Guide to CDMA MS Behavior Analysis-20021227-A-1.0

Document No. Product Name CDMA 2000Document Users Internal Use Product Version

Written byCDMA 2000 Network Planning Department

Document Version 1.0

Guide to CDMA MS Behaviour

Analysis (V1.0)

Prepared by: Xiong Qiang Date: December 27, 2002

Reviewed by:CDMA 2000 Network Planning Department

Date: December 27, 2002

Reviewed by: Date:

Approved by: Date:

Huawei Technologies Co., Ltd.

All Rights Reserved

Revision RecordDate Revised

version Description Author

2002/12/27 1.0 Completion of first draft Xiong Qiang

Table of ContentsChapter 1 Basic Parameters of MS...............................................................................................2

1.1 Basic Parameters................................................................................................................21.1.1 ESN.......................................................................................................................... 21.1.2 IMSI.......................................................................................................................... 2

1.2 Overview of MS Behavior....................................................................................................2

Chapter 2 MS Initialization.............................................................................................................42.1 Determine System...............................................................................................................42.2 Capture Pilot Channel.........................................................................................................52.3 Capture Sync Channel........................................................................................................52.4 Change Timing....................................................................................................................5

Chapter 3 MS Idle State..................................................................................................................73.1 Paging Channel Interception...............................................................................................7

3.1.1 Interception Mode.....................................................................................................73.1.2 Introduction to System Messages.............................................................................83.1.3 Message Handling Procedures.................................................................................9

3.2 Registration......................................................................................................................... 93.2.1 Registration Type....................................................................................................103.2.2 Registration Procedure...........................................................................................12

3.3 Idle Handoff....................................................................................................................... 133.4 Roaming............................................................................................................................ 13

Chapter 4 MS Access...................................................................................................................154.1 Access Parameters...........................................................................................................154.2 Access Process................................................................................................................. 164.3 Mobile Originated Call Access Procedure.........................................................................184.4 Mobile Terminated Call Access Procedure.......................................................................184.5 Handoff during Access Process........................................................................................19

Chapter 5 Control on Traffic Channel.........................................................................................205.1 Soft Handoff...................................................................................................................... 20

5.1.1 Terminology............................................................................................................205.1.2 Pilot Search............................................................................................................205.1.3 Handoff Procedure..................................................................................................22

5.2 Hard Handoff.....................................................................................................................235.3 Call Drop........................................................................................................................... 235.4 Call Termination................................................................................................................24

Guide to CDMA MS Behavior Analysis

Guide to CDMA MS Behaviour Analysis

Keyword:

CDMA, MS, BTS, PN, call, handoff, message, call drop, initialization, idle, access and control on traffic channel.

Abstract:

The CDMA MS behaviour analysis is a very complicated subject, which deals with CDMA principle, CDMA key algorithms and various service processes in the CDMA 1X protocol. The initialization state, idle state, access state and control on traffic channel state of an MS almost involve all operations of the MS. On the basis of these states, the document briefly introduces the MS behaviours.

Abbreviations:

None

References:

1. TIA/EIA/IS-2000.5-A 3GPP2, March 2000

2. Relationship of LAC Size to Paging and Registration CDMA2000 Network System Research Department

3. Introduction to C2K System Message Series of CDMA2000 BSC Training Materials

1

Guide to CDMA MS Behavior Analysis Chapter 1 Basic Parameters of MS

Chapter 1 Basic Parameters of MS

1.1 Basic Parameters

Many parameters are stored in the Mobile Station (MS). They decide the working mode, working state or identity of the MS.

1.1.1 ESN

ESN is short for Electronic Serial Number, consisting of 32 bits. It is designated by the MS manufacturer as a unique identification number of the MS. When a subscriber is defined, ESN must be provided. Many random numbers generated in the MS are related to ESN.

1.1.2 IMSI

IMSI, short for international mobile station identity, is provided by the mobile control center when a subscriber is defined. It is configured in the MS. There are two types of IMSI. One type of IMSI consists of 15 digits and is called Type 0 IMSI. The other type of IMSI consists of less than 15 digits and is called Type 1 IMSI. A complete IMSI number is made up of three parts, as shown below:

Mobile Station Identification Number

Figure 1-1 Composition of IMSI

MCC: Mobile Country Code, for example, 460 for China.

MNC: Mobile Network Code, for example, 03 for China Unicom.

MSIN: Mobile Station Identification Number. This number is used to distinguish different mobile stations in the same mobile network.

With the first three digits removed, IMSI will become NMSI, namely, the national mobile station identity.

1.2 Overview of MS Behavior

The state of the MS includes four: Initialization, Idle, Access and Control on traffic channel. Each state further includes several substates. All these states cover all functions and operations of the MS.

In the initialization state, MS mainly selects and captures the system.

In the idle state, the MS obtains the system message and performs the registration.

In the access state, the MS realizes the connection with the system.

2

Guide to CDMA MS Behavior Analysis Chapter 1 Basic Parameters of MS

In the control on traffic channel state, the MS realizes the service interaction with the system.

Under a certain condition, the MS can be changed between these four states. The following is the state transition diagram of the MS.

Figure 1-2 MS state transition

3

Guide to CDMA MS Behavior Analysis Chapter 2 MS Initialization

Chapter 2 MS Initialization

The MS initialization includes four substates: determine system, capture pilot channel, capture synchronization channel and change timing. The substate transition diagram is shown below.

Figure 1-1 Substate transition diagram of MS initialization

2.1 Determine System

The MS may enter the “determine system” substate in the case of MS power-up, capture failure, system redirection and system reselection. A state indication will correspond to each case. For example, the power-up indication will be given in the case of power-up, and capture failure indication in the case of capture failure. These indications will guide the MS to perform different operations after it enters the corresponding substate. These operations will unexceptionally reset the local system variables, but only the objects they reset will be different in different cases. Here, a brief introduction will be given to the operations of the MS from the power-up to the “Determine system" substate.

After the MS is powered up, a power-up indication will be given and the MS will perform a system self-check (for example, check the electrical quantity of the battery). Then the MS will enter the “Determine system” substate and reset the corresponding system parameters. Next, the MS will determine the working mode (CDMA system or analog system) and the working frequency according to its settings. Finally, the MS

4


will select one of the pilots saved last time or either of the primary and secondary pilots saved in the MS to access the CDMA system. The whole procedures are called the system selection process. After the system selection process completes, the MS will enter the “Capture pilot channel” substate.

2.1 Capture Pilot Channel

In the “Capture pilot channel” substate, the MS will tune the frequency to the one selected in “Determine System” substate and search the selected pilot channel. If the pilot channel is successfully captured within the stipulated time T20m (15s), the MS will enter the “Capture sync channel” substate. Otherwise, the pilot channel capture failure will be indicated and the MS will return to the “Determine system” substate. At this stage, the pilot searcher of the MS will search PNs by means of the local correlator and find out the PN with the maximum Ec/Io. If the Ec/Io of all PNs is lower than the demodulation threshold, it is considered that the pilot capture fails.

2.2 Capture Sync Channel

In the “Capture sync channel” substate, the MS will align the phases of the branches of the RAKE receiver with the pilot with the maximum Ec/Io. Meanwhile, the local Walsh code generator will output W32 to demodulate the messages in the sync channel. (Since the sync channel is not scrambled with long codes, the corresponding sync channel can be demodulated.)

The sync channel contains the sync channel message. The figure on the left shows the details about a sync channel message.

At this stage, the MS first confirms whether the protocol versions supported by the MS and the BTS match. When the protocol version (MOB_p_rev) supported by the MS is not below the minimum protocol version (min_p_rev) supported by the BTS, the MS will identify the following information in the sync channel message.

System information: System identification (SID), network identification (NID), PN offset index and paging channel rate.

Timing information: Long code state value, system time, leap seconds and daylight saving time indication.

The MS will initialize its variables according to these parameters and then enter the “Change timing” substate.

If the MS fails to receive a valid sync channel message within T21m (1S), it will send a “Capture failure indication” message to the BTS and return to the “Determine system” substate. If the MS receives a valid sync channel message but the protocol versions do not match, it will send a “Protocol version mismatch indication” message to the BTS and return to the “Determine system” substate.

2.3 Change Timing

In the “Change timing” substate, the MS mainly performs two tasks:

5

98/05/24 23:14:09.817 [SCH]

Sync Channel Message

p_rev 6,

min_p_rev 2

sid 4

nid 1

pilot_pn 0x0144

lc_state 357A4F9D28E

sys_time 20A88C24C (03/28/2002 06:52:31.040 diff=0.380 sec)

lp_sec 13

ltm_off 0x10 (8.0 hours)


1. Set its own long code generator according to the long code state value (lc_state) fetched from the sync channel message.

2. Synchronize its own system time with the fetched system time (sys_time). Since the sync channel message is sent strictly in accordance with the system timing, the state of long code generator of the MS can be consistent with the long code state of the whole system.

Besides, the MS can tune its frequency:

The IS-95 MS will use the CDMA_FREQ in the sync channel message (SCHM) to receive the primary paging channel system message. If the current frequency of the MS is not the CDMA_FREQ, the MS will tune its frequency to the CDMA_FREQ. However, the IS-2000 MS will use the EXT_CDMA_FREQ in the sync channel message (SCHM) to receive the primary paging channel system message. If the current frequency of the MS is not the EXT_CDMA_FREQ, the MS will tune it to the EXT_CDMA_FREQ. On this basis, the MS enter the idle state.

6

Guide to CDMA MS Behavior Analysis Chapter 3 MS Idle State

Chapter 3 MS Idle State

In the idle state, the MS will perform many operations. Here, only the four major processes are detailed:

Paging channel interception

Registration

Idle handoff

Roaming

3.1 Paging Channel Interception

3.1.1 Interception Mode

The paging channel is segmented into 80ms. Each 80ms time segment is called a paging timeslot. The MS can work in two modes: slotted mode and non-slotted mode. The MS working in the non-slotted mode must intercept all paging timeslots, while the MS working in the slotted mode only intercepts the designated paging timeslots and can reduce the operations of the processor or stop the processor in the other timeslots, so as to save energy.

Note:

Only the MS in the idle state can work in the slotted mode.

Within a timeslot cycle, the MS working in the slotted mode can intercept one or two paging timeslots. In the registration message, origination message and paging response message, the MS will designate the timeslot to be intercepted in the SLOT_CYCLE_INDEX field. (Note: This field is not the final timeslot No. It is only a parameter for calculating timeslot No.). According to the field, the BSS will use the Hash algorithm to calculate the designated timeslot. Usually, the field, together with IMSI, is set in the MS when a subscriber is defined. If the field is changed by the subscriber, a parameter change registration procedure must be initiated. When this parameter is set to 0, it indicates that the MS selects the non-slotted mode.

The timeslot cycle (Slot Cycle) is defined as T=2 i (in 1.28s), where i is the selected SLOT_CYCLE_INDEX. In a timeslot cycle, there are 16T timeslots. Therefore, when i=0, T=16*80ms=1.28s.

SLOT_NUM is defined as the timeslot No. of the paging channel.

, where t is the system time of a frame.

To determine the timeslots to be intercepted, the MS uses the Hash algorithm to select a random number (PGSLOT), which ranges from 0 to 2047. The timeslots designated by the MS must satisfy the following equation:

It can be seen that the whole paging channel is periodically divided into 2048 timeslots. For a specified MS, there is a fixed deviation between initial timeslot No. and SLOT_Number 0. The fixed deviation is determined by PGSLOT.

In the following example, the timeslot cycle is 1.28s and the calculated PGSLOT is 6. It can be seen that the MS begins to intercept SLOT_NUM 6. It will intercept another timeslot in the next timeslot cycle. Therefore, the timeslot to be intercepted in the next timeslot cycle will be SLOT_NUM 22.

7


Figure 1-1 Example of paging timeslot

3.1.2 Introduction to System Messages

After the MS synchronizes with the system, the MS will adjust the local Walsh codes to W1 to demodulate the corresponding paging channel and collect the configuration messages of the current system from the paging channel. Thirteen system messages are defined in the CDMA protocol. Among them, the following 6 system messages are mandatory.

System Parameters Message

Access Parameters Message

CDMA Channel List Message

Neighbor List Message

Extended Neighbor List Message

Extended System Parameters Message

In the CDMA system, the majority of calls are triggered by messages. Among the diversified CDMA channels, the sync channel, paging channel and reverse access channel are only used to transfer messages. The structure of all these messages is similar and will be briefed here.

Each message consists of multiple binary fields, of which the first field is used to identify the type of the message. To ensure that no message is lost, all messages contain a sequence number. The important messages also contain a one-bit field requiring the message receiver to acknowledge it. Otherwise, the message will be resent. If the correct acknowledgement signal fails to be received for many times, the sender will release the connection.

The figure below shows the structure of the power measurement report message.

8


MSG_TYPE (‘00000110’)

ACK_SEQ

MSG_SEQ

ACK_REQ

ENCRYPTION

ERRORS_DETECTED

POWER_MEAS_FRAMES

LAST_HDM_SEQ

NUM_PILOTS

PILOT_STRENGTH

RESERVED (‘0’s)

8

3

3

1

2

5

10

2

4

6

0-7

NUM_PILOTS occurrences of this field:

Field Length (in bits)

t

MSG_TYPE (‘00000110’)

ACK_SEQ

MSG_SEQ

ACK_REQ

ENCRYPTION

ERRORS_DETECTED

POWER_MEAS_FRAMES

LAST_HDM_SEQ

NUM_PILOTS

PILOT_STRENGTH

RESERVED (‘0’s)

8

3

3

1

2

5

10

2

4

6

0-7

NUM_PILOTS occurrences of this field:

Field Length (in bits)

t

Figure 1-2 Structure of power measurement report message

3.1.3 Message Handling Procedures

Before the MS operates normally, it must receive a complete set of messages, including all necessary configuration parameters. The system messages are periodically broadcast on the paging channel. In fact, the broadcast period is not too long, but only 1.28s. The MS demodulates these messages to obtain the system parameters and set its own registers.

When the MS begins to intercept the paging channel, it will initialize one of its timers. The length of the timer is set to T40m(3s). Once the MS receives a valid message (no matter whether this message is sent to it or not) on the paging channel, the MS will reset the timer. If the MS does not receive any valid message before the timer expires, it will give out a paging channel loss indication and enter the “Determine system” substate of the MS initialization.

After the MS correctly demodulates a message, it will first judge the message type according to the message type field in the message, and compare the sequence number in the message with the corresponding one in the local register. If these two sequence numbers are the same, it will neglect the message. Otherwise, it will continue to handle the message.

For example, after the MS receives the neighbor list message, it will compare the CONFIG_MSG_SEQr field in the message with the value of NGHBR_LST_MSG_SEQS stored in the local register. If the comparison results match, the MS will neglect the message. If the comparison results do not match, the MS will decode the remaining fields in the message and update the corresponding parameter register according to the contents in the message.

3.2 Registration

The biggest benefit that the MS brings to people lies in its “mobility”. It is the “mobility” of the MS that brings great uncertainties to the whole system: The MS may go from the coverage area of one BTS to that of another BTS, or it may go from one system to

9


another. When the parameters of the MS are changed, how is the BTS notified of the change so as to effectively page the MS? All this is realized by registration. The registration refers to the process what the MS notifies the BTS of its location, state, identification, timeslot cycle and other characteristics. Through that process, the BTS clearly knows the characteristics and state of the MS so that it can effectively originate a paging. For example, the registration message contains the SLOT_CYCLE_INDEX parameter and the BTS determines whether the MS works in the slotted mode or the non-slotted mode according to that parameter. When that parameter is changed or the MS moves to a new BTS, the BTS must be timely informed of the change by means of the registration.

The CDMA system supports 10 different types of registration.

3.2.1 Registration Type

I. Power-up registration

The MS will perform the power-up registration when the MS is powered up, the frequency or the operation mode is changed, or the MS is handed off from the analog system.

Important: When the MS is powered up, it will perform the registration. To avoid frequent registrations due to frequent power-ups and power-downs in a short time, the protocol stipulates that a delay T57m(20s) is required for the MS to perform another registration after it enters the idle state.

II. Power-down registration

When the subscriber is ready to power down the MS, the MS will perform the power-down registration. The system will consider that the MS is powered down only after the power-down registration completes.

If the MS is not registered in the system indicated by the current SID and NID, the MS will not perform the power-down registration.

III. Timer-based registration

The timer-based registration enables the MS to perform the registration within the stipulated time and also enables the system to know the MS is in service. If the system does not receive the registration message of the MS within the stipulated time, the system will automatically delete the registration of the MS. In this way, the system can cancel the registration message of the MS which fails to perform the power-down registration.

According to the REG_PRD in the system parameters message, the MS determines the registration period REG_COUNT_MAXS:

REG_COUNT_MAXs = [2REG_PRD/4]

To trigger a registration, a time-based registration counter (REG_COUNTs) is required in the MS. When the counter is enabled and the MS works in the non-slotted mode, the MS will increase the counter by “1” every 80ms (timeslot of a paging channel). If the MS works in the slotted mode, the counter can be activated only when it begins to intercept the paging channel, but the increment is equal to the timeslot cycle divided by 80ms. (For example, suppose the timeslot cycle of the MS is 2.56s, the increment of the counter each time is 32 when the counter is activated.) In this way, the periods of the registration triggered in the two modes will keep consistent. When the registration period of the counter comes, the MS will initiate a registration and reset the counter.

If the registration period (REG_PRD) is set to “0”, it indicates that the MS cancels the timer-based registration. In practice, the registration period of the MS should be shorter than that of MSC.

10


IV. Distance-based registration

When the distance between the BTS where the MS is currently located and the BTS registered last time exceeds a threshold, the MS will initiate a registration. This type of registration is called distance-based registration. The MS saves the latitude and longitude of the BTS registered last time. (The latitude and longitude can be obtained from the system message.) If the differences between the latitude and longitude issued in the system message and those registered last time exceed the threshold (REG_DIST), a distance-based registration will be induced. If the threshold (REG_DIST) is set to “0”, the MS is forbidden to use this type of registration.

V. Zone-based registration

“Zone” refers to a BTS group in a specified system and network. The zone of a BTS is given by the REG_ZONE field in the system parameters message.

When the MS enters a new zone and that zone is not in the registered zone list saved by the MS, the MS will initiate a registration. This type of registration is called zone-based registration.

The following three parameters decide the triggering condition of this type of registration.

REG_ZONE: Registration zone code. This field is the registration zone code of the BTS. The registration zone code refers to a group of BTSs in the specified system and network.

TOTAL_ZONES: Total number of reserved registration zone codes. It is necessary to use the registration zone list (ZONE_LISTs) in the zone-based registration. If the zone-based registration is not allowed, the “TOTAL_ZONES” field in the BTS should be set to “000”.

ZONE_TIMER: Length of the zone timer. This field value of BTS is the length of the zone-based registration timer used by the MS.

In addition, there is an access zone registration list (ZONE_LISTs) in the MS. When the MS moves to a new zone and that zone is not in the ZONE_LISTs, the MS will initiate a registration and add that zone to the ZONE_LISTs. The MS will delete it when the timer expires. The number of records in the ZONE_LISTs is determined by the “TOTAL_ZONES” field.

For example, when the value of the “TOTAL_ZONES” field is “1” and the MS moves from ZONE 1 to ZONE 2, the MS will add ZONE 2 to the ZONE_LISTs after it finds ZONE 2 is not in the original ZONE_LISTs. However, the “ZONE_LISTs” is now full. According to the protocol, the zone first added should be deleted, so ZONE 1 will be deleted from ZONE_LISTs, and meanwhile, a registration will be initiated.

Alike, when the MS moves from ZONE 2 to ZONE 3 (It is possibly another zone or ZONE 1), it will add ZONE 3 to ZONE_LISTs and delete ZONE 2 from ZONE_LISTs after it finds ZONE 3 is not in the original ZONE_LISTs. Meanwhile, a registration will be initiated.

The advantage of this type of registration is that the paging will always succeed, but the disadvantage is that too many registrations will take place.

If the value of the “TOTAL_ZONES” field is greater than 2, at most 2 zones (REG_ZONE+SID+NID) can be saved in the ZONE_LISTs of the MS.

When the MS moves from ZONE 1 to ZONE 2, if ZONE 2 is not in the ZONE_LISTs, the MS will add ZONE 2 to ZONE_LISTs and initiate a registration. By now, the zones in the ZONE_LISTs include ZONE 1 and ZONE 2. Meanwhile, the MS will set a ZONE_TIMER for ZONE 1. When the timer expires, the MS will delete ZONE 1 from ZONE_LISTs.

11


Table 1-1 Values of Zone Timer

Value (bin) Length of timer (min)

'000' 1'001' 2'010' 5'011' 10'100' 20'101' 30'110' 45'111' 60

VI. Parameter-change Registration

When some parameters of the MS are changed or when the MS enters a new system, the MS will perform a registration called parameter-change registration. The change of the following parameters will trigger this type of registration.

Preferred timeslot cycle index (SLOT_CYCLE_INDEXp)

Mobile station class mark (SCMp)

Call termination enable indicators (MOB_TERM_HOMEp, MOB_TERM_FOR_SIDp and MOB_TERM_FOR_NIDp)

The change of the following parameters supported by the MS will also trigger the parameter-change registration.

Band class

Power level

Rate set

Operating mode

VII. Order registration

By sending a registration request order, the BTS can order the MS to perform a registration, which is called order registration.

VIII. Implicit registration

When the MS successfully sends an origination message or a paging response message, the BSS can deduce the location of the MS. It is called implicit registration.

IX. Traffic channel registration

Whenever the BSS receives the registration message of the MS to which a traffic channel is assigned, the BSS can inform the MS that a registration is performed. The BSS sends to the MS the Status Request Message or Status Request Order to request of the MS the registration information. Meanwhile, the BSS sends to the MS the Mobile Station Registered message to inform that the MS is registered.

12

16:18:27.144 Access Channel: Registration

ACK_SEQ: 7 MSG_SEQ: 1 ACK_REQ: 1 VALID_ACK: 0

ACK_TYPE: 0

MSID_TYPE: 3, ESN: [0x 01 99 0d fc]

MFR 1, Reserved 38, Serial Number 69116,

IMSI: (Class: 0, Class_0_type: 1) [0x 01 8d 31 74 29 36]

00-416-575-0421

AUTH_MODE: 0

REG_TYPE: Timer-based

SLOT_CYCLE_INDEX: 2

MOB_P_REV: 1

EXT_SCM: 1

SLOTTED_MODE: 1

MOB_TERM: 1


X. User zone-based registration

When the MS selects an activated User Zone, it will perform a registration.

3.2.2 Registration Procedure

All types of registrations that the protocol supports are enumerated above. However, only some of them will be adopted in the system. What type of registration the MS performs and when it performs the registration can be learnt by analysing the system parameters message. When the registration condition is satisfied, the MS will trigger a registration. The registration message is transferred on R-CSCH. Above is shown a decoded registration message.

When the BSS receives a registration message from the MS, it will send an ACK message to the MS. As with message handling procedure of the MS, the BSS will save the corresponding parameters in the register or report them to the MSC.

The registration procedure is as follows:

MS BTS BSC

Registration MsgAbis-ACH Msg Transfer(RGM)

Abis-PCH Msg Transfer(Bs Ack Ord)

Bs Ack Order

Location Updating Request

MSC

ACH

PCHLocation Updating Accept/Reject

Abis-PCH Msg Transfer(Reg Accept/Reject Ord)

Reg Accept/Reject Ord)PCH

Figure 1-3 Registration procedures

3.3 Idle Handoff

As long as the MS is powered up, the pilot searcher of the MS will keep on searching the pilots in the neighbor list. When the MS in the idle state senses that the pilot of another BTS is stronger than that of the current BTS, the MS will perform an idle handoff and consider the stronger pilot as a reference one. When the next superframe starts, the MS will be handed off to the corresponding paging channel of the stronger pilot to receive the system message and modify the values of some parameters of the MS.

Note: The BSS does not participate in the idle handoff, that is to say, the BSS does not know that the idle handoff has already happened to the MS. On a new paging channel, if the condition is satisfied, the MS will initiate a registration, by which the BSS learns the relevant information of the MS.

The neighbor set of the MS in the idle state is obtained from the Neighbor List Message, Extended Neighbor List Message and General Neighbor List Message. The Neighbor List Message (NLM) only contains the PN list of the used frequency, the Extended Neighbor List Message (ENLM) contains the PN list of different frequencies and bands, and the General Neighbor List Message (GNLM) contains the pilot information of different systems.

13


3.4 Roaming

When a mobile subscriber is defined, one or more groups of local network parameter pairs (SID NID) will be set. When the SID NID in the system parameters message received by the MS is different from the local network parameter pair, the MS will consider that a roaming happens. Two types of roaming are defined in the protocol. One type is the intra-system roaming between different networks, which takes place when the SIDs are the same but the NIDs are different. The other is the inter-system roaming, which takes place when the SIDs are different. If the NID is set to the reserved value 65535 (0XFFFF), none of the MSs under the BTS identified by this SID are in the roaming state.

14

Guide to CDMA MS Behavior Analysis Chapter 4 MS Access

Chapter 4 MS Access

In one of the following states, the MS access will take place:

1. Origination

2. Paging response

3. Registration

In the above states, the MS needs to establish connection with the BTS to send information to the BTS. Before that, the MS, however, just passively receives different messages issued by the BTS, and the communication between the MS and BTS is just limited to one way. When the MS wants to issue a message to acknowledge the BTS (for example, acknowledge the paging of the BTS), or when it wants to originate a call, the MS must access the system so as to form a close loop between the MS and BTS. That is the MS access. Only after the MS succeeds in accessing the system, the two-way communication between the MS and BTS can be available.

The access solution of the IS-95 MS is based on an ALOHA protocol in regard to timeslot. All subscribers can send access messages at will, but there is only one access channel. Therefore, their frames may conflict in terms of time so that they could collide. As a result, errors may occur to the data of two (multiple) collided frames. Hence, all of them need to be resent. To avoid further collision, the subscribers can not resend the access messages at once. The resending strategy in the ALOHA protocol is that each subscriber resends the access message after waiting for a random time. In case of further collision, the subscriber needs to wait for another random time before the access message is successfully sent out.

In the IS-2000 protocol, not only the access mode in the IS-95 protocol is compatible, but also improvements of IS-95 protocol have been made.

The original access mode is reserved for the reverse random access channel. The access process is basically the same as that in the IS-95 protocol. Meanwhile, an enhanced access channel is added. With the adoption of an improved access mode, this enhanced access channel has a higher access efficiency and supports the high-speed data service.

Different from the non-overlapping timeslot ALOHA solution in the IS-95 protocol, an overlapping timeslot ALOHA solution is adopted in IS-2000 protocol. In the IS-2000 protocol, a function that long codes serve as timeslots is applied to avoid the collision. In this way, only partial access messages sent by subscribers may be overlapped along the time axis and the delay is reduced.

The adoption of close loop power control on the access channel improves the channel performance and lowers the error probability of access messages. In addition, the optimization of the IS-95 protocol greatly shortens the timeslot (from the original 200ms to 1.25ms) and the timer threshold.

A dedicated channel is used to transfer long messages so that the load of the access channel could not be too heavy.

The application of soft handoff can improve the access performance.

4.1 Access Parameters

Before the introduction of access process of the MS, we will explain the configurations of the access channel:

In the access parameters message issued by the BTS, some parameter configurations necessary for the MS access are assigned. The following lists the details of an access parameter message:

98/05/24 23:14:10.427 [PCH] MSG_LENGTH = 184 bits

15


MSG_TYPE = Access Parameters Message

PILOT_PN = 168 Offset Index

ACC_MSG_SEQ = 27

ACC_CHAN = 1 channel

NOM_PWR = 0 dB INIT_PWR = 0 dB PWR_STEP = 4 Db

NUM_STEP = 5 Access Probes Maximum

MAX_CAP_SZ = 4 Access Channel Frames Maximum

PAM_SZ = 3 Access Channel Frames

Persist Val for Acc Overload Classes 0-9 = 0

Persist Val for Acc Overload Class 10 = 0






Persistence Modifier for Msg Tx = 1

Persistence Modifier for Reg = 1

Probe Randomization = 15 PN chips

Acknowledgement Timeout = 320 ms

Probe Backoff Range = 4 Slots Maximum

Probe Sequence Backoff Range = 4 Slots Max.

Max # Probe Seq for Requests = 2 Sequences

Max # Probe Seq for Responses = 2 Sequences

Authentication Mode = 1

Random Challenge Value = Field Omitted

Reserved Bits = 99

From the above message, the MS can obtain some access parameters, for example, number of access channels that the current paging channel corresponds to, the open loop power control parameter, access times, access attempts and access acknowledgement timeout. The MS will configure its own state according to these parameters and then access the system if necessary.

4.2 Access Process

After the MS obtains the above access parameters message on the paging channel, it will make configurations for its own state. After that, the MS can start to access the system.

The access process contains many access attempts. The access attempt is divided into access request attempt and access acknowledgement attempt. When the MS requests to access the system, it will make an access request attempt. When the MS acknowledges the paging message of the BTS, it will make an access acknowledgement attempt.

The access process of the MS on the access channel is random. Generally speaking, one access attempt consists of one or more access sub-attempts. Below is a schematic diagram of an access sub-attempt. From the diagram, it can be seen that one access sub-attempt contains multiple access probe sequences.

16


Figure 1-1 Access sub-attempt (including four access probe sequences)

One access probe sequence further contains multiple access probes. The figure below shows the structure of an access probe sequence.

Figure 1-2 Access probe sequence (including five access probes)

Since a forward paging channel may correspond to multiple reverse access channels, the MS will randomly select one of these reverse access channels to access the system. If there is only one reverse access channel corresponding to the current paging channel, all access probes in an access probe sequence will be transferred on this reverse access channel. If there are more than one reverse access channels, the access probes in an access probe sequence may be transferred on these different access channels.

The transmit power of the first access probe in each access probe sequence is determined by the physical layer according to the open loop power control. The MS calculates the initial transmit power according to the power of the receiving signal in the forward link and the open loop power control formula. Then the MS makes the first access probe at the initial transmit power and waits for the access acknowledgement of the BTS on the forward channel. If the MS does not receive the acknowledgement message from the BSS within the stipulated Timing Advance (TA), the access probe will fail. After the MS waits for a random time, it will make another access probe. To increase the success probability of the access, there will be a Power Increment (PI) between the transmit power of a second access probe and the initial transmit power. There are 16 access probes at most in one access probe sequence, while there are 15 access probe sequences at most. In most cases, the first access probe can succeed. When the number of access probes amounts to the maximum stipulated in the access parameters message but the MS does not receive the acknowledgement message from the BTS, the MS will indicate that the access fails.

17


4.3 Mobile Originated Call Access Procedure

After the mobile subscriber dials the called number and presses down the “OK” key, the mobile originated call procedures will be started. At this time, the MS will request to access the system.

First, the MS will encapsulate the called number and its related parameters into the origination message and then transfer the message on the reverse access channel in the access mode described in 4.2.

After the BTS correctly demodulates the origination message, it will send the corresponding acknowledgement (ACK) message and issue the channel assignment message to assign a corresponding forward channel to the MS to receive the forward traffic channel frames.

After the MS successively receives two null traffic channel frames on the assigned channel, it will confirm that it has found the correct forward traffic channel. In response to the BTS, the MS will send two null preamble frames on the reverse traffic channel.

After the BTS sends the channel assignment message, it will intercept the preamble frames sent by the MS on the reverse traffic channel. If the BTS receives these two null preamble frames, it will send an ACK message in response to the MS. The MS will also send to the BTS an ACK message, as an essential part of the handshake message, after it receives the ACK message from the BTS. In this way, the traffic channel between the MS and BTS is established. Then the BTS will issue the Service Connect Message to indicate the supported service. If the MS can accept the service, it will feed back to the BTS the corresponding ACK message, which is a critical point in the call procedure. All operations before this point are involved in the access attempt, while the process after this point can only be called a real call.

4.4 Mobile Terminated Call Access Procedure

As specified before, the access attempt of the MS includes the access request attempt and the access acknowledgement attempt. The mobile terminated call acknowledgement attempt is an access acknowledgement attempt.

After the BSS receives the paging order issued by the MSC, it will send the General Page Message on the paging channel in its coverage area.

All MSs that have received the general page message will compare the IMSI in the message with their own IMSIs. The MS, which finds these two IMSIs are the same, will return the paging response message on the reverse access channel, according to the access process described in 4.2. The paging response message needs to be acknowledged by the BTS. If the MS receives the ACK message, the access will succeed.

18

98/05/24 23:14:46.127 [PCH] General Page Message

MSG_LENGTH = 128 bits

MSG_TYPE = General Page Message

CONFIG_MSG_SEQ = 1 ACC_MSG_SEQ = 20

CLASS_0_DONE = 1

CLASS_1_DONE = 1 RESERVED = 0

BROADCAST_DONE = 1 RESERVED = 0

ADD_LENGTH = 0 bits ADD_PFIELD = Field Omitted

PAGE_CLASS = 0 PAGE_SUBCLASS = 0

MSG_SEQ = 1

IMSI_S = 6153300644

SPECIAL_SERVICE = 1

SERVICE_OPTION = 32768

RESERVED = Field Omitted


About 400ms after the access succeeds, the MS will receive the channel assignment message issued by the BTS. According to the channel assignment message, the MS will capture the forward traffic channel frames on the corresponding channel, on which the BTS has already used the assigned Walsh codes to send null frames. If the MS does not receive the channel assignment message within T42m(12s) after receiving the paging response ACK message, the MS will return to the idle state.

After the MS successively receives two correct null frames on the assigned forward channel, it will judge that it has found the correct forward traffic channel. By now, the forward link is established. To establish the corresponding reverse traffic link, the MS will send two null preamble frames on the reverse traffic channel. If the BTS succeeds demodulating the preamble frames, it will feed back the corresponding ACK message and the MS will also confirm this ACK message. Now the traffic link between the BTS and MS is established.

As with the mobile originated call in 4.3, after the traffic channel is established, both the MS and the BTS need to negotiate the service. The service negotiation process is the same for both the mobile originated call and the mobile terminated call.

In the mobile originated call procedure, the subscriber can start conversation after the service negotiation. But in the mobile terminated call procedures, there is an alert with information message, which demands the called MS to ring and present the calling party number.

Some parameters about ringing are designated in the alert with information message. The calling party number is given in the CHARi field so that the called MS can present it. After the called MS receives the alert with information message, it will acknowledge the message. When the called mobile subscriber presses down the “OK” key, the called MS will send the Connect Order to the BTS. When the BTS receives this order, it will acknowledge it and send a corresponding order to the NSS. After the circuit is connected, the calling and called parties can start conversation. In this case, the MS formally enters the “control on traffic channel” state.

19

18:14:47.961 Forward Traffic Channel:

Alert With Information

ACK_SEQ: 3 MSG_SEQ: 1 ACK_REQ: 1 ENCRYPTION: 0

SIGNAL_TYPE = IS-54B Alerting

ALERT_PITCH = Medium Pitch (Standard Alert)

SIGNAL = Long RESERVED = 0

RECORD_TYPE = Calling Party Number

RECORD_LEN = 96 bits

NUMBER_TYPE = National Number

NUMBER_PLAN = ISDN/Telephony Numbering Plan

PI = Presentation Allowed SI = Network Provided

CHARi = 6153000124 RESERVED = 0 RESERVED = 0


4.5 Handoff during Access Process

In the access state, the MS still continues to search pilots and performs a handoff if the condition is satisfied. The handoff is divided into access handoff and access attempt handoff according to the occurrence time of the handoff.

Access handoff: In the paging response or origination attempt substate, if the MS gives out the paging channel loss indication before the MS receives (sends) an acknowledgement message from (to) the BTS, the MS will perform an access handoff. As a result, the MS is handed off to an optimal sector.

Access attempt handoff: In the paging response or origination attempt substate, if the MS gives out the paging channel loss indication when the MS makes an access attempt, it will perform an access attempt handoff. As a result, the MS will suspend the access attempt on the original channel and make a new access attempt on the reverse access channel that the new pilot corresponds to.

20

Guide to CDMA MS Behavior Analysis Chapter 5 Control on Traffic Channel

Chapter 5 Control on Traffic Channel

5.1 Soft Handoff

5.1.1 Terminology

Before the analysis of handoff of the MS, we will briefly introduce some terms:

Pilot set: A set of pilots with the same frequency but different PNs.

The pilot set is classified into four categories:

1) Active set: A set of corresponding pilots of the traffic channel which the MS is using for communication.

2) Candidate set: A set of pilots which do not belong to the active set but are so strong that their corresponding forward traffic channels can be successfully demodulated.

3) Neighbor set: A set of pilots which belong to neither the active set nor the candidate set, but may serve as candidate pilots for the handoff.

4) Remaining set: A set of pilots other than in active set, candidate set or neighbor set.

Besides, there are several important parameters regarding the soft handoff: T_ADD, T_DROP and T_TDROP.

T_ADD: Pilot addition threshold. When the Ec/Io of pilots in the neighbor set and remaining set exceeds the threshold, these pilots will be added to the candidate set.

T_DROP: Pilot drop threshold. When the Ec/Io of pilots in the active set and the candidate set is lower than the threshold, the MS will start the drop timer. When the Ec/Io of pilots is higher than the T_DROP threshold, the MS will stop the drop timer and reset the timer.

T_TDROP: Drop timer length. When the drop timer length of the pilot exceeds the T_TDROP threshold, the drop timer will expire and trigger the drop process.

The measurement data of pilots in the active set and candidate set are the data source of the handoff decision. These data include the pilot strength (Ec/Io) and the state of the corresponding drop timer of the pilot. The MS sends the measurement data to the BTS via the pilot measurement report message.

The MS will send the pilot measurement report message to the BTS when one of the following conditions is triggered.

(a) After the MS receives from the BTS the pilot measurement report order.

(b) When the Ec/Io of a pilot in the neighbor set or remaining set is higher than T-ADD.

(c) When the Ec/Io of a pilot in the active set or candidate set is lower than T_DROP and the T_TDROP timer expires.

5.1.2 Pilot Search

When the MS demodulates the traffic channel, the pilot searcher will unceasingly search other pilots. For the four pilot sets, the pilot search priorities vary. The figure below vividly depicts the search modes of the pilot searcher.


Figure 1-1 Pilot search modes

From the figure, it can be seen that the active set and candidate set take precedence over the neighbor set and remaining set, and the neighbor set over the remaining set. The simple example below shows the priorities of these four pilot sets.

Figure 1-2 Contents in current pilot set (example)

In the above example, there are three active set pilots, one candidate set pilot, twelve neighbor set pilots and 112 remaining set pilots. The search sequence is shown in the figure below:

Figure 1-3 Search sequence of MS (example)

It is obvious that if there are too many PNs in the neighbor set, the probability of searching pilots in the remaining set is very low. Even if the pilots in the remaining set are searched, it will take a long time. Therefore, if the configuration of neighbor cell is


absent in the neighbor list, the system will fail to search the strong pilots in the neighbor cell in time, giving rise to strong interference or even call drops. If a pilot in the absent neighbor cell is fortunately searched by the MS and the strength (Ec/Io) is greater than T_ADD, the MS will report PSMM. But the BSS will not perform handoff processing except to report the Absent Configuration of Neighbor Cell alarm. (Huawei system realizes the alarm in the R01B02D405 in this way.)

Furthermore, the MS will follow a certain principle to search pilots in the remaining set. This principle is that only the PNs which are a multiple of Pilot_INC will be searched. However, the MS will search the pilots in the other three sets free from the restriction of the above principle.

5.1.3 Handoff Procedure

Here we will take an example to illustrate the soft handoff procedure of the MS.

MS initialization state: The reference pilot is PN168.

During a call, the pilot searcher will follow the rules described in 5.1.2 to unceasingly search the pilots in the four pilot sets. Once the MS finds the Ec/Io of a pilot in the neighbor set or remaining set exceeds the T_ADD threshold, it will report the pilot strength measurement message (PSMM) to the BTS and add this pilot to the candidate set. The figure below shows a complete PSMM.

From the left figure, the PSMM reported by the MS indicates the strengths of two other pilots PN220 and PN500, besides that of the reference pilot.

After the BTS receives the PSMM, it will return a corresponding ACK message to the MS. When the BSS judges a handoff is required according to the algorithm in the protocol, it will assign the corresponding Walsh code in the target sector and send the forward traffic channel frames for the MS to capture. In the meantime, the BSS will capture the null preamble frames sent by the MS on the reverse channel. If the resources are successfully assigned, the BSS will issue the handoff order message to the MS.

98/05/24 23:14:02.205 [RTC]

Pilot Strength Measurement Message


MSG_TYPE = Pilot Strength Measurement Message

ACK_SEQ = 5 MSG_SEQ = 0 ACK_REQ = 1

ENCRYPTION = Encryption Mode Disabled

REF_PN = 168 Offset Index (the Reference PN)

PILOT_STRENGTH = -6.0 dB

KEEP = 1

PILOT_PN_PHASE = 14080 chips (PN220+0chips)


KEEP = 1

PILOT_PN_PHASE = 32002 chips (PN500 + 2 chips)


KEEP = 1

RESERVED = 0


From the right message, the destination cell (PN500) will use W50 to establish a new traffic link with the MS, and the corresponding cell of PN168 will use W61 to establish a new traffic link with the MS. After the MS receives this message, it will return a corresponding ACK message to the BTS and try to capture the forward traffic link in the destination cell. If the capture succeeds, the MS will send null preamble frames on the reverse traffic channel. If the BTS also succeeds in capturing the reverse traffic link, the traffic link between the MS and BTS is successfully established. Now, the MS will send the handoff completion message to the BTS. The handoff completion message indicates the three PN branches that are being used. After the above operations, the BTS with which the MS establishes the traffic link changes, so does the adjacency. To inform the MS of this change in time, the BSS will issue the neighbor cell update message after it receives the handoff completion message. The neighbor cell update message contains the union set of all neighbor cells of the three active cells. So far, the MS has accomplished a complete handoff procedure and established traffic links with three cells.

After the handoff completes, the MS still unceasingly searches the pilots in the active set. When the Ec/Io of a pilot leg is lower than the T_DROP threshold and the T_TDROP timer expires, the MS will again send the PSMM to start a new handoff. However, a leg is deleted in this handoff. Meanwhile, the pilot searcher of the MS still continues to search the PNs in the neighbor list. When the Ec/Io of a pilot exceeds the T_ADD threshold, a new handoff procedure will be triggered.

In the CDMA system, addition or deletion of a pilot leg is called a handoff.

5.2 Hard Handoff

In the CDMA system, the hard handoff is similar to the handover in the GSM system, that is, during a handoff process, the MS cannot access a new channel unless it leaves the original channel. The hard handoff can happen to different frequencies or

98/05/24 23:14:02.926 [FTC] Extended Handoff Direction Message


MSG_TYPE = Extended Handoff Direction Message

ACK_SEQ = 0 MSG_SEQ = 6 ACK_REQ = 1

ENCRYPTION = Encryption Mode Disabled

USE_TIME = 0 ACTION_TIME = 0 HDM_SEQ = 0

SEARCH_INCLUDED = 1

SRCH_WIN_A = 40 PN chips

T_ADD = -13.0 dB T_DROP = -15.0 dB T_COMP = 2.5 dB

T_TDROP = 4 sec

HARD_INCLUDED = 0 FRAME_OFFSET = Field Omitted

PRIVATE_LCM = Field Omitted RESET_L2 = Field Omitted

RESET_FPC = Field Omitted RESERVED = Field Omitted

ENCRYPT_MODE = Field Omitted RESERVED = Field Omitted

NOM_PWR = Field Omitted NUM_PREAMBLE = Field Omitted

BAND_CLASS = Field Omitted CDMA_FREQ = Field Omitted

ADD_LENGTH = 0

PILOT_PN = 168 PWR_COMB_IND = 0 CODE_CHAN = 61



RESERVED = 0


the same frequency (For example, when the system does not support the inter-BSC soft handoff .or inter-MSC soft handoff).

The hard handoff involves two pilot sets.

1) Candidate frequency neighbor pilot set: Set of CDMA candidate frequency pilots

2) Candidate frequency search pilot set: A subset of candidate frequency neighbor pilot set. The BTS can guide the MS to search pilots.

The MS reports the pilot measurement results in these search pilot sets to the BSS via the candidate frequency search report message. The pilot measurement results, together with the reverse link measurement report from the BTS are the major data source for the decision of the hard handoff.

Hard handoff procedure:

When the BSS judges that a hard handoff is required, it will assign to the MS a traffic channel in the destination cell, and send and receive service frames on this traffic channel. After the MS receives the general handoff direction message from the BSS, the MS will return an ACK message and then leave the original channel and access the target channel of the handoff according to the parameters in the message. After the access succeeds, the MS will send the handoff completion message on the new channel.

5.3 Call Drop

In conversation, both the forward and reverse traffic channels are occupied by the service data. To ensure the normal transmission of service data, the signaling link between the MS and the BTS must be in a closed loop state. When the closed loop is broken for some reasons, the MS will release the traffic link, so a call drop happens.

There are some counters in the MS, which are used to count the events that break the closed loop. When the thresholds of these counters are exceeded, the MS will close its transmitter or return to the initialization state.

Currently, there are three known causes for the call drop:

Erasure frame: When the MS successively receives N2m(12) erasure frames, it will close its transmitter. If the MS successively receives two good frames after the transmitter is closed, the MS will restart the transmitter.

Fading counter: A high forward frame error rate (FER) means fading in the forward link. There is a fading counter in the MS. When the MS successively receives N3m(2) good frames, this counter will be reset to recount. If the MS does not receive two successive good frames within the stipulated time T5m (usually 5s) yet, the reading of the counter will be “0” and the MS will enter the initialization state.

Response failure: The MS sends a message to be acknowledged by the BTS on the reverse traffic channel. To ensure the BTS can receive the message, this message will be sent for several times. If the message is not acknowledged by the BTS after it is sent for several times, the MS will close its transmitter and re-enter the initialization state.

5.4 Call Termination

Different from the call drop, a normal call termination requires the MS which terminates the call should issue a “release order”. No matter which party terminates the call, the MS needs to save the current configuration of some parameters. When the calling party and called party release the occupied resources, the call is terminated.


After the call is terminated, the MS will send the release order to enter the “Determine system” substate of the initialization, then search the strongest PN of the current frequency, next trace the message of the corresponding sync channel, and finally return to the idle state to intercept the message on the paging channel and wait for the next call.