Scot baxtor cdma

5,160 views

Published on

0 Comments
4 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
5,160
On SlideShare
0
From Embeds
0
Number of Embeds
6
Actions
Shares
0
Downloads
296
Comments
0
Likes
4
Embeds 0
No embeds

No notes for slide

Scot baxtor cdma

  1. 1. Course RF200 Wireless CDMA RF Wireless CDMA RF Performance Optimization Performance OptimizationNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 1
  2. 2. Contents Chapter Slide #1. Introduction 12. Foundation Topics Layer-3 Messaging 9 Call Processing 14 Performance Indicators and Problem Signatures 95 PN Planning and Search Windows 1162. Analyzing System Performance 138 System Data and Analysis Techniques 1413. Mobile Field Tools and Data Analysis 191 Autonomous Mobile Data Collection 196 Conventional Field Data Collection Tools 2014. Multiple Carrier Systems: Operating Principles and Analysis 2625. Applied Optimization 2926. 1xRTT Optimization Issues 334Appendix I. Cell Loading Example 405Appendix II. CDMA/3g1x Books, Publications, Web Resources 419November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 2
  3. 3. Course RF200 Introduction to Performance Introduction to Performance Optimization OptimizationNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 3
  4. 4. Welcome to Course RF200 Course RF100 is an introduction to RF and CDMA principles. After completing it, you should be familiar with: • General RF system design principles • CDMA technology - principles, channels, network basics • key fundamentals of Messaging and Call Processing Course RF200 covers how to recognize and deal with system performance problems • key performance indicators and what they mean • what tools are available for discovering and analyzing problems • mechanisms and situations that cause trouble • how to solve many of the problems you’ll seeNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 4
  5. 5. Good Performance is so Simple!! One, Two, or Three good signals in handoffBTS BTS • Composite Ec/Io > -10 db Enough capacity • No resource problems – I’ve got what IBTS need Ec/Io BTS A BTS B BTS C -10 available FORWARD power Traffic LINK Channels In use Paging Sync Pilot November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 5
  6. 6. Bad Performance Pilot PollutionBTS BTS Weak Signal Scarce Resources available power • BTS forward power TrafficBTS Channels • BTS receive power In use BTS Rx Pwr Paging • channel elements Sync Pilot • packet pipes Poor System Statistics • High Dropped Calls • High Access Failures Percent Total Drop Call Percentage 5.0% 4.5% %Drops 4.0% 3.5% 3.0% 2.5% 2.0% 1.5% 1.0% 0.5% 0.0% Date November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 6
  7. 7. What is Performance Optimization? The words “performance optimization” mean different things to different people, viewed from the perspective of their own jobs System Performance Optimization includes many different smaller processes at many points during a system’s life • recognizing and resolving system-design-related issues (can’t build a crucial site, too much overlap/soft handoff, coverage holes, etc.) • “cluster testing” and “cell integration” to ensure that new base station hardware works and that call processing is normal • “fine-tuning” system parameters to wring out the best possible call performance • identifying causes of specific problems and customer complaints, and fixing them • carefully watching system traffic growth and the problems it causes - implementing short-term fixes to ease “hot spots”, and recognizing problems before they become criticalNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 7
  8. 8. Performance Optimization Phases/Activities Phase Drivers/Objectives Activities Main Tools Success Indicators Cover desired area; Plan cells to effectively cover Prop. Models,RF Design and have capacity for as needed and divide traffic Test Transmitters, Model resultsCell Planning anticipated traffic load appropriately planning tools New Cluster Ensure cells properly Drive-test: coverage, all Drive-test tools; All handoffs occur; constructed and Testing and handoff boundaries, all call cell diagnostics and all test cases configured to giveCell Integration events and scenarios hardware test verified normal performanceSolve Specific Identify problems Drive-test tools, Identified Detect, Investigate, Resolve Performance from complaints or system stats, problems are performance problems Problems statistics; fix them! customer reports resolved Well-System Ensure present ‘plant’ Watch stats: Drops, Blocks, Acceptable levels Performance is giving best possible Access Failures; identify/fix hot System statistics and good trends Management performance spots for all indicators Manage congested Watch capacity indicators; Smart optimization Stats-Derived Capacity areas for most identify problem areas, tune of parameters; indicators; carried Optimization effective performance parameters & configuration system statistics traffic levels Sectors are Growth expanded soon hello Management: Overall traffic increases and Predict sector and area Traffic analysis and trending tools; after first signs ofOptimizing both exhaustion: plan and validate congestion; congestion; prop. models for Performance effective growth plan, avoid capital budget competition for capital cell spliiting; carrier and Capital integration impact remains within during tight times additions Effectiveness comfortable bounds November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 8
  9. 9. Course RF200 CDMA2000 Layer 3 Messages CDMA2000 Layer 3 MessagesNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 9
  10. 10. Messages in CDMA In CDMA, most call processing events are driven by messages Some CDMA channels exist for the sole purpose of carrying messages; they never carry user’s voice traffic • Sync Channel (a forward channel) • Paging Channel (a forward channel) • Access Channel (a reverse channel) • Forward or Reverse Dedicated Control Channels • On these channels, there are only messages, not voice or data Some CDMA channels exist just to carry user traffic • Forward Fundamental and Supplemental Channels • Reverse Fundamental and Supplemental Channels • On these channels, most of the time is filled with traffic and messages are sent only when there is something to do All CDMA messages have very similar structure, regardless of the channel on which they are sentNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 10
  11. 11. The Basic Format of CDMA Messages EXAMPLE:CDMA messages on both forward A POWER MEASUREMENTand reverse traffic channels arenormally sent via dim-and-burst REPORT MESSAGEMessages include many fields of Field Lengthbinary data (in bits)The first byte of each message MSG_TYPE (‘00000110’) 8identifies message type: this allows ACK_SEQ 3the recipient to parse the contents MSG_SEQ 3To ensure no messages are ACK_REQ 1missed, all CDMA messages bearserial numbers and important ENCRYPTION 2messages contain a bit requesting ERRORS_DETECTED 5acknowledgment POWER_MEAS_FRAMES 10Messages not promptlyacknowledged are retransmitted LAST_HDM_SEQ 2several times. If not acknowledged, NUM_PILOTS 4the sender may release the call NUM_PILOTS occurrences of this field:Field data processing tools captureand display the messages for study PILOT_STRENGTH 6 t RESERVED (‘0’s) 0-7November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 11
  12. 12. Message Vocabulary: Acquisition & Idle States Pilot Channel Sync Channel No Messages Sync Channel Msg Access Channel Paging Channel BTS Registration Msg Access Parameters Msg General Page Msg Order Msg System Parameters Msg Order Msg • Mobile Station Acknowldgment •Base Station Acknowledgment •Lock until Power-Cycled • Long Code Transition Request • Maintenance required • SSD Update Confirmation CDMA Channel List Msg many others….. many others….. Extended System Channel Assignment Origination Msg Parameters Msg Msg Extended Neighbor Page Response Msg List Msg Feature Notification Msg Authentication Challenge Global Service Authentication Response Msg Redirection Msg Challenge Msg Status Response Msg Service Redirection Msg Status Request Msg TMSI Assignment SSD Update Msg TMSI Assignment Msg Completion Message Data Burst Msg Null Msg Data Burst Msg November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 12
  13. 13. Message Vocabulary: Conversation State Forward Traffic Channel Order Msg Alert With Reverse Traffic Channel• Base Station Acknowledgment Information Msg • Base Station Challenge Confirmation Service Request Msg Service Request Msg Origination • Message Encryption Mode Continuation Msg Authentication Service Response Msg Service Response Msg Authentication Challenge Challenge Msg Response Msg TMSI Assignment Msg Service Connect Msg Service Connect TMSI Assignment Completion Message Completion Message Send Burst DTMF Msg Service Option Service Option Control Send Burst DTMF Msg Control Msg Message Set Parameters Msg Status Request Msg Status Response Msg Parameters Response Message Power Control Flash With Flash With Power Measurement Parameters Msg. Information Msg Information Msg Report MsgRetrieve Parameters Msg Data Burst Msg Data Burst Message Order Message • Mobile Sta. Acknowledgment Analog Handoff Extended Handoff Pilot Strength •Long Code Transition Direction Msg Direction Msg Measurement Msg Request • SSD Update Confirmation SSD Update Msg Neighbor List Handoff Completion Msg • Connect Update Msg Mobile Station In-Traffic System Registered Msg Parameters Msg November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 13
  14. 14. Course RF200 CDMA Call Processing Basics CDMA Call Processing BasicsNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 14
  15. 15. Troubleshooting Call Processing CDMA call processing is complex! • Calls are a relationship between mobile and system – the events driven by messaging – the channels supported by RF transmission • Multiple codes and channels available for use • Multiple possible problems - physical, configuration, software • Multiple concurrent processes in the mobile and the system Troubleshooting focuses on the desired call events • What is the desired sequence of events? • Compare the actual sequence of events. – What’s missing or wrong? Why did it happen? Messaging is a major blow-by-blow troubleshooting tool RF indications reveal the transmission risks and the channel configurationsBottom Line: To troubleshoot effectively, you’ve got to know call processing steps and details AND the RF basis of the transmissionNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 15
  16. 16. Course RF200 Lets Acquire The System! Lets Acquire The System!November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 16
  17. 17. What’s In a Handset? How does it work? Digital Rake Receiver Symbols Chips Traffic Correlator summing PN xxx Walsh xx bits Traffic Correlator PN xxx Walsh xx Σ Symbols control Receiver Traffic Correlator ∆t Viterbi Decoder, time-aligned RF Section Convl. Decoder, PN xxx Walsh xx Demultiplexer powerIF, Detector Traffic Correlator Packets AGC PN xxx Walsh xx RF Audio Open Loop MessagesDuplexer Pilot Searcher CPU Vocoder PN xxx Walsh 0 RF Transmit Gain Adjust Audio Messages Transmitter Transmitter Digital Section RF Section Long Code Gen.November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 17
  18. 18. The Task of Finding the Right System Reverse Link Frequencies Forward Link Frequencies (Mobile Transmit) (Base Station Transmit) 800 MHz. Cellular Spectrum824 MHz. 835 845 849 870 880 890 894 A B Paging, ESMR, etc. A B 825 846.5 869 891.5 1900 MHz. PCS Spectrum unlic. unlic. A D B E F C data voice A D B E F C1850MHz. 1910MHz. 1930MHz. 1990 MHz. FREQUENCY LISTS:Mobile scans forward link frequencies: HISTORY PREFERRED (Cellular or PCS, depending on model) LIST/MRU ROAMING History List (MRU) LIST/PRL Last-used: Preferred Roaming List (PRL) Freq System1 Freq System2 until a CDMA signal is found. Freq System3 Use PRL to find best signal in area. Freq System4 Freq System5 NO CDMA? Try AMPS. No AMPS? Standby etc. etc. November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 18
  19. 19. The System Determination AlgorithmAt turnon, Idle mobiles use proprietary System Determination Algorithms(SDA) to find the initial CDMA carrier intended for them to useThe mobile finally acquires a CDMA signal and reads the Sync channel • Find the SID & NID in the PRL (Preferred Roaming List) • Check: is there a more-preferred system in the PRL? What Freq(s)? • Go look for the better system Start Preferred MRU Only Bit 0 PRL Acq Idx Yes Go to last Strongest Is better Is SID frequency PN, read SID permitted? from MRU Sync available? No Signal No Denied SID Read Last Resort: Paging Best System Found! GEO escape Channel Begin Normal Paging Channel Operation Or Analog Legend Steps from Steps from Proprietary Typical Mobile the CDMA proprietary SDA standards SDAs databases System Determination Algorithm November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 19
  20. 20. 1xRTT Acquisition On the Current Frequency: Find Strongest Pilot, Read Sync Channel All PN Offsets 0 Ec/Io 1. Pilot Searcher Scans the Entire Range of PNs -20 Chips 0 32K PN 0 512 SYNC CHANNEL MESSAGE 2. Put Rake finger(s) on strongest MSG_LENGTH, 28, 28 octets MSG_TYPE, 1, Sync Channel Message available PN, decode Walsh 32, P_REV, 6, IS-2000 Revision 0 MIN_P_REV, 1, J-STD-008 and read Sync Channel Message SID 995, Is this the right system to use? NID 3, PILOT_PN 240 Check the PRL! Active Pilot LC_STATE, 0x00 25 93 12 7C FA, SYS_TIME, 0x02 20 34 B7 53, 10/23/2001 11:02:54Handset Rake Receiver Rake Fingers LP_SEC, 13, LTM_OFF, 54, -660 minutes F1 PN168 W32 DAYLT, 1, Yes F2 PN168 W32 PRAT, 1, 4800 bps RF CDMA_FREQ, 274 (IS-95) ≈ x ≈ F3 PN168 W32 EXT_CDMA_FREQ, 274 (1xRTT) LO Srch PN??? W0 SR1_BCCH_SUPPORTED, 0 SR3_INCL, 0, No Reference PN RESERVED, 0, November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 20
  21. 21. PRL Database Guides System Determination Handsets can be programmed with their Preferred Only bit set to True or TRUE False. If True, the handset can only used preferred systems. If False, the Preferred Only Bit FALSE handset can use non-preferred systems, but will prefer preferred systems when available. Acquisition Index There are 29 Acq Indexes in the current PRL. It is normal for some to contain duplicate channels. 0 CDMA channels 350,400 1 CDMA channels 50, 100 2 Analog Block A When the phone Every three minutes idle 3 Analog Block B loses service, it phones rescan for any more- scans the list of preferred signals in the current channels in its Geo Group. This is called current GEO group. “climbing the GEO group”. System Records SID NID PREF GEO Priority Index Roam Indicator 4139 65535 Pref New More 0 Off 59 65535 Pref Same More 2 On 52 65535 Pref Same More 3 Flash Some records are merely analog “Guideposts” to allow the phone to 67 65535 Neg Same Same 3 Short-short-long recognize where it is and position into the 4412 65535 Pref New More 1 Off proper GEO group “GEO confinement”. : : : : : : : 61737 226 Neg New More 0 Off The last system record is not a real system. It merely contains the version65535 is a “wildcard” NID. Preferred “more” number of the PRl and is used by someThe phone is to accept any than the following phones to allow displaying the version.NID it sees on this system. record.November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 21
  22. 22. November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 22
  23. 23. Climbing the GEO Group SYSTEM TABLE ACQUISITION TABLE ROAMING LIST NEG/ ACQ ROAM INDEX ACQ TYPE CH1 CH2 CH3 CH4 CH5 CH6 CH7 CH8 CH9 0 6 500 425 825 575 850 325 625 INDEX SID NID PREF GEO PRI INDEX IND 1 6 575 625 500 425 Roaming List Type: IS-683A 2 6 50 100 75 475 825 850 175 250 296 4144 65535 Pref NEW SAME 13 1 Preferred Only: FALSE 297 4812 65535 Pref SAME MORE 21 1 3 6 25 200 350 375 725 50 475 175 250 a GEO GROUP 4 1 Both Default Roaming Indicator: 0 298 205 65535 Pref SAME SAME 4 0 5 6 450 500 350 575 650 Climb! 299 208 65535 Pref SAME MORE 37 0 6 6 675 500 600 575 475 Preferred List ID: 10018 7 6 250 50 175 300 208 65535 Pref SAME SAME 4 0 8 6 550 375 425 625 301 342 65535 Pref SAME MORE 37 0 9 6 75 50 175 250 302 342 65535 Pref SAME SAME 4 0 10 6 200 250 175 50When traveling the first signal 11 6 425 500 575 25 325 650 303 478 65535 Pref SAME SAME 4 0 12 6 500 575 475 25 675 304 1038 65535 Pref SAME SAME 4 0 13 6 500 625 350 50 375 775 575 725 425found is usually not the best 305 306 1050 1058 65535 Pref 65535 Pref SAME SAME SAME SAME 4 4 0 0 14 15 16 6 6 6 650 25 425 500 50 550 675 375 225 25 350 725 75 250 750 425 50 575 175 775one to use 307 308 1375 1385 65535 Pref 65535 Pref SAME SAME SAME MORE 4 4 0 0 17 18 6 6 200 825 50 850 175 925 375 250 19 6 350 325 375 675 25 1175 725 600 100 309 143 65535 Pref SAME MORE 37 0When the SID and NID are 310 143 65535 Pref SAME MORE 4 0 20 21 22 6 6 6 750 325 1150 725 725 1175 775 350 750 375 775 425 575 625looked up in the PRL, they 311 312 4103 4157 65535 Pref 65535 Pref NEW SAME SAME MORE 3 2 1 1 23 24 6 6 350 25 875 1175 325 825 375 1175 200 75 175 250are far down the list of 313 312 65535 Pref SAME SAME 4 0 25 6 50 200 25 100 250 75 a GEO GROUP 26 6 500 1075 850 825 314 444 65535 Pref SAME MORE 37 0 27 1 Aavailable choices 315 316 444 1008 65535 Pref 65535 Pref SAME SAME SAME SAME 4 4 0 0 28 29 30 1 5 5 B A B 317 1012 65535 Pref SAME SAME 4 0The starts at the top of the 31 5 C 318 1014 65535 Pref SAME SAME 4 0 32 5 D 33 5 E 319 1688 65535 Pref SAME MORE 4 0GEO group and works down 320 321 113 113 65535 Pref 65535 Pref SAME SAME MORE 37 SAME 4 0 0 34 35 36 5 4 4 F A Bto the first (most preferred) 322 179 65535 Pref SAME MORE 37 0 37 38 4 6 Both 350 825system it can find 323 324 179 465 65535 Pref 65535 Pref SAME SAME SAME SAME 4 4 0 0 39 40 41 6 6 6 25 675 850 100 600 750 850 1175 775 325 2119 65535 Pref SAME MORE 4 0 42 6 650 • the Acquisition Table is 326 327 2094 1005 65535 Pref 65535 Pref SAME SAME MORE SAME 4 4 0 0 43 44 6 6 450 325 475 350 375 1025 1050 1075 the list of frequencies 328 1013 65535 Pref SAME SAME 4 0 45 46 6 6 150 1025 475 625 675 1050 1075 used by the various PRL: Preferred Roaming List systems, so the mobile Programmed into each phone by the system knows where to search operator; can be updated over the air.November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 23
  24. 24. Found it! Now we’re on the Right System All PN Offsets 0 Ec/Io 1. Pilot Searcher Scans the Entire Range of PNs -20 Chips 0 32K PN 0 512 SYNC CHANNEL MESSAGE 2. Put Rake finger(s) on strongest 98/05/24 23:14:09.817 [SCH] available PN, decode Walsh 32, MSG_LENGTH = 208 bits MSG_TYPE = Sync Channel Message and read Sync Channel Message P_REV = 3 MIN_P_REV = 2 If PRL shows: Go to the SID = 179 This is the Best Paging Active Pilot NID = 0 Available System! Channel! PILOT_PN = 168 Rake Fingers Offset IndexHandset Rake Receiver LC_STATE = 0x0348D60E013 F1 PN168 W32 SYS_TIME = 98/05/24 23:14:10.160 LP_SEC = 12 F2 PN168 W32 RF LTM_OFF = -300 minutes ≈ x ≈ F3 PN168 W32 DAYLT = 0 LO Srch PN??? W0 PRAT = 9600 bps Ref. RESERVED = 1 PN November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 24
  25. 25. Course RF200 After finding the right system: After finding the right system: Normal Paging Channel Operation Normal Paging Channel OperationNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 25
  26. 26. The Configuration Messages After reading the Sync Channel, the mobile is now capable of reading the Paging Channel, which it now monitors constantly Before it is allowed to transmit or operate on this system, the mobile must collect a complete set of configuration messages In IS-95, the configuration messages are sent on the Paging Channel, repeated every 1.28 seconds In CDMA2000 systems, the configuration messages may be sent on the separate F-BCH channel • This would be indicated as SR1_BCCH_SUPPORTED = 1 There are six possible types of configuration messages; some are optional; and they may happen in any order The configuration messages contain sequence numbers so the mobile can recognize if any of the messages have been freshly updated as it continues to monitor the paging channel • Access parameters message sequence number • Configuration message sequence number • If a mobile notices a changed sequence number, or if 600 seconds passes since the last time these messages were read, the mobile reads all of them againNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 26
  27. 27. Reading the Configuration Messages All PN Offsets 0 Ec/Io -20 Chips 0 32K PN 0 Read the 512 Configuration Messages Access Parameters Msg Keep Rake finger(s) on strongest available PN, monitor Walsh 1, System Parameters Msg the Paging Channel CDMA Channel List Msg Active Pilot Extended System Parameters Msg (*opt.)Handset Rake Receiver Rake Fingers (Extended*) Neighbor List Msg F1 PN168 W01 Global Service F2 PN168 W01 RF Redirection Msg (*opt.) ≈ x ≈ F3 PN168 W01 LO Srch PN??? W0 Now we’re ready to operate!! Reference PN November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 27
  28. 28. 1xRTT Access Parameters Message ACCESS PARAMETERS MESSAGE Basic Access Procedure 000035, Time 15:28:37.709, Record 6408, QcpCdmaLogMsgPagingChan Any Access Msg PD: P_REV_IN_USE < 6 MSG_TYPE: Access Parameters Message Success! PILOT_PN: 36 ACC_MSG_SEQ: 2 BTS MS ACC_CHAN: 1 Access Channel(s) Probing NOM_PWR: 3 dB INIT_PWR: -13 dB an Access Probe a Probe Sequence PWR_STEP: 5 dB NUM_STEP: 4 Probe(s) an Access Attempt MAX_CAP_SZ: 6 ACH Frames PAM_SZ: 3 ACH Frame(s) PSIST(0-9): 0 The Access Parameters message PSIST(10): 0 PSIST(11): 0 controls all the steps mobiles must PSIST(12): 0 perform when they transmit on the PSIST(13): 0 Access Channel PSIST(14): 0 PSIST(15): 0 Mobiles perform a trial-and-error MSG_PSIST: 1.00 process called “Probing” to get their REG_PSIST: 1.00 PROBE_PN_RAN: 0 PN chip(s) messages through ACC_TMO: 240 ms PROBE_BKOFF: 1 Slot(s) BKOFF: 1 Slot(s) MAX_REQ_SEQ: 3 MAX_RSP_SEQ: 3 AUTH_MODE: 0 NOM_PWR_EXT: -8 to 7 dB inclusive PSIST_EMG_INCL: No RESERVED: 0November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 28
  29. 29. Phone Operation on the Access Channel Successful Basic Access AttemptA sector’s Paging Channel announces 1(typ) to 32 (max) Access Channels: PN Origination Msg ACCESSLong Code offsets for mobiles to use if Success!accessing the system. BTS MS • For mobiles sending Registration, Probing Origination, Page Responses an Access Probe • Base Station always listening! a Probe Sequence an Access AttemptOn the access channel, phones are notyet under BTS closed-loop power control! PAGING Base Sta. Acknlgmt. OrderPhones access the BTS by “probing” at FW TFC TFC frames of 000spower levels determined by receive powerand an open loop formula PAGING Channel Assnmt. Msg. • If “probe” not acknowledged by BTS within ACC_TMO (~400 mS.), phone TFC preamble of 000s RV TFC will wait a random time (~200 mS) FW FC Base Sta. Acknlgmt. Order then probe again, stronger by PI db. • There can be 15 max. (typ. 5) probes Mobile Sta. Ackngmt. Order RV TFC in a sequence and 15 max. (typ. 2) sequences in an access attempt FW TFC Service Connect Msg. • most attempts succeed on first probe! Svc. Connect Complete Msg RV TFCThe Access Parameters message on thepaging channel announces values of all FW TFC Base Sta. Acknlgmt. Orderrelated parameters Call is Established!November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 29
  30. 30. 1xRTT System Parameters Message SYSTEM PARAMETERS MESSAGE 000029, Time 15:28:37.607, Record 6330, QcpCdmaLogMsgPagingChan PD: P_REV_IN_USE < 6 MSG_TYPE: System Parameters Message PILOT_PN: 36 CONFIG_MSG_SEQ: 1 SID: 4379 NID: 15 REG_ZONE: 6 TOTAL_ZONES: 3 ZONE_TIMER: 1 min MULT_SIDS: No MULT_NIDS: No BASE_ID: 2155 BASE_CLASS: Public PCS System # Paging Channels, Slotted Mode period PAGE_CHAN: 1 MAX_SLOT_CYCLE_INDEX: 1 HOME_REG: Yes FOR_SID_REG: Yes FOR_NID_REG: Yes POWER_UP_REG: Yes POWER_DOWN_REG: Yes Who Registers? PARAMETER_REG: No REG_PRD: 30.89 min Why & When? BASE_LAT: 37D1835.00N BASE_LONG: 079D1519.00W REG_DIST: 0 SRCH_WIN_A: 60 chips Search Window SRCH_WIN_N: 60 chips SRCH_WIN_R: 80 chips NGHBR_MAX_AGE: 0 Widths PWR_REP_THRESH: 2 Bad Frame(s) PWR_REP_FRAMES: 113 frame(s) PWR_THRESH_ENABLE: Yes Handoff Thresholds PWR_PERIOD_ENABLE: No PWR_REP_DELAY: 4 frames RESCAN: No T_ADD: -14.0 dB T_DROP: -16.0 dB T_COMP: 4.0 T_TDROP: 4 sec EXT_SYS_PARAMETER: Yes EXT_NGHBR_LIST: Yes GEN_NGHBR_LIST: No GLOBAL_REDIRECT: Yes PRI_NGHBR_LIST: No USER_ZONE_ID: No What other optional EXT_GLOBAL_REDIRECT: No EXT_CHAN_LIST: Yes configuration messages RESERVED: 0 exist?November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 30
  31. 31. 1xRTT Extended System Parameters Message EXTENDED SYSTEM PARAMETERS 000021, Time 15:28:37.421, Record 6188, QcpCdmaLogMsgPagingChan PD: P_REV_IN_USE < 6 One main job of this message is to MSG_TYPE: Extended System Parameters Message tell mobiles how to report their PILOT_PN: 36 CONFIG_MSG_SEQ: 1 identities when they transmit on the DELETE_FOR_TMSI: No Access Channel USE_TMSI: No PREF_MSID_TYPE: IMSI and ESN • IMSI - International Mobile MCC: 1134 IMSI_11_12: 813 Subscriber Identity TMSI_ZONE_LEN: 1 octet TMSI_ZONE: 0 – The “world” phone number BCAST_INDEX: Disable Periodic Broadcast Paging of the mobile IMSI_T_SUPPORTED: No P_REV: IS-2000 Revision 0 • ESN - Electronic Serial Number MIN_P_REV: J-STD-008 SOFT_SLOPE: 18 Different Networks may request ADD_INTERCEPT: 6 dB different identification modes; the DROP_INTERCEPT: 6 dB PACKET_ZONE_ID: Base Station Does Not Support A phones simply comply Packet Data Service Zone MAX_NUM_ALT_SO: 0 • IMSI and ESN RESELECT_INCLUDED: No PILOT_REPORT: No • IMSI only NGHBR_SET_ENTRY_INFO: No NGHBR_SET_ACCESS_INFO: No • ESN only BROADCAST_GPS_ASST: No QPCH_SUPPORTED: No Intelligent soft handoff parameters SDB_SUPPORTED: No are also included RLGAIN_TRAFFIC_PILOT: 0.000000 dB REV_PWR_CNTL_DELAY_INCL: No AUTO_MSG_SUPPORTED: No RESERVED: 0November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 31
  32. 32. The Neighbor List Message EXTENDED NEIGHBOR LIST The Neighbor List Message gives the 000017, Time 15:28:37.381, Record 6158, mobile up to 20 PN offsets of sectors it QcpCdmaLogMsgPagingChan may soon need in handoff PD: P_REV_IN_USE < 6 MSG_TYPE: Extended Neighbor List Message • This enables the mobile to search PILOT_PN: 36 CONFIG_MSG_SEQ: 1 smarter and faster PILOT_INC: 4 NGHBR_CONFIG: 0, NGHBR_PN: 32 On the paging channel, Enhanced or SEARCH_PRIORITY: Very High, FREQ_INCL: No Extended neighbor lists may also include NGHBR_CONFIG: 0 NGHBR_PN: 28 SEARCH_PRIORITY: Very High FREQ_INCL: No neighbors on different frequencies NGHBR_CONFIG: 0 NGHBR_PN: 308 SEARCH_PRIORITY: Very High FREQ_INCL: No • Slotted mode mobiles can jump to NGHBR_CONFIG: 0 NGHBR_PN: 432 other frequencies in their “sleep” SEARCH_PRIORITY: Very High FREQ_INCL: No NGHBR_CONFIG: 0 NGHBR_PN: 20 time to check pilots SEARCH_PRIORITY: Very High FREQ_INCL: No NGHBR_CONFIG: 0 NGHBR_PN: 24 • This is useful at system boundaries SEARCH_PRIORITY: Very High FREQ_INCL: No NGHBR_CONFIG: 0 NGHBR_PN: 260 During a call, a mobile first uses the SEARCH_PRIORITY: Very High FREQ_INCL: No neighbor list remembered from idle mode NGHBR_CONFIG: 0 NGHBR_PN: 196 SEARCH_PRIORITY: Very High FREQ_INCL: No • After each handoff, a new Neighbor NGHBR_CONFIG: 0 NGHBR_PN: 392 List Update message is sent to the SEARCH_PRIORITY: Very High FREQ_INCL: No NGHBR_CONFIG: 0 NGHBR_PN: 312 mobile on the Forward Traffic SEARCH_PRIORITY: Very High FREQ_INCL: No Channel NGHBR_CONFIG: 0 NGHBR_PN: 316 SEARCH_PRIORITY: Very High FREQ_INCL: No Each neighbor list received by the mobile RESERVED: 0 overwrites and replaces the previous neighbor listNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 32
  33. 33. The CDMA Channel List Message EXTENDED CDMA CHANNEL LIST MESSAGE If a mobile sees a CDMA 000005, Time 15:28:37.056, Record 5910, Channel List Message, it notices QcpCdmaLogMsgPagingChan PD: P_REV_IN_USE < 6 the list of channels included in the MSG_TYPE: Extended CDMA Channel List Message message PILOT_PN: 36 CONFIG_MSG_SEQ: 1 • There may be one, two, NUM_FREQ: 1 CDMA_FREQ: 600 three, or more channels listed RC_QPCH_SEL_INCL: No TD_SEL_INCL: No The mobile immediately uses a RESERVED: 0 random selection process called “hashing” to select one of the listed channels • The outcome of hashing depends only on the mobile’s F3 F2 IMSI CDMA Ch HASH using F1 Fnow List Message IMSI • Both the system and the mobile know which carrier the mobile will choose The message also includes an indicator to show if the QPCH is in use, and for what radio configurationsNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 33
  34. 34. How Hashing Works If a mobile sees a CDMA Channel List Message, it notices the list of channels included in the message • There may be one, two, three, or more channels listed Whenever a phone encounters multiple announced resources, it uses its number (IMSI, International Mobile Subscriber Identity) and a randomized process called “hashing” to determine which resource it should use. This is how mobiles select: • Carrier Frequencies in idle mode • Preferred Paging Channel • Preferred Access Channel • Paging Time Slot in Slotted Mode Optimization personnel may wish to carry a phone for each carrier frequency, or use the multiple NAM capability of some handsets to operate on different numbers so as to prefer different frequenciesNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 34
  35. 35. Hashing Examples Try your own phone in the spreadsheet Hashing.xls (in utilities folder)Hashing Examples Time between active slots, seconds:v2. 1-28-2000 1.28 2.56 5.12 10.24 20.48 40.96 81.92 163.84 Number of Slots in Mobiles Cycle: 16 32 64 128 256 512 1024 2048 How Many How Many PagingKey in red-shaded Frequencies? Channels? Slot Cycle Index: values 2 1 0 1 2 3 4 5 6 7 10 Digit IMSI Use Freq. # Use PCH # Slot# Slot# Slot# Slot# Slot# Slot# Slot# Slot# 6153000124 1 1 15 31 63 127 127 383 895 895 6153000125 1 1 11 27 27 27 27 27 539 1563 6153000126 1 1 5 5 5 69 69 69 69 69 6153000127 1 1 3 3 3 67 195 451 451 1475 6153000128 2 1 8 24 24 24 152 152 152 1176 6153000129 2 1 9 25 25 25 25 25 25 25 6153000130 1 1 11 27 27 27 27 27 539 1563 6153000131 2 1 1 1 33 97 225 225 737 737 6153000132 1 1 8 8 40 40 40 40 552 552 6153000133 1 1 3 19 51 115 243 243 755 755 November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 35
  36. 36. The Global Service Redirection Message GLOBAL SERVICE REDIRECTION 000011, Time 15:28:37.118, Record 5957, QcpCdmaLogMsgPagingChan PD: P_REV_IN_USE < 6 The GSRM was originally MSG_TYPE: Global Service Redirection Message intended as a way to PILOT_PN: 36 CONFIG_MSG_SEQ: 1 solve system and REDIRECT_ACCOLC (ACCOLC_0): No multicarrier border REDIRECT_ACCOLC (ACCOLC_1): No REDIRECT_ACCOLC (ACCOLC_2): No problems REDIRECT_ACCOLC (ACCOLC_3): No REDIRECT_ACCOLC (ACCOLC_4): No • Outermost F2 cells REDIRECT_ACCOLC (ACCOLC_5): No REDIRECT_ACCOLC (ACCOLC_6): No transmit GSRM, REDIRECT_ACCOLC (ACCOLC_7): No REDIRECT_ACCOLC (ACCOLC_8): No sending distant F2 REDIRECT_ACCOLC (ACCOLC_9): No mobiles to F1 REDIRECT_ACCOLC (ACCOLC_10): No REDIRECT_ACCOLC (ACCOLC_11): No The GSRM can also be REDIRECT_ACCOLC (ACCOLC_12): No REDIRECT_ACCOLC (ACCOLC_13): No used to manually REDIRECT_ACCOLC (ACCOLC_14): No REDIRECT_ACCOLC (ACCOLC_15): No distribute idle mobiles to RETURN_IF_FAIL: No different frequencies DELETE_TMSI: No EXCL_P_REV_MS: No • A GSRM applies only RECORD_TYPE: Redirection to An Analog System RECORD_LEN: 3 octets to phones of Access EXPECTED_SID: 0 IGNORE_CDMA: No Overload Classes SYS_ORDERING: Attempt To Obtain Service On Either System A specified in the Or System B. If Unsuccessful, Attempt Alternate System MAX_REDIRECT_DELAY: 0 sec messageNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 36
  37. 37. Summary: How Idle Mobiles Choose CDMA CarriersAt turnon, Idle mobiles use proprietary System Determination Algorithms(SDA) to find the initial CDMA carrier intended for them to useOn the paging channel of the idle mobile’s newly-found home signal, themobile might be sent to a different frequency if it hears • CDMA Channel List Message • Global Service Redirection Message (GSRM) Start System Determination Algorithm Preferred MRU Only Bit 0 PRL Acq Idx Go to last Strongest Is better Yes Idle Mode Carrier Selection Is SID frequency PN, read SID permitted? from MRU Sync available? F3 No Signal Denied SID No CDMA Ch HASH using F2 Config List Message IMSI F1 Messages: Read remain Last Resort: Paging GEO escape Channel Global Svc my ACCOLC? Or Analog Redir Msg redirect to another CDMA frequency or system Legend to Analog Steps from Steps from Proprietary the CDMA proprietary SDA standards SDAs databases November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 37
  38. 38. Course RF200 Let’s Do An Idle Mode Let’s Do An Idle Mode Handoff! Handoff!November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 38
  39. 39. Idle Mode Handoff An idle mobile always demodulates the best available signal • In idle mode, it isn’t possible to do soft handoff and listen to multiple sectors or base stations at the same time -- the paging channel information stream is different on each sector, not synchronous -- just like ABC, NBC, CBS, and CNN TV news programs aren’t in word-sync for simultaneous viewing • Since a mobile can’t combine signals, the mobile must switch quickly, always enjoying the best available signal The mobile’s pilot searcher is constantly checking neighbor pilots If the searcher notices another signal at least 3 db better than the present one, and it remains so for 5 seconds, the mobile starts listening to it at the beginning of the next paging slot. • The mobile doesn’t automatically say anything to the system, so system doesn’t know about the idle mode handoff On the new paging channel, if the mobile learns that registration is required, it re-registers on the new sectorNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 39
  40. 40. Idle Mode on the Paging Channel: Meet the Neighbors, track the Strongest Pilot All PN Offsets 0 Ec/Io -20Chips 0 SRCH_WIN_A Mobile Rake RX 32K PN 0 F1 PN168 W01 512 Active Pilot F2 PN168 W01 Rake Fingers F3 PN168 W01 Srch PN??? W0 SRCH_WIN_N The phone’s pilot searcher constantly checks the pilots listed in the Neighbor List Message Reference PN Neighbor Set If the searcher ever notices a neighbor pilot substantially stronger than the current reference pilot, it becomes the new reference pilot and the phone switches over to its paging channel on the next superframe. This is called an idle mode handoff. November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 40
  41. 41. Course RF200 Let’s Register! Let’s Register!November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 41
  42. 42. Registration Registration is the process by which an idle mobile lets the system know it’s awake and available for incoming calls • this allows the system to inform the mobile’s home switch of the mobile’s current location, so that incoming calls can be delivered • registration also allows the system to intelligently page the mobile only in the area where the mobile is currently located, thereby eliminating useless congestion on the paging channels in other areas of the system There are many different conditions that could trigger an obligation for the mobile to register • there are flags in the System Parameters Message which tell the mobile when it must register on the current systemNovember, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 42
  43. 43. Registration Registration Message (by PROBING) BTS Base Station Acknowledgment OrderPaging AccessChannel Channel November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 43
  44. 44. An Actual 1xRTT Registration SYSTEM PARAMETERS MESSAGEIS-95 Message Type: System ParametersPN Offset: 44 CONFIG_MSG_SEQ 0 SID 1121 NID 1REG_ZONE: 0 TOTAL_ZONES: 0 Zone timer length (min): 1 The System Parameters Message tellsMULT_SIDS: 0 MULT_NIDS: 0BASE_ID: 5586 BASE_CLASS: Public Macrocellular System all mobiles when they should register.PAG_CHAN: 1 MAX_SLOT_CYCLE_INDEX: 2 This mobile notices that it is obligated toHOME_REG: 1 FOR_SID_REG: 1 FOR_NID_REG: 1,POWER_UP_REG: 1 POWER_DOWN_REG: 1 register, so it transmits a RegistrationPARAMETER_REG: 1 Registration period (sec): 1853.60Base station 0°00´00.00¨ Lon., 0°00´00.00° Lat. REG_DIST: 0 Message.SRCH_WIN_A: 20ch SRCH_WIN_N: 100ch SRCH_WIN_R: 320chNGHBR_MAX_AGE: 0 PWR_REP_THRESH: 2 REGISTRATION MESSAGEPWR_REP_FRAMES (frames): 905 PWR_THRESH_ENABLE: 1 IS-95 Message Type: RegistrationPWR_PERIOD_ENABLE: 0, PWR_REP_DELAY: 1 (0 frames) ACK_SEQ: 7 MSG_SEQ: 5 ACK_REQ: 1 VALID_ACK: 0Re-Init and Re-acquire After This Message?: No ESN (Electronic Serial Number):0xB38092BCT_ADD: -14dB T_DROP: -16dB T_COMP: 1 DB, T_TDROP: 4s IMSI Class: 0 IMSI Class 0 Type: IMSI_S onlySending Extended System Parameters Messages?: Yes IMSI_S: 694 582 9500Are Extended Neighbor List Messages Being Sent?: No Pilot Strength: -8.0 dBAre General Neighbor List Messages Being Sent?: No Active pilot is first one probed?: YesUsing Global Redirect Messages?: No Original pilot is same as pilot in previous probe?: NoAre Private Neighbor List Messages Being Sent?: No Number of additional pilots: 0Are User Zone ID Messages Being Sent?: No Registration Type: Timer-based Slot Cycle Index: 2Are Extended Global Redirection Messages Being Sent?: No Mobile Protocol Revision Level: 6Are Extended Channel List Messages Being Sent?: Yes Station Class Mark: Dual Mode, Slotted, Discontinuous Xmit, Power Class 3 Mobile-Terminated Calls Acceptable?: Yes BASE STATION ACKNOWLEDGMENT IS-95 Message Type: Order ACK_SEQ: 5 MSG_SEQ: 2 ACK_REQ: 0 VALID_ACK: 1 The base station confirms that the Address Type: IMSI IMSI Class: 0 mobile’s registration message was IMSI Class 0 Type: IMSI_S, IMSI_11_12, and MCC Mobile Country Code (MCC): 310 IMSI 11th+12th Digits: 00 received. We’re officially registered! IMSI_S: 694 582 9500 Order Message Type: Base ACK November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 44
  45. 45. Example 4 Let’s Receive an Incoming Let’s Receive an Incoming Call! Call!November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 45
  46. 46. Receiving an Incoming Call All idle mobiles monitor the paging channel to receive incoming calls. When an incoming call appears, the paging channel notifies the mobile in a General Page Message. A mobile which has been paged sends a Page Response Message on the access channel. The system sets up a traffic channel for the call, then notifies the mobile to use it with a Channel Assignment Message. The mobile and the base station notice each other’s traffic channel signals and confirm their presence by exchanging acknowledgment messages. The base station and the mobile negotiate what type of call this will be -- I.e., 13k voice, etc. The mobile is told to ring and given a “calling line ID” to display. When the human user presses the send button, the audio path is completed and the call proceeds.November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 46
  47. 47. Incoming Call Delivery Scenario General Page Message Page Response Message (by PROBING) BTS Base Station Acknowledgment OrderPaging Channel Assignment Message AccessChannel Channel Continuous frames of all 000’s Traffic Channel Preamble: Frames of 000’s Base Station Acknowledgment OrderForward Reverse Traffic TrafficChannel Mobile Station Acknowledgment Order Channel Service Connect Message Service Connect Complete Message The Call is now officially Established! November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 47
  48. 48. An Actual Page and Page Response GENERAL PAGE MESSAGE98/05/24 23:14:46.127 [PCH] General Page MessageMSG_LENGTH = 128 bits The system pages the mobile,MSG_TYPE = General Page Message 615-330-0644.CONFIG_MSG_SEQ = 1 ACC_MSG_SEQ = 20CLASS_0_DONE = 1CLASS_1_DONE = 1 RESERVED = 0 PAGE RESPONSE MESSAGEBROADCAST_DONE = 1 RESERVED = 0ADD_LENGTH = 0 bits ADD_PFIELD = Field Omitted 98/05/24 23:14:46.425 [ACH] Page Response MessagePAGE_CLASS = 0 PAGE_SUBCLASS = 0 MSG_LENGTH = 216 bitsMSG_SEQ = 1 MSG_TYPE = Page Response MessageIMSI_S = 6153300644 ACK_SEQ = 1 MSG_SEQ = 2 ACK_REQ = 1SPECIAL_SERVICE = 1 VALID_ACK = 1 ACK_TYPE = 2SERVICE_OPTION = 32768 MSID_TYPE = IMSI and ESN MSID_LEN = 9 octetsRESERVED = Field Omitted ESN = 0xD30E415C IMSI_CLASS = 0 IMSI_CLASS_0_TYPE = 0 RESERVED = 0 IMSI_S = 6153300644 AUTH_MODE = 1 The mobile responds to the page. AUTHR = 0x307B5 RANDC = 0xC6 COUNT = 0 MOB_TERM = 1 SLOT_CYCLE_INDEX = 0 MOB_P_REV = 3 SCM = 106BASE STATION ACKNOWLEDGMENT REQUEST_MODE = Either Wide Analog or CDMA Only SERVICE_OPTION = 32768 PM = 098/05/24 23:14:46.768 [PCH] Order Message NAR_AN_CAP = 0 RESERVED = 0MSG_LENGTH = 112 bitsMSG_TYPE = Order MessageACK_SEQ = 2 MSG_SEQ = 0 ACK_REQ = 0VALID_ACK = 1ADDR_TYPE = IMSI ADDR_LEN = 40 bitsIMSI_CLASS = 0 IMSI_CLASS_0_TYPE = 0 RESERVED = 0 The base station confirms that the mobile’sIMSI_S = 6153300644ORDER = Base Station Acknowledgement Order page response was received. Now theADD_RECORD_LEN = 0 bits mobile is waiting for channel assignment,Order-Specific Fields = Field Omitted RESERVED = 0 expecting a response within 12 seconds. November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 48
  49. 49. Channel Assignment and Traffic Channel Confirmation CHANNEL ASSIGNMENT MESSAGE18:14:47.027 Paging Channel: Channel Assignment Only about 400 ms. after the base stationACK_SEQ: 2 MSG_SEQ: 1 ACK_REQ: 0 VALID_ACK: 1MSID_TYPE: 2 IMSI: (Class: 0, Class_0_type: 0) acknowledgment order, the mobile receives[0x 01 f8 39 6a 15] 615-330-0644ASSIGN_MODE: Traffic Channel Assignment the channel assignment message.ADD_RECORD_LEN: 5 FREQ_INCL: 1 GRANTED_MODE: 2CODE_CHAN: 43 FRAME_OFFSET: 2ENCRYPT_MODE: Encryption disabledBAND_CLASS: 800 MHz cellular bandCDMA_FREQ: 283 The mobile sees at least twoThe base station is already good blank frames in a row on sending blank frames on the forward channel, andthe forward channel,using concludes this is the right trafficthe assigned Walsh code. channel. It sends a preamble of two blank frames of its own on the reverse traffic channel.BASE STATION ACKNOWLEDGMENT MOBILE STATION ACKNOWLEDGMENT18:14:47.581 Forward Traffic Channel: OrderACK_SEQ: 7 MSG_SEQ: 0 ACK_REQ: 1 18:14:47.598 Reverse Traffic Channel: OrderENCRYPTION: 0 USE_TIME: 0 ACTION_TIME: 0 ACK_SEQ: 0 MSG_SEQ: 0 ACK_REQ: 0Base Station Acknowledgement Order ENCRYPTION: 0 Mobile Station Acknowledgement Order The base station acknowledges The mobile station acknowledges the receiving the mobile’s preamble. base station’s acknowledgment. Everybody is ready! November, 2004 RF200 v4.0 (c) 2004 Scott Baxter RF200 - 49

×