Tonex RF Bootcamp

Tonex RF Bootcamp
November, 2014
RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex
RF100 - 1
History of RF And
Early Telecommunications
November, 2014
RF100 - 2
How Did We Get Here?

Days before radio.....
1680 Newton first suggested
concept of spectrum, but for
visible light only
N
LF HF VHF UHF MW IR
UV XRAY
1831 Faraday demonstrated that

light, electricity, and magnetism
are related
1864 Maxwells Equations:
spectrum includes more than light
1890s First successful demos of
radio transmission
November, 2014
RF100 - 3
Telegraphy
Samuel F.B. Morse had the idea of the telegraph on a
sea cruise in the 1833. He studied physics for two years,
and In 1835 demonstrated a working prototype, which he
patented in 1837.
Derivatives of Morse binary code are still in use today
The US Congress funded a demonstration line from
Washington to Baltimore, completed in 1844.
1844: the first commercial telegraph circuits were coming
into use. The railroads soon were using them for train
dispatching, and the Western Union company resold idle
Samuel F. B. Morse
time on railroad circuits for public telegrams, nationwide
at the peak of his career
1857: first trans-Atlantic submarine cable was installed
Submarine Cable Installation

news sketch from the 1850s
November, 2014
Field Telegraphy
during the US Civil War, 1860s
RF100 - 4
Telephony
By the 1870s, the telegraph was in use all over the world and largely taken for
granted by the public, government, and business.
In 1876, Alexander Graham Bell patented his telephone, a device for carrying
actual voices over wires.
Initial telephone demonstrations sparked intense public interest and by the late
1890s, telephone service was available in most towns and cities across the USA
Alexander Graham Bell and his phone

from 1876 demonstration
November, 2014
Telephone Line Installation Crew

1880s
RF100 - 5
Electromagnetic Radiation
electric
field
Propagation
direction
Interrelated electric and magnetic fields

traveling through space
Electromagnetic radiation travels at about
c = 3108 m/s in a vacuum the cosmic
speed limit!
299792458.0 m/s, more exactly
in cables, 82-95% speed in a vacuum
In glass, about 66% speed in a vacuum
magnetic
field
November, 2014
RF100 - 6
Radio Milestones
1888: Heinrich Hertz, German physicist, gives lab demo of
existance of electromagnetic waves at radio frequencies
1895: Guglielmo Marconi demonstrates a wireless radio
telegraph over a 3-km path near his home it Italy
1897: the British fund Marconis development of reliable
radio telegraphy over ranges of 100 kM
1902: Marconis successful trans-Atlantic demonstration
1902: Nathan Stubblefield demonstrates voice over radio
Guglielmo Marconi
1906: Lee De Forest invents audion, triode vacuum tube radio pioneer, 1895
feasible now to make steady carriers, and to amplify signals
MTS,
IMTS
1914: Radio became valuable military tool in World War I

1920s: Radio used for commercial broadcasting
1940s: first application of RADAR - English detection of
incoming German planes during WW II
1950s: first public marriage of radio and telephony - MTS,
Mobile Telephone System
1961: transistor developed: portable radio now practical
1961: IMTS - Improved Mobile Telephone Service
Lee De Forest
1970s: Integrated circuit progress: MSI, LSI, VLSI, ASICs vacuum tube inventor
1979, 1983: AMPS cellular demo, commercial deployment
November, 2014
RF100 - 7
Prefixes for Large and Small Units
November, 2014
RF100 - 8
Wavelength, Frequency, and Energy Relationships
Wavelength (m)
Frequency (Hz)
Energy (J)
Radio
> 1 x 10-1
< 3 x 109
< 2 x 10-24
Microwave
1 x 10-3 - 1 x 10-1
3 x 109 - 3 x 1011
2 x 10-24- 2 x 10-22
Infrared
7 x 10-7 - 1 x 10-3
3 x 1011 - 4 x 1014
2 x 10-22 - 3 x 10-19
Optical
4 x 10-7 - 7 x 10-7
4 x 1014 - 7.5 x 1014
3 x 10-19 - 5 x 10-19
UV
1 x 10-8 - 4 x 10-7
7.5 x 1014 - 3 x 1016
5 x 10-19 - 2 x 10-17
X-ray
1 x 10-11 - 1 x 10-8
3 x 1016 - 3 x 1019
2 x 10-17 - 2 x 10-14
Gamma-ray
< 1 x 10-11
> 3 x 1019
> 2 x 10-14
November, 2014
RF100 - 9
Frequency vs. Wavelength
November, 2014
RF100 - 10
Radio Spectrum Designations

Free-space
Wavelengths
Designation
Abbreviation
Frequencies
Very Low
Frequency
VLF
9 kHz - 30 kHz
33 km - 10 km
Low Frequency
LF
30 kHz - 300 kHz
10 km - 1 km
Medium Frequency
MF
300 kHz - 3 MHz
1 km - 100 m
High Frequency
HF
3 MHz - 30 MHz
100 m - 10 m
Very High
Frequency
VHF
30 MHz - 300 MHz
10 m - 1 m
Ultra High
Frequency
UHF
300 MHz - 3 GHz
1 m - 100 mm
Super High
Frequency
SHF
3 GHz - 30 GHz
100 mm - 10 mm
Extremely High
Frequency
EHF
30 GHz - 300 GHz
10 mm - 1 mm
November, 2014
RF100 - 11
Common Terms for US Frequency Bands

Band
Frequency range
UHF ISM
902-928 MHz
S-Band
2-4 GHz
S-Band ISM
2.4-2.5 GHz
C-Band
4-8 GHz
C-Band satellite downlink
3.7-4.2 GHz
C-Band Radar (weather)
5.25-5.925 GHz
C-Band ISM
5.725-5.875 GHz
C-Band satellite uplink
5.925-6.425 GHz
X-Band
8-12 GHz
X-Band Radar (police/weather)
8.5-10.55 GHz
Ku-Band
12-18 GHz
Ku-Band Radar (police)
13.4-14 GHz 15.7-17.7 GHz
November, 2014
RF100 - 12
Microwave Bands (complete list)

L band
1 to 2 GHz
S band
2 to 4 GHz
C band
4 to 8 GHz
X band
8 to 12 GHz
Ku band
12 to 18 GHz
K band
18 to 26.5 GHz
Ka band
26.5 to 40 GHz
Q band
30 to 50 GHz
U band
40 to 60 GHz
V band
50 to 75 GHz
E band
60 to 90 GHz
W band
75 to 110 GHz
F band
90 to 140 GHz
D band
110 to 170 GHz
November, 2014
RF100 - 13
Frequencies Used by Wireless Systems

Overview of the Radio Spectrum
AM
0.3
0.4
0.5
0.6
LORAN
0.7 0.8 0.9 1.0
1.2
Marine
1.4 1.6 1.8 2.0
2.4
Short Wave -- International Broadcast -- Amateur
VHF LOW Band
30
40
VHF TV 2-6
50
60
70
10
12
FM
80 90 100
30,000,000 i.e., 3x10 Hz
VHF VHF TV 7-13
120 140 160 180 200
0.5
Broadcasting
November, 2014
0/6
300 MHz
2.4
3.0 GHz
GPS
0.7 0.8 0.9 1.0
240
300,000,000 i.e., 3x108 Hz

DCS, PCS, AWS
UHF UHF TV 14-59
0.4
CB
14 16 18 20 22 24 26 28 30 MHz
7
700 + Cellular
0.3
3.0 MHz
3,000,000 i.e., 3x106 Hz
10
1.2
1.4 1.6 1.8 2.0
12
14 16 18 20 22 24 26 28 30 GHz
10
3,000,000,000 i.e., 3x109 Hz
30,000,000,000 i.e., 3x10
Land-Mobile
Aeronautical Mobile Telephony
Terrestrial Microwave Satellite
RF100 - 14
Hz
The Broadband Wireless Spectrum

ISM
SATELLITE
WCS BCST. WCS
2300
2400
Sirius
& XM
5100
800
900
1000 MHz.
ISM
EBS
BRS
U-NII
5200
2500
EBS BRS
2600 MHz.
5300
2690
5400
ISM
5700
5800
5900 MHz.
Five differently-regulated ranges of spectrum are available for broadband:

ISM - the Industrial, Scientific, and Medical band. Unlicensed, already used for Wi-Fi networking,
cordless phones, toys, and microwave ovens. Spread-spectrum transmission is required. In some
localities this spectrum may be too cluttered to be useful for broadband.
U-NII Unlicensed National Information Infrastructure band. Unlicensed, and spread-spectrum
transmission is not required. This spectrum has far fewer users at present than ISM.
BRS - Broadband Radio Service. (Earlier called the Multipoint Distribution Service (MDS)/MMDS),
it was used as wireless cable to bring video to end-users.) Links are licensed, so the potential for
interference is small. Sprint and Nextel both control large blocks which are now combined.
EBS Educational Broadband Service (formerly ITFS/Instructional Television Fixed Service)
instructional video and data for education. Licensed spectrum; can be used for wireless
broadband. Clearwire/Craig McCaw control large blocks.
WCS Wireless Communications Service. Licensed spectrum available for broadband. Bellsouth
owns large blocks.
November, 2014
RF100 - 15
700 MHz
800
IDEN
CELL DNLNK
900
PCS
Uplink
PCS
DownLink
1700
1800
1900
Frequency, MegaHertz
2000
AWS
DownLink
2100
SAT
AWS
Uplink
AWS?
Proposed AWS-2
SAT
700 MHz.
IDEN
CELL UPLINK
Current Wireless/Cellular Spectrum in the US
2200
Modern wireless began in the 800 MHz. range, when the US FCC
reallocated UHF TV channels 70-83 for wireless use and AT&Ts Analog
technology AMPS was chosen.
Nextel bought many existing 800 MHz. Enhanced Specialized Mobile
Radio (ESMR) systems and converted to Motorolas IDEN technology
The FCC allocated 1900 MHz. spectrum for Personal Communications
Services, PCS, auctioning the frequencies for over $20 billion dollars
With the end of Analog TV broadcasting in 2009, the FCC auctioned
former TV channels 52-69 for wireless use, 700 MHz.
The FCC also auctioned spectrum near 1700 and 2100 MHz. for
Advanced Wireless Services, AWS.
Technically speaking, any technology can operate in any band. The
choice of technology is largely a business decision.
November, 2014
RF100 - 16
North American Cellular Spectrum

Uplink Frequencies
(Reverse Path)
824
835
Downlink Frequencies
(Forward Path)
845
849
Frequency, MHz
870
Paging, ESMR, etc.

825
846.5
Ownership and
Licensing
890
880
894
869
891.5
Frequencies used by A Cellular Operator

Initial ownership by Non-Wireline companies
Frequencies used by B Cellular Operator
Initial ownership by Wireline companies
In each MSA and RSA, eligibility for ownership was restricted

A licenses awarded to non-telephone-company applicants only
B licenses awarded to existing telephone companies only
subsequent sales are unrestricted after system in actual operation
November, 2014
Page 17
Development of North America PCS

By 1994, US cellular systems were seriously
overloaded and looking for capacity relief
The FCC allocated 120 MHz. of spectrum
around 1900 MHz. for new wireless telephony
known as PCS (Personal Communications
Systems), and 20 MHz. for unlicensed services
allocation was divided into 6 blocks; 10-year
licenses were auctioned to highest bidders
PCS Licensing and Auction Details
A & B spectrum blocks licensed in 51 MTAs (Major Trading Areas )
Revenue from auction: $7.2 billion (1995)
C, D, E, F blocks were licensed in 493 BTAs (Basic Trading Areas)
C-block auction revenue: $10.2 B, D-E-F block auction: $2+ B (1996)
Auction winners are free to choose any desired technology
51 MTAs
493 BTAs
PCS SPECTRUM ALLOCATIONS IN NORTH AMERICA
1850
MHz.
E F
15
15
15
November, 2014
unlic.
G data voice
1910
MHz.
1930
MHz.
E F
15
15
15
G
1990
MHz.
Page 18
Advanced Wireless Services: The AWS Spectrum
To further satisfy growing demand for wireless data services as well

as traditional voice, the FCC has also allocated more spectrum for
wireless in the 1700 and 2100 MHz. ranges
The US AWS spectrum lines up with International wireless
spectrum allocations, making world wireless handsets more
practical than in the past
Many AWS licensees will simply use their AWS spectrum to add
more capacity to their existing networks; some will use it to
introduce their service to new areas
Page 19
November, 2014
AWS Spectrum Blocks
The AWS spectrum is divided into blocks

Different wireless operator companies are licensed to use specific
blocks in specific areas
This is the same arrangement used in original 800 MHz. cellular,
1900 MHz. PCS, and the new 700 MHz. allocations
Page 20
November, 2014
The US 700 MHz. Spectrum and Its Blocks
To satisfy growing demand for wireless data services as well as

traditional voice, the FCC has also taken the spectrum formerly used as
TV channels 52-69 and allocated them for wireless
The TV broadcasters will completely vacate these frequencies when
analog television broadcasting ends in February, 2009
At that time, the winning wireless bidders may begin building and
operating their networks
In many cases, 700 MHz. spectrum will be used as an extension of
existing operators networks. In other cases, entirely new service will be
provided.
Page 21
November, 2014
RF100 - 22
November, 2014
Wireless Systems:
Modulation and Signal Bandwidth
Q axis
Lower
Sideband
fc
Upper
Sideband
b
a
0 1 0
fc
I axis
QPSK
0 1 0
fc
0 1 0
Q axis
a
c
I axis
p
v
/4 shifted DQPSK
fc
November, 2014
RF100 - 23
Characteristics of a Radio Signal

SIGNAL CHARACTERISTICS
The complete, timevarying radio signal
Natural Frequency
of the signal
S (t) = A cos [ c t + ]
Amplitude (strength)
of the signal
Phase of the signal
Compare these Signals:

Different
Amplitudes
Different
Frequencies
The purpose of telecommunications is to

send information from one place to another
Our civilization exploits the transmissible
nature of radio signals, using them in a
sense as our carrier pigeons
To convey information, some characteristic
of the radio signal must be altered (I.e.,
modulated) to represent the information
The sender and receiver must have a
consistent understanding of what the
variations mean to each other
RF signal characteristics which can be
varied for information transmission:
Amplitude
Frequency
Phase
Different
Phases
November, 2014
RF100 - 24
Modulation and Occupied Bandwidth

Time-Domain
Frequency-Domain
(as viewed on an
Oscilloscope)
(as viewed on a
Spectrum Analyzer)
Voltage
The bandwidth occupied by a signal

depends on:
Voltage
Time
Frequency
Lower
Sideband
fc
Upper
Sideband
fc
fc
input information bandwidth

modulation method
Information to be transmitted, called
input or baseband
bandwidth usually is small, much
lower than frequency of carrier
Unmodulated carrier
the carrier itself has Zero bandwidth!!
AM-modulated carrier
Notice the upper & lower sidebands
total bandwidth = 2 x baseband
FM-modulated carrier
Many sidebands! bandwidth is a
complex mathematical function
PM-modulated carrier
Many sidebands! bandwidth is a
complex mathematical function
fc
November, 2014
RF100 - 25
The Emergence of AM: A bit of History

The early radio pioneers first used binary transmission, turning their
crude transmitters on and off to form the dots and dashes of Morse
code. The first successful demonstrations of radio occurred during
the mid-1890s by experimenters in Italy, England, Kentucky, and
elsewhere.
Amplitude modulation was the first method used to transmit voice
over radio. The early experimenters couldnt foresee other methods
(FM, etc.), or todays advanced digital devices and techniques.
Commercial AM broadcasting to the public began in the early
1920s.
Despite its disadvantages and antiquity, AM is still alive:
AM broadcasting continues today in 540-1600 KHz.
AM modulation remains the international civil aviation standard,
used by all commercial aircraft (108-132 MHz. band).
AM modulation is used for the visual portion of commercial
television signals (sound portion carried by FM modulation)
Citizens Band (CB) radios use AM modulation
Special variations of AM featuring single or independent
sidebands, with carrier suppressed or attenuated, are used for
marine, commercial, military, and amateur communications
SSB
LSB USB
November, 2014
RF100 - 26
Frequency Modulation (FM)

TIME-DOMAIN VIEW
t
sFM(t) =A cos c t + mm(x)dx+
t0
where:
A = signal amplitude (constant)
c = radian carrier frequency
mfrequency deviation index
m(x) = modulating signal
= initial phase
Voltage
FREQUENCY-DOMAIN VIEW
LOWER
SIDEBANDS
0 Frequency
November, 2014
UPPER
SIDEBANDS
SFM(t)
Frequency Modulation (FM) is a type of

angle modulation
in FM, the instantaneous frequency
of the signal is varied by the
modulating waveform
Advantages of FM
the amplitude is constant
simple saturated amplifiers can
be used
the signal is relatively immune
to external noise
the signal is relatively robust;
required C/I values are typically
17-18 dB. in wireless
applications
Disadvantages of FM
relatively complex detectors are
required
a large number of sidebands are
produced, requiring even larger
bandwidth than AM
fc
RF100 - 27
The Digital Advantage
transmission
demodulation-remodulation
transmission
transmission
November, 2014
The modulating signals shown in previous

slides were all analog. It is also possible to
quantize modulating signals, restricting them
to discrete values, and use such signals to
perform digital modulation. Digital
modulation has several advantages over
analog modulation:
Digital signals can be more easily
regenerated than analog
in analog systems, the effects of noise
and distortion are cumulative: each
demodulation and remodulation
introduces new noise and distortion,
added to the noise and distortion from
previous demodulations/remodulations.
in digital systems, each demodulation
and remodulation produces a clean
output signal free of past noise and
distortion
Digital bit streams are ideally suited to many
flexible multiplexing schemes
RF100 - 28
Theory of Digital Modulation: Sampling

m(t)
Sampling
p(t)
m(t)
Recovery
The Sampling Theorem: Two Parts

If the signal contains no frequency higher
than fM Hz., it is comletely described by
specifying its samples taken at instants of
time spaced 1/2 fM s.
The signal can be completely recovered
from its samples taken at the rate of 2 fM
samples per second or higher.
November, 2014
Voice and other analog signals first must

be sampled (converted to digital form) for
digital modulation and transmission
The sampling theorem gives the criteria
necessary for successful sampling,
digital modulation, and demodulation
The analog signal must be bandlimited (low-pass filtered) to contain
no frequencies higher than fM
Sampling must occur at least twice
as fast as fM in the analog signal.
This is called the Nyquist Rate
Required Bandwidth for p(t)
If each sample p(t) is expressed as
an n-bit binary number, the
bandwidth required to convey p(t) as
a digital signal is at least N*2* fM
this follows Shannons Theorem: at
least one Hertz of bandwidth is
required to convey one bit per
second of data
RF100 - 29
Sampling Example: the 64 kb/s DS-0

Band-Limiting
C-Message Weighting
0 dB
-10dB
-20dB
-30dB
-40dB
16
15
14
13
12
11
10
9
8
7
6
5
4
3
2
1
0
100
300
1000
3000
Frequency, Hz
Companding
16
15
8
3
10000
4 4
-Law
y sgn(x)
ln(1 | x|)
ln(1 )
(where 255)
A-LAW A|x|
y sgn(x)
for 0 x
A
ln(1 A)
1
ln(1 A|x)|
y sgn(x)
for x 1
A
ln(1 A)
(where A 87. 6)
x = analog audio voltage

y = quantized level (digital)
November, 2014
Telephony has adopted a world-wide PCM

standard digital signal employing a 64 kb/s
stream derived from sampled voice data
Voice waveforms are band-limited
upper cutoff between 3500-4000 Hz. to
avoid aliasing
rolloff below 300 Hz. to minimize
vulnerability to hum from AC power mains
Voice waveforms sampled at 8000/second rate
8000 samples x 1 byte = 64,000 bits/second
A>D conversion is non-linear, one byte per
sample, thus 256 quantized levels are
possible
Levels are defined logarithmically rather
than linearly to accommodate a wider range
of audio levels with minimum distortion
-law companding (popular in North
America & Japan)
A-law companding (used in most other
countries)
A>D and D>A functions are performed in a
CODEC (coder-decoder) (see following figure)
RF100 - 30
Digital Modulation
November, 2014
RF100 - 31
Modulation by Digital Inputs

Our previous modulation examples used continuously-variable
analog inputs. If we quantize the inputs, restricting them to
digital values, we will produce digital modulation.
Voltage
Time
0 1 0
0 1 0
0 1 0
0 1 0
November, 2014
For example, modulate a signal with this

digital waveform. No more continuous
analog variations, now were shifting
between discrete levels. We call this shift
keying.
The user gets to decide what levels
mean 0 and 1 -- there are no
inherent values
Steady Carrier without modulation
Amplitude Shift Keying
ASK applications: digital microwave
Frequency Shift Keying
FSK applications: control messages in
AMPS cellular; TDMA cellular
Phase Shift Keying
PSK applications: TDMA cellular,
GSM & PCS-1900
RF100 - 32
Claude Shannon:
The Einstein of Information Theory and Signal Science

The core idea that makes CDMA
possible was first explained by
Claude Shannon, a Bell Labs
research mathematician
Shannon's work relates amount
of information carried, channel
bandwidth, signal-to-noise-ratio,
and detection error probability
It shows the theoretical
upper limit attainable
In 1948 Claude Shannon published his landmark paper on information theory,
A Mathematical Theory of Communication. He observed that "the
fundamental problem of communication is that of reproducing at one point
either exactly or approximately a message selected at another point." His
paper so clearly established the foundations of information theory that his
framework and terminology are standard today.
Shannon died Feb. 24, 2001, at age 84.
November, 2014
RF100 - 33
Modulation Techniques of 1xEV Technologies

1xEV, 1x Evolution, is a family of alternative
fast-data schemes that can be implemented on a
1x CDMA carrier.
1xEV DO means 1x Evolution, Data Only,
originally proposed by Qualcomm as High Data
Rates (HDR).
Up to 2.4576 Mbps forward, 153.6 kbps
reverse
A 1xEV DO carrier holds only packet data,
and does not support circuit-switched voice
Commercially available in 2003
1xEV DV means 1x Evolution, Data and Voice.
Max throughput of 5 Mbps forward, 307.2k
reverse
Backward compatible with IS-95/1xRTT
voice calls on the same carrier as the data
Not yet commercially available; work
continues
All versions of 1xEV use advanced modulation
techniques to achieve high throughputs.
November, 2014
QPSK
CDMA IS-95,
IS-2000 1xRTT,
and lower rates
of 1xEV-DO, DV
16QAM
1xEV-DO
at highest
rates
64QAM
1xEV-DV
at highest
rates
RF100 - 34
Digital Modulation Systems

Each symbol of a digitally
modulated RF signal conveys
a number of bits of information
determined by the number
of degrees of modulation
freedom
More complex modulation
schemes can carry more bits
per symbol in a given
bandwidth, but require better
signal-to-noise ratios
The actual number of bits per
second which can be
conveyed in a given bandwidth
under given signal-to-noise
conditions is described by
Shannons equations
November, 2014
Modulation
Scheme
Shannon Limit,
BitsHz
BPSK
QPSK
8PSK
16 QAM
32 QAM
64 QAM
256 QAM
1 b/s/hz
2 b/s/hz
3 b/s/hz
4 b/s/hz
5 b/s/hz
6 b/s/hz
8 b/s/hz
SHANNONS
CAPACITY EQUATION
C = B log2 [
1+
S
N
B = bandwidth in Hertz
C = channel capacity in bits/second
S = signal power
N = noise power
RF100 - 35
Digital Modulation Schemes

There are many different schemes for digital modulation, each a
compromise between complexity, immunity to errors in transmission,
required channel bandwidth, and possible requirement for linear amplifiers
Linear Modulation Techniques
BPSK Binary Phase Shift Keying
DPSK Differential Phase Shift Keying
QPSK Quadrature Phase Shift Keying IS-95 CDMA forward link
Offset QPSK IS-95 CDMA reverse link
Pi/4 DQPSK IS-54, IS-136 control and traffic channels
Constant Envelope Modulation Schemes
BFSK Binary Frequency Shift Keying AMPS control channels
MSK Minimum Shift Keying
GMSK Gaussian Minimum Shift Keying GSM systems, CDPD
Hybrid Combinations of Linear and Constant Envelope Modulation
MPSK M-ary Phase Shift Keying
QAM M-ary Quadrature Amplitude Modulation
MFSK M-ary Frequency Shift Keying FLEX paging protocol
Spread Spectrum Multiple Access Techniques
DSSS Direct-Sequence Spread Spectrum IS-95 CDMA
FHSS Frequency-Hopping Spread Spectrum
November, 2014
RF100 - 36
Error Vulnerabilities of
Higher-Order Modulation Schemes
Higher-Order Modulation
Schemes (16PSK, 32QAM,
64QAM...) are more
vulnerable to transmission
errors than the simpler, more
rugged schemes (BPSK,
QPSK)
Closely-packed
constellations leave little
room for vector error
Non-linearities (gain
compression, clipping,
reflections within antenna
system) warp the
constellation
Noise and long-delayed
echoes cause scatter
around constellation points
Interference blurs
constellation points into
rings of error
November, 2014
Q Distortion
Q Normal 64QAM
(Gain Compression)
Q Noise
Q Interference
RF100 - 37
Error Vector Magnitude and (Rho)

A common measurement of
overall error is Error Vector
Magnitude EVM
usually a small fraction of
total vector amplitude, ~0.1
EVM is usually averaged over
a large number of symbols
Root-mean-square (RMS)
Commercial test equipment
for BTS maintenance
measures EVM
Signal quality is often
expressed as 1-EVM
normally called (Rho)
typically 0.89-0.96
November, 2014
RF100 - 38
RF Fundamentals:
Noise
RF100 - 39
November, 2014
Receiving Weak Signals:
Noise, Unwelcome Guest Who Wont Go Home!

To hear a very weak signal, why cant we just add amplifier after
amplifier until we get enough gain to hear it?
Unfortunately, theres always noise in the background free!
The signal must be strong enough to hear despite the noise
Signal-to-Noise Ratio SNR
Different kinds of signals have different resistance to noise
The most common, ever-present kind of noise is thermal noise
Electrons in metal are always randomly moving around,
propelled by free ambient heat
Electron flow is the same thing as current noise current
Thermal noise power is distributed evenly through the radio
spectrum a certain amount per hertz of bandwidth
RF100 - 40
November, 2014
How Strong is the Thermal Noise?

The strength of the noise we receive is determined by three things:
Its proportional to absolute temperature (degrees Kelvin)
Its proportional to the bandwidth were looking at (thermal noise
is uniformly distributed in watts per hertz)
The exact amount of noise per degree kelvin per hertz is
determined by Boltzmanns constant
In the world of radio, we usually express noise power in decibels
above a milliwatt (dbm). Heres the everyday formula for the amount
of thermal noise in dbm:
Where
P is the power in dbm
Delta F is the bandwidth were watching, in hertz
the Noise Floor
RF100 - 41
November, 2014
Thermal Noise Strength

in the Bandwidths of Common Signals
RF100 - 42
November, 2014
Physical Principles of
Propagation
November, 2014
RF100 - 43
Working in Decibels
GAIN and LOSS
Ratio vs. dB
1,000,000 x
+60 db
100,000 x
+50 db
10,000 x
+40 db
1,000 x
+30 db
100 x
+20 db
10 x
4x
2x
1x
+10 db
+6 db
+3 db
0 db
.1 x
-10 db
.01 x
-20 db
.001 x
-30 db
.0001 x
-40 db
.00001 x
-50 db
.000001 x
-60 db
November, 2014
Ratio to Decibels
db = 10 * Log10 (Pout/Pin)
Decibels to Ratio
(Pout/Pin) = 10 (db/10)
Amplifiers increase the power of electrical signals
(an increase is called gain)
Cables, attenuators, or simple radiation through
space decrease signal power (called loss)
Decibels are logarithmic units, so db values are
never very big or very small db, even if the gains
or losses are extremely big or small
Db are always small enough to allow doing the
arithmetic in your head without needing a
calculator
RF100 - 44
Decibels can Express Relative Gains/Losses,

or Absolute Amounts of Power,
or Gains of Specific Antennas
dB - relative gain or loss
When you see just a simple value 30 dB, this tells what happens to a
signal when it passes through a certain device or system
If a device increases the signal power 1000x, that is 30 db gain.
If signal power decreases 1000x, that is -30 db gain (thats loss).
dBm - absolute power
A value 30 dBm expresses an actual amount of power. m stands for
milliwatts. Example: 1000 milliwatts is +30 dBm
dBi or dBd gain of test antenna compared to a reference antenna
12.1 dbi gain means the test antenna makes signals seem 12.1 db
stronger than if an isotropic antenna had been used
10 dbd gain means the test antenna makes signals seem 10 db
stronger than if a dipole antenna had been used
November, 2014
RF100 - 45
Introduction to Propagation
Propagation is a key process within every radio link. During propagation, many
processes act on the radio signal.
attenuation
the signal amplitude is reduced by various natural mechanisms; if there is
too much attenuation, the signal will fall below the reliable detection
threshold at the receiver. Attenuation is the most important single factor
in propagation.
multipath and group delay distortions
the signal diffracts and reflects off irregularly shaped objects, producing a
host of components which arrive in random timings and random RF
phases at the receiver. This blurs pulses and also produces intermittent
signal cancellation and reinforcement. These effects are combatted
through a variety of special techniques
time variability - signal strength and quality varies with time, often dramatically
space variability - signal strength and quality varies with location and distance
frequency variability - signal strength and quality differs on different
frequencies
Effective mastery of propagation relies on
Physics: understand the basic propagation processes
Measurement: obtain data on propagation behavior in area of interest
Statistics: characterize what is known, extrapolate to predict the unknown
Modelmaking: formalize all the above into useful models
November, 2014
RF100 - 46
Some Physics: Wavelength of the Signal

and Its Influence on Propagation
C / F
Frequency,
GHz.
0.92
2.4
5.8
Radio signals in the atmosphere

travel at the speed of light
Wavelength
cm.
in.
32.6
12.8
12.5
4.9
5.2
2.0
/2
RF100 - 47
= wavelength
C = distance traveled in 1 second
F = frequency, Hertz
The wavelength of a radio signal

determines many of its propagation
characteristics
Internal antenna elements size are
typically in the order of 1/4 to 1/2
wavelength
Objects bigger than a wavelength
can reflect or obstruct RF energy
RF energy can penetrate into a
building or vehicle if it has
openings the size of a wavelength,
or larger
November, 2014
Propagation Effects of Earths Atmosphere

Earths unique atmosphere supports life (ours
included) and also introduces many propagation
effects -- some useful, some troublesome
Skywave Propagation: reflection from Ionized Layers
LF and HF frequencies (below roughly 50 MHz.) are
routinely reflected off layers of the upper atmosphere which
become ionized by the sun
this phenomena produces intermittent world-wide
propagation and occasional total outages
this phenomena is strongly correlated with frequency,
day/night cycles, variations in earths magnetic field, 11year sunspot cycle
these effects are negligible for wireless systems at their
much-higher frequencies
November, 2014
RF100 - 48
More Atmospheric Propagation Effects

Rain Fades on
MIcrowave Links
Refraction
by air layers
Attenuation at Microwave Frequencies

rain droplets can substantially attenuate RF signals
whose wavelengths are comparable to, or smaller than,
droplet size
rain attenuations of 20 dB. or more per km. are possible
troublesome mainly above 10 GHz., and in tropical
areas
must be considered in reliability calculations during path
design
not major factor in wireless systems propagation
Diffraction, Wave Bending, Ducting
Ducting
by air layers
signals 50-2000 MHz. can be bent or reflected at

boundaries of different air density or humidity
phenomena: very sporadic unexpected long-distance
propagation beyond the horizon. May last minutes or
hours
can occur in wireless systems
>100 mi.
November, 2014
RF100 - 49
Dominant Mechanisms of Mobile Propagation

Free Space
D
B
Reflection
with partial cancellation
Knife-edge
Diffraction
November, 2014
Most propagation in the mobile

environment is dominated by these
three mechanisms:
Free space
No reflections, no obstructions
first Fresnel Zone clear
Signal spreading is only mechanism
Signal decays 20 dB/decade
Reflection
Reflected wave 180out of phase
Reflected wave not attenuated much
Signal decays 30-40 dB/decade
Knife-edge diffraction
Direct path is blocked by obstruction
Additional loss is introduced
Formulae available for simple cases
Well explore each of these further...
RF100 - 50
Propagation:
Getting the Signal to the Customer
AP
SM
Propagation is the name for the general process of getting a radio signal
from one place to another
During propagation, the signal gets weaker because of several natural
processes. This weakening is called attenuation.
Point-to-point radio links work best when there is line-of-sight between
the two antennas. This is the condition of least attenuation
nothing along the way to block the signal
In mobile systems, line-of-sight only happens near base stations or from
high spots (hilltops, top floors of buildings and parking garages, etc.)
RF100 - 51
November, 2014
The First Fresnel Zone and

Free-Space Propagation
AP
Frequency, Path,
GHz.
Miles
0.92
10
2.4
10
5.8
10
Mid-Pt
Fresnel
R, ft
119
74
47
SM
Most of the signal power sent from one antenna to another travels in an
elliptical, football shape called the First Fresnel zone.
the thickness of the zone depends on the signal frequency
If the First Fresnel zone is free of penetration or obstruction by any objects,
we say free-space conditions apply
this is the desirable condition providing highest received signal strength
Sometimes obstructions are unavoidable, and penetrate the first fresnel zone
this attenuates the signal and reduces the signal strength received at the
other end of the link
the amount of attenuation depends on the degree of penetration by the
obstruction, and its absorbing characteristics
RF100 - 52
November, 2014
LoS, nLoS, and NLoS Definitions
Line of Site
(LoS)
Near Line of
Site
(nLoS)
Non Line of
Site
(NLoS)
November, 2014
RF100 - 53
Free-Space Propagation Technical Details

r
Free Space
Spreading Loss
energy intercepted
by receiving
antenna is
proportional to 1/r2
d
A
The simplest propagation mode

Antenna radiates energy which spreads in space
Path Loss, db (between two isotropic antennas)
= 36.58 +20*Log10(FMHZ)+20Log10(DistMILES )
Path Loss, db (between two dipole antennas)
= 32.26 +20*Log10(FMHZ)+20Log10(DistMILES )
Notice the rate of signal decay:
6 db per octave of distance change, which is
20 db per decade of distance change
Free-Space propagation is applicable if:
there is only one signal path (no reflections)
the path is unobstructed (i.e., first Fresnel zone
is not penetrated by obstacles)
1st Fresnel Zone
D
B
RF100 - 54
First Fresnel Zone =

{Points P where AP + PB - AB < }
Fresnel Zone radius d = 1/2 (D)^(1/2)
November, 2014
Path Profiles from Propagation Prediction Tools
Propagation models can also prepare automated path profiles

From a path profile, you can quickly determine whether the path is
line-of-sight or obstructed
RF100 - 55
November, 2014
Reflection With Partial Cancellation

Heights Exaggerated
for Clarity
HTFT
HTFT
Mobile environment characteristics:

Small angles of incidence and reflection
Reflection is unattenuated (reflection coefficient =1)
Reflection causes phase shift of 180 degrees
Analysis
Physics of the reflection cancellation predicts signal
decay of 40 dB per decade of distance
DMILES
Path Loss [dB ]= 172 + 34 x Log (DMiles )

- 20 x Log (Base Ant. HtFeet)
- 10 x Log (Mobile Ant. HtFeet)
SCALE PERSPECTIVE
Comparison of Free-Space and Reflection Propagation Modes
Assumptions: Flat earth, TX ERP = 50 dBm, @ 1950 MHz. Base Ht = 200 ft, Mobile Ht = 5 ft.
DistanceMILES
Received Signal in
Free Space, DBM
Received Signal in
Reflection Mode
November, 2014
1
-52.4
-69.0
2
-58.4
-79.2
4
-64.4
-89.5
6
-67.9
-95.4
8
-70.4
-99.7
10
-72.4
15
-75.9
20
-78.4
-103.0
-109.0
-113.2
RF100 - 56
Signal Decay Rates in Various Environments

Signal Level vs. Distance
0
-10
-20
-30
-40
1
One Octave
of distance (2x)
November, 2014
3.16
5 6 7 8
Distance, Miles
One Decade
of distance (10x)
10
Weve seen how the signal decays

with distance in two basic modes
of propagation:
Free-Space
20 dB per decade of distance
6 db per octave of distance
Reflection Cancellation
40 dB per decade of distance
12 db per octave of distance
Real-life wireless propagation
decay rates are typically
somewhere between 30 and 40
dB per decade of distance
RF100 - 57
Obstructions and their Effects

AP
SM
When an obstruction penetrates the first fresnel zone, the signal is

attenuated. The degree of attenuation depends on
how much of the first fresnel zone is obstructed
the absorptive characteristics of the obstructing object(s)
whether the signal is also reflecting off of other nearby objects,
possibly providing a degree of fill-in
Depending on the length of the path, the transmitter power, and
the receiver sensitivity, the link may still work despite the
obstruction
RF100 - 58
November, 2014
Severe Obstructions
AP
SM
When the path is blocked by a major obstruction (large hill,

downtown building, etc.) there will be substantial signal attenuation
Even under this undesirable condition, if the distance is small there
may be enough signal to make the link usable
A very small amount of the signal will actually diffract (bend)
over the obstruction
the extra attenuation caused by the obstruction can be
calculated by the knife edge diffraction model
this diffraction loss can be considered in the link budget to
see if the link is likely to be usable anyway
RF100 - 59
November, 2014
Knife-Edge Diffraction
R1
= -H
R2
2 ( R1 + R2)
R1 R2
0
-5
atten -10
dB -15
-20
-25
-5 -4 -3 -2 -1 0 1 2 3
November, 2014
Sometimes a single well-defined

obstruction blocks the path, introducing
additional loss. This calculation is fairly
easy and can be used as a manual tool
to estimate the effects of individual
obstructions.
First calculate the diffraction parameter
from the geometry of the path
Next consult the table to obtain the
obstruction loss in db
Add this loss to the otherwisedetermined path loss to obtain the total
path loss.
Other losses such as free space and
reflection cancellation still apply, but
computed independently for the path as
if the obstruction did not exist
RF100 - 60
Foliage and Building Penetration

Considerations
AP
Building
SM
AP
SM
RF100 - 61
Building
At broadband wireless
frequencies, the penetration loss
entering a building often exceeds
35 db.
this restricts range so greatly
that antennas are almost
never located inside a building
At broadband wireless
frequencies, trees and other
vegetation effectively block and
absorb the signal
typical attenuation for just one
mature tree can be 20 db or
more
Unfortunately, neither building nor
vegetation loss can be predicted
accurately. Measurement is the
only way to know accurately what
is happening.
November, 2014
Combating Rayleigh Fading: Space Diversity

D
Signal received
by Antenna 1
Signal received
by Antenna 2
Combined
Signal
November, 2014
Fortunately, Rayleigh fades are

very short and last a small
percentage of the time
Two antennas separated by
several wavelengths will not
generally experience fades at the
same time
Space Diversity can be
obtained by using two receiving
antennas and switching instantby-instant to whichever is best
Required separation D for good
decorrelation is 10-20
12-24 ft. @ 800 MHz.
5-10 ft. @ 1900 MHz.
RF100 - 62
Types Of Propagation Models And Their Uses

Examples of various model types
Simple Analytical models
Used for understanding and

predicting individual paths and
specific obstruction cases
General Area models
Primary drivers: statistical

Used for early system
dimensioning (cell counts, etc.)
Point-to-Point models
Primary drivers: analytical

Used for detailed coverage
analysis and cell planning
Local Variability models
Primary drivers: statistical

Characterizes microscopic level
fluctuations in a given locale,
confidence-of-service probability
November, 2014
Simple Analytical
Free space (Friis formula)
Reflection cancellation
Knife-edge diffraction
Area
Okumura-Hata
Euro/Cost-231
Walfisch-Betroni/Ikegami
Point-to-Point
Ray Tracing
- Lees Method, others
Tech-Note 101
Longley-Rice, Biby-C
Local Variability
Rayleigh Distribution
Normal Distribution
Joint Probability Techniques
RF100 - 63
General Principles Of Area Models

-50
+90
-60
+80
-70
+70
-80
+60
Field
Strength,
+50 dBV/m
RSSI,
-90
dBm
-100
+40
-110
+30
-120
0
9 12 15 18 21 24 27 30 33
+20
Distance from Cell Site, km
Green Trace shows actual measured signal

strengths on a drive test radial, as determined
by real-world physics.
Red Trace shows the Okumura-Hata
prediction for the same radial. The smooth
curve is a good fit for real data. However, the
signal strength at a specific location on the
radial may be much higher or much lower
than the simple prediction.
November, 2014
Area models mimic an average

path in a defined area
Theyre based on measured data
alone, with no consideration of
individual path features or
physical mechanisms
Typical inputs used by model:
Frequency
Distance from transmitter to
receiver
Actual or effective base
station & mobile heights
Average terrain elevation
Morphology correction loss
(Urban, Suburban, Rural, etc.)
Results may be quite different
than observed on individual paths
in the area
RF100 - 64
The Okumura Model: General Concept

70
Urban Area
35
50
(dB)
Correction factor, Garea
80
70
d, km
Median Attenuation A(f,d), dB
100
40
30
26
25
20
15
10
9 dB
5
2
1
10
30
850 MHz
850
100
500
Frequency f, MHz
3000
100
200
300
500 700 1000
Frequency f, (MHz)
2000
3000
The Okumura model is based on detailed analysis of exhaustive drive-test measurements

made in Tokyo and its suburbs during the late 1960s and early 1970s. The collected
date included measurements on numerous VHF, UHF, and microwave signal sources,
both horizontally and vertically polarized, at a wide range of heights.
The measurements were statistically processed and analyzed with respect to almost every
imaginable variable. This analysis was distilled into the curves above, showing a
median attenuation relative to free space loss Amu (f,d) and correlation factor Garea
(f,area), for BS antenna height ht = 200 m and MS antenna height hr = 3 m.
Okumura has served as the basis for high-level design of many existing wireless
systems, and has spawned a number of newer models adapted from its basic
concepts and numerical parameters.
November, 2014
RF100 - 65
Structure of the Okumura Model

Path Loss [dB] = LFS + Amu(f,d) - G(Hb) - G(Hm) - Garea
Free-Space
Path Loss
Amu(f,d) Additional
Median Loss
from
Okumuras Curves
Mobile Station
Height Gain
= 10 x Log (Hm/3)
Morphology Gain
0 dense urban
5 urban
10 suburban
17 rural
Base Station
Height Gain
= 20 x Log (Hb/200)
Urban Area
100
80
50
70
d, km
Median Attenuation A(f,d), dB
70
40
30
26
Correction factor, Garea (dB)
35
30
25
20
15
10
5
5
2
850 MHz
1
10
Frequency f, MHz
100
500
100
850
200
300
500 700 1000 2000 3000
Frequency f, (MHz)
3000
The Okumura Model uses a combination of terms from basic physical

mechanisms and arbitrary factors to fit 1960-1970 Tokyo drive test data
Later researchers (HATA, COST231, others) have expressed Okumuras
curves as formulas and automated the computation
November, 2014
RF100 - 66
Examples of Morphological Zones
Suburban
Urban
Dense Urban
Suburban
Urban
Dense Urban
Suburban: Mix of
residential and business
communities. Structures
include 1-2 story houses
50 feet apart and 2-5
story shops and offices.
Urban: Urban residential
and office areas (Typical
structures are 5-10 story
buildings, hotels,
hospitals, etc.)
Dense Urban: Dense
business districts with
skyscrapers (10-20 stories
and above) and high-rise
apartments
Although zone definitions are arbitrary, the examples and definitions illustrated above
are typical of practice in North American PCS designs.
RF100 - 67
November, 2014
Example Morphological Zones

Rural - Highway
Rural - Highway
Rural
Rural
Suburban
Suburban
Rural - Highway:
Highways near open
farm land, large
open spaces, and
sparsely populated
residential areas.
Typical structures
are 1-2 story
houses, barns, etc.
Rural - In-town:
Open farm land,
large open spaces,
and sparsely
populated residential
areas. Typical
structures are 1-2
story houses, barns,
etc.
Notice how different zones may abruptly adjoin one another. In the case immediately
above, farm land (rural) adjoins built-up subdivisions (suburban) -- same terrain, but
different land use, penetration requirements, and anticipated traffic densities.
RF100 - 68
November, 2014
Radio Network Planning Tools Basics
November, 2014
RF100 - 69
Rough Planning with Propagation Prediction Tools

Access Point locations can be
compared using commercial
propagation prediction tools
Tools include terrain databases and
land-use or land-cover data to predict
the signal levels between the AP and
neighborhoods needing service
the AP antenna patterns can also
be included in the model
Actual field test measurements should
be used to tune the model
parameters for best agreement with
the field data
Such models are especially valuable
for analyzing effects of terrain
obstructions
RF100 - 70
November, 2014
Typical Model Results

Including Environmental Correction
COST-231/Hata
f =1900 MHz.
Tower
Height,
m
EIRP
(watts)
C,
dB
Range,
km
Dense Urban
Urban
Suburban
Rural
30
30
30
50
200
200
200
200
0
-5
-10
-17
2.52
3.50
4.8
10.3
f = 870 MHz.
Tower
Height,
m
EIRP
(watts)
C,
dB
Range,
km
Dense Urban
Urban
Suburban
Rural
30
30
30
50
200
200
200
200
-2
-5
-10
-26
4.0
4.9
6.7
26.8
Okumura/Hata
November, 2014
RF100 - 71
Propagation at 1900 MHz. vs. 800 MHz.

Propagation at 1900 MHz. is similar to 800 MHz., but all effects are
more pronounced.
Reflections are more effective
Shadows from obstructions are deeper
Foliage absorption is more attenuative
Penetration into buildings through openings is more effective,
but absorbing materials within buildings and their walls
attenuate the signal more severely than at 800 MHz.
The net result of all these effects is to increase the contrast of hot
and cold signal areas throughout a 1900 MHz. system, compared
to what would have been obtained at 800 MHz.
Overall, coverage radius of a 1900 MHz. BTS is approximately
two-thirds the distance which would be obtained with the same
ERP, same antenna height, at 800 MHz.
RF100 - 72
November, 2014
Walfisch-Betroni/Walfisch-Ikegami Models
Ordinary Okumura-type models do work in
this environment, but the Walfisch models
attempt to improve accuracy by exploiting
the actual propagation mechanisms
involved
Path Loss = LFS + LRT + LMS

LFS = free space path loss (Friis formula)
LRT = rooftop diffraction loss
LMS = multiscreen reflection loss
Area View
Signal
Level
Legend
November, 2014
-20 dBm
-30 dBm
-40 dBm
-50 dBm
-60 dBm
-70 dBm
-80 dBm
-90 dBm
-100 dBm
-110 dBm
-120 dBm
Propagation in built-up portions of cities is

dominated by ray diffraction over the tops of
buildings and by ray channeling through
multiple reflections down the street canyons
RF100 - 73
Elements of Propagation Measurement Systems

Main Features
Field strength measurement
Accurate collection in real-time
Multi-channel, averaging
capability
Location Data Collection Methods:
Global Positioning System (GPS)
Dead reckoning on digitized map
database using on-board
compass and wheel revolutions
sensor
A combination of both methods is
recommended for the best results
Ideally, a system should be calibrated
in absolute units, not just raw
received power level indications
Record normalized antenna gain,
measured line loss
RF100 - 74
Wireless
Receiver
PC or
Collector
GPS
Receiver
Dead
Reckoning
November, 2014
Typical Test Transmitter Operations

Typical Characteristics
portable, low power needs
weatherproof or weather resistant
regulated power output
frequency-agile: synthesized
Operational Concerns
spectrum coordination and proper
authorization to radiate test signal
antenna unobstructed
stable AC power
SAFETY:
people/equipment falling due to
wind, or tripping on obstacles
electric shock
damage to rooftop
RF100 - 75
November, 2014
Statistical Techniques
Distribution Statistics Concept

Signal Strength Predicted Vs. Observed
An area model predicts signal strength

Vs. distance over an area
This is the median or most probable
signal strength at every distance from the
cell
The actual signal strength at any real
location is determined by local physical
effects, and will be higher or lower
It is feasible to measure the observed
median signal strength M and standard
deviation
M and can be applied to find probability
of receiving an arbitrary signal level at a
given distance
Signal Strength predicted

by area model
Observed
Signal Strength
RSSI,
dBm
Distance
Occurrences
Normal
Distribution
RSSI
Median
Signal
Strength
November, 2014
,
dB
RF100 - 76
Statistical Techniques
Practical Application Of Distribution Statistics

General Approach:
Percentage of locations where

observed RSSI exceeds predicted
RSSI
Use a model to predict RSSI

Compare measurements with model
obtain median signal strength M
obtain standard deviation
now apply correction factor to obtain field RSSI,
dBm
strength required for desired probability of
service
10% of locations exceed this

RSSI
50%
90%
Applications: Given
A desired outdoor signal level (dbm)
The observed standard deviation from signal
strength measurements
A desired percentage of locations which must
receive that signal level
Compute a cushion in dB which will give us
that % coverage confidence
Distance
Occurrences
Median
Signal
Strength
Normal
Distribution
RSSI
,
dB
November, 2014
RF100 - 77
Cell Edge
Area Availability And Probability Of Service
Statistical View of
Cell Coverage
Overall probability of service is best close to the

BTS, and decreases with increasing distance
away from BTS
For overall 90% location probability within cell
coverage area, probability will be 75% at cell
75% edge
90%
Area Availability:
90% overall within area
75%at edge of area
November, 2014
Result derived theoretically, confirmed in modeling with

propagation tools, and observed from measurements
True if path loss variations are log-normally distributed
around predicted median values, as in mobile environment
90%/75% is a commonly-used wireless numerical
coverage objective
Recent publications by Nortels Dr. Pete Bernardin
describe the relationship between area and edge reliability,
and the field measurement techniques necessary to
demonstrate an arbitrary degree of coverage reliability
RF100 - 78
Application Of Distribution Statistics: Example

Cumulative Normal Distribution
Lets design a cell to deliver at least -95 dBm

to at least 75% of the locations at the cell edge
(This will provide coverage to 90% of total
locations within the cell)
Assume that measurements you have made
show a 10 dB standard deviation
On the chart:
100%
90%
80%
70%
75%
To serve 75% of locations at the cell edge , we

must deliver a median signal strength which is
.675 times stronger than -95 dBm
Calculate:
- 95 dBm + ( .675 x 10 dB )
= - 88 dBm
So, design for a median signal strength of -88
dBm!
60%
50%
40%
30%
20%
0.675
10%
0%
-3 -2.5 -2 -1.5 -1 -0.5 0
0.5
1.5
2.5
Standard Deviations from

Median (Average) Signal Strength
November, 2014
RF100 - 79
Statistical Techniques:
Normal Distribution Graph & Table For Convenient

Reference
Standard
Deviation
Cumulative
Probability
-3.09
0.1%
-2.32
1%
80%
-1.65
5%
70%
-1.28
10%
60%
-0.84
20%
-0.52
30%
50%
0.52
70%
30%
0.675
75%
20%
0.84
80%
10%
1.28
90%
1.65
95%
2.35
99%
3.09
99.9%
3.72
99.99%
4.27
99.999%
100%
90%
50%
40%
0%
-3
-2.5
-2
-1.5
-1
-0.5
0.5
1.5
2.5
Standard Deviation from Mean Signal Strength
November, 2014
RF100 - 80
Composite Probability Of Service
Adding Multiple Attenuating Mechanisms
Building
Outdoor Loss + Penetration Loss
COMPOSITE = ((OUTDOOR)2+( ENETRATION)2)1/2

P
LOSSCOMPOSITE = LOSSOUTDOOR+LOSSPENETRATION
For an in-building user, the actual signal level includes regular outdoor path attenuation
plus building penetration loss
Both outdoor and penetration losses have their own variabilities with their own standard
deviations
The users overall composite probability of service must include composite median and
standard deviation factors
November, 2014
RF100 - 81
Composite Probability of Service
Calculating Fade Margin For Link Budget

Example Case: Outdoor attenuation is 8 dB., and penetration loss is 8 dB. Desired
probability of service is 75% at the cell edge
What is the composite ? How much fade margin is required?
COMPOSITE = ((OUTDOOR)2+(PENETRATION)2)1/2
On cumulative normal distribution curve, 75%

probability is 0.675 above median.
Fade Margin required =
= ((8)2+(8)2)1/2 =(64+64)1/2 =(128)1/2 = 11.31 dB
(11.31) (0.675) = 7.63 dB.

100%
90%
Composite Probability of Service

Calculating Required Fade Margin
80%
75%
70%
Environment
Type
(morphology)
60%
50%
20%
10%
0%
-3 -2.5 -2 -1.5 -1 -0.5 0
.675
0.5
1.5
Standard Deviations from

Median (Average) Signal Strength
November, 2014
2.5
OutDoor
Composite
Total
Median
Loss,
dB
Std.
Dev.
, dB
Std.
Dev.
, dB
Area
Availability
Target, %
Fade
Margin
dB
Dense Urban Bldg.
20
90%/75% @edge
7.6
Urban Bldg.
15
90%/75% @edge
7.6
Suburban Bldg.
10
90%/75% @edge
7.6
Rural Bldg.
10
90%/75% @edge
7.6
Typical Vehicle
90%/75% @edge
6.0
40%
30%
Building
Penetration
RF100 - 82
RF propagation
Propagation loss in non free space
For outdoor usage models have been created

that include
path loss coefficient up to a measured
breakpoint (
path loss coefficient beyond measured
breakpoint (
breakpoint depend on antenna height (dbr)
L(2.4GHz) = 40 +10 * * log(dbr) + 10 * * log(d/dbr)
November, 2014
RF100 - 83
Link Budget Analysis
Since each bit rate requires a specific receive

sensitivity for a given radio, any wireless network
(simply referred to as link for the purpose of this
discussion) design must estimate the available link
budget in dB to make sure that that the link budget is
at least 0 dB for the highest bit rate desired.
It is also a good practice to leave some reasonable
margin (e.g., 10 dB) in the link budget to
accommodate any variations in signal strength
caused by interferers or reflectors and to increase
the reliability of the link.
The link budget analysis can be used to estimate the range
or capacity or to select an antenna.
November, 2014
RF100 - 84
Link Budget Calculation

The first step in the calculation of the link budget is to
calculate the received power at the receiver.
The Received Power is given as:
Received Power = Radiated Power/EIRP Path Loss + Receiver Gain
The radiated power (EIRP or Effective Isotropic Radiated Power is the
correct technical term) in dBm is given as:
EIRP (dBm) = Radio Transmit Power (dBm) Cable/Connector/Switch

Loss (dB) at Transmitter + Transmit Antenna Gain (dBi)
The Path Loss can be calculated using the appropriate path loss
exponent, as discussed earlier, and may include attenuations caused
by other objects in the path, if known. The Receiver Gain is given as:
Receiver Gain = Receive Antenna Gain (dBi) - Cable/Connector/Switch
Loss (dB) at Receiver
November, 2014
RF100 - 85
Link Budget
One important point to note here is that the antenna gain is reciprocal, i.e.,
the antenna gain can be added to the wireless device at either end to
increase the overall link budget. For example, a wireless system with a 10
dBi antenna on the transmitter and a 2 dBi antenna on the receiver will
have the same range as a system with a 4 dBi antenna the transmitter
and an 8 dBi antenna on the receiver, everything else being equal.
Therefore, adding a high gain antenna allows a device not only to transmit
signals farther, but also to receive weaker signals.
Once the received power (or signal strength) is known, the link budget can
be calculated by subtracting the receive sensitivity of the receiver from the
received power, i.e.,
Link Budget = Received Power Receive Sensitivity

The Noise Floor at the receiver can be subtracted from the received
power to calculate the SNR. If the noise is lower than the Rx sensitivity,
the link will be limited by the Rx sensitivity. Otherwise, the link will be
limited by the Noise Floor.
November, 2014
RF100 - 86
An Example
For example, with 30 dB EIRP (e.g., 23 dBm Transmit Power, 10
dBi antenna gain and 3 dB cable/connector loss) in 2.4 GHz, the
signal attenuates to -50 dBm at 100 meters in free space. For a
receiver with Receive Gain of 0 dB (e.g., 2 dBi Receiver antenna
and 2 dB cable/connector loss), the received power is -50 dBm.
If the receive sensitivity is -91 dBm for 1 Mbps, then the link
margin is 41 dB. However, if the Noise Floor is -85 dBm, then the
SNR is 35 dB. In either case, the signal is more than enough to
decode 1 Mbps. However, as the distance increases the Noise
Floor will be the limiting factor in this specific example.
November, 2014
RF100 - 87
Link Budgets
November, 2014
RF100 - 88
Link Budget Example:

Usage Model and Service Assumptions
Interactive Initial System Design Example
This section
outlines the number
of subscribers and
amount of traffic by
year
This section shows
the variability of
outdoor and indoor
signals, and the
building penetration
loss
November, 2014
v1.2
fill in GREEN fields

YELLOW fields calculate automatically
Step 1. Basic Business Plan Details
Year
Population
Penetration, %
#Customers
BH Erl/Cust
Total BH erl
Launch
3,886,000
3,949,350
4,012,700
4,076,050
4,139,400
4,202,750
0.05%
1,781
0.1
178.1
1.85%
72,933
0.05
3,646.7
3.72%
149,453
0.045
6,725.4
5.64%
229,941
0.05
11,497.0
7.60%
314,451
0.05
15,722.6
9.57%
402,360
0.05
20,118.0
2. Enter building penetration loss and standard deviations from measurements.
Composite Probability Of Service & Required Fade Margin

Outdoor Composite
Building
Building
Environment
Std. Dev, Std. Dev, Standard Desired Reliability at
Median
Type
dB.
dB
("morphology") Loss, dB
Cell Edge, %
Deviation
Dense Urban
20
8
8
75.0%
11.31
Urban
15
8
8
75.0%
11.31
Suburban
15
8
8
75.0%
11.31
Rural
10
8
8
75.0%
11.31
Highway
8
6
8
75.0%
10.00
Fade
Margin,
dB.
7.63
7.63
7.63
7.63
6.74
RF100 - 89
Reverse Link Budget Example

3. Construct Link Budgets
Reverse Link Budget

Term or Factor
MS TX Power (dbm) (+)
MS antenna gain and body loss (+/-)
MS EIRP (dBm) (+)
Fade Margin, (dB) (-)
Soft Handoff Gain (dB) (+)
Receiver Interf. Margin (dB) (-)
Building Penetration Loss (dB) (-)
BTS RX antenna gain (dBi) (+)
BTS cable loss (dB) (-)
kTB (dBm/14.4 KHz.)
BTS noise figure (dB)
Eb/Nt (dB)
BTS RX sensitivity (dBm) (-)
Survivable Uplink Path Loss (dB) (+)
Dense
Urb.
Given
Urban
Suburban
Rural
Highway
Formula
23
0
23.00
-7.63
4
-3
-20.00
17
-3
23.00
-7.63
4
-3
-15.00
17
-3
23.00
-7.63
4
-3
-15.00
17
-3
23.00
-7.63
4
-3
-10.00
17
-3
23.00
-6.74
4
-3
-8.00
17
-3
-120.0
-120.0
-120.0
-120.0
-120.0
-132.4
6.5
5.9
130.4
135.4
135.4
140.4
A
B
C
D
E
F
G
H
I
J
H+I+J
A+B+C+D+E
+F+G(H+I+J)
143.3
The Reverse Link Budget describes how the energy from the
phone is distributed to the base station, including the major
components of loss and gain within the system
November, 2014
RF100 - 90
Forward Link Budget Example

Forward Link Budget
Term or Factor
BTS TX power (dBm) (+)
BTS TX power (watts)
% Power for traffic channels
Number of Traffic Channels in use
BTS cable loss (dB) (-)
BTS TX antenna gain (dBi) (+)
BTS EIRP/traffic channel (dBm) (+,-)
Fade margin (dB) (-)
Receiver interference margin (db) (-)
Building Penetration Loss (dB) (-)
MS antenna gain & body loss (dB) (+,-)
kTB (dBm/14.4 KHz.)
Subscriber RX noise figure (dB)
Eb/Nt (dB)
Subscriber RX sensitivity (dBm) (-)
Given
Which link is dominant?

What advantage, dB?
Urban
45
31.62
74.0%
19
-3
17
44.9
-7.63
-3
-15.0
0
Suburban
45
31.62
74.0%
19
-3
17
44.9
-7.63
-3
-15.0
0
Rural
-115.9
-115.9
-115.9
-115.9
-115.9
130.2
135.2
135.2
140.2
143.1
Urban
Reverse
0.2
Suburban
Reverse
0.2
Rural
Reverse
0.2
Highway
Reverse
0.2
45
31.62
74.0%
19
-3
17
44.9
-7.63
-3
-10.0
0
Highway
Formula
45
31.62
74.0%
19
-3
17
A
44.9
B
-6.74
-3
C
D
-8.0
0
E
-132.4
10.5
6
Survivable Downlink Path Loss, dB (+)

Forward/Reverse Link Balance
Dense
Urb.
45
31.62
74.0%
19
-3
17
44.9
-7.63
-3
-20.0
0
Dense
Urban
Reverse
0.2
F
A+B+C+D
+E-F
This section shows the forward link power distribution, and

compares the relative balance of the forward and reverse links
November, 2014
RF100 - 91
Link Budgets: What is the Radius of a Cell?

4. Explore propagation model to figure coverage radius of cell.
Frequency, MHz.
Subscriber Antenna Height, M
Base Station Antenna Height, M
Environmental Correction, dB
Coverage Radius, kM
Coverage Radius, Miles
870
1.5
Dense
Urban
20
Urban
Suburban
20
30
Rural
Dense
Urban
Urban
Rural
Highway
-17
-17
-2
1.30
0.81
-5
Suburban
-10
2.17
1.35
6.87
4.27
50
20.86
12.96
Highway
50
25.40
15.78
This section uses the Okumura-Hata/Cost-231 model to describe

the frequency, antenna heights, and environmental factors, and
their relationship on the cells coverage distance
November, 2014
RF100 - 92
Link Budgets: Putting It All Together

Step 4
estimates
the number
of cells
required to
serve each
distinct
environment
within the
system
Steps 5, 6,
and 7
estimate the
RF coverage
from each
cell, and the
number of
cells
required
November, 2014
5. Calculate number of cells required for coverage, ignoring traffic considerations.
Covered Area of this type, kM^2

One cell's coverage in this zone, kM^2
# Cells required to cover zone
Dense
Urban
55
5.35
10.3
Urban
Suburban
450
1700
14.73
148.46
30.6
11.5
Total
Rural
Highway
# Cells
3400
1400 Required
1367.34
2026.72 for System
2.5
0.7
55.5
6. What is the traffic capacity (in erlangs) of your chosen BTS configuration, year-by-year?
Year
Erlangs which one BTS can carry
Launch
18.3
2
18.3
3
90
4
90
5
450
450
7, 8. What is the total busy-hour erlang traffic on your system? How many BTS are required?
Year
Total System Busy-Hour Erlangs
Capacity of One BTS, erlangs
# BTS required to handle all the traffic
Launch
178.1
18.3
9.7
1
3,646.7
18.3
199.3
2
6,725.4
90
74.7
3
11,497.0
90
127.7
4
15,722.6
450
34.9
5
20,118.0
450
44.7
9. Examine your market, #BTS required for coverage and capacity; estimate total
number of BTS required.
Year
#BTS req'd just to achieve coverage
#BTS required just to carry traffic
Launch
55.5
9.7
Estimated total #BTS required
56.3
55.5
199.3
55.5
74.7
55.5
127.7
55.5
34.9
55.5
44.7
206.8
206.8
206.8
206.8
206.8
RF100 - 93
Radio Link - Simplified Model
Gt
Gr
Attenuator
Lt
Lp
Pt
Tx
November, 2014
Lr
P
r
free space
path obstruction
atmospheric gases
multipath
beam spreading
variation of angle of arrival and launch
Precipitation (rainfall)
sand and dust storms
Rx
RF100 - 94
Link Budget Calculations
Lr = 1.5
dB
Lt = 1.5 dB
f = 18 GHz
Tx
Rx
d = 12 km
Pt = 23
dBm
Gt = 38 dBi
Gr = 38 dBi
Pr = Pt - Lt + Gt - Lp + Gr - Lr
Pr = ?
dBm
dBm
Lp = 92.45 + 20 log(18) + 20 log(12) = 119.11 dBm

Pr = 23 - 1.5 + 38 119.11 + 38 - 1.5 = -23dBm
November, 2014
RF100 - 95
Path Loss Calculations

The simplest propagation mode
Antenna radiates energy which spreads in space
Lp or Path Loss, db (between two isotropic antennas) = 36.56
+20*Log10(F MHZ)+20Log10(Dist MILES )
Lp or Path Loss, db (between two dipole antennas) = 32.26
+20*Log10(F MHZ)+20Log10(Dist MILES )
Lp = Path Loss, db (between two isotropic antennas) = 92.45
(30+62.45) + 20 log(FGHz) + 20 log( Distance km)
November, 2014
RF100 - 96
Passive Repeater Configuration
Lt = 1.5 dB
Gt = 42 dBi
d = 0.8 km
Tx
Pt = 23 dBm
Gt = 38 dBi
1 dB
f = 18 GHz
Lr = 1.5 dB
d = 12 km
Rx
Pr = ? dBm
November, 2014
Gt = 42 dBi
Gr = 38 dBi
RF100 - 97
RF propagation
Simple Path Analysis Concept (alternative)
+ Antenna Gain
+ Antenna Gain
- Path Loss over link

Antenna
RF Cable
distance
- LOSS
Cable/connectors
Antenna
- LOSS
Cable/connectors
Lightning Protector
Lightning Protector
pigtail cable
pigtail cable
PC Card
WP II
RF Cable
+ Transmit Power
RSL (receive signal level) or P r> sensitivity + Fade Margin
PC Card
WP II
Calculate signal in one direction if Antennas and active components are equal
November, 2014
RF100 - 98
RF propagation
FADE MARGIN
50 ft.LMR 400
24 dBi
3.4 dB
50 ft.LMR 400
24 dBi parabolic
3.4 dB
For a Reliable link - the signal arriving at the

receiver - should be greater than the Sensitivity
of the Radio (-82dBm for 11 Mbit)
.7 dB
This EXTRA signal strength is FADE MARGIN
.7 dB
FADE MARGIN can be equated to UPTIME

1.3 dB
Tx =15 dBm
Minimum Fade Margin = 10 dB

Links subject to interference (city) = 15dB
1.3 dB
Rx = -82 dBm
Links with Adverse Weather = 20dB

WP II
November, 2014
Calculate RSL > -82 + 10 = -72dBm
WP II
RF100 - 99
RF propagation
Sample Calculation
16 Km = - 124 dB
50 ft.LMR 400
24 dBi
3.4 dB
50 ft.LMR 400
24 dBi parabolic
3.4 dB
RSL > PTx - Cable Loss + Antenna Gain - Path loss + Antenna Gain - Cable Loss
+ 15 dBm
.7 dB
- 2 dB
- 3.4 dB
1.3 dB
+ 24 dBi
- 124 dB
Tx =15 dBm
+ 24 dBi
- 3.4 dB
- 2 dB
WP II
November, 2014
This lets us know that if the

Fresnel zone is clear, the
Link should work. If RSL <
than -72 then MORE GAIN is
needed, using Higher Gain
Antennas or Lower loss
Cables or Amplifiers (not a
Agere Systems provided
option)
- 71.8 dB > -72
.7 dB
1.3 dB
Rx = -82 dBm
WP II
RF100 - 100
RF Propagation
Antenna Height requirements

Fresnel Zone Clearance = 0.6 first Fresnel
distance (Clear Path for Signal at mid point)
30 feet for 10 Km path
Clearance for Earths

Curvature
Midpoint clearance = 0.6F + Earth curvature + 10' when K=1

First Fresnel Distance (meters) F1= 17.3 [(d1*d2)/(f*D)]1/2 where D=path length
Km, f=frequency (GHz) , d1= distance from Antenna1(Km) , d2 = distance from
Antenna 2 (Km)
Earth Curvature h = (d1*d2) /2 where h = change in vertical distance from
Horizontal line (meters), d1&d2 distance from antennas 1&2 respectively
Fresnel Zone
Clearance
Antenna
Height
Obstacle
Clearance
Antenna
Height
Earth Curvature
November, 2014
RF100 - 101
RF Propagation
Reflections
Signals arrive 180 out of phase ( 1/2 ) from reflective surface

Cancel at antenna - Try moving Antenna to change geometry of link - 6cm is the
difference in-phase to out of phase
November, 2014
RF100 - 102
Elements of Typical Measurement Systems

Main Features
Field strength measurement
Accurate collection in real-time
Multi-channel, averaging
capability
Location Data Collection Methods:
Global Positioning System (GPS)
Dead reckoning on digitized map
database using on-board
compass and wheel revolutions
sensor
A combination of both methods is
recommended for the best results
Ideally, a system should be calibrated
in absolute units, not just raw
received power level indications
Record normalized antenna gain,
measured line loss
November, 2014
Wireless
Receiver
PC or
Collector
GPS
Receiver
Dead
Reckoning
RF100 - 103
Typical Test Transmitter Operations

Typical Characteristics
portable, low power needs
weatherproof or weather resistant
regulated power output
frequency-agile: synthesized
Operational Concerns
spectrum coordination and proper
authorization to radiate test signal
antenna unobstructed
stable AC power
SAFETY:
people/equipment falling due to
wind, or tripping on obstacles
electric shock
damage to rooftop
November, 2014
RF100 - 104
Antennas for
Wireless Systems
Dipole
Isotropic
Typical Wireless
Omni Antenna
November, 2014
RF100 - 105
Understanding Antenna Radiation

The Principle Of Current Moments
An antenna is just a passive

conductor carrying RF current
Zero current
at each end
each tiny
imaginary slice
of the antenna
does its share
of radiating
TX
RX
Maximum current
at the middle
Current induced in
receiving antenna
is vector sum of
contribution of every
tiny slice of
radiating antenna
Width of band
denotes current
magnitude
November, 2014
RF power causes the current

flow
Current flowing radiates
electromagnetic fields
Electromagnetic fields cause
current in receiving antennas
The effect of the total antenna is the
sum of what every tiny slice of the
antenna is doing
Radiation of a tiny slice is

proportional to its length times
the magnitude of the current in
it, at the phase of the current
RF100 - 106
Polarization of an Antenna and its Effects

Antenna 1
Vertically
Polarized
Antenna 2
Horizontally
Polarized
Electromagnetic
Field
TX
current
RX
almost
no
current
RF current in a conductor
causes electromagnetic fields
that seek to induce current
flowing in the same direction
in other conductors.
The orientation of the antenna is
called its polarization.
To intercept significant energy, a receiving antenna must be

oriented parallel to the transmitting antenna
A receiving antenna oriented at right angles to the transmitting antenna
is cross-polarized; will have very little current induced
Vertical polarization is the default convention in wireless telephony
In the cluttered urban environment, energy becomes scattered and depolarized during propagation, so polarization is not as critical
Handset users hold the antennas at seemingly random angles..
November, 2014
RF100 - 107
Antenna Gain
Antennas are passive devices: they do not produce
power
Can only receive power in one form and pass

it on in another, minus incidental losses
Cannot generate power or amplify
Omni-directional
Antenna
However, an antenna can appear to have gain

compared against another antenna or condition. This
gain can be expressed in dB or as a power ratio. It
applies both to radiating and receiving
A directional antenna, in its direction of maximum
radiation, appears to have gain compared against a
non-directional antenna
Gain in one direction comes at the expense of less
radiation in other directions
Antenna Gain is RELATIVE, not ABSOLUTE
When describing antenna gain, the

comparison condition must be stated or
implied
November, 2014
Directional
Antenna
RF100 - 108
Reference Antennas
Defining Gain And Effective Radiated Power

Isotropic Radiator
Truly non-directional -- in 3 dimensions

Difficult to build or approximate physically, Isotropic
Antenna
but mathematically very simple to describe
A popular reference: 1000 MHz and above
PCS, microwave, etc.
Dipole Antenna
Non-directional in 2-dimensional plane only

Can be easily constructed, physically
practical
A popular reference: below 1000 MHz
800 MHz. cellular, land mobile, TV & FM
Quantity
Gain above Isotropic radiator
Gain above Dipole reference
Effective Radiated Power Vs. Isotropic
Effective Radiated Power Vs. Dipole
November, 2014
Units
dBi
dBd
(watts or dBm) EIRP
(watts or dBm) ERP
Dipole Antenna
Notice that a dipole
has 2.15 dB gain
compared to an
isotropic antenna.
RF100 - 109
Radiation Patterns
Key Features And Terminology

An antennas directivity is
expressed as a series of patterns
The Horizontal Plane Pattern graphs
the radiation as a function of azimuth
(i.e..,direction N-E-S-W)
The Vertical Plane Pattern graphs the
radiation as a function of elevation (i.e..,
up, down, horizontal)
Antennas are often compared by noting
specific landmark points on their
patterns:
-3 dB (HPBW), -6 dB, -10 dB

points
Front-to-back ratio
Angles of nulls, minor lobes, etc.
Typical Example
Horizontal Plane Pattern

Notice -3 dB points
0 (N)
0
-10
-20
-30 dB
270
(W)
10 dB
points
Main
Lobe
nulls or
a Minor
minima
Lobe
Front-to-back Ratio
180 (S)
November, 2014
RF100 - 110
90
(E)
How Antennas Achieve Their Gain

Quasi-Optical Techniques (reflection, focusing)
Reflectors can be used to concentrate

radiation
technique works best at microwave frequencies,
where reflectors are small
Examples:
corner reflector used at cellular or higher
frequencies
parabolic reflector used at microwave
frequencies
grid or single pipe reflector for cellular
Array techniques (discrete elements)
Power is fed or coupled to multiple

antenna elements; each element radiates
Elements radiation in phase in some
directions
In other directions, a phase delay for each
element creates pattern lobes and nulls
November, 2014
In phase
Out of
phase
RF100 - 111
Types Of Arrays
Collinear vertical arrays
Essentially omnidirectional in
horizontal plane
Power gain approximately
equal to the number of
elements
Nulls exist in vertical pattern,
unless deliberately filled
Arrays in horizontal plane
Directional in horizontal
plane: useful for sectorization
Yagi
RF
power
one driven element, parasitic

coupling to others
Log-periodic
all elements driven
wide bandwidth
RF
power
All of these types of antennas are

used in wireless
November, 2014
RF100 - 112
Omni Antennas
Collinear Vertical Arrays

The family of omni-directional wireless
antennas:
Number of elements determines
Typical Collinear Arrays

Number of
Elements
1
2
3
4
5
6
7
8
9
10
11
12
13
14
Physical size
Gain
Beamwidth, first null angle
Models with many elements have
very narrow beamwidths
Require stable mounting and

careful alignment
Watch out: be sure nulls do
not fall in important coverage
areas
Rod and grid reflectors are
sometimes added for mild directivity
Examples: 800 MHz.: dB803, PD10017, BCR10O, Kathrein 740-198
1900 MHz.: dB-910, ASPP2933
November, 2014
Power
Gain
1
2
3
4
5
6
7
8
9
10
11
12
13
14
Gain,
dB
0.00
3.01
4.77
6.02
6.99
7.78
8.45
9.03
9.54
10.00
10.41
10.79
11.14
11.46
Angle
n/a
26.57
18.43
14.04
11.31
9.46
8.13
7.13
6.34
5.71
5.19
4.76
4.40
4.09
Vertical Plane Pattern

beamwidth
-3
d
B
Angle
of
first
null
RF100 - 113
Sector Antennas
Reflectors And Vertical Arrays

Typical commercial sector
antennas are vertical combinations
of dipoles, yagis, or log-periodic
elements with reflector (panel or
grid) backing
Vertical plane pattern is

determined by number of
vertically-separated
elements
varies from 1 to 8, affecting
mainly gain and vertical plane
beamwidth
Horizontal plane pattern is

determined by:
number of horizontally-spaced
elements
shape of reflectors (is reflector
folded?)
November, 2014

Up
Down
Horizontal Plane Pattern
N
RF100 - 114
Cassegrain antenna
Less prone to back scatter than simple parabolic antenna

Greater beam steering possibility: secondary mirror motion
amplified by optical system
Much more compact for a given f/D ratio
November, 2014
RF100 - 115
Horn antenna
Rectangular or circular waveguide flared up
Spherical wave fronts from phase centre
Flare angle and aperture determine gain
November, 2014
RF100 - 116
Example of Commercial Antennas
November, 2014
RF100 - 117
Model
Gain
Length
HG2401RD-MC
1 dBi
2.2 in.
2.4 GHz 1 dBi MC-Card Right Angle Plug Mini WLAN Rubber Duck Antenna
HG2401RD-MMCX
1 dBi
2.1 in.
2.4 GHz 1 dBi MMCX Right Angle Plug Mini WLAN Rubber Duck Antenna
HG2402RD-RSF
2.2 dBi
4.7 in.
2.4 GHz 2.2 dBi RP-SMA WLAN Rubber Duck Antenna with Tilt-&-Swivel
Connector
HG2403RD-RSF
3 dBi
5.4 in.
2.4 GHz 3 dBi RP-SMA WLAN Rubber Duck Antenna with Tilt-&-Swivel
Connector
HG2403RD-RTF
3 dBi
5.6 in.
2.4 GHz 3 dBi RP-TNC WLAN Rubber Duck Antenna with Tilt-&-Swivel
Connector
HG2403RD-NM
3 dBi
5.8 in.
2.4 GHz 3 dBi N-Type Male WLAN Rubber Duck Antenna with Tilt-&-Swivel
Connector
HG2405RD-RSP
5.5 dBi
8.2 in.
2.4 GHz 5.5 dBi RP-SMA WLAN Rubber Duck Antenna with Tilt-&-Swivel
Connector
HG2405RD-RTP
5.5 dBi
8.4 in.
2.4 GHz 5.5 dBi RP-TNC WLAN Rubber Duck Antenna with Tilt-&-Swivel
Connector
HG2405RD-NM
5.5 dBi
8.7 in.
2.4 GHz 5.5 dBi N-Type Male WLAN Rubber Duck Antenna with Tilt-&-Swivel
Connector
HG2407RD-RSP
7 dBi
13 in.
2.4 GHz 7 dBi RP-SMA High Performance WLAN Rubber Duck Antenna with Tilt&-Swivel Connector
HG2407RD-RTP
7 dBi
13.2 in.
2.4 GHz 7 dBi RP-TNC High Performance WLAN Rubber Duck Antenna with Tilt&-Swivel Connector
HG2407RD-SM
7 dBi
10.6 in.
2.4 GHz 7 dBi SMA-Male High Performance WLAN Rubber Duck Antenna with
Tilt-&-Swivel Connector
HG2407RD-NM
7 dBi
11 in.
2.4 GHz 7 dBi N-Male High Performance WLAN Rubber Duck Antenna with Tilt&-Swivel Connector
HG2409RD-RSP
9 dBi
15.19 in.
2.4 GHz 9 dBi RP-SMA High Performance WLAN Rubber Duck Antenna with Tilt&-Swivel Connector
HG2409RD-RTP
9 dBi
15.2 in.
2.4 GHz 9 dBi RP-TNC High Performance WLAN Rubber Duck Antenna with Tilt&-Swivel Connector
HG2409RD-NM
9 dBi
15 in.
2.4 GHz 9 dBi N-Male High Performance WLAN Rubber Duck Antenna with Tilt&-Swivel Connector
November, 2014
Description
RF100 - 118
Example of radiation patterns
Vertical (E)- Elevation
November, 2014
Horizontal (H) Azimuth
RF100 - 119
Example Of Antenna Catalog Specifications

Electrical Data
ASPP2933
1850-1990
3/5.1
<1.5:1
32
Vertical
400
50
Direct Ground
N-Female
Order Sep.
ASPP2936
1850-1990
6/8.1
<1.5:1
15
Vertical
400
50
Direct Ground
N-Female
Order Sep.
dB910C-M
1850-1970
10/12.1
<1.5:1
5
Vertical
400
50
Direct Ground
N-Female
Order Sep.
Mechanical Data
Antenna Model
ASPP2933
Overall length - in (mm)
24 (610)
Radome OD - in (mm)
1.1 (25.4)
Wind area - ft2 (m2)
.17 (.0155)
Wind load @ 125 mph/201 kph lb-f (n)
4 (17)
Maximum wind speed - mph (kph)
140 (225)
ASPP2936
36 (915)
1.0 (25.4)
.25 (.0233)
6 (26)
140 (225)
dB910C-M
77 (1955)
1.5 (38)
.54 (.05)
14 (61)
125 (201)
6 (2.7)
13 (5.9)
ASPA320
5.2 (2.4)
9 (4.1)
Integral
Antenna Model
Frequency Range, MHz.
Gain - dBd/dBi
VSWR
Beamwidth (3 dB from maximum)
Polarization
Maximum power input - Watts
Input Impedance - Ohms
Lightning Protection
Termination - Standard
Jumper Cable
Weight - lbs (kg)

Shipping Weight - lbs (kg)
Clamps (steel)
November, 2014
4 (1.8)
11 (4.9)
ASPA320
RF100 - 120
Example Of Antenna Catalog Radiation Pattern
E-Plane (elevation plane)

Gain: 10 dBd
Dipole pattern is superimposed at
scale for comparison (not often
shown in commercial catalogs)
Frequency is shown
Pattern values shown in dBd
Note 1-degree indices through
region of main lobe for most
accurate reading
Notice minor lobe and null detail!
November, 2014
RF100 - 121
Other Parts of
Antenna Systems
November, 2014
RF100 - 122
Antenna Systems
Antenna
Transmission Line
Jumper
Directional
Coupler
F R
Jumpers
November, 2014
D
u
p
l
e
x
e
r
Combiner
BPF
TX
TX
RX
Antenna systems include more

than just antennas
Transmission Lines
Necessary to connect
transmitting and receiving
equipment
Other Components necessary to
achieve desired system function
Filters, Combiners,
Duplexers - to achieve
desired connections
Directional Couplers,
wattmeters - for
measurement of
performance
Manufacturers system may
include some or all of these
items
Remaining items are added
individually as needed by
system operator
RF100 - 123
Types of Transmission Lines

Physical Characteristics
Type of line
Typical coaxial cables
Used as feeders in wireless applications
Coaxial, stripline, openwire

Balanced, unbalanced
Physical configuration
Dielectric:
air
foam
Outside surface
unjacketed
jacketed
Size (nominal outer diameter)
1/4,1/2, 7/8, 1-1/4, 17/8, 2-1/4, 3
November, 2014
Foam
Dielectric
Air
Dielectric
RF100 - 124
Attenuation, Impedance, Velocity, Power Handling

Electrical Characteristics
Attenuation
Varies with frequency, size, dielectric
D
d
characteristics of insulation
Usually specified in dB/100 ft and/or
dB/100 m
Characteristic impedance Z0 (50 ohms is the
Impedance
usual standard; 75 ohms is sometimes used) Characteristic
of a Coaxial Line
Value set by inner/outer diameter ratio
Zo = ( 138 / ( 1/2 ) ) Log10 ( D / d )
and dielectric characteristics of
= Dielectric Constant
insulation
= 1 for vacuum or dry air
Connectors must preserve constant
impedance (see figure at right)
Velocity factor
Determined by dielectric characteristics
of insulation.
Power-handling capability
Varies with size, conductor materials,
dielectric characteristics
November, 2014
RF100 - 125
Transmission Lines
Important Installation Practices

Respect specified minimum
bending radius!
Inner conductor must

remain concentric,
otherwise Zo changes
Dents, kinks in outer
conductor change Zo
Dont bend large, stiff lines (15/8 or larger) to make direct
connection with antennas
Use appropriate jumpers,
weatherproofed properly.
Secure jumpers against wind
vibration.
November, 2014
Observe
Minimum
Bending
Radius!
RF100 - 126
Transmission Lines
Important Installation Practices, Continued

During hoisting
Allow line to support its own
weight only for distances
approved by manufacturer
Deformation and stretching
may result, changing the Zo
Use hoisting grips,
messenger cable
After mounting
Support the line with proper
mounting clamps at
manufacturers
recommended spacing
intervals
Strong winds will set up
damaging metal-fatigueinducing vibrations
November, 2014
200 ft 3-6 ft
~60 m
Max.
RF100 - 127
Coaxial cable attenuation ratings

(in dB/100 feet at X MHz)
November, 2014
RF100 - 128
Connectors
The choice of connectors is driven mainly by other factors already
chosen in your design:
Size of transmission line or connectors already on equipment
Manufacturer and type of cable being used
Gender of existing equipment or antenna connectors for mating
Special requirements for power handling, passive intermodulation,
or other special electrical characteristics
Weather-proofing capabilities
Ease of installation and attachment, wear characteristics
There are literally hundreds of types of connectors available. A good
visual guide to help you identify connectors are the charts available
at http://www.pasternack.com/t-connector-specific-charts.aspx
November, 2014
RF100 - 129
Examples of Common Connector Types
November, 2014
N-male
RP-SMA- male
N-female
RP-SMA-female
RF100 - 130
RF Filters
Types And Applications

Filters are the basic building
blocks of duplexers and more
complex devices
Most manufacturers network
equipment includes internal
bandpass filters at receiver input
and transmitter output
Filters are also available for
special applications
Number of poles (filter elements)
and other design variables
determine filters electrical
characteristics
Bandwidth rejection
Insertion loss
Slopes
Ripple, etc.
November, 2014
Typical RF Bandpass Filter

/4
Notice construction: RF input

excites one quarter-wave
element and electromagnet
fields propagate from element
to element, finally exciting the
last element which is directly
coupled to the output.
Each element is individually set
and forms a pole in the filters
overall response curve.
RF100 - 131
RF Filters
Basic Characteristics And Specifications

Typical RF bandpass filter
Single-pole:
pass
reject (notch)
Multi-pole:
band-pass
band-reject
Key electrical characteristics
Insertion loss
Passband ripple
Passband width
upper, lower cutoff frequencies
Attenuation slope at band edge

Ultimate out-of-band attenuation
November, 2014
Attenuation, dB
insertion
loss
0
Types of Filters
-3 dB
passband ripple
passband
width
Frequency, megaHertz
Typical bandpass filters have

insertion loss of 1-3 dB. and
passband ripple of 2-6 dB.
Bandwidth is typically 1-20% of
center frequency, depending on
application. Attenuation slope
and out-of-band attenuation
depend on # of poles & design
RF100 - 132
Basics Of Transmitting Combiners

Allows multiple transmitters to feed single
antenna, providing
Minimum power loss from

transmitter to antenna
Maximum isolation between
transmitters
Combiner types
Tuned
low insertion loss ~1-3 dB
transmitter frequencies must be
significantly separated
Typical tuned combiner

application
Antenna
TX TX TX TX TX TX TX TX
Typical hybrid combiner

application
Antenna
Hybrid
insertion loss -3 dB per stage
no restriction on transmitter
frequencies
Linear amplifier
linearity and intermodulation are
major design and operation issues
November, 2014
~-3 dB
~-3 dB
~-3 dB
TX TX TX TX TX TX TX TX
RF100 - 133
Duplexer Basics
Duplexer allows simultaneous
transmitting and receiving on one
antenna
Nortel 1900 MHz BTS RFFEs
include internal duplexer
Nortel 800 MHz BTS does not
include duplexer but commercial
units can be used if desired
Important duplexer specifications
TX pass-through insertion loss
RX pass-through insertion loss
TX-to-RX isolation at TX
frequency (RX intermodulation
issue)
TX-to-RX isolation at RX
frequency (TX noise floor issue)
Internally-generated IMP limit
specification
November, 2014
Antenna
Duplexer
fR
fT
RX
TX
Principle of operation
Duplexer is composed of individual
bandpass filters to isolate TX from
RX while allowing access to antenna
for both. Filter design determines
actual isolation between TX and RX,
and insertion loss TX-to-Antenna
and RX-to-Antenna.
RF100 - 134
Directional Couplers
Couplers are used to measure
forward and reflected energy in a
transmission line; it has 4 ports:
Input (from TX),
Output (to load)
Forward and Reverse Samples
Sensing loops probe E& I in line
Equal sensitivity to E & H fields
Terminations absorb induced
current in one direction,
leaving only sample of other
direction
Typical performance specifications
Coupling factor ~20, ~30,
~40 dB., order as appropriate
for application
Directivity ~30-~40 dB., f($)
defined as relative
attenuation of unwanted
direction in each sample
November, 2014
Typical directional coupler
Principle of operation
RT
Reverse Sample
Input
Forward Sample
RT
ZLOAD=
50
Main lines E & I induce equal signals in

sense loops. E is direction-independent,
but Is polarity depends on direction and
cancels sample induced in one direction.
Thus sense loop signals are directional.
One end is used, the other terminated.
RF100 - 135
Testing Antenna Systems
November, 2014
RF100 - 136
Testing Communications Feedlines and Antennas

AC power wiring and voice telephone wiring do not
require extremely critical wiring practices
just make sure the connections and insulation are
good, heat is not allowed to build up, and youll have
good results
AC power frequencies and audio signal frequencies
have wavelengths of many miles
a few feet of wire wont radiate much energy
High frequency RF wiring practice is much more critical
since signal wavelengths are only a few inches or feet
any bend or protruding bit of wire can serve as an
unintentional antenna, leaking energy
even splices and connections can leak energy unless
their shape and dimensions are closely controlled
abrupt changes in cable shape reflect energy back
down the transmission line, causing many problems
Precisely shaped cables and connectors, careful
installation and accurate testing are required to avoid
significant antenna system performance problems
November, 2014
RF100 - 137
Forward and Reflected Energy

Antenna
50
Transmitter
50
Transmission Line
50
Forward Power
Virtually no reflected power
In a perfect antenna system, the transmission line and the

antenna have the same impedance
we say they are impedance matched
All the energy from the transmitter passes through and is radiated
from the antenna
virtually no energy is reflected back to the transmitter
November, 2014
RF100 - 138
Forward and Reflected Energy

Antenna
42-j17
Transmitter
dent or kink
50 Transmission Line 37
Forward Power
Significant Reflected Power
In a damaged antenna system, the impedance match is not good

there could be a dent, kink, or a spot with water in the transmission
line
the different impedance in the line at this spot will cause some of
the energy to be reflected backwards
the antenna could be damaged or dangling, causing it to have an
altered impedance
the antennas different impedance will reflect some of the energy
backwards down the line
The Site Master Distance-To-Fault mode will be helpful in finding the
location of the damage
November, 2014
RF100 - 139
How Much Reflection? Four Ways to Say It

There are four ways of expressing how
much energy is being reflected
different users like different methods
Voltage Standing Wave Ratio (VSWR)
(used by hobbyists and consumers)
the reflected voltage is in phase with the
incident voltage at some places and out
of phase at others
VSWR is the ratio of Vmax/Vmin
Reflected Power as % of Forward Power
(used by field personnel in some industries)
just divide Rev by Fwd, use percent
Return Loss (used by field personnel)
how many db weaker is the reflected
energy than the forward energy
Reflection Coefficient (academic users)
vector ratio of reflected/incident voltage
or current
usually expressed as a polar vector, with
magnitude and phase
November, 2014
SWR: Standing Wave Ratio

= Vmax/ Vmin
Vmin
Vmax
Reflected Power (%)

FORWARD
= 100 x
RevPwr
FwdPwr
REFLECTED
Return Loss (db)

FORWARD
= 10 x Log10
RevPwr
FwdPwr
REFLECTED
Reflection Coefficient (vector ratio)

FORWARD
REFLECTED
Vreflected
Vincident
RF100 - 140
Comparing Reflection Reports in Different Forms

Reflection expressed in one form can be
converted and expressed in the other forms
For example, consider a VSWR of 1.5 : 1
this is 4% reflected power
this is a return loss of 14 db
to calculate the reflection coefficient, the
phase of the reflection is also needed
SWR: STANDING WAVE RATIO

=
Vmin
Reflected Power
Forward Power
1-
Reflected Power
Forward Power
Reflected Power (%)

FORWARD
VSWR vs. Return Loss
1+
=
Vmax
Vmax/ Vmin
= 100 x
RevPwr
FwdPwr
REFLECTED
50
40
Return Loss (db)

FORWARD
30
= 10 x Log10
RevPwr
FwdPwr
REFLECTED
20
Reflection Coefficient (vector ratio)
10
FORWARD
0
1
1.5
VSWR
November, 2014
2.5
REFLECTED
Vreflected
Vincident
RF100 - 141
The Anritsu/Wiltron Site Master
The Site Master is a combination

instrument not much larger than a cigar box.
In the field, it provides the functions of a
spectrum analyzer with tracking sweep
generator, directional coupler, and power
meter. In the past, a trunk full of instruments
were required to test communications
antenna systems. Today, a Site Master can
even be carried to the tower top if needed.
November, 2014
The Site Master is one of the

most convenient and popular
combination instruments for
testing communications
feedlines and antennas
Built Into a Site Master are:
sweep signal generator
directional coupler
signal detector
processing software to
display return loss and
distance to fault
Optional: Spectrum
Analyzer
Optional: Power Meter
Battery and charging circuit
RF100 - 142
Estimating Isolation Between Antennas

Often multiple antennas are needed at a
site and interaction is troublesome
Electrical isolation between antennas
Coupling loss between isotropic

antennas one wavelength apart is
22 dB
6 dB additional coupling loss with
each doubling of separation
Add gain or loss referenced from
horizontal plane patterns
Measure vertical separation
between centers of the antennas
vertical separation usually is very
effective
One antenna should not be mounted in

main lobe and near-field of another
Typically within 10 feet @ 800 MHz

Typically 5-10 feet @ 1900 MHz
November, 2014
RF100 - 143
Types Of Downtilt
Mechanical downtilt
Physically tilt the antenna
The pattern in front goes
down, and behind goes up
Popular for sectorization
and special omni
applications
Electrical downtilt
Incremental phase shift is
applied in the feed network
The pattern droops all
around, like an inverted
saucer
Common technique when
downtilting omni cells
November, 2014
RF100 - 144
Traffic Engineering
Typical Traffic Distribution
on a Cellular System
100%
90%
SUN
80%
Efficiency %
80%
41
MON
70%
60%
TUE
50%
WED
40%
THU
30%
Capacity,
Erlangs
FRI
20%
SAT
10%
0%
# Trunks
50
Hour
November, 2014
RF100 - 145
A Game of Avoiding Extremes

The traffic engineer must walk a fine line
between two problems:
Overdimensioning
too much cost
insufficient resources to construct
traffic revenue is too low to
support costs
very poor economic efficiency!
Underdimensioning
blocking
poor technical performance
(interference)
capacity for billable revenue is low
revenue is low due to poor quality
users unhappy, cancel service
very poor economic efficiency!
November, 2014
RF100 - 146
Basics of Traffic Engineering
Terminology & Concept of a Trunk

Traffic engineering in telephony is focused on the voice paths
which users occupy. They are called by many different names:
trunks
circuits
radios (AMPS, TDMA), transceivers (TRXs in GSM),
channel elements (CDMA)
Some other common terms are:
trunk group
a trunk group is several trunks going to the same
destination, combined and addressed in switch
translations as a unit , for traffic routing purposes
member
one of the trunks in a trunk group
November, 2014
RF100 - 147
Units of Traffic Measurement

Traffic is expressed in units of Circuit Time
General understanding of telephone traffic engineering began

around 1910. An engineer in the Danish telephone system,
Agner Krarup Erlang, was one of the first to master the science
of trunk dimensioning and publish the knowledge for others. In
his honor, the basic unit of traffic is named the Erlang.
An Erlang of traffic is one circuit continuously used during an
observation period one hour long.
Other units have become popular among various users:
CCS (Hundred-Call-Seconds)
MOU (Minutes Of Use)
Its easy to convert between traffic units if the need arises:
1 Erlang = 60 MOU = 36 CCS

November, 2014
RF100 - 148
How Much Traffic Can One Trunk Carry?
Traffic studies are usually for periods of one hour

In one hour, one trunk can carry one hour of traffic -- One Erlang
If nothing else matters, this is the limit!
If anyone else wants to talk -- sorry!
Absolute Maximum Capacity

of One Trunk
One Trunk
Constant
Talker
One Erlang
We must not plan to keep trunks busy all the time. There must be
a reserve to accommodate new talkers! How much reserve? next!
November, 2014
RF100 - 149
Traffic Engineering And Queuing Theory

Ticket counter analogy
Servers
Queue
User population
Queues we face in
everyday life
1) for telephone calls
2) at the bank
3) at the gas station
4) at the airline counter
November, 2014
Traffic engineering is an application of a

science called queuing theory
Queuing theory relates user arrival
statistics, number of servers, and
various queue strategies, with the
probability of a user receiving service
If waiting is not allowed, and a blocked
call simply goes away, Erlang-B
formula applies (popular in wireless)
If unlimited waiting is allowed before a
call receives service, the Erlang-C
formula applies
If a wait is allowed but is limited in
time, Binomial & Poisson formulae
apply
Engset formulae apply to rapid,
packet-like transactions such as
paging channels
RF100 - 150
Offered And Carried Traffic

PSTN or other
Wireless user
Carried
Traffic
MTXBSC
BTS BTS BTS BTS BTS
Offered
Traffic
Offered traffic is what users attempt to

originate
Carried traffic is the traffic actually
successfully handled by the system
Blocked traffic is the traffic that could
not be handled
Since blocked call attempts never
materialize, blocked traffic must be
estimated based on number of
blocked attempts and average
duration of successful calls
BTSBlocked
Offered Traffic =
Traffic
Carried Traffic + Blocked Traffic
TOff = NCA x TCD

TOff = Offered traffic
NCA = Number of call attempts
TCD = Average call duration
November, 2014
RF100 - 151
Principles of Traffic Engineering
Blocking Probability / Grade of Service

Blocking is inability to get a circuit when one is needed
Probability of Blocking is the likelihood that blocking will
happen
In principle, blocking can occur anywhere in a wireless system:
not enough radios, the cell is full
not enough paths between cell site and switch
not enough paths through the switching complex
not enough trunks from switch to PSTN
Blocking probability is usually
Typical Wireless System
expressed as a percentage
Design Blocking Probabilities
using a shorthand notation:
PSTN Office
P.02 is 2% probability, etc.
Blocking probability sometimes
P.005
is called Grade Of Service
Cell
DMS-MTX
Most blocking in cellular systems
P.02
occurs at the radio level.
P.02 is a common goal at the
P.001
P.005
radio level in a system
Cell
Cell
November, 2014
RF100 - 152
Number of Trunks
vs. Utilization Efficiency
Imagine a cell site with just one voice channel. At a P.02
Grade of Service, how much traffic could it carry?
The trunk can only be used 2% of the time, otherwise the
blocking will be worse than 2%.
98% availability forces 98% idleness. It can only carry
.02 Erlangs. Efficiency 2%!
Adding just one trunk relieves things greatly.
Now we can use trunk 1 heavily, with trunk 2
handling the overflow. Efficiency rises to 11%
Erlang-B P.02 GOS

Trks
Erl Eff%
0.02
2%
0.22 11%
The Principle of Trunking Efficiency

80%
Efficiency %
For a given grade of service, trunk
41
utilization efficiency increases as the
number of trunks in the pool grows larger.
For trunk groups of several hundred,
Capacity,
Erlangs
utilization approaches 100%.
1
November, 2014
# Trunks
RF100 - 153
50
Number of Trunks,
Capacity, and Utilization Efficiency
Capacity and Trunk Utilization

Erlang-B for P.02 Grade of Service
90
80
70
60
50
40
30
20
10
0
Utilization
Efficiency
Percent
10
November, 2014
20
30
Trunks
40
50
45
40
35
30
25
20
15
10
5
0
Capacity,
Erlangs
The graph at left illustrates

the capacity in Erlangs of a
given number of trunks, as
well as the achievable
utilization efficiency
For accurate work, tables of
traffic data are available
Capacity, Erlangs
Blocking Probability
(GOS)
Number of Trunks
Notice how capacity and
utilization behave for the
numbers of trunks in typical
cell sites
RF100 - 154
Traffic Engineering & System Dimensioning

Using Erlang-B Tables to determine Number of Circuits Required
Probability
of blocking
E
0.0001 0.002
0.02
0.2
1
2
2.935
Number of
available
circuits
Capacity
in Erlangs
300
A = f (E,n)
November, 2014
RF100 - 155
Erlang-B Traffic Tables

Abbreviated - For P.02 Grade of Service Only
November, 2014
RF100 - 156
Wireless Traffic Variation with Time:

A Cellular Example
Typical Traffic Distribution
on a Cellular System
100%
90%
SUN
80%
MON
70%
60%
TUE
50%
WED
40%
THU
30%
FRI
20%
SAT
10%
0%
Hour
Actual traffic from a cellular system in the

mid-south USA in summer 1992. This
system had 45 cells and served an area
of approximately 1,000,000 population.
November, 2014
Peak traffic on cellular systems

is usually daytime businessrelated traffic; on PCS systems,
evening traffic becomes much
more important and may actually
contain the system busy hour
Evening taper is more gradual
than morning rise
Wireless systems for PCS and
LEC-displacement have peaks
of residential traffic during early
evening hours, like wireline
systems
Friday is the busiest day,
followed by other weekdays in
backwards order, then Saturday,
then Sunday
There are seasonal and
annual variations, as well as
long term growth trends
RF100 - 157
Busy-Hour
In telephony, it is customary to collect and analyze traffic in hourly
blocks, and to track trends over months, quarters, and years
When making decisions about number of trunks required, we
plan the trunks needed to support the busiest hour of a normal
day
Special events (disasters, one-of-a-kind traffic tie-ups, etc.)
are not considered in the analysis (unless a marketingsponsored event)
Which Hour should be used as the Busy-Hour?
Some planners choose one specific hour and use it every day
Some planners choose the busiest hour of each individual day
(floating busy hour)
Most common preference is to use floating (bouncing) busy
hour determined individually for the total system and for each
cell, but to exclude special events and disasters
In the example just presented, 4 PM was the busy hour every
day
November, 2014
RF100 - 158
Where is the Traffic?

Wireline telephone systems have a big
advantage in traffic planning.
They know the addresses where
their customers generate the traffic!
Wireless systems have to guess where
the customers will be next
Existing System
Traffic In Erlangs
8
11
7
10
7
6 11
16
19
8 7
16
7
6
3
9
9
5
2
5
7
November, 2014
on existing systems, use

measured traffic data by sector and
cell
analyze past trends
compare subscriber forecast
trend into future, find overloads
for new systems or new cells,
we must use all available clues
RF100 - 159
Traffic Clues
27 mE/Sub in BH
103,550 Subscribers
1,239,171 Market Population
adding 4,350 subs/month
Population Density
new
Shopping Center
Vehicular Traffic
Land Use
Databases
920
5110
22,100
4215
3620
November, 2014
1230
6620
Subscriber Profiles:
Busy Hour Usage, Call Attempts, etc.
Market Penetration:
# Subscribers/Market Population
use Sales forecasts, usage forecasts
Population Density
Geographic Distribution
Construction Activity
Vehicular Traffic Data
Vehicle counts on roads
Calculations of density on major
roadways from knowledge of vehicle
movement, spacing, market
penetration
Land Use Database: Area Profiles
Aerial Photographs: Count Vehicles!
RF100 - 160
Traffic Density Along Roadways

Number of lanes and speed are the main
variable determining number of vehicles on
major highways
Vehicles per mile

Vehicle Vehicle Vehicles
Speed, Spacing, per mile,
MPH
feet
per lane
0
20
264
10
42
126
20
64
83
30
86
61
45
119
44
60
152
35
Typical headway ~1.5 seconds

Table and figure show capacity of 1
lane
Vehicle spacing 20 ft. @stop

Running Headway 1.5 seconds
When traffic stops, users generally increase

calling activity
Multiply number of vehicles by percentage
penetration of population to estimate number
of subscriber vehicles
Vehicle Spacing At Common Roadway Speeds

100
200
300
400
500
600
700
800 feet
0 MPH
10 MPH
20 MPH
30 MPH
40 MPH
50 MPH
November, 2014
RF100 - 161
Introduction to Cellular and

Broadband Technologies
CDMA, GSM/GPRS/EDGE, UMTS/WCDMA/HSPA, LTE
November, 2014
RF100 - 162
Wireless Generations and Sector Data Speeds
EARLY ANALOG
MTS, IMTS
AutoTel
In the days before analog cellular, various wide-area mobile

telecommunications systems were used
They covered wide areas with only a few channels available
Voice calls only - the internet didn't even exist
RF100 - 163
November, 2014
1G
EARLY ANALOG
AMPS: Analog Cellular
NMT450, NMT900
MTS, IMTS
AutoTel
LMR, SMR
1G: When the first cellular systems launched, even though data
wasn't offered by the carriers, a few hardy users provided their own
(MNP10) modems for haphazard, slow data via dialup access
The internet wasn't a big factor yet!
RF100 - 164
November, 2014
2G
1G
EARLY ANALOG
CDMA IS-95, J-Std 008
TDMA: NADC, IS-136
TDMA: GSM, HSCSD
TDMA: IDEN
NMT450, NMT900
LMR, SMR
MTS, IMTS
AutoTel
2G provided digital data but at low bit rates -- 9600 - 32k bps
Downloading a 2MB file took an hour or more (if it didn't drop in
the middle and require manually re-starting)
Travel agents with telephones were still faster than online res.
RF100 - 165
November, 2014
200+
200+
153
153
2.5 G
2G
1G
EARLY ANALOG
CDMA-2000, 1xRTT
GPRS, EDGE
TDMA: NADC, IS-136
TDMA: GSM, HSCSD
TDMA: IDEN
NMT450, NMT900
LMR, SMR
MTS, IMTS
AutoTel
When 1xRTT, GPRS, and EDGE became available, suddenly it

was possible to do direct IP web access at speeds of 150 kbps or
higher. This was better than dial-up speeds, especially on a hotel
switchboards. Nerds and even some normal people on the road
were finally free to stay connected on-line
RF100 - 166
November, 2014
153
153
3G
2.5 G
2G
1G
EARLY ANALOG
3.1M
1.8M
200+
200+
1xEV-DO
7M+
3M+
UMTS WCDMA HSPA
CDMA-2000, 1xRTT
GPRS, EDGE
TDMA: NADC, IS-136
TDMA: GSM, HSCSD
TDMA: IDEN
NMT450, NMT900
LMR, SMR
MTS, IMTS
AutoTel
When the true 3G services 1xEV-DO and WCDMA/UMTS/HSPA

became available, wireless speeds were boosted into the Mb/s
range for downloading and approaching 1 Mb/s for uploading
Now mobile users had almost normal internet access, although
many networks had heavy congestion in dense usage areas
RF100 - 167
November, 2014

100M
50M
153
153
4G
3G
2.5 G
2G
1G
EARLY ANALOG
44M
22M
HSPA+
3.1M
1.8M
200+
200+
100M
50M
7M+
3M+
WiMAX
LTE
1xEV-DO
UMTS WCDMA HSPA
CDMA-2000, 1xRTT
GPRS, EDGE
TDMA: NADC, IS-136
TDMA: GSM, HSCSD
TDMA: IDEN
NMT450, NMT900
LMR, SMR
MTS, IMTS
AutoTel
The first WiMAX and LTE networks brought user speeds of up to

12 Mb/s and even 3G HSPA was enhanced to HSPA+, providing
nearly transparent internet usage for the first time.
4G Network buildouts were slow, with some carriers still building
only trial networks even in late 2011
RF100 - 168
November, 2014

100M
50M
153
153
4G
3G
2.5 G
2G
1G
EARLY ANALOG
44M
22M
HSPA+
3.1M
1.8M
200+
200+
100M
50M
7M+
3M+
WiMAX
LTE
1xEV-DO
1000M
500M
LTE adv.
UMTS WCDMA HSPA
CDMA-2000, 1xRTT
GPRS, EDGE
TDMA: NADC, IS-136
TDMA: GSM, HSCSD
TDMA: IDEN
NMT450, NMT900
LMR, SMR
MTS, IMTS
AutoTel
Within 2 years of initial LTE buildouts,

Widespread use of MIMO is expected to boost speed 3-4x
LTE-Advanced technology is expected to boost speeds to 5001000 Mb/s for stationary downlink users
RF100 - 169
November, 2014
4G
3G
2.5 G
2G
1G
EARLY ANALOG
200+
200+
7M+
3M+
WiMAX
LTE
1xEV-DO
VOIP
VOIP?
153
153
3.1M
1.8M
44M
22M
HSPA+
100M
50M
VOIP
100M
50M
1000M
500M
LTE adv.
UMTS WCDMA HSPA
CDMA-2000, 1xRTT
GPRS, EDGE
TDMA: NADC, IS-136
TDMA: GSM, HSCSD
TDMA: IDEN
NMT450, NMT900
LMR, SMR
MTS, IMTS
AutoTel
Finally the industry will settle on one or two VOIP standards for
LTE, voice traffic of legacy CDMA and GSM will finally go to LTE
Nearly all WiMax networks will finally convert to LTE
CDMA and LTE voice networks won't die until 2017 or even later!
RF100 - 170
November, 2014
4G
3G
2.5 G
2G
1G
EARLY ANALOG
200+
200+
7M+
3M+
WiMAX
LTE
1xEV-DO
VOIP
VOIP?
153
153
3.1M
1.8M
44M
22M
HSPA+
100M
50M
VOIP
100M
50M
1000M
500M
LTE adv.
UMTS WCDMA HSPA
CDMA-2000, 1xRTT
GPRS, EDGE
TDMA: NADC, IS-136
TDMA: GSM, HSCSD
TDMA: IDEN
NMT450, NMT900
LMR, SMR
MTS, IMTS
AutoTel
1G: Users provided their own modems for haphazard, slow data
2G provided digital data but at low bit rates -- 9600 - 32k bps
3G data users finally passed 1 Mb/s in EV-DO and HSPA
4G users finally get10 Mb/s+
RF100 - 171
November, 2014
Introduction to CDMA
IS-95, CDMA2000, 1xEV-DO
November, 2014
RF100 - 172
Multiple Access Methods

FDMA
Power
FDMA: AMPS & NAMPS

Each user occupies a private Frequency,
protected from interference through physical
separation from other users on the same
frequency
TDMA: IS-136, GSM

TDMA
Power
Each user occupies a specific frequency but

only during an assigned time slot. The
frequency is used by other users during
other time slots.
CDMA
CDMA
Power
Page 173
Each user uses a signal on a particular

frequency at the same time as many other
users, but it can be separated out when
receiving because it contains a special code
of its own
November, 2014
CDMA: Using A New Dimension

All CDMA users occupy the same frequency
at the same time! Frequency and time are
not used as discriminators
CDMA operates by using CODING to
discriminate between users
CDMA interference comes mainly from
nearby users
Each user is a small voice in a roaring
crowd -- but with a uniquely recoverable
code
CDMA
Figure of Merit: C/I
(carrier/interference ratio)
AMPS: +17 dB
TDMA: +14 to +17 dB
GSM: +7 to 9 dB.
CDMA: -10 to -17 dB.
CDMA: Eb/No ~+6 dB.
November, 2014
RF100 - 174
Two Types of CDMA

Frequency Hopping CDMA
User 1 User 2 User 3 User 4
User 3 User 4 User 1 unused User 2
User 1 User 4 User 3 User 2 unused
unused User 1 User 2 User 4 User 3
There are Two types of CDMA:

Frequency-Hopping
Each users narrowband signal hops
among discrete frequencies, and the
receiver follows in sequence
Frequency-Hopping Spread
Spectrum (FHSS) CDMA is NOT
currently used in wireless systems,
although used by the military
Direct Sequence
Frequency
Direct Sequence CDMA

Time
Frequency
User 1
+
=
November, 2014
Code 1
Composite
narrowband input from a user is

coded (spread) by a user-unique
broadband code, then transmitted
broadband signal is received;
receiver knows, applies users code,
recovers users data
Direct Sequence Spread Spectrum
(DSSS) CDMA IS the method used
in IS-95 commercial systems
RF100 - 175
DSSS Spreading: Time-Domain View

Input A: Users Data
At Originating Site:
Input A: Users Data @
19,200 bits/second
Input B: Walsh Code #23
@ 1.2288 Mcps
Output: Spread
spectrum signal
via air interface
At Destination Site:
Input A: Received
spread spectrum signal
Input B: Walsh Code #23
@ 1.2288 Mcps
Output: Users Data @
19,200 bits/second just
as originally sent
November, 2014
Originating Site
1
Input B: Spreading Code
XOR
Exclusive-OR
Gate
Spread Spectrum Signal
Input A: Received Signal
Input B: Spreading Code
Destination Site
XOR
Exclusive-OR
Gate
Output: Users Original Data
Drawn to actual scale and time alignment
RF100 - 176
Spreading from a Frequency-Domain View
Traditional technologies try

to squeeze signal into
minimum required
bandwidth
CDMA uses larger
bandwidth but uses
resulting processing gain to
increase capacity
TRADITIONAL COMMUNICATIONS SYSTEM

Spread
Spectrum
Narrowband
Signal
Slow
Information
Sent
TX
Slow
Information
Recovered
RX
SPREAD-SPECTRUM SYSTEM
Wideband
Signal
Slow
Information
Sent
TX
Fast
Spreading
Sequence
Slow
Information
Recovered
RX
Fast
Spreading
Sequence
Spread Spectrum Payoff:

Processing Gain
November, 2014
RF100 - 177
The CDMA Spread Spectrum Payoff:
Would you like a lump-sum, or monthly payments?

Shannon's work suggests that a certain
bit rate of information deserves a
certain bandwidth
If one CDMA user is carried alone by a
CDMA signal, the processing gain is
large - roughly 21 db for an 8k vocoder.
Each doubling of the number of
users consumes 3 db of the
processing gain
Somewhere above 32 users, the
signal-to-noise ratio becomes
undesirable and the ultimate
capacity of the sector is reached
Practical CDMA systems restrict the
number of users per sector to ensure
processing gain remains at usable
levels
November, 2014
CDMA Spreading Gain

Consider a user with a 9600
bps vocoder talking on a
CDMA signal 1,228,800 hz
wide. The processing gain is
1,228,800/9600 = 128, which
is 21 db. What happens if
additional users are added?
# Users Processing Gain
21 db
18 db
15 db
12 db
16
9 db
32
6 db
64..Uh, Regis, can I just

take the money I've already
won, and go home now?
RF100 - 178
CDMA Uses Code Channels

Building a
CDMA Signal
A CDMA signal uses many chips to convey just

one bit of information
Bits
Each user has a unique chip pattern, in effect a
from Users Vocoder
code channel
To recover a bit, integrate a large number of chips
interpreted by the users known code pattern
Forward Error
Correction
Other users code patterns appear random and
Symbols
integrate in a random self-canceling fashion, dont
disturb the bit decoding decision being made with
the proper code pattern
Coding and
Spreading
Chips
November, 2014
RF100 - 179
CDMAs Nested Spreading Sequences

ORIGINATING SITE
X+A
DESTINATION
Spread-Spectrum Chip Streams

X+A+B
X+A+B+C
X+A+B
X+A
Input
Data
Recovered
Data
Spreading Spreading Spreading

Sequence Sequence Sequence
Spreading Spreading Spreading

Sequence Sequence Sequence
CDMA combines three different spreading sequences to create

unique, robust channels
The sequences are easy to generate on both sending and receiving
ends of each link
What we do, we can undo
November, 2014
RF100 - 180
One of the CDMA Spreading Sequences:

The Family of Walsh Codes
WALSH CODES
64 Magic Sequences, each 64 chips long

Each Walsh Code is precisely Orthogonal
with respect to all other Walsh Codes
its simple to generate the codes, or
theyre small enough to use from ROM
Unique Properties:
Mutual Orthogonality
EXAMPLE:
Correlation of Walsh Code #23 with Walsh Code #59
#23
#59
Sum
0110100101101001100101101001011001101001011010011001011010010110
0110011010011001100110010110011010011001011001100110011010011001
0000111111110000000011111111000011110000000011111111000000001111
Correlation Results: 32 1s, 32 0s: Orthogonal!!
#
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
---------------------------------- 64-Chip Sequence -----------------------------------------0000000000000000000000000000000000000000000000000000000000000000

0101010101010101010101010101010101010101010101010101010101010101
0011001100110011001100110011001100110011001100110011001100110011
0110011001100110011001100110011001100110011001100110011001100110
0000111100001111000011110000111100001111000011110000111100001111
0101101001011010010110100101101001011010010110100101101001011010
0011110000111100001111000011110000111100001111000011110000111100
0110100101101001011010010110100101101001011010010110100101101001
0000000011111111000000001111111100000000111111110000000011111111
0101010110101010010101011010101001010101101010100101010110101010
0011001111001100001100111100110000110011110011000011001111001100
0110011010011001011001101001100101100110100110010110011010011001
0000111111110000000011111111000000001111111100000000111111110000
0101101010100101010110101010010101011010101001010101101010100101
0011110011000011001111001100001100111100110000110011110011000011
0110100110010110011010011001011001101001100101100110100110010110
0000000000000000111111111111111100000000000000001111111111111111
0101010101010101101010101010101001010101010101011010101010101010
0011001100110011110011001100110000110011001100111100110011001100
0110011001100110100110011001100101100110011001101001100110011001
0000111100001111111100001111000000001111000011111111000011110000
0101101001011010101001011010010101011010010110101010010110100101
0011110000111100110000111100001100111100001111001100001111000011
0110100101101001100101101001011001101001011010011001011010010110
0000000011111111111111110000000000000000111111111111111100000000
0101010110101010101010100101010101010101101010101010101001010101
0011001111001100110011000011001100110011110011001100110000110011
0110011010011001100110010110011001100110100110011001100101100110
0000111111110000111100000000111100001111111100001111000000001111
0101101010100101101001010101101001011010101001011010010101011010
0011110011000011110000110011110000111100110000111100001100111100
0110100110010110100101100110100101101001100101101001011001101001
0000000000000000000000000000000011111111111111111111111111111111
0101010101010101010101010101010110101010101010101010101010101010
0011001100110011001100110011001111001100110011001100110011001100
0110011001100110011001100110011010011001100110011001100110011001
0000111100001111000011110000111111110000111100001111000011110000
0101101001011010010110100101101010100101101001011010010110100101
0011110000111100001111000011110011000011110000111100001111000011
0110100101101001011010010110100110010110100101101001011010010110
0000000011111111000000001111111111111111000000001111111100000000
0101010110101010010101011010101010101010010101011010101001010101
0011001111001100001100111100110011001100001100111100110000110011
0110011010011001011001101001100110011001011001101001100101100110
0000111111110000000011111111000011110000000011111111000000001111
0101101010100101010110101010010110100101010110101010010101011010
0011110011000011001111001100001111000011001111001100001100111100
0110100110010110011010011001011010010110011010011001011001101001
0000000000000000111111111111111111111111111111110000000000000000
0101010101010101101010101010101010101010101010100101010101010101
0011001100110011110011001100110011001100110011000011001100110011
0110011001100110100110011001100110011001100110010110011001100110
0000111100001111111100001111000011110000111100000000111100001111
0101101001011010101001011010010110100101101001010101101001011010
0011110000111100110000111100001111000011110000110011110000111100
0110100101101001100101101001011010010110100101100110100101101001
0000000011111111111111110000000011111111000000000000000011111111
0101010110101010101010100101010110101010010101010101010110101010
0011001111001100110011000011001111001100001100110011001111001100
0110011010011001100110010110011010011001011001100110011010011001
0000111111110000111100000000111111110000000011110000111111110000
0101101010100101101001010101101010100101010110100101101010100101
0011110011000011110000110011110011000011001111000011110011000011
0110100110010110100101100110100110010110011010010110100110010110
In CDMA2000, user data comes at various speeds, and different lengths of walsh codes can exist.
See Course 332 for more details on CDMA2000 1xRTT fast data channels and additional Walsh codes.
November, 2014
RF100 - 181
The Other Two Spreading Sequences:

The Pseudo-random Noise (PN) codes
An Ordinary Shift Register
Other CDMA sequences are

generated in shift registers
Plain shift register: no fun,
sequence = length of register
Tapped shift register generates a
wild, self-mutating sequence 2N-1
chips long (N=register length)
Such sequences match if
compared in step (no-brainer,
any sequence matches itself)
Such sequences appear
approximately orthogonal if
compared with themselves not
exactly matched in time
false correlation typically <2%
November, 2014
Sequence repeats every N chips,

where N is number of cells in register
A Tapped, Summing Shift Register
Sequence repeats every 2N-1 chips,

where N is number of cells in register
A Special Characteristic of Sequences
Generated in Tapped Shift Registers
Compared In-Step: Matches Itself
Sequence:
Self, in sync:
Sum:
Complete Correlation: All 0s
Compared Shifted: Little Correlation

Sequence:
Self, Shifted:
Sum:
Practically Orthogonal: Half 1s, Half 0s
RF100 - 182
Another CDMA Spreading Sequence:

The Short PN Code, used for Scrambling
Original IS-95 CDMA PN Scrambling
32,768 chips long
26-2/3 ms.
(75 repetitions in 2 sec.)
I
Q
I-sequence
Walsh
users
symbols
RF: cos t
Same
information
duplicated
on I and Q
Q-sequence
Short PN
Scrambling
QPSKmodulated
RF
Output
RF: sin t
QPSK
Serial to
Parallel
Output
The short PN code consists of

two PN Sequences, I and Q, each New CDMA2000 1x Complex Scrambling
32,768 chips long
RF:
Generated in similar but
cos t
differently-tapped 15-bit shift
I-sequence +
registers
users
Walsh
symbols
the two sequences scramble
+
the information on the I and Q
Different
phase channels
+
Information
Q-sequence
on I and Q
Figures to the right show how one
sin t
users channel is built at the bTS
RF
Complex Scrambling
November, 2014
RF100 - 183
Another CDMA Spreading Sequence:

The PN Long Code
LONG CODE STATE REGISTER dynamic contents, zero timing shift
clock
MASK REGISTER unique steady contents cause unique timing shift

SUMMER holds dynamic modulo-2 sum of LC State and Mask registers
Each clock cycle, all the Summer bits are

added into a single-bit modulo-2 sum
The shifted Long Code emerges, chip by chip!
Every phone and every BTS channel element has a Long Code generator
Long Code State Register makes long code at system reference timing
A Mask Register holds a user-specific unique pattern of bits
Each clock pulse drives the Long Code State Register to its next state
State register and Mask register contents are added in the Summer
Summer contents are modulo-2 added to produce just a single bit output
The output bits are the Long Code, but shifted to the users unique offset
November, 2014
RF100 - 184
Different Masks Produce

Different Long PN Offsets
TRAFFIC CHANNEL NORMAL
USING THE PUBLIC LONG CODE MASK
LONG CODE STATE REGISTER
PERMUTED ESN
fixed
SUMMING REGISTER
TRAFFIC CHANNEL PRIVATE

USING THE PRIVATE LONG CODE MASK
calculated PRIVATE LONG CODE MASK

SUMMING REGISTER
ACCESS CHANNEL (IDLE MODE)

USING THE ACCESS CHANNEL LONG CODE MASK
fixed
AC# PC#
BASE_ID
SUMMING REGISTER
November, 2014
PILOT PN
Ordinary mobiles use their ESNs and

the Public Long Code Mask to
produce their unique Long Code PN
offsets
main ingredient: mobile ESN
Mobiles needing greater privacy use
the Private Long Code Mask
instead of 32-bit ESN, the mask
value is produced from SSD
Word B in a calculation similar to
authentication
Each BTS sector has an Access
Channel where mobiles transmit for
registration and call setup
the Access Channel Long Code
Mask includes Access Channel
#, Paging Channel #, BTS ID,
and Pilot PN
The BTS transmits all of these
parameters on the Paging
Channel
RF100 - 185
IS-95 CDMA Forward and

Reverse Channels
November, 2014
RF100 - 186
The Original IS-95 CDMA Code Channels

FORWARD CHANNELS
REVERSE CHANNELS
W0: PILOT
W32: SYNC
BTS
W1: PAGING
ACCESS
Wn: TRAFFIC
TRAFFIC
Existing IS-95A/JStd-008 CDMA uses the channels above for call setup and
traffic channels all call processing transactions use these channels
traffic channels are 9600 bps (rate set 1) or 14400 bps (rate set 2)
IS-2000 CDMA is backward-compatible with IS-95, but offers additional
radio configurations and additional kinds of possible channels
These additional modes are called Radio Configurations
IS-95 Rate Set 1 and 2 are IS-2000 Radio Configurations 1 & 2
November, 2014
RF100 - 187
The Code Channels of 1xRTT Rev. 0

FORWARD CHANNELS
F-Pilot
Same coding as IS-95B,

Backward compatible
Includes Power
Control Subchannel
F-Sync

Backward compatible
1 to 7
PAGING

Backward compatible
Access Channel
(IS-95B compatible)
Enhanced
Access Channel
0 to 8
F-BCH
0 to 3
F-QPCH
Quick Paging Channel
F-CPCCH
Common
Power Control Channel
How many 1
Possible:
1
0 to 4
BTS
REVERSE CHANNELS
0 to 7
0 to 7
Users:
0 to many
1
Broadcast Channel
F-CACH
Common
Assignment Channel
F-CCCH
Common
Control Channels
F-TRAFFIC
F-FCH
Forward
Traffic Channels
Fundamental Channel
Dedicated
Control Channel
0 or 1
F-DCCH
0 to 7
F-SCH IS-95B only Channels IS-95B only
0 to 2
F-SCH
Supplemental
Supplemental
Channels RC3,4,5
Common
Control Channel
R-Pilot 1
R-ACH or
R-EACH
R-CCCH 0 or 1
R-TRAFFIC
Reverse Fundamental
Channel (IS95B comp.)
Dedicated
Control Channel
Reverse
Supplemental Channel
R-FCH 1
R-DCCH 0 or 1
R-SCH 0 to 2
CDMA2000 1xRTT has a rich

variety of traffic channels for
voice and fast data
There are also optional
additional control channels
for more effective operation
See Course 332 for more details.
November, 2014
RF100 - 188
Spreading Rates & Radio Configurations

Spreading
Rate
SR1
1xRTT
1 carrier
1.2288
MCPS
SR3
3xRTT
Fwd:
3 carriers
1.2288
MCPS
Rev:
3.6864
MCPS
Forward Link
Radio
Configuration
Data
Rates
Data
Rates
Radio
Configuration
Reverse Link
Required. IS-95B Compatible

No CDMA2000 coding features
RC1
9600
9600
RC1
Required. IS-95B Compatible

Compatible with IS-95B RS2

RC2
14400
14400
RC2
Compatible with IS-95B RS2

Quarter-rate convolutional or
Turbo Coding, base rate 9600
RC3
9600
Half-rate convolutional or
RC4
Quarter-rate convolutional or
RC5
1/6 rate convolutional

or Turbo coding, base rate 9600
RC6
Required. 1/3 rate convolutional

RC7
or 1/3 rate convolutional or

Turbo coding, base rate 14400
RC8
or 1/3 rate convolutional or

Turbo encoder, base rate 14400
November, 2014
RC9
153600
9600
153600
307200
307200
14400
14400
230400
230400
9600
307200
9600
614400
14400
460800
14400
1036800
RC3
Quarter rate convolutional or

Turbo coding; Half rate
convolutional or Turbo coding;
base rate 9600
RC4
Quarter rate convolutional or

RC5
Required. or 1/3 convolutional

RC6
or convolutional or Turbo
encoding, base rate 14400
9600
9600
307200
614400
14400
460800
1036800
RF100 - 189
Walsh Codes in 1xRTT

SYMBOLS of 2G VOICE or DATA
One Symbol of Information
19,200 symbols/second
DATA
SYMBOLS
WALSH
CODE
1,228,800 walsh chips/second

64 chips of Walsh Code
Data Rates are different, but

Chip Rates must stay the same!
SYMBOLS of 3G 153.6 kb/s DATA

One Symbol of Fast Data
307,200 symbols/second
DATA
SYMBOLS
WALSH
CODE
4 Chips of Walsh Code
November, 2014
1,228,800 walsh chips/second
RF100 - 190
The Famous Walsh Codes from IS-95 Days

WALSH CODES
64 Magic Sequences, each 64 chips long

Each Walsh Code is precisely Orthogonal with
respect to all other Walsh Codes and their
opposites too!
its simple to generate the codes, or
theyre small enough to use from ROM
Unique Properties:
Mutual Orthogonality
EXAMPLE:
Correlation of Walsh Code #23 with Walsh Code #59
#23
#59
Sum
0110100101101001100101101001011001101001011010011001011010010110
0110011010011001100110010110011010011001011001100110011010011001
0000111111110000000011111111000011110000000011111111000000001111
Correlation Results: 32 1s, 32 0s: Orthogonal!!
November, 2014
#
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
---------------------------------- 64-Chip Sequence -----------------------------------------0000000000000000000000000000000000000000000000000000000000000000

0101010101010101010101010101010101010101010101010101010101010101
0011001100110011001100110011001100110011001100110011001100110011
0110011001100110011001100110011001100110011001100110011001100110
0000111100001111000011110000111100001111000011110000111100001111
0101101001011010010110100101101001011010010110100101101001011010
0011110000111100001111000011110000111100001111000011110000111100
0110100101101001011010010110100101101001011010010110100101101001
0000000011111111000000001111111100000000111111110000000011111111
0101010110101010010101011010101001010101101010100101010110101010
0011001111001100001100111100110000110011110011000011001111001100
0110011010011001011001101001100101100110100110010110011010011001
0000111111110000000011111111000000001111111100000000111111110000
0101101010100101010110101010010101011010101001010101101010100101
0011110011000011001111001100001100111100110000110011110011000011
0110100110010110011010011001011001101001100101100110100110010110
0000000000000000111111111111111100000000000000001111111111111111
0101010101010101101010101010101001010101010101011010101010101010
0011001100110011110011001100110000110011001100111100110011001100
0110011001100110100110011001100101100110011001101001100110011001
0000111100001111111100001111000000001111000011111111000011110000
0101101001011010101001011010010101011010010110101010010110100101
0011110000111100110000111100001100111100001111001100001111000011
0110100101101001100101101001011001101001011010011001011010010110
0000000011111111111111110000000000000000111111111111111100000000
0101010110101010101010100101010101010101101010101010101001010101
0011001111001100110011000011001100110011110011001100110000110011
0110011010011001100110010110011001100110100110011001100101100110
0000111111110000111100000000111100001111111100001111000000001111
0101101010100101101001010101101001011010101001011010010101011010
0011110011000011110000110011110000111100110000111100001100111100
0110100110010110100101100110100101101001100101101001011001101001
0000000000000000000000000000000011111111111111111111111111111111
0101010101010101010101010101010110101010101010101010101010101010
0011001100110011001100110011001111001100110011001100110011001100
0110011001100110011001100110011010011001100110011001100110011001
0000111100001111000011110000111111110000111100001111000011110000
0101101001011010010110100101101010100101101001011010010110100101
0011110000111100001111000011110011000011110000111100001111000011
0110100101101001011010010110100110010110100101101001011010010110
0000000011111111000000001111111111111111000000001111111100000000
0101010110101010010101011010101010101010010101011010101001010101
0011001111001100001100111100110011001100001100111100110000110011
0110011010011001011001101001100110011001011001101001100101100110
0000111111110000000011111111000011110000000011111111000000001111
0101101010100101010110101010010110100101010110101010010101011010
0011110011000011001111001100001111000011001111001100001100111100
0110100110010110011010011001011010010110011010011001011001101001
0000000000000000111111111111111111111111111111110000000000000000
0101010101010101101010101010101010101010101010100101010101010101
0011001100110011110011001100110011001100110011000011001100110011
0110011001100110100110011001100110011001100110010110011001100110
0000111100001111111100001111000011110000111100000000111100001111
0101101001011010101001011010010110100101101001010101101001011010
0011110000111100110000111100001111000011110000110011110000111100
0110100101101001100101101001011010010110100101100110100101101001
0000000011111111111111110000000011111111000000000000000011111111
0101010110101010101010100101010110101010010101010101010110101010
0011001111001100110011000011001111001100001100110011001111001100
0110011010011001100110010110011010011001011001100110011010011001
0000111111110000111100000000111111110000000011110000111111110000
0101101010100101101001010101101010100101010110100101101010100101
0011110011000011110000110011110011000011001111000011110011000011
0110100110010110100101100110100110010110011010010110100110010110
RF100 - 191
Families of the Walsh Codes

WALSH
# 1-Chip
0 0
WALSH
# 2-Chips
0 00
1 01
WALSH
#
0
1
2
3
4-Chips
0000
0101
0011
0110
2x2 4x4
WALSH
#
0
1
2
3
4
5
6
7
8-Chips
00000000
01010101
00110011
01100110
00001111
01011010
00111100
01101001
8x8
WALSH
#
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
---- 16-Chips ------0000000000000000

0101010101010101
0011001100110011
0110011001100110
0000111100001111
0101101001011010
0011110000111100
0110100101101001
0000000011111111
0101010110101010
0011001111001100
0110011010011001
0000111111110000
0101101010100101
0011110011000011
0110100110010110
16x16
Walsh Code Names

W1232 = Walsh Code #12, 32 chips long.
Walsh Level Mapping

The Walsh Codes shown here are in logical
state values 0 and 1.
Walsh Codes also can exist as physical
bipolar signals. Logical zero is the signal
value +1 and Logical 1 is the signal value -1.
Mapping: Logical 0,1 > +1, -1 Physical
WALSH CODES
#
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
----------- 32-Chip Sequence ------------00000000000000000000000000000000

01010101010101010101010101010101
00110011001100110011001100110011
01100110011001100110011001100110
00001111000011110000111100001111
01011010010110100101101001011010
00111100001111000011110000111100
01101001011010010110100101101001
00000000111111110000000011111111
01010101101010100101010110101010
00110011110011000011001111001100
01100110100110010110011010011001
00001111111100000000111111110000
01011010101001010101101010100101
00111100110000110011110011000011
01101001100101100110100110010110
00000000000000001111111111111111
01010101010101011010101010101010
00110011001100111100110011001100
01100110011001101001100110011001
00001111000011111111000011110000
01011010010110101010010110100101
00111100001111001100001111000011
01101001011010011001011010010110
00000000111111111111111100000000
01010101101010101010101001010101
00110011110011001100110000110011
01100110100110011001100101100110
00001111111100001111000000001111
01011010101001011010010101011010
00111100110000111100001100111100
01101001100101101001011001101001
32x32
All Walsh codes can be built to any size from a

single zero by replicating and inverting
All Walsh matrixes are square -- same number
of codes and number of chips per code
November, 2014
WALSH CODES
#
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
---------------------------------- 64-Chip Sequence -----------------------------------------0000000000000000000000000000000000000000000000000000000000000000

0101010101010101010101010101010101010101010101010101010101010101
0011001100110011001100110011001100110011001100110011001100110011
0110011001100110011001100110011001100110011001100110011001100110
0000111100001111000011110000111100001111000011110000111100001111
0101101001011010010110100101101001011010010110100101101001011010
0011110000111100001111000011110000111100001111000011110000111100
0110100101101001011010010110100101101001011010010110100101101001
0000000011111111000000001111111100000000111111110000000011111111
0101010110101010010101011010101001010101101010100101010110101010
0011001111001100001100111100110000110011110011000011001111001100
0110011010011001011001101001100101100110100110010110011010011001
0000111111110000000011111111000000001111111100000000111111110000
0101101010100101010110101010010101011010101001010101101010100101
0011110011000011001111001100001100111100110000110011110011000011
0110100110010110011010011001011001101001100101100110100110010110
0000000000000000111111111111111100000000000000001111111111111111
0101010101010101101010101010101001010101010101011010101010101010
0011001100110011110011001100110000110011001100111100110011001100
0110011001100110100110011001100101100110011001101001100110011001
0000111100001111111100001111000000001111000011111111000011110000
0101101001011010101001011010010101011010010110101010010110100101
0011110000111100110000111100001100111100001111001100001111000011
0110100101101001100101101001011001101001011010011001011010010110
0000000011111111111111110000000000000000111111111111111100000000
0101010110101010101010100101010101010101101010101010101001010101
0011001111001100110011000011001100110011110011001100110000110011
0110011010011001100110010110011001100110100110011001100101100110
0000111111110000111100000000111100001111111100001111000000001111
0101101010100101101001010101101001011010101001011010010101011010
0011110011000011110000110011110000111100110000111100001100111100
0110100110010110100101100110100101101001100101101001011001101001
0000000000000000000000000000000011111111111111111111111111111111
0101010101010101010101010101010110101010101010101010101010101010
0011001100110011001100110011001111001100110011001100110011001100
0110011001100110011001100110011010011001100110011001100110011001
0000111100001111000011110000111111110000111100001111000011110000
0101101001011010010110100101101010100101101001011010010110100101
0011110000111100001111000011110011000011110000111100001111000011
0110100101101001011010010110100110010110100101101001011010010110
0000000011111111000000001111111111111111000000001111111100000000
0101010110101010010101011010101010101010010101011010101001010101
0011001111001100001100111100110011001100001100111100110000110011
0110011010011001011001101001100110011001011001101001100101100110
0000111111110000000011111111000011110000000011111111000000001111
0101101010100101010110101010010110100101010110101010010101011010
0011110011000011001111001100001111000011001111001100001100111100
0110100110010110011010011001011010010110011010011001011001101001
0000000000000000111111111111111111111111111111110000000000000000
0101010101010101101010101010101010101010101010100101010101010101
0011001100110011110011001100110011001100110011000011001100110011
0110011001100110100110011001100110011001100110010110011001100110
0000111100001111111100001111000011110000111100000000111100001111
0101101001011010101001011010010110100101101001010101101001011010
0011110000111100110000111100001111000011110000110011110000111100
0110100101101001100101101001011010010110100101100110100101101001
0000000011111111111111110000000011111111000000000000000011111111
0101010110101010101010100101010110101010010101010101010110101010
0011001111001100110011000011001111001100001100110011001111001100
0110011010011001100110010110011010011001011001100110011010011001
0000111111110000111100000000111111110000000011110000111111110000
0101101010100101101001010101101010100101010110100101101010100101
0011110011000011110000110011110011000011001111000011110011000011
0110100110010110100101100110100110010110011010010110100110010110
64x64
RF100 - 192
Walsh Code Trees and Interdependencies

W316 0110 0110 0110 0110
W38
0110 0110
W1116
0110 0110 1001 1001
W332 0110 0110 0110 0110 0110 0110 0110 0110

W1932 0110 0110 0110 0110 1001 1001 1001 1001
W1132 0110 0110 1001 1001 0110 0110 1001 1001
W2732 0110 0110 1001 1001 1001 1001 0110 0110
W34 0110
W716 0110 1001 0110 1001
W78
0110 1001
W1516 0110
1001 1001 0110
W732 0110 1001 0110 1001 0110 1001 0110 1001

W2332 0110 1001 0110 1001 1001 0110 1001 0110
W1532 0110 1001 1001 0110 0110 1001 1001 0110
W3132 0110 1001 1001 0110 1001 0110 0110 1001
W364
W3564
W1964
W5164
W1164
W4364
W2764
W5964
W764
W3964
W2364
W5564
W1564
W4764
W3164
W6364
Entire Walsh matrices can be built by replicating and inverting -- Individual

Walsh codes can also be expanded in the same way.
CDMA adds each symbol of information to one complete Walsh code
Faster symbol rates therefore require shorter Walsh codes
If a short Walsh code is chosen to carry a fast data channel, that walsh
code and all its replicative descendants are compromised and cannot be
reused to carry other signals
Therefore, the supply of available Walsh codes on a sector diminishes
greatly while a fast data channel is being transmitted!
CDMA2000 Base stations can dip into a supply of quasi-orthogonal codes
if needed to permit additional channels during times of heavy loading
November, 2014
RF100 - 193
Walsh Code Families and Exclusions

Consider a forward link supplemental
channel being transmitted with a data
W34
rate of 307,200 symbols/second
Each symbol will occupy 4 chips at
the 1x rate of 1,228,800 c/s.
A 4-chip walsh code will be used for
this channel
If Walsh Code #3 (4 chips) is chosen for
this channel:
Use of W34 will preclude other usage
of the following 64-chip walsh codes:
3, 35, 19, 51, 11, 43, 27, 59, 7, 39,
23, 55, 15, 47, 31, 63 -- all forbidden!
16 codes are tied up since the data is
being sent at 16 times the rate of
conventional 64-chip walsh codes
The BTS controller managing this sector
must track the precluded walsh codes
and ensure they arent assigned
WALSH CODES
0110
Which Walsh Codes get tied up by another?

Wxxyyties up every YYth Walsh Code starting with #XX.
November, 2014
#
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
---------------------------------- 64-Chip Sequence -----------------------------------------0000000000000000000000000000000000000000000000000000000000000000

0101010101010101010101010101010101010101010101010101010101010101
0011001100110011001100110011001100110011001100110011001100110011
0110011001100110011001100110011001100110011001100110011001100110
0000111100001111000011110000111100001111000011110000111100001111
0101101001011010010110100101101001011010010110100101101001011010
0011110000111100001111000011110000111100001111000011110000111100
0110100101101001011010010110100101101001011010010110100101101001
0000000011111111000000001111111100000000111111110000000011111111
0101010110101010010101011010101001010101101010100101010110101010
0011001111001100001100111100110000110011110011000011001111001100
0110011010011001011001101001100101100110100110010110011010011001
0000111111110000000011111111000000001111111100000000111111110000
0101101010100101010110101010010101011010101001010101101010100101
0011110011000011001111001100001100111100110000110011110011000011
0110100110010110011010011001011001101001100101100110100110010110
0000000000000000111111111111111100000000000000001111111111111111
0101010101010101101010101010101001010101010101011010101010101010
0011001100110011110011001100110000110011001100111100110011001100
0110011001100110100110011001100101100110011001101001100110011001
0000111100001111111100001111000000001111000011111111000011110000
0101101001011010101001011010010101011010010110101010010110100101
0011110000111100110000111100001100111100001111001100001111000011
0110100101101001100101101001011001101001011010011001011010010110
0000000011111111111111110000000000000000111111111111111100000000
0101010110101010101010100101010101010101101010101010101001010101
0011001111001100110011000011001100110011110011001100110000110011
0110011010011001100110010110011001100110100110011001100101100110
0000111111110000111100000000111100001111111100001111000000001111
0101101010100101101001010101101001011010101001011010010101011010
0011110011000011110000110011110000111100110000111100001100111100
0110100110010110100101100110100101101001100101101001011001101001
0000000000000000000000000000000011111111111111111111111111111111
0101010101010101010101010101010110101010101010101010101010101010
0011001100110011001100110011001111001100110011001100110011001100
0110011001100110011001100110011010011001100110011001100110011001
0000111100001111000011110000111111110000111100001111000011110000
0101101001011010010110100101101010100101101001011010010110100101
0011110000111100001111000011110011000011110000111100001111000011
0110100101101001011010010110100110010110100101101001011010010110
0000000011111111000000001111111111111111000000001111111100000000
0101010110101010010101011010101010101010010101011010101001010101
0011001111001100001100111100110011001100001100111100110000110011
0110011010011001011001101001100110011001011001101001100101100110
0000111111110000000011111111000011110000000011111111000000001111
0101101010100101010110101010010110100101010110101010010101011010
0011110011000011001111001100001111000011001111001100001100111100
0110100110010110011010011001011010010110011010011001011001101001
0000000000000000111111111111111111111111111111110000000000000000
0101010101010101101010101010101010101010101010100101010101010101
0011001100110011110011001100110011001100110011000011001100110011
0110011001100110100110011001100110011001100110010110011001100110
0000111100001111111100001111000011110000111100000000111100001111
0101101001011010101001011010010110100101101001010101101001011010
0011110000111100110000111100001111000011110000110011110000111100
0110100101101001100101101001011010010110100101100110100101101001
0000000011111111111111110000000011111111000000000000000011111111
0101010110101010101010100101010110101010010101010101010110101010
0011001111001100110011000011001111001100001100110011001111001100
0110011010011001100110010110011010011001011001100110011010011001
0000111111110000111100000000111111110000000011110000111111110000
0101101010100101101001010101101010100101010110100101101010100101
0011110011000011110000110011110011000011001111000011110011000011
0110100110010110100101100110100110010110011010010110100110010110
RF100 - 194
Forward Link Walsh Codes in 1xRTT
This way of arranging Walsh codes is called bit reversal order. It shows each Walsh
codes parents and children. Remember, we cannot use any Walsh code if another
Walsh code directly above it or below it is in use.
4 chips
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
8 chips
16 chips
76.8
ksps
76,800
sps
76.8
ksps
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
31 Code#
38.4k
38,400
sps
15
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
32 chips
63
31
47
15
55
23
39
7
59
27
43
11
51
19
35
3
61
29
45
13
53
21
37
5
57
25
41
9
49
17
33
1
62
30
46
14
54
22
38
6
58
26
42
10
50
18
34
2
60
28
44
12
52
20
36
4
56
24
40
8
48
16
32
0
Sync
Pilot
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
Paging 7
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
Paging 3
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
Paging 5
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
Paging
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
PCH 6
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
PCH 2
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
PCH 4
19.2k
19.2k
19.2k
19.2k
19,200
sps
64 chips
127
63
95
31
111
47
79
15
119
55
87
23
103
39
71
7
123
59
91
27
107
43
75
11
115
51
83
19
99
35
67
3
125
61
93
29
109
45
77
13
117
53
85
21
101
37
69
5
121
57
89
25
105
41
73
9
113
49
81
18
97
33
65
1
126
62
94
30
110
46
78
14
118
54
86
22
102
38
70
6
122
58
90
26
106
42
74
10
114
50
82
18
98
34
66
2
124
60
92
28
108
44
76
12
116
52
84
20
100
36
68
4
120
56
88
24
104
40
72
8
112
48
80
16
96
32
64
0
QPCH
QPCH
QPCH
TX Div PIlot
9,600
4,800
2,400
sps
128 chips
RF100 - 195
November, 2014
76.8
ksps
76.8
ksps
Code#
Code#
76.8
ksps
76.8
ksps
Code#
Code#
76.8
ksps
76.8
ksps
23
30
Code#
76.8
ksps
7
14
15
76.8
ksps
27
22
7
14
11
6
11
6
19
26
3
10
3
10
13
2
29
18
5
12
13
2
9
4
21
28
153,600
sps
8
5
12
F-SCH
153.6 ksps
0
25
20
F-SCH
153.6 ksps
F-SCH
153.6 ksps
9
4
F-SCH
153.6 ksps
F-SCH
153.6 ksps
Code#
F-SCH
153.6 ksps
17
24
7
6
1
8
3
2
Code#
16
Code# 0
5
1
4
0
Code#
307200
sps
F-SCH
307.2 ksps
F-SCH
307.2 ksps
Code#
3
1
2
0
Code#
Mature 1xRTT Mixed-Mode Voice and Data:

1 RC3/RC4 Shared F-SCH, 20 RC3 Voice Users, 38 RC4 Voice Users,
4 Active+12 Control-Hold RC3 and RC4 Data Users
16 data users time-share 2 F-DCCH for Control Hold state. Data users will get
38.4, 76.4, 153.6 or 307.2 kb/s peak, ~9 or 19 kb/s average, good latency. Fwd power tight!
Code#
4 chips
0
F-SCH
153.6 ksps
F-SCH
153.6 ksps
F-SCH
153.6 ksps
12
10
14
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
16 chips
15
Code#
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
76.8
ksps
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
38.4k
25
21
13
29
19
11
27
23
15
31 Code#
63
31
47
15
55
23
39
7
59
27
43
11
51
19
35
3
61
29
45
13
53
21
37
5
57
25
41
9
49
17
33
1
62
30
46
14
54
22
38
6
58
26
42
10
50
18
34
2
60
28
44
12
52
20
36
4
56
24
40
8
48
16
32
0
F-FCHs 9.6k
RC3 Voice
RC3 Voice
F-FCHs 9.6k
????
RC3 Voice
127
63
95
31
111
47
79
15
119
55
87
23
103
39
71
7
123
59
91
27
107
43
75
11
115
51
83
19
99
35
67
3
125
61
93
29
109
45
77
13
117
53
85
21
101
37
69
5
121
57
89
25
105
41
73
9
113
49
81
18
97
33
65
1
126
62
94
30
110
46
78
14
118
54
86
22
102
38
70
6
122
58
90
26
106
42
74
10
114
50
82
18
98
34
66
2
124
60
92
28
108
44
76
12
116
52
84
20
100
36
68
4
120
56
88
24
104
40
72
8
112
48
80
16
96
32
64
0
QPCH
QPCH
QPCH
TX Div PIlot
128 chips
F-FCHs
F-DCCHs
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
Paging
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
19.2k
Sync
Pilot
64 chips
F-FCHs 9.6k
F-FCHs 9.6k
RC4 Voice
November, 2014
F-FCHs 9.6k
RC4 Voice
38,400
sps
Code#
19,200
sps
Code#
9,600
4,800
2,400
sps
F-FCHs 9.6k
RC4 Voice
76,800
sps
38.4k
38.4k
17
Code#
38.4k
38.4k
38.4k
30
11
38.4k
14
38.4k
22
13
38.4k
38.4k
26
38.4k
10
153,600
sps
38.4k
18
F-SCH
153.6 ksps
38.4k
F-SCH
153.6 ksps
38.4k
28
F-SCH
153.6 ksps
38.4k
12
38.4k
20
38.4k
307200
sps
38.4k
24
38.4k
32 chips
38.4k
16
38.4k
Code# 0
Code#
F-SCH 153K RC3

F-SCH
or
ksps RC4
F-SCH307.2
307K
8 chips
Code#
Code#
F-SCH
307.2 ksps
Code#
Code#
RF100 - 196
CDMA Network Architecture
November, 2014
RF100 - 197
Structure of a Typical CDMA System

HLR Home Location Register
(subscriber database)
SUPPORT
FUNCTIONS
BASE STATIONS
Voice Mail System
PSTN
Local Carriers
Long Distance
Carriers
November, 2014
SWITCH
BASE STATION
CONTROLLER
Mobile Telephone
Switching Office
ATM Link
to other CDMA
Networks
(Future)
RF100 - 198
CDMA Network for Circuit-Switched Voice Calls
(C)BSC/Access Manager
Switch
PSTN
t1
t1
SEL
t1
CE
BTS
The first commercial IS-95 CDMA systems provided only circuitswitched voice calls
November, 2014
RF100 - 199
CDMA 1xRTT Voice and Data Network

Internet
VPNs
PDSN
Home Agent
PDSN
Foreign Agent
Backbone
Network
Authentication
Authorization
Accounting
AAA
Switch
PSTN
t1
t1
SEL
t1
CE
BTS
CDMA2000 1xRTT networks added two new capabilities:

channel elements able to generate and carry independent streams of
symbols on the I and Q channels of the QPSK RF signal
this roughly doubles capacity compared to IS-95
a separate IP network implementing packet connections from the mobile
through to the outside internet
including Packet Data Serving Nodes (PDSNs) and a dedicated direct
data connection (the Packet-Radio Interface) to the heart of the BSC
The overall connection speed was still limited by the 1xRTT air interface
November, 2014
RF100 - 200
1xEV-DO Overlaid On Existing 1xRTT Network

Internet
VPNs
PDSN
Home Agent
PDSN
Foreign Agent
Backbone
Network
Authentication
Authorization
Accounting
AAA
DO
Radio
Network
Controller
Switch
CE
PSTN
t1
DO-OMC
t1
SEL
t1
CE
BTS
1xEV-DO requires faster resource management than 1x BSCs can give

this is provided by the new Data Only Radio Network Controller (DO-RNC)
A new controller and packet controller software are needed in the BTS to
manage the radio resources for EV sessions
in some cases dedicated channel elements and even dedicated backhaul is
used for the EV-DO traffic
The new DO-OMC administers the DO-RNC and BTS PCF addition
Existing PDSNs and backbone network are used with minor upgrading
The following sections show Lucent, Motorola, and Nortels specific solutions
November, 2014
RF100 - 201
Voice Call Path through the CDMA Network

MTX
SLM
GPS
BTS
GPS
GPSR
CM
GPSR
BSM
TFU1
DMS-BUS
LPP ENET
BSC-BSM
CDSU
LPP
CDSU
DS0 in T1
CDSU DISCO
Packets
DISCO 1
DISCO 2
CDSU
Ch. Card
Vocoders
Selectors
Vocoder,
Selector
ACC
CDSU
Txcvr
A
Txcvr
B
Txcvr
C
RFFE
A
RFFE
B
RFFE
C
Chips
CDSU
SBS
TFU
CDSU
CDSU
DTCs
IOC
CDSU
Channel
Element
RF
PSTN
November, 2014
RF100 - 202
1x Data Call Path through the CDMA Network

MTX
SLM
GPS
BTS
GPS
GPSR
CM
GPSR
BSM
TFU1
DMS-BUS
LPP ENET
BSC-BSM
LPP
CDSU
CDSU
CDSU
CDSU DISCO
CDSU
Packets
DISCO 1
DISCO 2
CDSU
Ch. Card
IOC
Vocoders
Selectors
R-P
PSTN Interface
Internet
VPNs
November, 2014
Selector
Txcvr
A
Txcvr
B
Txcvr
C
RFFE
A
RFFE
B
RFFE
C
Chips
CDSU
SBS
ACC
CDSU
CDSU
DTCs
TFU
Channel
Elements
RF
(FCH, SCH)
PDSN
RF100 - 203
Telecom Transmission Standards

170 OC-192s
on One Fiber Strand!!
64,512
North American Heirarchy

in Copper Media
~45 Mb/s
DS-3
= 28 DS-1
= 672 DS-0
OC-192 10 Gb/s
32,256
OC-96 5 Gb/s
16,128
OC-48 2.5 Gb/s
8,064
OC-24 1.2 Gb/s
4,032
OC-12 622 Mb/s
2,016
DS-0
OC-3 155 Mb/s

51.84 Mb/s
Worldwide telecom rides

on the standard signal
formats shown at left
Lower speeds are used on
copper twisted pairs or
coaxial cable
Higher speeds are carried
on fiber
Multiplexers bundle and
unbundle channels
Channelized and
unchannelized modes are
provided
OC-1
= 28 DS-1
= 672 DS-0
FIBER
European Heirarchy
in Copper Media
1.544 Mb/s
2.036 Mb/s
DS-1/T-1
E-1
= 24 DS-0
= 28+2 DS-0
64 kb/s
64 kb/s
DS-0
DS-0
November, 2014
RF100 - 204
IS-95 Operational Details

Vocoding, Multiplexing, Power Control
November, 2014
RF100 - 205
Variable Rate Vocoding & Multiplexing

DSP QCELP VOCODER
20ms Sample
Vocoders compress speech, reduce bit
Pitch
rate, greatly increasing capacity
Filter
CDMA uses a superior Variable Rate
Codebook
Vocoder
FeedCoded Result
back Formant
full rate during speech
Filter
low rates in speech pauses
increased capacity
bits
Frame Sizes
more natural sound
192/288
Full Rate Frame
Voice, signaling, and user secondary 96/144 1/2 Rate Frame
data may be mixed in CDMA frames
48/72 1/4 Rt.
24/36
1/8
Frame Contents: can be a mixture of

Primary
Signaling Secondary
Traffic
(System
(On-Air
(Voice or
data)
November, 2014
Messaging)
activation, etc)
RF100 - 206
How Power Control Works

REVERSE LINK POWER ADJUSTMENT
BSC
BTS
Stronger than
setpoint?
Eb/No
Setpoint
Bad FER?
Raise Setpoint
Reverse Link
IS-95, 1xRTT800 Power Control Bits per second!

ALL SAME METHOD
RX RF Digital
Open
Loop Closed
Loop
TX RF Digital
TXPO = -(RXdbm) -C + TXGA
FORWARD LINK POWER ADJUSTMENT

BSC
Voc- Selecoder
tor
Pilot
Sync
Paging
User 1
User 2
User 3
MOBILE
BTS (1 sector)
DGU
Transmitter,
Sector X
I Q
Short PN
Forward Link
Bad Frame
PMRM POWER MEAS. REPORT MSG 2 bad in last 4, Help!! Counter
November, 2014
MOBILE
FEI Bits Mark Bad Frames Received
FEI Bits
POWER CONTROL BITSTREAM RIDING ON MOBILE PILOT
Eb/No
Setpoint
IS-95 RS1
Method
IS-95 RS2
Method
1xRTT
Method
RF100 - 207
Details of Reverse Link Power Control

TXPO Handset Transmit Power
Actual RF power output of the
handset transmitter, including
combined effects of open
loop power control from
receiver AGC and closed
loop power control by BTS
cant exceed handsets
maximum (typ. +23 dBm)
Subscriber Handset
BTS
LNA
DUP
TXPO
Rake
R
IF
LO
Viterbi
Decoder
Open Loop
Closed Loop Pwr Ctrl

I
IF
Long PN
x
IF Mod
x
x
Q
Orth
Mod
Vocoder
FEC
<<Transmitter
Typical TXPO:
+23 dBm in a coverage hole
0 dBm near middle of cell
-50 dBm up close to BTS
C = +73 for 800 MHz. systems

= +76 for 1900 MHz. systems
November, 2014
PA
LO
x
TXPO = -(RXdbm) -C + TXGA
TXGA Transmit Gain Adjust

Sum of all closed-loop
power control commands
from the BTS since the
beginning of this call
Receiver>>
0 dB
Typical Transmit Gain Adjust
-10 dB
-20 dB
Time, Seconds
RF100 - 208
A Quick Introduction to
CDMA Messages and Call Processing
November, 2014
RF100 - 209
Messages in CDMA
In CDMA, most call processing events are driven by messages
Some CDMA channels exist for the sole purpose of carrying
messages; they never carry users voice traffic
Sync Channel (a forward channel)
Paging Channel (a forward channel)
Access Channel (a reverse channel)
On these channels, there are only messages, continuously all
of the time
Some CDMA channels exist just to carry user traffic
Forward Traffic Channel
Reverse Traffic Channel
On these channels, most of the time is filled with traffic and
messages are sent only when there is something to do
All CDMA messages have very similar structure, regardless of the
channel on which they are sent
November, 2014
RF100 - 210
How CDMA Messages are Sent

CDMA messages on both forward
and reverse traffic channels are
normally sent via dim-and-burst
Messages include many fields of
binary data
The first byte of each message
identifies message type: this allows
the recipient to parse the contents
To ensure no messages are
missed, all CDMA messages bear
serial numbers and important
messages contain a bit requesting
acknowledgment
Messages not promptly
acknowledged are retransmitted
several times. If not acknowledged,
the sender may release the call
Field data processing tools capture
and display the messages for study
November, 2014
EXAMPLE:
A POWER MEASUREMENT
REPORT MESSAGE
Length
(in bits)
Field
MSG_TYPE (00000110)
ACK_SEQ
MSG_SEQ
ACK_REQ
ENCRYPTION
ERRORS_DETECTED
POWER_MEAS_FRAMES
10
LAST_HDM_SEQ
NUM_PILOTS
NUM_PILOTS occurrences of this field:

PILOT_STRENGTH
RESERVED (0s)
6
0-7
RF100 - 211
Message Vocabulary: Acquisition & Idle States

Pilot Channel
Sync Channel
No Messages
Sync Channel Msg
Paging Channel
BTS
Access Channel
Registration Msg
Access Parameters Msg
General Page Msg
System Parameters Msg
Order Msg
CDMA Channel List Msg
Base Station Acknowledgment

Lock until Power-Cycled
Maintenance required
many others..
Mobile Station Acknowldgment

Long Code Transition Request
SSD Update Confirmation
many others..
Extended System
Parameters Msg
Channel Assignment
Msg
Origination Msg
Extended Neighbor
List Msg
Feature Notification Msg
Page Response Msg
Global Service
Redirection Msg
Authentication
Challenge Msg
Authentication Challenge
Response Msg
Service Redirection Msg
Status Request Msg
Status Response Msg
SSD Update Msg
TMSI Assignment Msg
TMSI Assignment
Completion Message
Null Msg
Data Burst Msg
November, 2014
Order Msg
Data Burst Msg
RF100 - 212
Message Vocabulary: Conversation State

Forward Traffic Channel
Order Msg
Base Station Acknowledgment
Base Station Challenge
Confirmation
Message Encryption Mode
Alert With
Information Msg
Reverse Traffic Channel
Service Request Msg
Service Request Msg
Origination
Continuation Msg
Authentication
Challenge Msg
Service Response Msg
Service Response Msg
Authentication Challenge
Response Msg
TMSI Assignment Msg
Service Connect Msg
Service Connect
Completion Message
TMSI Assignment
Completion Message
Send Burst DTMF Msg
Service Option
Control Msg
Service Option Control

Message
Send Burst DTMF Msg
Set Parameters Msg
Status Request Msg
Status Response Msg
Parameters Response
Message
Power Control
Parameters Msg.
Flash With
Information Msg
Flash With
Information Msg
Power Measurement
Report Msg
Retrieve Parameters Msg
Data Burst Msg
Data Burst Message
Order Message
Analog Handoff
Direction Msg
Extended Handoff
Direction Msg
Pilot Strength
Measurement Msg
SSD Update Msg
Neighbor List
Update Msg
Handoff Completion Msg
Mobile Station
Registered Msg
In-Traffic System
Parameters Msg
November, 2014
Mobile Sta. Acknowledgment

Long Code Transition
Request
SSD Update Confirmation
Connect
RF100 - 213
A Streamlined Visual Tour

Of CDMA Call Processing
November, 2014
RF100 - 214
Traffic Correlator
PN xxx Walsh xx
Traffic Correlator
PN xxx Walsh xx
AGC
Duplexer
RF
Open Loop
RF
Transmitter
RF Section
November, 2014
bits
time-aligned
Receiver
RF Section
IF, Detector
control
Traffic Correlator
PN xxx Walsh xx
power
Chips
Digital
Rake Receiver Symbols
Traffic Correlator
PN xxx Walsh xx
summing
Whats In a Handset? How does it work?
Symbols
Viterbi Decoder,
Convl. Decoder,
Demultiplexer
Packets
Audio
Messages
Pilot Searcher
PN xxx Walsh 0
CPU
Vocoder
Transmit Gain Adjust

Transmitter
Digital Section
Audio
Messages
Long Code Gen.

RF100 - 215
Let's Acquire The System!
November, 2014
RF100 - 216
1. Find the Strongest Pilot!

PN 168
BTS
W0
PILOT
TIME
#2 unassigned
#3 unassigned
#4 unassigned
Pilot Searcher
SCAN
Find Strongest
Rake Receiver
#1 unassigned
Ec/Io
The pilot searcher of the phone spends about 3.4 seconds measuring the
pilot strength at every possible PN delay, in miniscule 1/8 chip delay steps,
to see how much energy is being received from every nearby sector
The sector with the strongest pilot is chosen
0
Pilot Searcher Scans the Entire Range of PNs
-20
Chips 0
PN 0
November, 2014
32K
512
RF100 - 217
2. Read the Sync Channel Message

PN 168
BTS
The Sync Channel is a

Sesame Street for mobiles!
W32
SYNC
W0
PILOT
SYN SYN SYN SYN SYN SYN SYN SYN SYN SYN SYN SYN SYN SYN SYN SYNSYN
Rake Receiver
#1 PN168+0 W32
#3 PN168+9 W32
#4 PN168+5 W32
Pilot Searcher
Stay Locked!
#2 PN168+2 W32
Read Sync Ch. Msg
TIME
Great! We found a signal. Now we know:

The strongest pilot available
The exact timing of this pilot
We do NOT yet know
This pilots PN offset
20 msec frame timing of channels
Long Code State
The SYNC channel is a special channel timed
exactly in step with the short PN sequence
It tells us all these unknown quantities
November, 2014
SYNC CHANNEL MESSAGE

MSG_LENGTH, 28, 28 octets
MSG_TYPE, 1, Sync Channel Message
P_REV, 6, IS-2000 Revision 0
MIN_P_REV, 1, J-STD-008
SID 995,
NID 3,
PILOT_PN 168
LC_STATE, 0x00 25 93 12 7C FA,
SYS_TIME, 0x02 20 34 B7 53,
10/23/2001 11:02:54
LP_SEC, 13,
LTM_OFF, 54, -660 minutes
DAYLT, 1, Yes
PRAT, 1, 4800 bps
CDMA_FREQ, 274 (IS-95)
EXT_CDMA_FREQ, 274 (1xRTT)
SR1_BCCH_SUPPORTED, 0
SR3_INCL, 0, No
RESERVED, 0,
RF100 - 218
3. The Timing Shift: Adjust all Internal Clocks

PN 168
End of SCH
SuperFrame
BTS
W32
SYNC
W0
PILOT
Ref Time
TIME
+320 ms
Rake Receiver
#1 unassigned
#3 unassigned
Pilot Searcher
-PN
168
The
Timing
Change
#4 unassigned
Stay Locked!
#2 unassigned
This timeline shows each step as the mobile acquires the system
First search all PNs to find the strongest pilot
Read the Sync Channel Message to learn times and LC state
The times and state refer to a future moment 320 ms after the end of the
Sync Channel superframe, minus the BTS PN offset. This waiting period
is called the Timing Change.
November, 2014
RF100 - 219
4. Is This the Right System to Use?

Scan the PRL for Anything Better
November, 2014
SID
4144
4812
205
208
208
342
342
478
1038
1050
1058
1375
1385
143
143
4103
4157
312
444
444
1008
1012
1014
1688
113
113
179
179
465
2119
2094
1005
1013
ACQUISITION TABLE
NEG/
NID PREF
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
65535 Pref
GEO
NEW
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
NEW
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
SAME
a GEO GROUP
Its not enough just to find a

CDMA signal
We want the CDMA
signal of our own system
or a favorite roaming
partner
Phones look in the PRL to
see if there is a more
preferred signal than
whatever they find first
They check frequencies
in the Acquisition Table
until they find the best
system, or look down the
list level by level
INDEX
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
a GEO GROUP
Roaming List Type:

IS-683A
Preferred Only:
FALSE
Default Roaming Indicator:
0
Preferred List ID:
10018
SYSTEM TABLE
Climb!
ROAMING LIST
ACQ ROAM
PRI INDEX IND
SAME 13
1
MORE 21
1
SAME
4
0
MORE 37
0
SAME
4
0
MORE 37
0
SAME
4
0
SAME
4
0
SAME
4
0
SAME
4
0
SAME
4
0
SAME
4
0
MORE
4
0
MORE 37
0
MORE
4
0
SAME
3
1
MORE
2
1
SAME
4
0
MORE 37
0
SAME
4
0
SAME
4
0
SAME
4
0
SAME
4
0
MORE
4
0
MORE 37
0
SAME
4
0
MORE 37
0
SAME
4
0
SAME
4
0
MORE
4
0
MORE
4
0
SAME
4
0
SAME
4
0
INDEX ACQ TYPE

0
6
1
6
2
6
3
6
4
1
5
6
6
6
7
6
8
6
9
6
10
6
11
6
12
6
13
6
14
6
15
6
16
6
17
6
18
6
19
6
20
6
21
6
22
6
23
6
24
6
25
6
26
6
27
1
28
1
29
5
30
5
31
5
32
5
33
5
34
5
35
4
36
4
37
4
38
6
39
6
40
6
41
6
42
6
43
6
44
6
45
6
46
6
CH1
500
575
50
25
Both
450
675
250
550
75
200
425
500
500
650
25
425
200
825
350
750
325
1150
350
25
50
500
A
B
A
B
C
D
E
F
A
B
Both
350
25
675
850
650
450
325
150
1025
CH2
425
625
100
200
CH3
825
500
75
350
CH4
575
425
475
375
CH5 CH6 CH7 CH8 CH9

850 325 625
500
500
50
375
50
250
500
575
625
500
50
550
50
850
325
725
725
1175
875
1175
200
1075
350
600
175
425
175
175
575
475
350
675
375
225
175
925
375
775
350
575
575
650
475
625
250
50
25
25
50
25
350
725
375
325
675
375
75
250
750
250
325
825
25
850
375 1175
200 75 175 250
100 250 75
825
825
100
600
750
850 1175 775
825
725
850 175 250

50 475 175 250
650
775 575 725 425
425 50 575
175
775
675
25
1175 725 600 100
750
375
775 425 575 625
475
350 375 1025 1050 1075
475 625 675
1050 1075
PRL: Preferred Roaming List

Programmed into each phone by the system
operator; can be updated over the air.
RF100 - 220
5. Collect the Configuration Messages!

Collect all the Configuration Messages
(all config.messages are repeated every 1.28 sec)
PN 168
BTS
W1 PAGING
ACK SYS ChASN CHN XSYS NBR ChASN GSRM APM ACK GPAG ACK
W32
SYNC
W0
PILOT
Ref Time
TIME
Access
Parameters
Message
Global Service
** Redirection
Message
Neighbor
** List
Message
Pilot Searcher
Extended
System
Parameters
Message
#4 PN168+5 W1
** CDMA
Channel
List Message
#3 PN168+9 W1
Stay Locked!
#2 PN168+2 W1
System
Parameters
Message
Rake Receiver
#1 PN168+0 W1
Collect all the Configuration Messages

Absorb and store all their parameters.
The Configuration Messages tell the mobile everything it needs to know to

successfully operate on the system
Access Parameters Message (how to behave on the access channel)
System Parameters Message (registration, handoff, window settings)
Extended System Parameters Message (how to identify; packet details)
Channel List Message (list of all carrier frequencies on this sector)
Neighbor List Message (list of nearby sectors to watch out for)
Global Service Redirection Message (dont stay here - go over there)
November, 2014
RF100 - 221
6. Welcome! Just Monitor the Paging Channel

PN 168
BTS
W1 PAGING
ACK SYS ChASN CHN XSYS NBR ChASN GSRM APM ACK GPAG ACK
W32
SYNC
W0
PILOT
Ref Time
TIME
Now monitor the
Paging Channel
for any
incoming calls
or messages
Rake Receiver
#1 PN168+0 W1
#2 PN168+2 W1
#3 PN168+9 W1
#4 PN168+5 W1
Pilot Searcher
Listen to see if you get any incoming calls or short messages!
November, 2014
RF100 - 222
Registration: Mobile, Sign In Please
BTS
W1
PAGING KSAKX KPCKGKSAKXPNKPPCKGKSAKXPNKPPCKGKSAKXPNKPPCKGSAKXPNGKSAKXPNKGKSAKXPG

NSA
W32
SYNC SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
W0
PILOT
TIME
ACCESS CHANNEL
R
20 sec.
20 seconds after system acquisition, the mobile
sends a Registration Message on the access
channel.
The BTS sends an ACK

on the Paging Channel.
The mobile is now
Registered and can begin
slotted mode paging.
After acquiring the system, the mobile must register

This allows the current system to update the HLR with the mobiles
location, so incoming calls can be delivered here
It also allows the mobile to tell the system if it wants to do slotted
mode paging, and if so, what Slot Cycle Index.
A holdoff timer delays initial registration 20 seconds after acquisition
This avoids needless registration by mobiles just being turned on to
check who is the owner, or other short power-on/off uses
Registration has many different controlling parameters, all declared by the
system on the paging channel in the System Parameters Message
November, 2014
RF100 - 223
Stretch Your Battery! IS-95 Slotted Mode Paging
BTS
W1
Mobile listens during its slot, every cycle

NSA
PAGING KGKSAKKGCKGKSAKXPNKPPCKGKSAKXPNKPPCKGKSGKXPNKPPCKGSAKXPNGKSAKXPNKGKSAKXPG
W32
W0
PILOT
TIME
Rake Receiver
#1 PN168+0 W1
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 1 2 3 4 5
#3 PN168+9 W1
#4 PN168+5 W1
1 Slot Cycle
1 Slot Cycle
#2 PN168+2 W1
Battery
Drain
1 Slot
80 ms
Pilot Searcher
Slotted Mode Paging is a battery-saving trick

After registering with the system, the mobile
goes into sleep mode with low battery drain
It wakes on a schedule to listen for pages
Page slots are 80 ms. Long
Slot cycles can be set to many lengths
Longer cycles give better battery life, but introduce
longer possible delays in call delivery
Each mobile uses Hashing with its IMSI and SCI
to determine which slot it should always monitor
November, 2014
Each mobile has a preferred SCI

programmed by the vendor. The system
also declares a maximum slot cycle
index, which mobiles may not exceed.
Slot Cycle
Index (SCI)
Number Slots
in Cycle
Length of
Cycle, sec.
16
1.28 sec.
32
2.56 sec.
64
5.12 sec.
128
10.24 sec.
256
20.48 sec.
512
40.96 sec.
1024
81.92 sec.
2048
163.84 sec.
RF100 - 224
Even Better: CDMA2000 Slotted Mode Paging

Using the Quick Paging Channel (QPCH)
W1
BTS
Mobile listens to PCH only when QPCH requires

NSA
PAGING KGKSAKKGCKGKSAKXPNKPPCKGKSAKXPNKPPCKGKSGKXPNKPPCKGSAKXPNGKSAKXPNKGKSAKXPG
W48
QPCH
W32
W0
PILOT
TIME
Rake Receiver
#1 PN168+0 W1
#2 PN168+2 W1
#3 PN168+9 W1
#4 PN168+5 W1
Paging Channel Slots

Paging Channel Slots
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 1 2 3 4 5
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0 1 2 3 4 5 6
Battery
Drain
QPCH Slots
QPCH Slots
Pilot Searcher
IS-95 mobiles must monitor their PCH

slots during every slot cycle
Must wake up 1000s of times per
hour and run high-drain message
parsers, even if they are not paged
The Quick Paging Channel (QPCH) is a
simpler bitstream which notifies a 1xRTT
mobile to monitor the PCH, only when a
page is coming for its IMSI group
There are at least xx IMSI groups. A
mobile knows its group by hashing.
November, 2014
Mobile hashes using its IMSI to

recognize which indicator bits it should
monitor. If the bits are on, the mobile
wakes up and listen to the next PCH
slot somebody watching those bits
will be paged.
PCH SLOT
GenPG
QPCH SLOT
20
ms
80 ms
80 ms
100 ms
RF100 - 225
Idle Mode Handoff

An idle mobile always uses the best available signal
In idle mode, it isnt possible to do soft handoff and listen to multiple
sectors or base stations at the same time -- the paging channel
information stream is different on each sector, not synchronous -- just
like ABC, NBC, CBS, and CNN TV news programs arent in word-sync
for simultaneous viewing
Since a mobile cant combine signals, the mobile must switch quickly,
always enjoying the best available signal
The mobiles pilot searcher is constantly checking neighbor pilots
A Mobile might change pilots for either of two reasons:
It notices another pilot at least 3 db stronger than the current active
pilot, and it stays this good continuously for at least five seconds:
mobile switches at end of the next superframe
Mobile loses the current paging channel. If another signal is better
than the old active sector, change immediately to the new one.
On the new paging channel, if the mobile learns that registration is
required, it re-registers on the new sector
November, 2014
RF100 - 226
Ec/Io
Idle Mode on the Paging Channel:

Meet the Neighbors, track the Strongest Pilot
All PN Offsets
-20
SRCH_WIN_A
Chips 0
PN 0
F1 PN168 W01
Active Pilot
Rake Fingers
SRCH_WIN_N
Reference PN
32K
512
Mobile Rake RX
F2 PN168 W01
F3 PN168 W01
Srch PN??? W0
The phones pilot searcher constantly checks

the pilots listed in the Neighbor List Message
Neighbor Set
If the searcher ever notices a neighbor pilot substantially stronger than

the current reference pilot, it becomes the new reference pilot
and the phone switches over to its paging channel on the next superframe.
This is called an idle mode handoff.
November, 2014
RF100 - 227
Receiving An Incoming Call
November, 2014
RF100 - 228
Incoming Call Termination Voice

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
W23 TRAFFIC
W1 PAGING KGGenPag
KS
PCGKSPKGACKKPC CHasn KPNKPPCKGKSGKXPNKPPCKGSAKXPNGKSAKXPNKGKSAKXPG
NSAGSAKXPNGKSAK
W32
BTS
W0
SYNC S SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
PILOT
TIME
ACCESS
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
RF100 - 229
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
W23 TRAFFIC
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
RF100 - 230
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
W23 TRAFFIC
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
Im here! What
should I do?
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
RF100 - 231
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
W23 TRAFFIC
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
Im here! What
should I do?
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
RF100 - 232
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
W23 TRAFFIC
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
Im here! What
should I do?
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
RF100 - 233
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
Im here! What
should I do?
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
RF100 - 234
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
Im here! What
should I do?
I see
frames!
#4 PN168+5 W23
Pilot Searcher
RF100 - 235
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
I see
frames!
W23 TRAFFIC
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
Im here! What
should I do?
I see
frames!
#4 PN168+5 W23
Pilot Searcher
RF100 - 236
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
Im here! What
should I do?
I see
frames!
#4 PN168+5 W23
Pilot Searcher
RF100 - 237
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
ACK
Im here! What
should I do?
I see
frames!
I see you,
too!
#4 PN168+5 W23
Pilot Searcher
RF100 - 238
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
SVCcon
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
ACK
Im here! What
should I do?
I see
frames!
I see you,
too!
#4 PN168+5 W23
Pilot Searcher
RF100 - 239
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
SVCcon
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
ACK
Im here! What
should I do?
I see
frames!
I see you,
too!
SVCncmp
I accept.
#4 PN168+5 W23
Pilot Searcher
RF100 - 240
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
OK! Then start

ringing and
show this:
615-300-0124
SVCcon
Alert/Inf
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
ACK
Im here! What
should I do?
I see
frames!
I see you,
too!
SVCncmp
I accept.
#4 PN168+5 W23
Pilot Searcher
RF100 - 241
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
OK! Then start

ringing and
show this:
615-300-0124
SVCcon
Alert/Inf
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
ACK
Im here! What
should I do?
I see
frames!
I see you,
too!
SVCncmp
I accept.
ACK
I am.
#4 PN168+5 W23
Pilot Searcher
RF100 - 242
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
OK! Then start

ringing and
show this:
615-300-0124
SVCcon
Alert/Inf
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
ACK
Im here! What
should I do?
I see
frames!
I see you,
too!
SVCncmp
I accept.
#4 PN168+5 W23
I am.
My owner answered!
Connect the audio.
SEND
Pilot Searcher
RF100 - 243
ACK Con
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
Scotts mobile,
are you there?
You have a call.
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
OK! Then start

ringing and
show this:
615-300-0124
SVCcon
OK.
Alert/Inf
ACK V
W1 PAGING KGGenPag
KS
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
PgResp
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
ACK
Im here! What
should I do?
I see
frames!
I see you,
too!
SVCncmp
I accept.
#4 PN168+5 W23
I am.
My owner answered!
Connect the audio.
SEND
Pilot Searcher
RF100 - 244
ACK Con
November, 2014
Making an Outgoing Call!
November, 2014
RF100 - 245
Outgoing Call Origination IS-95 Voice

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
W23 TRAFFIC
W1 PAGING KGKSPCGGPCGKSPKGACKKPC CHasn KPNKPPCKGKSGKXPNKPPCKGSAKXPNGKSAKXPNKGKSAKXPG
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
RF100 - 246
The mobile user dials,

Then presses SEND.
6 1 5 5 5 5 1 2 3 4
SEND
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
W23 TRAFFIC
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
RF100 - 247
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
6 1 5 5 5 5 1 2 3 4
SEND
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
I hear you.
Just a moment.
W23 TRAFFIC
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
RF100 - 248
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
6 1 5 5 5 5 1 2 3 4
SEND
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
I hear you.
Just a moment.
W23 TRAFFIC
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
RF100 - 249
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
6 1 5 5 5 5 1 2 3 4
SEND
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W01
#2 PN168+2 W01
#3 PN168+9 W01
#4 PN168+5 W01
Pilot Searcher
RF100 - 250
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
6 1 5 5 5 5 1 2 3 4
SEND
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
RF100 - 251
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
6 1 5 5 5 5 1 2 3 4
SEND
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
I see
frames!
W23 TRAFFIC
NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
RF100 - 252
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
6 1 5 5 5 5 1 2 3 4
SEND
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK

NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
RF100 - 253
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
6 1 5 5 5 5 1 2 3 4
SEND
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK

NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
RF100 - 254
ACK
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
I see you,
too!
6 1 5 5 5 5 1 2 3 4
SEND
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
SVCcon

NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
RF100 - 255
ACK
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
I see you,
too!
6 1 5 5 5 5 1 2 3 4
SEND
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
SVCcon

NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
RF100 - 256
ACK
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
I see you,
too!
SVCncmp
I accept.
6 1 5 5 5 5 1 2 3 4
SEND
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
SVCcon
OK!
ACK

NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
RF100 - 257
ACK
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
I see you,
too!
SVCncmp
I accept.
6 1 5 5 5 5 1 2 3 4
SEND
November, 2014

MSC
HLR
BSC
BTS A
VLR
SS7
PSTN
switch
I hear you.
Just a moment.
Your channel
Is ready!
Walsh 23
W23 TRAFFIC
I see
frames!
I see you!
ACK
Then lets use

Service Option
X, for voice
with 8k EVRC
SVCcon
OK!
ACK
Voice conversation

NSAGSAKXPNGKSAK
W32
BTS
W0
PILOT
TIME
ACCESS
Origination
TRAFFIC
Rake Receiver
#1 PN168+0 W23
#2 PN168+2 W23
#3 PN168+9 W23
#4 PN168+5 W23
Pilot Searcher
RF100 - 258
ACK
Hey system! I am
615-300-0124,
ESN 2E5FC31. Let me
call 615-555-1234
using EVRC voice.
I see
frames!
I see you,
too!
SVCncmp
Voice conversation
I accept.
6 1 5 5 5 5 1 2 3 4
SEND
November, 2014
Downloading Data on a
Forward Link Supplemental Channel
November, 2014
RF100 - 259
Forward Supplemental Channel Assignment

Mobile: Watch
Walsh Code 2
Starting in 320 ms
For 1000 ms.
PN 168
BTS
W2
F-SCH
W23
F-FCH
Mobile: Watch
Walsh Code 2
Starting in 320 ms
For 1000 ms.
Supplemental
Channel Burst
ESCAM
Supplemental
Channel Burst
ESCAM
W1
PAGING KGKSAKKNKGGKSKPG
NSASPPCKGKSAKGKSAKKNKGGKSKPG
NSASPPCK
W32
SYNC SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
W0
PILOT
TIME
ACCESS CHANNEL
R-FCH
November, 2014
RF100 - 260
Uploading Data on a
Reverse Link Supplemental Channel
November, 2014
RF100 - 261
Reverse Supplemental Channel Assignment

Mobile: Send
Walsh Code 1
Starting in 320 ms
For 1000 ms.
F-FCH
W23
PN 168
BTS
Mobile: Send
Walsh Code 1
Starting in 320 ms
For 1000 ms.
ESCAM
ESCAM
W1
NSASPPCK
W32
PILOT
W0
TIME
ACCESS CHANNEL
R-FCH
SCRM
Supplemental
Channel Burst
R-SCH
System: I need to
Send you the
Following blocks:
November, 2014
SCRM
Supplemental
Channel Burst
System: I need to
Send you the
Following blocks:
RF100 - 262
Ending A Call
November, 2014
RF100 - 263
Normal End of Call

W23
BTS
TRAFFIC
Voice
RELnorm
W1
NSASPPCKGKSA
ACK SYS ChASN CHN XSYS NBR
W32
SYNC SSSSSSSSSSSSSSSSSSSSSSSSSSS
SYN SYN SYN SYN SYN SYN SYN SYN SYN
W0
SCAN Ref Time
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
MOBILE REACQUIRES SYSTEM NORMALLY

Voice
RELnoRsn
When a call ends normally, it is because the caller on one side of the
conversation decided to hang up
The side ending the call sends a Release Normal order
The other side sends a Release No reason order
It may send an acknowledgment first, if it cannot give the release
order immediately
After the system receives a release order from the mobile, it releases the
resources it used for the call
After the mobile receives a release order from the base station, it stops
listening to the traffic channel and freshly reacquires the system
November, 2014
RF100 - 264
Abnormal End of Call Forward Link Failure

W23
BTS
TRAFFIC
Voice
5s timer
All bad frames
W1
NSASPPCKGKSA
ACK SYS ChASN CHN XSYS
W32
SYNC SSSSSSSSSSSSSSSSSSSSSSSSSSS
SYN SYN SYN SYN SYN SYN SYN SYN
W0
SCAN Ref Time
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
MOBILE REACQUIRES SYSTEM, if available

Voice
Mute! No pc
5s timer
The mobile is always counting and tracking the bad frames it

receives on the forward link
Forward Link Fade Timer: If the mobile does not receive any good
frames during a 5-second period, it aborts the call
If a mobile receives 10 consecutive bad frames, it mutes its
transmitter until at least 2 consecutive good frames are heard
If the mobile stays muted 5 seconds, the BTS will release too
After a call ends for any reason, the mobile tries to reacquire the
system, making an independent cold start
November, 2014
RF100 - 265
Abnormal End of Call Reverse Link Failure

W23
BTS
TRAFFIC
Voice
RELnoRsn
W1
NSASPPCKGKSAAKSKPG
NSAS
ACK SYS ChASN CHN XSYS
W32
SYNC SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
SYN SYN SYN SYN SYN SYN SYN SYN
W0
SCAN Ref Time
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
MOBILE REACQUIRES SYSTEM, if available

Voice
All bad frames

5s timer
The BTS is always counting and tracking the bad frames it

receives on the reverse link from the mobile
Reverse Link Fade Timer: If the BTS does not receive any good
frames during a 5-second period, it releases the call
After a call ends for any reason, the mobile tries to reacquire the
system, making an independent cold start
November, 2014
RF100 - 266
Feature Notification:
You Have Voicemail!
November, 2014
RF100 - 267
Feature Notification
FEATURE NOTIFICATION MESSAGE
98/06/30 21:16:44.368 [PCH] Feature Notification Message
MSG_LENGTH = 144 bits
MSG_TYPE = Feature Notification Message
ACK_SEQ = 0
MSG_SEQ = 0
ACK_REQ = 1
VALID_ACK = 0
ADDR_TYPE = IMSI
ADDR_LEN = 56 bits
IMSI_CLASS = 0
IMSI_CLASS_0_TYPE = 3
RESERVED = 0
MCC = 302
IMSI_11_12 = 00
IMSI_S = 9055170325
RELEASE = 0
RECORD_TYPE = Message Waiting
RECORD_LEN = 8 bits
MSG_COUNT = 1
RESERVED = 0
The Feature Notification Message on

the Paging Channel tells a specific
mobile it has voice messages waiting.
There are other record types to notify
the mobile of other features.
MOBILE STATION ACKNOWLEDGMENT

The mobile confirms it has received the
notification by sending a Mobile Station
Acknowledgment Order on the access
channel.
November, 2014
RF100 - 268
CDMA Handset Architecture

CDMA Handoffs
November, 2014
RF100 - 269
Traffic Correlator
PN xxx Walsh xx
Traffic Correlator
PN xxx Walsh xx
AGC
Duplexer
RF
Open Loop
RF
Transmitter
RF Section
November, 2014
bits
time-aligned
Receiver
RF Section
IF, Detector
control
Traffic Correlator
PN xxx Walsh xx
power
Chips
Digital
Rake Receiver Symbols
Traffic Correlator
PN xxx Walsh xx
summing
Whats In a Handset? How does it work?
Symbols
Viterbi Decoder,
Convl. Decoder,
Demultiplexer
Packets
Audio
Messages
Pilot Searcher
PN xxx Walsh 0
CPU
Vocoder
Transmit Gain Adjust

Transmitter
Digital Section
Audio
Messages
Long Code Gen.

RF100 - 270
The Rake Receiver

Handset
RF
BTS
BTS
Rake Receiver
PN Walsh
PN
Walsh
PN
Walsh
Searcher
PN
W=0
Voice,
Data,
Messages
Pilot Ec/Io
Every frame, handset uses combined outputs of the three traffic

correlators (rake fingers)
Each finger can independently recover a particular PN offset and
Walsh code
Fingers can be targeted on delayed multipath reflections, or even on
different BTSs
Searcher continuously checks pilots
November, 2014
RF100 - 271
CDMA Soft Handoff Mechanics

Switch BSC
Handset
Sel.
RF
BTS
BTS
Rake Receiver
PN Walsh
PN
Walsh
PN
Walsh
Searcher
PN
W=0
Voice,
Data,
Messages
Pilot Ec/Io
CDMA soft handoff is driven by the handset

Handset continuously checks available pilots
Handset tells system pilots it currently sees
System assigns sectors (up to 6 max.), tells handset
Handset assigns its fingers accordingly
All messages sent by dim-and-burst, no muting!
Each end of the link chooses what works best, on a frame-by-frame
basis!
Users are totally unaware of handoff
November, 2014
RF100 - 272
The Complete Rules of Soft Handoff

IS-95B/
1xRTT
PILOT SETS
Active
6 6
Candidate 5 10
Neighbor 20 40
Remaining
HANDOFF
PARAMETERS
T_ADD
T_DROP
T_TDROP
T_COMP
Exercise: How does a pilot

in one set migrate into
another set, for all cases?
Identify the trigger, and the
messages involved.
RF100 - 273
# Reqd`. By Std.
November, 2014
IS-95/
J-Std008
The Handset considers pilots in sets

Active: pilots of sectors actually in use
Candidates: pilots mobile requested, but
not yet set up & transmitting by system
Neighbors: pilots told to mobile by system,
as nearby sectors to check
Remaining: any pilots used by system but
not already in the other sets (div. by PILOT_INC)
Handset sends Pilot Strength Measurement
Message to the system whenever:
It notices a pilot in neighbor or remaining set
exceeds T_ADD
An active set pilot drops below T_DROP for
T_TDROP time
A candidate pilot exceeds an active by
T_COMP
The System may set up all requested handoffs,
or it may apply special manufacturer-specific
screening criteria and only authorize some
Softer Handoff
Handset
Switch BSC
Sel.
BTS
RF
Rake Receiver
PN Walsh
PN
Walsh
PN
Walsh
Searcher
PN
W=0
Voice,
Data,
Messages
Pilot Ec/Io
Each BTS sector has unique PN offset & pilot

Handset will ask for whatever pilots it wants
If multiple sectors of one BTS simultaneously serve a handset, this is
called Softer Handoff
Handset cant tell the difference, but softer handoff occurs in BTS in
a single channel element
Handset can even use combination soft-softer handoff on multiple
BTS & sectors
November, 2014
RF100 - 274
What is Ec/Io?
Ec/Io is the measurement mobiles
use to gauge strengths of the various
Handset Receiver
nearby sectors they encounter
Rake
LNA
IF
R
Ec means the energy per chip of
x
R
the pilot of the observed sector

R
BW
BW
~30
1.25
LO
Io means the total power currently
S
MHz.
MHz.
being picked up by the mobile
RX Level
(from AGC)
Why cant the mobile just measure the signal strength of a sector
directly with its receiver?
all sectors are on the same frequency
the measurable signal strength on that frequency is just the
sum of all the individual signal powers
to distinguish them individually CDMA decoding must be used
Each sector dedicates 10-15% of its power to a steady test signal
called the pilot. Mobiles can easily measure the pilot of a sector,
determining its strength as a percentage of total received power
November, 2014
RF100 - 275
How Ec/Io Varies with Traffic Loading
November, 2014
Ec/Io = (2/4)
= 50%
= -3 db.
Paging
Sync
Pilot
1.5w
0.5w
2w
EC
I0
Heavily Loaded
Ec/Io = (2/10)
= 20%
= -7 db.
Traffic Channels
Each sector transmits a certain

amount of power, the sum of:
pilot, sync, and paging
any traffic channels in use
at that moment
Ec/Io is the ratio of pilot power
to total power
On a sector with nobody
talking, Ec/Io is typically
about 50%, which is -3 db
On a sector with maximum
traffic, Ec/Io is typically
about 20%, which is -7 db.
Light Traffic Loading
Paging
Sync
Pilot
6w
I0
1.5w
0.5w
2w
EC
RF100 - 276
How Ec/Io varies with RF Environment
Io = -90 dbm
Ec = -96 dbm
Ec/Io = -6 db
Traffic
Channels
In a clean situation, one

sector is dominant and the
mobile enjoys an Ec/Io just
as good as it was when
transmitted
In pilot pollution, too many
sectors overlap and the
mobile hears a soup made
up of all their signals
Io is the power sum of all
the signals reaching the
mobile
Ec is the energy of a
single sectors pilot
The large Io overrides the
weak Ec; Ec/Io is low!
One Sector Dominant
Paging
Sync
Pilot
I0
1.5w
0.5w
2w
EC
Many Sectors, Nobody Dominant
Io = 10 signals
each -90 dbm
= -80 dbm
Ec of any one
sector = -96
Ec/Io = -16 db
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
Traffic
Sync & Paging
Pilot
November, 2014
4w
BTS10
BTS9
BTS8
BTS7
BTS6
BTS5
I0
BTS4
BTS3
BTS2
BTS1
EC
RF100 - 277
A Soft Handoff
November, 2014
RF100 - 278
Basic Soft/Softer Handoff

BTS A
BSC
BTSC
ctrl
BTS B
I hear you.
Hang on
PN 344
BTS
PN 168
BTS
BTSC
OK! You can use:

PN 168 W23
PN 344 W41
OK
OK. Heres your new

Neighbor list:
PN164 PN172 PN340
PN420 PN084 PN132
PN434 PN504 PN016
PN028 PN508 PN372
W41
TRAFFIC
W1
PAGING
GGKSKPG
NSASPPCK
W32
SYNC
SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS
W0
PILOT
W23
TRAFFIC
EHDM
ACK
ACK
EHDM
ACK
NLum
NLum
W1
NSASPPCK
W32
W0
PILOT
TIME
ACCESS CHANNEL
TRAFFIC CHANNEL
PSMM
ACK
HOcomp
ACK
Rake Receiver
#1 PN344+0 W41
!!
#2 PN344+3 W41
#3 PN168+2 W23
#4 PN168+5 W23
Wow! PN344
is above
T_ADD!
Hey system! I want:

PN168 (ref), -6, keep
PN344, -11, keep
OK
Great! Im using
PN168 + PN344
OK
Pilot Searcher
November, 2014
RF100 - 279
Ec/Io
Handoff Example
All PN Offsets
-20
Chips
10752
PN 0
14080
32002
168 220
Active Pilot
Mobile Rake RX
F1 PN168 W61
F2 PN168 W61
Rake Fingers
F3 PN168 W61
Srch PN??? W0
Reference PN
T_ADD
500 512
The call is already in progress.

PN 168 is the only active signal,
and also is our timing reference.
Continue checking the neighbors.
Neighbor Set
If we ever notice a neighbor with Ec/Io above T_ADD,

ask to use it! Send a Pilot Strength Measurement Message!
November, 2014
32K
RF100 - 280
Ec/Io
Handoff Now In Effect, but still check Pilots!

All PN Offsets
-20
Chips
10752
PN 0
14080
168 220
Mobile Rake RX
F1 PN168 W61
F2 PN500 W50
F3 PN220 W20
32002
Active Set
Rake Fingers
500 512
T_DROP
Srch PN??? W0
Reference PN
Neighbor Set
T_ADD
Continue checking each ACTIVE pilot. If any are less than T_DROP and remain
so for T_TDROP time, send Pilot Strength Measurement Message, DROP IT!!
Continue looking at each NEIGHBOR pilot. If any ever rises above T_ADD, send
Pilot Strength Measurement Message, ADD IT!
November, 2014
32K
RF100 - 281
Ec/Io
The Complete Picture of Handoff & Pilot Sets

All PN Offsets
-20
Chips 0
PN 0
Rake Fingers
SRCH_WIN_A
T_DROP
T_ADD
SRCH_WIN_A
Pilots of sectors
now used for
communication
Reference PN
Candidate Set
SRCH_WIN_N
Pilots requested
by mobile but not
set up by system
November, 2014
32K
512
Active Set
T_DROP
Mobile Rake RX
F1 PN168 W61
F2 PN500 W50
F3 PN220 W20
Srch PN??? W0
Neighbor Set
Pilots suggested
by system for
more checking
Remaining Set
T_ADD
All other pilots divisible by PILOT_INC but not

presently in Active, Candidate, or Neighbor sets
SRCH_WIN_R
RF100 - 282
CDMA Call Processing
November, 2014
RF100 - 283
CDMA Troubleshooting is like Air Accident Investigation

Control & Parameters
11500
Layers
Wireless Protocol Stack

4
3
Application
Message
Data Link Layer
114.50
118.25
130.75
Messaging
11500
Aeronautical
Investigations
Flight Data Recorder
Cockpit Voice Recorder
CDMA
Investigations
LAC
MAC
Physical Layer
BTS
Temporal Analyzer Data
Layer 3 Message Files
Air accidents are big news and reporters follow the investigations closely
Everybodys familiar with the two main information sources at the crash
Cockpit voice recorder: record of conversation and sounds in the
cockpit during the last 30 minutes up to the crash
Flight data recorder: record of major control settings, mechanical,
electrical, and hydraulic systems status for the last 30 minutes
In CDMA, the same sorts of tools are available for problem investigation:
Layer-3 message files contain user and system command/control details
Temporal analyzer data shows the RF environment up to the problem
November, 2014
RF100 - 284
Troubleshooting Call Processing

CDMA call processing is complex!
Calls are a relationship between mobile and system
the events driven by messaging
the channels carried by RF transmission
Multiple codes and channels available for use
Multiple possible problems - physical, configuration, software
Multiple concurrent processes in the mobile and the system
Troubleshooting focuses on the desired call events
What is the desired sequence of events?
Compare the actual sequence of events.
Whats missing or wrong? Why did it happen?
Messaging is a major blow-by-blow troubleshooting tool
RF indications reveal the transmission risks and the channel
configurations
Bottom Line: To troubleshoot effectively, youve got to know call
processing steps and details AND the RF basis of the transmission
November, 2014
RF100 - 285
The Key Features

and Structure of 1xEV-DO
November, 2014
RF100 - 286
Channel Structure of 1xEV-DO vs. 1xRTT

CHANNEL STRUCTURE
IS-95 and 1xRTT
many simultaneous users, each
with steady forward and reverse
traffic channels
transmissions arranged,
requested, confirmed by layer-3
messages with some delay
1xEV-DO -- Very Different:
Forward Link goes to one user at a
time like TDMA!
users are rapidly time-multiplexed,
each receives fair share of
available sector time
instant preference given to user
with ideal receiving conditions, to
maximize average throughput
transmissions arranged and
requested via steady MAC-layer
walsh streams very immediate!
November, 2014
IS-95 AND 1xRTT

Many users simultaneous forward
and reverse traffic channels
ATs
W0
W32
W1
W17
W25
W41
F-SCH
W3
F-FCH4
W53
BTS
1xEV-DO
(Access Terminals)
PILOT
SYNC
PAGING
F-FCH1
F-FCH2
F-FCH3
AP
(Access Point)
1xEV-DO Forward Link
AP
RF100 - 287
Power Management of 1xEV-DO vs. 1xRTT

TO MAINTAIN USER FER
Maximum Sector Transmit Power
power
8
7
5
4
2
User 1
PAGING
SYNC
PILOT
time
1xEV-DO: MAX POWER ALWAYS,

DATA RATE OPTIMIZED
power
POWER MANAGEMENT
IS-95 and 1xRTT:
sectors adjust each users
channel power to maintain a
preset target FER
1xEV-DO IS-856:
sectors always operate at
maximum power
sector output is timemultiplexed, with only one
user served at any instant
The transmission data rate is
set to the maximum speed
the user can receive at that
moment
IS-95: VARIABLE POWER
time
November, 2014
RF100 - 288
Some EV-DO Terminology

IS-95, IS-2000, 1xRTT
Phone,
Mobile,
Handset, or
Subscriber
Terminal
Base Station,
BTS,
Cell Site
November, 2014
EV-DO
AT
Access
Terminal
AP
Access
Point
RF100 - 289
1xEV-DO Technical Details

Data Flow and Channels
November, 2014
RF100 - 290
1xEV-DO Transmission Timing

Forward Link
All members of the CDMA family - IS-95, IS-95B,

1xRTT, 1xEV-DO and 1xEV-DV transmit
Frames
IS-95, IS-95B, 1xRTT frames are usually 20
ms. long
1xEV-DO frames are 26-2/3 ms. long
same length as the short PN code
each 1xEV-DO frame is divided into
1/16ths, called slots
The Slot is the basic timing unit of 1xEV-DO
forward link transmission
Each slot is directed toward somebody and
holds a subpacket of information for them
Some slots are used to carry the control
channel for everyone to hear; most slots are
intended for individual users or private groups
Users dont own long continuing series of slots
like in TDMA or GSM; instead, each slot or small
string of slots is dynamically addressed to
whoever needs it at the moment
RF100 - 291
One Cycle of PN Short Code
One 1xEV-DO Frame
One Slot
November, 2014
Whats In a Slot?
400 chips
64 96
64 400 chips
400 chips
64 96
MAC
DATA
PILOT
DATA
Slot 1024 chips
MAC
MAC
DATA
PILOT
SLOT
MAC
Slot 1024 chips
DATA
64 400 chips
The main cargo in a slot is the DATA being sent to a user

But all users need to get continuous timing and administrative
information, even when all the slots are going to somebody else
Twice in every slot there is regularly-scheduled burst of timing and
administrative information for everyone to use
MAC (Media Access Control) information such as power
control bits
a burst of pure Pilot
allows new mobiles to acquire the cell and decide to use it
keeps existing user mobiles exactly on sector time
mobiles use it to decide which sector should send them
their next forward link packet
RF100 - 292
November, 2014
What if theres No Data to Send?
400 chips
64 96
64 400 chips
400 chips
64 96
MAC
empty
PILOT
empty
Slot 1024 chips
MAC
MAC
empty
PILOT
SLOT
MAC
Slot 1024 chips
empty
64 400 chips
Sometimes there may be no data waiting to be sent on a sectors

forward link
When theres no data to transmit on a slot, transmitting can be
suspended during the data portions of that slot
But---the MAC and PILOT must be transmitted!!
New and existing mobiles on this sector and surrounding
sectors need to monitor the relative strength of all the sectors
and decide which one to use next, so they need the pilot
Mobiles TRANSMITTING data to the sector on the reverse link
need power control bits
So MAC and PILOT are always transmitted, even in an empty
slot
RF100 - 293
November, 2014
Slots and Frames
400 chips
64 96
64 400 chips
DATA
400 chips
64 96
MAC
DATA
PILOT
Slot 1024 chips
MAC
MAC
DATA
PILOT
SLOT
MAC
Slot 1024 chips
DATA
64 400 chips
Slot
FRAME
1 Frame = 16 slots 32k chips 26-2/3 ms
Two Half-Slots make a Slot

16 Slots make a frame
RF100 - 294
November, 2014
Frames and Control Channel Cycles

A Control Channel Cycle is 16 frames (thats 426-2/3 ms, about 1/2
second)
The first half of the first frame has all of its slots reserved for possible use
carrying Control Channel packets
The last half of the first frame, and all of the remaining 15 frames, have
their slots available for ordinary use transmitting subpackets to users
Slot
FRAME
CONTROL
CHANNEL
USER(S) DATA CHANNEL
16-FRAME
CONTROL CHANNEL
CYCLE
16 Frames 524k chips 426-2/3 ms
Thats a lot of slots!

16 x 16 = 256
RF100 - 295
November, 2014
Forward Link Frame and Slot Structure:

Big Picture Summary
400 chips
64 96
64 400 chips
DATA
400 chips
64 96
MAC
DATA
PILOT
Slot 1024 chips
MAC
MAC
DATA
PILOT
SLOT
MAC
Slot 1024 chips
DATA
64 400 chips
FRAME
CONTROL
CHANNEL
USER(S) DATA CHANNEL
16-FRAME
CONTROL CHANNEL
CYCLE
16 Frames 524k chips 426-2/3 ms
Slots make Frames and Frames make Control Channel Cycles!

Shorter Control Channel Cycles can be used for fast setup (PTT)
RF100 - 296
November, 2014
Reverse Link Frame and Slot Structure:

Big Picture Summary
Slot 1024 chips
SLOT
Slot 1024 chips
DATA
FRAME
1 Subframe
holds
1 Subpacket
Subframe
Subframe
Subframe
Reverse Link frames are the same length as forward link frames
The mobile does not include separate MAC and Pilot bursts
Its MAC and pilot functions are carried inside its signal by
simultaneous walsh codes
There is no need for slots for dedicated control purposes since the
mobile can transmit on the access channel whenever it needs to
RF100 - 297
November, 2014
Rev. A Reverse Channel Sub-Frame Structure

RRI
DATA CHANNEL
DRC CHANNEL
ACK
DSC
ACK
DSC
ACK
DSC
ACK
DSC
AUXILIARY PILOT CHANNEL

PILOT CHANNEL
1 Slot
1 Slot
1 Slot
1 Slot
1 Sub-Frame
The mobile transmits sub-packets occupying four reverse link

slots, called a reverse link sub-frame.
If multiple subpackets are required to deliver a packet, the
additional subpackets are spaced in every third subframe until
done
RF100 - 298
November, 2014
EV-DO Rev. A Channels

REVERSE CHANNELS
W064 Pilot
Pilot
W016
Data
W24
ACCESS
64
DRCLock
RPC
ARQ
MAC
Wx16 Control
Primary Pilot
W016
Auxiliary Pilot
W2832
RRI
DRC
DSC
W416
W816
W1232
ACK
W1232
Data
W12
MAC
Wx16 Traffic
Walsh
code
FORWARD
Public or Private
Long PN offset
MAC
W264 Rev Activity
Access
Access
Point
(AP)
just like IS-95
FORWARD CHANNELS
Long PN offset
Sector has a Short PN Offset
IN THE WORLD OF CODES

Access Channel
for session setup
from Idle Mode
Access
Terminal
(User
Terminal)
Traffic Channel
as used during
a data session
Walsh
code
The channels are not continuous like ordinary 1xRTT CDMA

Notice the differences between the MAC channels and the Rev. 0
MAC channels these are the heart of the Rev. 0/A differences
RF100 - 299
November, 2014
Functions of Rev. A Forward Channels

FORWARD
CHANNELS
just like IS-95
Access
Point
(AP)
Access terminals watch the Pilot to select the

strongest sector and choose burst speeds
W064 Pilot
W264 Rev Activity
MAC
Sector has a Short PN Offset
64
DRCLock
RPC
ARQ
MAC
Wx16 Traffic
Walsh
code
The Reverse Activity Channel tells

ATs If the reverse link loading is too
high, requiring rate reduction
Each connected AT has MAC channel:
DRCLock indication if sector busy
RPC (Reverse Power Control)
ARQ to halt reverse link subpackets as
soon as complete packet is recovered
Wx16 Control
Traffic channels
carry user data to
one user at a time
The Control channel carries

overhead messages for idle ATs but
can also carry user traffic
400 chips
RF100 - 300
64 96
64 400 chips
Slot 1024 chips
400 chips
MAC
DATA
PILOT
DATA
MAC
MAC
DATA
PILOT
Forward Link Slot Structure (16 slots in a 26-2/3 ms. frame)

MAC
AP
DATA
64 96
64 400 chips
Slot 1024 chips
November, 2014
Functions of Rev. A Reverse Channels

The Pilot is used as a preamble
during access probes
Data
W24
ACCESS
W016
Auxiliary Pilot
W2832
RRI
DRC
DSC
W416
W816
W1232
ACK
W1232
Data
W12
MAC
RRI reverse rate indicator tells AP

what rate is being sent by AT
DRC Data Rate Control channel
tells desired downlink speed
Public or Private
Primary Pilot
Access Channel
for session setup
from Idle Mode
Long PN offset
Auxiliary Pilot on traffic channel

allows synchronous detection
during high data rates
W016
Access
Primary Pilot on traffic channel

allows synchronous detection and
also carries the RRI channel
Pilot
Long PN offset
Data channel during access

carries mobile requests
REVERSE CHANNELS
Access
Terminal
(User
Terminal)
Traffic Channel
as used during
a data session
Walsh
code
DSC Data Source Control channel

tells which sector will send burst
ACK channel allows AT to signal
successful reception of a packet
RF100 - 301
DATA channel during traffic

carries the ATs traffic bits
November, 2014
Rev. A MAC Index Values and Their Uses

MAC INDEX
MAC CHANNEL USE
0, 1
Not Used
2
Not Used
3
Not Used
4
RA Channel
5
RPC, DRC LOCK, ARQ
64 and 65
Not Used
66
Not Used
67
Not Used
68
Not Used
69
Not Used
70
Not Used
71
Not Used
6-63 and 72-127 RPC, DRC LOCK, ARQ
PREAMBLE USE
Not Used
Control 76.8 kbps
Control 38.4 kbps
Not Used
Fwd TC if no Bcst
Not Used
Multi-User 128, 256, 512, 1024
Multi-User 2048
Multi-user 3072
Multi-User 4096
Multi-User 5120
Control 19.2, 38.4, 76.8
Fwd TC, Single User
PREAMBLE LENGTH
N/A
512
1024
N/A
Variable
N/A
256
128
64
64
64
1024
Variable
114 MAC indices are available for regular single-user packets

3 MAC indices are earmarked for control channel packets
5 MAC indices are reserved for multi-user packets
1 MAC index is reserved for broadcast packets, or single-users
4 MAC indices are not used due to conflicts with multiplexing patterns
November, 2014
RF100 - 302
Rev. A MAC Index and I/Q Channel Contents
RF100 - 303
November, 2014
Available Link Rates in 1xEV-DO Rev. A

FORWARD LINK
DRC
Index Slots
0x0 n/a
0x1 16
0x2
8
0x3
4
0x4
2
0x5
4
0x6
1
0x7
2
0x8
2
0x9
1
0xa
2
0xb
1
0xc
1
0xd
2
0xe
1
Modu- Preamble Payload Raw

C/I
lation
Chips
Bits
kb/s
db
QPSK
n/a
0
null rate
n/a
QPSK
1024
1024
38.4
-11.5
QPSK
512
1024
76.8
-9.2
QPSK
256
1024
153.6
-6.5
QPSK
128
1024
307.2
-3.5
QPSK
128
2048
307.2
-3.5
QPSK
64
1024
614.4
-0.6
QPSK
64
2048
614.4
-0.5
QPSK
64
3072
921.6
+2.2
QPSK
64
2048 1,228.8
+3.9
16QAM
64
4096 1,228.8
+4.0
8PSK
64
3072 1,843.2
+8.0
16QAM
64
4096 2,457.6 +10.3
16QAM
64
5120 1,536.0
+8.3
16QAM
64
5120 3,072.0 +11.3
REVERSE LINK
Payload Modu-Effective Rate kbps after: Code Rate (repetition) after
Bits lation 4 slots 8 slots 12 slots16 slots 4 slots 8 slots 12 slots16 slots
128
B4 19.2 9.6
6.4
4.8
1/5
1/5
1/5
1/5
256
B4
38 19.2 12.8 9.6
1/5
1/5
1/5
1/5
512
B4
76 38.4 25.6 19.2 1/4
1/5
1/5
1/5
768
B4
115 57.6 38.4 28.8 3/8
1/5
1/5
1/5
1024
B4
153 76.8 51.2 38.4 1/2
1/4
1/5
1/5
1536
Q4 230 115 76.8 57.6 3/8
1/5
1/5
1/5
2048
Q4 307 153 102.4 76.8 1/2
1/4
1/5
1/5
3072
Q2 461 230 153.6 115.2 3/8
1/5
1/5
1/5
4096
Q2 614 307 204.8 153.6 1/2
1/4
1/5
1/5
6144 Q4Q2 921 461 307 230.4 1/2
1/4
1/5
1/5
8192 Q4Q2 1228 614 409 307.2 2/3
1/3
2/9
1/5
12288 E4E2 1843 921 614 460.8 2/3
1/3
1/3
1/3
The 1xEV-DO Rev. A reverse link has seven available modes

offering higher speeds than available in Rev. 0
Modulation formats are hybrids defined in the standard
The 1xEV-DO Rev. A forward has two available modes offering
higher speeds than available in Rev. 0.
November, 2014
RF100 - 304
1xEV-DO Technical Details

Data Flow and Channels
November, 2014
RF100 - 305
Information Flow Over 1xEV-DO

Data Ready
Data from PDSN for the Mobile
DRC: 5
MP3, web page, or other content
AP
The system notifies a mobile when data for it is waiting to be sent

The mobile chooses which sector it hears best at that instant, and requests
the sector to send it a packet
there are 16 possible transmission formats the mobile may request, called
DRC Indices. Each DRC Index value is really a combined specification
including specific values for:
what data speed will be transmitted
how big a chunk of waiting data will be sent (that amount of data will be
cut of the front of the waiting data stream and will be the Packet
transmitted)
what kind of encoding will be done to protect the data (3x Turbo, 5x
Turbo, etc.) and the symbol repetition, if any
after the symbols are formed, how many SUBpackets they will be
divided into
Then, the sector starts transmitting the SUBpackets in SLOTS on the
forward link
The first slot will begin with a header that the mobile will recognize so it can
begin the receiving process
RF100 - 306
November, 2014
Transmission of a Packet over EV-DO

Data Ready
AP
A user has initiated a1xEV-DO data session on their AT,

accessing a favorite website.
The requested page has just been received by the PDSN.
The PDSN and Radio Network Controller send a Data Ready
message to let the AT know it has data waiting.
RF100 - 307
November, 2014


A user has initiated a1xEV-DO data session on their AT, accessing
a favorite website.
The requested page has just been received by the PDSN.
The PDSN and Radio Network Controller send a Data Ready
message to let the AT know it has data waiting.
The AT quickly determines which of its active sectors is the
strongest. On the ATs DRC channel it asks that sector to send it
a packet at speed DRC Index 5.
The mobiles choice, DRC Index 5, determines everything:
The raw bit speed is 307.2 kb/s.
The packet will have 2048 bits.
There will be 4 subpackets (in slots 4 apart).
The first subpacket will begin with a 128 chip preamble.
RF100 - 308
Data Ready
DRC: 5
AP
DRC
Index
0x0
0x1
0x2
0x3
0x4
0x5
0x6
0x7
0x8
0x9
0xa
0xb
0xc
0xd
0xe
Slots Modulation
n/a
16
8
4
2
4
1
2
2
1
2
1
1
2
1
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
16QAM
8PSK
16QAM
16QAM
16QAM
Preamble
Chips
n/a
1024
512
256
128
128
64
64
64
64
64
64
64
64
64
Payload
Bits
0
1024
1024
1024
1024
2048
1024
2048
3072
2048
4096
3072
4096
5120
5120
Raw
kb/s
null rate
38.4
76.8
153.6
307.2
307.2
614.4
614.4
921.6
1,228.8
1,228.8
1,843.2
2,457.6
1,536.0
3,072.0
November, 2014
C/I
db
n/a
-11.5
-9.2
-6.5
-3.5
-3.5
-0.6
-0.5
+2.2
+3.9
+4.0
+8.0
+10.3
in Rev. A
in Rev. A

PACKET
DRC: 5

2048 bits
Using the specifications for the
mobiles requested DRC index,
the correct-size packet of bits is
fed into the turbo coder and the
right number of symbols are
created.
RF100 - 309
Turbo Coder
+
+
+
+
+
Interleaver
Symbols
Data Ready
+
+ +
+
+ +
AP
DRC
Index
0x0
0x1
0x2
0x3
0x4
0x5
0x6
0x7
0x8
0x9
0xa
0xb
0xc
0xd
0xe
Slots Modulation
n/a
16
8
4
2
4
1
2
2
1
2
1
1
2
1
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
16QAM
8PSK
16QAM
16QAM
16QAM
Preamble
Chips
n/a
1024
512
256
128
128
64
64
64
64
64
64
64
64
64
Payload
Bits
0
1024
1024
1024
1024
2048
1024
2048
3072
2048
4096
3072
4096
5120
5120
Raw
kb/s
null rate
38.4
76.8
153.6
307.2
307.2
614.4
614.4
921.6
1,228.8
1,228.8
1,843.2
2,457.6
1,536.0
3,072.0
November, 2014
C/I
db
n/a
-11.5
-9.2
-6.5
-3.5
-3.5
-0.6
-0.5
+2.2
+3.9
+4.0
+8.0
+10.3
in Rev. A
in Rev. A

PACKET
DRC: 5

2048 bits
created.
To guard against bursty errors in
transmission, the symbols are
completely stirred up in a block
interleaver.
RF100 - 310
Data Ready
Turbo Coder
+
+
+
+
+
Interleaver
+
+ +
+
+ +
Symbols
Block Interleaver
AP
DRC
Index
0x0
0x1
0x2
0x3
0x4
0x5
0x6
0x7
0x8
0x9
0xa
0xb
0xc
0xd
0xe
Slots Modulation
n/a
16
8
4
2
4
1
2
2
1
2
1
1
2
1
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
16QAM
8PSK
16QAM
16QAM
16QAM
Preamble
Chips
n/a
1024
512
256
128
128
64
64
64
64
64
64
64
64
64
Payload
Bits
0
1024
1024
1024
1024
2048
1024
2048
3072
2048
4096
3072
4096
5120
5120
Raw
kb/s
null rate
38.4
76.8
153.6
307.2
307.2
614.4
614.4
921.6
1,228.8
1,228.8
1,843.2
2,457.6
1,536.0
3,072.0
November, 2014
C/I
db
n/a
-11.5
-9.2
-6.5
-3.5
-3.5
-0.6
-0.5
+2.2
+3.9
+4.0
+8.0
+10.3
in Rev. A
in Rev. A

PACKET
DRC: 5

2048 bits
created.
interleaver.
Turbo Coder
+
+
+
+
+
Interleaver
+
+ +
+
+ +
Symbols
Block Interleaver
The re-ordered stream of

symbols is now ready to transmit.
Interleaved Symbols
RF100 - 311
Data Ready
AP
DRC
Index
0x0
0x1
0x2
0x3
0x4
0x5
0x6
0x7
0x8
0x9
0xa
0xb
0xc
0xd
0xe
Slots Modulation
n/a
16
8
4
2
4
1
2
2
1
2
1
1
2
1
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
16QAM
8PSK
16QAM
16QAM
16QAM
Preamble
Chips
n/a
1024
512
256
128
128
64
64
64
64
64
64
64
64
64
Payload
Bits
0
1024
1024
1024
1024
2048
1024
2048
3072
2048
4096
3072
4096
5120
5120
Raw
kb/s
null rate
38.4
76.8
153.6
307.2
307.2
614.4
614.4
921.6
1,228.8
1,228.8
1,843.2
2,457.6
1,536.0
3,072.0
November, 2014
C/I
db
n/a
-11.5
-9.2
-6.5
-3.5
-3.5
-0.6
-0.5
+2.2
+3.9
+4.0
+8.0
+10.3
in Rev. A
in Rev. A

PACKET
Data Ready
DRC: 5
AP
2048 bits
Turbo Coder
+
+
+
+ +
D
D
D
+
+
+
+
+
+ +
D
D
D
+
+
created.
Symbols
Block Interleaver
interleaver.
The re-ordered stream of
symbols is now ready to transmit.
The symbols are divided into the
correct number of subpackets,
which will occupy the same
Interleaved Symbols
number of transmission slots,
spaced four apart.
Its up to the AP to decide when it
will start transmitting the stream,
taking into account any other
pending subpackets for other
users, and proportional
fairness.
DRC
Index
0x0
0x1
0x2
0x3
0x4
0x5
0x6
0x7
0x8
0x9
0xa
0xb
0xc
0xd
0xe
RF100 - 312
n/a
16
8
4
2
4
1
2
2
1
2
1
1
2
1
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
16QAM
8PSK
16QAM
16QAM
16QAM
Preamble
Chips
n/a
1024
512
256
128
128
64
64
64
64
64
64
64
64
64
Payload
Bits
0
1024
1024
1024
1024
2048
1024
2048
3072
2048
4096
3072
4096
5120
5120
Raw
kb/s
null rate
38.4
76.8
153.6
307.2
307.2
614.4
614.4
921.6
1,228.8
1,228.8
1,843.2
2,457.6
1,536.0
3,072.0
Subpacket 4
Subpacket 3
Subpacket 2
Subpacket 1
Interleaver
Slots Modulation
November, 2014
C/I
db
n/a
-11.5
-9.2
-6.5
-3.5
-3.5
-0.6
-0.5
+2.2
+3.9
+4.0
+8.0
+10.3
in Rev. A
in Rev. A

PACKET
Data Ready
DRC: 5
AP
2048 bits
Turbo Coder
When the AP is ready, the first
subpacket is actually
+
+
+
+ +
D
D
D
+
transmitted in a slot.
+
+
+
The first subpacket begins with a
+
+ +
D
D
D
+
preamble carrying the users
+
MAC index, so the user
Symbols
knows this is the start of its
sequence of subpackets,
and how many subpackets
Block Interleaver
are in the sequence..
The user keeps collecting
subpackets until either:
1)
it has been able to reverseturbo decode the packet
contents early, or
Interleaved Symbols
2)
the whole schedule of
subpackets has been
transmitted.
Interleaver
DRC
Index
0x0
0x1
0x2
0x3
0x4
0x5
0x6
0x7
0x8
0x9
0xa
0xb
0xc
0xd
0xe
Slots Modulation
n/a
16
8
4
2
4
1
2
2
1
2
1
1
2
1
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
QPSK
16QAM
8PSK
16QAM
16QAM
16QAM
Preamble
Chips
n/a
1024
512
256
128
128
64
64
64
64
64
64
64
64
64
Payload
Bits
0
1024
1024
1024
1024
2048
1024
2048
3072
2048
4096
3072
4096
5120
5120
Raw
kb/s
null rate
38.4
76.8
153.6
307.2
307.2
614.4
614.4
921.6
1,228.8
1,228.8
1,843.2
2,457.6
1,536.0
3,072.0
Subpackets
1
SLOTS
RF100 - 313
November, 2014
C/I
db
n/a
-11.5
-9.2
-6.5
-3.5
-3.5
-0.6
-0.5
+2.2
+3.9
+4.0
+8.0
+10.3
in Rev. A
in Rev. A
1xEV-DO Network Architecture
November, 2014
RF100 - 314
CDMA Network for Circuit-Switched Voice Calls
Switch
PSTN
t1
t1
SEL
t1
CE
BTS
The first commercial IS-95 CDMA systems provided only circuitswitched voice calls
November, 2014
RF100 - 315
CDMA 1xRTT Voice and Data Network

Internet
VPNs
PDSN
Home Agent
PDSN
Foreign Agent
Backbone
Network
Authentication
Authorization
Accounting
AAA
Switch
PSTN
t1
t1
SEL
t1
CE
BTS
CDMA2000 1xRTT networks added two new capabilities:

channel elements able to generate and carry independent streams of
symbols on the I and Q channels of the QPSK RF signal
this roughly doubles capacity compared to IS-95
a separate IP network implementing packet connections from the mobile
through to the outside internet
including Packet Data Serving Nodes (PDSNs) and a dedicated direct
data connection (the Packet-Radio Interface) to the heart of the BSC
The overall connection speed was still limited by the 1xRTT air interface
November, 2014
RF100 - 316
1xEV-DO Overlaid On Existing 1xRTT Network

Internet
VPNs
PDSN
Home Agent
PDSN
Foreign Agent
Backbone
Network
Authentication
Authorization
Accounting
AAA
DO
Radio
Network
Controller
Switch
CE
PSTN
t1
DO-OMC
t1
SEL
t1
CE
BTS
1xEV-DO requires faster resource management than 1x BSCs can give

this is provided by the new Data Only Radio Network Controller (DO-RNC)
A new controller and packet controller software are needed in the BTS to
manage the radio resources for EV sessions
in some cases dedicated channel elements and even dedicated backhaul is
used for the EV-DO traffic
The new DO-OMC administers the DO-RNC and BTS PCF addition
Existing PDSNs and backbone network are used with minor upgrading
The following sections show Lucent, Motorola, and Nortels specific solutions
November, 2014
RF100 - 317
Technical Introduction to GSM,

GPRS/EDGE, and UMTS/WCDMA/HSPA
RF100 - 318
November, 2014
Largest US Wireless Providers YE 2012
Cellular
800
PCS
1900
AWS
1700/2100
700
109
CDMA
EVDO
LTE
LTE
103
GSM
UMTS
HSPA
56
CDMA
EVDO
34
GSM
HSPA+
Regional
12
November, 2014
Bands and Technologies
Subs (M)
National
333M total
CDMA
EVDO
Other
MVNOs and
Affiliated Companies
LTE
WiMAX
LTE-TDD
IDEN
CDMA
EVDO
LTE
11
CDMA
EVDO
LTE
CDMA
EVDO
LTE
CDMA
EVDO
LTE
CDMA
EVDO
LTE
RF100 - 319
The US CDMA Providers
National
196M total
Subs (M)

Cellular
800
PCS
1900
AWS
1700/2100
700
109
CDMA
EVDO
LTE
LTE
Regional
12
November, 2014
WiMAX
LTE-TDD
IDEN
CDMA
EVDO
56
CDMA
EVDO
Other
MVNOs and
CDMA
EVDO
LTE
11
CDMA
EVDO
LTE
CDMA
EVDO
LTE
CDMA
EVDO
LTE
CDMA
EVDO
LTE
RF100 - 320
The US GSM Providers

Subs (M)
National
137M total
Cellular
800
PCS
1900
103
GSM
UMTS
HSPA
700
Other
MVNOs and
LTE
GSM
HSPA+
Regional
34
AWS
1700/2100
November, 2014
RF100 - 321
GSM: The Mother of

2G Wireless Technologies
RF100 - 322
November, 2014
The Birth of GSM

In 1983, The US had just implemented its analog cellular systems,
using the AMPS technology Advanced Mobile Phone Service
Developed by AT&T Bell Labs, with Motorola contributions
Europe preferred to leapfrog to a digital technology, standardized
so it could be implemented internationally on a wide scale
The ETSI Group Special Mobile (GSM) developed the standard,
which bears its initials, in 1982
Today marketed as Global System for Mobile communication
GSM was field-tested in 1986, a memorandum of understanding
signed in 1988, and commercially launched in 1991
By 1995 coverage of most of Europe was complete
Today there are more than 5 billion GSM users in 212 countries
worldwide, about 80% of the global mobile market.
RF100 - 323
November, 2014
The Frequencies Used by GSM

GSM operates in a wide variety of frequency bands worldwide
Spectrum is provided in blocks or bands
Base stations transmit in the upper block
Mobiles transmit in the lower block
GSM carriers are normally operated 200 KHz. apart but
frequencies are numbered in 100 KHz. Increments within the
operators licensed block of spectrum
GSM/GPRS/EDGE/UMTS-WCDMA/HSPA signals operate on
numbered frequencies.
The channel numbers are unique, in other words, the same
numbers are not used in more than one band and the uplink
and downlink frequencies have different channel numbers
Channel numbers are officially called Absolute Radio
Frequency Channel Numbers (ARFCNs) and there is a handy
lookup utility on the website:
http://niviuk.free.fr/lte_band.php
RF100 - 324
November, 2014
Structure of a GSM Signal

GSM is a TDMA system with
carriers spaced 200 kHz. apart
In the BTS downlink signal, different
timeslots belong to different users a mobile listens only to its own
recurring timeslots
During unused timeslots, a
mobile can measure the signal
strength of surrounding BTSs to
guide the handover process
On its uplink, a mobile transmits
only during its assigned timeslots
Mobiles transmit only during
their own timeslots
Mobile transmit timeslots occur
three timeslots after the
corresponding BTS transmit
timeslot
This avoids the need for
simultaneous mobile TX/RX
and a mobile duplexer
RF100 - 325
Slots
Required
C/I 9-12 dB
1
4
200 kHz
2
3
Typical Frequency Reuse N=4
Downlink
3 slots
BTS
Uplink
November, 2014
GSM On Radio: Time Division Multiple Access:

GSM Uplink and Downlink Frequencies and Timing
Uplink
Downlink
Mobile Transmit
Base Station Transmit
H
G
E
BCCH
Frequency
3 slots
Frequency
RF100 - 326
H
G
A voice user
B voice user
C voice user
D voice user
E voice user
F voice user
G voice user
H voice user
November, 2014
Multiple Carriers in a GSM Cell

Frequency 6
Frequency 5
Frequency 4
Frequency 3
Frequency 2
Frequency 1
TS1
TS1
TS1
TS1
TS1
TS1
TS2
TS2
TS2
TS2
TS2
TS2
Time
TS3
TS4
TS5
TS6
TS3
TS4
TS5
TS6
TS3
TS4
TS5
TS6
TS3
TS4
TS5
TS6
TS3
TS4
TS5
TS6
TS3
TS4
TS5
TS6
1 timeslot 577 s
1 frame 4.615 ms
TS7
TS7
TS7
TS7
TS7
TS7
TS8
TS8
TS8
TS8
TS8
TS8
A GSM base station transceiver makes a signal ~240 kHz. wide

The signal is time-divided into a repeating pattern of frames
Each frame is 60/13 = 4.615 ms long, there are ~221.5 frames per second
Each frame is further subdivided into 8 timeslots, each 15/26 ms = 577 s long
A timeslot can hold the bits of a channel of information
One users voice signal, or a signaling/administrative channel
One GSM base station can have several transceivers, each one producing a
GSM signal on a different frequency - six carriers in the example above
Various repeating patterns of information can use the timeslots to carry
channels of information
RF100 - 327
November, 2014
Channels in GSM: Repeating Patterns

Channels of information in GSM occupy physical timeslots of the GSM
signal in repeating patterns
Similar to the way that classes and activities of a university occupy the
physical classrooms on a defined schedule
Some classes meet daily, some only three days a week
Some labs once or twice a week
Meals daily in the cafeteria, entertainment at night
Graduation ceremonies each semester
Dedicated channels (carrying traffic or control information for individual
users) occur in a repeating 26-multiframe pattern 120 ms long
24 frames are used for traffic, one for SACH, one is unused
Full-rates occur in each traffic frame
Half-rates (if used) occur in alternating traffic frames
1/8 rate dedicated channels are defined for special purposes and are
called SDCHs (Stand-Alone Dedicated Control Channels)
RF100 - 328
November, 2014
GSM Traffic Channels:
Hyperframes, Superframes, Multiframes, Frames, and Bursts

One Hyperframe
1
One
Superframe
One
Frame
2044 2045 2046 2047
51 multiframes of 26 frames each
SACH
0 1 2 3 4 5 6 7 8 9
6.120 s
47
26 frames
49
50
Used for traffic channels and

associated signaling only
120 ms
BP 0 BP 1 BP 2 BP 3 BP 4 BP 5 BP 6 BP 7
1 frame
60/13 ms ~4.615 ms
Tail Bits
Stealing
Bit
Data Bits
57 bits
Stealing
Bit
Training
Sequence
1
26 bits
One Burst (156.25 bits)

Data Bits
57 bits
Gross Rate 270.833 kbps
RF100 - 329
48
UNUSED
25
24
23
22
21
20
19
18
17
16
15
14
13
12
11
10
One 26
Multiframe
3h 28m 53.760s
Tail Bits
2048 superframes
Guard
Bits
8.25 bits
15/26 ms
~0.577 ms
November, 2014
GSM Control Channels:
Hyperframes, Superframes, Multiframes, Frames, and Bursts

One Hyperframe
1
2044 2045 2046 2047
26 multiframes of 51frames each
One
Superframe
1 2 3 4 5 6 7 8 9
6.120 s
24
CCH 1
CCH3 or CCH4 or
SDCH
SDCH
CCH 2
51 frames
One
Frame
1 frame
Tail Bits
57 bits
Used for control channels only
Stealing
Bit
Training
Sequence
1
26 bits
One Burst (156.25 bits)

Data Bits
57 bits
Gross Rate 270.833 kbps
RF100 - 330
CCH6 or CCH7 or
SACH
SACH
60/13 ms ~4.615 ms
Stealing
Bit
CCH5 or CCH5 or
SDCH
SDCH
235.38 ms
BP 0 BP 1 BP 2 BP 3 BP 4 BP 5 BP 6 BP 7
Data Bits
25
not used 50
49
48
47
46
45
44
43
42
SCH 41
FCH 40
39
38
37
36
35
34
33
32
SCH 31
FCH 30
29
28
27
26
25
24
23
22
SCH 21
FCH 20
19
18
17
16
15
14
13
12
11
10
CCH0 or
SYS_INFO
7&8
SCH
FCH
BCH 4
BCH 3
BCH 2
BCH 1
SCH
FCH
One 51 0
Multiframe
3h 28m 53.760s
Tail Bits
2048 superframes
Guard
Bits
8.25 bits
15/26 ms
~0.577 ms
November, 2014
Typical Timeslot Allocation in Multiframe Patterns

on One GSM RF Carrier
TIME
T
C
H
TimeSlot
2
T
C
H
Frame
Number
1
0
1
1
1
2
T T T T T T T T T T T T
C C C C C C C C C C C C
H H H H H H H H H H H H
IDLE
1
3
2
5
1
4
1
5
1
6
1
7
1
8
1
9
2
0
2
1
2
2
2
3
2
4
26 Multiframe Pattern for Traffic Channels
1
0
1
1
1
2
1
3
2
5
1
4
1
5
1
6
1
7
1
8
1
9
2
0
2
1
2
2
2
3
2
4
26 Multiframe Pattern for Traffic Channels
S
D
C
C
H
0
S
D
C
C
H
0
S
D
C
C
H
1
S
D
C
C
H
1
S
D
C
C
H
1
S
D
C
C
H
1
S
D
C
C
H
2
S
D
C
C
H
2
S
D
C
C
H
2
S
D
C
C
H
3
S
D
C
C
H
3
S
D
C
C
H
4
S
D
C
C
H
4
S
D
C
C
H
4
S
D
C
C
H
4
S
D
C
C
H
5
S
D
C
C
H
5
S
D
C
C
H
5
S
D
C
C
H
5
S
D
C
C
H
6
S
D
C
C
H
6
S
D
C
C
H
6
S
D
C
C
H
6
S
D
C
C
H
7
S
D
C
C
H
7
S
A
C
C
H
0
S
A
C
C
H
0
S
A
C
C
H
0
S
A
C
C
H
1
S
A
C
C
H
1
S
A
C
C
H
1
S
A
C
C
H
1
S
A
C
C
H
2
S
A
C
C
H
3
S
A
C
C
H
3
S
A
C
C
H
3
S
A
C
C
H
3
F
C S
C C
H H
B
C
C
H
1
B
C
C
H
2
B
C
C
H
3
B
C
C
H
4
A
G
C
H
/
P
C
H
A
G
C
H
/
P
C
H
A
G
C
H
/
P
C
H
A
G
C
H
/
P
C
H
A A A
G G G
F S C C C
C C H H H
C H / / /
P P P
H
C C C
H H H
A
G
C
H
/
P
C
H
A
G
C
H
/
P
C
H
A
G
C
H
/
P
C
H
A
G
C
H
/
P
C
H
A
G
C
H
/
P
C
H
F
C S
C C
H H
S
D
C
C
H
0
S
D
C
C
H
0
S
D
C
C
H
0
S
D
C
C
H
0
S
D
C
C
H
1
S
D
C
C
H
1
S
D
C
C
H
1
S
D F S C C
C C C B B
C C H C C
H H
H H
1
C
B
C
H
C
B
C
H
S
D
C
C
H
3
S
D
C
C
H
3
S
D
C
C
H
3
S
S S
D F S A A
C C C C C
C C H C C
H H
H H
3
0 0
S
A
C
C
H
0
S
A
C
C
H
0
S
A
C
C
H
1
S
A
C
C
H
1
S
A
C
C
H
1
S
A
C
C
H
1
IDLE
1
0
1
5
1
6
1
7
1
8
1
9
2
0
2
2
2
3
2
4
2
5
2
6
2
7
2
8
2
9
3
4
3
5
3
6
3
7
3
8
3
9
4
4
4
5
4
6
4
7
4
8
4
9
5
0
1
1
1
2
S
D
C
C
H
3
S
D
C
C
H
0
S
D
C
C
H
3
IDLE
Frame
Number
S
D
C
C
H
2
IDLE
TimeSlot
0
S
D
C
C
H
0
IDLE
TimeSlot
1
IDLE
TimeSlot
3
IDLE
T
C
H
IDLE
TimeSlot
4
IDLE
T
C
H
IDLE
TimeSlot
5
S
T T T T T T T T T T T T A
C C C C C C C C C C C C C
H H H H H H H H H H H H C
H
S
H
S
H
S
H
S
H
S
H
IDLE
IDLE
T
C
H
IDLE
TimeSlot
6
IDLE
IDLE
T T T
C C C
H H H
IDLE
S
T T T T T T T T T A
C C C C C C C C C C
H H H H H H H H H C
H
S
T T T T T T T T T T T A
H H H H H H H H H H H C
H
S
H
S
H
S
H
S
H
TimeSlot
7
1
3
1
4
2
1
S
D
C
C
H
7
3
0
S
D
C
C
H
7
3
1
S
A
C
C
H
0
3
2
3
3
S
A
C
C
H
2
4
0
S
A
C
C
H
2
4
1
S
A
C
C
H
2
4
2
4
3
51 Multiframe Pattern for Control Channels
RF100 - 331
November, 2014
A GSM Uplink Normal Burst
GSM is a TDMA system and a mobiles transmission bursts are carefully

constructed so as not to overlap with bursts from other mobiles
Different propagation delays of mobiles near and far mobiles the BTS are
compensated by automatically advancing mobile transmit timing
Special training sequences are included in each uplink burst and downlink
timeslot to facilitate demodulation
During unused timeslots, a mobile measures the strength of surrounding
base stations to guide the handover process (this is called MAHO, Mobile
Assisted Hand Over)
RF100 - 332
November, 2014
GSM Bursts on the Uplink: 4 Types
142 bits
Tail
Fixed 0 or Fill-in Bits
Guard
Bits
8.25 bits
Tail
Tail
Frequency Correction Burst or Dummy Burst
Guard
Bits
8.25 bits
Tail
Synchronization Burst
Data Bits
Training Bits
39 bits
Data Bits
64 bits
39 bits
Training Bits
41 bits
36 bits
Stealing
Bit
Tail
Normal Burst
Data Bits
57 bits
RF100 - 333
Data Bits
68.25 bits
Stealing
Bit
Training Bits
1
Guard
Bits
26 bits
Data Bits
57 bits
Tail
Tail
Bits
Tail
access Burst
Guard
Bits
November, 2014
8.25 bits
GSM Channels
DOWNLINK CHANNELS
UPLINK CHANNELS
BCH
BTS identity, channel allocation,

frequency hopping sequences
FCH
Provides frequency reference
SCH
Defines burst period boundaries

and time slot numbering
PCH
Carries Pages to mobiles,

alerting of incoming calls
AGCH
Allocates SDCH to mobile to

obtain dedicated channel after
a request on the RACH
BTS
0 to many
Slotted aloha channel used to

request network access
RACH
Stand Alone Dedicated

Control Channel
SDCH
Traffic Channel
Fast Associated Control
Channel
FACH
Slow Associated Control

Channel
SACH
F-TRAFFIC
SDCH
Stand Alone Dedicated

Control Channel
Traffic Channel
FACH
Fast Associated Control Channel
SACH
Slow Associated Control Channel
RF100 - 334
November, 2014
Basic GSM Network Voice Only

NSS
HLR
BSS
BSC
BTS
MSC
PSTN
MS
TRC
OMC-S
OMC-R
OSS
MS mobile station
BSS base station subsystem
BTS base transceiver station, BSC base station controller
NSS network subsystem
MSC Mobile Switching Center
PSTN public switched telephone network
OSS Operations Subsystem
OMC-R Operation and Maintenance Center Radio
OMC-S Operation and Maintenance Center System
RF100 - 335
November, 2014
Compare with
A CDMA Network Voice Only
HLR
BSC
BTS
MSC
PSTN
MS
The elements in a CDMA voice-only network map almost exactly to

their counterparts in a GSM voice-only network.
Americans are just a little less formal about the overall architecture of
things, allowing each network manufacturer to implement the
connections between elements and the overall network organization as
they wish
RF100 - 336
November, 2014
Data over the 2G GSM Signal?

GPRS and EDGE
RF100 - 337
November, 2014
GSM Evolution: General Packet Radio Service

GSM was designed for voice calls only, but interest in mobile data
grew and eventually a data service, HSCSD High Speed Circuit
Switched Data was implemented at 32 kb/s using the GSM signal
Around 1994, the GSM phase 2 standards were enhanced to
include a number of new and improved services. These
enhancements became known as GSM Phase 2 Plus.
One of the new features proposed in 1994 was a new bearer
service, a true IP packet radio service known as GPRS General
Packet Radio Service
GPRS allows a user with suitable mobile station to occupy multiple
time slots on a TRX, culminating in the possible occupancy of all 8
timeslots if they are available and the mobile is capable
Data rates supported per timeslot are 9.06, 13.4, 15.6, and
21.4 kb/s, corresponding to Modulation and Coding Schemes
MCS1, MCS2, MCS3, and MCS4
When all 8 timeslots are available, throughput can reach 8 x
21.4 kb/s = 171.2 kb/s, although realistic expectations are
around 115 kb/s due to BCH and other requirements
RF100 - 338
November, 2014
GPRS Timeslot Allocation

In conventional GSM, a channel is permanently allocated for a particular
user during the entire call period (whether speaking or silent, whether
transmitting data or not)
In GPRS, the channels are only allocated when data packets are
transmitted or received, and they are released after the transmission
For bursty traffic this results in much more efficient use of the scarce
radio resources
Multiple users can share one channel
GPRS allows a single mobile to
transmit and/or receive on multiple
timeslots of the same frame (this is
called multislot operation)
One to eight timeslots per frame
can be allocated to a mobile,
depending on its capabilities and
traffic levels
Uplink and downlink allocations
can be allocated separately,
which efficiently supports
asymmetric data traffic (suitable
for web browsing, for example)
RF100 - 339
BTS
This GPRS mobile is in 3+1 timeslot mode

3 timeslots assigned on downlink
1 timeslot assigned on uplink
November, 2014
Allocation of GPRS Channels

A cell supporting GPRS can allocate Packet Data Channels (PDCHs) for
GPRS traffic
The PDCHs are taken dynamically from the common pool of all
channels available in the cell
The radio resources of a cell are shared by all GPRS and all nonGPRS mobiles in the cell
The mapping of physical channels to either GPRS or GSM usage can
be performed dynamically, based on:
Capacity on demand principle
Depending on the current traffic load, priority of service, and the
multislot classes of the individual mobiles
A load supervision procedure monitors the PDCHs in the cell
The number of channels allocated to GPRS can be changed according to
current demand
Physical channels not currently in use by conventional GSM can be
allocated as PDCHs to increase the GPRS quality of service
When there is a resource demand for services with higher priority,
PDCHs can be de-allocated
RF100 - 340
November, 2014
A GSM/GPRS Network Voice and Data

NSS
Internet
VPNs
BSS
GGSN
HLR
SGSN
BSC
BTS
MSC
PSTN
MS
TRC
OMC-S
OMC-R
OSS
Adding GPRS packet services to a GSM network requires two new network
elements, the GGSN and the SGSN
GGSN Gateway GPRS Support Node
Hosts IP addresses, routes data packets into and out of the radio network;
acts as a router for packets within the network
SGSN Serving GPRS Support Node
Maintains packet delivery connection with mobiles in its area
Data is tunneled from the GGSN to the SGSN using GTP, GPRS Tunneling
Protocol, carrying packets between mobile and GGSN
PCU Packet Controller Unit manages RF timeslots for packets
RF100 - 341
November, 2014
Compare with
A CDMA/1xRTT Network Voice and Data
Internet
VPNs
PDSN
AAA
Home Agent
PSTN
HLR
PDSN
Foreign Agent
BSC
BTS
MSC
V
MS
The network elements of GSM/GPRS/EDGE networks have direct counterparts

in CDMA/1xRTT networks
The GGSN performs the same function as a 1xRTT PDSN Home Agent
It is the anchor point for a range of internet IP addresses
The SGSN performs the same function as a 1xRTT PDSN Foreign Agent
It routes packets to and from the GGSN to actual users no matter where
they are in the network
The HLR function in CDMA networks applies only to voice calls. A separate
function AAA serves as the data HLR.
The MSC and BSC administrative functions are handled by separate terminals,
like the OMC-S and OMC-R, but with proprietary mfrs. names
RF100 - 342
November, 2014
How can a User get packets wherever they are?

Through Tunnels between the SGSN and GGSN
GGSN
SGSN
Just like
Home!
GRAND
HOTEL
158766
158774
158782
158767
158775
158783
158768
158776
158784
158769
Mobile
User
Secure Tunneling
Forward and Reverse
FedEx
FedEx
Encapsulation
158785
158770
158778
158786
158771
158779
158787
158772
158780
158788
158773
158781
158789
Internet
IP Address
Assigned
To User
The GPRS-EDGE (and even UMTS/HSPA) packet networks rely on

secure tunneling to forward packets in both directions between a User,
the SGSN, and the GGSN which actually owns the internet IP address
assigned to the User in that data session
RF100 - 343
November, 2014
GSM and GPRS Radio Operations Together
A Mix of Voice and Data Users on Different Timeslots

Uplink
Downlink
Mobile Transmit
Base Station Transmit
H
G
E
BCCH
Frequency
3 slots
Frequency
RF100 - 344
H
G
A voice user
B voice user
C data user
D voice user
E voice user
F data user
G data user
H voice user
November, 2014
Fully Detailed GPRS Network Architecture

VLR
PLMN
PSTN
ISDN
MSC
Gp
HLR
Gc
PSPDN
New GPRS elements and interfaces

User data & signaling
Signaling only
Gs
SGSN
of a
different
PLMN
LEGEND
Existing GSM Core Network elements
Gi
GGSN
SMSC
EIR
Gr
Gn
Gf
SGSN
TCU
Gd
Gb
PCUSN
Ater
BSC
BTS
Base Abis Base

Station
Transceiver
Controller
Station
Agprs
SIM
Mobile
Station
Mobile
Eqpmt
Um
Interface
Additional elements in the GPRS network and their functions

HLR home location register master database of customers and authorizations
EIR equipment identity register can whitelist or blacklist specific mobiles
SMSC the short message service center, storing, routing, delivering SMS
TCU transcoder unit, converts 64 kb/s DS-0 speech into GSM coded voice
PCUSN the packet control unit support node schedules packets over the air
interface and manages radio resource allocation to carry packets
Data is tunneled from the GGSN to the SGSN using GTP, GPRS Tunneling Protocol,
encapsulating packets de-encapsulating on delivery
RF100 - 345
November, 2014
Taking GPRS to the next level:
EDGE
Enhanced Data Rates for GPRS Evolution
RF100 - 346
November, 2014
The EDGE Air Interface

Scheme
Modulation
Maximum
rate [kb/s]
Code Rate
Header Code
Rate
Blocks
per 20 ms
Family
M CS-9
M CS-8
M CS-7
M CS-6
M CS-5
M CS-4
M CS-3
M CS-2
M CS-1
8PSK
59.2
54.4
44.8
29.6 / 27.2
22.4
17.6
14.8 / 13.6
11.2
8.8
1.0
0.92
0.76
0.49
0.37
1.0
0.80
0.66
0.53
0.36
0.36
0.36
1/3
1/3
0.53
0.53
0.53
0.53
2
2
2
1
1
1
1
1
1
A
A
B
A
B
C
A
B
C
GM SK
Extends GPRS packet data speeds using adaptive higher order

modulation and coding schemes
Using 8-state phase shift keying allows three times the data speeds
available with the original modulation of GPRS, GMSK
8.2 to 59.2 kbps per time slot
Supports peak rates over 384 kbps when all timeslots are available
However, the new modulation requires linear amplifiers with < 3 dB peak
to average power ratio using linearized GMSK pulses
RF100 - 347
November, 2014
True 3G:
UMTS - WCDMA
RF100 - 348
November, 2014
Higher Speeds: UMTS / WCDMA

Even the best speeds of EDGE are still far below the data speeds
of DSL and Cable Modems for users in homes and businesses
The ETSI combined the GSM, GPRS, and EDGE standards and
added a new wideband technology for even higher data rates
The new overall family is called UMTS (Universal Mobile
Telecommunications Services) and that is the name normally used
for the new technology, based on wideband CDMA (WCDMA)
Different and not directly compatible with US CDMA
The UMTS/WCDMA signal can carry up to roughly 200 voice
calls as well as data bursts up to as much as 2 Mb/s overall
One UMTS signal occupies about 3.84 MHz. of radio spectrum,
and can fit within a licensed spectrum block 5 MHz. wide
This is about 3-times wider than a US CDMA signal
A UMTS base station is called a Node B
RF100 - 349
November, 2014
The UMTS / WCDMA Radio Signal

At left, four UMTS/WCDMA carriers
stand side by side in 20 MHz. of
spectrum. Each of the carriers can
handle in excess of 200 voice calls as
well as numerous data connections
with peak rates up to 1 Mb/s each.
As well see in the next section, one
or more of the carriers can also
handle HSPA fast data too.
The UMTS signal uses wideband CDMA

RF bandwidth is 3.84 MHz., 3x wider than US CDMA signals
UMTS uses up to 256 codes, same as US CDMA Walsh codes
but called OVSF Orthogonal Variable Spreading Factor
UMTS establishes timeslots for use of the OVSF codes,
creating TDMA in a WCDMA shell for operational flexibility
Up to two 1 Mb/s data channels can exist at any instant
Instead of a PN short code with timing offsets to distinguish
sectors, UMTS uses 512 different Gold Codes as carriers
RF100 - 350
November, 2014
A UMTS Network
NSS
Internet
VPNs
BSS
RNC
GGSN
HLR
SGSN
MSC
UE
PSTN
Node B
OMC-S
OMC-R
OSS
BTS
The core voice and packet network in UMTS is the same as in

GSM/GPRS, but the BSS Base Station Subsystem is changed a lot
Radio Resource Control for packet and voice and the packet control
function uses a new element, the RNC Radio Network Controller
Each base station is now called a Node B
A customer mobile is now called a UE, User Equipment
The required SIM card is special, including UMTS features
RF100 - 351
November, 2014
Compare with
An EV-DO Network
Internet
VPNs
PDSN
Home Agent
PSTN
AAA
HLR
RNC
PDSN
Foreign Agent
MSC
BTS
UE
The network elements of UMTS networks have direct counterparts in

CDMA/EV-DO networks
The GGSN performs the same function as a 1xRTT PDSN Home Agent
It is the anchor point for a range of internet IP addresses
The SGSN performs the same function as a 1xRTT PDSN Foreign Agent
It routes packets to and from the GGSN to actual users no matter
where they are in the network
The HLR function in CDMA networks applies only to voice calls. A
separate function AAA serves as the data HLR for EV-DO.
The MSC and BSC administrative functions are handled by separate
terminals, like the OMC-S and OMC-R, but with proprietary mfrs. names
RF100 - 352
November, 2014
WCDMA Principles
RF100 - 353
November, 2014
Wireless Multiple Access Methods

FDMA
Power
Frequency Division Multiple Access

A users channel is a private frequency
TDMA
Power
Time Division Multiple Access

A users channel is a specific frequency, but it
only belongs to the user during certain time
slots in a repeating sequence
Code Division Multiple Access

WCDMA
Power
RF100 - 354
Each users signal is a continuous unique

code pattern buried within a shared signal,
mingled with other users code patterns. If a
users code pattern is known, the presence or
absence of their signal can be detected, thus
conveying information.
November, 2014
Steps in WCDMA Signal Generation

User
Voice
Vocoder
BITS
Convolutional Symbol
CRC
Block
Turbo
Addition Or
Repetition
Interleaving
Coding
SYMBOLS
CHIPS
OVSF
Function
What Does It Do?
Baseband
Filtering
To RF
modulator
Scrambling
Code
Why Do We Do It?
Encodes
user voice
or data
Physical
Layer
functions
For digitization and compression. The main goal is

to have fewer bits to transmit, maximizing capacity..
Vocoding
Convolutional
Coding
Symbol
Repetition
Encode information bit

stream before transmission
Repeat information symbols
before transmission
Add calculated redundancy in the bit stream to allow

error correction at reception after noisy radio link.
Block
Interleaving
Disperse redundant bits

away from each other
Orthogonal
Spreading
Create a Spread-Spectrum
Signal; make User channel
Scramble user chipstreams
in a cell (DL) or UE (UL)
Add additional phase
dimensions to RF signal
Node B adjusts UEs transmit
power
Restrict and shape signal
bandwidth
Ensures symbols representing an information bit are

distributed throughout the 10 ms. frame, ensuring no
error burst wipes out all symbols of a specific bit..
Spreading user bitstream into spread-spectrum
chipstream for gain advantage; the specific OVSF
code is the users channel in the cell
This makes the DL signal of each cell unique from
other cells and each UE (UL) from other UEs.
Scrambling
Quadrature
Spreading
Power Control
Baseband
Filtering
RF100 - 355
Increase redundancy in the bitstream even further

when bit rates are low enough to allow it
Increases the bandwidth-density of transmitted

information for maximum system capacity
So each UE transmits enough power to achieve
desired S/N, without causing excessive interference
Eliminate outer sidebands of the baseband signal to
meet bandwith requirements
November, 2014
Codes Used in UMTS
RF100 - 356
November, 2014
Channels and Protocols,

Application Parts, Handover
RF100 - 357
November, 2014
Introduction to WCDMA Channels

Like other wireless technologies, WCDMA uses various types of channels
to carry the actual information to and from users, and to manage the
connections between users and the system
The channels break down cleanly into several categories:
In terms of ownership or control:
COMMON channels are public places, much like a hotel lobby
DEDICATED channels are private for one user, much like a guest
room in a hotel
SHARED channels can momentarily serve one user, much like a
meeting room in a hotel
In terms of direction:
DOWNLINK channels are transmitted by Node B, received by UE
UPLINK channels are transmitted by UE, received by Node B
In terms of purpose:
DATA
CONTROL (includes PRIMARY and SECONDARY subchannels)
SYNC (includes PRIMARY and SECONDARY subchannels)
RF100 - 358
November, 2014
The W-CDMA Physical Channels

DOWNLINK CHANNELS
CPICH
P-CPICH
S-CPICH
P-CCPCH
S-CCPCH
SCH
Node
B
P-SCH
S-SCH
Common Pilot
Channel
Primary Common Control
Physical Channel
Secondary Common Control
Physical Channel
Physical Random Access

Channel
Physical Common
Packet Channel
PRACH
Dedicated Physical
Data Channel
Dedicated Physical
Control Channel
DPDCH
PCPCH
Synchronization Channel
PICH
RF100 - Indication Channel
AICH
Acquisition Indication Channel
AP-AICH
Access Preamble Acquisition

Indicator Channel
CSICH
CPCH Status Indicator

Channel
CD/CA-ICH
Collision Detection/Channel
Assignment Indicator Channel
DPDCH
Dedicated Physical
Data Channel
DPCCH
Dedicated Physical
Control Channel
PDSCH
Physical Downlink
Shared Channel
RF100 - 359
UPLINK CHANNELS
DPCCH
November, 2014
Downlink W-CDMA Physical Channel Functions

DOWNLINK CHANNELS
CPICH
P-CPICH
S-CPICH
P-CCPCH
Primary Common Control

Physical Channel
S-CCPCH
Secondary Common Control Contains Paging Channel PCH and Forward Access Channel
FACH time-multiplexed. OVSF is announced on the P-CCPCH.
Physical Channel
P-SCH
S-SCH
In PCCPCH idle period. Two subchannels, Unmodulated P-SCH

gives S-SCH timing. S-SCH gives long code group.
PICH
RF100 - Indication Channel
Idle mobiles sleep deeply to save battery power, only looking at

this channel to see if they need to wake up and hear a Slide.
AICH
A mobile sending a random access preamble watches AICH to

Acquisition Indication Channelsee
when it may end the preamble and transmit its request.
AP-AICH
Access Preamble Acquisition A mobile sending a CPCH preamble watches AICH to see when
it may end the preamble and transmit its request.
Indicator Channel
CSICH
CPCH Status Indicator

Channel
CD/CA-ICH
Collision Detection/Channel Fixed-rate common DL channel carries CD indicator only if CA is

Assignment Indicator Channel not active, or both CD/CA indicators if CA is active
DPDCH
Dedicated Physical
Data Channel
DPCCH
Dedicated Physical
Control Channel
Carries user or control information to a UE wherever it may be in

the cell.
PDSCH
Physical Downlink
Shared Channel
Downlink channel used to carry fast user data (the DSCH

transport channel). Much like supplemental channel in IS-2000.
SCH
Node
B
Common Pilot
Channel
UEs monitor as 1) phase reference for SCH, P- CCPCH, AICH,

PICH and 2) to measure signal strength for cell
selection/Handover
Primary is uncoded and uses main scrambling pattern of the cell.
Secondary can use other scrambling pattern and beam-forming.
BCH cell configuration information. Same OVSF in every cell. Not
transmitted in first 256 chips of every slot (90% duty factor).
RF100 - 360
Fixed-rate downlink channel carries CPCH status information.

Paired with CPCH AP-AICH, uses same ch. and scr. codes
November, 2014
(P-SCH, S-SCH) Coding
The Primary SCH consists of an unmodulated code 256 chips long
Transmitted once every slot
The same code is used for every base station in the system
Transmitted time-aligned with the slot boundary
The Secondary SCH consists of one modulated code 256 chips long,
transmitted in parallel with the Primary SCH
The code is one of 8, determined by the code group set to which the
base stations downlink scrambling code belongs
S-SCH is modulated by a binary sequence 16 bits long, repeated
each frame
The same sequence is used for each Node B and has good cyclic
autocorrelation
The SCH is transmitted intermittently (one codeword per slot)
Multiplexed with DPDCH/DPCCH and CCPCH after long code
scrambling
So SCH is non-orthogonal to the other downlink physical channels
RF100 - 361
November, 2014
Reverse W-CDMA Physical Channel Functions

UPLINK CHANNELS
A common uplink physical channel used to carry control
information or short user packets from the UE
Physical Random Access

Channel
PRACH
A common uplink physical channel used to carry short and

medium- sized user packets. Its always associated with a
downlink channel for power control
Physical Common
Packet Channel
PCPCH
Carries user data from a UE anywhere in the cell. Usually only

one DPDCH allocated per connection, services interleaved on it.
Dedicated Physical
Data Channel
DPDCH
Carries user or control information from a UE wherever it may be

in the cell. Pilot symbols, Pwr ctrl bits, reverse rate indication. Can
be continuous (code multiplexed) or time-multiplexed.
Dedicated Physical
Control Channel
DPCCH
RF100 - 362
November, 2014
User Equipment Architecture
RF100 - 363
November, 2014
Whats In a WCDMA UE?
bits
summing
Symbols
control
Chips
Digital
Rake Receiver
Rake Finger
Scrambling Channelization
Receiver
RF Section
IF, Detector
Rake Finger
Rake Finger
AGC
Duplexer
RF
Transmitter
RF Section
RF100 - 364
Symbols
Viterbi Decoder,
Convl. Decoder,
Demultiplexer
Packets
Open Loop
RF
power
Rake Finger
time-aligned
Audio
Messages
Pilot Searcher
CPU
Vocoder
Closed Loop Pwr. Ctrl.

Transmitter
Digital Section
Audio
Messages
UIM
Scrambling Gen.
November, 2014
Basic Call Processing
RF100 - 365
November, 2014
Cell Search Procedure

Background:
each cell uses the same 256-chip primary synchronization code
1. The UE searches the 256-chip primary synchronization code
the detected correlation peak corresponds to the slot boundary
chip, symbol, and slot synchronization are obtained
2. Using the peaks detected in 1, the UE seeks the largest peak from the
Secondary SCH code word
there are 64 possible values for this code word
the UE must check all 15 possible delay positions since the frame
boundary isnt available until this word is found
from the strongest Secondary SCH code word, Frame synchronization
and the code group of the cell can be obtained
3. The UE now has the Secondary SCH code word and frame timing is
known
The UE now seeks the primary scrambling codes belonging to this
code group
each group has 8 primary scrambling codes which must be tested
but only at the starting position of relative timing -- the starting
point is known already
Scrambling code of the cell is then obtained
RF100 - 366
November, 2014
Types of Handovers in WCDMA

Intra-Mode
soft handover
softer handover
hard handover
Inter-Mode
UMTS WCDMA to/from UTRA TDD mode
Inter-system Handover
UMTS WCDMA to GSM
UMTS WCDMA to CDMA2000
RF100 - 367
November, 2014
Soft Handover
Before entering soft handover, the mobile
Measures the observed timing differences of the downlink SCHs from
the involved base stations
Reports the timing differences back to the serving base station
Trigger Parameters
RSCP Received Signal Code Power
RSSI Received Signal Strength Indicator
Ec/No = RSCP/RSSI
other parameters are being discussed
The timing of the new downlink soft handover connection is adjusted with
a resolution of one symbol
This enables the rake receiver in the mobile to collect the
macrodiversity energy from the two base stations
Timing adjustments of dedicated downlink channels is carried out with
a resolution of one symbol without losing orthogonality of the downlink
codes
RF100 - 368
November, 2014
Interfrequency Handovers
Interfrequency handovers arise during utilization of heirarchical cell
structures (macro, micro, indoor cells)
Several carriers and interfrequency handovers may also be used for
taking care of high capacity needs in hot spots
Interfrequency handovers are also needed to second-generation
systems such as GSM or IS-95
An efficient method is needed for making measurements on other
frequencies while still having the connection running on the current
frequency
Two methods are available to do interfrequency measurements in
WCDMA: Dual Receiver and Slotted Mode
Dual receiver is considered feasible especially if the mobile uses
antenna diversity
One receiver branch can be switched to the other frequency
Slotted Mode is necessary if the receiver has no diversity
The information transmitted during a 10 ms frame is compressed
by puncturing or changing the FEC rate and the mobile is free to
make a quick measurement on the other frequency
RF100 - 369
November, 2014
Modes and States - RRC Modes

UTRAN Connected Mode
URA PCH
GSM Handover
CELL_PCH
UTRAN Inter-System Handover
CELL_DCH
GSM
Connected
Mode
Release
RR
Connection
CELL_FACH
GPRS Packet
Transfer Mode
Release
RRC
Connection
Establish
RRC
Connection
Release
RRC
Connection
Release
Cell
Establish Reselection Temp
RRC
Block
Connection
Flow
Camping on a UTRAN cell
Establish
RR
Connection
Initiate
Temp
Block
Flow
GPRS Packet Idle Mode

Camping on a GSM/GPRS cell
Idle Mode
RF100 - 370
November, 2014
WCDMA-GSM Handovers Measurement Process

Since GSM use is so widespread, W-CDMA--GSM handovers are
quite important
The GSM compatible multiframe structure allows similar timing
for intersystem measurements as in the GSM system itself
The needed measurement interval is not as frequent as for
GSM terminals operating in a GSM system
In this frame, change coding or puncturing to
allow payload bits to finish early so mobile
receiver is free during part of the frame.
In this frame, change coding or puncturing to

allow payload bits to finish early so mobile
receiver is free during part of the frame.
WCDMA
UMTS
Frames
12 frames
120 ms
12 frames
Measure GSM
FCCH and SCH
120 ms
Measure GSM
FCCH and SCH
TIME
RF100 - 371
November, 2014
Moving UMTS Higher:

HSPA the EVDO of WCDMA
RF100 - 372
November, 2014
Even Higher Speeds HSPA and HSPA+

As UMTS was born, Qualcomm and American operators had
applied the newest principles to its CDMA technology, producing a
hybrid variation called EVDO (Evolved, Data Optimized).
Adding higher order modulation to the basic CDMA signal,
EVDO offered data speeds of up to 3.1 Mb/s downlink, 1.8
Mb/s up on a single CDMA-like signal just 1.2 MHz. wide
The ETSI community wasted no time doing the same to its UMTS
/WCDMA signal, achieving speeds of up to 7 Mb/s downlink, 3.5
Mb/s uplink on a single UMTS-like signal just 3.8 MHz. wide
This signal was called HSPA, High Speed Packet Access
Downlink and uplink versions were call HSDPA and HSUPA
If multiple HSPA signals are harnessed together for even greater
speed, this is called HSPA+
The most advanced HSPA+ multicarrier arrangements offer up
to 44 Mb/s downlink, 22 Mb/s uplink
AT&T and T-Mobile have advertised HSPA+ as a 4G technology
RF100 - 373
November, 2014
HSPA = HSDPA + HSUPA

The HSPA downlink and uplink specifications were released at
different times through 3GPP. They have different properties
resulting from the different modes of operation that are required,
and are often regarded as almost separate entities.
HSDPA - High Speed Downlink Packet Access:
packet data support, reduced delays, peak data rate 14 Mbps
around three times the capacity of the 3G UMTS
HSUPA - High Speed Uplink Packet Access:
improved uplink packet support, reduced delays and a peak
raw data rate of 5.74 Mbps.
a capacity increase of around twice compared to Release 99
services.
RF100 - 374
November, 2014
HSPA Speeds under 3GPP Releases

cc
RF100 - 375
November, 2014
HSPA Benefits for Two Types of Traffic
RF100 - 376
November, 2014
HSPA+ Advantages
Five features of HSPA+ substantially improve both network

performance and user experience
RF100 - 377
November, 2014
Carrier Aggregation for HSPA+
Multiple HSPA carriers can be combined for even greater capacity

and throughput
HSPA+ relies on both multiple carriers and higher order
modulation schemes to achieve data rates as high as 44 Mb/s
downlink, 22 Mb/s uplink
RF100 - 378
November, 2014
Introduction to LTE
RF100 - 379
November, 2014
Multiple Access Methods

FDMA
Power
FDMA: AMPS & NAMPS

Each user occupies a private Frequency,
protected from interference through physical
separation from other users on the same
frequency
TDMA: IS-136, GSM

TDMA
Power
Each user occupies a specific frequency but

only during an assigned time slot. The
frequency is used by other users during
other time slots.
CDMA
CDMA
Power
RF100 - 380
Each user uses a signal on a particular

frequency at the same time as many other
users, but it can be separated out when
receiving because it contains a special code
of its own
November, 2014
Highly Advanced Multiple Access Methods

OFDM
Power
OFDM, OFDMA
Frequency
Orthogonal Frequency Division Multiplexing;

Orthogonal Frequency Division Multiple Access
The signal consists of many (from dozens to
thousands) of thin carriers carrying symbols
In OFDMA, the symbols are for multiple users
OFDM provides dense spectral efficiency and robust
resistance to fading, with great flexibility of use
Multiple-Antenna Techniques to Multiply Radio Throughput
MIMO
MIMO
Multiple Input Multiple Output
An ideal companion to OFDM, MIMO allows
exploitation of multiple antennas at the base station
and the mobile to effectively multiply the throughput
for the base station and users
SMART ANTENNAS
Beam forming for C/I improvement and
interference reduction
RF100 - 381
November, 2014
LTE Design Objectives

LTE was intended to be a major leap forward in performance compared to
the 3G technologies HSPA and EV-DO
LTE objectives as expressed in the early document TR25.913:
Gross data rate100 Mb/s in 20 MHz. for downlink, 50 Mb/s in 20 MHz.
for uplink, where separate uplink and downlink frequencies are used,
not taking into account multiplying effects available using MIMO
Control Plane (setup) Latency: camped to active <100 ms., dormant
to active <50 ms.
User Plane (data) Latency: 5 ms 1-way on unloaded network
# Active Users: >200 in 5 MHz., >400 in wider than 5 MHz. block
Distance: Full performance to 5 km, good to 30 km, up 100 km. is not
specified but to be substantially better than 3G technologies
Handoff Delay: negligible LTE-LTE, less than 512 ms LTE>GSM
Bandwidth scalable for incremental transition in existing spectrum
MBMS (Multimedia Broadcast Multicast Service) to allow about 16 TV
channels simultaneously in 5 MHz. at efficiency of about 1 b/s/hz
RF100 - 382
November, 2014
LTE
The Evolved Packet System (EPS) is purely IP based. Both real time
services and datacom services are carried by the IP protocol.
An outside IP address is allocated when the mobile is switched on and
released when it has been switched off for some time.
The new LTE radio signal uses OFDMA (Orthogonal Frequency
Division Multiple Access) to handle high data rates and volumes.
High order modulation (up to 64QAM), large bandwidth (up to 20
MHz) and MIMO transmission on the downlink (up to 4x4) is also
available. Up to 170 Mbps on uplink and 300 Mbps on the downlink!
The EPC core network can inter-work with Non-3GPP access such as
WiMAX, WiFi, CDMA and EV-DO.
Non 3GPP access solutions can be treated as trusted or non-trusted
(using independent security) based on operator requirements.
The LTE access network (RAN) is simply a network of base stations
(eNodeBs) in a flat architecture. There is no centralized intelligent
controller, and the eNBs are normally inter-connected by the X2-interface
and connected towards the core network by the S1-interface.
Distributing intelligence among eNodeBs speeds up connection set-up
and handovers, especially critical for some types of user traffic.
RF100 - 383
November, 2014
LTE vs. LTE Advanced

Characteristic
Peak Data Rate
Latency:
Spectral Width
Peak Spectral Efficiency
Control-Plane
User Capacity
LTE
LTE Advanced
DL: 100 Mbps

UL: 50 Mbps
C-Plane: <100 ms
U-Plane: <5 ms usually
DL: 1 Gbps
UL: 512 Mbps
C-Plane: <50 ms
U-plane: <5 ms always
Multiple Blocks,
up to 100 MHz. +
DL: up to ~30 b/s/hz
UL: up to ~15 b/s/Hz
>300 active in 5 MHz.
without DRX, >600 in 5+
One Block, up to 20 MHz

DL: ~5 b/s/Hz
UL: ~2.5 b/s/Hz
At least 200 active in 5
MHz., 400 in > 5 MHz.
Many features of LTE-Advanced are already implemented in

current commercial-production network equipment
Data rate figures above do not include benefits of MIMO
RF100 - 384
November, 2014
Summary of Major Progress

in Wireless Communications
Cellular Frequency Reuse Concept
with handoffs
From No Frequency Reuse
Progress in
Network Configuration
and Frequency Reuse
to
0.2
104k
0.5
3
1
0.17
0.2
160k
0.8
3
1
0.27
0.2
384k
1.9
3
1
0.63
1.2
1.2
360k 720k
0.3
0.6
1
1
1
1
0.3
0.6
1xEV-DO
EDGE
0.03
28k
0.9
7
1
0.13
1xRTT RC4
GPRS
0.03
9600*
0.3*
7
1
0.04
CDMA
GSM
Signal Bandwidth, MHz =

User Bits/Second =
Signal Efficiency bits/Hz =
Frequency Reuse N =
MIMO factor =
Spectral Efficiency bits/Hz/Area =
TDMA (US)
Progress in
Signal
Technology
Analog*
UMTS
HSPA
LTE
1.2
3.1M
2.4
1
1
2.4
3.84
2M
0.5
1
1
0.5
3.84
8M
2.1
1
1
2.1
20
100M
5.5
~3
4
7.3
Progress in
Devices
RF100 - 385
November, 2014
Introducing The LTE Air Interface
RF100 - 386
November, 2014
LTE Uses OFDM
Orthogonal Frequency Division Multiplexing

An LTE signal is made up of many
small ordinary radio signals
(subcarriers) standing together
The bundle could be from a few
dozen to over 1000 subcarriers,
whatever your spectrum can hold
subcarriers are on 15 kHz. steps
Each subcarrier can carry whatever bits we put on it
We can send a large amount of data very fast by splitting it up and
sending over a large number of subcarriers in parallel
Subcarriers are created and received using Discrete Fourier
Transforms, so they dont interfere (are orthogonal)
1980s technology would have needed an individual transmitter and
receiver for each subcarrier mobiles bigger than suitcases with
car batteries strapped on outside but modern LTE chipsets keep
a users equipment (UE) small and compatible with small batteries
RF100 - 387
November, 2014
FDD LTE: Frequency Division Duplex

Uplink
706
Downlink
716
730
eNodeB
740
1.4, 3, 5, 10, 15 or 20 MHz.

1.4, 3, 5, 10, 15 or 20 MHz.
The width of the LTE signal can be set to fill any authorized frequency block
UE When an operators licensed spectrum includes separate frequency

blocks for uplink and downlink, this is called Frequency Division
Duplex operation
The LTE standard contains a list of several dozen band classes,
different arrangements of the uplink and downlink blocks and their
frequencies as used in different countries around the world
Downlink is sometimes called Forward Link, and uplink called
Reverse Link
LTE mobiles are called User Equipment (UE)
LTE base stations are Enhanced Node-Bs (eNodeB, or eNB)
RF100 - 388
November, 2014
Downlink
TDD LTE: Time Division Duplex

Frequency
Uplink
In TDD, uplink and downlink take turns transmitting in a single block
of spectrum.
Operators choice of FDD or TDD operation is usually dictated by the
frequencies assigned by government
In FDD, the capacity of uplink and downlink is determined by the
spectrum allocated to each (usually equal)
In TDD, the relative capacity of uplink and downlink can be adjusted
to most closely match the actual distribution of uplink and downlink
traffic, getting greatest efficiency from available spectrum
The WiMAX standard was first developed in only a TDD version
The LTE technology was first developed in only an FDD version
Today both LTE and WiMAX have FDD and TDD versions
RF100 - 389
November, 2014
Orthogonal Frequency Division

Multiple Access - OFDMA
Uplink
Downlink
Uplink spectrum is empty

if no UEs are transmitting
706
Downlink spectrum on active system

usually appears fully occupied
716
1.4, 3, 5, 10, 15 or 20 MHz.
730
740
1.4, 3, 5, 10, 15 or 20 MHz.
Whether FDD or TDD is used, transmission in each direction on

each subcarrier is scheduled in units of 1 millisecond (or multiples)
An LTE system dynamically schedules uplink and downlink
subcarriers based user needs and RF conditions to ensure:
Efficiency each user gets their fair share of the resources and
the total resources are used effectively for greatest throughput
Quality of Service (QOS) each users type of traffic is
considered when assigning resources, to provide acceptable
quality (both in latency and throughput) for the user
RF100 - 390
November, 2014
The LTE Uplink Signal
The uplink uses SC-FDMA with some dynamic multiple of 4 15-khz

subcarriers to transmit the users information
Modulation can be QPSK, 16QAM or 64QAM for conditions
SC-FDMA has a low Peak-to-Average Power Ratio (PAPR)
which provides more transmit power and longer battery life
RF100 - 391
November, 2014
700 MHz
800
900
PCS
Uplink
1700
1800
1900
Frequency, MegaHertz
PCS
DownLink
2000
AWS
DownLink
2100
Modern wireless began in the 800 MHz. range, when the US FCC
reallocated UHF TV channels 70-83 for wireless use and AT&Ts
proposed analog technology AMPS was chosen.
Nextel bought many existing 800 MHz. Enhanced Specialized Mobile
Radio (ESMR) systems and converted to Motorolas IDEN technology
The FCC allocated 1900 MHz. spectrum for Personal Communications
Services, PCS, auctioning the frequencies for over $20 billion
With the end of Analog TV broadcasting in 2013, the FCC auctioned
former TV channels 52-69 for wireless use, the 700 MHz. band
The FCC also auctioned spectrum near 1700 and 2100 MHz. for
Advanced Wireless Services, AWS.
Technically speaking, any technology can operate in any band. The
choice of technology is largely a business decision by system operators.
RF100 - 392
November, 2014
SAT
AWS
Uplink
AWS?
Proposed AWS-2
SAT
IDEN
CELL DNLNK
700 MHz.
IDEN
CELL UPLINK
Current Wireless Spectrum in the US
2200
The US 700 MHz. Spectrum and Its Blocks
In the U.S., the former television channels 52-69 have been re-allocated
to wireless operators and public safety entities.
The Upper C block (striped red) is now used by Verizon Wireless in
virtually the entire U.S. with uplink in 776-787 MHz. and downlink in
746-757 MHz. Verizons partnership with rural operators has given it a
head-start in completing LTE service along virtually all interstate
highways and many surrounding rural areas.
AT&T has obtained the lower B and/or lower C block in many areas.
After considerable delay it is now well along in its national rollout.
Other operators also use lower A, B, and/or C blocks in many areas.
There is controversy over adjacency of lower A to TV channel 51.
RF100 - 393
November, 2014
LTE Band
Classes
The LTE Band Classes
are listed in the ETSI
document 36.101 in the
table shown at left
Blocks 1-26 are for FDD,
Frequency-DivisionDuplex use
Blocks 33-43 are for
TDD Time-DivisionDuplex use
As new frequencies are
purposed for LTE around
the world, new band
classes will be added
VZW US: Bandclass 13
ATT US: Bandclass 17,
not 12 controversy!
RF100 - 394
November, 2014
LTE Subcarriers and Modulation
RF100 - 395
November, 2014
One LTE Subcarrier: What Can It Do?

Frequency,
KHz
-30
-15
FSC
+15
+30
The LTE radio signal is made up of many individual little signals

called subcarriers, spaced 15 kHz apart in spectrum. A subcarrier
can carry information bits or reference signals.
Bits are carried by a subcarrier by one of three types of modulation.
The system chooses which type to use, reacting to instantaneous
radio conditions between each specific UE and eNB:
QPSK rugged but slow, for bad RF conditions
16QAM faster, but only works in fair conditions
64QAM very fast, but only for great conditions
The smallest atom of an LTE signal is one subcarrier during the
time while it transmits one symbol. This is a resource element.
Normal bursts of user data over LTE occupy many subcarriers for
many symbols; we dont schedule just one resource element alone.
RF100 - 396
November, 2014
A Quick Introduction to Digital Modulation

Modulation
Schemes
Q
QPSK
I
16QAM
64QAM
November, 2014
Modulation
Scheme
BPSK
QPSK *
8PSK
16 QAM *
32 QAM
64 QAM *
256 QAM
Possible
States
2
4
8
16
32
64
256
Efficiency,
Bits/S/Hz
1 b/s/hz
2 b/s/hz
3 b/s/hz
4 b/s/hz
5 b/s/hz
6 b/s/hz
8 b/s/hz
SHANNONS
CAPACITY EQUATION
= B log2
[ 1+
S
N
B = bandwidth in Hertz
C = channel capacity in bits/second
S = signal power
N = noise power
In digital modulation, the signals amplitude and

phase are driven among several pre-defined values.
On a vector diagram, these points look like stars in
a constellation. Each dot is called a symbol.
Simple modulation schemes have fewer symbols in
their constellations, and are easy to receive even
through interference and noise. However, each
symbol only carries a few bits of information.
More complex modulation schemes have more
symbols in their constellations and each symbol
carries many bits of information. However, reception
is vulnerable to errors from interference, noise, or
distortion in amplifiers of the transmitter/receiver.
RF100 - 397
LTE Symbols Weapon against

Multipath Reflections: The Cyclic Prefix
LTE Symbol
eNB
LTE Symbol
LTE Symbol
UE
Radio signals in a mobile environment dont follow just one direct pathway
from transmitter to receiver. The signal travels over every possible path. The
receiver gets a jumble of what was transmitted, blurred in time.
On arrival, the boundary between one symbol and the next is fuzzy. A
symbol is sometimes interfered with by overlapping remnants of the symbol
sent just before of it. This is called intersymbol interference, ISI.
LTE exploits Discrete Fourier Transforms to overcome ISI. Each symbol
begins with a preview of its end value, called a cyclic prefix.
If the CP length is longer than the time-blurring of the radio channel, the
Discrete Fourier Transform can eliminate the intersymbol interference.
LTE systems have a normal CP length which nicely fits most situations. The
CP length can also be extended to get good performance in very reflective
areas such as big cities and mountain canyons, and in Multicast transmission.
RF100 - 398
November, 2014
Normal and Extended Cyclic Prefix
RF100 - 399
November, 2014
The Smallest Assignable Traffic-Carrying

Part of an LTE signal: a Resource Block
A Resource Block is 12 subcarriers
carrying data for one-half millisecond.
RF100 - 400
November, 2014
LTE Frame Timing Structure

in Frequency Division Duplex (FDD)
Each LTE downlink subcarrier operates with radio frames 10

milliseconds long.
Each frame is made up of 10 subframes, each 1 millisecond long.
Each subframe contains 2 slots, each 512 microseconds long.
Normally, each slot carries seven modulated symbols, which could
be QPSK, 16QAM, or 64QAM, whatever is most appropriate for
the prevailing radio conditions.
RF100 - 401
November, 2014
LTE Frame Timing Structure

in Time Division Duplex (TDD)
When an LTE system has a single block of frequencies to use, it is

not possible to have simultaneous uplink and downlink.
Instead, Uplink and downlink must take turns using the available
frequency space. This is called Time Division Duplex, TDD
The frames for TDD LTE are 10 milliseconds long, just like FDD
Inside a frame, some subframes are used for uplink and some for
downlink. When transmission direction changes, there is a
transition subframe with a pilot timeslot for the ending link direction,
a guard period, and a pilot timeslot for the starting link direction.
RF100 - 402
November, 2014
Possible LTE TDD Time Configurations
RF100 - 403
November, 2014
MIMO
Multiple Input Multiple Output
RF100 - 404
November, 2014
SISO, MISO, SIMO, MIMO

Single-Input Single-Output is the
default mode for radio links over the
years, and the baseline for further
comparisons.
Multiple-Input Single Output provides
transmit diversity (recall CDMA2000
OTD). It reduces the total transmit
power required, but does not increase
data rate. Its also a delicious
Japanese soup.
Single-Input Multiple Output is receive
diversity. It reduces the necessary
SNR but does not increase data rate.
Its rumored to be named in honor of
Dr. Ernest Simo, noted CDMA expert.
Multiple-Input Multiple Output is highly
effective, using the differences in path
characteristics to provide a new
dimension to hold additional signals
and increase the total data speed.
RF100 - 405
November, 2014
SU-MIMO, MU-MIMO, Co-MIMO

Single-User MIMO allows
the single user to gain
throughput by having
multiple essentially
independent paths for data
Multi-User MIMO allows
multiple users on the
reverse link to transmit
simultaneously to the eNB,
increasing system capacity
Cooperative MIMO allows a
user to receive its signal
from multiple eNBs in
combination, increasing
reliability and throughput
RF100 - 406
November, 2014
LTE Channels
RF100 - 407
November, 2014
Frequency
All Resource Blocks
Downlink Physical Resources and Mapping
A Physical Resource Block
Time
A complete view of an FDD LTE Downlink Signal several MHz wide.

RF100 - 408
November, 2014
Frequency
Uplink Physical Resources and Mapping
One or more 60-KHz. SC-FDMA carriers

of a UE, as assigned by the system
Time
RF100 - 409
November, 2014
Types of Channels in LTE

Logical Channels
A logical channel carries a specific traffic or control messaging
between the RLC and an upper-level entity
Transport Channels
The Transport channels carry information between Medium
Access Control (MAC) and higher layers.
Physical Channels
A physical channel holds content with bits mapped into the
appropriate format to be transmitted over the air interface
In addition to physical channels carrying user and control bits,
there are also physical signals
PSS: downlink Primary Synchronization Signal
SSS: downlink Secondary Synchronization Signal
RS: downlink demodulation Reference Signal
Uplink demodulation Reference Signal
RF100 - 410
November, 2014
LTE Channels Logical, Transport, Physical
Control
Traffic
Control
Traffic
Control
Traffic
Control
Control
Paging
Overhead
Shared
Random
Access
MultiMedia
Shared
Paging
Broadcast
Overhead
Shared
Control
Random Access
MultiMedia
Control
Format
HARQ
Paging
Broadcast
Overhead
November, 2014
RF100 - 411
Individual
User
Public
MultiMedia
Individual
User
Public
Downlink Physical Signals and Channels
Downlink Physical Signals

Reference Signal (RS)
Pilot used for DL channel estimation. Derived from cell ID (one of 3x168=504 PN Sequences)
Primary Synchronization Signal (P-SCH)
Signal used by UE for initial cell acquisition codes 0, 1, or 2
Secondary Synchronization Signal (S-SCH)
Signal used by UE for initial cell acquisition 168 different codes
Downlink Physical Channels

Physical Broadcast Channel (PBCH)
Broadcasts system information, including MIB and SIBs
Physical Downlink Shared Channel (PDSCH)
Shared channel for user data, radio/core network, System information (BCH), paging messages.
Physical Downlink Control Channel (PDCCH)
Shared signaling channel for allocation of resources for the PDSCH.
Physical Control Format Indicator Channel (PCFICH)
Defines number of PDCCH OFDMA symbols per Sub-frame (1, 2, or 3)
Physical Hybrid-ARQ Indicator Channel (PHICH)
Carries HARQ ACK/NACK
Physical Multicast Channel (PMCH)
Carries the MCH Transport channel
RF100 - 412
November, 2014
Uplink Physical Signals and Channels
Uplink Physical Signal

Reference signal (RS)
Reference signal used for demodulation and sounding
Used for synchronization to the UE and UL channel estimation
Uplink Physical Channels

Physical Uplink Shared Channel (PUSCH)
Shared channel used to carry user data..
Physical Uplink Control Channel (PUCCH)

Shared signaling channel for UE to request PUSCH resources
Physical Random Access Channel (PRACH)

Shared channel used for the access procedure, Call setup
RF100 - 413
November, 2014
Downlink Resource Grid Details
RF100 - 414
November, 2014
Resource Allocation in LTE

Resources in LTE
Resource Element, Resource Block, Slot, Sub-frame
Resource Grid
Control Information Resourced Allocation
Physical Channels, PDCCH, DCI
REG Resource Element Groups
Traffic Resource Allocation
Resource Block Group (RBG) based
RBG Subset based
Virtual Resource Block (VRB)-based
Interactive LTE downlink signal demonstration:
http://paul.wad.homeSlide.dk/LTE/lte_resource_grid.html
RF100 - 415
November, 2014
RF100 - 416
November, 2014
RF100 - 417
November, 2014
Example of RS Sequences for

1, 2, and 4 Antennas
Notice when one antenna is transmitting a
reference symbol, the other antennas are silent
RF100 - 418
November, 2014
How REGs and Reference Signals Fit

Heres an example of
how REGs and
Reference Symbols fit
into the resource grid
The Downlink Control
Indicator (DCI) carries
the information a UE
needs to know
Which resource
blocks carry my
data?
What modulation
scheme is used
for my data?
Whats the
starting resource
block for my
data?
RF100 - 419
November, 2014
LTE Resource Allocation and PDCCH Support

There are 10 DCI formats for indicating downlink scheduling, in
three broad types.
There is one DCI format for assigning uplink scheduling.
A Control Channel Element (CCE) consists of 9 Resource Element

Groups (REG).
RF100 - 420
November, 2014
DCI Formats and Resource Allocation
RF100 - 421
November, 2014
Resource Allocation type 0

In type 0 resource allocation, a bit map represents a resource
block group (RBG) allocated to a UE.
The size of RBG is given by P, which can be found in TS
36.213 Table 7.1.6.1-1 for the system bandwidth.
Each bit in the Bitmap indicates a small contiguous group
whose size depends on the bandwidth (RBG: 14).
The maximum resource block (RB) coverage of any type 0
allocation is the whole signal bandwidth. A type 0 allocation
with all the bits in bitmap set to 1 means the whole signal.
Example
For 50 RB Bandwidth, the number of bits in Bitmap are 17.
Each bit in the 17 bit bitmap selects a group of 3 RB (apart
from the last group which will only contains 2 RB for this BW).
Each bit is associated with a group of RE with the same color.
RF100 - 422
November, 2014
Resource Allocation Type 1

Type 1 resource allocation uses a bit map to indicate physical resource blocks
inside an RB subset p, where 0 p < P. Even with all the bits in the Bitmap set
to 1, it does not span the whole signal bandwidth. Each bit in the bitmap selects a
single RB from islands of small contiguous groups whose size (RBG) and
separation depend on the total bandwidth. This allows selecting individual RBs.
Resource block assignment signaling is split into 3-parts:
RBSubset, Shift (whether to apply an offset when interpreting), and Bitmap
indicating the specific physical resource block inside the resource block group
subset. This makes Type 1 bitmap sizes smaller by [log2 (P)]+1 than Type 0.
Example 50 RB Bandwidth, the number of bits in Bitmap are 14. Each bit
selects one RB inside a selected subset. If all bits are set to one, we get:
RF100 - 423
November, 2014
Resource Allocation type 2

In Type 2 resource allocation, physical resource blocks are not
directly allocated. Instead, virtual resource blocks are allocated
which are then mapped onto physical resource blocks.
Type 2 allocation supports both localized and distributed virtual
resource block allocation differentiated by one bit-flag.
The information regarding the starting point of virtual resource
block and the length in terms of contiguously allocated virtual
resource block can be derived from Resource Indication Value
(RIV) signaled within the DCI.
Example 50 RB Bandwidth:
UE is assigned an allocation of 25 resource blocks (LCRBs =
25), starting from resource block 10 (RBstart = 10) in the
frequency domain.
To calculate the RIV value see the formula in TS 36.213
Section 7.1.6.3, which yields RIV = 1210. This RIV is signaled
in DCI and the UE can determine the starting resource block
and the number of allocated resource blocks from the RIV.
RF100 - 424
November, 2014
Non-Hopping and Hopping

Uplink Resource Allocation
Non-Hopping Uplink Resource Allocation
Type 2 localized resource allocation rules allow deriving the resource
allocation from the RIV value.
Uplink Hopping Resource Allocation two types of hopping exist:
Type 1 PUSCH Hopping
Type 1 PUSCH Hopping is calculated using the RIV value and a
number of parameters signaled by higher layers;
Type 2 PUSCH Hopping (not the same thing as downlink resource
allocation type 1 and type 2 described earlier) is calculated using a
pre-defined pattern (a function of subframe/frame number) defined in
TS36.211 5.3.4.
The fundamental set of resource blocks is calculated from the rules for
type 2 localized resource allocation from the RIV value, except either 1 or
2 hopping bits deduced from bandwidth and resource allocation bitmap.
These hopping bits specify whether Type 1 or Type 2 PUSCH
Hopping is to be used, and for the case of 2 bits, variations of the
position of the Type 1 hopping in the frequency domain. The
definition of the hopping bits is in TS 36.213 Table 8.4-2.
RF100 - 425
November, 2014
Intercell Interference
RF100 - 426
November, 2014
LTEs Achilles Heel:

Intercell Interference and its Coordination
LTE signals are unlike CDMA the traffic channels of different

cells are not coded orthogonally different from each other
Cochannel interference will result if adjacent cells use adjacent
frequencies to serve distant UEs in the border areas
The LTE standards provide methods for cells to communicate their
present loading to one another
LTE manufacturers are allowed to develop their own algorithms for
cells to dynamically coordinate the subcarriers used to serve their
various mobiles to avoid interference as much as possible
RF100 - 427
November, 2014
The LTE Core Network
RF100 - 428
November, 2014
Circuit-Switched vs. Packet-Switched

MME
HLR
MSC
PSTN
BSC
TRC
BTS
P GW
MS
S GW
Internet
VPNs
UE
eNB
For voice calls, the original cellular technologies used circuit-switched connection a
steady circuit as long as the call lasts.
The voice path from a mobile to a landline phone was steady:
Continuous radio transmission between phone and BTS
Continuous bitstream from BTS over backhaul to the BSC
Continuous trunk: BSC thru Switch to destination phone
Even during a pause in conversation, the links stayed up
Data sent over cellular uses Packet-switched methods
The flow of data occurs in instantaneous spurts as needed
No steady signal between phone and BTS; the radio signal in each direction
exists only when a packet is being sent
Data goes between BTS and BSC intermittently as packets
Data from the BSC goes through routers to and from the internet
intermittently, as packets
GPRS, EDGE, 1xRTT, EV-DO, HSPA and LTE systems are all packet-switched
RF100 - 429
November, 2014
The LTE Evolved Packet Core Network, EPC

PCR
In the wireless data technologies
F
before LTE, there were many
proprietary network elements
HSS
Base Station Controllers and
Evolved
MME
PDN
SGW
Radio Network Controllers,
UPE
GW
RAN: eNB
which used manufacturerEvolved Packet Core
Uu
proprietary messages and
link formats
The BSC/RNC had to be the
same brand of equipment as
the BTS
One of the goals of the LTE standard is to eliminate proprietary devices and
allow different brands of equipment to work together
The intelligence for scheduling data bursts and arranging handoffs has
been standardized and moved into the eNodeBs
This means no proprietary BSC or RNC is needed
Standard TCP/IP techniques are used for all data movement
A new standardized non-proprietary Mobility Management Entity (MME)
is the intelligent matchmaker guiding setup of data sessions, handoffs,
and other processing events
Policy and Charging Rules Function
Home Subscriber Server

Super HLR
Mobility Management Entity,

User Plane Entity
Internet
Serving Gateway
Inter Access System Anchor
IASA
LTE radio
Networks
The PDN Gateway is also sometimes called the

System Architecture Evolution Anchor
RF100 - 430
November, 2014
EPC Elements
PCR
F

Super HLR
HSS
Mobility Management Entity,

User Plane Entity
Evolved
RAN: eNB
LTE radio
Networks
MME
UPE
Uu
SGW
PDN
GW
Serving
Gateway
Internet
IASA
Evolved Packet Core
The PDN Gateway is also sometimes called

the System Architecture Evolution Anchor
Serving GW, PDN GW The Serving and PDN gateways transport the IP
data traffic between User Equipment (UE) and external networks.
The Serving GW connects the radio-side and the EPC.
The PDN GW connects EPC and external IP networks (PDN).
MME The Mobility Management Entity handles the control plane, in
particular signaling related to mobility and security for UEs. It handles UE
tracking and paging, and is the termination point of the NAS.
HSS The HSS (Home Subscriber Server) is a database that contains
user and subscriber information. It provides support functions in mobility
management, call and session setup, user authentication and access
authorization. Its a combination of Home Location Register (HLR) and
Authentication Center (AuC) functions.
RF100 - 431
November, 2014
Functions of the Evolved Packet System

and the Evolved Packet Core Elements
E-UTRAN
eNB
Inter-cell RMM
EPC
RB Control
Connection Mobility Ctrl
MME
Radio Admission Ctrl.
NAS Security
eNB Measurement
Config. & Provision
Idle State Mobility

Handling
Dynamic Resource
Allocation (scheduler)
EPS Bearer
Control
RRC
PDCP
S-GW
RLC
MAC
Mobility
Anchoring
S1
P-GW
UE IP Address
Allocation
PHY
Packet Filtering
RF100 - 432
Internet
November, 2014
Networking Functional Elements

(eNB; MME; Anchors/Gateways, PCRF; HSS)
Legacy GSM radio Networks
Gb
GERAN
SGSN GPRS CORE

S3
WCDMA /HSPA radio Networks

Mobility Management Entity
User Plane Entity
Evolved
RAN: eNB
LTE radio
Networks
S1
Ref Pt.
MME
UPE
S4
Ref Pt.
Serving
Gateway

Super HLR
S6a
PDN
Gateway
HSS
SGi
IASA
Outside IP
World: The
Internet
Evolved Packet Core
Uu
S2a
1xRTT, CDMA2000,
EV-DO networks
RF100 - 433
Rx+
S7
S5b
Iu
S5a
UTRAN
PCRF
Non-3GPP
IP access
S2b,c
WLAN 3GPP
IP access
November, 2014
Key Network Interfaces (1)

Uu The LTE physical layer interface connecting the UE with the
eNodeB on both uplink and downlink directions (GTP-U Protocol)
S1-MME The Control Plane (command and control) connection
from the eNB to the MME managing user mobility (GTP)
S1-U The User Plane (traffic-carrying) connection from the eNB
to the serving gateway (GTP protocol)
S2a PDN link to trusted non-3GPP networks (CDMA EVDO)
(based on proxy mobile IP, can use client mobile IP FA mode)
S2b PDN link to serving gateway for an untrusted network GTP
(based on proxy mobile IP)
S2c PDN link to trusted non-3GPP network (CDMA, EVDO) GTP
(based on client mobile co-location)
S3 Connection between 2G/3G SGSN and SAE MME (GTP)
S4 -- Provides user plane connection and mobility support
between a 2G/3G SGSN and the SGW (based on Gn reference
point defined between SGSN and GGSN) (GTP protocol)
RF100 - 434
November, 2014

S5 Provides user plane tunneling and tunnel management
between SGW and PDN GW. Handles S GW relocation for UE
mobility if the S GW must connect to a non-collocated PDN GW.
S5 is the intra PLMN variant of S8.
S6a Carries subscription and authentication data between the
MME and the HSS (often called a super HLR)
S7 Carries policy and charging rules information between the
PDN gateway and the PCRF
S8 Inter-PLMN reference point providing user and control plane
between the Serving GW in the VPLMN and the PDN GW in the
HPLMN. S8 is the inter PLMN variant of S5.
S9 - Transfers (QoS) policy and charging control information
between Home/Visited PCRF to support local breakout function.
S10 -- Reference point between MMEs for MME relocation and
MME to MME information transfer
RF100 - 435
November, 2014

S11 -- Reference point between MME and Serving GW
S12 Connection from UTRAN to Serving GW during user plane
Direct Tunnel. Based on Iu-u/Gn-u ref. point and GTP-U protocol
SGSN-to-UTRAN or SGSN-to-GGSN. Optional by Operator.
S13 Enables UE identity check between MME and EIR
SGi -- Reference point between PDN GW and packet data
network. Packet data network can be external public, private, or
intra-operator packet data network, e.g. for provision of IMS.
Corresponds to Gi interface for 3GPP accesses.
Rx -- The Rx reference point resides between the AF and the
PCRF in the TS 23.203 [6].
Wn* The reference point between the Untrusted Non-3GPP IP
Access and the ePDG. Traffic on this interface for a UE initiated
tunnel must be forced towards the ePDG.
RF100 - 436
November, 2014

X2 -- The X2 interface can provide
inter-connection of eNBs supplied by different manufacturers;
support of continuation between eNBs of the E-UTRAN
services offered via the S1 interface;
separation of X2 interface Radio Network functionality and
Transport Network functionality to facilitate introduction of
future technology.
SBc:- Reference point between CBC and MME for warning
message delivery and control functions
RF100 - 437
November, 2014
X1 and S1 Interfaces
Another advantage with the distributed solution is that the MAC
protocol layer, which is responsible for scheduling, is represented only
in the UE and in the base station leading to fast communication and
decisions between the eNB and the UE.
In UMTS the MAC protocol, and scheduling, is located in the
controller and when HSDPA was introduced an additional MAC
sub-layer, responsible for HSPA scheduling was added in the NB.
RF100 - 438
November, 2014
LTE Scheduling
RF100 - 439
November, 2014
Resource Allocation in LTE

Resources in LTE
Resource Grid, Resource Block, Slot, Sub-frame
Control Information
Physical Channels, PDCCH, DCI
Resource Allocation
Resource Block Group (RBG) based
RBG Subset based
Virtual Resource Block (VRB)-based
Helpful Link: very useful utility showing LTE resource grid
http://paul.wad.homeSlide.dk/LTE/lte_resource_grid.html
RF100 - 440
November, 2014
The Downlink Scheduler

The Downlink Scheduler must manage the assignment of
resource blocks to users for the downlink shared channel, and the
Modulation and Coding Schemes (MCS) to be used on
transmissions to individual UEs.
The scheduler is ultimately responsible for maximizing the overall
throughput through each EnodeB and the data delivered to the
users.
In order to correctly manage the air resources, the Downlink
Scheduler must be aware of the data waiting to be sent and
frequently receive channel RF condition details from the UEs.
Amount and type of data waiting to be sent to each UE
Channel RF condition (CQI) measurements from each UE
RF100 - 441
November, 2014
The Uplink Scheduler

The Uplink Scheduler must manage the assignment of resource
blocks to users for the uplink shared channel
The mechanism is similar to the Downlink Scheduler but the
directions are reversed
Uplink Channel quality measurements are made by the
eNodeB
Mobiles report the data in their buffers ready to be sent and
request authority to begin transmission
The uplink scheduler applies QOS and throughput
maximization strategies to achieve an optimum user
experience
RF100 - 442
November, 2014
LTE Scheduling
The eNodeB allocates physical layer resources for the uplink and
downlink shared channels (UL-SCH and DL-SCH). Resources are
composed of Physical Resource Blocks (PRB) and Modulation
Coding Scheme (MCS). The MCS determines the bit rate, and
thus the capacity, of PRBs. Allocations may be valid for one or
more TTIs; each TTI interval is one subframe (1 ms).
Semi-persistent scheduling reduces control channel signaling. If
every allocation was individually signaled, the overhead would be
unacceptable. In an application such as voice over IP, for example,
a downlink frame occurs every 10 to 20 milliseconds. If each
downlink frame were signaled individually, it would cause a lot of
traffic on the control channel and the control channel would need a
lot more bandwidth than necessary. Semi-persistent scheduling
lets you set up an ongoing allocation that persists until it is
changed. Semi-persistent schedules can be configured for both
uplink and downlink.
RF100 - 443
November, 2014
Scheduling: Transmission Time Interval (TTI)

The scheduler is the main player in rapidly utilizing radio resources. The
smallest Transmission Time Interval (TTI) is only 1 ms.
During each TTI the eNB scheduler:
considers the physical radio environment per UE. The UEs report
received radio quality to the scheduler which decides which
Modulation and Coding scheme to use. The scheduler rapidly adapts
to channel variations, using HARQ (Hybrid Automatic Repeat
Request), soft-combining, and rate adaptation.
prioritizes QoS requirements among the UEs. Both delay sensitive
and rate-sensitive data services are accomodated.
informs UEs of their allocated downlink and uplink radio resources.
Each UE scheduled in a TTI gets a Transport Block (TB) carrying its data.
On downlink there can be a maximum of two TBs generated per UE if
using MIMO. The TBs are delivered over a transport channel.
The user plane has only one shared channel in each direction. The TB
can contain bits from several services, multiplexed together.
In theory the highest number of users that can be scheduled during 1
ms is 440, presuming 20 MHz band and 4x4 Multi User MIMO.
RF100 - 444
November, 2014
Waking Up with a UE:

LTE Call Processing
RF100 - 445
November, 2014
System Acquisition
Searching In Frequency
Searching In Time
At power-up, the UE notes its LTE band class capabilities and begins
exploring all the possible center frequencies that might be hold the SCH
The UE first looks for the primary synchronization signal (P-SCH) in the
last OFDM symbol of the first time slot of the first subframe (subframe 0)
in each radio frame. It reads symbol timing, and learns which of three cell
identities is being transmitted, and locks its frequencies to the eNB.
The UE next searches for the (S-SCH) secondary synchronization signal,
and learns which of 170 cell identities it carries. From this it decodes the
PCI, physical cell identity, and the frame boundaries
The UE next finds the RS sequence and learns antenna port configuration
Now the UE can decode the P-BCH and apply cell selection and
reselection criteria
RF100 - 446
November, 2014
Cell Reselection (Idle Mode Handover)

The mobile is in power-conservation mode
Does not inform network of every cell change; rather, just when
it detects entry into a new Tracking Area
UE-terminated calls are paged in the UEs last reported TA
TA organization and procedures have been widely debated
Static non-overlapping TAs were used in earlier technologies
New techniques reduce ping-ponging, distribute TA update
load more evenly across cells, and reduce aggregate TA
update load
Mechanisms include overlapping TAs, multiple TAs, and
distance-based schemes
RF100 - 447
November, 2014
Cell Search Measurements

An LTE UE measures reference signal RSRP (Reference Signal Received
Power) and RSRQ (Reference Signal Received Quality).
RSRP is a RSSI type of measurement. It measures the average received
power over the resource elements that carry cell-specific reference signals
within certain frequency bandwidth.
RSRQ is a C/I type of measurement and it indicates the quality of the
received reference signal, defined as (N*RSRP)/(E-UTRA Carrier RSSI),
N ensures the nominator and denominator are measured over the
same frequency bandwidth;
carrier RSSI measures the average total received power observed
only in OFDM symbols containing reference symbols for antenna port
0 in the measurement bandwidth over N resource blocks. The total
carrier RSSI includes all incoming RF from all sources.
RSRP is applicable in both RRC_idle and RRC_connected modes, while
RSRQ is only applicable in RRC_connected mode.
In the procedure of cell selection and cell reselection in idle mode, RSRP
is used. In the procedure of handover, the LTE specification provides the
flexibility of using RSRP, RSRQ, or both.
RF100 - 448
November, 2014
Physical Layer Measurements Definition

Physical layer measurements to support mobility are classified as:
within E-UTRAN (intra-frequency, inter-frequency);
between E-UTRAN and GERAN/UTRAN (inter-RAT);
between E-UTRAN and non-3GPP RAT (Inter 3GPP access
system mobility).
For measurements within E-UTRAN at least two basic UE
measurement quantities shall be supported:
Reference symbol received power (RSRP);
E-UTRA carrier received signal strength indicator (RSSI).
RF100 - 449
November, 2014
LTE Measurement: RSSI

LTE Carrier Received Signal Strength Indicator (RSSI)
Definition: The total received wideband power observed by the UE
from all sources, including co-channel serving and non-serving
cells, adjacent channel interference and thermal noise within the
bandwidth of the whole LTE signal.
Uses: LTE carrier RSSI is not used as a measurement by itself,
but as an input to the LTE RSRQ measurement.
LTE Downlink
RF100 - 450
November, 2014
LTE Measurement: RSRP

LTE Reference Signal Received
Power (RSRP)
Definition: RSRP is the linear
average power of the
Resource Elements (REs)
carrying a specific cells RS
within the considered
measurement frequency
bandwidth.
Uses: Rank cells for
reselection and handoff.
Notes: Normally based on the
RS of the first antenna port, but
the RS on the second antenna
port can also be used if they
are known to be transmitted.
RF100 - 451
November, 2014
LTE Measurement: RSRQ
RB RB RB RB RB RB RB RB RB RB RB RB
LTE Reference Signal Received Quality (RSRQ)

Definition: RSRQ = N RSRP / RSSI
N is the number of Resource Blocks (RBs) of the LTE carrier
RSSI measurement bandwidth. Since RSRQ exists in only one
or a few resource blocks, and RSSI is measured over the
whole width of the LTE signal, RSRQ must be scaled up for a
fair apples-to-apples comparison with RSSI.
Uses: Mainly to rank different LTE cells for handover and cell
reselection decisions
Notes: The reporting range of RSRQ is defined from 19.5 to 3
dB with 0.5 dB resolution. -9 and above are good values.
RF100 - 452
November, 2014
Getting Needed Cell Parameters:

Information Blocks
inter
The Master Information Block (MIB) gives the basic signal configuration
and bandwith
System Information Block 1 declares what other information blocks exist,
and the mobile goes about collecting all their contents
The MIB and SIB1 are carried by the BCH channel; all the other SIBS are
carried by the DL-SCH
RF100 - 453
November, 2014
Special Details for TDD

In TDD, the Primary synchronization signal (PSS) is placed at the
third symbol in subframes #1 and #6.
The Secondary Synchronization signal (SSS) is placed at the last
symbol in subframes #0 and #5.
The S-RACH is transmitted on the UpPTS within the special frame
The Primary Broadcast Channel (PBCH) and the Dynamic
Broadcast Channel (D-BCH) are located just as in LTE FDD.
RF100 - 454
November, 2014
Idle Mode Operation
RF100 - 455
November, 2014
Tracking Area Update

Consider a UE in idle state (RRC idle and ECM idle)
This UE is free to travel and only do a Tracking Area Update
(TAU) when it discovers it has landed on a cell in a different TA
If data arrives for the UE, the system must Page the UE
throughout the TA where it last registered
The mobile responds to the page, implicitly revealing its cell
location and re-establishing its connection to the network
When a mobile is switched on it always has at least a
default bearer with the IP address that comes with it
A UE is in ECM-IDLE state when no NAS signaling connection
exists between the UE and the network
The mobile only performs cell selection and PLMN selection
There is no UE context, no S1_MME and no S1_U connection
The UE will perform the TA procedure when the TAI in the
EMM isnt on the UEs registered list of Tas
The UE will then be in ECM-CONNECTED state again
RF100 - 456
November, 2014
More EMM
EPS also includes the concept of TAL, the Tracking Area List.
A uE does not need to initiate a TAU when it enters a new Tracking
Area, if that area is already in its present Tracking Area List
Provisioning different lists to the UEs can avoid signaling peaks when
a large nujmber of Ues cross a TA border, for example on a train or
other public transport
EMM Connection Management Procedures
Service request UE initiates to begin NAS signaling connection
Network-initiated paging on NAS to UE to send service request
Transport of NAS messages for SMS (CS fallback)
Generic transport of NAS messages, various others
RF100 - 457
November, 2014
Access Barring During System Overload

Every UE is in one of ten randomly allocated Access Classes (AC) 0 to 9,
stored in the SIM/USIM. A UE can also be in one or more of 5 special
categories (Access Classes 11 to 15), in the SIM/USIM:
0-9: Regular users, 10: Users calling emergency numbers
11 - For PLMN special use, 12 - Security Services
13 - Public Utilities (e.g. water/gas suppliers)
14 - Emergency Services, 15 - PLMN Staff
During overload, the network can cope by changing the SIB2 (System
Information Block Type 2). The UE generates a random number Rand
and must pass a persistence test before making an access attempt.
By setting ac-Barring to a lower value, normal UEs are randomly
delayed while priority users with AC11 15 have no restriction
Regular users AC 0 9 obey ac-Barring Factor and ac-Barring Time.
Emergency calls (AC10) use ac-Barring For Emergency on or off
UEs of AC11- 15 use ac-Barring For Special AC on or off
The eNB transmits mean duration of access control and the barring
rate for each type of access attempt (data origination, signaling orig.)
Service Specific Access Control (SSAC) can restrict attempts by
service type.
RF100 - 458
November, 2014
Flow Examples
Random Access
RF100 - 459
November, 2014
What is Random Access?

An LTE UE uses the random access process to gain access to a
cell for any the following reasons:
Initial access to the network from the idle state
For performing an initial attach
For initiating a new call
For responding to a Page
Regaining access to the network after a radio link failure
During the handover process to gain timing synchronization
with a new cell
Before uplink data transfers when the UE is not time
synchronized with the network
The random access process allows multiple user equipment to
gain simultaneous access to a cell by using different random
access preamble sequence codes. User equipment on the uplink
in specific Physical Random Access Channel (PRACH) subframes
transmits these codes.
RF100 - 460
November, 2014
Contention-Based Random Access (CBRA)

The UE initiates the Contention Based Random Access (CBRA)
process to gain access to the network. It involves the UE selecting
a random access preamble code from a list of codes available for
selection by all UE in the cell.
Unfortunately, Contention can occur when multiple UEs just
happen to pick the same PRACH subframe and use the same
preamble code. CBRA additional messaging is required to resolve
such conflicts.
Random Access is Contention-Based in all of the following
situations: Initial network access, Access following a radio link
failure, Handover between cells, and data transfers on either uplink
or downlink when UE synchronization must be established
Random Access is NOT Contention-Based during handoffs, since
the system can assign a specific preamble for the UE to use in
accessing the new site and there is no danger another UE will
intrude or compete
RF100 - 461
November, 2014
The Steps of the Random Access Process
RF100 - 462
November, 2014
eNB Announces the Rules,

1. UE Transmits the first
Random Access Preamble
All the UEs learn the necessary details of the Random Access
process before they even need to use it. The network transmits it in
overhead messages. The key details include:
Which Preamble Format to use
Usually Preamble Format 0 providing range up to about 14
kM. Other formats are available if greater range is needed.
When the PRACH occurs, usually once per 10 ms. radio frame
How the UE should calculate its open loop transmit power for its
initial transmissions before the eNB acknowledges it
When the eNB finally responds, it will take over using closed
loop power control
Step 1: Now the UE transmits its first Random Access Preamble.
3GPP TS 36.321 contains more information on power control.
RF100 - 463
November, 2014
2. eNB sends Random Access

Response Message
When the eNB hears the UEs random
access preamble, it generates and sends a
Random Access Response Message on the
Physical Downlink Shared Channel (PDSCH)
Its addressed to a specific Random Access Radio Network
Temporary Identifier (RA-RNTI) address.
Theres room in the RARM for multiple RA-RNTI addresses in
case multiple UEs were heard and need to be acknowledged
The UE watches the PDCCH for its specific RA-RNTI address to
recognize its random access response message, which contains:
Random access preamble sequence code identifying the
preamble sequence code which has been detected by the eNB
Initial uplink schedule grant used for transmitting subsequent
data on the uplink channel
Timing Alignment information so packet collisions wont occur
A Cell Radio Network Temporary Identifier (C-RNTI) for the UE
RF100 - 464
November, 2014
CBRA Contention Resolution:

Steps 3 and 4
Contention resolution steps (3 and 4) are
used whenever multiple UEs are detected
attempting random access using the same
preamble code sequence.
Step 3: The UE hears the RARM and makes its first scheduled
uplink transmission on Physical Uplink Shared Channel (PUSCH).
The UE gives the network a unique identifier in this message.
Step 4: The eNB repeats back the UE identity provided in step 3. A
UE which hears a match with the identity it transmitted now
declares the random access procedure successful. It transmits an
acknowledgment in the uplink.
UEs which dont hear a match know they have failed the random
access procedure. They have to start over again at step 1.
Both step 3 and step 4 use the Hybrid Automatic Repeat Request
(HARQ) process. Further details on the contention resolution
process and the HARQ process are in Chapter 5.1 of 3GPP TS
36.321.
RF100 - 465
November, 2014
Flow Examples
Initial Attach
RF100 - 466
November, 2014
LTE Initial Attach
The S1 interface is initialized by request from the eNB to the MME
RF100 - 467
November, 2014
LTE Initial Attach
The MME confirms setup of the S1AP interface by sending an S1

Setup Successful Outcome message to the eNB
S1 Setup: This is where eNB is attached to the network. As long
the eNB is functioning the S1 setup remains.
RF100 - 468
November, 2014
LTE Initial Attach
The UE sends an RRC connection request message to the eNB
RF100 - 469
November, 2014
LTE Initial Attach
The eNB sends an RRC Connection Setup message to the UE
RF100 - 470
November, 2014
LTE Initial Attach
The UE sends an RRC Connection Setup Complete message to

the eNB
The message contains an NAS attachment request and a
PDN connectivity request
RRC Connections: Once UE comes up a RRC connection is
established for communication with the network.
RF100 - 471
November, 2014
LTE Initial Attach
The eNB sends the requests on to the MME

NAS Attach Request
PDN connectivity request
NAS: After RRC is established then the NAS signaling begins .
UE sends Attach request along with PDN connectivity request
to network.
Attach is for attaching to the network and the other message
are for establishing the bearers.
RF100 - 472
November, 2014
LTE Initial Attach
The MME sends an Authentication Info Request to the HSS

HSS: This is Home Subscriber System and it understands
diameter protocol. Once MME receives Attach Request, it queries
HSS for authentication details. HSS sends the authentication
vectors to MME in Authentication Info Answer
RF100 - 473
November, 2014
LTE Initial Attach
The HSS responds to the MME with an Authentication Info Answer
RF100 - 474
November, 2014
LTE Initial Attach
The MME now has sufficient information to begin authentiation of

the UE
The MME sends an S1AP DL NAS Transport and NAS message
containing the Authentication Request
RF100 - 475
November, 2014
LTE Initial Attach
The eNB sends a RRC DL info Transfer and NAS message to the
UE, containing the Authentication Request
Authentication/Security: Networks request Authentication Vectors
from UE. Once UE provides them, MME compares them with what
HSS has sent. If they match UE is authenticated. Next is security.
After the security all the NAS messages are encrypted using the
security algorithms that were exchanged.
RF100 - 476
November, 2014
LTE Initial Attach
The UE replies with an RRC UL info transfer and NAS message

including an NAS Authentication Response
RF100 - 477
November, 2014
LTE Initial Attach
The eNB sends an S1AP UL NAS transport and NAS message

containing the Authentication Response
RF100 - 478
November, 2014
LTE Initial Attach
The MME processes the authentication response and if

successful, sends a DL NAS Transport and NAS message
containing a Security Mode Command to the eNB.
RF100 - 479
November, 2014
LTE Initial Attach
The eNB sends a DL Info Transfer and NAS message including

the Security Mode Command to the UE.
RF100 - 480
November, 2014
LTE Initial Attach
The UE confirms it has applied the Security Mode Command by

sending to the eNB a UL Info Transfer and NAS message
containing Security Mode Complete
RF100 - 481
November, 2014
LTE Initial Attach
The eNB forwards a UL NAS Transport and NAS message to the

MME with the Security Mode Complete details.
RF100 - 482
November, 2014
LTE Initial Attach
Now the MME is able to send a Create Session Request to the

SGW.
After security mode is complete, all the NAS messages are
encrypted using the security algorithms that were exchanged.
RF100 - 483
November, 2014
LTE Initial Attach
The PGW sends a Proxy Binding Update/ACK message to the

SGW using PMIP
RF100 - 484
November, 2014
LTE Initial Attach

The SGW sends a Create Session Response to the MME using
GTP
RF100 - 485
November, 2014
LTE Initial Attach

MME sends eNB the Initial Context Setup Request and NAS
message containing Attach Accept and Activate Default EPS
Bearer Context Request
RF100 - 486
November, 2014
LTE Initial Attach

eNB sends RRC Connection Reconfiguration and NAS message
to UE containing Attach Accept, Activate Default EPS Bearer
Context Request.
RF100 - 487
November, 2014
LTE Initial Attach

UE sends RRC Configuration Complete message to eNB
RF100 - 488
November, 2014
LTE Initial Attach

MME sends Initial Context Setup Response message to the eNB
RF100 - 489
November, 2014
LTE Initial Attach

Security: network creates the EPS bearers (GTP messages). Then
radio bearers created, RRC connections modified, radio bearers
created, eNB downlink addresses sent to SGW in GTP messages
RF100 - 490
November, 2014
LTE Initial Attach

eNB sends UL NAS transport and NAS Attach Complete message
to MME, and Activate Default EPS Bearer Context Accept
RF100 - 491
November, 2014
LTE Initial Attach

MME sends Modify Bearer Request by GTP to the SGW
RF100 - 492
November, 2014
LTE Initial Attach

Attach complete
RF100 - 493
November, 2014
Flow Examples
UE Detach
RF100 - 494
November, 2014
LTE UE Detach
The UE is attached to this network. It decides to detach.
In the following Slides,
It sends a detach request message to network.
Network deletes the EPS bearers
then the radio bearers are torn down.
Finally RRC connection is released.
RF100 - 495
November, 2014
LTE UE Detach
The UE sends an RRC UL Info Transfer + NAS containing a

detach request.
RF100 - 496
November, 2014
LTE UE Detach
The eNB sends to the MME an UL NAS Transport + NAS

message containing a Detach request
RF100 - 497
November, 2014
LTE UE Detach
The MME sends a Delete Session Request to the SGW using GTP
protocol.
RF100 - 498
November, 2014
LTE UE Detach
The SGW sends the PGW a PMIP Proxy Binding Update, deleting
the EPS bearers.
RF100 - 499
November, 2014
LTE UE Detach
The PGW sends a PMIP Proxy Binding ACK to the SGW
RF100 - 500
November, 2014
LTE UE Detach
The SGW sends a Delete Session Response message by GTP to

the MME.
RF100 - 501
November, 2014
LTE UE Detach
The MME updates the HSS on the UEs detachment with a Notify
Request
RF100 - 502
November, 2014
LTE UE Detach
The HSS confirms it has received the notification by sending a

Notify Answer to the MME
RF100 - 503
November, 2014
LTE UE Detach
Now the MME sends the eNB a DL NAS Transport + NAS Detach
Accept
RF100 - 504
November, 2014
LTE UE Detach
The eNB sends the UE an RRC Connection Reconfiguration

message
RF100 - 505
November, 2014
LTE UE Detach
The UE confirms to the eNB by sending an RRC Connection

Reconfiguration Complete message
RF100 - 506
November, 2014
LTE UE Detach
The MME sends the eNB a UE Context Release Command
RF100 - 507
November, 2014
LTE UE Detach
The eNB responds to the MME with a UE Context Release

Complete message
RF100 - 508
November, 2014
LTE UE Detach
The eNB sends the UE an RRC Connection Release message

RF100 - 509
November, 2014
LTE QoS and Bearers
RF100 - 510
November, 2014
Tunnels, Connections and Bearers

Default Bearers, Dedicated Bearers
GPRS Tunneling Protocol (GTP) and Proxy Mobile IP (PMIP)
Tunnel parameters (TEID; F-TEID )
RF100 - 511
November, 2014
LTE Bearers
In LTE, data plane traffic travels over virtual connections called

service data flows (SDFs).
SDFs travel over bearers: Virtual containers with unique QoS
characteristics.
A bearer is a datapath between UE and PDN, in three segments:
Radio bearer between UE and eNodeB
Data bearer between eNodeB and SGW (S1 bearer)
Data bearer between SGW and PGW (S5 bearer)
RF100 - 512
November, 2014
LTE QoS Architecture

LTE architecture supports hard QoS, with end-to-end quality of
service and guaranteed bit rate (GBR) for radio bearers. Just as
Ethernet and the internet have different types of QoS, for example,
various levels of QoS can be applied to LTE traffic for different
applications. Because the LTE MAC is fully scheduled, QoS is a
natural fit.
Evolved Packet System (EPS) bearers provide one-to-one
correspondence with RLC radio bearers and provide support for
Traffic Flow Templates (TFT). There are four types of EPS
bearers:
GBR Bearer resources permanently allocated by admission
control
Non-GBR Bearer no admission control
Dedicated Bearer associated with specific TFT (GBR or nonGBR)
Default Bearer Non GBR, catch-all for unassigned traffic
RF100 - 513
November, 2014
QoS Parameters and TFTs (1)

A Traffic Flow Template (TFT) is all the packet filters associated with an EPS bearer.
A packet filter may be associated with a protocol.
Several packet filters can be combined to form a Traffic Flow Template.
EBI+Packet filter ID gives us a "unique" packet filter Identifier. The following is the
TFT for FTP protocol.
RF100 - 514
November, 2014

Bearer level QoS is associated with a bearer and all traffic mapped
to that will receive same bearer level packet forwarding treatment.
QoS parameter values of the default bearer are assigned by the
network based on the subscription data received from HSS.
In LTE the decision to establish or modify a dedicated bearer is
taken by EPC and bearer level QoS parameters are assigned by
EPC. These values are not modified by MME but are forwarded
transparently to EUTRAN. However MME may reject the
establishment of dedicated bearer if there is any discrepancy.
RF100 - 515
November, 2014

A default bearer may or may not be associated with a TFT. But a
dedicated bearer is always associated with TFT.
So we have bearers, the QoS values for them and TFT which
indicate what type of application should run over them. This
defines the LTE QoS. We have Uplink TFT and Downlink TFT
which are used by UE and PDN
The UE routes uplink packets to the different EPS bearers based
on uplink packet filters in the TFT's assigned to those EPS
bearers.
We have evaluation packet precedence index in packet filter
which is used by UE to search for a match (to map the
application traffic).
Once the UE finds a match it uses that particular packet filter to
transmit the data.
If there is no match UE transmits the data on bearer to which
no TFT has been assigned.
RF100 - 516
November, 2014
Flow Examples
Default Bearer Establishment

Incoming
RF100 - 517
November, 2014
LTE Default Bearer Establishment, Incoming

UE is in RRC_IDLE condition
RF100 - 518
November, 2014
MME has traffic for specific UE. It sends page messages to all
eNBs in UEs current tracking area (TA).
RF100 - 519
November, 2014
eNB sends Page message over air interface for UE
RF100 - 520
November, 2014
UE recognizes the page and responds by sending RRC

Connection Request message to eNB
RF100 - 521
November, 2014
eNB sends RRC Connection Setup message to UE
RF100 - 522
November, 2014
UE sends eNB a RRC Connection Setup Complete message and

NAS message including Attach Request and PDN Connectivity
Request
RF100 - 523
November, 2014
eNB sends Initial UE Message + NAS attach request and PDN

connectivity request to MME
RF100 - 524
November, 2014
MME sends Create Session Request to SGW using GTP
RF100 - 525
November, 2014
SGW sends PGW a PMIP Proxy Binding Update
RF100 - 526
November, 2014
PGW responds to SGW with PMIP Proxy Binding ACK
RF100 - 527
November, 2014
SGW sends Create Session Response to MME
RF100 - 528
November, 2014
MME sends eNB Initial Context Setup request + NAS Activate

Default EPS Bearer Context Request and Attach Accept
RF100 - 529
November, 2014
eNB sends UE an RRC Connection Reconfig and NAS Activate

Default EPS bearer context request and Attach Accept
RF100 - 530
November, 2014
UE responds with RRC Connection Reconfiguration Complete
RF100 - 531
November, 2014
eNB sends Initial Context Setup Response to MME
RF100 - 532
November, 2014
UE sends eNB an RRC UL Info Transfer and NAS Activate Default

EPS bearer context accept and Attach Accept
RF100 - 533
November, 2014
eNB sends to MME UL NAS Transport and NAS Activate Default

EPS Bearer Context Accept and Attach Accept
RF100 - 534
November, 2014
MME sends Modify Bearer Request to SGW using GTP

RF100 - 535
November, 2014
SGW responds to MME with Modify Bearer Response over GTP

RF100 - 536
November, 2014
Flow Examples
Default Bearer Establishment

Outgoing
RF100 - 537
November, 2014
LTE Default Bearer Establishment, Outgoing
UE is in RRC_Idle mode
UE has data and needs connection to network
RF100 - 538
November, 2014
UE sends RRC Connection Request to eNB
RF100 - 539
November, 2014
eNB sends RRC Connection Setup to UE
RF100 - 540
November, 2014
UE sends RRC Connection Setup Complete and NAS Attach

Request and PDN Connectivity Request to eNB
RF100 - 541
November, 2014
eNB sends Initial UE Message and NAS Attach Request and PDN
Connectivity Request to MME
RF100 - 542
November, 2014
MME sends Create Session Request to SGW using GTP
RF100 - 543
November, 2014
SGW semds PMIP Proxy Binding Update to PGW
RF100 - 544
November, 2014
PGW sends PMIP Proxy Binding Ack to SGW
RF100 - 545
November, 2014
SGW sends Create Session Response to MME by GTP
RF100 - 546
November, 2014
MME sends eNB an Initial Context Setup Request and NAS

Activate Default EPS Bearer Context request and Attach Accept
RF100 - 547
November, 2014
eNB sends UE an RRC Connection Reconfiguration and NAS

Activate Default EBS Bearer Context Request and Attach Accept
RF100 - 548
November, 2014
UE sends eNB RRC Connection Reconfiguration Complete
RF100 - 549
November, 2014
eNB sends MME an Initial Context Setup Response message
RF100 - 550
November, 2014
UE sends eNB RRC UL Info Transfer NAS Activate Default EPS

Bearer Context Accept and Attach Accept
RF100 - 551
November, 2014
eNB sends MME a UL NAS Transport + NAS Activate Default EPS

Bearer Context Accept and Attach Complete
RF100 - 552
November, 2014
MME sends SGW a Modify Bearer request by GTP

RF100 - 553
November, 2014
SGW sends MME a Modify Bearer Response message by GTP

RF100 - 554
November, 2014
Flow Examples
Intra-LTE (Intra-MME / SGW)

Handover
Using the X2 Interface
RF100 - 555
November, 2014
Case I. Intra-LTE (Intra-MME / SGW) Handover

User-Plane Traffic
Radio Interface
IP Traffic
The Data call is already established between the UE, S-eNB and
network elements.
Data packets are already flowing to/from the UE on both DL & UL.
RF100 - 556
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The Network sends a MEASUREMENT CONTROL REQ message

to the UE to set the measurement parameters and thresholds.
The UE is instructed to send measurement report when thresholds
are met.
RF100 - 557
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The UE sends a MEASUREMENT REPORT to the S-eNB as soon

as thresholds are met.
The S-eNB decides to hand UE off to a T-eNB using network
operators handover algorithm.
RF100 - 558
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
Optionally S-eNB issues RESOURCE STATUS REQUEST

message to determine the load on T-eNB.
Based on received RESOURCE STATUS RESPONSE, the S-eNB
can decide whether to continue the handover procedure using the
X2 interface.
RF100 - 559
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The S-eNB issues a HANDOVER REQUEST message to the TeNB with UE and RB contexts to prepare handover at the target.
RF100 - 560
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
T-eNB checks availability, reserves resources and sends back

HANDOVER REQUEST ACKNOWLEDGE message including a
transparent container for the UE as an RRC message to perform
the handover.
The container includes a new C-RNTI, T-eNB security algorithm
identifiers for the selected security algorithms, and may include a
dedicated RACH preamble and possibly some other parameters
(i.e., access parameters, SIBs, etc.).
RF100 - 561
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The S-eNB generates the RRC message to perform the handover,

i.e, RRCCONNECTION RECONFIGURATION message including
the mobility Control Information. The S-eNB performs the
necessary integrity protection and ciphering of the message and
sends it to the UE.
RF100 - 562
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The S-eNB sends the eNB STATUS TRANSFER message to the

T-eNB to convey the PDCP and HFN status of the E-RABs.
RF100 - 563
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The S-eNB starts forwarding the downlink data packets to the TeNB for all the data bearers (which are being established in the TeNB during the HANDOVER REQ message processing).
RF100 - 564
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
In the meantime, the UE tries to access the T-eNB cell using the
non-contention-based Random Access Procedure.
RF100 - 565
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
If it succeeds in accessing the target cell, it sends the RRC

CONNECTION RECONFIGURATION COMPLETE to the T-eNB.
RF100 - 566
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The T-eNB sends a PATH SWITCH REQUEST message to the

MME to inform it that the UE has changed cells, including the
TAI+ECGI of the target.
The MME determines that the SGW can continue to serve the UE.
RF100 - 567
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The MME sends a MODIFY BEARER REQUEST (eNodeB

address and TEIDs for downlink user plane for the accepted EPS
bearers) message to the SGW. If the PDN GW requested the UEs
location info, the MME also includes the User Location Information
IE in this message.
RF100 - 568
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The SGW sends one or more end marker packets on the old path
to the S-eNB and then can release any user plane / TNL resources
toward the S-eNB.
RF100 - 569
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
15. The MME responds to the T-eNB with a PATH SWITCH REQ
ACK message to notify the completion of the handover.
RF100 - 570
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
User data packets now flow between the SGW and the UE.
RF100 - 571
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The T-eNB now requests the S-eNB to release the resources

using the X2 UE CONTEXT RELEASE message. With this, the
handover procedure is complete.
RF100 - 572
November, 2014
Flow Examples
Intra-LTE (Intra-MME / SGW)

Handover
Using the S1 Interface
RF100 - 573
November, 2014
Case II. Intra-LTE (Intra-MME / SGW) Handover

User-Plane Traffic
Radio Interface
IP Traffic
The UE is sending and receiving user data on both the uplink and
downlink.
RF100 - 574
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The S-eNB sends an RRC: Measurement Control message to the

UE, instructing it to take certain measurements at specific intervals
and to report the results when specific criteria are met.
The UE sets to work taking the requested measurements and
performing comparisons against the specified criteria.
RF100 - 575
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The UE notices that measurements have satisfied the specified

criteria. It sends an RRC: Measurement Report to the Currently
Serving eNB.
The handover procedure in this section is very similar to that in the
previous section (Intra-LTE Handover Using the X2 Interface),
except the involvement of the MME in relaying the handover
signaling between the S-eNB and T-eNB.
RF100 - 576
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The serving eNB sends a Handover Required message to the

MME
RF100 - 577
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
MME sends Handover Request to Target eNB
RF100 - 578
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The Target eNB sends a Handover Request Acknowledgment to

the MME
RF100 - 579
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The MME sends a Handover Command to the serving eNB
RF100 - 580
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The Serving eNB sends an RRC Connection Reconfiguration

Request to the UE
RF100 - 581
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The Serving eNB sends an eNB Status Transfer message to the

MME
RF100 - 582
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The Serving eNB sends a Forward User Data message to the

SGW by GTP protocol
RF100 - 583
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The MME sends an MME Status Transfer message to the Target

eNB
RF100 - 584
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The UE performs the Non-Contention RACH Process on the

Target eNB
RF100 - 585
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The SGW sends Forward User Data to the Target eNB
RF100 - 586
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The UE sends an RRC Connection Reconfiguration Complete

message to the Target eNB
RF100 - 587
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The Target eNB sends a Handover Notify message to the MME
RF100 - 588
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The MME sends a Modify Bearer Request message to the SGW

by GTP
RF100 - 589
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The SGW sends a Modify Bearer Response to the MME by GTP
RF100 - 590
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
User data packets now flow between the UE and the SGW.
RF100 - 591
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The T-eNB sends an S1AP UE Context Release Command to the

the S-eNB.
RF100 - 592
November, 2014

User-Plane Traffic
Radio Interface
IP Traffic
The S-eNB confirms the requested UE context release by sending

the MME an S1AP UE Context Release Complete message.
RF100 - 593
November, 2014
Flow Examples
Inter-MME Handover (Intra-SGW)

(no change in Gateway)
RF100 - 594
November, 2014
Case III. Inter-MME Handover (Intra-SGW)

(no change in Gateway)
In an inter-MME handover, two MMEs are involved in the
handover, the source MME (S-MME) and target MME (T-MME).
The S-MME controls the S-eNB and the T-MME controls the TeNB; both MMEs are connected to the same SGW. This handover
is triggered when the UE moves from one MME area to another
MME area.
RF100 - 595
November, 2014

User-Plane Traffic
Radio Interface IP Traffic
downlink.
RF100 - 596
November, 2014

User-Plane Traffic
The Serving eNB sends a Handover Request to the Serving MME
RF100 - 597
November, 2014

User-Plane Traffic
The Serving MME sends a Forward Relocation Request to the

Target MME by GTP
RF100 - 598
November, 2014

User-Plane Traffic
The Target MME sends a Handover Request to the Target eNB
RF100 - 599
November, 2014

User-Plane Traffic
The Target eNB sends a Handover Request Acknowledgment to

the Target MME
RF100 - 600
November, 2014

User-Plane Traffic
The Target MME sends a Forward Relocation Response to the

Serving MME
RF100 - 601
November, 2014

User-Plane Traffic
The Serving MME sends a Handover Command to the Serving

eNB
RF100 - 602
November, 2014

User-Plane Traffic
The Serving eNB sends a RRC Connection Reconfiguration

Request to the UE
RF100 - 603
November, 2014

User-Plane Traffic
The Serving eNB sends an eNB Status Transfer to the Serving

MME, which forwards it to the Target MME
RF100 - 604
November, 2014

The Target MME sends an eNB Status Transfer to the Target eNB
RF100 - 605
November, 2014

The Serving eNB sends Forward User data to the SGW by GTP
RF100 - 606
November, 2014

The SGW sends Forward User Data to the Target eNB by GTP
RF100 - 607
November, 2014

The UE performs the Non-Contention RACH procedure on the

Target eNB
RF100 - 608
November, 2014

The UE sends RRC Connection Reconfiguration Complete to the

Target eNB
RF100 - 609
November, 2014

The Target eNB sends a Handover Notify message to the Target

MME
RF100 - 610
November, 2014

The Target MME sends a Modify Bearer Request to the SGW by

GTP
RF100 - 611
November, 2014

The SGW sends a Modify Bearer Response to the Target MME by

GTP
RF100 - 612
November, 2014

The Target MME sends a Forward Relocation Complete message

to the Serving MME
RF100 - 613
November, 2014

The Serving MME sends a Forward Relocation Complete

Acknowledgment to the Target MME
RF100 - 614
November, 2014

User Packets now flow directly from UE to SGW in both directions

RF100 - 615
November, 2014

The S-MME sends a UE Context Release Command to S-eNB

RF100 - 616
November, 2014

The S-eNB responds with a UE Context Release Complete

RF100 - 617
November, 2014
Flow Examples
Inter-MME / SGW Handover

RF100 - 618
November, 2014
Case IV. Inter-MME / SGW Handover

downlink.
RF100 - 619
November, 2014

The S-eNB sends RRC Measurement Procedures to the UE

The UE performs the requested measurements
The S-eNB receives information when specified thresholds are
exceeded, triggering need for a handover
RF100 - 620
November, 2014

The Serving eNB sends a Handover Request to the serving MME
RF100 - 621
November, 2014

The serving MME sends a Forward Relocation Request to the

target MME
RF100 - 622
November, 2014

The Target MME sends a Create Session Request to the Target

SGW by GTP
RF100 - 623
November, 2014

The Target SGW sends a Create Session Response to the Target

MME by GTP
RF100 - 624
November, 2014

The Target MME sends a Handover Request to the Target eNB
RF100 - 625
November, 2014

The Target eNB sends a handover Request Acknowledgment to

the Target MME
RF100 - 626
November, 2014

The Target MME sends a Forward Relocation Request to the

Serving MME using GTP
RF100 - 627
November, 2014

The Serving MME sends a Handover Command to the Serving

eNB
RF100 - 628
November, 2014

The Serving eNB sends an RRC Connection Reconfiguration

Request to the UE
RF100 - 629
November, 2014

The Serving eNB sends an eNB Status Transfer to the Target

MME
RF100 - 630
November, 2014

The Target MME sends an eNB Status Transfer to the Target eNB
RF100 - 631
November, 2014

The Serving eNB sends Forward User Data to the Target eNB
RF100 - 632
November, 2014

The UE performs the Non-Contention RACH Procedure on the

Target eNB
RF100 - 633
November, 2014

The UE sends an RRC Connection Reconfiguration Complete

message to the Target eNB
RF100 - 634
November, 2014

The Target eNB sends a Handover Notify message to the Target

MME
RF100 - 635
November, 2014

The Target MME sends a Modify Bearer Request to the Target

SGW using GTP
RF100 - 636
November, 2014

The Target SGW sends a Modify Bearer Response to the Target

MME by GTP
RF100 - 637
November, 2014

The Target MME sends a Forward Relocation Complete message

to the Serving MME
RF100 - 638
November, 2014

The Serving MME sends a UE Context Release Command to the

Serving eNB
RF100 - 639
November, 2014

The Serving MME sends a Forward Relocation Completion

acknowledgment to the Target MME
RF100 - 640
November, 2014

The Serving eNB sends a UE Context release Complete to the

Serving MME
RF100 - 641
November, 2014

The Serving MME sends a Delete Session Request to the Serving

SGW
RF100 - 642
November, 2014

The S-SGW sends a Delete Session Response to the S-MME

RF100 - 643
November, 2014

User data packets flow from UE to T-SGW in both UL and DL

RF100 - 644
November, 2014
Voice over LTE
RF100 - 645
November, 2014
Why Voice Over LTE?

Originally LTE was seen as a completely IP cellular system just for
carrying data, and operators would be able to carry voice either by
reverting to 2G / 3G systems or by using VoIP.
The Voice over LTE, VoLTE scheme was devised by operators
looking for a standardized system for carrying voice over LTE.
But to Operators, the lack of a defined voice format seemed to be
a major omission for the system.
lack of standardization may cause problems in roaming.
SMS is a key requirement since it used to set-up many mobile
broadband connections. Lack of SMS is a show-stopper
Mobile operators still receive over 80% of their revenues from
voice and SMS traffic. A viable and standardized scheme is
essential to provide these services and protect this revenue.
LTE can more efficiently deliver these services due to its much
higher spectral efficiency
RF100 - 646
November, 2014
Options for Voice over LTE

There are several options for delivering Voice over LTE:
CSFB, Circuit Switched Fall Back: automatically falling back
the old 2G or 3G system when an LTE UE initiates a call. This
spec also allows SMS to be carried over an interface known as
SGs, so messages to be sent over an LTE channel.
SV-LTE - simultaneous voice LTE: SV-LTE can run packet
switched LTE services simultaneously with circuit switched
voice service.However,it requires two radios to run at the same
time within the handset, with serious battery drain
VoLGA, Voice over LTE via GAN: The VoLGA standard is
based on existing 3GPP Generic Access Network (GAN)
standards, aiming to deliver a consistent user services while
the network transitions to LTE (low-risk, popular with operators)
One Voice / later called Voice over LTE, VoLTE: Provides
voice over the LTE system using IMS as part of a rich media
solution which can handle multimedia as well
RF100 - 647
November, 2014
Issues for Voice Services over LTE

Unlike previous standards (GSM, CDMA), LTE does not have
dedicated channels for circuit switched telephony. LTE is an all-IP
system providing an end-to-end IP connection from the mobile
equipment to the core network and out again.
In order to provide some form of voice connection over a standard
LTE bearer, some form of Voice over IP (VoIP) must be used.
The aim for any voice service is to exploit the LTE low latency and
QoS features so that any LTE voice service is better than 2G/3G
However to achieve a full VoIP offering on LTE poses some
significant problems which will take time to resolve. With the first
deployments having taken place in 2010, it is necessary that a
solution for voice is available within a short timescale.
RF100 - 648
November, 2014
Voice over LTE (VoLTE) Basics

The One Voice profile for Voice over LTE (VoLTE) was developed
by a collaboration between over forty operators and manufacturers
including AT&T, Verizon Wireless, Nokia and Alcatel-Lucent.
At the 2010 GSMA Mobile World Congress, GSMA announced
their support for the VoLTE solution to provide Voice over LTE.
VoLTE, Voice over LTE is an IMS-based specification.
Adopting this approach, it enables the system to be integrated
with the suite of applications that will become available on LTE
Three interfaces are being defined to provide VoLTE:
User Network interface, UNI: between the user's equipment
and the operators network.
Roaming Network Network Interface, R-NNI: located between
the Home and Visited Network.
Interconnect Network Network Interface, I-NNI: located
between the networks of the two parties making a call.
RF100 - 649
November, 2014
Continuing Work on LTE

Work to define Voice over LTE (VoLTE) is ongoing, including the
following elements:
ensuring continuity of Voice calls as a user moves from an LTE
coverage area to an area where a fallback to another
technology is required. This form of handover will be achieved
using Single Radio Voice Call Continuity, or SR-VCC).
Providing optimal routing of bearers for voice calls when
customers are roaming.
establishing commercial frameworks for roaming and
interconnect for services implemented using VoLTE definitions,
necessary to set up roaming agreements
Providing capabilities ror roaming hubbing
Providing security and fraud threat measures to prevent
hacking and unauthorized network penetration..
RF100 - 650
November, 2014
IMS
IP Multimedia Subsystem
RF100 - 651
November, 2014
What is IMS?
IP Multimedia Core Network Subsystem
The IP Multimedia Subsystem or IP Multimedia Core Network
Subsystem, IMS is an architectural framework for delivering
Internet Protocol, IP multimedia services. It enables a variety of
services to be run seamlessly rather than having independent
applications operating concurrently.
IMS, or IP Multimedia Subsystem is having a major impact on the
telecommunications industry, both wired and wireless.
Although IMS was originally created for mobile applications by
3GPP and 3GPP2, its use is more widespread as fixed line
providers are also being forced to find ways of integrating mobile
or mobile associated technologies into their portfolios.
As a result the use of IMS, IP multimedia subsystem is crossing
the frontiers of mobile, wire-less and fixed line technologies.
Indeed there is very little within IMS that is wireless or mobile
specific, and as a result there are no barriers to its use in any
telecommunications environment.
RF100 - 652
November, 2014
IMS Basics
IMS, IP multimedia subsystem is an architecture, not a technology
It uses Internet standards to deliver services on new networks.
It uses Session Initiation Protocol (SIP) for establishing, managing and
terminating sessions on IP networks.
The overall IMS architecture uses several components to enable multimedia
sessions between two or more end devices.
One element is a presence server to handle user status
a key element in Push to talk over Cellular (PoC) where the presence, or
user status is key to enabling one user to be able to talk to another.
Users often need many concurrent simultaneous sessions of different applications
IMS provides a common IP interface for simplified signaling, traffic, and
application development
In addition, under IMS architecture subscribers can connect to a network using
multiple mobile and fixed devices and technologies. With new applications
such as Push to talk over Cellular (PoC), gaming, video and more, it is
seamless integration is necessary for users to get the full benefits.
IMS has advantages for operators too. In addition to maximum services for
maximum revenues, functions like billing, and "access approval" can be unified
across network applications, greatly simplifying deployment and management
RF100 - 653
November, 2014
IMS Architecture Basics

The architecture of an IMS system can be split into a number of
main elements or areas:
User equipment: As the name implies, the user equipment or
UE is part of the IMS architecture resides with the user - it is
the endpoint.
Access network: This is the portion of the IMS architecture
through which the overall network is accessed.
Core network: This is a major element within the IMS
architecture and provides all the core functionality.
Application layer: The application layer contains the web
portal and the application servers, which provide the end user
with service and enhanced service controls. T
RF100 - 654
November, 2014
IMS Architecture Functional View

Elements of overall IMS architecture:
Server CSCF: session control for endpoint
devices; maintains state.
Proxy CSCF: entry point to IMS for the UE;
forwards SIP messages to user's home S-CSCF;
controls inter-working security; QoS mgt.
Interrogating CSCF: a session control for endpoint
devices.
Home Subscriber Server, HSS: provides
subscriber database for the home network.
Breakout gateway control function, BGCF: selects
the network in which a PSTN breakout is to occur.
If on in the same network as the BGCF, also
selects a media gateway control function, MGCF
Media gateway control function, MGCF:
interworks the SIP signalling. manages sessions
across multiple media gateways
Media server function control, MSCF: manages
the use of resources on media servers.
SIP applications server, SIP-AS: execution
platform to deploy more services
RF100 - 655
November, 2014
LTE Advanced
RF100 - 656
November, 2014
LTE Advanced
The driving force to further develop LTE towards LTEAdvanced,
LTE R-10 is to provide higher bitrates in a cost efficient way, and
at the same time completely fulfil the requirements set by ITU for
IMT Advanced, also referred to as 4G.
In LTE-Advanced focus is on higher capacity:
increased peak data rate, DL 3 Gbps, UL 1.5 Gbps
higher spectral efficiency, from a maximum of 16bps/Hz in R8
to 30 bps/Hz in R10
increased number of simultaneously active subscribers
improved performance at cell edges, e.g. for DL 2x2 MIMO at
least 2.40 bps/Hz/cell.
The main new functionalities introduced in LTE-Advanced are
Carrier Aggregation (CA), enhanced use of multi-antenna
techniques and support for Relay Nodes (RN).
RF100 - 657
November, 2014
LTE Advanced (2)

Carrier Aggregation
The simplest way to increase
capacity is to add more bandwidth.
To keep backward compatibility with
R8 and R9 mobiles the increase in
bandwidth in LTE-Advanced is
provided through aggregation of
R8/R9 carriers. Carrier aggregation
can be used for both FDD and TDD.
Each aggregated carrier is referred
to as a component carrier.
A component carrier can have a
bandwidth of 1.4, 3, 5, 10, 15 or 20
MHz Up to five component carriers
can be aggregated.
R10 UEs can use DL and UL on up
to five Component Carriers (CC).
R8/R9 UEs can use any ONE of the
CCs. The CCs can be of different
bandwidths.
RF100 - 658
The maximum aggregate

bandwidth is 100 MHz.
The number of aggregated
carriers can be different in DL
and UL, but UL is never larger
than DL. The individual
component carriers can have
different bandwidths.
November, 2014
LTE Advanced (3)

Continuous and Non-Continuous Aggregation
Contiguous component carriers in the same operating frequency band are called
intra-band contiguous. This simplest arrangement is not always possible..
Non-contiguous allocation can be intra-band, i.e. the component carriers belong to
the same operating frequency band, but are separated by a gap
Non-contiguous allocation can be inter-band, in which case the component carriers
belong to different operating frequency bands
Each component carrier is present on certain cells. Not all cells have all carriers.
The coverage of serving cells may differ due to different frequencies and powers
RRC connection is handled by one cell, the Primary serving cell, using the Primary
component carrier (DL and UL PCC). The other component carriers are called
Secondary component carriers (DL and UL SCC), on secondary serving cells.
RF100 - 659
November, 2014
Differing Coverage of Different Carriers
Different component carriers can have different coverage

In inter-band carrier aggregation the component carriers will
experience different pathloss, due to different frequencies.
In the example above, carrier aggregation on all three component
carriers can only be used by the black UE. The white UE is not
within the coverage area of the red component carrier. Note that
for UEs using the same set of CCs, they can have different PCC.
RF100 - 660
November, 2014
LTE SON:
Self Organizing/Optimizing Networks
RF100 - 661
November, 2014
Major Elements of LTE SON

LTE has created a lot of interest in Self Optimizing Networks,
although the idea can be applied to other technologies too
The main elements of SON include:
Self configuration: to enable new base stations to become
essentially "Plug and Play" items. They need little manual
attention for RF or backhaul configuration
Self optimization: After setup, the eNodeB will autonomously
optimize its operational characteristics for best performance
Self-healing: Autonomously detecting network problems and
changing network characteristics to mask the problem until
manual repairs can be made - for example, adjacent cell
boundary manipulation when a cell goes down
Typically an LTE SON system is a feature and software package
with relevant options that an operator buys from the network
manufacturer
RF100 - 662
November, 2014
LTE SON Development

The Next Generation Mobile Networks (NGMN) alliance introduced
the term SON when it became obvious that LTE networks were
going to use large numbers of cells, microcells, and femtocells.
With revenue per bit falling, deployment costs must be reduced
at the same time network performance demands are increasing
Third Generation Partnership Program (3GPP) has created the
standards for SON. Since LTE is the first technology to use them,
they are often referred to as LTE SON.
While 3GPP has generated the standards, they have been based
upon long term objectives for a 'SON-enabled broadband mobile
network' set out by the NGMN.
NGMN has defined the necessary use cases, measurements,
procedures and open interfaces to ensure that multivendor
offerings are available. 3GPP has incorporated these aspirations
into useable standards.
Deployment of LTE SON features is in very early stages now
RF100 - 663
November, 2014
LTE SON and 3GPP Standards

LTE Son has been standardized in the various 3GPP standards. It
was first incorporated into 3GPP release 8, and further
functionality has been progressively added in the further releases
of the standards.
One of the major aims of the 3GPP standardization is the support
of SON features is to ensure that multi-vendor network
environments operate correctly with LTE SON. As a result, 3GPP
has defined a set of LTE SON use cases and the associated SON
functions.
As the functionality of LTE advances, the LTE SON
standardization effectively track the LTE network evolution stages.
In this way SON will be applicable to the LTE networks.
RF100 - 664
November, 2014
LTE Key Design and

Performance Optimization Considerations
RF100 - 665
November, 2014
Course Outline
Starting the LTE Planning Process: Collecting basic inputs

Initial Basic Planning and Exploration
Heterogeneous Network Details and Critical Considerations
LTE Backhaul
Determine User Equipment Requirements and Feasibility
LTE Network Design Engineering
LTE Network Design Outputs
LTE Post-Launch Performance Assessment
Basic LTE Planning Considerations
Exploiting Heterogeneous Network Opportunities
Performance Optimization: Network Statistics and Objectives
LTE Message and Event Records
Analytical Techniques for Problem Identification and Solution
RF100 - 666
November, 2014
LTE Network Dimensioning:

Coverage
RF100 - 667
November, 2014
LTE Coverage Dimensioning Flow
RF100 - 668
November, 2014
LTE Link Budget Procedure Uplink
RF100 - 669
November, 2014
LTE Link Budget Procedure Downlink
RF100 - 670
November, 2014
Speed Depends on
Signal-to-Noise-and-Interference Ratio
CQI
Index
0
Modulation
DL Mb/s Typical Min.

In 20 Mhz Req C/(I+N)
Out of Range
QPSK
2.7
-6
QPSK
4.2
-5
QPSK
6.8
-3
QPSK
10.8
-1
QPSK
15.8
+1
QPSK
21.2
+3
16QAM
26.6
+5
16QAM
34.5
+8
16QAM
43
+9
10
64QAM
49
+11
11
64QAM
60
+12
12
64QAM
70
+14
13
64QAM
81
+16
14
64QAM
92
+18
15
64QAM
100
+20
RF100 - 671
LTE modulation and coding on downlink

and uplink are adapted in real-time for best
results over the air interface
The mobile (UE) reports its Channel Quality
Index (CQI) frequently to the base station
(eNB) which adjusts its downlink rate as
shown at left
Three types of modulation are available on
the downlink: QPSK, 16QAM, and 64QAM.
The coding rate can also be adjusted to
produce a total of 16 graded speed levels.
The base station also chooses the
modulation and coding for each burst it
authorizes the mobiles (UEs) to transmit
November, 2014
Typical LTE Link Budget Example
RF100 - 672
November, 2014
Practical LTE Cell ID

And Neighbor List Planning
RF100 - 673
November, 2014
Cell ID and Neighbor List Planning

The first release of SON (R8) includes two key 3GPP functions:
Automatic Neighbor Relation (ANR)
Automatic Physical Cell ID (PCI) Assignment
However, most operators dont use SON ANR and APCI for their
initial configuration. Instead, they prefer to use their RF
propagation prediction tools.
RF100 - 674
November, 2014
Physical Cell Identity (PCI) Planning

After cell locations are planned and a radio network planning tool
shows good dominant coverage areas and adequate capacity, the
LTE Physical Cell IDs can be assigned.
An automatic tool such as Atoll can generate a solid PCI plan
it takes propagation into consideration to reduce the possibility
of Physical Cell ID conflicts
Prevents cells with the same Physical Cell ID from overlapping
Takes into consideration the neighbor cell relationships in the
assignment of Physical Cell IDs
Can reserve codes for use with at new LTE sites in the network
to avoid the need to totally re-plan Physical Cell IDs
RF100 - 675
November, 2014
PSS, SSS, and Physical Cell ID Relationship

CELL ID
Cell identity is a global cell ID that is used to

identify the cell from an OA&M perspective.
Primary Synchronization ID (PSS ID) ranges
from 0 to 2 cell by cell
Secondary Synchronization ID (SSS ID) ranges
from 0 to 167 site by site
Physical Cell ID = PSS ID + (3*SSS ID) (see
following table)
can range from 0 to 503 (total of 504 PCIs)
is used to scramble data to help the UE
distinguish and separate information from
different cells.
Physical Cell ID planning requirements:
No cells coverage can overlap another cell
with the same ID
No cell can have two neighbors with the
same call ID
RF100 - 676
261
PSS
0
PSS
87
SSS
PSS
1
CELL ID
CELL ID
262
263
NO OVERLAP!
CELL ID
CELL ID
382
382
CELL ID
456
CELL ID
456
November, 2014
PSS, SSS, and Physical Cell ID Table
RF100 - 677
November, 2014
Heterogeneous Networks
RF100 - 678
November, 2014
Traditional Network Architecture

Traditional wireless systems were composed mainly of macrocells
The network structure was homogeneous, composed of many
similar cells in a uniform fabric
Cells covered large areas of a city or rural area
Cells used relatively large transmit power and antenna heights
Cells used conventional backhaul technologies
Network growth was managed at a high level, with substantial
cost and effort levels involved in adding new or expanded cells
Construction and Expansion of classical homogeneous networks
faces increasing obstacles
Addition of new cells is expensive and slow
major regulatory obstacles and public opposition are often
encountered
Traffic bottlenecks are difficult to relieve
RF100 - 679
November, 2014
Whats a Heterogeneous Network?
A heterogeneous network is a non-uniform, seemingly disjointed combination of

macro and micro/pico/femtocells, delivering RF where it is needed most in both
outdoor and indoor environments
Macrocells continue to deliver widespread public coverage
Distributed antenna systems (DAS) serve large public venues where
traditional cells arent effective
Non-traditional small cells are used to deliver coverage to individual homes,
businesses and problem areas
Non-traditional backhaul is used (in-band relay, home broadband, etc)
Solutions to traffic or coverage problems can be achieved much more quickly using
non-traditional methods
RF100 - 680
November, 2014
Heterogeneous Network Details

and Critical Considerations
Multi-Band Deployment
Overlay-Underlay, or Segmented?
non-traditional spectrum strategies
Transition triggers and methods
Micro-Pico-Femtocell on Customer Premises
Backhaul availability and economics
Pricing operator vs. customer contribution, business plan
Transition triggers and methods
Special factors: S1 vs X2? Doppler and other exotic triggers?
WiFi access/offloading by UE?
WiFi networks: operator provided, business-hosted, user
premises?
RF100 - 681
November, 2014
LTE Key Performance Indicators:

Radio Quality Measurements
RF100 - 682
November, 2014

A set of radio quality
measurements are
specified by 3GPP
36.214, E-UTRA
Physical Layer
Measurements
Some are measured
by the eNB, and
some by the UE
eNB vendors have some leeway in how they handle these
measurements using their own proprietary implementations, since
measurement reports for the S1 interface are not standardized.
Usually the E-UTRAN measurement results will be sent to the
OMC via proprietary O&M interfaces.
Radio quality is measurable on both UL and DL.
On UL, the only parameter sent by the UE using a RRC
measurement report is the UE Tx power
RF100 - 683
November, 2014
Radio Quality Measurements (continued)

The eNodeB can provide these measurements:
Received Interference Power (RIP): the UL noise floor for a
set of UL resource blocks.
Thermal noise power: This is the UL receive power for the
entire UL frequency bandwidth without any signals present
Timing advance: This is the time it takes for the radio signal to
travel from the UE to the eNBs receiver across the radio
interface. Thus, it is proportional to the distance between the
UE and the eNodeB.
An scanning receiver or air interface analyzer can also provide:
Channel baseband power: This is the power of a particular
physical channel in the time domain
I/Q constellation diagrams: Indicate the quality/accuracy of
the modulated symbols received.
Error vector magnitude: A measurement of how far off the
actual symbols are from their correct positions in the
constellation.
RF100 - 684
November, 2014
LTE Measurement: RSSI

LTE Carrier Received Signal Strength Indicator (RSSI)
Definition: The total received wideband power observed by the UE
from all sources, including co-channel serving and non-serving
cells, adjacent channel interference and thermal noise within the
bandwidth of the whole LTE signal.
Uses: LTE carrier RSSI is not used as a measurement by itself,
but as an input to the LTE RSRQ measurement.
LTE Downlink
RF100 - 685
November, 2014
LTE Measurement: RSRP

LTE Reference Signal Received
Power (RSRP)
Definition: RSRP is the linear
average power of the
Resource Elements (REs)
carrying a specific cells RS
within the considered
measurement frequency
bandwidth.
Uses: Ranking cells for
reselection and handoff.
Notes: Normally based on the
RS of the first antenna port, but
the RS on the second antenna
port can also be used if known
to be transmitted.
RF100 - 686
November, 2014
UE Measurements: RSRP
RSRP
dB
-50
-60
-70
-80
-90
-100
-110
-120
-130
-140
RSRP is a measure of cell

downlink coverage
When triggered, the
UE sends RRC
measurement reports
including RSRP,
which is defined from
140 to 44 dBm with
1 dB resolution.
UEs use RSRP to choose the best cell for access or handover.
RSRP correlates with user plane QoS. Outdoor expectations:
RSRP > 75 dBm gives excellent QoS.
RSRP between 75 and 95 dBm gives a slight degradation of the
QoS. Throughput declines by 3050% between -75 and 95 dBm.
RSRP < 95 dBm gives unacceptable QoS. Throughput reaches
zero at approximately 108 to 100 dBm. Call drops will occur.
In-House cells often give usable QoS with RSRP down to
115dBm, due to lower in-house interference levels
RF100 - 687
November, 2014
RSSI and RSRP
RSSI = wideband power= noise + serving cell power + interference

power
Without noise and interference, 100% DL PRB activity:
RSSI=12*N*RSRP
RSRP is the received power of 1 RE (3GPP definition) average
of power levels received across all Reference Signal symbols
within the considered measurement frequency bandwidth
RSSI is measured over the entire bandwidth
N: number of RBs across the RSSI is measured and depends
on the BW
Based on the above, under full load and high SNR:
RSRP (dBm)= RSSI (dBm) -10*log (12*N)
RF100 - 688
November, 2014
LTE Measurement: RSRQ
RB RB RB RB RB RB RB RB RB RB RB RB
LTE Reference Signal Received Quality (RSRQ)

Definition: RSRQ = N RSRP / RSSI
N is the number of Resource Blocks (RBs) of the LTE carrier
RSSI measurement bandwidth. Since RSRQ exists in only one
or a few resource blocks, and RSSI is measured over the
whole width of the LTE signal, RSRQ must be scaled up for a
fair apples-to-apples comparison with RSSI.
Uses: Mainly to rank different LTE cells for handover and cell
reselection decisions
Notes: The reporting range of RSRQ is defined from 19.5 to 3
dB with 0.5 dB resolution. -9 and above are good values.
RF100 - 689
November, 2014
UE Measurements: RSRQ
Like RSRP, RSRQ is used to determine the best cell for LTE radio
connection at a certain geographic location. However, while RSRP
is the absolute strength of the reference radio signals, RSRQ is the
signal-to-noise ratio. Like RSRP, RSRQ can be used as the
criterion for initial cell selection or handover. RSRQ is calculated by
the formula above.
The following RF100 - shows how RSRP and RSRQ vary in the
outdoor environment due to varying propagation loss and
interference of various types.
RF100 - 690
November, 2014
More RSRQ Details
RSRQ
dB -3
-4
-5
-6
-7
-8
-9
-10
-11
-12
-13
-14
-15
-16
-17
-18
-19
The reporting range of RSRQ is defined from 19.5 to 3 dB

with 0.5 dB resolution
Comparing measured values of RSRQ and RSRP at one
location will show whether coverage or interference problems
are present.
If RSRP remains stable or gets better, but RSRQ is
declining, this indicates rising interference.
If both RSRP and RSRQ decline, coverage is weak.
This kind of logic helps in finding the root cause of drops due
to radio problems.
Three quality ranges can be defined for RSRQ:
RSRQ values above 9 dB give the best subscriber
experience.
RSRQ of 9 to 12 dB degrades QoS, but with fair results.
RSRQ values of 13 dB and lower give reduced
throughput and a risk of call drops.
RF100 - 691
November, 2014
SINR: LTE Signal vs. Noise And Interference

SINR is a more practical measure of signal quality than SNR
It is not defined in the 3GPP specs but rather by UE vendor. It is
not reported to the network.
SINR is popular with operators since it better quantifies the
relationship between RF conditions and throughput
Most UEs use SINR to calculate the CQI (Channel Quality
Indicator) they report to the network
The components of the SINR calculation are:
S: the power of measured usable signals, such as Reference
signals (RS) and physical downlink shared channels (PDSCHs)
I: the power of measured interference from other cells in the
current system
N: background noise power
SINR can be defined as Wideband or Narrowband (for specific
subcarriers or a specific resource element)
RF100 - 692
November, 2014
How RSRQ and SINR Relate

Cell traffic load influences RSRQ, but not SINR
To map RSRQ vs. SINR, RE/RB is an important factor
Used Resource Elements per Resource Block (in serving cell)
RF100 - 693
November, 2014
Power Headroom
Power Headroom (PH), in dB, is the
difference between current UE PUSCH
transmit power and the UEs maximum
capable power output
its how much extra transmit power the
UE has left in reserve to be used in case
uplink conditions worsen
PH reports can be sent either eventtriggered or periodically. The most common
trigger is a path loss change higher than a
predefined value when a timer expires.
Otherwise, periodic PH reporting starts when
the PH measurement task is configured or
reconfigured.
UE PH reports are sent in MAC, not RRC.
The eNB can set UEs maximum transmit
power by the P-max parameter in RRC.
PH runs from 23 to +40 dB. The 64
values correspond to 6 bits of the PH
control element in the MAC.
RF100 - 694
November, 2014
Maintenance mode in Samsung G3, G4, Note II

You can put your mobile in
maintenance mode to see
LTE rf conditions wherever
you happen to be.
For Samsung Galaxy 3
devices, try:
First open phone dialing
screen
*#22745927
Then enable hidden menus
Then press back
Then *#0011#
Youll see the screen at right
RF100 - 695
November, 2014
Android Phone Software for

Field Performance Observation
Android Market (Google Play) applications:
G-NetTrack
CDMA Field Test
Other Interesting Apps:
GeoCam Free
Shows coordinates, azimuth, vertical, and pitch angles
Clinometer
AudioTool by Jbunn
Audio tone generator, spectrum analyzer, spectragram,
pulse reverberation testing in rooms, etc.
Keyhole Radio propagation prediction maps on your android
device for any frequency anywhere in the world
RF100 - 696
November, 2014
Signatures of Common LTE Conditions

SIGNATURE:
GOOD CALL
In a good LTE call,

RSSI and RSRP will be well
above their respective noise
floors
RSRQ will be -9 or stronger
SINR will be +20 or stronger
Headroom will be around or
better than +10
RSSI
RSRP
RSRQ SINR Headroom
-30
-50
-40
-60
-50
-70
-60
-80
-70
--90
-80
-110
--90
-120
-110
-130
-120
-140
RSSI
RSRP
-3
+40
+40
-6
+30
+30
-9
+20
+20
-12
+10
+10
-10
-10
-23
-23
-15
-19.5
RSRQ SINR Headroom

UE
eNB
RF100 - 697
Messaging
November, 2014
Signature of LTE Dropped Call in Poor Coverage

SIGNATURE:
In bad coverage, poor RF
conditions will lead to call drops
RSSI will be around the noise
floor, -115 or weaker
DROPPED CALL, BAD COVERAGE

RSSI
RSRP
RSRQ SINR Headroom
-30
-50
-40
-60
-50
-70
-60
-80
RSRQ will be -12 or weaker
-70
--90
SINR will be below 0
-80
-110
Headroom will be well below 0
--90
-120
-110
-130
-120
-140
RSRP will be around or below

its noise floor, -135 or weaker
RSSI
BTS
RF100 - 698
RSRP
-3
+40
+40
-6
+30
+30
-9
+20
+20
-12
+10
+10
-10
-10
-23
-23
-15
-19.5
RSRQ SINR Headroom

Messaging
November, 2014
Signature of LTE Downlink Interference

In forward link interference, all the
forward link indicators will be poor:
RSSI will be normal, but its
strength comes from the strong
included interference
RSRP will be lower than
expected compared to RSRP
RSRQ will be lower than
normal, well below -9
SINR will be lower than normal,
around 0
The uplink-related Headroom
measurement is independent of
downlink conditions; its current
value isnt affected by downlink
interference
RF100 - 699
SIGNATURE:
FORWARD LINK INTERFERENCE
RSSI
RSRP
RSRQ SINR Headroom
-30
-50
-40
-60
-50
-70
-60
-80
-70
--90
-80
-110
--90
-120
-110
-130
-120
-140
RSSI
BTS
RSRP
-3
+40
+40
-6
+30
+30
-9
+20
+20
-12
+10
+10
-10
-10
-23
-23
-15
-19.5
RSRQ SINR Headroom

Messaging
November, 2014
Signature of LTE Uplink Interference

In LTE Uplink interference makes
the UE transmit at higher power
trying to compensate
SIGNATURE:
REVERSE LINK INTERFERENCE
RSSI
RSRP
RSRQ SINR Headroom
UE power Headroom will be

driven down, even to 0 or
below in serious cases
-30
-50
-40
-60
-50
-70
The Downlink indicators RSSI,

RSRP, RSRQ, and SINR arent
directly affected by Uplink
interference
-60
-80
-70
--90
-80
-110
--90
-120
-110
-130
-120
-140
Their values will be consistent

with whatever is happening on
the downlink at that moment
BTS
RF100 - 700
-3
+40
+40
-6
+30
+30
-9
+20
+20
-12
+10
+10
-10
-10
-23
-23
-15
-19.5
Messaging
November, 2014
LTE Received Channel Quality Indication, CQI

CQI
Index
0
Modula- Code rate Efficiency Typ. Min.

tion
x 1024
b/s/Hz
Req C/(I+N)
Out of Range
QPSK
78
0.152
-6
QPSK
120
0.234
-5
QPSK
193
0.377
-3
QPSK
308
0.601
-1
QPSK
449
0.877
+1
QPSK
602
1.176
+3
16QAM
378
1.477
+5
16QAM
490
1.914
+8
16QAM
616
2.406
+9
10
64QAM
466
2.731
+11
11
64QAM
567
3.322
+12
12
64QAM
666
3.902
+14
13
64QAM
772
4.523
+16
14
64QAM
873
5.115
+18
15
64QAM
948
5.555
+20
RF100 - 701
LTE modulation is adapted in

real-time to match existing RF
conditions reported by the UE.
Three types of modulation are
available, QPSK, 16QAM, and
64QAM. The coding rate can
also be adjusted through 16
steps.
The table at left shows the 16
CQI indexes, their modulation
and coding details, and the
resulting spectral efficiency of
the LTE signal in bits per
second per hertz of bandwidth.
November, 2014
General Wireless Key Performance Indicators
RF100 - 702
November, 2014
Common LTE Key Performance Indicators (1)

Accessibility
Initial E-RAB Establishment Success Rate
Add E-RAB Establishment Success Rate
Retainability
E-RAB Retainability
Integrity
Mobility
Downlink Latency (first packet)
Mobility Success
Downlink Throughput
Rate
Downlink Packet Loss
Availability
Uplink Latency
Cell Availability
Uplink Throughput
Downlink Packet Error Loss Rate
Uplink Packet Loss Rate
RF100 - 703
November, 2014
Specific LTE Key Performance Indicators

The Key Performance Indicators for an LTE system fall into several
major groups:
The most critical function in the E-UTRAN is the scheduling
algorithm implemented in the eNodeB
This is the most critical and decisive function affecting the users
Quality of Service (QoS) and Quality of Experience (QOE)
The most critical KPIs are those measuring scheduler
effectiveness
Control Plane Performance Counters and Delay measurements
User Plane QoS and QoE Measurements
RF100 - 704
November, 2014
Interference, Intermodulation
Practical Considerations
RF100 - 705
November, 2014
Spectrum Analyzer Basics
RF100 - 706
November, 2014
Our Eyes for Measuring Electronic Signals

Communications signals are measured and analyzed from both a
timing and frequency point of view (often called the time domain
and the frequency domain)
Oscilloscope -- The tool most often used for seeing signal
strength vs. time is the oscilloscope. Originally purely analog,
todays oscilloscopes are mainly digital with the capability to
capture and graphically display signal variations as short as
picoseconds and as long as days or weeks or more.
Oscilloscopes typically show voltage on the vertical axis, with
time on the horizontal axis, with ranges fully user-settable
Even the public recognizes oscilloscopes for example, the
beeping EKG display at bedside or the long steady tone..
Spectrum Analyzer The tool most often used for seeing
instantaneous signal power across a range of frequencies
Power is usually on the vertical axis, frequency on horizontal
RF100 - 707
November, 2014
The Display of a Spectrum Analyzer

A spectrum shows a live window of
signal strength vs. frequency
Amplitude (strength) on the vertical scale
Strong at top, weak bottom
usually ten major divisions,
adjustable db per division
Frequency on the horizontal scale
usually ten major divisions, low
frequency left and high on the right
Frequency range user- settable
RF100 - 708
November, 2014
Setting Frequency Range of a Spectrum Analyzer

Lower Limit
Center
Upper Limit
Span
To set the frequencies displayed a spectrum analyzer, you can either

Set the two edges lower frequency limit, upper frequency limit, or
Set the Center Frequency and the width (Span) you want displayed
What range do you want to display?
Normally just the width of the actual signal you are watching
In the case of interference, a wider field of view may be needed
To see all of a broad interfering signal which is wider than the
signal being interfered with
To see strong signals on nearby frequencies which may be
causing intermodulation or distortion
RF100 - 709
November, 2014
Setting Signal Levels on a Spectrum Analyzer

Reference Level
Choose Ref. Level and db per division so both
high signal peaks and the noise floor are on-scale
dB per
division
The level settings of a spectrum analyzer must be appropriate for the

strength of the signal you are trying to see
The reference level (top of screen) must be set at least as high as
the strongest signal being displayed, to avoid analyzer overload
The db/division should be set large enough so that the noise floor is
seen near the bottom of the screen
Very strong signals outside the displayed frequency span can still
saturate the amplifier and cause the displayed noise floor to be higher
than reality. If this is happening, a bandpass filter can be used ahead
of the analyzer to reduce the strength of the problem signals
RF100 - 710
November, 2014
Convenience Features on Spectrum Analyzers

Most spectrum analyzers allow setting up markers
A marker is a visible line or pointer to mark a certain frequency and
the power level there
Markers can be manually set to mark signals, band edges, etc.
Some analyzers also provide automatic marker to peak settings,
to reveal power and frequency of a signal quickly without the user
having to manually set or adjust the frequency of the marker
Many spectrum analyzers also provide marker to center
features which automatically change the center frequency of the
analyzer to the current position of the marker
Most analyzers can display multiple markers
Many analyzers allow marker settings to be stored for future use
Some analyzers also provide accurate frequency-counter measurements
for observed signals or their marker positions
RF100 - 711
November, 2014
Example of Markers
on a Spectrum Analyzer Display
xxx
RF100 - 712
November, 2014
Advanced Analyzer Features: Storage

Display Storage
Most modern analyzers allow digital storage of complete
displays including signal, markers, and labels for all settings
This is very helpful in documenting what has been seen, and
for before-and-after evaluation
The displays can be downloaded to PC and saved as relatively
small files for archiving purposes
Settings Storage
Most modern analyzers also allow digital storage of complete
measurement setups including center frequency, frequency
span, amplitude settings, scan rate, IF and video bandwidths,
marker settings, and any other advanced features
This is very convenient for repetitive measurements under the
same conditions: no tedious settings, just recall setup #3 and
youre ready to measure.
RF100 - 713
November, 2014
Spectrum Analyzer <-> PC Transfer/Analysis
Most analyzer manufacturers offer software to offload stored traces for storage and
analysis on PCs
Anritsus Master Software Tools (MST) provides file transfer from and to the
analyzer as well as manipulation of display settings for best presentation and
analysis of previously collected traces
Some control software allows a user to remotely control a spectrum analyzer over
an IP connection
RF100 - 714
November, 2014
Sets IF or
Resolution
Bandwidth
Signal
LNA
I.F.
Bandpass
Filter
VCO - Swept
Local
Oscillator
Sets Video
Bandwidth
Power
Whats Inside a Conventional Swept

Spectrum Analyzer?
Frequency
I.F.
Amp.
Detector
Lowpass
Video
Filter
Sweep
Generator
The earliest (and still todays most basic) spectrum analyzers are
simply receivers whose frequency can continuously sweep over
a selected frequency range
As the receiver frequency sweeps, the received power is
displayed on a trace which is moving in step with the sweep
RF100 - 715
November, 2014
IF (Resolution) Bandwidth vs. Noise and Speed

Narrow Bandwidth:
High Resolution
Low Noise Floor
Long Sweep Time
96
Medium Bandwidth:
Medium Resolution
Medium Noise Floor
Medium Sweep Time
24
Wide Bandwidth:
Low Resolution
High Noise Floor
Short Sweep Time
A swept spectrum analyzer steps through consecutive chunks of

spectrum the size of its IF bandwidth until the span is covered
Small chunks give low noise and good resolution, but slow speed
Large chunks give high noise and poor resolution, but fast speed
Many analyzers have automatic default settings for typical use
RF100 - 716
November, 2014
Setting Video Bandwidth

of a Conventional Spectrum Analyzer
For most typical measurements, the video bandwidth can be set
equal to the IF bandwidth
Some analyzers have default settings for video bandwidth
which track with the selected IF bandwidth automatically
This leaves the trace crispness and detail as good as
possible at the selected IF bandwidth
However, when looking to recognize very weak signals near the
noise floor, video bandwidths much smaller than the IF bandwidth
may be helpful
This makes the noise floor appear as a thinner trace, allowing
weak signals to be more easily seen
RF100 - 717
November, 2014
Setting the Scan Rate of a Spectrum Analyzer

As spectrum analyzer steps through the selected span of
spectrum, it must dwell long enough at each step to allow its
receiver to recognize the level of signal power in its IF bandwidth
Moving too fast results in erroneously low readings
Moving too slow gives correct readings but wastes time
The time required to sufficiently register the power in the IF
bandwidth is approximately the reciprocal of the bandwidth
Tseconds = 1 / IFBWhertz
For a 10 KHz. Bandwidth, the time is 0.1 millisecond
As a rough rule of thumb, the time of one sweep must be at least
Tsec = SPANHZ / (IFBWHZ)^2
Most spectrum analyzers provide
Automatic default IFBW
Automatic default scan rate
Typical example values at right:
RF100 - 718
November, 2014
Using Spectragrams:
Waterfall Displays
A spectragram, sometimes called a waterfall display, shows a

time history of whats happening in a chunk of spectrum
Instead of plotting signal strength on a vertical scale, the
spectragram shows each pass across the spectrum as a line. The
strength at each frequency determines the color of the line at that
point.
The lines build up like weaving a piece of cloth one thread at a
time in a tapestry
RF100 - 719
November, 2014
Advanced Spectragram Functions
Tektronix SA2600
Rohde & Schwarz PR100
Advanced spectrum analyzers also allow opening a

second window to show a conventional trace. Moving a
horizontal pointer up and down on the spectragram
shows in the other window the conventional spectrum
trace from that moment.
RF100 - 720
November, 2014
Special Considerations when

Using Conventional Spectrum Analyzers
Overload noise rise graphic here
Spectrum analyzers use amplifiers like any ordinary receiver and
are vulnerable to all the nonlinear problems receivers face
Specan Front-end must be very wide to allow measurements on
any freq, so strong signals like UHF TV and other wireless sites
can severely desensitize the analyzer and even cause mixing of
signals producing intermodulation products
Bandpass filters are an effective way to allow desired signals
through but suppress adjacent very strong signals to improve
sensitivity and reduce intermodulation products
Modern Low-noise preamplifiers often have better noise figures
than the analyzer itself and can significantly improve the analyzer
sensitivity, but they must be protected from overload by adjacent
stronger signals
RF100 - 721
November, 2014
Using Bandpass Filters to

Eliminate DeSensitization and Intermod
Both tunable and fixed bandpass filters are available for wireless
frequencies from many manufacturers
The K&L BT-series tunable bandpass filters have bandwidth of 5%
(1-8% special order), very steep skirts, are tunable over a 2:1
frequency range; Trilithic has a similar line of filters.
Fixed filters for each 700 MHz. uplink and downlink block are
available from numerous manufacturers
RF100 - 722
November, 2014
Using Low-Noise Preamplifiers

to Improve Analyzer Sensitivity
The sensitivity and noise figure of all
but the most advanced spectrum
analyzers can be improved by use of
a wideband low-noise preamplifier
The Mini-Circuits Labs LNA model
ZRL-1150LN+ in 698-896 MHz. has
gain 30 db, NF 0.8 db, IP3 intercept
(output) +40 dbm; 1 db compression
at +24 dbm out
The unit requires12 volts from a
battery or filtered cigar lighter plug
To maintain calibrated signal level
readings on the analyzer, measure
and set the reference level offset
A bandpass filter is essential ahead of
the LNA to prevent overloading,
distortion and intermodulation
RF100 - 723
November, 2014
Types of Spectrum Analyzers
RF100 - 724
November, 2014
Types of Spectrum Analyzers

Conventional Swept-Receiver Spectrum Analyzers: basic, original
Pros: low cost, fair performance
Cons: low probability of intercept for pulsed signals
DSP Spectrum Analyers: analyze digital signals, vector modulation
Pros: excellent performance due to DSP/FFT processes
Cons: poor detection of transient events, pulsed signals
Real-Time Spectrum Analyzers (RTSAs): fast capture and analysis
Pros: can capture and analyze signals continuously without
interruption across the full processing bandwidth, for 100%
probability-of-intercept for pulsed and intermittent signals down
to the minimum detectable pulse width of typically <500 uS.
Cons: three or more times as costly as conventional analyzers
RF100 - 725
November, 2014
Conventional Swept Spectrum Analyzers

Are Slow to catch Pulsed Signals
Imagine a conventional spectrum analyzer scanning a 20 MHz.
span of frequencies using a 10 KHz. IF bandwidth. There are 2000
steps in each scan, and a scan takes 0.2 seconds to complete.
Also imagine a pulsed RF interferer is bursting random 0.1
millisecond pulses 10 KHz. wide on random frequencies across
the span. It transmits only 10% of the time.
At any moment, the spectrum analyzer is watching one of 2000
frequency bins, and there is a 10% chance the interferer is even
transmitting at that moment.
there is a 1/20000 chance of the analyzer seeing the interferer
in any 0.1 millisecond period.
In a 1-second period the analyzer has only a 50% chance of
seeing the interferer for 0.1 millisecond. Unless the interferer is
very strong, such a hit will not be visible on a spectragram.
The Probability of Intercept (POI) is very low and a long period
will likely be required to detect the interferor, let alone track it..
RF100 - 726
November, 2014
Conventional Spectrum Analyzers

Typical Examples
HP 8595E
Rigol DSA1030A
Agilent E7495
El Gato
Bird SH-362 Series
hello
Anritsu MT8212B
RF100 - 727
November, 2014
DSP-Based Spectrum Analyzers

and Vector Signal Analyzers
This class of analyzers uses high-quality A-D converters to
perform signal detection and analysis at its IF frequency. The IF
bandwidth can be from a few hertz up to tens of megahertz.
Traditional frequency conversion is usually available ahead of the
DSP-based IF circuitry, to allow coverage of a wide range of
frequencies from low RF to microwave.
Performance of this class of analyzers is excellent in most
respects, and sophisticated demodulation of digital signals is
usually supported.
About half of current analyzers sold for maintenance of modern
wireless systems fall in this category.
This class of analyzers has one distinct drawback: its signal
processing is not fast enough to continuously monitor the signals it
collects, so its probability of intercept suffers when seeking pulsed
or intermittent signals, especially in wideband cases.
RF100 - 728
November, 2014
Digital Spectrum Analyzers DSP

Typical Examples
Anritsu MT8221
Agilent 9925A
Fieldfox
Test Eq. Plus
SA124A
Agilent N9342C
RF100 - 729
Rohde & Schwarz FSH-8
November, 2014
Real-Time Spectrum Analyzers: RTSAs

These analyzers also use cutting-edge high-quality A-D converters
to perform signal detection and analysis at an IF frequency. The IF
bandwidth can be from a few hertz up to tens of megahertz
What distinguishes these analyzers is that the signal processing
happens in real time, in step with the signal as it is received
Within the IF bandwidth, there are no time gaps between
successive analyses and 100% probability of detection of signal
bursts or pulses as short as a few microseconds
State-of-the-art front-end dynamic preselectors, filtering, and lownoise internal preamps make traditional external bandpass filters
and preamplifiers unnecessary for most measurements
Extreme sensitivity allows distant weak signal tracking at ground
level, and even detection of standby local oscillator radiation from
buried GSM phones intended as IED detonators
Convenience features include mapping and hand-held antennas
with GPS and electronic compass for direction finding
Disadvantages: High cost, complexity of effective operation
RF100 - 730
November, 2014
Rohde & Schwarz PR100 Receiver

The PR100 is a real-time DSP
based receiver/analyzer able
to catch elusive interference
ordinary analog swept
analyzers simply cant see
10 MHz realtime IF spectrum
DSP displays all types of
signals no matter how
unstable they are
Pulses as short as 500 us are
clearly visible on spectrogram
and captured trace display
Built-in electronic compass
and GPS receiver for rapid
trackdowns on displayed map
Remote logging and remote
control software
List $55,000, but best-in-class
RF100 - 731
November, 2014
Tektronix SA2600/H600
The Tektronix SA2600 or
H600 has the same
capabilities as the RohdeSchwarz PR100, but in a
little more cumbersome
package
The SA2600s digital
phosphor display provides
excellent views of transient
pulsed signals analog
analyzers miss
The H600 version can
match received signals
against an internal database
of signal signatures, useful
especially for military users
SA2600 list price $28,000,
the H600 is over $40,000
RF100 - 732
November, 2014
Topographic Density Displays and

Display Decay Features (Variable Phosphor)
RTSAs provide statistically-derived information in traces, a feature

called DPX by Tektronix and topographic displays by others
Each pixel on the display represents a signal power level at a
specific frequency, but the color of the pixel is determined by the
number of times it was recently illuminated by a received signal
This allows seeing even highly intermittent interferences as wispy,
ethereal blue envelopes above the level of a main signal
RF100 - 733
November, 2014
Interference to
Wireless Systems
RF100 - 734
November, 2014
Classifying Interference: Types

Cochannel
adjacent channel
Same Type of Signal as the Victim
Whats the vulnerability?
Different Type of Signal than the Victim
Whats the vulnerability?
RF100 - 735
November, 2014
What Are the Symptoms of Interference?

Forward Link:
In a specific area, higher drops, access and handoff failures
Fairly localized customer complaints
Mobile transmit powers seem normal, but reverse closed loop
power control goes more positive*
Reverse Link:
Across all but the innermost core of the sector, drops and
failures of access and handoff attempts increase
Across the whole sector, mobile transmit powers increase
BTS receiver noise floor measurements increase*
* The db amount of the closed loop control increase and the BTS
noise floor measurement increase is a direct indication of the
amount of degradation of the link, in db
RF100 - 736
November, 2014
The Reverse Link (Uplink)

is the Most Vulnerable Link
Interference on the forward link is a bruteforce battle at each users receiver
between the BTS signal and the interferer
Usually the BTS is much more
powerful and better positioned than the
interferer, and obvious to track down
The interference is confined to the
area immediately surrounding the
interferer, not the whole sector
On the reverse link, the BTS is very
sensitive so it can hear the distant users
Even a weak interferer can really hurt
Battle at the BTS receiver is between
the interferer and the weakest users
A medium-strong interferer received at
the BTS is usually pretty weak on the
ground, much harder to track down
The most useful indicator of interference is
the BTS-reported noise floor rise
RF100 - 737
Forward/Downlink
Interferer
Reverse/Uplink
Interferer
November, 2014
Interfering Signals at Ground Level Are

Typically 20-30 db Weaker than at BTS input
Consider an interferer located
High Gain
at the normal edge of a cell or
Antennas
somewhat beyond
In free space, 1 mW from
10 miles away is enough to
deliver a -95 dbm signal at
the BTS receiver
In free space, 100 mW from Good
LNA
100 miles away is enough
to deliver a -95 dbm signal
at the BTS receiver
The interfering signal on the
ground is typically 20-30 db
weaker than at the BTS RX
Its hard to see and track,
receiving at ground level
At or below the noise floor
RF100 - 738
Low Loss Fresnel Clearance!
Higher Loss Absorption
November, 2014
Reverse-Link Noise Floor Monitoring

and a PR100 Success Story
eNodeB receiver noise level over 15-day period

An LTE 700 MHz. operator began receiving 10-20 dB noise floor
rises on numerous sectors over a wide area. Daily receive power
variations on a typical victim sector are shown above.
Notice the rises are erratic, but seem to occur most often from
sunset to sunrise (in the pink bands on the daily graph above).
Normal traffic was ruled out as a cause, since most of the high
rises occurred during times of no traffic or little traffic.
The interferer could be seen on the sector antennas but not at
ground level on conventional spectrum analyzers for trackdown.
The interferer was broadband, covering most of the LTE block. A
brief video is shown on the next page.
RF100 - 739
November, 2014
Plot the Affected Sectors

Now You See It.
The widespread scope of the
interference was dramatic, and
the interfering signal could be
seen on sector antennas, but not
at ground with conventional
spectrum analyzers even with
preamps and directional
antennas.
Fortunately, the signal was
barely visible above the noise
floor at ground level on a PR100
with the active HE300 antenna.
The source was tracked to an
authorized 1-watt TDD WiMax
transmitter in another state with
antennas on a tower over 40
miles away from the nearest
affected eNodeB.
RF100 - 740
November, 2014
Plot the Affected Sectors

Now You Dont!
The WiMax operator was cooperative
and turned down the transmitter to
verify that it was the source.
The widespread interference was
eliminated. Other local sources still
raised levels on some sectors and
were individually tracked/eliminated.
The bad news is that the other
operator was in the middle of turnup of
its authorized TDD WiMax network
with more than a dozen sites.
Substantial compromises are going to
be necessary on both sides to achieve
minimally acceptable operation for
both the LTE and the WiMax operator.
The FCC was unwise in allowing
mixed TDD/FDD operations
indiscriminately at the operators
choice in the same spectrum blocks.
RF100 - 741
November, 2014
Signatures of
Common Interferers
RF100 - 742
November, 2014
Legacy: IDEN and IS-136 TDMA
Notice characteristic
Segmentation of IDEN
Carrier into 4 parts
BW
~18 KHz
Channel Spacing
25 KHz
RF100 - 743
November, 2014
A Single CDMA or EV-DO Carrier
RF100 - 744
November, 2014
CDMA and 1xEV-DO

hello
BW
1.23 MHz
Peak Trace
Average Trace
RF100 - 745
November, 2014
GSM, GPRS, and EDGE
Peak Trace
Average Trace
5
4
11
3
1
12
10
GSM Channels Downlink
RF100 - 746
November, 2014
UMTS/WCDMA/HSPA in Cellular B Block

dsd
1xRTT
1xEV-D0
Peak Trace
Average Trace
UMTS/WCDMA/HSPA
3.84 MHz. BW
UMTS/WCDMA/HSPA
3.84 MHz. BW
GSM-GPRS-EDGE
12 Carriers
Notice 890-891.5 MHz. is used by

the A-block cellular operator.
RF100 - 747
November, 2014
LTE Downlink
sfwe
Peak Trace
VERIZON WIRELESS LTE in UPPER C

Bandwidth 10 MHz.
AT&T LTE in LOWER B&C BLOCKS
Limited to 10 MHz. max BW
RF100 - 748
Average Trace
November, 2014
Conventional Narrowband FM Land Mobile Radio
Peak Trace
BW ~15 KHz.
Average Trace
November, 2014
RF100 - 749
Aeronautical Radio Simple AM Modulation

hhhh
November, 2014
RF100 - 750
Digital Television
Some of the strongest
signals received at any
communications site are
television signals, whether
VHF LO, VHF HI, or UHF.
Todays DTV signals fill their
6 MHz. wide channels.
There is no separate
analog FM audio carrier
There is a pilot signal at
the lower edge of a DTV
signal roughly 10 db
above the power in the
rest of signal bandwidth
Pilot
DIGITAL TELEVISION CHANNEL

6 MHZ. TOTAL WIDTH
38
47 49 51
US TV Channels
November, 2014
RF100 - 751
FM Broadcast
(Fundamental)
FM broadcast stations are the secondstrongest group of signals at most
wireless sites, behind UHF TV.
The band is from 88.1 to 107.9 MHz.,
with 88.1-91.9 reserved in the United
States for use by educational stations
Most wireless equipment is sufficiently
shielded and filtered to prevent
interference from nearby FM stations
However, the harmonics of FM
broadcast stations can fall on
frequencies in the wireless bands
Even if the FM station is compliant
with FCC radio restrictions,
interference may still occur over
ranges of up to nearly 1000 feet
November, 2014
The Entire FM Broadcast Band
Analog FM Signal
BW ~200 KHz
FM-NRSC Hybrid Signal
BW ~400 KHz
RF100 - 752
FM Broadcast
(Harmonics)
FM broadcast stations close to wireless
sites can seriously or severely interfere
on the wireless uplink
FM signals are up to 200 KHz wide
(analog) or 400 KHz. wide (digital) and
the harmonics are proportionally wider
FCC spurious suppression requirements
are -83 dbc for most FM stations
Unfortunately, nearby stations fully
compliant with the FCC requirement
can still raise wireless noise floors
by 20 db or more as in the example
case at right
High power harmonic filters are
available for installation on the FM
transmitter to achieve an additional
25-40 db suppression, cost ~$5000
or less depending on FM transmitter
power
In some cases, the offending
radiation is by leakage from the FM
transmitter cabinet and can be
reduced with additional shielding
November, 2014
RF100 - 753
Screening Your System for

Nearby Possible FM Station Harmonic Sources
Its easy to screen your sites
against the FCC FM
database to identify FM
stations nearby
Its also easy to calculate the
harmonic frequencies of
nearby FM stations and see
whether they fall within any
of the wireless bands you
use
We have a program that can
screen large lists of wireless
sites against the FCC FM
database and document
potential hits in reports like
the one at right
November, 2014
RF100 - 754
Radars
Radar is used for many purposes today.
Common types and their bands include:
Weather 2.7-3.0 GHz (500 kW TPO
plus substantial antenna gain!)
Air traffic control 2-4 GHz.
Aircraft identification and tracking
(1030 MHz. up, 1090 MHz. down)
Navigation (ships, tugs, aircraft) 3 GHz
and 10 GHz.
Police vehicle speed enforcement
(10.5 X, 24 K, 35-36 Ka GHz.)
Radar interference to wireless is rare, but
is usually identifiable by its correlation with
the radar antenna rotation and the whine
of the pulse repetition rate of the radar
Chirp Radars
Doppler Radar
November, 2014
RF100 - 755
Fluorescent
Ballasts
At left is a
catalog of
spectra of various
ballasts of different
manufacturers.
The chart stops
well below 1 MHz.,
but ballasts
generate similarlooking peaks up
to above cellular
frequencies
November, 2014
RF100 - 756
Ballasts for Fluorescent Lighting
Ballasts used to power fluorescent lights can produce wideband

interference across wireless bands, interfering with uplink on
wireless sites up to many hundreds of feet away
Outdoor fluorescent sign boosters in harsh environmental
conditions often fail and go rogue
November, 2014
RF100 - 757
Electronic Billboards and Signs

Electronic billboards and signs are
becoming very commonplace in
populated areas
Most signs are carefully screened in
EMC labs for compatability but the
1-10 kilowatt sign circuitry and
extreme sensitivity of LTE, WiMAX
and HSPA base stations raises
concerns when a sign is within 100200 feet of a wireless base station
Radiation can come from the three
main sections of the sign:
Switching power supplies
Display LED drive circuitry
Graphics processor PC and
interface to sign electronics
November, 2014
RF100 - 758
Wi-Fi Emission Masks, Modulation, and Power

The emission masks for 802.11a and 802.11b are below
Maximum power is limited to +30 dbm
ultimate suppression at mask-edge is -50 dbc
permissible radiation could be as strong as -20 dbm!
Although the noise from properly-operating equipment does not approach
this level on PCS frequencies, a defective 802.11 access point or device
could raise a BTS noise floor from farther than 2 miles in free space
November, 2014
RF100 - 759
Bluetooth Emission Mask, Modulation, Power

Type 3 Bluetooth devices can operate at 100 mw. output
required out-of-band suppression is -50 dbc
this is -30 dbm, capable of raising the noise floor of a BTS up to 3000 ft.
distant in free space
normal phase noise is much lower but ciruit defects could produce
stronger interference and still be compliant with the mask
November, 2014
RF100 - 760
MMDS
The MMDS
suppression
required at the
edge of its
mask is -60
dbc
November, 2014
RF100 - 761
Cordless Phone 2.4 GHz

Cordless phones are very
commonplace today
Operating bands include:
900 MHz. unlicensed
2400 MHz. unlicensed
5 GHz unlicensed
Harmonics of 900 MHz. phones fall
just below PCS uplink blocks, but
problems are rarely if ever seen
2400 MHz. phones can interfere with
nearby 802.11b and 802.11g WiFi and
Bluetooth devices, but rarely if ever
with wireless
5 GHz phones can interfere with
802.11a and 802.11n LANS, but rarely
if ever with wireless
November, 2014
RF100 - 762
Microwave Ovens
Microwave ovens operate in
the 2400 MHz. unlicensed
spectrum
Oven incidental radiation is
strictly limited to avoid health
effects and interference with
electronic cardiac devices
Radiation is required to be
below 1 mw/cm2
However, even at these
levels interference can be
caused to 802.11b/g LANs
and bluetooth devices
Door seals are the main
points of RF egress; clean
them and replace the oven if
the problem persists
November, 2014
RF100 - 763
Leakage from Cable Systems
Cable systems can produce strong leakage across the entire VHF and
UHF spectrum, usually due to bad or incorrectly attached connectors
Poor connector-shield contact can produce strong radiation
November, 2014
RF100 - 764
Consumer Repeaters and BDAs
As if we didnt have enough problems with jammers, theres a whole

world of trouble from consumers eager to get better service
The big problem is the nearly total lack of consumer knowledge in the
selection, installation, and alignment of these devices
Donor and serving antennas are often placed very close together,
depending on dubious repeater capabilities to avoid oscillation
Antenna alignment is haphazard, often pointing toward strong near
BTS of one system and being overloaded, when the customer
actually desires to boost a different system
Interference can be severe but is usually quite visible on a spectrum
analyzer and readily trackable
FCC enforcement support is readily available; use it!
November, 2014
RF100 - 765
Cellular Jammers
Like GPS jammers, cellular/PCS/AWS jammers are illegal in the

US but readily available from foreign vendors on the web
The jammers typically emit wideband noise or combs of
interfering subcarriers, usually across the forward link frequencies
of the bands they are intended to jam
Jammer powers vary from milliwatts to hundreds of watts
FCC enforcement assistance is readily available. Use it!
November, 2014
RF100 - 766
A Typical Cellular Jammer
November, 2014
RF100 - 767
Cellular Jammer Spectra 800 MHz.

hhhh
November, 2014
RF100 - 768
Cellular Jammer Spectra 1900 MHz.

hhhh
November, 2014
RF100 - 769
Oscillating TV Boosters and Consumer Devices

Consumer RF electronics is often an unwitting
source of interference to wireless
Old TV booster amplifiers in attics, motor
homes, apartment house MATV systems
Wireless routers, RF sensors, and alarm
systems sometimes have parasitic oscillations
Even home entertainment electronics,
childrens remote control toys, and thermostats
are occasional culprits
The spectra of these devices can range from stable
or unstable narrowband signals to intermittent and
hard-to-see pulsed broadband envelopes tens of
MHz. wide
In many cases the owner is unaware of the
existence of the device, or believes it to be
disconnected or powered off.
Finding these sources requires good tech savvy,
and being allowed to stop the interference requires
tact, diplomacy, and a cheerful enthusiasm.
November, 2014
RF100 - 770
UWB Ultra WideBand Communications
Excerpt from Part 15 of FCC Rules:

(d) The radiated emissions at or below
960 MHz from a device operating under
the provisions of this section shall not
exceed the emission levels in Section
15.209. The radiated emissions above
960 MHz from a device
operating under the provisions of this
section shall not exceed the following
average limits when measured using a
resolution bandwidth of 1 MHz:
Frequency in MHz
EIRP in dBm
960-1610
-53.3
1610-1990
-51.3
1990-10600
-41.3
Above 10600
-51.3
November, 2014
The FCC has recently moved to allow the

use of very narrow pulse-width, widebandwidth radio devices
Special applications include
ground-penetrating and buildingpenetrating radar for construction and
rescue applications
low-power communications links with
high resistance to fading, jamming,
and interference
Because of the broadband nature of these
transmissions overlapping PCS
frequencies, there is the potential for
interference
the table at left shows the emission
limits for one type of UWB device
This level of radiation could still raise
the CDMA BTS uplink noise floor if
used within 200-300 feet from a BTS
RF100 - 771
Arc Welding: Intermittent Source

An Effective Spark Gap Emitter
Characterized by noise over a large
frequency spectrum
welding rods or wire are typically the
right length to be a good antenna
Where: Auto Body Repair Shops, Metal
Fabricator Shops
November, 2014
RF100 - 772
Electric Utility Substations

Substations
with highervoltage feeds
and large
amounts of
equipment can
be major noise
emitters
sniffing with a
spectrum
analyzer and
yagi are the
best
interference
identification
method
In all power-system radiation, the interference is usually very broadband
if the origin seems blurred at the PCS frequency, try looking at lower
frequencies. The interference will be stronger there its origin may be
more readily identifiable
Most utility companies are quite cooperative in resolving interference since
it can interfere with their own telemetry
November, 2014
RF100 - 773
Electric Power Systems:

Unintentional Spark Radiators
Residential and industrial distribution systems can produce noise

Dirty insulators, tree branches contacting wires, and oily HV and LV
terminals on transformers can cause low-level arcing and interference
Sniffing with a directional antenna is the most effective location method
but radiation along lengthy sections of line may blur the actual source
of the interference, making identification harder
November, 2014
RF100 - 774
A Tesla Coil
A Tesla Coil is a highvoltage generator used
mainly for demonstration
or materials-testing
During operation, it can
produce broadband
noise over the entire
radio spectrum
Typical users would
include museums, high
school and university
physics labs, and even
home experimenters
Even a small Tesla Coil
or other arc generator
can raise noise levels at
a nearby BTS
November, 2014
RF100 - 775
Unusual Recent Cases

A hand-held bar-code scanner prototype was being tested in a grocery
store less than mile from a PCS BTS
its fourth harmonic fell on an uplink CDMA carrier
intermittent access failures and FER bursts were noticed
the source was tracked down by direction-finding
Law enforcement was running wireless video surveillance
the signal was illegally within the PCS block and partially overlapped
an uplink CDMA carrier
After complaint, the existence and purpose of the surveillance was
never acknowledged but the interference stopped
paging transmitter parasitics
an 800 MHz. operator received intermittent severe interference from
unstable, frequency-meandering spurious sidebands of a paging
transmitter
FM broadcast harmonics
an 800 MHz. operator had one sectors reverse link performance
seriously limited by the 9th harmonic of a co-located FM station
the radiation was coming from unshielded wiring coming from the
transmitter cabinet and not by radiation through the FM antenna
November, 2014
RF100 - 776
Interference to GNSS
Global Navigation Satellite Systems
Because our sites depend on GPS for timing synchronization,
were interested in keeping up with potential interferers to GPS
The recent Light-Squared 1600-MHz. LTE proposal was
rejected due to widespread fear it would interfere with GPS
Just a few years ago the US Global Positioning System was the
only worldwide general satellite navigation system on earth
Today, there are several systems available:
GPS, our US flagship system, the most-used in the world
Recently modernized with new signal capabilities, both
civilian and military (WAAS for example)
Galileo, European system for general use, partially operational
Advanced capabilities
Glonass, a Russian system slowly being implemented
Greatly modernized with new capabilities
Beidou, a new Chinese regional system
November, 2014
RF100 - 777
Special Considerations for

Because the GNSS signals are spread-spectrum, there is a large
spreading gain realized by GPS and other receivers when they lock to the
signal they are seeking
The actual power level of a GPS or other satnav signal is well below the
spectral density of thermal noise
Satnav signals cant normally be seen on a spectrum analyzer, even
of the RTSA class
However, interferers to GNSS reception are usually visible above the
noise floor with sensitive RTSAs, and can be tracked down by normal
methods
In some countries, GPS jammers are often used by criminals and rogue
elements to
Disorient pedestrians to facilitate robbery or worse
Disable navigation by, and tracking reports from, transportation
vehicles with highly valuable cargo which can be stolen
Although their transmitted power levels can be low, fortunately GPS
jammers are relatively easy to track
The following pages show the spectra of the GNSS systems
November, 2014
RF100 - 778
GNSS
hhhh
November, 2014
RF100 - 779
GPS Spectrum
These are the measured spectra of the US GPS system

At right the narrow 2-MHz. wide civilian GPS signal can be
seen superimposed on the wider 1500 MHz. military signal
At left the 1200 MHz. military signal is visible
November, 2014
RF100 - 780
Galileo Spectrum
This trace is from the first launched satellite of the European

Galileo satellite navigation system.
November, 2014
RF100 - 781
Beidou Spectrum
Beidou is a 3-satellite Chinese regional satnav system, covering

from the Indian Ocean in the west to Australia in the east
November, 2014
RF100 - 782
Glonass Spectrum
After several years of decline and low numbers of working

satellites, Russia has more recently modernized the signal and
capabilities of the system and launched several additional
satellites
Multi-system satnav receivers are entering the international market
with capabilities of receiving GPS, Galileo, and Glonass for greatly
enhanced accuracy
November, 2014
RF100 - 783
Interference
to GPS
MILITARY
USERS ONLY
CIVILIAN USERS
MILITARY
USERS ONLY
GPS is very important to CDMA BTS operation

it provides the master clock for PN and other timing reference
Symptoms of Interference to GPS
one or multiple sites with GPS lock problems
Identification, Detection
any terrestrial interference in the GPS band: 1545~ MHz.
GPS receiver front ends with broad filters may suffer
fundamental overload/interference over wide frequency range
look for interference with spectrum analyzer
GPS antennas have active amplifiers, look after amplifier
Possible Interference Sources
dirty WiFi, Bluetooth, cordless phones, other devices
misconfigured GPS-assisted surveying equipment
oscillating GPS receiving antenna/amplifier device
November, 2014
RF100 - 784
GPS Jammers
Handy gadgets! Order Today!?!!

Used to facilitate disorientation and robbery of
GPS-dependent citizens,
disrupt tracking of vehicles with valuable cargo
Even disrupt GPS-assisted aircraft navigation
and landings
Illegal in the US, but still readily available for a few
dollars from foreign vendors on the web
FCC enforcement assistance readily available
November, 2014
RF100 - 785
Field Techniques to
Locate Interference Sources
November, 2014
RF100 - 786
Steps to Solve Reverse Link Problems

Observe system-collected sector receive power levels
Deduce directional information if seen on multiple sectors
Watch receive line/sample port until interferer definitely seen
For intermittent interferers, collect in-band spectragrams or
auto logging using remotely controlled spectrum analyzer
If intermodulation suspected, do wide-band spectragrams seeking
strong signals appearing at same time as interference
put in 6 or 10 db pad before first receiving amplifier and see if
interference goes down by multiple of pad value internal!!
If not internal intermod, try to trackdown
obtain the sensitivity necessary to see at ground level using
bandpass filters, low noise amplifiers, directional antennas,
portable masts
Once visible, use triangulation to track it down
November, 2014
RF100 - 787
Tracking Down Weak Uplink Interferers

BTS/eNodeB antennas have a 20-30 db advantage over the view
at the ground
So a 20-db above noise signal at the sector input will be
invisible on a spectrum analyzer with omni antenna at ground
Special techniques for weak signal analysis
Bottom line: you need to be 20+ db better than normal
Directional antenna: absolutely necessary
Low noise preamp: necessary on most analyzers
Bandpass filter: necessary to prevent desensitization
Height: elevated and widely-clear locations
Masts, even Painters Poles are useful
November, 2014
RF100 - 788
Typical 700 and 800 MHz. Directional Antennas
Cellular Specialties - 700-806MHz

11dBi 8 Element Yagi Antenna
TESSCO SKU :312128
Mfg Part #:CSI-AY/700-806/11
UPC:888063121289
Cellphone-Mate - 806-960MHz
14dBi 14 Element Yagi Antenna
TESSCO SKU : 374594
Mfg Part #: CM230-800
UPC: 888063745942
November, 2014
RF100 - 789
1900 MHz. Directional Antenna

HyperGain HG1910Y Yagi
November, 2014
RF100 - 790
Steps to Solve Forward Link Problems

Ways to learn if Forward Link Interference is occurring
Access failure and drop statistics to pin down to sector level
Call failure location information if available on your system
Customer complaints, reports from techs, engineers, everyone
Forward link interferers must override BTS signals, so they should
be much easier to discover and see than reverse link interferers
Identify area of complaints and go watch for interference
Spectragram or screen-capture driving across problem area
looking to spot abnormal signatures
If intermittent, set up stationary analyzer or spectragram or
screen capture until abnormal signature is observed
After interference is seen,
Use triangulation to pinpoint source
Worst case, set up monitoring in multiple directions from one
site or in multiple sites to triangulate highly intermittent sources
November, 2014
RF100 - 791
A Primary Technique: Triangulation

Directional Antennas are essential
Both to determine direction of origin, and to get enough
sensitivity to see weak and/or distant signals
Pitfall: at ground level, scattering and reflections are the norm
Record directions and strengths graphically from many locations
Dont put faith in a single reading or a single measurement
location, the complete picture will eventually yield the solution
Keep notes of for each spot you measure
Note all peak directions seen, and strength of each
Easy method: Arrows on a map, arrow length is strength
youll see convergence when enough data is collected
FCC ASR tower database is useful to find suspicious targets
If you seem to be progressing toward a signal but it stops
increasing in strength and seems to be coming from different
opposing directions, it is probably above you and reflecting back to
you from outside. Look up!
November, 2014
RF100 - 792
Triangulation
Triangulation is the process of
locating a transmitting source by
measuring radial distance or
direction of the received signal
from several different points
Triangulation can be used to
pinpoint the geographic position
of a user or interferer
The drawing shows the basic
principle of triangulation.
The emitters location is
found by measuring the
relative direction of the
signal from three (or more)
different locations.
The area where the radials
overlap becomes search area
for the emitters exact
location.
1
November, 2014
RF100 - 793
Triangulation Rounds Two and Up

The first round of
triangulation will identify the
vicinity of the emitter.
However, the search area
may still be impractically
large.
Another round of
triangulation from closer
points surrounding the
search area may be required.
When completed you should
have 3 new intersecting lines
which reveal the approximate
location of the interferer
within a triangle of
uncertainty.
This method can also be
used to find interferers inside
a large building.
1
November, 2014
RF100 - 794
Triangulation/Trackdown Example 1
This 930 MHz. signal was tracked to its
source on a downtown building in
Nashville, Tennessee
Notice the strong misleading reflections at
every location more than 2500 feet west
Consistent results were seen from the
unobstructed river bottom
November, 2014
RF100 - 795
Triangulation/Trackdown Example 2
This 930 MHz. signal source was observable over a wide area, but
rolling terrain severely contaminated many of the measurements
The northwest measurement points saw ambiguous strength
variations and reflections from misleading directions, but the north
and northeast points gave a consistent track to the source
November, 2014
RF100 - 796
An Alternative Technique:
Blind Driving with Detailed Capture/Recording
What: Driving and Automatically Recording What You Pass
Where: Anywhere, from large area to small vicinity
When: Any of the following.
Interference signature is unknown,
Interference is low level and affects only local surroundings,
or area is very large,
area not good for stopping and investigation (crime, bad weather, wee
hours, etc. when standing and triangulating would be risky)
When documentation of interference levels over wide area desired
Advantages: Simple to perform, solid documentation, post-analysis
Disadvantages: Low gain antennas prevent seeing very low sources, so
later triangulation probably needed for trackdown
Methods: Use fast screen captures if your analyzer doesnt have replay
Free utility Automatically Take Screen Shots Software and others
are available to take periodic captures
November, 2014
RF100 - 797
Blind Drive Example
November, 2014
RF100 - 798
Blind Drive Example
November, 2014
RF100 - 799
Blind Drive Example
November, 2014
RF100 - 800
Blind Drive Example
November, 2014
RF100 - 801
Blind Drive Example
November, 2014
RF100 - 802
Blind Drive Example
November, 2014
RF100 - 803
Blind Drive Example
November, 2014
RF100 - 804
Blind Drive Example
November, 2014
RF100 - 805
Blind Drive Example
November, 2014
RF100 - 806
Blind Drive Example
November, 2014
RF100 - 807
Blind Drive Example
November, 2014
RF100 - 808
Blind Drive Example
November, 2014
RF100 - 809
Blind Drive Example
November, 2014
RF100 - 810
Blind Drive Example
November, 2014
RF100 - 811
Intermodulation
November, 2014
RF100 - 812
Modulation and Mixing vs. Intermodulation

When two signals are intentionally combined in a nonlinear device we call the effect modulation
Amplitude modulator, or quad phase modulator
Mixer, down or up converter in superheterodyne
When two (or more) signals are unintentionally combined
in a non-linear device, we call the effect intermodulation (a
pejorative term)
An analogy: Botanists use soil to grow plants. But on your living
room carpet, soil is just dirt.
IM signals increase system noise, or cause distinctive

recognizable interference signals
November, 2014
RF100 - 813
Intermod Basics
Definition: Intermodulation (IM) is
Non-linear device
Input
Output
the unintended mixing of legitimate
RF signals, producing undesired
signals (intermodulation products) on
f
f
unrelated frequencies possibly
f1 f 2
3f1-2f2 f1 f2 3f2-2f1
already being used for other services
2f2-f1
2f1-f2
IM can devastate reception on
certain frequencies at base
stations and other communication
facilities
Power transfer characteristics
Intermodulation occurs because
of typical amplifier or other device
signals are passing through a
nonlinear device, allowing each signal
Predicted
Third order
to alter the waveshape of the others
power
intercept
the frequencies of the intermod
point
products are sums and
differences of multiples of the
Output
original signal frequencies, and
power
Third order
can be calculated exactly
(dBm)
intermodulation
the strength of the intermod
products
products depends on the degree
Noise floor
of nonlinearity of the circuits
involved, and can be predicted
with good accuracy using
Input power (dBm)
measured intercept levels
November, 2014
RF100 - 814
Intermodulation Interference Analysis

There are three basic categories of
Intermodulation (IM) interference:
Transmitter produced IM is the result of
one or more transmitters impressing a signal
in the non-linear final output stage circuitry of
another transmitter, usually via antenna
coupling. The IM product frequency is then
re-radiated from the transmitter's antenna.
Receiver produced IM is the result of two or
more transmitter signals mixing in a receiver
RF amplifier or mixer stage when operating
in a non-linear range.
Other" radiated IM, or Passive IM, is
the result of transmitter signals mixing in
other non-linear junctions. These junctions
are usually metallic, such as rusty bolts on a
tower, dissimilar metallic junctions, or other
non-linear metallic junctions in the area. IM
products can also be caused by non-linearity
in the transmission system such as antenna,
transmission line, or connectors.
November, 2014
Duplexer
Duplexer
Comb
Comb
Circ
BPF
Circ
TX
TX
Preamp
Splitter
RX
RF100 - 815

The frequencies of IM products are derived from mathematical
formulae. IM products are classified by their "order" (2nd, 3rd, 4th,
...Nth). Some of the more common forms of mixing are illustrated
in the following examples. Note that The "A", "B", and "C"
designations are the mixing frequencies. The numerical number
assigned to the letter designation indicates the harmonic
relationship of the frequency. Thus, 2A means the 2nd harmonic
of frequency A.
Order
First
Second
Third
Fourth
Fifth
Sixth
Seventh
Eighth
Ninth
November, 2014
Mixing Formulae
A=B, A=C, etc.
A B, A C, etc.
A + B - C, A 2B, 2A B, etc.
A 3B, 2A 2B, 3A B, etc.
A 4B, 2A 3B, 3A 2B, 4A B, etc.
A 3B 2C, 2A 2B 2C, 3A 2B C, etc.
A 6B, 2A 5B, 3A 4B, 4A 3B, 5A 2B, etc.
A 7B, 2A 6B, 3A 5B, 4A 4B, 5A 3B, 6A 2B,
A 8B, 2A 7B, 3A 6B, 4A 5B, 5A 4B, 6A 3B, c.
RF100 - 816

The IM product formulae are just a few of the many possible
combinations. When there are four frequencies involved at one
time, the mixing possibilities increase tremendously. Not all of the
mixing possibilities are significant in creating interference signals.
Some fall out-of-band of the receiver and the higher order IM
products are usually weaker in signal strength.
November, 2014
RF100 - 817
Transmitter Spurious Output Interference

Analysis
Transmitter spurious output interference can be attributed to many
different factors in a transmitter. The generation of spurious
frequencies could be due to non-linear characteristics in a
transmitter or possibly the physical placement of components and
unwanted coupling. If a spurious signal falls within the passband of
a nearby receiver and the signal level is of sufficient amplitude, it
can degrade the performance of the receiver.
November, 2014
RF100 - 818
Transmitter Spurious Output Interference

Analysis
The analysis takes into account a transmitters spurious output
specification, output levels, transmission line losses, filters,
duplexers, combiners, isolators, multi-couplers and other RF
devices that are present in each system. Additionally, the analysis
considers the antenna separation space loss, horizontal and
vertical gain components of the antennas as well as how they are
mounted on the structure. The gain components are derived from
antenna pattern data published by each manufacturer.
The analysis determines how much isolation is required to prevent
receiver performance degradation for any transmitter spurious
signals that fall within a receivers passband.
November, 2014
RF100 - 819
Non-linear Effects and Intermodulation
Almost everything is slightly (or extremely) non-linear. Only free

space is theoretically a true linear medium. Particularly non-linear are:
all active semiconductor devices
corroded electrical connections, etc.
When high RF current levels are present in non-linear devices,
waveform distortion occurs
A distorted (clipped, peaked, etc.) non-sinusoidal waveform is
equivalent to a sum of sine waves of several different frequencies
(Fourier series)
Product waveforms can also occur when two frequencies are
mixed due to the non-linearity
if the nonlinear device characteristics are accurately known
(intercept point, etc.), IM amplitudes can be accurately computed.
If nonlinear device characteristics are unknown, the worst-case
intermod mechanism will have a conversion loss of at least 6 dB.
November, 2014
RF100 - 820
What to do about IM
Try to prevent or reduce the amplitude of strong RF signals
reaching receivers in wireless systems
Reduce or eliminate at the source, if feasible (spurious
emissions from electric lamps, signs, elevator motors, etc.)
Shielding, enclosure, modification of antenna directionality to
reduce the penetration of electromagnetic waves
Identify and eliminate secondary non-linear radiators: parallel
metal joints with conductive connections, ground all parts of
metal fences, rain gutters, etc. (also improves lightning
protection)
Conducted RF from wires, etc. entering receiver can be
reduced via low pass or band pass filters, ferrite beads, etc.
Notch filters to remove source RF, or specific harmonics or
products
November, 2014
RF100 - 821
Intermod Forensics
November, 2014
RF100 - 822
Intermod Forensics and Detective Work

Detective Work to identify
the likely creation paths for an observed intermod problem
methods of reducing the intermod production or delivery to
non-problematic levels
Identify source and victim destination
analyze each conceivable path
gains, isolations, line losses, conversion losses, bandpass
filters in the path
compute the likely intermod amplitude at the victim due to
that path
the path with the largest calculated amplitude at the victim
is the most suspect and should be investigated or mitigated
first
November, 2014
RF100 - 823
Truth Serum for a Witchhunt:

a lowly attenuator
Often the source of intermod is unclear it could be anywhere:
In the affected victim receiver
In a transmitter of one of the source signals
In some other nonlinear device nearby
A simple attenuator (usually 3, 6 or 10 db pad) can be used to help
isolate where the intermod is occuring
Place pad in front of the victim receiver
If the intermod decreases the same amount as the pad
attenuation, it is coming in from outside, beyond the pad
Keep looking elsewhere
If the intermod decreases by a multiple of the pad attenuation, it
is being generated in the receiver
Consider additional filtering for the receiver
Place high power pad in front of the transmitters, one by one
When the intermod is reduced by the maximum amount, the pad
is on the transmitter producing most of the intermod
November, 2014
RF100 - 824
Using an Attenuator for Intermodulation

Location
IM
-90 dbm
TX1
RX
Troublesome intermod
is received on a
product frequency of
TX1 and TX2. Where
is the source?
IM
-102 dbm
RX
TX2
IM
-96 dbm
TX1
6 db
RX
TX2
November, 2014
A 6 db pad on the
receiver merely
reduces all signals
including the intermod
by 6 db. The intermod
is originating outside
this receiver.
IM
-114 dbm
RX
6 db With a 6 db pad on
TX1, the intermod
TX1 goes down 12 db. The
intermod is reduced,
but this does not prove
where the IM is
generated.
TX2
With a 6 db pad on TX2,

the intermod goes down
TX1
lower than anywhere
else. TX2 is an intermod
6 db
generator.Now consider
additional flitering for
TX2 TX2 to suppress the IM.
RF100 - 825

Tonex RF Bootcamp

Încărcat de

Informații document

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Tonex RF Bootcamp

Încărcat de

Drepturi de autor:

Formate disponibile

Tonex RF Bootcamp

RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex

RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex

How Did We Get Here?

1831 Faraday demonstrated that

RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex

Submarine Cable Installation

RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex

Alexander Graham Bell and his phone

Telephone Line Installation Crew

RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex

Interrelated electric and magnetic fields

RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex

1914: Radio became valuable military tool in World War I

RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex

Prefixes for Large and Small Units

RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex

Wavelength, Frequency, and Energy Relationships

4 x 1014 - 7.5 x 1014

7.5 x 1014 - 3 x 1016

RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex

Frequency vs. Wavelength

RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex

Radio Spectrum Designations

30 kHz - 300 kHz

300 kHz - 3 MHz

30 MHz - 300 MHz

300 MHz - 3 GHz

30 GHz - 300 GHz

RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex

Common Terms for US Frequency Bands

C-Band satellite downlink

C-Band Radar (weather)

C-Band satellite uplink

X-Band Radar (police/weather)

Ku-Band Radar (police)

13.4-14 GHz 15.7-17.7 GHz

RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex

Microwave Bands (complete list)

110 to 170 GHz

RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex

Frequencies Used by Wireless Systems

0.7 0.8 0.9 1.0

1.4 1.6 1.8 2.0

Short Wave -- International Broadcast -- Amateur

VHF LOW Band

30,000,000 i.e., 3x10 Hz

VHF VHF TV 7-13

120 140 160 180 200

0.7 0.8 0.9 1.0

300,000,000 i.e., 3x108 Hz

UHF UHF TV 14-59

3,000,000 i.e., 3x106 Hz

1.4 1.6 1.8 2.0

3,000,000,000 i.e., 3x109 Hz

30,000,000,000 i.e., 3x10

The Broadband Wireless Spectrum

Five differently-regulated ranges of spectrum are available for broadband:

RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex

Current Wireless/Cellular Spectrum in the US

RF Bootcamp - Course RF100 v10.0 - (c) 2014 Tonex

North American Cellular Spectrum

Paging, ESMR, etc.

Frequencies used by A Cellular Operator