.4
-11.5
QPSK
512
1024
76.8
-9.2
QPSK
256
1024
153.6
-6.5
QPSK
128
1024
307.2
-3.5
QPSK
128
2048
307.2
-3.5
QPSK
64
1024
614.4
-0.6
QPSK
64
2048
614.4
-0.5
QPSK
64
3072
921.6
+2.2
QPSK
64
2048 1,228.8
+3.9
16QAM
64
4096 1,228.8
+4.0
8PSK
64
3072 1,843.2
+8.0
16QAM
64
4096 2,457.6 +10.3
16QAM
64
5120 1,536.0
+8.3
16QAM
64
5120 3,072.0 +11.3
REVERSE LINK
Payload Modu-Effective Rate kbps after: Code Rate (repetition) after
Bits lation 4 slots 8 slots 12 slots16 slots 4 slots 8 slots 12 slots16 slots
128
B4 19.2 9.6
6.4
4.8
1/5
1/5
1/5
1/5
256
B4
38 19.2 12.8 9.6
1/5
1/5
1/5
1/5
512
B4
76 38.4 25.6 19.2 1/4
1/5
1/5
1/5
768
B4
115 57.6 38.4 28.8 3/8
1/5
1/5
1/5
1024
B4
153 76.8 51.2 38.4 1/2
1/4
1/5
1/5
1536
Q4
230 115 76.8 57.6 3/8
1/5
1/5
1/5
2048
Q4
307 153 102.4 76.8 1/2
1/4
1/5
1/5
3072
Q2
461 230 153.6 115.2 3/8
1/5
1/5
1/5
4096
Q2
614 307 204.8 153.6 1/2
1/4
1/5
1/5
6144 Q4Q2 921 461 307 230.4 1/2
1/4
1/5
1/5
8192 Q4Q2 1228 614 409 307.2 2/3
1/3
2/9
1/5
12288 E4E2 1843 921 614 460.8 2/3
1/3
1/3
1/3
Q The 1xEV-DO Rev. A reverse link has seven available modes

offering higher speeds than available in Rev. 0
Modulation formats are hybrids defined in the standard
Q The 1xEV-DO Rev. A forward has two available modes offering
higher speeds than available in Rev. 0.
October, 2007
Course 120+: 314
Basics
Basics of
of EV-DO
EV-DO Operation
Operation
October, 2007
Course 120+: 315
Sessions and Connections

Q A Session is a state shared by an Access Terminal and the
network.
Negotiated protocols and configurations are remembered by
both sides as the basis for their communication.
An access terminal must already have a session underway in
order to communicate with the network
The only exception is the setup communications made
possible on the access channel for the purpose of initially
setting up a session
Q A Connection is a particular state of the air link in which the access
terminal is assigned a forward traffic channel, reverse traffic
channel, and associated MAC channels.
Q During one ongoing session, the terminal and network may open
and close their connection many times.
October, 2007
Course 120+: 316
EV-DO Terminal Identifiers

Q In CDMA, mobiles are identified by the familiar IMSI and ESN.
These are permanent quantities stored in the mobile.
Q EV-DO terminals have hardware addresses which can be queried
by the system, but connections are coordinated by the use of
Access Terminal Identifiers (ATIs)
Q There are four types of ATIs:
00 BATI Broadcast Access Terminal Identifier
01 MATI Multicast Access Terminal Identifier
02 UATI Unicast Access Terminal Identifier
Requested by the mobile at session setup and assigned by
the system. Updated when crossing various boundaries
03 RATI Random Access Terminal Identifier
Used by the mobile during initial access
Q From the view of the SLP protocol, ATIs simply define connection
endpoints.
October, 2007
Course 120+: 317
Setting up an EV-DO Connection

CONNECTION ROUTE UPDATE
Access
Point
(AP)
ACCESS
TRAFFIC
CONTROL
MAC
PILOT
RRI
DRC
ACK
MAC ACK
TRAFFIC CHANNEL ASSIGNMENT
MAC RTC ACK
PILOT
TRAFFIC CHANNEL COMPLETE

XON REQUEST
DATA
TRAFFIC
CONNECTION REQUEST
Access
Terminal
(AT)
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
NULL MESSAGE
NEIGHBOR LIST
XON RESPONSE
ROUTE UPDATE
TRANSITION TO DORMANT
NULL MESSAGE
TRAFFIC CHANNEL ASSIGNMENT
TRAFFIC CHANNEL COMPLETE
NEIGHBOR LIST
October, 2007
Course 120+: 318
Access
Access Terminal
Terminal Architecture
Architecture
And
And Handoffs
Handoffs Route
Route Updates
Updates
October, 2007
Course 120+: 319
Traffic Correlator
PN xxx Walsh xx
AGC
Duplexer
RF
Open Loop
RF
Transmitter
RF Section
October, 2007
Traffic Correlator
PN xxx Walsh xx
bits
Symbols
time-aligned
Receiver
RF Section
IF, Detector
control
Traffic Correlator
PN xxx Walsh xx
power
Chips
Digital
Rake Receiver
Symbols
Traffic Correlator
PN xxx Walsh xx
summing
Block Diagram of an Access Terminal
Messages
Pilot Searcher
PN xxx Walsh 0
Viterbi Decoder,
Convl. Decoder,
Demultiplexer
Packets
UART
CPU
Transmit Gain Adjust Messages
Conv or
Turbo
Coder
Transmitter
Digital Section
Long Code Gen.
Course 120+: 320
1xEV-DO Forward Link: AT Rake Receivers

ONE sector at a time!!
Access Terminal
Rake Receiver
PN Walsh
RF
AP
AP
PN
Walsh
PN
Walsh
PN
Walsh
Searcher
PN
W=0
user
data
Pilot Ec/Io
Q Burst by burst, the Access Terminal asks for transmission from whichever
Active sector it hears best, at the max speed it can successfully use
Q Using latest multipath data from its pilot searcher, the Access Terminal uses
the combined outputs of the four traffic correlators (rake fingers)
Q Each rake finger can be set to match any multipath component of the signal
Q The terminal may be a dual-mode device also capable of 1xRTT voice/data
fingers could even be targeted on different AP, but in 1xEV-DO mode
only a single AP transmits to us, never more than one at a time, so this
capability isnt needed or helpful in 1xEV-DO mode
October, 2007
Course 120+: 321
1xEV-DO Reverse Link: Soft Handoff

All Active Set sectors
can listen to the AT
Access Terminal
Rake Receiver
PN Walsh
RF
AP
DO-RNC chooses
cleanest packet
AP
PN
Walsh
PN
Walsh
PN
Walsh
Searcher
PN
W=0
user
data
Pilot Ec/Io
Q The AT uses the Route Update protocol to frequently update its

preferences of which sectors it wants in its active set
Q Frame-by-frame, all the sectors in the Active Set listen for the ATs
signal
Q Each sector collects what it heard from the AT, and sends it back to
the DO-RNC.
Q The DO-RNC uses the cleanest (lowest number of errors) packet
October, 2007
Course 120+: 322
1xEV-DO Route Update Mechanics

Access Terminal
Rake Receiver
PN Walsh
DO-RNC
?
?
Sel.
RF
AP
AP
PN
Walsh
PN
Walsh
PN
Walsh
Searcher
PN
W=0
user
data
Pilot Ec/Io
Q 1xEV-DO Route Update is driven by the Access Terminal

Access Terminal continuously checks available pilots
Access Terminal tells system pilots it currently sees
System puts those sectors in the active set, tells Access Terminal
Q Access terminal requests data bursts from the sector it likes best
tells which sector and what burst speed using the DRC channel
so there is no Soft Handoff on the forward link, just fast choices
Q All sectors in Active Set try to hear AT, forward packets to the DO-RNC
so the reverse link does benefit from CDMA soft handoff
October, 2007
Course 120+: 323
Route Update Pilot Management Rules

AT must support
PILOT SETS
Q The Access Terminal considers pilots in sets
Active: sectors who listen and can transmit
Active
6
Candidates: sectors AT requested, but not
Candidate 6
yet approved by system to be active
Neighbors: pilots told to AT by system, as
Neighbor 20
nearby sectors to check
Remaining
Remaining: any pilots used by system but
not already in the other sets (div. by PILOT_INC)
Q Access Terminal sends a Route Update
HANDOFF
Message to the system whenever:
PARAMETERS
It transmits on the Access Channel
PilotAdd
PilotDrop
Pilot
In idle state, it notices the serving sector is
PilotDrop
Compare
Timer
far from the sector where last updated
Dynamic Thresholds?
In connected state, whenever it notices the
Softslope
Handoff Parameters suggest a change
AddIntercept
DropIntercept
NeighborMaxAge
October, 2007
Course 120+: 324
Format of Traffic Channel Assignment Message

Q The Traffic Channel
Assignment Message
assigns all or some of the
sectors the access terminal
requested in its most recent
Route Update request
Q The message lists every
Active pilot; if it doesnt list it,
its not approved as active
Q Notice the MAC index and
DRC Cover so the access
terminal knows how to
request forward link bursts
on the data rate control
channel
Neighbor Structure Maintained by the AT
Pilot PN
October, 2007
Channel
SrchWinSize SrchWinOffset
Course 120+: 325
1xEV-DO
1xEV-DO Network
Network Architecture
Architecture
Simple
Simple IP
IP and
and Mobile
Mobile IP
IP
October, 2007
Course 120+: 326
CDMA Network for Circuit-Switched Voice Calls
Switch
PSTN
t1
t1
SEL
t1
CE
BTS
Q The first commercial IS-95 CDMA systems provided only circuitswitched voice calls
October, 2007
Course 120+: 327
CDMA 1xRTT Voice and Data Network
Internet
VPNs
PDSN
Home Agent
PDSN
Foreign Agent
Backbone
Network
Authentication
Authorization
Accounting
AAA
Switch
PSTN
t1
t1
SEL
t1
CE
BTS
Q CDMA2000 1xRTT networks added two new capabilities:

channel elements able to generate and carry independent streams of
symbols on the I and Q channels of the QPSK RF signal
this roughly doubles capacity compared to IS-95
a separate IP network implementing packet connections from the mobile
through to the outside internet
including Packet Data Serving Nodes (PDSNs) and a dedicated direct
data connection (the Packet-Radio Interface) to the heart of the BSC
Q The overall connection speed was still limited by the 1xRTT air interface
October, 2007
Course 120+: 328
1xEV-DO Overlaid On Existing 1xRTT Network
Internet
VPNs
PDSN
Home Agent
PDSN
Foreign Agent
Backbone
Network
Authentication
Authorization
Accounting
AAA
DO
Radio
Network
Controller
Switch
CE
PSTN
t1
DO-OMC
t1
SEL
t1
CE
BTS
Q 1xEV-DO requires faster resource management than 1x BSCs can give

this is provided by the new Data Only Radio Network Controller (DO-RNC)
Q A new controller and packet controller software are needed in the BTS to
manage the radio resources for EV sessions
in some cases dedicated channel elements and even dedicated backhaul is
used for the EV-DO traffic
Q The new DO-OMC administers the DO-RNC and BTS PCF addition
Q Existing PDSNs and backbone network are used with minor upgrading
Q The following sections show Lucent, Motorola, and Nortels specific solutions
October, 2007
Course 120+: 329
Lucent
Lucent 1xEV-DO
1xEV-DO Architecture
Architecture
October, 2007
Course 120+: 330
Lucent 1xEV-DO Radio Access Network (RAN)

OMP FX
Element Management
System
AP
AP
T-1/E-1
Ethernet
RF
Router
Uplink
Input
Router
Flexent
Mobility
Server
AAA
Server
Downlink
Input
Router
AP
Uplink
Input
Router
RF
User ATs
(Access Terminals)
Flexent
Mobility
Server
Downlink
Input
Router
Packet
Data
Serving
Node
(PDSN)
Internet
AP
Q A Lucent 1xEV-DO Radio Access Network (RAN) includes

1xEV-DO base stations and the
1xEV-DO Flexent Mobility Server (FMS).
Q The 1xEV-DO equipment may be collocated with IS-95 and/or
1xRTT equipment, creating 1xEV-DO/IS-95 and 1xEVDO/3G-1X
combination base stations.
October, 2007
Course 120+: 331
1xEV-DO in Lucent Flexent Mod Cell Cabinets

Q Lucent Mod Cell cabinets can
support up to three IS-95 or
1xRTT carriers on three
sectors
Q 1xEV-DO CDMA Digital
Modules (CDM) can be mixed
with conventional CDMs in
the same cabinet
Q the same RF hardware
(filters, amplifiers, other RF
components) can be used for
IS-95, 1xRTT, and 1xEV-DO
October, 2007
Course 120+: 332
Lucent CDMA Digital Module

(CDM) Configurations
Q At upper left is a CDM for conventional
IS-95 / 1xRTT service. It includes
CRC CDMA Radio controller
up to 6 CCU CDMA Channel Units
PCU power converter module
CBR CDMA Baseband Radio
Q At lower left is a CDM for 1xEV-DO
it must be occupy the leftmost slot
all CCU packs are removed and
replaced by a single 1xEV-DO
modem (EVM) occupying 2 slots
the CRC must be 44WW13D or
later
October, 2007
Course 120+: 333
1xEV-DO in Lucent Mod Cell 4.0 Cabinets
FMS
Universal
Radio
Controller
(URC)
Digital Shelf
Evolution Carr1
Flow
Modem
(4.0 EVM)
ECP
Universal
Radio
Controller
(URC)
October, 2007
CDMA
Modem
Unit
(CMU)
Carr
2, 3
Universal
Antenna
CDMA
Radio
(UCR)
Q The Mod Cell 4 cabinet comes in

many variations
Q Instead of per-carrier dedicated
CDMs, resources are pooled
Q URCs (Universal Radio
Controllers) are used to steer data
for each carrier to EVMs for EVDO
or CMUs for IS-95/1xRTT.
in a mixed-mode system, a
URC is required for EVDO and
a URC for IS-95/1xRTT
Q The modulated signal from a 4.0
EVM or CMU is upconverted to the
RF carrier frequency by the UCR
each UCR (Universal CDMA
Radio) can handle up to three
carriers
Course 120+: 334
Lucent 1xEV-DO Flexent Mobility Server (FMS)

Q The Flexent Mobility Server is the
heart of the Radio Access Network
Q It provides four processors running
the 1xEV-DO Application Processor
(DO-AP), which provides the Packet
Controller Function (PCF)
Q The PCF provides air link and radio
resource management to implement
1xEV-DO user sessions, including
the dormant state and other DOspecific features
October, 2007
Course 120+: 335
Motorola
Motorola 1xEV-DO
Architecture
October, 2007
Course 120+: 336
Motorola 1xEV-DO System Architecture

MSC
OMC-IP
MM/SDU
OMC-DO
AAA
AN-AAA
BSC-DO
PDSNs
VPU
AN-DO
OMC-R
Elements
Existing IS-95
New 1xEV-DO
Shared IS-95/DO
1x-AN
1x-BTS
MCC-DO
Packet Core
Network
HAs
Connections
IS-95/1x
1xEV-DO
Shared 1x/DO
Q New 1xEV-DO carrier appears as a standard carrier addition to

existing network elements
new MCC-DO cards and OMC-R database revisions needed
AAA and PDSN need software upgrades
October, 2007
Course 120+: 337
New Motorola 1xEV-DO Network Elements

MSC
OMC-IP
MM/SDU
OMC-DO
AAA
AN-AAA
PDSNs
BSC-DO
VPU
AN-DO
OMC-R
Elements
Existing IS-95
New 1xEV-DO
Shared IS-95/DO
1x-AN
1x-BTS
MCC-DO
Packet Core
Network
HAs
Connections
IS-95/1x
1xEV-DO
Shared 1x/DO
Q MCC-DO (Multi-Channel Controller - Data Only)

Q AN-DO (Access Node - Data only)
CR (Consolidation Router) Similar in function to the 1x-AN MGX
LSW (Layer 3 Switch) Similar in function to the 1x-AN CATs
Q BSC-DO (Base Station Controller-Data Only)
Mobility functions like 1x MM - Packet Control & Selection like SDU
Q OMC-DO (Operations & Maintenance Center - Data Only)
Q LMT (Local Maintenance Terminal)
October, 2007
Course 120+: 338
Motorola 1xEV-DO Block Diagram

and Network Upgrade Summary
BTS
RF Front End
1x BBX
1x Modems
BSC-DO
DO BBX
MCC-DO
AN-DO
October, 2007
CR
BTS
PDSN
LSW
1x BBX
RF Front End
IS-2000
1xEV-DO
Tool
LMF
LMT
BTS frame & CCP shelf
LPA
BBX-1X
BTS
MCC-1X
MCC-DO
GLI (Traffic)
GLI (Control)
AN (MGX8800)
CR
AN
AN (Catalyst 6509)
LSW
BSC
CBSC
BSC-DO
OMC-R
O&M
OMC-DO
UNO
PDSN (Note 1)
IP Network
Telephone Network
MSC/HLR
Not Required
Data Network
Not Required
AAA
1x Modems
DO BBX
T1 or E1
MCCDO
AN-AAA
OMC-DO
Course 120+: 339
Motorola MCC-DO Functions
BTS
RF Front End
1x BBX
1x Modems
BSC-DO
DO BBX
MCC-DO
AN-DO
CR
BTS
PDSN
LSW
RF Front End
1x BBX
1x Modems
DO BBX
T1 or E1
MCC-DO
OMC-DO
AN-AAA
Q 1xEV-DO Modem
1 carrier, 3 sectors per
MCC-DO card
Supports 59 channels per
sector
Q Span Interface
Up to 3 Active Span lines
per MCC-DO
Most operators will
generally deploy with 2
spans per BTS
Q BTS provides control:
SCAP messaging
Redundant BBX Selection
Enhanced BBX interface
MCC- DO
October, 2007
Course 120+: 340
Nortel
Nortel 1xEV-DO
Architecture
October, 2007
Course 120+: 341
A Typical Nortel CDMA2000 System

Providing 1xRTT Voice, Data, and 1xEV-DO
October, 2007
Course 120+: 342

Providing Only 1xRTT Voice, Data
October, 2007
Course 120+: 343

Providing 1xEV-DO Only
October, 2007
Course 120+: 344
Nortel DOM: Data-Only Module

Q The Data Only Module (DOM) adds 1xEV-DO
capability to a MetroCell AP CEM shelf
transmits/receives baseband data to/from
the digital control group (DCG) in the CORE
module
CORE switches baseband to proper carrier
on the MFRM for transmission
the DOM performs all encoding/decoding of
IP packets for transport on data-only
network to the Data-Only Radio Network
Controller (DO-RNC)
One DOM supports up to a three-sector,
one-carrier MetroCell AP
Additional DOMs support additional carriers
October, 2007
Course 120+: 345
Nortels DO-RNC
The Data-Only Radio Network Controller
Q DO-RNC is the heart of a 1xEV-DO network,
located at the central office (CO) with the BSC
and/or BSS Manager (BSSM)
Q DO-RNC is a stand-alone node supporting
1xEV-DO. It manages:
DOMs at multiple APs (even on different
band classes) over IP-based backhaul
network
access terminal state, both idle and
connected
handoffs of ATs between cells and carrier
frequencies (reverse); sector selection (fwd).
Nortel DO-RNC
connections from airlink to PDSN over
Data-Only
standard A10-A11 interfaces
Radio Network Controller
connects to MetroCell AP via dedicated IP
backhaul network
Q DO-RNC is the peer of the access terminal for
most over-the-air signaling protocols, including
session and connection layers
October, 2007
Course 120+: 346
1xEV-DO
1xEV-DO // 1xRTT
1xRTT
Interoperability
Interoperability
October, 2007
Course 120+: 347
1xEV-DO/1xRTT Interoperability
Q The CDMA2000 1xEV-DO Rev. 0 Standard IS-856 makes no
provision for any kind of handoff to or from any other technology
Q Driven by Operator interest, a Hybrid mode has been developed
to provide some types of handoff functions to the best extent
possible
Q Hybrid Mode
is a mobile only function neither the EV nor 1xRTT network
knows anything about it
is a proprietary feature with vendor-specific implementation
has no standard-defined RF triggers; no hooks
Q In the 1xEV rev. A standard, some new features are provided
Using the CDMA2000 Circuit Services Negotiation Protocol,
the 1xEV control channel can carry 1xRTT pages too
this and other changes will eventually make the hybrid mode
unnecessary and obsolete
October, 2007
Course 120+: 348
What Handoffs are Possible in Hybrid Mode?

Q All switching between systems occurs in Idle Mode
there are no handoffs in active traffic state in either mode
Q Sessions can be transferred from one system to the other, but
NOT in active traffic state
If there is a connection, it can be closed and then re-originated
on the other system
In some cases this can be accomplished automatically without
the end-users awareness in other cases, the user must
manually reconnect
October, 2007
Course 120+: 349
Hybrid Mode Transition Scenarios

1:2 Deployment
1:1 Deployment
1:1 Deployment
EV-DO, F2
1xRTT, F1
Q DO systems will be Implemented in Several Configurations

1:1 overlays in busy core areas
1:1 or 1:N overlays in less dense areas
Q Many EV>1x and 1x>EV transition events may occur as a user
transitions from area to area
Q Initial system acquisition is also involved as a user activates their
AT in different locations
Q These transitions are dependent on the Hybrid mode
implementation in the AT
Q The following pages show some possible transitions assuming
Mobile IP and AT Hybrid Mode are implemented
October, 2007
Course 120+: 350
1xEV-DO
Idle
1xEV-DO
Active
1xRTT / 1xEV-DO Hybrid Idle Mode
Idle
Mode
Idle
Mode
1xRTT
Active
1xRTT
Idle
Hybrid
Mode
October, 2007
Q 1xRTT/1xEV-DO Hybrid Mode

depends on being able to hear pages on both
systems 1xRTT and 1xEV-DO
is possible because of slotted mode paging
1xRTT and 1xEV-DO paging slots do not occur
simultaneously
mobile can monitor both
Q During 1xEV-DO traffic operation, the hybrid-aware
mobile can still keep monitoring 1xRTT paging
channel
Q During 1xRTT traffic operation, the hybrid-aware
mobile is unable to break away; 1xRTT traffic
operation is continuous
no opportunity to see 1xEV-DO signal
Q This hybrid Idle mode capability is the foundation
for all 1xRTT/1xEV mode transfers
the network does not trigger any transfers
Course 120+: 351
Hybrid Dual-Mode Idle Operation

1xRTT / 1xEV-DO Paging Interoperability
16-frame Control Channel Cycle
16 slots of 26-2/3 ms = 426-2/3 ms
LONGEST POSSIBLE
PACKET
DRC 16 Subpackets
1xRTT Minimum Slot Cycle Index: 16 slots of 80 ms each = 48 26-2./3 ms frames
Q A dual-mode 1xRTT/1xEV-DO mobile using slotted-mode paging can

effectively watch the paging channels of both 1xRTT and 1xEV-DO at the
same time
Q How is it possible for the mobile to monitor both at the same time?
The paging timeslots of the two technologies are staggered
Q Three of the 16 timeslots in 1xRTT conflict with the control channel slots
of 1xEV-DO
However, conflicts can be avoided by page repetition, a standard
feature in systems of both technologies
October, 2007
Course 120+: 352
Initial System Acquisition by Hybrid Mobile
1xRTT
Idle
1xEV-DO
Idle
1xEV-DO
Active
when 1xEV-DO is NOT Available
Acquire
1xEV-DO
System
driven by
PRL
Acquire
1xRTT
System
driven by
PRL
Register
with
1xRTT
Network
no, cant see EV
After entering this state, the

mobile will search for EV-DO
at intervals (typ. 3 min)
Idle
Mode
Classical 1xRTT
Idle Mode
Voice
Page!
Idle
Mode
1xRTT
Active
Release
October, 2007
1xRTT
Voice
Call
Course 120+: 353
Initial System Acquisition by Hybrid Mobile
1xEV-DO
Active
when 1xEV-DO is Available

Set Up or
Re-establish
1xEVDO
Data
Session
1xEV
Traffic
interrupted
during
1xRTT
voice call
1xEV
Traffic
Data
Connection
Closed
1xEV-DO
Idle
Triggers:
Acquire
1xEV-DO
System
driven by
PRL
yes, found EV
Idle
Mode
AT Data
Ready!
Idle
Mode
AN Data
Page!
1xRTT
Idle
Hybrid
Mode
Acquire
1xRTT
System
driven by
PRL
Register
with
1xRTT
Network
Idle
Mode
Idle
Mode
Hybrid
Mode
Hybrid
Mode
Idle
Mode
Idle
Mode
Voice
Page!
1xRTT
Active
Release
October, 2007
1xRTT
Voice
Call
Course 120+: 354
Backhaul
Backhaul and
and
Related
Related Considerations
Considerations
October, 2007
Course 120+: 355
Rate Limitations from Backhaul

Q Wireless sites are commonly connected using T-1s or E-1s,
depending on local availability
In the case of T-1s, the raw rate is 1.544 megabits/second.
Accounting for overhead, this translates into a maximum
steady throughput of roughly 400 to 450 kb/s per sector on
a 3-sector, 1-carrier EV-DO site.
If one sector is busy while the other two are only lightly
loaded, throughput of roughly 1 mb/s can be obtained on
one sector
However, early 1xEV-DO cards without support for multiple
ARQ instances can only achieve about 400 kb/s
throughput even without backhaul limitations
Q Solutions under study to relieve backhaul congestion include fiberbased ATM to the sites; multiple-T1s; sites linked by Cable
Modems, and other methods
October, 2007
Course 120+: 356

CdmaCorePrinciple Opt

Загружено:

Сведения о документе

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

CdmaCorePrinciple Opt

Загружено:

Авторское право:

Доступные форматы

Course 120+ Section I

120v5 (c) 2007 Scott Baxter

Forward Link Signals of a 3-sector CDMA Site

120v5 (c) 2007 Scott Baxter

Forward Link Signals of a 3-sector CDMA Site

120v5 (c) 2007 Scott Baxter

Forward Link Signals of a 3-sector CDMA Site

120v5 (c) 2007 Scott Baxter

Forward Link Signals of a 3-sector CDMA Site

120v5 (c) 2007 Scott Baxter

The Capacity of One Carrier

120v5 (c) 2007 Scott Baxter

More Carriers for More Capacity

120v5 (c) 2007 Scott Baxter

CDMA Mobile Transmit (Reverse Link)

The forward link and reverse links are on different frequencies.

120v5 (c) 2007 Scott Baxter

Different Mobiles on Different Carriers

120v5 (c) 2007 Scott Baxter

CDMA: Using A New Dimension

Raw RF of one channel vs all the energy

120v5 (c) 2007 Scott Baxter

Figure of Merit: C/I

DSSS Spreading: Time-Domain View

Input B: Spreading Code

Spread Spectrum Signal

via air interface

Input A: Received Signal

Input B: Spreading Code

Output: Users Original Data

Drawn to actual scale and time alignment

Spreading from a Frequency-Domain View

Q Traditional technologies try

TRADITIONAL COMMUNICATIONS SYSTEM

Spread Spectrum Payoff:

120v5 (c) 2007 Scott Baxter

120v5 (c) 2007 Scott Baxter

Modulation Techniques of 1xEV Technologies

120v5 (c) 2007 Scott Baxter

Digital Modulation Systems

120v5 (c) 2007 Scott Baxter

The CDMA Spread Spectrum Payoff:

120v5 (c) 2007 Scott Baxter

CDMA Spreading Gain

# Users Processing Gain

64..Uh, Regis, can I just

CDMA Uses Code Channels

120v5 (c) 2007 Scott Baxter

CDMA In Action: Multiple Users on a Sector

This figure illustrates the basic technique of

120v5 (c) 2007 Scott Baxter

Spreading: What we do, we can undo

Q Sender combines data with a fast spreading sequence, transmits

120v5 (c) 2007 Scott Baxter

Shipping and Receiving via CDMA

Q Whether in shipping and receiving, or in CDMA, packaging is

120v5 (c) 2007 Scott Baxter

CDMAs Nested Spreading Sequences

Spread-Spectrum Chip Streams

Spreading Spreading Spreading

Q CDMA combines three different spreading sequences to create

120v5 (c) 2007 Scott Baxter

The Walsh Codes

Q 64 Magic Sequences, each 64 chips long