CDMA Overview

Introduction
CMDAOne and CDMA2000 are the wireless standards proposed by 3GPP2.
CDMAOne is a collective name given to IS95A, JSTD008 and IS95B.
IS95A operates in the Cellular Band whereas the JSTD operates in the PCS band.
Is95B is an upgrade to both these standards and operates in both bands.
The point in favour of CDMA 1x is that it requires narrow band CDMA (1.25Mhz)
to operate.
In CDMA each user (the MS) is assigned a unique code (in radio environment
terms, it is unique spreading waveform). This unique code distinguishes different
users in the radio environment.
Spreading the user waveform (small bit rate) with code (fast bit rate) is called
Spread Spectrum.
Spread Spectrum is accomplished before transmission through the use of a code
that is independent of data sequences .The same code is used at the receiver to
despread the received signal so that the original data sequence may be recovered.
 Band of Operation
There are 2 CDMA common air interface standards:
Cellular (824-894 MHz) - IS-95A
PCS (1850-1990 MHz) - Joint-STD-008
Cellular Band
45 MHz spacing for forward & reverse channel
Frequency assignments are on 30 kHz increments
PCS Band
80 MHz spacing for forward & reverse channel
Frequency assignments are on 50 kHz increments
 Cell Configuration in CDMA
In Wireless communication we divide a whole geographical area into smaller
chunks called cells. A single BS services each of these cells. These cells are grouped
into groups of 3 7 cells to form a cluster.
Groups of clusters are put under a single Base Station Controller (BSC). All the BSCs
in PLMN are controlled by a MSC (Master Switching center).
 Walsh, Short PN and Long PN Codes

Walsh Code: These codes are also used for spreading on a forward link.
-In IS-95A and IS-95B we use 64 orthogonal codes and in CDMA-2000 we use 128
orthogonal codes.
-These codes follows the orthogonal property of vector i.e. auto-correlation of a code is
1 and correlation with any other code is 0.

Short PN Code: This is a 16 bit short PN Code used to identify the BS and hence the
cell.

Long PN Code: This code on the reverse link is used for spreading meaning identifying
the mobile station. It is 42-bit code. On the forward link it is used for data
scrambling.
 IS-95 Logical Channels

Forward Link: The Forward Link is divided into 64 code channels. The logical structure is
described below.
Pilot Channel: This channel is all zeros carrying no data information. This channel is the
beacon channel that defines the radius of the cell and hence is transmitted with the
largest power. is assigned W0
Synchronization Channel: Used by the mobile during system acquisition to receive the system
time, system identification and parameter information and state of the Long Code. Sync
Channel is W32. This operates at 1200 bps.
Paging Channel: This channel carries overhead messages, pages, call setup messages and
orders. The bps (4800 or 9600bps) of this channel is got from the Sync. Channel. The
paging channel is assigned Walsh codes W1-W7.
Traffic Channel: The traffic channels are assigned to individual users to carry call traffic.
 Continued...
Reverse Link: Reverse CDMA Channel consists of 242-1 logical channels. One of the
logical channels is permanently and uniquely associated with each MS. The
channel does not change upon handoff.
Access Channel: Access channels are used by mobiles to transmit signaling
information. Access channels are paired to Paging Channels. Each paging channel
can have up to 32 access channels. These channels operate at 4800 bps.
Reverse Traffic Channel: The reverse traffic channel are used by individual users
during their actual calls to transmit traffic to the BTS .
CALL PROCESSING
MS-Initialization State
 MS-Idle state

The MS enters this state and listens to the Primary Paging Channel with the
PRAT read from the Sync channel message.
 Messages in CDMA
In CDMA, most call processing events are driven by messages
Some CDMA channels exist for the sole purpose of carrying messages; they never carry
users voice traffic
Sync Channel (a forward channel)
Paging Channel (a forward channel)
Access Channel (a reverse channel)
On these channels, there are only messages, continuously all of the time
Some CDMA channels exist just to carry user traffic
Forward Traffic Channel
Reverse Traffic Channel
On these channels, most of the time is filled with traffic and messages are sent only when
there is something to do
All CDMA messages have very similar structure, regardless of the channel on which
they are sent
 Message Vocabulary: Acquisition & Idle
States

Pilot Channel Sync Channel

No Messages Sync Channel Msg

BTS Access Channel

Paging Channel
Access Parameters Msg General Page Msg Registration Msg
Order Msg
System Parameters Msg Order Msg Mobile Station Acknowldgment
Base Station Acknowledgment
Lock until Power-Cycled Long Code Transition Request
CDMA Channel List Msg Maintenance required SSD Update Confirmation
many others.. many others..
Extended System Channel Assignment Origination Msg
Parameters Msg Msg
Extended Neighbor Feature Notification Msg Page Response Msg
List Msg
Global Service Authentication Authentication Challenge
Redirection Msg Challenge Msg Response Msg

Service Redirection Msg Status Request Msg Status Response Msg

TMSI Assignment
SSD Update Msg TMSI Assignment Msg Completion Message

Null Msg Data Burst Msg Data Burst Msg

 Message Vocabulary: Conversation State
Forward Traffic Channel
Order Msg Alert With Reverse Traffic Channel
Base Station Acknowledgment Information Msg
Base Station Challenge
Confirmation Service Request Msg Service Request Msg Origination
Message Encryption Mode Continuation Msg
Authentication Service Response Msg Service Response Msg Authentication Challenge
Challenge Msg Response Msg
TMSI Assignment Msg Service Connect Msg Service Connect TMSI Assignment
Completion Message Completion Message
Send Burst DTMF Msg Service Option Service Option Control Send Burst DTMF Msg
Control Msg Message

Set Parameters Msg Status Request Msg Status Response Msg Parameters Response
Message
Power Control Flash With Flash With Power Measurement
Parameters Msg. Information Msg Information Msg Report Msg

Retrieve Parameters Msg Data Burst Msg Data Burst Message Order Message
Mobile Sta. Acknowledgment
Analog Handoff Extended Handoff Pilot Strength Long Code Transition
Direction Msg Direction Msg Measurement Msg Request
Neighbor List SSD Update Confirmation
SSD Update Msg Update Msg Handoff Completion Msg Connect
Mobile Station In-Traffic System
Registered Msg Parameters Msg
 Find a Frequency with a CDMA RF Signal

Reverse Link Frequencies Forward Link Frequencies

(Mobile Transmit) (Base Station Transmit)
800 MHz. Cellular Spectrum
824 MHz. 835 845 849 870 880 890 894

A B Paging, ESMR, etc. A B

825 846.5 869 891.5
1900 MHz. PCS Spectrum
unlic. unlic.
A D B E F C data voice A D B E F C
1850MHz. 1910MHz. 1930MHz. 1990 MHz.
FREQUENCY LISTS:
Mobile scans forward link frequencies: HISTORY PREFERRED
(Cellular or PCS, depending on model) LIST ROAMING
History List Last-used:
LIST

Preferred Roaming List Freq Freq/SID 1

Freq Freq/SID 2
until a CDMA signal is found. Freq Freq/SID 3
NO CDMA?! power-saving standby mode Freq
Freq
Freq/SID 4
Freq/SID 5
etc. etc.
 Find Strongest Pilot, Read Sync Channel

0 All PN Offsets
Ec/Io

1. Pilot Searcher Scans the Entire Range of PNs

-20
Chips0 32K
PN0 512
SYNC 23:14:09.817
98/05/24 CHANNEL[SCH]
MESSAGE
2. Put Rake finger(s) on strongest Sync Channel Message
MSG_LENGTH = 208 bits
available PN, decode Walsh 32, MSG_TYPE = Sync Channel Message
and read Sync Channel Message P_REV = 3
MIN_P_REV = 2
SID = 179
Active Pilot NID = 0
PILOT_PN = 168
Rake Fingers Offset Index
LC_STATE = 0x0348D60E013
SYS_TIME = 98/05/24 23:14:10.160
LP_SEC = 12
LTM_OFF = -300 minutes
DAYLT = 0
Reference PN PRAT = 9600 bps
RESERVED = 1
 The Configuration Messages
After reading the Sync Channel, the mobile is now capable of reading the Paging
Channel, which it now monitors constantly
Before it is allowed to transmit or operate on this system, the mobile must collect a
complete set of configuration messages
Collection is a short process -- all configuration messages are repeated on the paging
channel every 1.28 seconds
The configuration messages contain sequence numbers so the mobile can recognize if
any of the messages have been freshly updated as it continues to monitor the paging
channel
Access parameters message sequence number
Configuration message sequence number
If a mobile notices a changed sequence number, or if 600 seconds passes since the last time
these messages were read, the mobile reads all of them again
 Go to Paging Channel, Get Configured
All PN Offsets
0
Ec/Io

-20

Chips0 Read the 32K

PN0 Configuration Messages 512
Access Parameters Msg

System Parameters Msg

Keep Rake finger(s) on strongest CDMA Channel List Msg

available PN, decode Walsh 1,
Extended System
and monitor the Paging Channel Parameters Msg (*opt.)

(Extended*) Neighbor
List Msg

Global Service
Redirection Msg (*opt.)
Two Very Important Configuration Messages

ACCESS PARAMETERS MESSAGE SYSTEM PARAMETERS MESSAGE

98/05/24 23:14:10.427 [PCH] 98/05/24 23:14:11.126 [PCH] System Parameter Message
MSG_LENGTH = 184 bits MSG_LENGTH = 264 bits
MSG_TYPE = Access Parameters Message MSG_TYPE = System Parameters Message
PILOT_PN = 168 Offset Index
PILOT_PN = 168 Offset Index
CONFIG_MSG_SEQ = 0
ACC_MSG_SEQ = 27 SID = 179 NID = 0
ACC_CHAN = 1 channel REG_ZONE = 0 TOTAL_ZONES = 0 ZONE_TIMER = 60 min
NOM_PWR = 0 dB INIT_PWR = 0 dB PWR_STEP = 4 Db MULT_SIDS = 0 MULT_NID = 0 BASE_ID = 8710
NUM_STEP = 5 Access Probes Maximum BASE_CLASS = Public Macrocellular
MAX_CAP_SZ = 4 Access Channel Frames Maximum PAGE_CHAN = 1 channel
PAM_SZ = 3 Access Channel Frames MAX_SLOT_CYCLE_INDEX = 0
Persist Val for Acc Overload Classes 0-9 = 0 HOME_REG = 0 FOR_SID_REG = 0 FOR_NID_REG = 1
Persist Val for Acc Overload Class 10 = 0 POWER_UP_REG = 0 POWER_DOWN_REG = 0
PARAMETER_REG = 1 REG_PRD = 0.08 sec
Persist Val for Acc Overload Class 11 = 0
BASE_LAT = 00D00'00.00N BASE_LONG = 000D00'00.00E
Persist Val for Acc Overload Class 12 = 0 REG_DIST = 0
Persist Val for Acc Overload Class 13 = 0 SRCH_WIN_A = 40 PN chips
Persist Val for Acc Overload Class 14 = 0 SRCH_WIN_N = 80 PN chips
Persist Val for Acc Overload Class 15 = 0 SRCH_WIN_R = 4 PN chips
Persistance Modifier for Msg Tx = 1 NGHBR_MAX_AGE = 0
Persistance Modifier for Reg = 1 PWR_REP_THRESH = 2 frames
Probe Randomization = 15 PN chips PWR_REP_FRAMES = 56 frames
Acknowledgement Timeout = 320 ms PWR_THRESH_ENABLE = 1
PWR_PERIOD_ENABLE = 0
Probe Backoff Range = 4 Slots Maximum
PWR_REP_DELAY = 20 frames
Probe Sequence Backoff Range = 4 Slots Max. RESCAN = 0
Max # Probe Seq for Requests = 2 Sequences T_ADD = -13.0 Db T_DROP = -15.0 dB T_COMP = 2.5 dB
Max # Probe Seq for Responses = 2 Sequences T_TDROP = 4 sec
Authentication Mode = 1 EXT_SYS_PARAMETER = 1
Random Challenge Value = Field Omitted RESERVED = 0
Reserved Bits = 99 GLOBAL_REDIRECT = 0
 Four Additional Configuration Messages
CDMA CHANNEL LIST MESSAGE EXTENDED SYSTEM PARAMETERS
98/05/24 23:14:10.786 [PCH] CDMA Channel List Message 98/05/24 23:14:10.946 [PCH]
MSG_LENGTH = 72 bits Extended System Parameters Message
MSG_TYPE = CDMA Channel List Message MSG_LENGTH = 104 bits
PILOT_PN = 168 Offset Index MSG_TYPE = Extended System Parameters Message
CONFIG_MSG_SEQ = 0 PILOT_PN = 168 Offset Index
CDMA_FREQ = 283 CONFIG_MSG_SEQ = 0 RESERVED = 0
RESERVED = Field Omitted PREF_MSID_TYPE = IMSI and ESN
MCC = 000 IMSI_11_12 = 00
NEIGHBOR LIST RESERVED_LEN = 8 bits
98/05/24 23:14:11.486 [PCH] Neighbor List Message RESERVED_OCTETS = 0x00
MSG_LENGTH = 216 bits BCAST_INDEX = 0
MSG_TYPE = Neighbor List Message RESERVED = 0
PILOT_PN = 168 Offset Index
CONFIG_MSG_SEQ = 0
PILOT_INC = 4 Offset Index
NGHBR_CONFIG = 0 NGHBR_PN = 220 Offset Index
GLOBAL SERVICE REDIRECTION
NGHBR_CONFIG = 0 NGHBR_PN = 52 Offset Index 98/05/17 24:21.566 Paging Channel: Global Service Redirection
NGHBR_CONFIG = 0 NGHBR_PN = 500 Offset Index PILOT_PN: 168, MSG_TYPE: 96, CONFIG_MSG_SEQ: 0
NGHBR_CONFIG = 0 NGHBR_PN = 8 Offset Index Redirected access overload classes: { 0, 1 }, RETURN_IF_FAIL: 0,
NGHBR_CONFIG = 0 NGHBR_PN = 176 Offset Index DELETE_TMSI: 0,
NGHBR_CONFIG = 0 NGHBR_PN = 304 Offset Index Redirection to an analog system:
NGHBR_CONFIG = 0 NGHBR_PN = 136 Offset Index EXPECTED_SID = 0
NGHBR_CONFIG = 0 NGHBR_PN = 384 Offset Index Do not ignore CDMA Available indicator on the redirected analog system
NGHBR_CONFIG = 0 NGHBR_PN = 216 Offset Index Attempt service on either System A or B with the custom system
NGHBR_CONFIG = 0 NGHBR_PN = 68 Offset Index selection process
NGHBR_CONFIG = 0 NGHBR_PN = 328 Offset Index
NGHBR_CONFIG = 0 NGHBR_PN = 112 Offset Index
RESERVED = 0
 Phone Operation on the Access Channel

A sectors Paging Channel announces 1 (typ) to 32 A Successful Access Attempt

(max) Access Channels: PN Long Code offsets for Origination Msg ACCESS
mobiles to use if accessing the system.
For mobiles sending Registration, Origination, Page Success!
Responses BTS MS
Base Station always listening! Probing
On the access channel, phones are not yet under an Access Probe
BTS closed-loop power control! a Probe Sequence
an Access Attempt
Phones access the BTS by probing at power
levels determined by receive power and an open PAGING Base Sta. Acknlgmt. Order
loop formula
If probe not acknowledged by BTS within FW TFC TFC frames of 000s
ACC_TMO (~400 mS.), phone will wait a random
time (~200 mS) then probe again, stronger by PI db. PAGING Channel Assnmt. Msg.
There can be 15 max. (typ. 5) probes in a sequence
and 15 max. (typ. 2) sequences in an access attempt TFC preamble of 000s RV TFC
most attempts succeed on first probe! FW FC Base Sta. Acknlgmt. Order
The Access Parameters message on the paging
channel announces values of all related Mobile Sta. Ackngmt. Order RV TFC
parameters
FW TFC Service Connect Msg.

Svc. Connect Complete Msg RV TFC

FW TFC Base Sta. Acknlgmt. Order

Call is Established!
Registration
 Registration
Registration is the process by which an idle mobile lets the system know its
awake and available for incoming calls
this allows the system to inform the mobiles home switch of the mobiles current
location, so that incoming calls can be delivered
registration also allows the system to intelligently page the mobile only in the area
where the mobile is currently located, thereby eliminating useless congestion on
the paging channels in other areas of the system
There are many different conditions that could trigger an obligation for the mobile
to register
there are flags in the System Parameters Message which tell the mobile when it
must register on the current system
 Registration
SYSTEM PARAMETERS MESSAGE The System Parameters Message tells all
18:26.826 [PCH] System Parameters Message
Pilot_PN: 32 mobiles when they should register.
CONFIG_MSG_SEQ: 14 SID: 16420 NID: 0,
REG_ZONE: 0 TOTAL_ZONES: 0 Zone timer length (min): 1 This mobile notices that it is obligated to
MULT_SIDS: 0 MULT_NIDS: 0
BASE_ID: 1618 BASE_CLASS: Reserved
register, so it transmits a Registration
PAG_CHAN: 1 MAX_SLOT_CYCLE_INDEX: 2 Message.
HOME_REG: 1 FOR_SID_REG: 1 FOR_NID_REG: 1,
POWER_UP_REG: 1 POWER_DOWN_REG: 1 PARAMETER_REG: 1 REGISTRATION MESSAGE
Registration period (sec): 54
Base station 00000.00 Lon., 00000.00 Lat. REG_DIST: 0 16:18:27.144 Access Channel: Registration
SRCH_WIN_A (PN chips): 28 SRCH_WIN_N (PN chips): 100, ACK_SEQ: 7 MSG_SEQ: 1 ACK_REQ: 1 VALID_ACK: 0
SRCH_WIN_R (PN chips): 130 NGHBR_MAX_AGE: 2 ACK_TYPE: 0
PWR_REP_THRESH: 2 PWR_REP_FRAMES (frames): 15 MSID_TYPE: 3, ESN: [0x 01 99 0d fc]
PWR_THRESH_ENABLE: 1 PWR_PERIOD_ENABLE: 0, MFR 1, Reserved 38, Serial Number 69116,
PWR_REP_DELAY: 1 (4 frames) RESCAN: 0, IMSI: (Class: 0, Class_0_type: 1) [0x 01 8d 31 74 29 36]
T_ADD: -14.0dB T_DROP: -16.0dB T_COMP: 2.5dB, T_TDROP: 4s 00-416-575-0421
EXT_SYS_PARAMETER: 1
AUTH_MODE: 0
EXT_NGHBR_LIST: 1
GLOBAL_REDIRECT: 0
REG_TYPE: Timer-based
SLOT_CYCLE_INDEX: 2
MOB_P_REV: 1
EXT_SCM: 1
SLOTTED_MODE: 1
BASE STATION ACKNOWLEDGMENT MOB_TERM: 1
16:18:27.506 Paging Channel: Order
ACK_SEQ: 1 MSG_SEQ: 0 ACK_REQ: 0 VALID_ACK: 1 The base station confirms that the mobiles
MSID_TYPE: 2 IMSI: (Class: 0, Class_0_type: 3)
[0x 02 47 8d 31 74 29 36] (302) 00-416-575-0421 registration message was received. Were
Order type: Base Station Acknowledgement Order
officially registered
Incoming Call
 Receiving an Incoming Call
All idle mobiles monitor the paging channel to receive incoming calls.
When an incoming call appears, the paging channel notifies the mobile in a General
Page Message.
A mobile which has been paged sends a Page Response Message on the access
channel.
The system sets up a traffic channel for the call, then notifies the mobile to use it with a
Channel Assignment Message.
The mobile and the base station notice each others traffic channel signals and confirm
their presence by exchanging acknowledgment messages.
The base station and the mobile negotiate what type of call this will be -- i.e., 13k voice,
etc.
The mobile is told to ring and given a calling line ID to display.
When the human user presses the send button, the audio path is completed and the
call proceeds.
 Page and Page Response
GENERAL PAGE MESSAGE
98/05/24 23:14:46.127 [PCH] General Page Message The system pages the mobile, 1071124566.
MSG_LENGTH = 128 bits
MSG_TYPE = General Page Message PAGE RESPONSE MESSAGE
CONFIG_MSG_SEQ = 1 ACC_MSG_SEQ = 20
98/05/24 23:14:46.425 [ACH] Page Response Message
CLASS_0_DONE = 1
MSG_LENGTH = 216 bits
CLASS_1_DONE = 1 RESERVED = 0
MSG_TYPE = Page Response Message
BROADCAST_DONE = 1 RESERVED = 0
ACK_SEQ = 1 MSG_SEQ = 2 ACK_REQ = 1
ADD_LENGTH = 0 bits ADD_PFIELD = Field Omitted
VALID_ACK = 1 ACK_TYPE = 2
PAGE_CLASS = 0 PAGE_SUBCLASS = 0
MSID_TYPE = IMSI and ESN MSID_LEN = 9 octets
MSG_SEQ = 1
ESN = 0xD30E415C IMSI_CLASS = 0
IMSI_S = 1071124566
IMSI_CLASS_0_TYPE = 0 RESERVED = 0
SPECIAL_SERVICE = 1
IMSI_S = 1071124566
SERVICE_OPTION = 32768
AUTH_MODE = 1
RESERVED = Field Omitted
AUTHR = 0x307B5 RANDC = 0xC6 COUNT = 0
MOB_TERM = 1 SLOT_CYCLE_INDEX = 0
The mobile responds to the page. MOB_P_REV = 3 SCM = 106
BASE STATION ACKNOWLEDGMENT REQUEST_MODE = Either Wide Analog or CDMA Only
98/05/24 23:14:46.768 [PCH] Order Message SERVICE_OPTION = 32768 PM = 0
MSG_LENGTH = 112 bits NAR_AN_CAP = 0 RESERVED = 0
MSG_TYPE = Order Message
ACK_SEQ = 2 MSG_SEQ = 0 ACK_REQ = 0 The base station confirms that the mobiles
VALID_ACK = 1
ADDR_TYPE = IMSI ADDR_LEN = 40 bits page response was received. Now the mobile is
IMSI_CLASS = 0 IMSI_CLASS_0_TYPE = 0 RESERVED = 0
IMSI_S = 1071124566
waiting for channel assignment,
ORDER = Base Station Acknowledgement Order expecting a response within 12 seconds.
ADD_RECORD_LEN = 0 bits
Order-Specific Fields = Field Omitted RESERVED = 0
 Channel Assignment and
Traffic Channel Confirmation
CHANNEL ASSIGNMENT MESSAGE
18:14:47.027 Paging Channel: Channel Assignment
ACK_SEQ: 2 MSG_SEQ: 1 ACK_REQ: 0 VALID_ACK: 1
Only about 400 ms. after the base station
MSID_TYPE: 2 IMSI: (Class: 0, Class_0_type: 0) acknowledgment order, the mobile receives
[0x 01 f8 39 6a 15] 615-330-0644
ASSIGN_MODE: Traffic Channel Assignment the channel assignment message.
ADD_RECORD_LEN: 5 FREQ_INCL: 1 GRANTED_MODE: 2
CODE_CHAN: 43 FRAME_OFFSET: 2
ENCRYPT_MODE: Encryption disabled
BAND_CLASS: 800 MHz cellular band
CDMA_FREQ: 283
The mobile sees at least two
The base station is already good blank frames in a row on
sending blank frames on the forward channel, and
the forward channel,using concludes this is the right traffic
the assigned Walsh code. channel. It sends a preamble
of two blank frames of its own
on the reverse traffic channel.
BASE STATION ACKNOWLEDGMENT
MOBILE STATION ACKNOWLEDGMENT
18:14:47.581 Forward Traffic Channel: Order
ACK_SEQ: 7 MSG_SEQ: 0 ACK_REQ: 1 18:14:47.598 Reverse Traffic Channel: Order
ENCRYPTION: 0 USE_TIME: 0 ACTION_TIME: 0 ACK_SEQ: 0 MSG_SEQ: 0 ACK_REQ: 0
Base Station Acknowledgement Order ENCRYPTION: 0
Mobile Station Acknowledgement Order
The base station acknowledges The mobile station acknowledges the
receiving the mobiles preamble. base stations acknowledgment.
Everybody is ready!
 Service Negotiation and Mobile Alert
SERVICE CONNECT MESSAGE Now that both sides have arrived on the
18:14:47.760 Forward Traffic Channel: Service Connect
ACK_SEQ: 0 MSG_SEQ: 1 ACK_REQ: 0 ENCRYPTION: 0 traffic channel, the base station
USE_TIME: 0 ACTION_TIME: 0 SERV_CON_SEQ: 0
Service Configuration: supported Transmission:
proposes that the requested call
Forward Traffic Channel Rate (Set 2): 14400, 7200, 3600, 1800 bps actually begin.
Reverse Traffic Channel Rate (Set 2): 14400, 7200, 3600, 1800 bps
Service option: (6) Voice (13k) (0x8000)
SERVICE CONNECT COMPLETE MSG.
Forward Traffic Channel: Primary Traffic 18:14:47.835 Reverse Traffic Channel:
Reverse Traffic Channel: Primary Traffic Service Connect Completion
ACK_SEQ: 1 MSG_SEQ: 3 ACK_REQ: 1
ENCRYPTION: 0 SERV_CON_SEQ: 0
ALERT WITH INFORMATION MESSAGE
18:14:47.961 Forward Traffic Channel:
The mobile agrees and
Alert With Information says its ready to play.
ACK_SEQ: 3 MSG_SEQ: 1 ACK_REQ: 1 ENCRYPTION: 0
SIGNAL_TYPE = IS-54B Alerting
ALERT_PITCH = Medium Pitch (Standard Alert)
SERVICE CONNECT COMPLETE is a
SIGNAL = Long RESERVED = 0 major milestone in call processing. Up
RECORD_TYPE = Calling Party Number until now, this was an access attempt.
RECORD_LEN = 96 bits
NUMBER_TYPE = National Number Now it is officially a call.
NUMBER_PLAN = ISDN/Telephony Numbering Plan
PI = Presentation Allowed SI = Network Provided
18:14:48.018 Reverse Traffic Channel: Order
CHARi = 6153000124 RESERVED = 0 RESERVED = 0
ACK_SEQ: 1 MSG_SEQ: 4 ACK_REQ: 0
ENCRYPTION: 0
Mobile Station Acknowledgement Order
The base station orders the mobile to ring, and
gives it the calling partys number to display. The mobile says its ringing.

July, 1998 RF100 (c) 1998 Scott Baxter 7 - 25

The Human Answers! Connect Order
The mobile has been ringing for several
seconds. The human user finally
comes over and presses the send
button to answer the call.
CONNECT ORDER
18:14:54.758 Reverse Traffic Channel: Order
ACK_SEQ: 6 MSG_SEQ: 0 ACK_REQ: 1
ENCRYPTION: 0
Connect Order

BASE STATION ACKNOWLEDGMENT

18:14:54.920 Forward Traffic Channel: Order
ACK_SEQ: 0 MSG_SEQ: 1 ACK_REQ: 0
ENCRYPTION: 0 USE_TIME: 0 ACTION_TIME: 0
Base Station Acknowledgement Order

Now the switch completes the audio circuit and

the two callers can talk!
Outgoing
Outgoing Call
Call
 Placing an Outgoing Call
The mobile user dials the desired digits, and presses SEND.
Mobile transmits an Origination Message on the access channel.
The system acknowledges receiving the origination by sending a base station
acknowledgement on the paging channel.
The system arranges the resources for the call and starts transmitting on the traffic
channel.
The system notifies the mobile in a Channel Assignment Message on the paging channel.
The mobile arrives on the traffic channel.
The mobile and the base station notice each others traffic channel signals and confirm
their presence by exchanging acknowledgment messages.
The base station and the mobile negotiate what type of call this will be -- I.e., 13k voice,
etc.
The audio circuit is completed and the mobile caller hears ringing.
 Origination
The mobile sends an
ORIGINATION MESSAGE
17:48:53.144 Access Channel: Origination
origination message ACK_SEQ: 7 MSG_SEQ: 6 ACK_REQ: 1
VALID_ACK: 0 ACK_TYPE: 0 MSID_TYPE: 3
on the access ESN: [0x 00 06 98 24] MFR 0 Reserved 1
Serial Number 170020
channel. IMSI: (Class: 0, Class_0_type: 0)
[0x 03 5d b8 97 c2] 972-849-5073
AUTH_MODE: 0 MOB_TERM: 1
SLOT_CYCLE_INDEX: 2 MOB_P_REV: 1 EXT_SCM: 1
DualMode: 0 SLOTTED_MODE: 1 PowerClass: 0
BASE STATION ACKNOWLEDGMENT REQUEST_MODE: CDMA only SPECIAL_SERVICE: 1
Service option: (6) Voice (13k) (0x8000) PM: 0
17:48:53.487 Paging Channel: Order
DIGIT_MODE: 0 MORE_FIELDS: 0 NUM_FIELDS: 11
ACK_SEQ: 6 MSG_SEQ: 0 ACK_REQ: 0 VALID_ACK: 1
Chari: 18008900829
MSID_TYPE: 2
NAR_AN_CAP: 0
IMSI: (Class: 0, Class_0_type: 0)
[0x 03 5d b8 97 c2] 972-849-5073
Base Station Acknowledgment Order
The base station confirms
that the origination message
CHANNEL ASSIGNMENT MESSAGE was received.
17:48:54.367 Paging Channel: Channel Assignment
ACK_SEQ: 6 MSG_SEQ: 1 ACK_REQ: 0 VALID_ACK: 1
MSID_TYPE: 2
IMSI: (Class: 0, Class_0_type: 0)
[0x 03 5d b8 97 c2] 972-849-5073
ASSIGN_MODE: Traffic Channel Assignment, The base station sends a
ADD_RECORD_LEN: 5 FREQ_INCL: 1 GRANTED_MODE: 2
CODE_CHAN: 12 FRAME_OFFSET: 0 Channel Assignment
ENCRYPT_MODE: Encryption disabled
BAND_CLASS: 1.8 to 2.0 GHz PCS band
Message and the mobile
CDMA_FREQ: 425 goes to the traffic channel.
 Traffic Channel Confirmation
The base station is already
sending blank frames on
the forward channel,using
the assigned Walsh code.
BASE STATION ACKNOWLEDGMENT
17:48:54.757 Forward Traffic Channel: Order
ACK_SEQ: 7 MSG_SEQ: 0 ACK_REQ: 1 ENCRYPTION: 0
USE_TIME: 0 ACTION_TIME: 0
Base Station Acknowledgment Order
The base station acknowledges
receiving the mobiles preamble.
The mobile sees at least two
good blank frames in a row on
the forward channel, and
concludes this is the right traffic
channel. It sends a preamble
of two blank frames of its own
on the reverse traffic channel.
MOBILE STATION ACKNOWLEDGMENT
17:48:54.835 Reverse Traffic Channel: Order
ACK_SEQ: 0 MSG_SEQ: 0 ACK_REQ: 0
ENCRYPTION: 0
Mobile Station Acknowledgment Order
The mobile station acknowledges the
base stations acknowledgment.
Everybody is ready!
 Service Negotiation and Connect Complete
SERVICE CONNECT MESSAGE
17:48:55.098 Forward Traffic Channel: Service Connect
ACK_SEQ: 7 MSG_SEQ: 1 ACK_REQ: 1 ENCRYPTION: 0
Now that the traffic channel is working
USE_TIME: 0 ACTION_TIME: 0 SERV_CON_SEQ: 0 in both directions, the base station
Service Configuration Supported Transmission:
Forward Traffic Channel Rate (Set 2): 14400, 7200, 3600, 1800 bps proposes that the requested call
Reverse Traffic Channel Rate (Set 2): 14400, 7200, 3600, 1800 bps actually begin.
Service option: (6) Voice (13k) (0x8000)
Forward Traffic Channel: Primary Traffic
Reverse Traffic Channel: Primary Traffic
SERVICE CONNECT COMPLETE MSG.
17:48:55.137 Reverse Traffic Channel: Service Connect
Completion ACK_SEQ: 1, MSG_SEQ: 0, ACK_REQ: 1,
ENCRYPTION: 0, SERV_CON_SEQ: 0

BASE STATION ACKNOWLEDGMENT

17:48:55.779 Forward Traffic Channel: Order
The mobile agrees and
ACK_SEQ: 0 MSG_SEQ: 0 ACK_REQ: 0 ENCRYPTION: 0 says its ready to play.
USE_TIME: 0 ACTION_TIME: 0
Base Station Acknowledgment Order

The base station agrees. SERVICE CONNECT COMPLETE is a

major milestone in call processing. Up
until now, this was an access attempt.
Now it is officially a call.

Now the switch completes the audio circuit and

the two callers can talk!
End
End Call
Call
 Ending A Call
A normal call continues until one of the parties hangs up. That action sends a
Release Order, normal release.
The other side of the call sends a Release Order, no reason given.
If a normal release is visible, the call ended normally.
At the conclusion of the call, the mobile reacquires the system.
Searches for the best pilot on the present CDMA frequency
Reads the Sync Channel Message
Monitors the Paging Channel steadily
Several different conditions can cause a call to end abnormally:
the forward link is lost at the mobile, and a fade timer acts
the reverse link is lost at the base station, and a fade timer acts
a number of forward link messages arent acknowledged, and the base station
acts to tear down the link
a number of reverse link messages arent acknowledged, and the mobile
station acts to tear down the link
 A Beautiful End to a Normal Call
MOBILE RELEASE ORDER
17:49:21.715 Reverse Traffic Channel: Order
ACK_SEQ: 1 MSG_SEQ: 1 ACK_REQ: 1
ENCRYPTION: 0
Release Order (normal release)

BASE STATION ACKNOWLEDGMENT At the end of a normal call, this

17:49:21.936 Forward Traffic Channel: Order mobile user pressed end.
ACK_SEQ: 1 MSG_SEQ: 2 ACK_REQ: 0 ENCRYPTION: 0,
USE_TIME: 0 ACTION_TIME: 0
Base Station Acknowledgement Order
The base station acknowledged
BASE STATION RELEASE ORDER
receiving the message, then sent
17:49:21.997 Forward Traffic Channel: Order
ACK_SEQ: 1 MSG_SEQ: 3 ACK_REQ: 0 ENCRYPTION: 0
a release message of its own.
USE_TIME: 0 ACTION_TIME: 0
Release Order (no reason given)

SYNC CHANNEL MESSAGE The mobile left the traffic channel,

17:49:22.517 Sync Channel scanned to find the best pilot, and read
MSG_TYPE: 1 Sync Channel Message the Sync Channel Message.
P_REV: 1 MIN_P_REV: 1
SID: 4112 NID: 2 Pilot_PN: 183
LC_STATE: 0x318fe5d84a5
SYS_TIME: 0x1ae9683dc
LP_SEC: 9 LTM_OFF: -10 DAYLT: 1
Paging Channel Data Rate: 9600
CDMA_FREQ: 425
 Notification
Notification
of
of aa Voice
Voice Message
Message
 Feature Notification
FEATURE NOTIFICATION MESSAGE
The Feature Notification Message on
the Paging Channel tells a specific
98/06/30 21:16:44.368 [PCH] Feature Notification Message
MSG_LENGTH = 144 bits mobile it has voice messages waiting.
MSG_TYPE = Feature Notification Message
ACK_SEQ = 0
MSG_SEQ = 0 There are other record types to notify
ACK_REQ = 1
VALID_ACK = 0
the mobile of other features.
ADDR_TYPE = IMSI
ADDR_LEN = 56 bits
IMSI_CLASS = 0
IMSI_CLASS_0_TYPE = 3
RESERVED = 0
MCC = 302
IMSI_11_12 = 00
IMSI_S = 9055170325
RELEASE = 0
RECORD_TYPE = Message Waiting
RECORD_LEN = 8 bits MOBILE STATION ACKNOWLEDGMENT
MSG_COUNT = 1
RESERVED = 0 The mobile confirms it has received the
notification by sending a Mobile Station
Acknowledgment Order on the access
channel.
LTE CDMA System Acquisition
Comparison
 LTE Term
AIR INTERFACE Meaning and Usage 1xEV-DO Equivalent

OFDMA Orthogonal Frequency Division Multiple Access, physical layer of LTE Downlink CDMA

SC-FDMA Single Carrier Frequency Division Multiple Access, physical layer of LTE Uplink CDMA

Subcarrier A single 15 kHz radio channel Radio channel

Symbol A single 66.67 s time period Chip (0.81 s)

Resource Element The smallest unit of radio resources, one subcarrier for one symbol n/a

The smallest block of resources that can be allocated, 12 subcarriers for 7 symbols (84
Resource Block n/a
resource elements)[1]

Timeslot 7 consecutive symbols1 Slot

Subframe 2 consecutive timeslots n/a

Frame 10 consecutive subframes, the basic transmission interval Frame

Synchronization Signal Periodic signal for synchronizing with and identifying cells Sync message

Reference Signal Periodic signal for transmission quality measurements Pilot Channel

PBCH Physical Broadcast Channel Control Channel

PDSCH Physical Downlink Shared Channel Forward Traffic Channel

PDCCH Physical Downlink Control Channel Preambles + MAC channels

PCFICH Physical Control Format Indicator Channel DO Session

PHICH Physical Hybrid ARQ Indication Channel ARQ Channel

PRACH Physical Random Access Channel Access Channel

PUSCH Physical Uplink Shared Channel Reverse Traffic Channel

 CORE NETWORK
LTE Term Meaning and Usage 1xEV-DO Equivalent

EPC Evolved Packet Core Packet Data Network

MME Mobility Management Entity RNC + PDSN + AN-AAA

S-GW Serving Gateway PDSN + PCF

PDN-GW Packet Data Network Gateway HA

HSS Home Subscriber System AAA

PCRF Policy Charging Rule Function PCRF

MIP Mobile IP MIP

S1 Bearer A configured traffic path between the eNode B and the S-GW A10 + R-P Session

S5/S8 Bearer A configured traffic path between the S-GW and the PDN-GW MIP

A configured end-to-end traffic path between the UE and the PDN-GW (Radio Bearer +
EPS Bearer Service PPP + MIP
S1 Bearer + S5/S8 Bearer)
 Others
LTE Term Meaning and Usage 1xEV-DO Equivalent
UE User Equipment (the mobile device) Access Terminal (AT)

IMSI [Mobile Country Code (MCC), Mobile

Network Code (MNC) and Mobile
IMSI International Mobile Subscriber Identity Identification Number (MIN) or

Mobile Directory Number (MDN)]

Mobile Serial Number (MSN) or Mobile

IMEI International Mobile Equipment Identity
Equipment Identity (MEID)

Downlink (DL) Transmissions from the network to the mobile Forward Link (FL)
Uplink (UL) Transmissions from the mobile to the network Reverse Link (RL)
Ciphering Over-the-air privacy Encryption

UATI Assignment + DO Session

Attach Initial registration process
Establishment + MIP Registration

Quick Config + Sector Parameters + Access

MIB, SIB Master Information Block and System Information Block
Parameters + DO Session

DCI, UCI Downlink Control Information and Uplink Control Information Traffic Channel Assignment
C-RNTI Cell Radio Network Temporary Identifier MAC Index
CQI Channel Quality Indicator DRC value
HARQ Hybrid ARQ HARQ
Handover Redirection of traffic from one base station to another Handoff

Measurement Control events A1, A2, A3, A4, Pilot Add, Pilot Drop, Dynamic (Soft Slope)
Thresholds for cell selection and handover
A5, B1, B2 Thresholds
Initialization Procedure
Protocol Revision: Rev 0,RevA,Rev B

PN Offset: PN offset (called Pilot PN) defines a cell. The PN offset indicates the timing of the cell's short codes relative to
system time (PN sequence offset in units of 64 PN chips).

System Time: The CDMA System Time consists of two portions: CDMASystemTime(Date) and CDMASystem
Time(Time)

SectorID:The sector ID provides the 128 bit (32 hex character) address of the sector. Sector ID is sent in the Sector
Parameters message and Quick Config message.

Country Code: Country code sets the 3-digit BCD encoded representation of the cell country code of the sector, which
specifies the country that the sector resides in. Country code can be changed at any time and will be sent out in the next
overhead message.

Color Code: The color code identifies the sector.Color code is sent in the Quick Config message.

Open Loop Adjust: Open loop adjust is the nominal power to be used by the access terminal in the open loop power
estimate.

Probe Initial Adjust: ProbeInitialAdjust sets the power correction that the access terminal applies to the open
loop power estimate to adjust its initial transmission on the Access Channel (when transmitting the initial access probe in an
access probe sequence).

Probe Num Step: Probe num step sets the number of steps (access probes) in a single access probe sequence.

Probe power step :Probe power step sets the increase in power between access probes in an access probe sequence.

Preamble Length: Preamble length sets the length (in frames) of the access probe preamble.
Idle State: There is no connection between AT and Network.
UATI Request procedure
Session Seed:
The session seed is a 32 bit (8 hex character) number which the access
network uses to address the access terminal until the access terminal is
assigned a UATI.During the UATI Request State , the access terminal
determines the session seed (using a pre-defined random number generator,
seeded with a number based on the access terminal's hardware ID) and sends
it to the access network in the UATI Request message .The AT uses the
Session Seed as the Random ATI that is its Transmit ATI, to identify itself to
the AN during its UATI Request.
Session seed can be queried at any time, but a value will only be returned if a
session is open.

UATI024:
UATI 024 represents the lower 24 bits of the UATI assigned by the AN to the
AT when a UATI Request is processed from the AT.

UATI Colour Code:

UATI color code is the color code associated with the subnet to which the UATI
belongs.
Session Negotiation Procedure
Hardware ID Type:
During the Session Negotiate State , the access network may send a Hardware ID
Request message to the access terminal. The access terminal then sends a
Hardware ID Response message which includes Hardware ID Type and Hardware
ID Value fields.
The Hardware ID Type determines the length of the Hardware ID Value and how
to interpret the Hardware ID Value.

Configurable Attributes for Protocols:

In the session negotiate state, the NW and the access terminal (AT) negotiate the
protocols and the Configurable Attributes that are used for the session (the
configurable attributes are sometimes called session settings). The NW also
requests the AT's hardware ID by sending a Hardware ID Request message
during this state.
Session negotiations are performed on a traffic channel connection. If a traffic
channel connection is not present when the session is negotiated or re-
negotiated, a temporary traffic channel connection is established (this temporary
connection is closed after the session negotiation is complete).
 Paging Procedure

Paging State:
In the Paging state, the NW is paging the AT to establish a data connection. Before paging the AT, a session
must be open. The NW pages the AT on the Control Channel (CCsynSS, that is Control Channel synchronous
sleep state capsule).
.
 Connection Request Procedure

In the connection request state, the NW has received a Connection Request message from the access terminal.
Connection Negotiate Procedure

ACK Channel Gain

ACK Channel Gain sets the power of the R-ACK Channel relative to the power of the R-Pilot Channel.
 EVDO GAUP Perform
EVDO GAUP Perform:
AT and AN negotiate the following characteristics for the RLP flow using General Attribute Update Protocol (GAUP).

Multi-Flow Packet Application Description

Several different applications, such as video streaming, email download, etc., can use the 1xEV-DO airlink
at the same time and each application may have different QoS (Quality of Service) requirements. The
1xEV-DO release 0 and release A with Default Packet Application (DPA) supports only one RLP stream,
therefore, all applications are forced to use same RLP stream. There is no mechanism to provide different
flows for different applications when those flows are transmitted over the 1xEV-DO airlink with DPA.

The Multi-Flow Packet Application has all of the functionality of the DPA including a single best effort default
flow. If the Access Terminal (AT) doesn't request additional flows, then the functionality remains identical to
DPA. Just as for DPA, this default flow is used to establish PPP and then the AT can serve as a modem to
support TCP/IP web surfing. But when other applications at the AT want the modem to support real-time
RTP/UDP/IP traffic and give that traffic priority over the best effort TCP/IP traffic, the applications will
request additional IP flows with particular QoS treatment. The Multi-Flow Packet Application provides
multiple octet streams that can be used to carry octets between the AT and the Access Network (AN). Each
octet stream is carried by an RLP flow, and RLP packets are tagged with an RLPID that identifies the RLP
flow. So Multi-Flow Packet Application provides a mechanism to define multiple application data flows
which can be assigned priorities and associated with QoS profiles.
IP - RLP - RTCMAC Flow Mapping
Application Initiation Steps

RLP Information
Anritsu eHRPD Logs
eHRPD Architectural Reference Model
Standalone eHRPD Network Architecture
(3GPP2 Elements)
eHRPDNew 3GPP2 Elements
HSGW
AN (EV-DO) and eAN(Standalone eHRPD)
Interworking
eHRPD with LTE Interworking
eHRPD and LTE Interworking with added Interfaces for
Optimized Handoff
Attach Procedure Overview(HRPD
and eHRPD)
Attach Procedure Call Flow when on eHRPD
Session Setup
eHRPD Session Setup Call Flow
Session Authentication in eHRPD
eHRPD Session Authentication Call
Flow
Link Layer Negotiation
PPP LCP Negotiation Call Flow
PPP Link Control Protocol (LCP)
Negotiation
Service Level Authentication
Service Level Authentication in
eHRPD
EAP AKA Authentication
EAP-AKA Authentication Call Flow
IP Address Allocation
PDN Establishment and IP Address
Allocation
IP Address Allocation Call Flow
Vendor Specific Network Control
Protocol (VSNCP)
VSNCPConfigure-Request
How is the UE made aware of the
APNs
PMIP Binding Update Call Flow
P-GW Selection and HSSUpdate
VSNCP Configuration Completion
Call Flow
VSNCP Cofiguration-ACK
VSNCP Configuration-Reject
 VSNCP Terminate-
Request/Terminate-Ack
QOS Establishment
QoS Bearer Establishment in
eHRPD
UE Initiated Dedicated Bearer
Procedures in eHRPD
UE Initiated and Network Initiated
QoS
Attach Procedure when UE is in E-
UTRAN
eHRPD Pre-Registration Call Flow
in LTE
Call Processing and Attach
Procedures
eHRPD Specifications and References
Key Air Interface Changes to support eHRPD
What is a EV-DO Session?
What is aeHRPDSession?
eHRPD Session Negotiation Essentials and Assumptions
Application Subtype
Stream Binding:
EMFPA FLOW
EHRPD Session Negotiation Scenarios
SIB 8
PRE REGISTRATION
Pre Registration Zone IDS
Typical EV-DO Session Negotiation Processes
Typical EV-DO Session Negotiation Processes
The EV-DO Session Negotiation, specifically eHRPD personality
negotiation for multimode UE(capable of LTE &eHRPD), depends on the
following OTA parameters in the System Information Block Type 8
(SIB8) messagebroadcast over the E-UTRAN network.
PreRegistrationAllowed: TRUE indicates that a UE shall perform an
EV-DO pre-registration if the UE does not have a valid current pre-
registration. FALSE indicates that the UE is not allowed to perform EV-
DO preregistration in the current cell.
PreRegistrationZoneID: Used to control when the UE should pre-
register. This is the ColorCode of the underlying EV-DO system.
SecondaryPreRegistrationZoneIDList: Used to control when the UE
should pre-register. This is the SecondaryColorCodeof the underlying
EV-DO system.
Typical EV-DO Session Negotiation Processes
Mobility from E-UTRAN to eAN CoverageRegion
New Protocols for eHRPD
Inter-RAT Signaling Adaptation Protocol
Illustration of Tunneled eHRPD Data Path
Inter-RAT Initialization State Protocol
Inter-RAT Idle State Protocol
Inter-RAT Route Update Protocol
Inter-RAT Overhead Messages Protocol
Changes to Existing HRPD Protocols
Changes to Default Session Management
Protocol
Changes to Default Session Management Protocol
Changes to default overhead messages protocol
Changes to RTCMAC subType 3 and physical
Layer
Illustration of Connection Setup for Inter-RAT
Tunneled Mode