302 - CDMA Performance Optimization Using Grayson's Surveyor

Course 302 -- CDMA Drive Test & System Optimization Issue 2.
0 (March, 2001) Page 1

Course 302
CDMA Performance Optimization
with Grayson CDMA Inspector32
CDMA Performance Optimization
with Grayson CDMA Inspector32
Course 302 -- CDMA Drive Test & System Optimization Issue 2.0 (March, 2001) Page 2
Outline: Using Surveyor for Optimization
I Introduction: Review of CDMA Principles (optional based on
portions needed)
CDMA Air Interface Review
CDMA Spread Spectrum Basics
CDMA Signal RF Characteristics
CDMA Spreading Sequences and Code Channels
Forward Link
Reverse Link
Call Processing from perspective of Subscriber Handset
Anatomy of a Handset
RF section, digital section, correlators
Operation of the Pilot Searcher
Subscriber Handset Operation, wakeup thru end of call
Messaging Overview
CDMA Handoff
Pilot Sets: Relationships, number of members, promotion
& demotion
Handoff Parameters
Handoff Messaging
RF Implications of Handoff Situations
CDMA System Network Architecture and Hardware Basic
Elements
I CDMA Datagathering Introduction
System-side resources, principles, tools: (overview)
Subscriber-side resources, principles, and techniques
Handset maintenance mode
Surveyor32 Real-Time and Replay
Analyzer - its role and purpose
I Interpreting Real-Time Drive-Tool Displays from Surveyor32
Parameters and values
RF significance of observed values (Ec/Io, TX Gain, TX PO,
RX Level)
Seeing the situation through the eyes of the handset
I Real-World CDMA Problems and Solutions
I Live Examples using Datafiles collected by the class
Course 302
Whats Different about CDMA?
Basic Principles Review
Whats Different about CDMA?
Basic Principles Review
Other Technologies:
Recovering the Signal / Avoiding Interference
I In conventional radio technologies, the
desired signal must be strong enough to
override any interference
I AMPS, TDMA and GSM depend on
physical distance separation to keep
interference at low levels
I Co-channel users are kept at a safe
distance by careful frequency planning
I Nearby users and cells must use different
frequencies to avoid interference
2
3
4
5 6
7
4
6
4
7 2
7
2
5
3
5
3
6
1
1
1
1
1
1
1
AMPS-TDMA-GSM
Figure of Merit: C/I
(carrier/interference ratio)
AMPS: +17 dB
TDMA: +14 to 17 dB
GSM: +7 to 9 dB.
CDMA: Using A New Dimension
I All CDMA users occupy the same frequency
at the same time! Frequency and time are
not used as discriminators, the signals are
hopelessly entangled both in time and
frequency
I CDMA operates by using CODING to
discriminate between users
I In CDMA systems, the interference comes
mainly from other nearby CDMA users
I Each users signal is like a small voice in a
roaring crowd -- but built using a unique
code that allows the signal to be uniquely
decoded and recovered by the recipient
CDMA
Figure of Merit: C/I
(carrier/interference ratio)
AMPS: +17 dB
TDMA: +14 to +17 dB
GSM: +7 to 9 dB.
CDMA: -10 to -17 dB.
CDMA: E
b
/N
o
~+6 dB.
CDMA Uses Code Channels
I A CDMA signal uses many chips to convey just
one bit of information
I Each user has a unique chip pattern, in effect a
code channel
I To recover a bit, integrate a large number of chips
interpreted by the users known code pattern
I Other users code patterns appear random and
add up to zero in a random self-canceling fashion,
thus they dont disturb the bit decoding decision
being made with the proper code pattern
I The process of going from Symbols into Chips is
called spreading, since the slow, narrow-
bandwidth information is spread so that it
occupies a much larger bandwidth
Building a
Building a
CDMA Signal
CDMA Signal
Bits
from Users Vocoder
Symbols
Chips
Forward Error
Correction
Coding and
Spreading
Spreading, from a Time-Domain point of view
At Originating Site:
I Input A: Users Data @
19,200 bits/second
I Input B: Walsh Code #23
@ 1.2288 Mcps
I Output: Spread
spectrum signal
At Destination Site:
I Input A: Received
spread spectrum signal
I Input B: Walsh Code #23
@ 1.2288 Mcps
I Output: Users Data @
19,200 bits/second just
as originally sent
Drawn to actual scale and time alignment
via air interface
XOR
Exclusive-OR
Gate
1
1
Input A: Received Signal
Input B: Spreading Code
Output: Users Original Data
Input A: Users Data
Input B: Spreading Code
Spread Spectrum Signal
XOR
Exclusive-OR
Gate
Originating Site
Destination Site
Spreading: a Frequency-Domain Point of View
I Traditional wireless technologies try to
squeeze one signal into a minimum
amount of bandwidth, so there can be
many one-user channels
the data rate of the information
dictates how wide a bandwidth the
signal requires; its narrow
I CDMA mixes slow information with a fast
spreading sequence
this makes a CDMA signal with much
wider bandwidth than the information
alone would require
the extra bandwidth gives a payback
of processing gain which extends
coverage range and improves the
radio link performance for users
I Multiple users can occupy one CDMA
signal, if each users information is mixed
with a unique, distinct personal spreading
sequence, and then all added together.
Decode the combined signal using
one users spreading sequence, and
that one users signal is recovered
Spread Spectrum Payoff:
Processing Gain
Multiple users with diferent codes
Spread Spectrum
TRADITIONAL COMMUNICATIONS SYSTEM
Slow
Information
Sent
TX
Slow
Information
Recovered
RX
Narrowband
Signal
SPREAD-SPECTRUM SYSTEM
Fast
Spreading
Sequence
Slow
Information
Sent
TX
Slow
Information
Recovered
RX
Fast
Spreading
Sequence
Wideband
Signal
CDMA: is it really magic, or just a card trick?

if 1 =
if 0 =
1
Analog
Summing
Users
QPSK RF

Demodulated
Received
CDMA Signal
Despreading Sequence
(Locally Generated, =0)
matches
opposite
Decision:
Matches!
( = 0 )
Time
Integration
1
Opposite
( =1)
+10
-26
Received energy:
Correlation
-16
BTS
This figure illustrates the basic technique of
CDMA signal generation and recovery.
The actual coding process used in IS-95 CDMA includes
a few additional layers, as well see in following slides.
The Concept of Orthogonality
I Each users signal must be
built using a unique
spreading sequence, if we are
to recover it individually
if users spreading
sequences arent unique,
all users signals will be
hopelessly jumbled
together and
unrecoverable
I This uniqueness is called
Orthogonality
I The spreading sequences we
use in CDMA are orthogonal
Comparing Signals:
Are they Orthogonal?
Two signals are orthogonal if their
corresponding bits match in half the
positions, and dont match in half the
positions
One way to check for orthogonality is
to add the two signals in binary form
(modulo 2).
If the signals are orthogonal, the sum
will contain exactly as many ones as
zeroes..
0 1 1 0 1 1 1 0
0 0 1 0 1 1 0 0
0 1 0 0 0 0 1 0 =
+
Signal A
Signal B
Binary Sum
Not these two signals!
Spreading: Whatever we encode, we can decode
I Sender combines data with a fast spreading sequence, transmits
spread data stream
I Receiver intercepts the stream, uses same spreading sequence
to extract original data
I If this basic idea makes sense, youre ready to understand the full
process used in commercial CDMA
ORIGINATING SITE DESTINATION
Spreading
Sequence
Spreading
Sequence
Input
Data
Recovered
Data
Spread Data Stream
Shipping and Receiving via CDMA
I Whether in package shipping and receiving, or in CDMA signals,
packaging methods are extremely important!
I Cargo is placed inside nested containers. Each container has
some special purpose -- for example, the disk is readable by a
PC, the mailer keeps the disk from getting bent or damaged, and
the shipping envelope can be addressed to the final destination
I The shipper packs in a certain order, and the recipient unpacks
in the reverse order
I For CDMA signals, the containers for our shipment are three
different kinds of spreading codes, and each one is used for a
specific purpose
F
e
d
E
x
Data
Mailer
F
e
d
E
x
Data
Mailer
Shipping Receiving
CDMAs Three Nested Spreading Sequences
I CDMA signals are built up using three different types of spreading
sequences -- this makes each signal unique and very rugged/robust
I These sequences are easy to generate, in a base station and in a handset
I Using these sequences, Whatever we encode, we can decode
I Next step is to meet these sequences, see their special properties
what are their functions on the forward link (base station to mobile) ?
what are their functions on the reverse link (mobile to base station) ?
I Dont worry about each sequence exact purpose yet; these are different on
the forward and reverse links; well see their jobs after the introductions
Spreading
Sequence
A
Spreading
Sequence
B
Spreading
Sequence
C
Spreading
Sequence
C
Spreading
Sequence
B
Spreading
Sequence
A
Input
Data
X
Recovered
Data
X
X+A X+A+B X+A+B+C X+A+B X+A
Spread-Spectrum Chip Streams
ORIGINATING SITE DESTINATION
Meet one type of CDMA Spreading Sequence:
The Walsh Codes
I 64 Magic Sequences, each 64 chips long
I Each Walsh Code is precisely Orthogonal
compared against any other Walsh Code
its simple to generate these codes, or
theyre small enough to store in ROM
WALSH CODES
# ---------------------------------- 64-Chip Sequence ------------------------------------------
0 0000000000000000000000000000000000000000000000000000000000000000
1 0101010101010101010101010101010101010101010101010101010101010101
2 0011001100110011001100110011001100110011001100110011001100110011
3 0110011001100110011001100110011001100110011001100110011001100110
4 0000111100001111000011110000111100001111000011110000111100001111
5 0101101001011010010110100101101001011010010110100101101001011010
6 0011110000111100001111000011110000111100001111000011110000111100
7 0110100101101001011010010110100101101001011010010110100101101001
8 0000000011111111000000001111111100000000111111110000000011111111
9 0101010110101010010101011010101001010101101010100101010110101010
10 0011001111001100001100111100110000110011110011000011001111001100
11 0110011010011001011001101001100101100110100110010110011010011001
12 0000111111110000000011111111000000001111111100000000111111110000
13 0101101010100101010110101010010101011010101001010101101010100101
14 0011110011000011001111001100001100111100110000110011110011000011
15 0110100110010110011010011001011001101001100101100110100110010110
16 0000000000000000111111111111111100000000000000001111111111111111
17 0101010101010101101010101010101001010101010101011010101010101010
18 0011001100110011110011001100110000110011001100111100110011001100
19 0110011001100110100110011001100101100110011001101001100110011001
20 0000111100001111111100001111000000001111000011111111000011110000
21 0101101001011010101001011010010101011010010110101010010110100101
22 0011110000111100110000111100001100111100001111001100001111000011
23 0110100101101001100101101001011001101001011010011001011010010110
24 0000000011111111111111110000000000000000111111111111111100000000
25 0101010110101010101010100101010101010101101010101010101001010101
26 0011001111001100110011000011001100110011110011001100110000110011
27 0110011010011001100110010110011001100110100110011001100101100110
28 0000111111110000111100000000111100001111111100001111000000001111
29 0101101010100101101001010101101001011010101001011010010101011010
30 0011110011000011110000110011110000111100110000111100001100111100
31 0110100110010110100101100110100101101001100101101001011001101001
32 0000000000000000000000000000000011111111111111111111111111111111
33 0101010101010101010101010101010110101010101010101010101010101010
34 0011001100110011001100110011001111001100110011001100110011001100
35 0110011001100110011001100110011010011001100110011001100110011001
36 0000111100001111000011110000111111110000111100001111000011110000
37 0101101001011010010110100101101010100101101001011010010110100101
38 0011110000111100001111000011110011000011110000111100001111000011
39 0110100101101001011010010110100110010110100101101001011010010110
40 0000000011111111000000001111111111111111000000001111111100000000
41 0101010110101010010101011010101010101010010101011010101001010101
42 0011001111001100001100111100110011001100001100111100110000110011
43 0110011010011001011001101001100110011001011001101001100101100110
44 0000111111110000000011111111000011110000000011111111000000001111
45 0101101010100101010110101010010110100101010110101010010101011010
46 0011110011000011001111001100001111000011001111001100001100111100
47 0110100110010110011010011001011010010110011010011001011001101001
48 0000000000000000111111111111111111111111111111110000000000000000
49 0101010101010101101010101010101010101010101010100101010101010101
50 0011001100110011110011001100110011001100110011000011001100110011
51 0110011001100110100110011001100110011001100110010110011001100110
52 0000111100001111111100001111000011110000111100000000111100001111
53 0101101001011010101001011010010110100101101001010101101001011010
54 0011110000111100110000111100001111000011110000110011110000111100
55 0110100101101001100101101001011010010110100101100110100101101001
56 0000000011111111111111110000000011111111000000000000000011111111
57 0101010110101010101010100101010110101010010101010101010110101010
58 0011001111001100110011000011001111001100001100110011001111001100
59 0110011010011001100110010110011010011001011001100110011010011001
60 0000111111110000111100000000111111110000000011110000111111110000
61 0101101010100101101001010101101010100101010110100101101010100101
62 0011110011000011110000110011110011000011001111000011110011000011
63 0110100110010110100101100110100110010110011010010110100110010110
EXAMPLE:
Correlation of Walsh Code #23 with Walsh Code #59
#23 0110100101101001100101101001011001101001011010011001011010010110
#59 0110011010011001100110010110011010011001011001100110011010011001
Sum 0000111111110000000011111111000011110000000011111111000000001111
Correlation Results: 32 1s, 32 0s: theyre Orthogonal!!
Unique Properties:
Mutual Orthogonality
Sneak Preview of the other CDMA Sequences
I The other two CDMA sequences
are generated in shift registers
I An ordinary shift register is no fun,
sequence length = register length
I A Tapped shift register generates
a wild, self-mutating sequence
2
N
-1 chips long (N=register length)
Such sequences match if
compared in step (no-brainer,
any sequence matches itself)
Such sequences appear
approximately orthogonal if
compared with themselves not
exactly matched in time
false correlation typically ~1%
A Tapped, Summing Shift Register
Sequence repeats every 2
N
-1 chips,
where N is number of cells in register
An Ordinary Shift Register
Sequence repeats every N chips,
where N is number of cells in register
A Special Characteristic of Sequences
Generated in Tapped Shift Registers
Compared In-Step: Matches Itself
Complete Correlation: All 0s Sum:
Self, in sync:
Sequence:
Compared Shifted: Little Correlation
Practically Orthogonal: Half 1s, Half 0s Sum:
Self, Shifted:
Sequence:
Meet another CDMA Spreading Sequence:
The PN Short Code
I The PN Short Code consists of two
PN Sequences, I (in-phase) and Q
(quadrature), each 32,768 chips long
Theyre generated in similar but
differently-tapped 15-bit-long shift
registers
I&Q always used simultaneously,
modulating the two phase axes
of a QPSK RF modulator
The PN Short Code
I
Q
32,768 chips long
26-2/3 ms.
(75 repetitions in 2 sec.)
CDMA QPSK Phase Modulator
Using I and Q PN Sequences
I-sequence
Q-sequence

cos t
sin t
chip
input
QPSK-
modulated
RF
Output
*
* In BTS, I and Q are used in-phase.
In handset, Q is delayed 1/2 chip to
avoid zero-amplitude crossings which
would require a linear power amplifier
Acronym: PN = Pseudorandom Noise
Meet another CDMA Spreading Sequence:
The PN Long Code
I Generated in a 42-bit register, the PN Long code is more than 40 days
long (~4x10
13
chips) -- too big to store in ROM in a handset, so its
generated chip-by-chip using the scheme shown above
I Each handset codes its signal with the PN Long Code, but at a unique
offset computed using its ESN (32 bits) and 10 bits set by the system
this is called the Public Long Code Mask; produces unique shift
private long code masks are available for enhanced privacy
I Integrated over a period even as short as 64 chips, phones with different
PN long code offsets will appear practically orthogonal
Long Code
State Register
(@ 1.2288 MCPS)
Public
Long Code Mask
(STATIC)
User Long Code
Sequence
(@1.2288 MCPS)
1 1 0 0 0 1 1 0 0 0 Phone s ESN , Pe rmu t ed
+
=
SUM
Modulo-2 Addition
Putting it All Together: the CDMA Channels
I All three spreading codes are used on both the forward and reverse links
I Forward Channel: Each Sector has a unique PN Short Code offset, each user
in that sector has a personal Walsh Code
long code is used incidentally for scrambling
I Reverse Channel: Each phone has a unique PN Long Code offset, different
from every other phone in the world
Incidentally, Walsh Codes used as symbols, short code for modulation
BTS
PN LONG CODE
at users offset
FORWARD CHANNEL
REVERSE CHANNEL
All WALSH CODES
used as tokens
for user bits,
makes signal
very robust
scrambled + WALSH CODE
PN SHORT CODE
at unique PN offset
of BTS sector
SHORT PN:
used at offset 0,
gives OQPSK
modulation
by Long Code
How a BTS Builds the Forward Code Channels
BSC or
Access
Manager
BTS (1 sector)
FEC
Walsh #1
Sync FEC
Walsh #32
FEC
Walsh #0
FEC
Walsh #12
FEC
Walsh #27
FEC
Walsh #44
Pilot
Paging
Vocoder
Vocoder
Vocoder
Vocoder
more more
Short PN Code
PN Offset 246
Trans-
mitter,
Sector X
Switch
more
a Channel Element
A Forward Channel
is identified by:
its CDMA RF
carrier Frequency
the unique Short
Code PN Offset of
the sector
the unique Walsh
Code of the user
FEC
Walsh #23

Q

I
x
x
+
cos t
sin t
I Q
Functions of the CDMA Forward Channels
I PILOT: WALSH CODE 0
The Pilot is a structural beacon which
does not contain a character stream. It is a
timing source used in system acquisition
and as a measurement device during
handoffs
I SYNC: WALSH CODE 32
This carries a data stream of system
identification and parameter information
used by mobiles during system acquisition
I PAGING: WALSH CODES 1 up to 7
There can be from one to seven paging
channels as determined by capacity needs.
They carry pages, system parameters
information, and call setup orders
I TRAFFIC: any remaining WALSH codes
The traffic channels are assigned to
individual users to carry call traffic. All
remaining Walsh codes are available,
subject to overall capacity limited by noise
Pilot Walsh 0
Walsh 19
Paging Walsh 1
Walsh 6
Walsh 11
Walsh 20
Sync Walsh 32
Walsh 42
Walsh 37
Walsh 41
Walsh 56
Walsh 60
Walsh 55
Code Channels in the Reverse Direction
BSC
(Access
Manager)
Switch BTS (1 sector)
Channel Element
Access Channels
Vocoder
Vocoder
Vocoder
Vocoder
more more
Receiver,
Sector X
A Reverse Channel is identified by:
its CDMA RF carrier Frequency
the unique Long Code PN Offset
of the individual handset
Channel Element
Channel Element
Channel Element
Channel Element
Long Code Gen
Long Code Gen
Long Code Gen
Long Code Gen
Long Code Gen
more
Long
Code
offset
Long
Code
offset
Long
Code
offset
Long
Code
offset
Long
Code
offset
Long
Code
offset
Functions of the CDMA Reverse Channels
There are two types of CDMA Reverse Channels:
I TRAFFIC CHANNELS are used by individual users
during their actual calls to transmit traffic to the BTS
a reverse traffic channel is defined by a user-
specific public or private Long Code mask
there are as many reverse Traffic Channels as
there are CDMA phones in the world
I ACCESS CHANNELS are used by mobiles not yet in a
call to transmit registration requests, call setup
requests, page responses, order responses, and other
signaling information
an access channel is defined by a public long
code mask specific to the BTS sector
Access channels are paired with Paging
Channels. There can be up to 32 access
channels per paging channel
REG
1-800
242
4444
BTS
Basic CDMA Network Architecture
Access Manager
or (C)BSC
Switch BTS
Ch. Card
Vocoders
Selectors
CDSU
CDSU
DTCs
Txcvr
B
RFFE
B
GPS
PSTN
DISCO 1
DS0 in T1
Packets
Chips
RF
Channel
Element
Vocoder
Variable Rate Vocoding & Multiplexing
I Vocoders compress speech, reduce bit
rate
I CDMA uses a superior Variable Rate
Vocoder
full rate during speech
low rates in speech pauses
increased capacity
more natural sound
I Voice, signaling, and user secondary
data may be mixed in CDMA frames
I The protocols governing the mixture are
the Multiplex Options; 1 = 8K, 2 = 13K
I The content of the primary traffic bits are
determined by Service Options which the
mobile and system negotiate
DSP QCELP VOCODER
Codebook
Pitch
Filter
Formant
Filter
Coded Result
Feed-
back
20ms Sample
Frame Sizes bits
Full Rate Frame
1/2 Rate Frame
1/4 Rt.
1/8
36
72
144
288
Frame Contents: can be a mixture of
Voice Signaling Secondary
Forward Power Control
I The BTS continually reduces the strength of each users forward
baseband chip stream
I When a particular handset sees errors on the forward link, it
requests more energy
I The complainers chip stream gets a quick boost; afterward,
continues to diminish
Forward
RF
BSC BTS (1 sector)
Sync
Pilot
Paging
more
Short PN
Trans-
mitter,
Sector X

I Q
User 1
User 2
User 3
Vocoder/
Selector
Help!
Reverse Power Control
I Three methods work in tandem to equalize all handset signal levels
at the BTS
Reverse Open Loop: handset adjusts power up or down based
on received BTS signal (AGC)
Reverse Closed Loop: Is handset too strong? BTS tells up or
down 1 dB 800 times/second
Reverse Outer Loop: BSC has FER trouble hearing handset?
BSC adjusts BTS setpoint
RX RF
TX RF Digital
BTS BSC
Setpoint
Bad FER?
Raise Setpoint
Stronger than
setpoint?
Reverse
RF
800 bits per second
Occasionally,
as needed
Handset
Open
Loop
Closed
Loop
Digital
Whats In a Handset?
Receiver
RF Section
IF, Detector
Transmitter
RF Section
Vocoder
Digital
Rake Receiver
Traffic Correlator
PN xxx Walsh xx

Traffic Correlator
PN xxx Walsh xx
Traffic Correlator
PN xxx Walsh xx
Pilot Searcher
PN xxx Walsh 0
Viterbi
Decoder
CPU
Duplexer
Transmitter
Digital Section
Long Code Gen.
O
p
e
n

L
o
o
p
Transmit Gain Adjust
Messages
Messages
Audio
Audio
Packets
Symbols
Symbols
Chips
RF
RF
AGC
The Rake Receiver
I Every frame, handset uses combined outputs of the three traffic
correlators (rake fingers)
I Each finger can independently recover a particular PN offset and
Walsh code
I Fingers can be targeted on delayed multipath reflections, or even on
different BTSs
I Searcher continuously checks pilots
Handset
Rake Receiver
RF
PN Walsh
PN Walsh
PN Walsh
Searcher
PN W=0
Voice,
Data,
Messages
Pilot E
c
/I
o
BTS
BTS
CDMA Soft Handoff Mechanics
I CDMA soft handoff is driven by the handset
Handset continuously checks available pilots
Handset tells system pilots it currently sees
System assigns sectors (up to 6 max.), tells handset
Handset assigns its fingers accordingly
All messages sent by dim-and-burst, no muting!
I Each end of the link chooses what works best, on a frame-by-frame
basis!
Users are totally unaware of handoff
Handset
Rake Receiver
RF
PN Walsh
PN Walsh
PN Walsh
Searcher
PN W=0
Voice,
Data,
Messages
Pilot E
c
/I
o
BTS
BSC Switch
BTS
Sel.
Softer Handoff
I Each BTS sector has unique PN offset & pilot
I Handset will ask for whatever pilots it wants
I If multiple sectors of one BTS simultaneously serve a handset, this is
called Softer Handoff
I Handset is unaware, but softer handoff occurs in BTS in a single
channel element
I Handset can even use combination soft-softer handoff on multiple
BTS & sectors
Handset
Rake Receiver
RF
PN Walsh
PN Walsh
PN Walsh
Searcher
PN W=0
Voice,
Data,
Messages
Pilot E
c
/I
o
BTS
BSC Switch
Sel.
Course 302
CDMA Messaging and Call Flow
CDMA Messaging and Call Flow
Messaging as an Investigative Resource:
Why did a Flight Crash? Why did a Call Drop?
I Layer-3 Messaging between system
and phone during a call is much like
in-flight voice messaging between
air traffic controllers and pilots.
I When a call drops or a flight goes
down, intense investigation of the
messaging will often identify the
cause of the problem.
I The Cockpit Voice Recorder gives
extremely valuable information. The
CDMA equivalent is a log file from
drive-test equipment. It can answer:
What was the call state at the
time of the crash? (handoffs,
primary PN, mobile parameters)
Was messaging reliable?
Were there any pending
messages not acknowledged or
requests not yet implemented
on either side?
Was either link under stress?
CDMA Messaging is much like
Air Traffic Control messaging
BTS
Sources of CDMA Data and Tools for Processing
I CDMA optimization data flows from three places:
Switch, CDMA peripherals and base stations, and the Handset
I Various software and hardware tools are available for collection
and analysis of each of these streams of data
I Data contains messages and various indicators of RF performance
Access Mgr./BSC-BSM Switch BTS
CDSU DISCO
Ch. Card ACC

TFU1
GPSR
CDSU
CDSU
DISCO 1
DISCO 2
SBS
Vocoders
Selectors
CDSU
CDSU
CDSU
CDSU
CDSU
CDSU
CM SLM
LPP LPP ENET
DTCs
DMS-BUS
Txcvr A
Txcvr B
Txcvr C
RFFE A
RFFE B
RFFE C
TFU1
GPSR
IOC
BSM
Data Analysis
Post-Processing
Tools
IS-95/J Std 8 Messages
IS-95/J Std 8
Messages
NOIS Messages
QC-Specific Messages
Switch OMs,
pegs, logs
Mobile Data
Post-Processing
Tools
Mobile Data
Capture Tools Selector
Logs
NMIS Messages
Handset
Messages
External
Analysis
Tools
PC-based
PC-based
Unix-based,
PC-based
Various
CDMA NETWORK EQUIPMENT
HANDSET
Structure of CDMA Messages
I CDMA messages on both forward
and reverse links are normally sent
via dim-and-burst
I Messages include many fields of
binary data
I The first byte of each message
identifies message type to allow the
recipient to parse the contents
I To ensure no messages are
missed, all CDMA messages bear
serial numbers and important
messages contain a bit requesting
acknowledgment
I Messages not promptly
acknowledged are retransmitted
several times, after which the
sender may release the call
I Surveyor parses all messages for
review and analysis
MSG_TYPE (00000110)
ACK_SEQ
MSG_SEQ
ACK_REQ
ENCRYPTION
ERRORS_DETECTED
POWER_MEAS_FRAMES
LAST_HDM_SEQ
NUM_PILOTS
PILOT_STRENGTH
RESERVED (0s)
8
3
3
1
2
5
10
2
4
6
0-7
NUM_PILOTS occurrences of this field:
Field
Length
(in bits)
EXAMPLE:
A POWER MEASUREMENT
REPORT MESSAGE
Messages In Acquisition and Idle States
Sync Channel
Sync Channel Msg
Pilot Channel
No Messages
Paging Channel
Access Parameters Msg
System Parameters Msg
CDMA Channel List Msg
Extended System
Parameters Msg
Extended Neighbor
List Msg
Global Service
Redirection Msg
Order Msg
Base Station Acknowledgment
Lock until Power-Cycled
Maintenance required
many others..
Authentication
Challenge Msg
Status Request Msg
Feature Notification Msg
TMSI Assignment Msg
Channel Assignment
Msg
SSD Update Msg
Service Redirection Msg
General Page Msg
Null Msg Data Burst Msg
Access Channel
Registration Msg
Order Msg
Mobile Station Acknowldgment
Long Code Transition Request
SSD Update Confirmation
many others..
Origination Msg
Page Response Msg
Authentication Challenge
Response Msg
Status Response Msg
TMSI Assignment
Completion Message
Data Burst Msg
BTS
Messages During a Call: Conversation State
Reverse Traffic Channel
Order Message
Mobile Sta. Acknowledgment
Long Code Transition
Request
SSD Update Confirmation
Connect
Authentication Challenge
Response Msg
Flash With
Information Msg
Data Burst Message
Pilot Strength
Measurement Msg
Power Measurement
Report Msg
Send Burst DTMF Msg
Origination
Continuation Msg
Handoff Completion Msg
Parameters Response
Message
Service Request Msg
Service Response Msg
Service Connect
Completion Message
Service Option Control
Message
Status Response Msg
TMSI Assignment
Completion Message
Forward Traffic Channel
Order Msg
Base Station Acknowledgment
Base Station Challenge
Confirmation
Message Encryption Mode
Authentication
Challenge Msg
Alert With
Information Msg
Data Burst Msg
Analog Handoff
Direction Msg
In-Traffic System
Parameters Msg
Neighbor List
Update Msg
Send Burst DTMF Msg
Power Control
Parameters Msg.
Retrieve Parameters Msg
Set Parameters Msg
SSD Update Msg
Flash With
Information Msg
Mobile Station
Registered Msg
Status Request Msg
Extended Handoff
Direction Msg
Service Request Msg
Service Response Msg
Service Connect Msg
Service Option
Control Msg
TMSI Assignment Msg
Adventures in Call Processing
5 Minutes in the Life of a CDMA Handset
Adventures in Call Processing
5 Minutes in the Life of a CDMA Handset
3
0

S
e
c
o
n
d
s
(
t
h
a
t
s

a
ll
w
e
v
e

g
o
t

t
im
e

t
o

d
o

in

o
n
e

d
a
y
!
)
Our Call Processing Adventures
I Lets Acquire the System!
I Lets do an Idle Mode Handoff!
I Lets Register!
I Lets Receive an Incoming Call!
I Lets Make an Outgoing Call!
I Lets End a Call!
I Lets Receive Notification of a Voice Message!
I Lets Do a Handoff!
Lets Acquire the System!
Lets Acquire the System!
CDMA Call Processing
Find a Frequency with a CDMA RF Signal
Mobile scans forward link frequencies:
(Cellular or PCS, depending on model)
History List
Preferred Roaming List
until a CDMA signal is found.
NO CDMA?! Go to AMPS,
or to a power-saving standby mode
HISTORY
LIST
Last-used:
Freq/SID x
Freq/SID y
Freq/SID z
Freq/SID t
Freq/SID u
etc.
FREQUENCY LISTS:
PREFERRED
ROAMING
LIST
Freq/SID 1
Freq/SID 2
Freq/SID 3
Freq/SID 4
Freq/SID 5
etc.
Forward Link Frequencies
(Base Station Transmit)
A D B E F C
unlic.
data
unlic.
voice
A D B E F C
1850MHz. 1910MHz. 1990 MHz. 1930MHz.
1900 MHz. PCS Spectrum
824 MHz. 835 845 870 880 894
869
849
846.5
825
890
891.5
Paging, ESMR, etc.
A B A B
800 MHz. Cellular Spectrum
Reverse Link Frequencies
(Mobile Transmit)
Find Strongest Pilot, Read Sync Channel
Rake Fingers
Reference PN
Active Pilot
E
c
/
I
o
0
0
32K
512
Chips
PN
1. Pilot Searcher Scans the Entire Range of PNs
All PN Offsets
0
-20
98/05/24 23:14:09.817 [SCH]
Sync Channel Message
MSG_LENGTH = 208 bits
MSG_TYPE = Sync Channel Message
P_REV = 3
MIN_P_REV = 2
SID = 179
NID = 0
PILOT_PN = 168 Offset Index
LC_STATE = 0x0348D60E013
SYS_TIME = 98/05/24 23:14:10.160
LP_SEC = 12
LTM_OFF = -300 minutes
DAYLT = 0
PRAT = 9600 bps
RESERVED = 1
2. Put Rake finger(s) on strongest
available PN, decode Walsh 32,
and read Sync Channel Message
SYNC CHANNEL MESSAGE
Handset
Rake Receiver
RF
LO
Srch PN??? W0
F1 PN168 W32
F2 PN168 W32
F3 PN168 W32
The Configuration Messages
I After reading the Sync Channel, the mobile is now capable of
reading the Paging Channel, which now monitors constantly
I Before it is allowed to transmit or operate on this system, the
mobile must collect a complete set of configuration messages
I Collection is a short process -- all configuration messages are
repeated on the paging channel every 1.28 seconds
I The configuration messages contain sequence numbers so the
mobile can recognize if any of the messages have been freshly
updated as it continues to monitor the paging channel
Access parameters message sequence number
Configuration message sequence number
If a mobile notices a changed sequence number, or if 600
seconds passes since the last time these messages were read,
the mobile reads all of them again
Go to Paging Channel, Get Configured
Rake Fingers
Reference PN
Active Pilot
E
c
/
I
o
0
0
32K
512
Chips
PN
All PN Offsets
0
-20
Keep Rake finger(s) on strongest
available PN, decode Walsh 1,
and monitor the Paging Channel
Read the
Configuration Messages
Access Parameters Msg
System Parameters Msg
CDMA Channel List Msg
Extended System
Parameters Msg (*opt.)
(Extended*) Neighbor
List Msg
Global Service
Redirection Msg (*opt.)
Now were ready to operate!!
Handset
Rake Receiver
RF
LO
Srch PN??? W0
F1 PN168 W01
F2 PN168 W01
F3 PN168 W01
Two Very Important Configuration Messages
98/05/24 23:14:10.427 [PCH]
MSG_TYPE = Access Parameters Message
ACC_MSG_SEQ = 27
ACC_CHAN = 1 channel
NOM_PWR = 0 dBINIT_PWR = 0 dBPWR_STEP = 4 Db
NUM_STEP = 5 Access Probes Maximum
MAX_CAP_SZ = 4 Access Channel Frames Maximum
PAM_SZ = 3 Access Channel Frames
Persist Val for Acc Overload Classes 0-9 = 0
Persist Val for Acc Overload Class 10 = 0
Persistance Modifier for Msg Tx = 1
Persistance Modifier for Reg = 1
Probe Randomization = 15 PN chips
Acknowledgement Timeout = 320 ms
Probe Backoff Range = 4 Slots Maximum
Probe Sequence Backoff Range = 4 Slots Max.
Max # Probe Seq for Requests = 2 Sequences
Max # Probe Seq for Responses = 2 Sequences
Authentication Mode = 1
Random Challenge Value = Field Omitted
Reserved Bits = 99
ACCESS PARAMETERS MESSAGE
98/05/24 23:14:11.126 [PCH] System Parameter Message
MSG_TYPE = System Parameters Message
CONFIG_MSG_SEQ = 0
SID = 179 NID = 0
REG_ZONE = 0 TOTAL_ZONES = 0 ZONE_TIMER = 60 min
MULT_SIDS = 0 MULT_NID = 0 BASE_ID = 8710
BASE_CLASS = Public Macrocellular
PAGE_CHAN = 1 channel
MAX_SLOT_CYCLE_INDEX = 0
HOME_REG = 0 FOR_SID_REG = 0 FOR_NID_REG = 1
POWER_UP_REG = 0 POWER_DOWN_REG = 0
PARAMETER_REG = 1 REG_PRD = 0.08 sec
BASE_LAT = 00D00'00.00N BASE_LONG = 000D00'00.00E
REG_DIST = 0
SRCH_WIN_A = 40 PN chips
SRCH_WIN_N = 80 PN chips
SRCH_WIN_R = 4 PN chips
NGHBR_MAX_AGE = 0
PWR_REP_THRESH = 2 frames
PWR_REP_FRAMES = 56 frames
PWR_THRESH_ENABLE = 1
PWR_PERIOD_ENABLE = 0
PWR_REP_DELAY = 20 frames
RESCAN = 0
T_ADD = -13.0 dB T_DROP = -15.0 dB T_COMP = 2.5 dB
T_TDROP = 4 sec
EXT_SYS_PARAMETER = 1
RESERVED = 0
GLOBAL_REDIRECT = 0
SYSTEM PARAMETERS MESSAGE
Four Additional Configuration Messages
98/05/24 23:14:10.946 [PCH]
Extended System Parameters Message
MSG_TYPE = Extended System Parameters Message
CONFIG_MSG_SEQ = 0 RESERVED = 0
PREF_MSID_TYPE = IMSI and ESN
MCC = 000 IMSI_11_12 = 00
RESERVED_LEN = 8 bits
RESERVED_OCTETS = 0x00
BCAST_INDEX = 0
RESERVED = 0
EXTENDED SYSTEM PARAMETERS
98/05/17 24:21.566 Paging Channel: Global Service Redirection
PILOT_PN: 168, MSG_TYPE: 96, CONFIG_MSG_SEQ: 0
Redirected access overload classes: { 0, 1 },
RETURN_IF_FAIL: 0,
DELETE_TMSI: 0,
Redirection to an analog system:
EXPECTED_SID = 0
Do not ignore CDMA Available indicator on the redirected analog
system
Attempt service on either System A or B with the custom system
selection process
GLOBAL SERVICE REDIRECTION
98/05/24 23:14:11.486 [PCH] Neighbor List Message
MSG_TYPE = Neighbor List Message
CONFIG_MSG_SEQ = 0
PILOT_INC = 4 Offset Index
NGHBR_CONFIG = 0 NGHBR_PN = 220 Offset Index
RESERVED = 0
NEIGHBOR LIST
98/05/24 23:14:10.786 [PCH] CDMA Channel List Message
MSG_TYPE = CDMA Channel List Message
CONFIG_MSG_SEQ = 0
CDMA_FREQ = 283
RESERVED = Field Omitted
CDMA CHANNEL LIST MESSAGE
Lets do an
Idle Mode Handoff!
Lets do an
Idle Mode Handoff!
Idle Mode Handoff
I An idle mobile always demodulates the best available signal
In idle mode, it isnt possible to do soft handoff and listen to
multiple sectors or base stations at the same time -- the paging
channel information stream is different on each sector, not
synchronous -- just as the TV news programs on different
networks are not in sync word-by-word if viewed together
Since a mobile cant combine signals, the mobile must switch
quickly, always enjoying the best available signal
I The mobiles pilot searcher is constantly checking neighbor pilots
I If the searcher notices a better signal, the mobile continues on the
current paging channel until the end of the current superframe,
then instantly switches to the paging channel of the new signal
The system doesnt know the mobile did this! (Does NBCs
Tom Brokaw know you just switched your TV to CNN?)
I On the new paging channel, if the mobile learns that registration is
required, it re-registers on the new sector
Idle Mode on the Paging Channel:
Meet the Neighbors, track the Strongest Pilot
E
c
/
I
o
All PN Offsets
0
0
32K
512
Chips
PN
0
-20
Neighbor Set
The phones pilot searcher constantly checks
the pilots listed in the Neighbor List Message
If the searcher ever notices a neighbor pilot substantially stronger than
the current reference pilot, it becomes the new reference pilot
and the phone switches over to its paging channel on the next superframe.
This is called an idle mode handoff.
Rake Fingers
Reference PN
Active Pilot
SRCH_WIN_A
SRCH_WIN_N
Mobile Rake RX
Srch PN??? W0
F1 PN168 W01
F2 PN168 W01
F3 PN168 W01
Phone Operation on the Access Channel
I A sectors Paging Channel announces 1
(typ) to 32 (max) Access Channels: PN
Long Code offsets for mobiles to use if
accessing the system.
For mobiles sending Registration,
Origination, Page Responses
Base Station always listening!
I On the access channel, phones are not
yet under BTS closed-loop power control!
I Phones access the BTS by probing at
power levels determined by receive power
and an open loop formula
If probe not acknowledged by BTS
within ACC_TMO (~400 mS.), phone
will wait a random time (~200 mS)
then probe again, stronger by PI db.
There can be 15 max. (typ. 5) probes
in a sequence and 15 max. (typ. 2)
sequences in an access attempt
most attempts succeed on first probe!
I The Access Parameters message on the
paging channel announces values of all
related parameters
ACCESS
RV TFC
BTS
Channel Assnmt. Msg.
Origination Msg
Base Sta. Acknlgmt. Order
TFC frames of 000s
TFC preamble of 000s
Mobile Sta. Ackngmt. Order
Service Connect Msg.
Svc. Connect Complete Msg
Call is Established!
MS
Probing
PAGING
FW TFC
PAGING
RV TFC
FW TFC
RV TFC
FW TFC
FW TFC
A Successful Access Attempt
a Probe Sequence
an Access Attempt
Success!
an Access Probe
Lets Register!
Lets Register!
Registration
I Registration is the process by which an idle mobile lets the system
know its awake and available for incoming calls
this allows the system to inform the mobiles home switch of
the mobiles current location, so that incoming calls can be
delivered
registration also allows the system to intelligently page the
mobile only in the area where the mobile is currently located,
thereby eliminating useless congestion on the paging channels
in other areas of the system
I There are many different conditions that could trigger an obligation
for the mobile to register
there are flags in the System Parameters Message which tell
the mobile when it must register on the current system
An Actual Registration
16:18:27.144 Access Channel: Registration
ACK_SEQ: 7 MSG_SEQ: 1 ACK_REQ: 1 VALID_ACK: 0
ACK_TYPE: 0
MSID_TYPE: 3, ESN: [0x 01 99 0d fc]
MFR 1, Reserved 38, Serial Number 69116,
IMSI: (Class: 0, Class_0_type: 1) [0x 01 8d 31 74 29 36]
00-416-575-0421
AUTH_MODE: 0
REG_TYPE: Timer-based
SLOT_CYCLE_INDEX: 2
MOB_P_REV: 1
EXT_SCM: 1
SLOTTED_MODE: 1
MOB_TERM: 1
REGISTRATION MESSAGE
18:26.826 [PCH] System Parameters Message
Pilot_PN: 32
CONFIG_MSG_SEQ: 14 SID: 16420 NID: 0,
REG_ZONE: 0 TOTAL_ZONES: 0 Zone timer length (min): 1
MULT_SIDS: 0 MULT_NIDS: 0
BASE_ID: 1618 BASE_CLASS: Reserved
PAG_CHAN: 1 MAX_SLOT_CYCLE_INDEX: 2
HOME_REG: 1 FOR_SID_REG: 1 FOR_NID_REG: 1,
POWER_UP_REG: 1 POWER_DOWN_REG: 1
PARAMETER_REG: 1 Registration period (sec): 54
Base station 00000.00 Lon., 00000.00 Lat. REG_DIST: 0
SRCH_WIN_A (PN chips): 28 SRCH_WIN_N (PN chips): 100,
SRCH_WIN_R (PN chips): 130 NGHBR_MAX_AGE: 2
PWR_REP_THRESH: 2 PWR_REP_FRAMES (frames): 15
PWR_THRESH_ENABLE: 1 PWR_PERIOD_ENABLE: 0,
PWR_REP_DELAY: 1 (4 frames) RESCAN: 0,
T_ADD: -14.0dB T_DROP: -16.0dB T_COMP: 2.5dB,
T_TDROP: 4s
EXT_SYS_PARAMETER: 1
EXT_NGHBR_LIST: 1
GLOBAL_REDIRECT: 0
SYSTEM PARAMETERS MESSAGE
16:18:27.506 Paging Channel: Order
MSID_TYPE: 2 IMSI: (Class: 0, Class_0_type: 3)
[0x 02 47 8d 31 74 29 36] (302) 00-416-575-0421
Order type: Base Station Acknowledgement Order
BASE STATION ACKNOWLEDGMENT
The System Parameters Message tells
all mobiles when they should register.
This mobile notices that it is obligated to
register, so it transmits a Registration
Message.
The base station confirms that the
mobiles registration message was
received. Were officially registered!
Lets Receive
an incoming Call!
Lets Receive
an incoming Call!
Receiving an Incoming Call
I All idle mobiles monitor the paging channel to receive incoming
calls.
I When an incoming call appears, the paging channel notifies the
mobile in a General Page Message.
I A mobile which has been paged sends a Page Response
Message on the access channel.
I The system sets up a traffic channel for the call, then notifies the
mobile to use it with a Channel Assignment Message.
I The mobile and the base station notice each others traffic channel
signals and confirm their presence by exchanging
acknowledgment messages.
I The base station and the mobile negotiate what type of call this will
be -- I.e., 13k voice, etc.
I The mobile is told to ring and given a calling line ID to display.
I When the human user presses the send button, the audio path is
completed and the call proceeds.
An Actual Page and Page Response
98/05/24 23:14:46.425 [ACH] Page Response Message
MSG_TYPE = Page Response Message
ACK_SEQ = 1 MSG_SEQ = 2 ACK_REQ = 1
VALID_ACK = 1 ACK_TYPE = 2
MSID_TYPE = IMSI and ESN MSID_LEN = 9 octets
ESN = 0xD30E415C IMSI_CLASS = 0
IMSI_CLASS_0_TYPE = 0 RESERVED = 0
IMSI_S = 6153300644
AUTH_MODE = 1
AUTHR = 0x307B5 RANDC = 0xC6 COUNT = 0
MOB_TERM = 1 SLOT_CYCLE_INDEX = 0
MOB_P_REV = 3 SCM = 106
REQUEST_MODE = Either Wide Analog or CDMA Only
SERVICE_OPTION = 32768 PM = 0
NAR_AN_CAP = 0 RESERVED = 0
PAGE RESPONSE MESSAGE
98/05/24 23:14:46.127 [PCH] General Page Message
MSG_TYPE = General Page Message
CONFIG_MSG_SEQ = 1 ACC_MSG_SEQ = 20
CLASS_0_DONE = 1
CLASS_1_DONE = 1 RESERVED = 0
BROADCAST_DONE = 1 RESERVED = 0
ADD_LENGTH = 0 bits ADD_PFIELD = Field Omitted
PAGE_CLASS = 0 PAGE_SUBCLASS = 0
MSG_SEQ = 1
IMSI_S = 6153300644
SPECIAL_SERVICE = 1
SERVICE_OPTION = 32768
RESERVED = Field Omitted
GENERAL PAGE MESSAGE
98/05/24 23:14:46.768 [PCH] Order Message
MSG_TYPE = Order Message
VALID_ACK = 1
ADDR_TYPE = IMSI ADDR_LEN = 40 bits
IMSI_CLASS = 0 IMSI_CLASS_0_TYPE = 0 RESERVED = 0
IMSI_S = 6153300644
ORDER = Base Station Acknowledgement Order
ADD_RECORD_LEN = 0 bits
Order-Specific Fields = Field Omitted RESERVED = 0
The system pages the mobile,
615-330-0644.
The base station confirms that the mobiles
page response was received. Now the
mobile is waiting for channel assignment,
expecting a response within 12 seconds.
The mobile responds to the page.
Channel Assignment and
Traffic Channel Confirmation
18:14:47.598 Reverse Traffic Channel: Order
ACK_SEQ: 0 MSG_SEQ: 0 ACK_REQ: 0
ENCRYPTION: 0
Mobile Station Acknowledgement Order
MOBILE STATION ACKNOWLEDGMENT
18:14:47.027 Paging Channel: Channel Assignment
MSID_TYPE: 2 IMSI: (Class: 0, Class_0_type: 0)
[0x 01 f8 39 6a 15] 615-330-0644
ASSIGN_MODE: Traffic Channel Assignment
ADD_RECORD_LEN: 5 FREQ_INCL: 1 GRANTED_MODE: 2
CODE_CHAN: 43 FRAME_OFFSET: 2
ENCRYPT_MODE: Encryption disabled
BAND_CLASS: 800 MHz cellular band
CDMA_FREQ: 283
CHANNEL ASSIGNMENT MESSAGE
18:14:47.581 Forward Traffic Channel: Order
ENCRYPTION: 0 USE_TIME: 0 ACTION_TIME: 0
Base Station Acknowledgement Order
Only about 400 ms. after the base station
acknowledgment order, the mobile receives
the channel assignment message.
The base station is already
sending blank frames on
the forward channel,using
the assigned Walsh code.
The mobile sees at least two
good blank frames in a row on
the forward channel, and
concludes this is the right traffic
channel. It sends a preamble
of two blank frames of its own
on the reverse traffic channel.
The base station acknowledges
receiving the mobiles preamble.
The mobile station acknowledges the
base stations acknowledgment.
Everybody is ready!
Service Negotiation and Mobile Alert
18:14:47.835 Reverse Traffic Channel:
Service Connect Completion
ENCRYPTION: 0 SERV_CON_SEQ: 0
SERVICE CONNECT COMPLETE MSG.
18:14:47.760 Forward Traffic Channel: Service Connect
ACK_SEQ: 0 MSG_SEQ: 1 ACK_REQ: 0 ENCRYPTION: 0
USE_TIME: 0 ACTION_TIME: 0 SERV_CON_SEQ: 0
Service Configuration: supported Transmission:
Forward Traffic Channel Rate (Set 2): 14400, 7200, 3600, 1800 bps
Reverse Traffic Channel Rate (Set 2): 14400, 7200, 3600, 1800 bps
Service option: (6) Voice (13k) (0x8000)
Forward Traffic Channel: Primary Traffic
Reverse Traffic Channel: Primary Traffic
SERVICE CONNECT MESSAGE
Now that both sides have arrived on the
traffic channel, the base station
proposes that the requested call
actually begin.
The mobile agrees and
says its ready to play.
18:14:47.961 Forward Traffic Channel:
Alert With Information
SIGNAL_TYPE = IS-54B Alerting
ALERT_PITCH = Medium Pitch (Standard Alert)
SIGNAL = Long RESERVED = 0
RECORD_TYPE = Calling Party Number
RECORD_LEN = 96 bits
NUMBER_TYPE = National Number
NUMBER_PLAN = ISDN/Telephony Numbering Plan
PI = Presentation Allowed SI = Network Provided
CHARi = 6153000124 RESERVED = 0 RESERVED = 0
ALERT WITH INFORMATION MESSAGE
The base station orders the mobile to ring, and
gives it the calling partys number to display.
ENCRYPTION: 0
The mobile says its ringing.
SERVICE CONNECT COMPLETE is a
major milestone in call processing. Up
until now, this was an access attempt.
Now it is officially a call.
The Human Answers! Connect Order
The mobile has been ringing for several
seconds. The human user finally
comes over and presses the send
button to answer the call.
Now the switch completes the audio circuit and
the two callers can talk!
ENCRYPTION: 0 USE_TIME: 0 ACTION_TIME: 0
ENCRYPTION: 0
Connect Order
CONNECT ORDER
Lets make an Outgoing Call!
Lets make an Outgoing Call!
Placing an Outgoing Call
I The mobile user dials the desired digits, and presses SEND.
I Mobile transmits an Origination Message on the access channel.
I The system acknowledges receiving the origination by sending a
base station acknowledgement on the paging channel.
I The system arranges the resources for the call and starts
transmitting on the traffic channel.
I The system notifies the mobile in a Channel Assignment Message
on the paging channel.
I The mobile arrives on the traffic channel.
I The mobile and the base station notice each others traffic channel
signals and confirm their presence by exchanging
acknowledgment messages.
I The base station and the mobile negotiate what type of call this will
be -- I.e., 13k voice, etc.
I The audio circuit is completed and the mobile caller hears ringing.
Origination
17:48:53.144 Access Channel: Origination
VALID_ACK: 0 ACK_TYPE: 0 MSID_TYPE: 3
ESN: [0x 00 06 98 24] MFR 0 Reserved 1
Serial Number 170020
IMSI: (Class: 0, Class_0_type: 0)
[0x 03 5d b8 97 c2] 972-849-5073
AUTH_MODE: 0 MOB_TERM: 1
SLOT_CYCLE_INDEX: 2 MOB_P_REV: 1 EXT_SCM: 1
DualMode: 0 SLOTTED_MODE: 1 PowerClass: 0
REQUEST_MODE: CDMA only SPECIAL_SERVICE: 1
Service option: (6) Voice (13k) (0x8000) PM: 0
DIGIT_MODE: 0 MORE_FIELDS: 0 NUM_FIELDS: 11
Chari: 18008900829
NAR_AN_CAP: 0
ORIGINATION MESSAGE
17:48:53.487 Paging Channel: Order
MSID_TYPE: 2
[0x 03 5d b8 97 c2] 972-849-5073
The mobile sends an
origination message
on the access
channel.
The base station confirms
that the origination message
was received.
17:48:54.367 Paging Channel: Channel Assignment
MSID_TYPE: 2
[0x 03 5d b8 97 c2] 972-849-5073
ASSIGN_MODE: Traffic Channel Assignment,
ADD_RECORD_LEN: 5 FREQ_INCL: 1 GRANTED_MODE: 2
CODE_CHAN: 12 FRAME_OFFSET: 0
ENCRYPT_MODE: Encryption disabled
BAND_CLASS: 1.8 to 2.0 GHz PCS band
CDMA_FREQ: 425
CHANNEL ASSIGNMENT MESSAGE
The base station sends a
Channel Assignment
Message and the mobile
goes to the traffic channel.
Traffic Channel Confirmation
ENCRYPTION: 0
USE_TIME: 0 ACTION_TIME: 0
The base station is already
sending blank frames on
the forward channel,using
the assigned Walsh code.
The mobile sees at least two
good blank frames in a row on
the forward channel, and
concludes this is the right traffic
channel. It sends a preamble
of two blank frames of its own
on the reverse traffic channel.
The base station acknowledges
receiving the mobiles preamble.
The mobile station acknowledges the
base stations acknowledgment.
Everybody is ready!
Service Negotiation and Connect Complete
17:48:55.137 Reverse Traffic Channel: Service Connect
Completion ACK_SEQ: 1, MSG_SEQ: 0, ACK_REQ: 1,
ENCRYPTION: 0, SERV_CON_SEQ: 0
SERVICE CONNECT COMPLETE MSG.
17:48:55.098 Forward Traffic Channel: Service Connect
USE_TIME: 0 ACTION_TIME: 0 SERV_CON_SEQ: 0
Service Configuration Supported Transmission:
Forward Traffic Channel Rate (Set 2): 14400, 7200, 3600, 1800 bps
Reverse Traffic Channel Rate (Set 2): 14400, 7200, 3600, 1800 bps
Service option: (6) Voice (13k) (0x8000)
Forward Traffic Channel: Primary Traffic
Reverse Traffic Channel: Primary Traffic
SERVICE CONNECT MESSAGE
Now that the traffic channel is working
in both directions, the base station
proposes that the requested call
actually begin.
The mobile agrees and
says its ready to play.
The base station agrees.
SERVICE CONNECT COMPLETE is a
major milestone in call processing. Up
until now, this was an access attempt.
Now it is officially a call.
Now the switch completes the audio circuit and
the two callers can talk!
Lets End a Call!
Lets End a Call!
Ending A Call
I A normal call continues until one of the parties hangs up. That
action sends a Release Order, normal release.
I The other side of the call sends a Release Order, no reason given.
If a normal release is seen, the call ended normally.
I At the conclusion of the call, the mobile reacquires the system.
Searches for the best pilot on the present CDMA frequency
Reads the Sync Channel Message
Monitors the Paging Channel steadily
I Several different conditions can cause a call to end abnormally:
the forward link is lost at the mobile, and a fade timer acts
the reverse link is lost at the base station, and a fade timer acts
a number of forward link messages arent acknowledged, and the
base station acts to tear down the link
a number of reverse link messages arent acknowledged, and the
mobile station acts to tear down the link
A Beautiful End to a Normal Call
ENCRYPTION: 0
Release Order (normal release)
MOBILE RELEASE ORDER
ACK_SEQ: 1 MSG_SEQ: 2 ACK_REQ: 0 ENCRYPTION: 0,
At the end of a normal call, this
mobile user pressed end.
The mobile left the traffic channel,
scanned to find the best pilot, and read
the Sync Channel Message.
BASE STATION RELEASE ORDER
Release Order (no reason given)
17:49:22.517 Sync Channel
MSG_TYPE: 1 Sync Channel Message
P_REV: 1 MIN_P_REV: 1
SID: 4112 NID: 2 Pilot_PN: 183
LC_STATE: 0x318fe5d84a5
SYS_TIME: 0x1ae9683dc
LP_SEC: 9 LTM_OFF: -10 DAYLT: 1
Paging Channel Data Rate: 9600
CDMA_FREQ: 425
SYNC CHANNEL MESSAGE
The base station acknowledged
receiving the message, then sent
a release message of its own.
Lets receive Notification
of a Voice Message!
Lets receive Notification
of a Voice Message!
Feature Notification
98/06/30 21:16:44.368 [PCH] Feature Notification Message
MSG_TYPE = Feature Notification Message
ACK_SEQ = 0
MSG_SEQ = 0
ACK_REQ = 1
VALID_ACK = 0
ADDR_TYPE = IMSI
ADDR_LEN = 56 bits
IMSI_CLASS = 0
IMSI_CLASS_0_TYPE = 3
RESERVED = 0
MCC = 302
IMSI_11_12 = 00
IMSI_S = 9055170325
RELEASE = 0
RECORD_TYPE = Message Waiting
RECORD_LEN = 8 bits
MSG_COUNT = 1
RESERVED = 0
FEATURE NOTIFICATION MESSAGE
The Feature Notification Message on
the Paging Channel tells a specific
mobile it has voice messages waiting.
There are other record types to notify
the mobile of other features.
The mobile confirms it has received the
notification by sending a Mobile Station
Acknowledgment Order on the access
channel.
Lets do a Handoff!
Lets do a Handoff!
The Detailed Rules of Soft Handoff
I Handset views pilots in sets
Active: pilots of sectors actually in use
Candidates: pilots mobile requested, but
not yet set up & transmitting by system
Neighbors: pilots told to mobile by system,
as nearby sectors to check
Remaining: any pilots used by system but
not already in the other sets (div. by PILOT_INC)
I Handset sends Pilot Strength Measurement
Message to the system whenever triggered by:
It notices a pilot in neighbor or remaining set
exceeds T_ADD
An active set pilot drops below T_DROP for
T_TDROP time
A candidate pilot exceeds an active by
T_COMP
I The System may set up all requested handoffs,
or it may apply special manufacturer-specific
screening criteria and authorize only some
6
5
Remaining
Active
Candidate
Neighbor 20
PILOT SETS
M
a
x
.

M
e
m
b
e
r
s
R
e
q
d
.

B
y

S
t
d
.
T_COMP
T_ADD T_DROP
T_TDROP
HANDOFF
PARAMETERS
Exercise: How does a pilot
in one set migrate into
another set, for all cases?
Identify the trigger, and the
messages involved.
The Call is Already Established. What Next?
E
c
/
I
o
All PN Offsets
0
0
32K
512
Chips
PN
0
-20
Neighbor Set
The call is already in progress.
PN 168 is the only active signal,
and also is our timing reference.
Continue checking the neighbors.
If we ever notice a neighbor with Ec/Io above T_ADD,
ask to use it! Send a Pilot Strength Measurement Message!
T_ADD
Rake Fingers
Reference PN
Active Pilot
10752
168
32000
500
14080
220
!
!
Mobile Rake RX
Srch PN??? W0
F1 PN168 W61
F2 PN168 W61
F3 PN168 W61
Mobile Requests the Handoff!
98/05/24 23:14:02.205 [RTC]
Pilot Strength Measurement Message
MSG_TYPE = Pilot Strength Measurement Message
ENCRYPTION = Encryption Mode Disabled
REF_PN = 168 Offset Index (the Reference PN)
PILOT_STRENGTH = -6.0 dB
KEEP = 1
PILOT_PN_PHASE = 14080 chips (PN220+0chips)
KEEP = 1
PILOT_PN_PHASE = 32002 chips (PN500 + 2 chips)
KEEP = 1
RESERVED = 0
PILOT STRENGTH MEASUREMENT MESSAGE
98/05/24 23:14:02.386 [FTC] Order Message
MSG_TYPE = Order Message
USE_TIME = 0 ACTION_TIME = 0
ORDER = Base Station Acknowledgement Order
Order-Specific Fields = Field Omitted
RESERVED = 0
Just prior to this message, this particular
mobile already was in handoff with PN 168
and 220.
This pilot strength measurement message
reports PN 500 has increased above
T_Add, and the mobile wants to use it too.
The base station acknowledges receiving
the Pilot Strength Measurement Message.
System Authorizes the Handoff!
98/05/24 23:14:02.926 [FTC] Extended Handoff Direction Message
MSG_TYPE = Extended Handoff Direction Message
USE_TIME = 0 ACTION_TIME = 0 HDM_SEQ = 0
SEARCH_INCLUDED = 1
SRCH_WIN_A = 40 PN chips
T_ADD = -13.0 dB T_DROP = -15.0 dB T_COMP = 2.5 dB
T_TDROP = 4 sec
HARD_INCLUDED = 0FRAME_OFFSET = Field Omitted
PRIVATE_LCM = Field Omitted RESET_L2 = Field Omitted
RESET_FPC = Field Omitted RESERVED = Field Omitted
ENCRYPT_MODE = Field Omitted RESERVED = Field Omitted
NOM_PWR = Field Omitted NUM_PREAMBLE = Field Omitted
BAND_CLASS = Field Omitted CDMA_FREQ = Field Omitted
ADD_LENGTH = 0
PILOT_PN = 168 PWR_COMB_IND = 0 CODE_CHAN = 61
RESERVED = 0
HANDOFF DIRECTION MESSAGE
The base station sends a Handof
Direction Message authorizing the
mobile to begin soft handoff with all
three requested PNs. The pre-existing
link on PN 168 will continue to use
Walsh code 61, the new link on PN220
will use Walsh Code 20, and the new
link on PN500 will use Walsh code 50.
The mobile acknowledges it has received
the Handoff Direction Message.
98/05/24 23:14:02.945 [RTC] Order Message
MSG_LENGTH = 56 bits MSG_TYPE = Order Message
ORDER = Mobile Station Acknowledgement Order
Order-Specific Fields = Field Omitted RESERVED = 0
Mobile Implements the Handoff!
The mobile searcher quickly re-checks
all three PNs. It still hears their pilots!
The mobile sends a Handoff Completion
Message, confirming it still wants to go
ahead with the handoff.
98/05/24 23:14:03.085 [FTC] Forward Traffic Channel: Order
98/05/24 23:14:02.985 [RTC] Handoff Completion Message
MSG_TYPE = Handoff Completion Message
LAST_HDM_SEQ = 0
RESERVED = 0
HANDOFF COMPLETION MESSAGE
The base station confirms it has
received the mobiles Handoff
Completion message, and will
continue with all of the links
active.
Neighbor List Updated, Handoff is Complete!
98/05/24 23:14:03.245 [RTC] Order Message
MSG_LENGTH = 56 bits MSG_TYPE = Order Message
ORDER = Mobile Station Acknowledgement Order
Order-Specific Fields = Field Omitted
RESERVED = 0
98/05/24 23:14:03.166 [FTC] Neighbor List Update Message
MSG_TYPE = Neighbor List Update Message
PILOT_INC = 4 Offset Index
NGHBR_PN = 164 Offset Index
RESERVED = 0
NEIGHBOR LIST UPDATE MESSAGE
In response to the mobiles Handoff
Completion Message, the base station
assembles a new composite neighbor
list including all the neighbors of each of
the three active pilots.
This is necessary since the mobile
could be traveling toward any one of
these pilots and may need to request
soft handoff with any of them soon.
The mobile confirms receiving the
Neighbor List Update Message. It is
already checking the neighbor list and
will do so continuously from now on.
The handoff is fully established.
Handoff Now In Effect, keep checking Pilots!
E
c
/
I
o
All PN Offsets
0
0
32K
512
Chips
PN
0
-20
Neighbor Set
Continue checking each ACTIVE pilot. If any are less than T_DROP and remain
so for T_TDROP time, send Pilot Strength Measurement Message, DROP IT!!
Continue checking each NEIGHBOR pilot. If any ever rises above T_ADD, send
PSMM, ADD IT! Keep watching CANDIDATES vs ACTIVES using T_COMP, too.
T_ADD
Rake Fingers
Reference PN
Active Set
10752
168
32000
500
14080
220

T_DROP
Mobile Rake RX
Srch PN??? W0
F1 PN168 W61
F2 PN500 W50
F3 PN220 W20
The Complete Picture of Handoff & Pilot Sets
T_ADD
E
c
/
I
o
All PN Offsets
0
0
32K
512
Chips
PN
0
-20
Neighbor Set
SRCH_WIN_N
Active Set
Candidate Set
T_DROP
SRCH_WIN_A
Remaining Set
T_ADD
SRCH_WIN_R
SRCH_WIN_A

T_DROP
Rake Fingers
Reference PN
Pilots of sectors
now used for
communication
Pilots requested
by mobile but not
set up by system
Pilots suggested
by system for
more checking
All other pilots divisible by PILOT_INC but not
presently in Active, Candidate, or Neighbor sets
Mobile Rake RX
Srch PN??? W0
F1 PN168 W61
F2 PN500 W50
F3 PN220 W20
Timing of Pilot Searchers Measurement Process
The searcher checks pilots in nested
loops, much like meshed gears.
Actives and candidates
occupy the fastest-
spinning wheel.
Neighbors are
next, advancing
one pilot for each
Act+Cand. revolution.
Remaining is slowest,
advancing one pilot each
time the Neighbors revolve.
CURRENT PILOT SET CONTENTS
A A A
C
N N N N N N N N N N N N
R R R R R R R R R R R R
R R R R
3
1
12
112
PILOT SEARCHER VIEWED IN SEQUENCE: Typical Elapsed Time = 4 seconds
A A A C N
R
A A A C A A A C A A A C A A A C A A A C A A A C N N N N N N
A A A C N A A A C A A A C A A A C A A A C A A A C A A A C N N N N N
A A A C N A A A C A A A C A A A C A A A C A A A C A A A C N N N N N N
N A A A C A A A C A A A C N N N R A A A C N A A A C A A A C A A A N N
C A A A C A A A C N N N
R
A A A C N A A A C A A A C A A A N N C A A A N
C A A A C N N
Only 3 of 112 remaining set pilots have been checked thus far!
A
N
R
R
R
R
R
R
R
N
N
N
N
N
N
N
N
A
A
Overall Handoff Perspective
I Soft & Softer Handoffs are preferred, but not always possible
a handset can receive BTS/sectors simultaneously only on one
frequency
all involved BTS/sectors must connect to a networked BSCs.
Some manufacturers do not presently support this, and so are
unable to do soft-handoff at boundaries between BSCs.
frame timing must be same on all BTS/sectors
I If any of the above are not possible, handoff still can occur but can
only be hard break-make protocol like AMPS/TDMA/GSM
intersystem handoff: hard
change-of-frequency handoff: hard
CDMA-to-AMPS handoff: hard, no handback
auxiliary trigger mechanisms available (RTD), Ec/Io
I Global Service Redirection Messages on outlooking sectors.
Troubleshooting Call Events:
Watch Messaging, Mobile State
I Your current capabilities
Earlier in this course we reviewed handset call processing
states
You have just seen the entire vocabulary of messages
ordinarily used in call processing
Now youre equipped to do serious troubleshooting of CDMA
calls!
I Auditing Call Processing Problems using messages
Watch the messages from birth (origination) to death (release)
is the order proper? are there inappropriate responses?
are any messages repeated? why? which link is bad?
are any messages missed or not acknowledged?
are contents and included parameter values reasonable?
is the timing appropriate -- delays not too long?
track the state in which the mobile and system should be
Course 302
CDMA Performance Indicators
and Problem Signatures
CDMA Performance Indicators
and Problem Signatures
Introducing CDMA RF Performance Indicators
I Earlier we compared a Cockpit Voice Recorder in aviation to the message
files captured by CDMA drive-test equipment.
I Continuing this analogy, a Flight Data Recorder logs aircraft operational
settings. Its CDMA equivalent is a file of RF performance indicators
captured by drive-test equipment.
I Key CDMA parameters and measurements show the condition of the RF
environment. They are the primary gauges used to guide CDMA
optimization and troubleshooting
some indicate uplink conditions, some downlink, and some, both.
these parameters are collected primarily at the subscriber end of the
link, and thus are easy to capture using readily available commercial
equipment without requiring assistance at the BSC
I Understanding these parameters and their important implications requires
basic knowledge in several subject areas:
General: RF units, transmitter and receiver basics
CDMA and spread-spectrum signal characteristics
channel definitions
power control systems
basic CDMA call processing flow
signal behavior characteristics in noise and interference
Key CDMA RF Performance Indicators
I FER Frame Erasure Rate
on forward channel
(realized at Handset)
on reverse channel
(realized at base station)
FER is an excellent call
quality summary statistic
I Mobile Receive Power
usually expressed in dBm
measured derived from
handset IF AGC
broadband, unintelligent
measurement: includes all
RF in the carrier bandwidth
regardless of source, not
just RF from serving BTS
-40
-90
-105
<
<
t
o
o

w
e
a
k

o
v
e
r
l
o
a
d
>
>
RX Level
FER
%
0 2 5 100
F
o
r
w
a
r
d
R
e
v
e
r
s
e
x
LO
RX Level
(from AGC)
IF LNA
BW
~30
MHz.
BW
1.25
MHz.
Handset Receiver
R
R
R
S
Rake
More Key CDMA RF Performance Indicators
I E
c
/I
o
cleanness of the pilot
foretells the readability of
the associated traffic
channels
guides soft handoff decisions
digitally derived: ratio of good
to bad energy seen by the
search correlator at the
desired PN offset
Never appears higher than
Pilots percentage of serving
cells transmitted energy
Can be degraded by strong
RF from other cells, sectors
Imperfect orthogonality,
other PNs are ~-20 dB.
Can be degraded by noise
E
c
/I
o
dB
-25 -15 -10 0
E
c
I
o
Energy of
desired pilot alone
Total energy received
Light Traffic Loading
Heavily Loaded
How Ec/Io Varies with Traffic Loading
I Each sector transmits a certain
amount of power, the sum of:
pilot, sync, and paging
any traffic channels in use
at that moment
I Ec/Io is the ratio of pilot power
to total power
On a sector with nobody
talking, Ec/Io is typically
about 50%, which is -3 db
On a sector with maximum
traffic, Ec/Io is typically
about 20%, which is -7 db.
Ec/Io = (2/4)
= 50%
= -3 db.
Ec/Io = (2/10)
= 20%
= -7 db.
2w
1.5w
Pilot
Paging
Sync
I
0
E
C
T
r
a
f
f
i
c

C
h
a
n
n
e
l
s
6w
0.5w
2w
1.5w
Pilot
Paging
Sync
I
0
E
C
0.5w
Many Sectors, Nobody Dominant
One Sector Dominant
How Ec/Io varies with RF Environment
I In a clean situation, one
sector is dominant and the
mobile enjoys an Ec/Io just
as good as it was when
transmitted
I In pilot pollution, too many
sectors overlap and the
mobile hears a soup made
up of all their signals
Io is the power sum of all
the signals reaching the
mobile
Ec is the energy of a
single sectors pilot
The large Io overrides the
weak Ec; Ec/Io is low!
Io = -90 dbm
Ec = -96 dbm
Ec/Io = -6 db
Io = 10 signals
each -90 dbm
= -80 dbm
Ec of any one
sector = -96
Ec/Io = -16 db
2w
1.5w
Pilot
Paging
Sync
I
0
E
C
T
r
a
f
f
i
c
C
h
a
n
n
e
l
s
4w
0.5w
BTS1
I
0
E
C
BTS2
BTS3
BTS4
BTS5
BTS6
BTS7
BTS8
BTS9
BTS10
Pilot
Sync & Paging
Traffic
Pilot
Sync & Paging
Traffic
Pilot
Sync & Paging
Traffic
Pilot
Sync & Paging
Traffic
Pilot
Sync & Paging
Traffic
Pilot
Sync & Paging
Traffic
Pilot
Sync & Paging
Traffic
Pilot
Sync & Paging
Traffic
Pilot
Sync & Paging
Traffic
Pilot
Sync & Paging
Traffic
False Correlation of Code Sequences
Generated in Tapped Shift Registers
I This shows the correlation between energy at one PN offset and
energy at all other possible PN offsets.
Offsets which differ by up to +/- 15 chips are perfectly orthogonal
Offsets differing by more than 15 chips are only approximately
orthogonal, and false correlation of as high as 1.3% exists
C
o
r
r
e
l
a
t
i
o
n
Correlation of Energy at PN offset 256 with Energy at All Other Offsets
0K 4K 8K 12K 16K 20K 24K 28K
0 64 128 192 256 320 384 448
32K
512
.01 =
-20 db
1 =
0 db
. 1 =
-10 db
.001 =
-30 db
Chips
PN Offset
More Key CDMA RF Performance Indicators
I TXPO Handset Transmit Power
Actual RF power output of the
handset transmitter, including
combined effects of open
loop power control from
receiver AGC and closed
loop power control by BTS
cant exceed handsets
maximum (typ. +23 dBm)
I TXGA Transmit Gain Adjust
Sum of all closed-loop
power control commands
from the BTS since the
beginning of this call
TXPO
DUP x

IF
LNA
Subscriber Handset
R
R
R
S
Rake

Viterbi
Decoder
Vocoder

FEC
Orth
Mod
Long PN
x
x
x
IF Mod
I
Q
x ~
LO
Open Loop
LO
Closed Loop Pwr Ctrl
IF
Receiver>>
<<Transmitter
PA
BTS
Typical TXPO:
+23 dBm in a coverage hole
0 dBm near middle of cell
-50 dBm up close to BTS
0 dB
-10 dB
-20 dB
Typical Transmit Gain Adjust
Time, Seconds
TXPO = -(RX
dbm
) -C + TXGA
C = +73 for 800 MHz. systems
= +76 for 1900 MHz. systems
Signatures of Common Conditions
I The key CDMA RF Performance
Indicators provide powerful clues
in cause-and-effect analysis for
understanding problem conditions
I There are many common
conditions which are easy to
recognize from their characteristic
signatures -- unique
relationships among the key
indicators which are observed
when these conditions exist
I We will use the simplified format
shown at right to display the key
indicators for each of several
interesting cases.
SIGNATURE:
GOOD CALL
FFER RXL E
C
/I
O
TxGa TxPo
BTS
Messaging
FFER RXL E
C
/I
O
TxGa TxPo
-110
-30
100%
50%
0%
10%
5%
2%
-40
-90
-100
-20
0
-6
-10
-15
-25
+25
+10
0
-10
-20
+23
-10
-20
-40
-50
-30
+10
0
Signature of a Successful Call
I If the mobile station originates
successfully, remains in service
area, and makes normal release,
data will show:
Low forward FER
Receive power > -100 dBm
Good Ec/Io (> -12 dB)
Normal Transmit Gain Adjust
(actual value depends on site
configurations, loading &
NOM_PWR setting)
Transmit power < +20 dBm
Good Messaging
Parsed message files will
contain a full set of normal
messages.
SIGNATURE:
GOOD CALL
FFER RXL E
C
/I
O
TxGa TxPo
BTS
Messaging
FFER RXL E
C
/I
O
TxGa TxPo
-110
-30
100%
50%
0%
10%
5%
2%
-40
-90
-100
-20
0
-6
-10
-15
-25
+25
+10
0
-10
-20
+23
-10
-20
-40
-50
-30
+10
0
Signature of a Dropped Call in Poor Coverage
I If a mobile station is taken out
of the service area or into a
coverage hole, and only data
from the mobile station is
available, the log files will show
the following characteristics:
High forward FER
Low receive power (<-100
dBm)
Low Ec/Io (< -10 dB)
Higher-than-normal Transmit
Gain Adjust (actual value depends
on site configurations, loading,
NOM_PWR setting)
Higher-than-normal transmit
power (> +20 dBm)
Poor messaging on both links
SIGNATURE:
DROPPED CALL, BAD COVERAGE
FFER RXL E
C
/I
O
TxGa TxPo
BTS
Messaging
FFER RXL E
C
/I
O
TxGa TxPo
-110
-30
100%
50%
0%
10%
5%
2%
-40
-90
-100
-20
0
-6
-10
-15
-25
+25
+10
0
-10
-20
+23
-10
-20
-40
-50
-30
+10
0
Signature of Forward Link Interference
I Characteristics of data for a phone
experiencing forward link
interference from a source other
than the current BTS:
High forward FER
Good receive power (> -100 dBm)
Low Ec/Io (< -10 dB)
Higher-than-normal Transmit Gain
Adjust
Normal transmit power (< +20
dBm)
Poor forward link messaging
unreliable at best and may be
the actual cause of the drop.
SIGNATURE:
FORWARD LINK INTERFERENCE
FFER RXL E
C
/I
O
TxGa TxPo
BTS
Messaging
FFER RXL E
C
/I
O
TxGa TxPo
-110
-30
100%
50%
0%
10%
5%
2%
-40
-90
-100
-20
0
-6
-10
-15
-25
+25
+10
0
-10
-20
+23
-10
-20
-40
-50
-30
+10
0
Signature of Reverse Link Interference
I Characteristics of data for a phone
whose BTS has a raised noise
floor due to reverse link
interference
Good forward FER
Good receive power (> -100 dBm)
Good Ec/Io (> -10 dB)
Higher-than-normal Transmit Gain
Adjust
Higher-than-normal transmit power
(< +20 dBm)
Poor reverse link messaging
in the message files, youll
see repeats of messages on
the forward link and reverse
link
SIGNATURE:
REVERSE LINK INTERFERENCE
FFER RXL E
C
/I
O
TxGa TxPo
BTS
Messaging
FFER RXL E
C
/I
O
TxGa TxPo
-110
-30
100%
50%
0%
10%
5%
2%
-40
-90
-100
-20
0
-6
-10
-15
-25
+25
+10
0
-10
-20
+23
-10
-20
-40
-50
-30
+10
0
Behavior when Messaging is Unreliable
I When messaging becomes unreliable on either forward or reverse links,
the sender of a message doesnt receive an acknowledgment, and will
repeat the message after a short time
I If the system tries 5 repeats with no success, it will declare Forward
Release and abort the call
I If the handset tries 3 repeats with no success, it will declare Reverse
Release and abort the call
I Watch captured data for repeated messages -- you can identify them by
their message sequence numbers
I If you see repeats on either link, dont jump to conclude that link is the
problem. Repeats can be triggered because the other side never heard
the message, OR because the other sides acknowledgment was
missed during rough conditions.
Other RF Performance Indicators
I There are additional RF indicators which are more difficult to
collect, but may be important evidence during investigation of
some types of more complex problems. Examples include:
I Ew/No setpoint statistics (available only via BSM
NT/QC
/CMC
Lucent
)
this is the comparison threshold which dictates BTS reverse
link closed loop power control commands
setpoint varies to combat reverse FER in outer loop control
I Number of Handset fingers locked (from drive-test tools)
I Composite E
c
/I
o
(from drive-test tools)
I BTS sector composite receive level (from BSM
NT/QC
/CMC
Lucent
)
I In addition, there are a host of other clues and indications hidden
in the messaging between system and handset. Other sections of
this course describe how to capture and interpret messaging for
problem investigation purposes
Starting Optimization on a New System
I RF Coverage Control
try to contain each sectors coverage, avoiding gross spillover
into other sectors
tools: PN Plots, Handoff State Plots, Mobile TX plots
I Search Window Settings
find best settings for SRCH_WIN_A, _N, _R
especially optimize SRCH_WIN_A per sector using collected
finger separation data; has major impact on pilot search speed
I Neighbor List Tuning
try to groom each sectors neighbors to only those necessary
but be alert to special needs due to topography and traffic
tools: diagnostic data, system logs
I Access Failures, Dropped Call Analysis
finally, iterative corrections until within numerical goals
Getting these items into shape provides a solid baseline and foundation from
which future performance issues can be addressed.
Statistical CDMA Performance Indicators
I Dropped Call Statistics
I Failed Access Attempts
I Blocking Statistics
BTS sector level
BSC resource level
Switch resource level
PSTN trunking level
I Counts of specific call
processing error events
The performance indicators described
previously show mainly the
condition of the RF links, and are
useful primarily for debugging link
problems.
There is an entire additional world of
data available to indicate overall
system performance on a statistical
basis. These indications are
collected from the Switch and BSM
and should be analyzed using
external software, archived, and
tracked and trended for system
performance benchmarking.
These indications should be examined
from many perspectives: overall for
an entire system, by individual
sector and cell, and both in
absolute numbers and by
percentages of total traffic.
Dropped Call Example
This dropped call is a dramatic example of big forward link problems.
As the call begins, forward FER is low with good E
c
/I
o
, RX, TX, and
TXGA. RX gets steadily better, TX and TXGA are climbing. At 18
seconds, suddenly E
c
/I
o
withers, FER explodes, and both TX and
TXGA increase. After four scary seconds, we recover but briefly.
0 9 18 27 36 45
Time, Seconds
dBm,
%
d
B
,
d
B
m
E
c
/I
o
dives again and
FER roars while RX,
TX and TXGA rise.
At 30 seconds, FER
is so bad that the
transmitter mutes.
E
c
/I
o
recovers briefly
but falters again and
we mute at 34
seconds. RX, TX,
and TXGA are all
high. E
c
/I
o
briefly
recovers, but then
fades. The call slides
to an ugly death.
Course 302
In-Class Exploration of Live Data
In-Class Exploration of Live Data
As a group, lets explore actual drive-test files collected on
your system. If needed, data from other systems is also
available to show examples of specific problems.
Afterwards, well continue by looking at the problems and
fixes described in the next section.
Call Processing Examples
EXAMPLES
I Normal Call
I Dropped Call - Coverage
I Dropped Call - Neighbor List
I Dropped Call - Search Window
Exporting Data from Surveyor
for External Analysis
I Surveyor32 stores its data in *.glf (Grayson Log File) binary format
I Other formats are often desired for external analysis:
call processing messages in text-file form
measurements and parameters in spreadsheet
I Surveyor 32 offers file conversion utilities under the Tools menu
CDMA Problems, Causes, and Cures
OUTLINE OF TOPICS
I Excessive Access Failures
I Excessive Dropped Calls
I Forward Link Interference
I Slow Handoff
I Handoff Pilot Search Window Issues
I PN Planning Considerations
I Excessive Soft Handoff
I Grooming Neighbor Lists
I Software Bugs, Protocol Violations
Normal Call Processing
Event Templates
Normal Call Processing
Event Templates
To troubleshoot what went wrong, the general approach is to
consider what should have happened and identify the steps
which didnt occur and the root causes which prevented
them from occurring.
Here are quick summaries of the events were
troubleshooting.
Access
Channel
Reverse
Traffic
Channel
Paging
Channel
Incoming Call Delivery Scenario
BTS
General Page Message
Page Response Message (by PROBING)
Base Station Acknowledgment Order
Channel Assignment Message
Traffic Channel Preamble: Frames of 000s
Continuous frames of all 000s
Mobile Station Acknowledgment Order
Service Connect Message
Service Connect Complete Message
The Call is now officially Established!
Forward
Traffic
Channel
Access
Channel
Reverse
Traffic
Channel
Paging
Channel
Mobile-Originated Call Scenario
BTS
Origination Message (by PROBING)
Channel Assignment Message
Traffic Channel Preamble: Frames of 000s
Continuous frames of all 000s
Service Connect Message
Service Connect Complete Message
The Call is now officially Established!
Forward
Traffic
Channel
Forward
Traffic
Channel
Reverse
Traffic
Channel
The Handoff Process
BTS
Handoff Completion Message
Extended Handoff Direction Message
The new Handoff condition is now officially Established!
The handset pilot searcher notices energy from
another sector or BTS, meeting any of these criteria:
Neighbor or Remaining Pilot Ec/Io stronger than T_Add
Candidate Pilot just got T_Comp better than an ac tive
An Active Pilot stayed below T_DROP for T_TDROP time
Pilot Strength Measurement Message
Selector arranges channel elements/Walsh codes in requested
sectors and begins using them, too.
Handset verifies which assigned PNs it can now hear.
Neighbor List Update Message
Access
Channel
Paging
Channel
Registration
BTS
Registration Message (by PROBING)
Access
Channel
Paging
Channel
Voice Mail Notification
BTS
Mobile Station Ackmt. (by PROBING)
Feature Notification Message
Course 302
Some Specific CDMA Problems
and Solutions
Some Specific CDMA Problems
and Solutions
Solving CDMA Performance Problems
I CDMA optimization is very different from optimization in analog
technologies such as AMPS
I AMPS: a skilled engineer with a handset or simple equipment can
hear, diagnose, and correct many common problems
co-channel, adjacent channel, external interferences
dragged handoffs, frequency plan problems
I CDMA impairments have one audible symptom: Dropped Call
voice quality remains excellent with perhaps just a hint of garbling as
the call approaches death in a hostile RF environment
I Successful CDMA Optimization requires:
recognition and understanding of common reasons for call failure
capture of RF and digital parameters of the call prior to drop
analysis of call flow, checking messages on both forward and reverse
links to establish what happened, where, and why.
CDMA Problems, Causes, and Cures
OUTLINE OF TOPICS
I Excessive Access Failures
I Excessive Dropped Calls
I Forward Link Interference
I Slow Handoff
I Handoff Pilot Search Window Issues
I PN Planning Considerations
I Excessive Soft Handoff
I Grooming Neighbor Lists
I Software Bugs, Protocol Violations
Troubleshooting Access Failures
Troubleshooting Access Failures
Troubleshooting Access Failures & TCCFs
I Troubleshooting access failures (Traffic Channel Confirmation Failures)
can be difficult
I There are many steps in the access process
Finding which step failed is not easy
I Rarely, circumstantial evidence points clearly to the problem
I Usually, it is necessary to debug the process leading up to the access
failure
Consider each step in the access process
Get evidence to determine whether this step occurred successfully
Move on to the next step and keep checking steps until the
unsuccessful step is found
Determine why this step failed
I The following slides describe the steps in the access process, where they
take place, and some of the factors which may cause them to fail
I This narrative might be useful as a template for organizing your own
thinking as you investigate access failures you are tracking!
Go out and capture actual drive tests of failed origination attempts
If possible, also collect system logs (RF call trace, etc.) for the same
event
MS
Probing
Troubleshooting Access Failures (1)
Paging Channel Access Channel
Steps in the Access Process
BTS
Origination Msg.
Probe #1
Origination Msg.
Probe #2
Origination Msg.
Probe #3
Mobile waits to see if the BTS hears and
acknowledges its probe within the time ACC_TMO.
If not, the mobile must transmit the message again
in another probe, this time PI db. louder.
If the mobile does not hear acknowledgment from
the BTS within ACC_TMO, this could mean either:
The BTS did not hear the mobile
Maybe the mobile collided with another
mobile transmitting at the same time
Maybe mobile was too weak to overcome
the existing reverse noise level at the BTS
In either case another probe should solve
the problem, provided PI is set reasonably
and additional probes are allowed (check the
Access Parameters Message to see if
Num_Step and the power parameters make
sense; be sure also the cell size or Access
Channel acquisition search width is set large
enough and the number of access preamble
frames is large enough for the cell size)
The BTS is acknowledging but the mobile cannot
hear the acknowledgment
If the mobile cant hear the BTS
acknowledging, Ec/Io is likely quite poor. If
so, check whether this is due to weak signal
(poor coverage) or pilot pollution (lots of
pilots all weak but no dominant server)
Collect system logs if necessary to determine
definitely whether the system heard the mobiles
origination or not
Troubleshooting Comments
Mobile waits again to see if the BTS hears and
acknowledges its probe within the time ACC_TMO.
If not, the mobile must transmit the message again
in another probe, this time PI db. louder.
The mobile keeps probing until NUM_STEP probes
have been sent, then repeats the probe sequence
again until Max_Probe_Sequences have been
sent.
The Access Process
BTS
Reorder
If this problem happens frequently, the BTS traffic
overload must be relieved. Here are some steps to
try:
Investigate BTS TX hardware to ensure everything
is working correctly and properly calibrated,
particularly gain settings in the TX chain
To free up more forward power for traffic channels,
try:
Reduce PTXstart (initial traffic channel
DGU) watching for less forward power
control overloads. If you go too far, you will
notice access failures increase.
Reduce PTXmax (maximum traffic channel
DGU) watching for less forward power
control overloads. If you go too far, dropped
calls will increase.
Reduce sector traffic by reorienting the sectors to
more closely balance the load carried by each
Or, add another carrier
Or split cells
Mobile beeps and displays Call Failed - System
Busy
One Dreaded Possibility:
The Access Process
BTS
After hearing the BTS acknowledgment, the mobile
will stop probing and wait for further instructions on
the paging channel.
If the mobile does not hear the Channel
Assignment Message within 12 seconds, the
mobile will beep and display Call Failed. Possible
causes:
The BTS did not transmit the Channel Assignment
Message
Check system logs to see if this was not
transmitted. If not transmitted, get
troubleshooting help from the system
manufacturer -- this should never occur
The BTS did transmit the Channel Assignment
Message, but the mobile did not hear it
Was this because the paging channel
faded? (Did the Ec/Io drop momentarily)? If
so, see If this is a recurring problem such as
a coverage hole or severe pilot pollution
Finally! The mobile hears the Channel Assignment
Message!
Now it will immediately leave the paging channel
and start trying to hear the new Forward Traffic
Channel.
Channel Assignment
Message
Base Station
Acknowledgment
STOP! Leave the Paging Channel, and dont
transmit again on the access channel.
The mobile now goes to try to hear the Forward
Traffic Channel.
FWD Traffic Channel REV Traffic Channel
The Access Process
BTS
The mobile listens to the Walsh Code # given in the
Channel Assignment Message. It should hear N5M
good frames full of all zeroes within T2M seconds
(usually 2 frames in 10 frames).
Mobile beeps and displays Call Failed
00000000000000000000
00000000000000000000
00000000000000000000
00000000000000000000
00000000000000000000
00000000000000000000
If the mobile hears the required number of good
empty frames, it starts transmitting its own
Reverse Traffic Channel Preamble of empty all-
zero frames.
If the mobile does not hear the required number of
good empty frames, it will beep and give an error
message, then reacquire the system.
Base Station
Acknowledgment
Mobile Station
Acknowledgment
If the BTS does NOT hear the mobiles access
preamble within a prescribed delay, it will abort the
process and release all the resources, and the
mobile will reacquire the system. . This is what
Lucent terms a Traffic Channel Confirmation
Failure (TCCF).
If the BTS DOES hear the mobiles access
preamble, it will send an acknowledgment.
The mobile responds with an acknowledgment, or
maybe even a pilot strength measurement
message if it already needs a handoff.
FWD Traffic Channel REV Traffic Channel
The Access Process
BTS
Now that the BTS and mobile see each other on
the traffic channels, the next step is service
negotiation.
The BTS sends a Service Connect message listing
the type and rate set of the vocoder or other
primary traffic source.
The mobile either accepts the proposal with a
Service Connect Complete message, or
counterproposes a different mode.
The BTS acknowledges the Service Connect
Complete message.
The call is now officially in progress. If anything
happens to interrupt it after this point, that is
considered a dropped call.
If any of these steps is unsuccessful, the call
attempt will probably fail. Suspect RF conditions on
the link which was supposed to carry the
unsuccessful command. Look at system logs and
message logs from mobile drive testing to pin down
just what happened.
Service Connect
Message
Service Connect
Complete Message
This is still just an ongoing access attempt
Base Station
Acknowledgment
Now this is officially a call in progress
Access Failure/TCCF Troubleshooting
Access Attempt Failed
Were any probes acknowledged?
Yes,
Reorder
Weak Signal/Coverage Hole?
Strong Fwd interf / pollution?
yes
yes
no
Is T-1unstable/blocking?
no
Add coverage
Identify, eliminate
Report/repair
Blocking
Forward Power
Channel Elements
Rev. Link Noise
Optmz Fpwr DGUs
Add chan cards
Identify, fix source
No,
Nothing
Yes,
BS Ack
Paging Channel
faded, lost
Check System Logs.
Was mobile heard?
Was Channel Assignment
Message heard?
no
Rev Link Overload? Identify, fix source
Num_Step, Pwr_Step
appropriate?
Ensure reasonable
values
Sector Size, Acq Width
appropriate?
Ensure reasonable
values for cell size
Check System Logs.
Was CH ASN sent?
yes
System Problem.
Investigate why
Software problem
Resource blocking
Did mobile see N5M good
frames on F-TCH?
yes
no
Check System Logs.
CH EL initialized OK?
no
yes
Check System Logs. Did
BTS see mobile preamble? no
yes
Did mobile see BS Ack?
Rev. Link Noise Identify, fix source
no Weak Signal/Coverage Hole?
Strong Fwd interf / pollution?
Improve coverage
Identify, eliminate
Report/repair
F-TFC Channel
faded, lost
yes
Check System Logs.
Did BTS see mobile Ack?
OK
no Weak Signal/Coverage Hole?
Strong Rev Noise?
Improve coverage
Identify, eliminate
Report/repair
R-TFC Channel
faded, lost
Init TCH DGU large enough? Raise DGU
1. If the failures occur in areas where one BTS
is dominant, suspect BTS hardware problems.
2. Plot the access failures to see if they correlate
with areas of BTS overlap. If so, suspect
forward link problems. This is probable
because the mobile does not have the normal
advantage it would get from soft handoff on a
traffic channel. During access, it must
successfully demodulate all five BTS messages
without the benefit of soft handoff. If the
handset is in an area of multiple BTS overlaps
or weak signal, this can be risky. In such cases,
try to make the serving BTS more dominant.
Also check the access/probing parameters.
If the base station never sees the mobiles probes,
the cause is probably coverage-related. If it happens
in strong signal areas, suspect BTS hardware. Also
check datafill for proper NOM_PWR and PWR_INC.
Be sure the BTS datafill access channel acquisition
and demodulation search windows are adequate.
Reducing Access Failures
BTS
Channel Assnmt. Msg.
Origination Msg
TFC frames of 000s
TFC preamble of 000s
Mobile Sta. Ackngmt. Order
Service Connect Msg.
Svc. Connect Complete Msg
Call is Established!
MS
Probing
ACCESS
PAGING
FW TFC
PAGING
RV TFC
FW FC
RV TFC
FW TFC
RV TFC
FW TFC
Access Attempt
Troubleshooting Dropped Calls
Troubleshooting Dropped Calls
Dropped Call Troubleshooting - Mobile Side
Just arrived on sync channel!
Is this a drop?
Were there release
messages?
OK, normal
end of call
This is a drop!
yes
no
Was the Sync Channel PN
Active before the drop?
Check
for:
yes
Strong Fwd/Rev interference?
no
Did mobile request Sync CH
PN in PSMM before drop?
Why didnt handoff happen?
no
yes
FER already too bad?
Border configuration problems
Fast-rising pilot, slow reaction
PN not in neighbor list
Is PN in neighbor list?
yes
Is SRCH_WIN_N adequate?
no
Add PN to Neighbor List!
Blocking
Forward Power
Channel Elements
Rev. Link Noise
yes
Is cell in island Mode?
yes
Repair/Re-initialize Cell!
no
no
Widen SRCH_WIN_N!
More information needed.
Collect system logs and
merge with mobile data,
analyze
Improve coverage
Identify, eliminate
Report/repair
Add PN to Nbr List!
Add coverage
Push earlier
Debug, reconfigure
Incr Sector Overlap
Speed up searcher
Optmz Fpwr DGUs
Add chan cards
Identify, fix source
Report/repair
Investigating Dropped Calls
I If the radio link fails after the mobile sends the
Service Connect Complete Message then it is
considered a dropped call. Using the signatures
described earlier, it is possible to recognize and
separate the dropped calls into the categories at
right.
I Each category has its own causes and solutions
I Dropped call analysis can consume a
considerable amount of time. Using good post-
processing analysis tools, the root cause of
some of the drops can be determined from
mobile data alone. However, there will be
cases where the cause cannot be reliably
confirmed unless system data is also used
BAD COVERAGE
FFER RXL E
C
/I
O
TxGa TxPo
BTS
Messaging
FFER RXL E
C
/I
O
TxGa TxPo
-110
-30
100%
50%
0%
10%
5%
2%
-40
-90
-100
-20
0
-6
-10
-15
-25
+25
+10
0
-10
-20
+23
-10
-20
-40
-50
-30
+10
0
FWD. INTERFERENCE
FFER RXL E
C
/I
O
TxGa TxPo
BTS
Messaging
FFER RXL E
C
/I
O
TxGa TxPo
-110
-30
100%
50%
0%
10%
5%
2%
-40
-90
-100
-20
0
-6
-10
-15
-25
+25
+10
0
-10
-20
+23
-10
-20
-40
-50
-30
+10
0
REV. INTERFERENCE
FFER RXL E
C
/I
O
TxGa TxPo
BTS
Messaging
FFER RXL E
C
/I
O
TxGa TxPo
-110
-30
100%
50%
0%
10%
5%
2%
-40
-90
-100
-20
0
-6
-10
-15
-25
+25
+10
0
-10
-20
+23
-10
-20
-40
-50
-30
+10
0
Treating Drops with Poor-Coverage Symptoms
I Using a post-processing tool,
display a map of the locations of
dropped calls that exhibit
symptoms of poor coverage
It is particularly useful to be
able to overlay the drop
locations on a map of
predicted or measured signal
levels
I Verify this type of drop is not
occurring in good-coverage areas
If so, suspect and investigate
hardware at the serving site
I Coverage related drops occurring
in poor-coverage areas are to be
expected; additional RF (usually
from new BTSs) is the only
solution except in rare cases
These drops are probably normal
due to their locations in a
predicted weak-signal area.
Drops with weak-signal symptoms
happened in predicted strong-signal
area. Suspect bad BTS hardware.
Treating Drops with Forward-Link Problems
I Plot the data containing the
forward-link interference drops on
maps from your propagation
prediction tool
Use the prediction tool to help
identify other strong signals
reaching the drop areas
If the signals are from other
CDMA carriers, add their Pilot
PNs to the neighbor list
Resolve any PN conflicts
I Another technique is to examine
the dropped call message files
and identify the BTS from which
the sync channel message is
received immediately after each
drop (this will be the cleanest pilot
the handset sees at that time)
The call on sector A dropped here,
apparently due to interference
from sector B. Find out why soft
handoff with B did not occur.
A
B
Sync Channel Message
p_rev 1, bit_len: 170
min_p_rev 1
sid 4139 nid 41
pilot_pn 0x164 = 356 ( RMCZ )
lc_state 1ED595B9632
sys_time 189406BE8
lp_sec 13
ltm_off 0x10 (8.0 hours)
daylt 0 prat 1
cdma_freq 50
Optimizable Dropped Calls: Slow Handoff
I When the mobile is suddenly
confronted with a strong new signal,
or when the signal it is using takes a
sudden deep fade, it will have poor
E
c
/I
o
and high forward FER. The call
will drop unless it gets help quickly.
Several steps which must occur
without delay:
The mobile search correlator
must first notice the new pilot
and send a PSMM to the system.
The system must set up the soft
handoff and notify the mobile.
The mobile must acquire the
new signal by locking a finger
BTS
BTS
x
Sources of Delay Causing Slow Handoff
Every step in the handoff process can suffer delay if were not careful
to control conditions:
I Mobile search correlator notices new pilot
Window sizes too large, searching is slow
Multi-sector soft handoff already underway, many active pilots,
searching is slow
Interferor not a neighbor, must find in remaining set: slow, DIE!
System cannot currently set up true remaining-set handoffs
I Mobile reports PSMM to system.
Reverse link noisy, PSMM must be re-requested & repeated
I System sets up handoff, sends EHDM to mobile
Resource congestion: no TCEs, or other problems
Forward link is noisy, mobile doesnt hear EHDM, must repeat
Fortunately, these problems do not have to happen.
Optional: Quick Primer on Pilot Search Windows
I The phone chooses one strong sector and
locks to it, accepting its offset at face value
and interpreting all other offsets by
comparison to it
I In messages, system gives to handset a
neighbor list of nearby sectors PNs
I Propagation delay skews the apparent PN
offsets of all other sectors, making them
seem earlier or later than expected
I To overcome skew, when the phone
searches for a particular pilot, it scans an
extra wide delta of chips centered on the
expected offset (called a search window)
I Search window values can be datafilled
individually for each Pilot set:
I There are pitfalls if the window sizes are
improperly set
too large: search time increases
too small: overlook pilots from far away
too large: might misinterpret identity of a
distant BTS signal
One chip is 801 feet or 244.14 m
1 mile=6.6 chips; 1 km.= 4.1 chips
PROPAGATION DELAY
SKEWS APPARENT PN OFFSETS
BTS
BTS
A
B
33
Chips
4
Chips
If the phone is locked to BTS A, the
signal from BTS B will seem 29 chips
earlier than expected.
If the phone is locked to BTS B, the
signal from BTS A will seem 29 chips
later than expected.
Pilot Search Order, Speed, and Implications
I Actives & candidates have the biggest influence.
Keep window size as small as possible
During soft handoff, this set dominates searcher
Minimize excessive Soft HO!
I Neighbor set is second-most-important
Keep window size as small as possible
Keep neighbor list as small as possible
But dont miss any important neighbors!
I Remaining Set: pay your dues, but get no reward
You must spend time checking them, but the system cant assign one to you
R
e
m
a
i
n
i
n
g
A
c
t
i
v
e
+
C
a
n
d
N
e
i
g
h
b
o
r
PILOT SEARCHING IN NESTED LOOPS:
THE CAR ODOMETER ANALOGY
The searcher checks pilots in the
order they would appear if pasted
on the wheels of a car odometer.
Actives and candidates occupy the
fastest-spinning wheel.
Neighbors are next, advance one
pilot each time Act+cand revolves.
Remaining is slowest, advance one
pilot each time Neighbors revolve.
WINDOW SIZE
IN CHIPS AND DATA UNITS
Window
Size (Chips)
14 (7)
20 (10)
40 (20)
60 (30)
80 (40)
100 (50)
130 (65)
160 (80)
226 (113)
28 ( 14)
320 (160)
452 (226)
Datafill
Value
4
5
7
8
9
10
11
12
13
6
14
15
Auditing System Handoff Setup Time
I After the mobile searcher recognizes the
pilot it needs, the job is only begun
The mobile must send a PSMM to
system; it must be received
System must recognize reported PN
phase, set up resources in the
appropriate sector
An EHDM must be sent to the
mobile, received, acknowledged
Mobile must acknowledge again
when handoff implemented
I Time required for this process can be
measured by watching messages
most post-processing tools can show
histogram or graph of this delay
if system is healthy, almost all
handoffs will happen in <200 msec.
and there will be no stragglers
0 100 200 300 400 500
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Time (milliseconds)
C
u
m
u
l
a
t
i
v
e

D
i
s
t
r
i
b
u
t
i
o
n

F
u
n
c
t
i
o
n
Typical Handoff
Setup Time
Handoff Problems: Window Dropped Calls
I Calls often drop when strong
neighbors suddenly appear
outside the neighbor search
window and cannot be used to
establish soft handoff.
I Neighbor Search Window
SRCH_WIN_N should be set
to a width at least twice the
propagation delay between
any site and its most distant
neighbor site
I Remaining Search Window
SRCH_WIN_R should be set
to a width at least twice the
propagation delay between
any site and another site
which might deliver occasional
RF into the service area
A
B
1 mi.
7 Chips
BTS
BTS
SITUATION 1
Locked to distant
site, cant see
one nearby
1
2

m
i
l
e
s
8
0

C
h
i
p
s
SRCH_WIN_N = 130
BTS A is reference.
BTS B appears (7-80) chips
early due to its closer distance.
This is outside the 65-chip window.
Mobile cant see BTS Bs pilot, but its
strong signal blinds us and the call drops.
T
ra
v
e
l
m
o
u
n
t
a
i
n
s
A
B
1 mi.
7 Chips
BTS
BTS
SITUATION 2
Locked to nearby
site, cant see
distant one
1
2

m
i
l
e
s
8
0

C
h
i
p
s
T
r
a
v
e
l
SRCH_WIN_N = 130
BTS B is reference.
BTS A appears (80-7) chips
late due to its farther distance.
This is outside the 65-chip window.
Mobile cant see BTS As pilot.
m
o
u
n
t
a
i
n
s
Setting Pilot Search Window Sizes
I When the handset first powers up, it does an exhaustive search for the
best pilot and no windows apply to this process.
I When finally on the paging channel, the handset learns the window sizes
SRCH_WIN_A, N, R and uses them when looking for neighbors both in
idle mode and during calls.
I During a call, when a strong neighbor is recognized, a PSMM is sent
requesting soft handoff. The former neighbor pilot is now a candidate set
pilot and its offset is precisely remembered and frequently rechecked and
tracked by the phone.
I The window size for active and candidate pilots doesnt need to be very
large, since the searcher has already found them and is tracking them
very frequently. We need only enough width to accommodate all
multipath components of these pilots.
This greatly speeds up the overall pilot search management!
I Most post-processing tools deliver statistics on the spread (in chips)
between fingers locked to the same pilot. These statistics literally show us
how wide the SRCH_WIN_A should be set.
I Neighbor and Remaining search windows should be set based on intercell
distances as described in a preceding slide.
PN PLANNING ISSUES
I Every sector is assigned a
PN offset different from any
other nearby sector.
I We must ensure no mobile at
the edge of this sector can
see energy from another CO-
PN sector arriving within its
active search window. (would
cause CO-PN confusion.)
I We must ensure that the
mobile does not see energy
from sectors with slightly
different PN offsets arriving
within the active search
window (This would cause
Adjacent-PN confusion.)
PREVENTING CO-PN CONFUSION
A B
BTS BTS
Observe: Min. reqd. spacing A-B (mi) =
(SRCH_WIN_A / 2) x (1 / 6.7) + 2R
Observe: Min. reqd. spacing A-B (mi) =
(SRCH_WIN_A / 2) x (1 / 6.7) + 2R
PN 472 PN 472
R
PREVENTING ADJACENT-PN CONFUSION
A
BTS
C
BTS
PN 472 PN 474
See following slide for diagram
and restricting expression
See following slide for diagram
and restricting expression
Maximum Timing Budget for CDMA Cells
I The range of a CDMA cell is normally limited by the attenuation that
occurs along ordinary propagation paths. Occasionally, a site is
located atop a high mountain or other location from which it can see a
very large distance, so large that timing considerations must be
recognized. Search windows are the main concern.
I The BTS uses acquisition and demodulation search windows much
like the pilot search windows used by the mobile. The maximum
setting is 4095/8 chips (512 chips -1/8 chip). A mobile 38.8 miles from
the site would be at the edge of this maximum window setting, and
could not originate or be acquired during handoff beyond this distance.
I The mobile is not restricted on acquiring the system forward channels
but its pilot search windows are limited to 452 chips. Neighbor pilots
couldnt be recognized if coming from a cell more than 34.3 miles
closer or farther than the cell to which the mobile is locked.
I The IS-95 and J-Std008 specify a maximum of 350 sec maximum
round trip delay, BTS-Handset. This is a distance of 32.6 miles.
I General Observation: If your cell radius exceeds 30 miles, be careful.
A Word About Soft Handoff for
Former AMPS/TDMA Personnel
I Former AMPS/TDMA optimizers may feel an instinctive obligation
to minimize handoff activity, with good reason. In AMPS/TDMA,
handoffs involved muting and real risk of a drop. Since the mobile
could be served by just one sector at a time, there was pressure to
be sure it was the best available sector, but also pressure not to do
many handoffs. Ping-pong is unpopular in AMPS/TDMA.
I In CDMA, there is no muting or audible effect during soft/softer
handoff, and there is no pressure to use just the right sector -- if
several are roughly as good, use them all, up to 6 at a time.
The noise level on the reverse link actually decreases during
soft handoff - by roughly 4 db. - allowing the system to handle
from 1.5 to 2 times as many subscribers as otherwise.
The forward link noise does rise, but not to troublesome levels
There is an additional cost for doing soft handoff: each involved
BTS must dedicate a TCE channel element to the handoff.
However, even if every user is constantly involved in soft
handoff, this increases the cost of a BTS a small percentage.
I So, to former AMPS/TDMA folks, dont fear. Use the force,
Luke! And to our GSM friends, Resistance is futile...
How Much Soft Handoff is Normal?
I How much soft handoff is normal?
Expectations in early CDMA development were for roughly 35%
The level of soft handoff which should be used depends on how
much diversity gain can be achieved, and terrain roughness
If the reverse link budget assumed 4 dB soft handoff gain, and
propagation decays 35 dB/decade, 42% of the sectors area is
within the last 4 dB. of coverage where soft handoff occurs.
In typical markets, terrain irregularities scatter RF beyond
cleanly designed cell edges; soft handoff is typically 50-60%
In rough terrain, proper soft handoff may rise to 70% or more
I In a system not yet well-tuned, soft handoff may be clearly excessive
The main cause is usually excessive RF overlap between cells
RF coverage control is the most effective means of reducing and
managing soft handoff (BTS attenuation, antenna downtilting)
Thresholds T_ADD and T_DROP can be adjusted to reduce soft
handoff, but this penalizes mobiles that need soft handoff to
escape interference from the excessively overlapping sites
Controlling soft handoff percentage with T_ADD and T_DROP is like limiting
allowed hospital days for various illnesses. Works, but some patients may drop.
Dangerous Environments
I The CDMA handset is designed with a digital rake receiver including
three correlators (fingers) which can demodulate signals from up to three
sectors simultaneously, combining and using the energy from all three to
improve reception. Implications:
If One dominant signal: this is a good situation; the three fingers will
be looking for resolvable multipath components; good diversity
If Two usable signals: good situation; soft handoff & diversity
If Three usable signals: good situation; soft handoff & diversity
If Four roughly equal signals: workable but not ideal. Three best
signals are demodulated; other remains an interferor. 3 vs 1
If Five roughly equal signals: probably workable but not good. Three
best are demodulated; remaining two are interferors. 3 vs 2
If Six roughly equal signals: very frightening. Three best signals are
demodulated; three remaining signals are interferors. 3 vs 3
I The system can provide up to 6-way soft handoff, but anything above
three-way is an indication that there is too much RF coverage overlap.
More than three-way soft handoff should be the notable exception rather
than the rule.
Identifying Causes of Excessive Soft Handoff
I RF Drive Test data (preferred) or Propagation Prediction runs
(second choice) can be used to identify the excessive coverage
overlaps which cause soft handoff.
I Suggested Procedure:
Use a post processing tool to display all locations where a
sector has strongest rake finger status, or
Use a propagation prediction tool to show all locations where a
sector is best server
Draw a curve through all the adjacent surrounding sites
If more than 15% of the best-finger or best-server points lie
outside this line, this sectors coverage is excessive.
Reduce signal levels by at least 8 dB. through attenuation or
downtilt and re-examine either using prediction or re-driving
Be aware that as strong unwanted signals are reduced or
removed by this process, other signals formerly degraded may
become apparent and also require similar treatment. This is
therefore a somewhat iterative process.
Grooming Neighbor Lists
I In section F we described a general technique for creating initial
neighbor lists. During initial optimization, and especially after your
system generates data from commercial traffic, youll want to
revisit and groom the neighbor lists.
I Use your post-processing tool to show you all handoff transitions
requested by mobiles on a per-sector basis. If you dont have a
fancy software tool, you can still do it with fairly simple scripts
parsing captured pilot strength measurement messages.
I For each sector, examine the statistics in conjunction with the
Planet equal power boundaries plot. Consider removing any pilots
that are currently in the neighbor list but have less than 1% of the
handoff transitions. However, make sure that is not a consequence
of no test drives being made across a particular sector boundary
(for example, do not remove adjacent sectors of a sectored site).
I Consider adding pilots that are not currently in the neighbor list but
have greater than 5% of the handoff transitions. Remember,
though, that the goal is to keep neighbor lists to a minimum (see
below) so avoid adding sites that are obviously not immediate
neighbors of the serving cell (i.e. try to make use of the composite
neighbor list as much as possible).
TX Gain Adjust as a Per-Site Debugging Tool
I Collect Transmit Gain Adjust Statistics
I For an unloaded system, the average should be -7 to -12 db. and
should be fairly constant throughout the coverage area
I Look for big jumps in TX GA from sector to sector. Look for
hardware problems (antennas OK, RX noise figure OK?, etc.)
I If you see values generally outside the range above uniformly
across the coverage area, look at the BS Eb/Nt. It should be 5-9
dB for mobile systems, or 3-4 dB. for fixed wireless access.
I Other parameters can have similar uses; compare and study.
0 dB
-10 dB
-20 dB
Typical Mobile Station Transmit Gain Adjust
Time, Seconds
Software Bugs and Protocol Violations
I After some experience surfing through air interface messages,
you will begin to notice interesting things that just don t look right.
Some of them will be events youll research and find are normal
and perhaps even beneficial. Some of them will be the inadvertent
rantings of insane code in infantile handsets or the network system
itself. If this were a philosophical cult, wed tell you our sacred
leaders writings are infallible and not to question them. However,
in this real-world technology created by humans for humans, you
may even discover things which are bugs in the CDMA standards
themselves, requiring correction in the next revision.
I Just a word of encouragement, maybe emboldenment: Learn
well the air interface and the standards. Trust yourself, and take
no prisoners. If you dont question what you see and at least
mention your suspicions about the emperors clothes, then you
have no right to complain about system performance. Who knows,
Andy Viterbi might even hear your name, or at least youll have a
Nortel CSR named after you until its fixed.
Bibliography
Wireless Communications Principles & Practice by Theodore S. Rappaport. 641 pp., 10 chapters, 7 appendices.
Prentice-Hall PTR, 1996, ISBN 0-13-375536-3. If you can only buy one book, buy this one. Comprehensive
summary of wireless technologies along with principles of real systems. Includes enough math for
understanding and solving real problems. Good coverage of system design principles.
The Mobile Communications Handbook edited by Jerry D. Gibson. 577 pp., 35 chapters. CRC Press/ IEEE Press
1996, ISBN 0-8493-0573-3. $89 If you can buy only two books, buy this second. Solid foundation of modulation
schemes, digital processing theory, noise, vocoding, forward error correction, excellent full-detailed expositions
of every single wireless technology known today, RF propagation, cell design, traffic engineering. Each chapter
is written by an expert, and well-edited for readability. Clear-language explanations for both engineers and
technicians but also includes detailed mathematics for the research-inclined. Highly recommended.
CDMA Systems Engineering Handbook by Jhong Sam Lee and Leonard E. Miller, 1998 Artech House, ISBN 0-
89006-990-5. Excellent treatment of CDMA basics and deeper theory, cell and system design principles,
system performance optimization and capacity issues. Highly recommended.
Applications of CDMA in Wireless/Personal Communications by Garg, Smolik & Wilkes. 360 pp., Prentice Hall,
1997, ISBN 0-13-572157-1 $65. Good CDMA treatment. Excellent treatment of IS-95/JStd. 008 as well as W-
CDMA. More than just theoretical text, includes chapters on IS-41 networking, radio engineering, and practical
details of CDMA signaling, voice applications, and data applications.
CDMA RF System Engineering by Samuel C. Yang, 1998 Artech House, ISBN 0-89006-991-3. Good general
treatment of CDMA capacity considerations from mathematical viewpoint.
"CDMA: Principles of Spread Spectrum Communication" by Andrew J. Viterbi. 245 p. Addison-Wesley 1995. ISBN
0-201-63374-4, $65. Definitive very deep CDMA Theory. You can design CDMA chipsets after reading it, but
beware lots of triple integrals; not very relevant to operations. Prestige collectors item among CDMA faithful.
"Mobile Communications Engineering" 2
nd
. Edition by William C. Y. Lee. 689 pp. McGraw Hill 1998 $65.
ISBN 0-07-037103-2 Lees latest/greatest reference work on all of wireless; very complete and well done.
"Spread Spectrum Communications Handbook" by Simon, Omura, Scholtz, and Levitt. 1227 pp., 15 illus., McGraw-
Hill # 057629-7, $99.50 Definitive technical reference on principles of Spread Spectrum including direct
sequence as used in commercial IS-95/JStd008 CDMA. Heavy theory.
Bibliography (concluded)
Wireless and Personal Communications Systems by Garg, Smolik & Wilkes. 445 pp., Prentice Hall, 1996, $68.
ISBN 0-13-234-626-5 $68. This is the little brother of The Mobile Communications Handbook. Good
explanation of each technology for a technical newcomer to wireless, but without quite as much authoritative
math or deep theoretical insights. Still contains solid theory and discussion of practical network architecture.
"Voice and Data Communications Handbook" by Bates and Gregory 699 pp, 360 illus., McGraw-Hill # 05147-X, $65
Good authoritative reference on Wireless, Microwave, ATM, Sonet, ISDN, Video, Fax, LAN/WAN
"Communication Electronics" by Louis E. Frenzel, 2nd. Ed., list price $54.95. Glencoe/MacMillan McGraw Hill,
April, 1994, 428 pages hardcover, ISBN 0028018427. All the basic principles of transmission and their
underlying math. If you didnt take signals & systems in school, this is your coach in the closet.
Digital Communications: Fundamentals and Applications by Bernard Sklar. 771 pp., Prentice Hall, 1988. $74
ISBN# 0-13-211939-0 Excellent in depth treatment of modulation schemes, digital processing theory, noise.
"Wireless Personal Communications Services" by Rajan Kuruppillai. 424 pp., 75 illus., McGraw-Hill # 036077-4, $55
Introduction to major PCS technical standards, system/RF design principles and process, good technical
reference
"PCS Network Deployment" by John Tsakalakis. 350 pp, 70 illus., McGraw-Hill #0065342-9, $65 Tops-down view
of the startup process in a PCS network. Includes good traffic section.
"The ARRL Handbook for Radio Amateurs (1997)" published by the American Radio Relay League (phone 800-594-
0200). 1100+ page softcopy ($44); useful exposure to nuts-and-bolts practical ideas for the RF-unfamiliar.
Solid treatment of the practical side of theoretical principles such as Ohms law, receiver and transmitter
architecture and performance, basic antennas and transmission lines, and modern circuit devices. Covers
applicable technologies from HF to high microwaves. If you havent had much hands-on experience with real
RF hardware, or havent had a chance to see how the theory you learned in school fits with modern-day
communications equipment, this is valuable exposure to real-world issues. Even includes some spread-
spectrum information in case youre inclined to play and experiment at home. At the very least, this book will
make dealing with hardware more comfortable. At best, it may motivate you to dig deeper into theory as you
explore why things behave as they do.
End of Section

302 - CDMA Performance Optimization Using Grayson's Surveyor

Încărcat de

Informații document

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

302 - CDMA Performance Optimization Using Grayson's Surveyor

Încărcat de

Drepturi de autor:

Formate disponibile

Course 302 -- CDMA Drive Test & System Optimization Issue 2.

0 (March, 2001) Page 1

S-ar putea să vă placă și