2000 1X CAI Message Analysis

2000 1x CAI Message analysis

Lecturer: Hong Jeong Ho

Revision History

Version 1.0 2002.4 Draft version – SK Telecom Samsung System.

Version 2.0 2002.5 Add Japan KDDI Motorola system data

Version 2.1 2002.9 Re-configuration for teaching material. Contents

1.CALL ORIGINATION (VOICE, DATA)...... 3

1.1 SYNC CHANNEL MESSAGE...... 3 1.2 GENERAL PAGE MESSAGE...... 7 1.3 NEIGHBOR LIST MESSAGE...... 11 1.4 CDMA CHANNEL LIST MESSAGE...... 13 1.5 EXTENDED SYSTEM PARAMETERS MESSAGE...... 14 1.6 GENERAL NEIGHBOR LIST MESSAGE...... 19 1.7 SYSTEM PARAMETERS MESSAGE...... 21 1.8 ACCESS PARAMETERS MESSAGE...... 26 1.9 REGISTRATION MESSAGE...... 30 1.10 ORDER MESSAGE...... 32 1.11 ORIGINATION MESSAGE...... 41 1.12 EXTENDED CHANNEL ASSIGNMENT MESSAGE...... 46 1.13 SERVICE REQUEST MESSAGE...... 49 1.14 SERVICE CONNECT MESSAGE...... 52 1.15 SERVICE CONNECT COMPLETION MESSAGE...... 53 1.16 POWER CONTROL MESSAGE...... 54 1.17 POWER CONTROL PARAMETERS MESSAGE...... 55 1.18 POWER MEASUREMENT REPORT MESSAGE...... 56 1.19 EXTENDED SUPPLEMENTAL CHANNEL MESSAGE...... 57 1.20 RLP STATISTICS...... 61 1.21 FAST FORWARD POWER CONTROL INFORMATION...... 67 1.22 FORWARD FRAME INFORMATION...... 68 1.23 REVERSE FRAME INFORMATION...... 71 1.24 REVERSE POWER CONTROL INFORMATION...... 74 1.25 PILOT STRENGTH MEASUREMENT MESSAGE...... 76 1.26 UNIVERSAL HANDOFF DIRECTION MESSAGE...... 77 1.27 HANDOFF COMPLETION MESSAGE...... 80 1.28 EXTENDED NEIGHBOR LIST UPDATE MESSAGE...... 80 1.29 IN-TRAFFIC MESSAGE...... 83 1.30 RELEASE ORDER MESSAGE...... 84 1.31 SCRM (SUPPLEMENTAL CHANNEL REQUEST MESSAGE)...... 85

2.CALL TERMINATION (VOICE, DATA)...... 86

2.1 ALERT WITH INFORMATION MESSAGE...... 86 2.2 CONNECT ORDER MESSAGE...... 88

3. PAGING AND STATUS REPORT (VOICE, DATA)...... 88

3.1 QUICK PAGING...... 88 3.2 ACCESS CHANNEL (PAGING RESPONSE)...... 89

2 3.3 SEARCHER AND FINGER INFORMATION...... 90 3.4 MARKOV STATISTIC...... 91 3.5 ACCESS PROBE INFO...... 91 3.6 SERVICE CONFIGURATION...... 92

4.SERVICE REDIRECTION MESSAGE (SRM)...... 93

5.ENHANCED HARD H/O...... 95

5.1 CANDIDATE FREQUENCY SEARCH REQUEST MESSAGE...... 95 5.2 CANDIDATE FREQUENCY SEARCH RESPONSE MESSAGE...... 98 5.3 CANDIDATE FREQUENCY SEARCH REPORT MESSAGE...... 98 5.4 CANDIDATE FREQUENCY SEARCH CONTROL...... 100

1.Call Origination (Voice, Data)

1.1 Sync Channel Message

2001 Feb 5 07:46:52.493 SYNC CHANNEL -- Sync Channel Msg (vol5. 3.7.2.3.2.25) protocol_rev = 6 (IS2000) chan_type = 0 (Sync) chan sc_msg gen msg_type = 1 (Sync)  ① sync p_rev = 6  1:IS95, 2:IS95A, 3:TSB74, 4,5:IS95B, 6:IS95C, protocol revision level. min_p_rev = 1  Minimum protocol revision that mobile can access system. It could use to prohibit the mobile that can’t support service from system. sid = 2236 (0x8bc)  ② nid = 113 (0x71)  ② pilot_pn = 188 (0xbc) lc_state[HI] = 507 lc_state[LO] = 3582174253  Present long code state sys_time[HI] = 1 sys_time[LO] = 4022462865 Difference present time between standard time (Jan 6, 00:00:00, 1980) lp_sec = 13  leap second count after system “on” ltm_off = 18  Local time offset (30minute unit) 18*30minute = 9 Hour ★daylt = 1  daylight savings time (Allow ‘1’, prohibit ’0’) ★prat = 0  Paging channel data bps 0 : 9600bps , 1 : 4800bps ★cdma_freq = 29 (0x1d)  CDMA Channel Number including Primary Paging Channel ext_cdma_freq = 29 (0x1d)  Quick paging

3 參考事項 ① msg_type (See vol4. LAC) Table 3.1.2.3.1.1.2-1. MSG_TYPE Values on f-csch MSG_NAME MSG_TAG MSG_TYPE Logical CH binary System Parameters Message SPM 1 Broadcast Access Parameters Message APM 10 Broadcast Neighbor List Message NLM 11 Broadcast CDMA Channel List Message CCLM 100 Broadcast Order Message ORDM 111 General signaling Channel Assignment Message CAM 1000 General signaling Data Burst Message DBM 1001 General signaling Authentication Challenge Message AUCM 1010 General signaling SSD Update Message SSDUM 1011 General signaling Feature Notification Message FNM 1100 General signaling Extended System Parameters Message ESPM 1101 broadcast Extended Neighbor List Message ENLM 1110 broadcast Status Request Message STRQM 1111 General signaling Service Redirection Message SRDM 10000 General signaling General Page Message GPM 10001 General signaling Global Service Redirection Message GSRDM 10010 Broadcast TMSI Assignment Message TASM 10011 General signaling PACA Message PACAM 10100 General signaling Extended Channel Assignment Message ECAM 10101 General signaling General Neighbor List Message GNLM 10110 broadcast User Zone Identification Message UZIM 10111 broadcast Private Neighbor List Message PNLM 11000 broadcast Reserved N/A 11001 N/A Extended Global Service Redirection Message EGSRM 11010 broadcast Extended CDMA Channel List Message ECCLM 11011 broadcast Sync Channel Message SCHM 1 sync User Zone Reject Message UZRM 11100 General signaling ANSI-41 System Parameters Message A41SPM 11101 broadcast MC-RR Parameters Message MCRRPM 11110 broadcast ANSI-41 RAND Message A41RANDM 11111 broadcast Enhanced Access Parameters Message EAPM 100000 broadcast Universal Neighbor List Message UNLM 100001 broadcast Security Mode Command Message SMCM 100010 broadcast Universal Page Message UPM 100011 General signaling

4 Table 3.2.2.2.1.2-1. MSG_TYPE Values for Regular PDUs on f-dsch MSG_NAME MSG_TAG MSG_TYPE binary Order Message ORDRM 1 Authentication Challenge Message AUCM 10 Alert With Information Message AWIM 11 Data Burst Message DBM 100 Analog Handoff Direction Message AHDM 110 In-Traffic System Parameters Message ITSPM 111 Neighbor List Update Message NLUM 1000 Send Burst DTMF Message BDTMFM 1001 Power Control Parameters Message PCNPM 1010 Retrieve Parameters Message RTPM 1011 Set Parameters Message STPM 1100 SSD Update Message SSDUM 1101 Flash With Information Message FWIM 1110 Mobile Station Registered Message MSRM 1111 Status Request Message STRQM 10000 Extended Handoff Direction Message EHDM 10001 Service Request Message SRQM 10010 Service Response Message SRPM 10011 Service Connect Message SCM 10100 Service Option Control Message SOCM 10101 TMSI Assignment Message TASM 10110 Service Redirection Message SRDM 10111 Supplemental Channel Assignment Message SCAM 11000 Power Control Message PCNM 11001 Extended Neighbor List Update Message ENLUM 11010 Candidate Frequency Search Request Message CFSRQM 11011 Candidate Frequency Search Control Message CFSCNM 11100 Power Up Function Message PUFM 11101 Power Up Function Completion Message PUFCM 11110 General Handoff Direction Message GHDM 11111 Resource Allocation Message RAM 100000 Extended Release Message ERM 100001 Universal Handoff Direction Message UHDM 100010 Extended Supplemental Channel Assignment Message ESCAM 100011 Mobile Assisted Burst Operation Parameters Message MABOPM 100100 User Zone Reject Message UZRM 100101 User Zone Update Message UZUM 100110 Call Assignment Message CLAM 100111 Extended Alert With Information Message EAWIM 101000

5 DS-41 Inter-system Transfer Message D41ISTM 101001 Extended Flash With Information Message EFWIM 101010 Security Mode Command Message SMCM 101011

Table 2.1.1.4.1.1.2-1. MSG_ID values on r-csch MSG_NAME MSG_TAG MSG_TYPE binary Registration Message RGM 1 Order Message ORDM 10 Data Burst Message DBM 11 Origination Message ORM 100 Page Response Message PRM 101 Authentication Challenge Response Message AUCRM 110 Status Response Message STRPM 111 TMSI Assignment Completion Message TACM 1000 PACA Cancel Message PACNM 1001 Extended Status Response Message ESTRPM 1010 Reserved N/A 1011 Reserved N/A 1100 Device Information Message DIM 1101 Security Mode Request Message SMRM 1110 Data Burst Response Message DBRM 1111

Table 2.2.1.2.1.2-1. MSG_TYPE Values for Regular PDUs on r-dsch MSG_NAME MSG_TAG MSG_TYPE binary Order Message ORDM 1 Authentication Challenge Response Message AUCRM 10 Flash With Information FWIM 11 Data Burst Message DBM 100 Pilot Strength Measurement Message PSMM 101 Power Measurement Report Message PMRM 110 Send Burst DTMF Message BDTMFM 111 Status Message STM 1000 Origination Continuation Message ORCM 1001 Handoff Completion Message HOCM 1010 Parameters Response Message PRSM 1011 Service Request Message SRQM 1100 Service Response Message SRPM 1101

6 Service Connect Completion Message SCCM 1110 Service Option Control Message SOCM 1111 Status Response Message STRPM 10000 TMSI Assignment Completion Message TACM 10001 Supplemental Channel Request Message SCRM 10010 Candidate Frequency Search Response Message CFSRSM 10011 Candidate Frequency Search Report Message CFSRPM 10100 Periodic Pilot Strength Measurement Message PPSMM 10101 Outer Loop Report Message OLRM 10110 Resource Request Message RRM 10111 Extended Release Response Message ERRM 11000 Enhanced Origination Message EOM 11010 Extended Flash With Information Message EFWIM 11011 Extended Pilot Strength Measurement Message EPSMM 11100 Extended Handoff Completion Message EHOCM 11101 Resource Release Request Message RRRM 11110 Security Mode Request Message SMRM 11111 Data Burst Response Message DBRM 100000 DS-41 Inter-system Transfer Message D41ISTM 100001 User Zone Update Request UZURM 100010 Call Cancel Message CLCM 100011 Device Information Message DIM 100100

② ★ SIN, NID Obiective : To help roaming Roaming condition : When SINs,NIDs mobile registered don’t match NID, SID received. Classification : Home only, NID roamer, SID roamer (Simply ; SID = service provider idenfication number, SKT 011, STI 017, KDDI 090) NID = MSC idenfication number ※ If NID=65535, Mobile don’t execute NID roaming. (To protect frequent roaming)

SID=0 SID=2

NID=A NID=B

SID=1 SID=3 SID=4

1.2 General Page Message

2001 Feb 5 07:46:54.201 PAGING CHANNEL -- General Page Msg (vol5. 3.7.2.3.2.17) protocol_rev = 6 (IS2000) chan_type = 1 (Paging)

7 chan pc_msg gen prot_disc = 0 msg_id = 17 gen_page config_msg_seq = 6  ① acc_msg_seq = 1  ② class_0_done = 1  If GPM have information for class0 IMSI mobile, value is “1”. class_1_done = 1  If GPM have information for class1 IMSI mobile, value is “1”. tmsi_done = 1 ordered_tmsis = 0 broadcast_done = 1 add_length = 0 num_pages = 1 (0x1)  Available paging CH number gen_page[0] page_class = 0  Mobile do registration by class0 IMSI. page_subclass = 3  ③ Including IMSI11_12,MCC.IMSI_S, (See vol4 3.1.2.2.1.1.1.2-1) rec format3 msg_seq = 0 mcc = 349 (0x15d)  Mobile Country Code (3 digits fixed) SK Telecom value 450(349+111) imsi_11_12 = 99  99+11’00 ‘Mobile Network Code Now, SKT:’00’, STI: ‘22’ imsi_s[HI] = 3  ④ imsi_s[LO] = 2219332107 special_service = 1  Ask service_option. ★service_option = 3 (0x3)  ⑤ Ask EVRC voice service.

Consideration 1 Whenever system changes the message, the value should increase by the rest of “CONFIG_SEQ/64”. ② Whenever BTS changes Access_para, BTS shall increases ACC_CONFIG_SEQ by the rest of “ACC_CONFIG_SEQ/64”. ③ If PAGE_SUBCLASS = 0, BTS don’t send MCC and IMSI_11_12 on General Page Msg. In this case, MCC and IMSI_11_12 use the value in Extended system parameter msg. (When BSC = Wild ON) If value = ‘3’, MCC and IMSI_11_12 use the value which Mobile have. (When BSC = Wild OFF)

④ IMSI Structure

MCC MNC MSIN

8 MCCp 2digits(Imsi_11_12p 3digits(Imsi_S2p 7digits(Imsi_S1p) ) ) 3 DIGITS NMSI

IMSI=15digits

- MCC : Mobile Country Code (3 digits fixed) - MNC : Mobile Network Code - MSIN : Mobile Station Identification Number - NMSI : National Mobile Station Identity ●IMSI type - IMSI_M : IMSI that is low 10 digit of MSIN(Mobile Station Identification Number) including MIN - IMSI_T : IMSI that have not MIN information - IMSI_O : IMSI that ME use practically in CDMA mode. - IMSI_S : IMSI that is low 10 digits of IMSI (in case of MIN based IMSI, low 10 digits is MIN . It would be said IMSI_M_S.) ●Class - Class 0 IMSI : NMSI is just 12 digits. - Class 1 IMSI : NMSI is fewer than 12 digits.

⑤ service_option table description

HEX DEC NAME DESCRIPTION

0x0001 1 VOICE_IS96A Basic Variable Rate Voice Service (IS-96A) 0x0002 2 LOOPBACK Mobile Station Loopback (IS-126) 0x0003 3 VOICE_EVRC Enhanced Variable Rate Voice Service 0x0004 4 ASYNC_DATA_PRE707 Asynchronous Data Service (IS-99) 0x0005 5 G3_FAX_PRE707 Group 3 FAX Service (IS-99) 0x0006 6 SMS Short Message Services (IS-637) 0x0007 7 PPP_PKT_DATA_PRE707 Internet Standard PPP Packet Data Service (IS-657) 0x0009 9 LOOPBACK_13K Mobile Station Loopback (IS-126) 0x000C 12 ASYNC_DATA_13K_PRE707 Asynchronous Data Service (IS-99) over Rate set 2 0x000D 13 G3_FAX_13K_PRE707 Group 3 FAX Service (IS-99) over Rate set 2 0x000E 14 RS2_SMS Short Message Services using Mux Option 2 (TSB-79) 0x000F 15 PPP_PKT_DATA_13K_PRE707 Internet Standard PPP Packet Data Service (IS-657) over Rate set 2 0x0011 17 VOICE_13K_IS733 High Rate Voice Service (13 kbps) IS-733 0x0012 18 RS1_OTAPA Over The Air Parameter Administration over Rate set 1 0x0013 19 RS2_OTAPA Over The Air Parameter Administration over Rate set 2 0x0014 20 ANALOG_FAX_RS1 Analog End to End Fax(IS-707A) 0x0015 21 ANALOG_FAX_RS2 Analog End to End Fax(IS-707A)

9 0x0016 22 MDR_PKT_DATA_FRS1_RRS1 High Speed Data PPP Packet Data Service (IS-707A) with rate set 1 forward and reverse. Default Mux = 9 forward 1 reverse 0x0017 23 MDR_PKT_DATA_FRS1_RRS2 High Speed Data PPP Packet Data Service(IS-707A) with rate set 1 forward and rate set 2 reverse. Default Mux = 9 forward 2 reverse. This SO is not support by MSM3000. 0x0018 24 MDR_PKT_DATA_FRS2_RRS1 High Speed Data PPP Packet Data Service(IS-707A) with rate set 2 forward and rate set 1 reverse. Default Mux = 10 forward 1 reverse. This SO is not support by MSM3000. 0x0019 25 MDR_PKT_DATA_FRS2_RRS2 High Speed Data PPP Packet Data Service(IS-707A) with rate set 2 forward and reverse. Default Mux = 10 forward 2 reverse 0x0021 33 PPP_PKT_DATA_3G CDMA2000 Packet Service Option

Example) KDDI system

Extended System Parameters [ 14:22:56.841 ] Paging Channel [ 13:57:11.941 ] Paging Channel PROTOCOL_REV : 6 PROTOCOL_REV : 0 General Page Extended System Parameters MSG_TYPE: 17 MSG_TYPE: 13 CONFIG_MSG_SEQ: 6 PILOT_PN: 426 ACC_MSG_SEQ: 6 CONFIG_MSG_SEQ: 6 CLASS_0_DONE: 1 DELETE_FOR_TMSI: 0 CLASS_1_DONE: 1 USE_TMSI: 0 TMSI_DONE: 0 PREF_MSID_TYPE: 3 ORDERED_TMSIS: 0 MCC: 1023 BROADCAST_DONE: 1 IMSI_11_12: 127 -> 38 ADD_LENGTH: 0 TMSI_ZONE_LEN: 1 ADD_PFIELD: TMSI_ZONE: 0 PAGE_CLASS: 0 BCAST_INDEX: 0 PAGE_SUBCLASS: 0 (See Consideration ② ) MSG_SEQ: 0 22 00 07 10 C0 26 D1 4C 1A 43 82 00 16 0D D5 0C IMSI_S[HI]: 0 7F FF F1 00 00 60 34 86 10 00 02 AE 80 00 11 F5 IMSI_S[LO]: 1498998646 8C 72 -> MIN : 019-0466-9997 Special_Service: 1

10 Service_Option: 33(0x0021)

1C 00 07 10 40 06 A1 28 2D 43 82 00 10 11 18 6C 80 00 2C AC 73 BB 40 08 4 0 0A 27 2A

★ Telephone Number calculation

00 2C AC 73 BB 40 08 4 (= 0001011001 0101100011 1001 1101110110 )

Number : 019-0466-9997

IMSI-S2 IMSI-S1

First 3 Second 3 Thousands Last 3 Digits Digits Digit Digits IMSI_S Digits *** *** * ***

Bits 10s 10s 4 10s

IMSI_T is fewer than 10 digits. Thus, 019-0466-9997 become 190 – 466 – 9 –997.

1st : 1*100 + 9*10 + 10 *1 –111 = 89 = 00 0101 1001 2nd : 4*100 + 6*10 + 6 –111 = 355 = 01 0110 0011 3rd : 9 = 1010 (BCD code) 4th : 997 = 9*100 + 9*10 + 7 –111 = 886 = 11 0111 0110

result ; 0001011001 0101100011 1101110110

imsi_s[HI](2bits) imsi_s[LO] (32 bit)

1.3 Neighbor List Message

2001 Feb 5 07:46:53.022 PAGING CHANNEL -- Neighbor List Msg protocol_rev = 6 (IS2000) (Vol5. 2.6.2.2.3, 3.7.2.3.2.3) chan_type = 1 (Paging) chan pc_msg gen prot_disc = 0 msg_id = 3

11 nghbr pilot_pn = 188 (0xbc) <- Decimal 188 (HEXA bc), config_msg_seq = 6 ★ pilot_inc = 2 <- Mobile only checks Remain Set by a multiple of pilot_inc. (Range: 1~15 integer) num_nghbrs = 19 (0x13) <- PN 188 Neighbor List 19EA nghbr[0] <- First Neighbor on neighbor lists nghbr_config = 0 (Config Same) <- ① If value=0, mobile receives Paging in same CDMA channel for neighbor. (range 0~3). See. Table 3.7.2.3.2.3-1 nghbr_pn = 356 (0x164) nghbr[1] nghbr_config = 0 (Config Same) nghbr_pn = 454 (0x1c6) nghbr[2] nghbr_config = 0 (Config Same) nghbr_pn = 274 (0x112) nghbr[3] nghbr_config = 0 (Config Same) nghbr_pn = 20 (0x14) nghbr[4] nghbr_config = 0 (Config Same) nghbr_pn = 466 (0x1d2) nghbr[5] nghbr_config = 0 (Config Same) nghbr_pn = 352 (0x160) nghbr[6] nghbr_config = 0 (Config Same) nghbr_pn = 232 (0xe8) nghbr[7] nghbr_config = 0 (Config Same) nghbr_pn = 442 (0x1ba) nghbr[8] nghbr_config = 0 (Config Same) nghbr_pn = 286 (0x11e) nghbr[9] nghbr_config = 0 (Config Same) nghbr_pn = 106 (0x6a) nghbr[10] nghbr_config = 0 (Config Same) nghbr_pn = 58 (0x3a) nghbr[11] nghbr_config = 0 (Config Same) nghbr_pn = 200 (0xc8) nghbr[12] nghbr_config = 0 (Config Same)

12 nghbr_pn = 492 (0x1ec) nghbr[13] nghbr_config = 0 (Config Same) nghbr_pn = 118 (0x76) nghbr[14] nghbr_config = 0 (Config Same) nghbr_pn = 16 (0x10) nghbr[15] nghbr_config = 0 (Config Same) nghbr_pn = 400 (0x190) nghbr[16] nghbr_config = 0 (Config Same) nghbr_pn = 192 (0xc0) nghbr[17] nghbr_config = 0 (Config Same) nghbr_pn = 250 (0xfa) nghbr[18] nghbr_config = 0 (Config Same) nghbr_pn = 386 (0x182)

Consideration

① nghber_config = 000 : Same paging channel number, Same CDMA Ch (FA) nghber_config = 001 : Primary paging paging channel number, Same CDMA Ch (FA) nghber_config = 010 : Primary paging channel number, First CDMA Ch on serving FA nghber_config = 011 : Transit initial state

1.4 CDMA Channel List Message

2001 Feb 5 07:46:53.082 PAGING CHANNEL -- CDMA Channel List Msg protocol_rev = 6 (IS2000) (See Vol5. 2.6.2.2.4 and 3.7.2.3.2.4) chan_type = 1 (Paging) chan pc_msg gen prot_disc = 0 msg_id = 4 chnlist pilot_pn = 188 (0xbc) config_msg_seq = 6 <- Ignore it if Chan_Lst_Msg_Seq value in mobile equal to this value. (See Vol5. 3.6.2.2) num_freq = 1 (0x1) <- Now, serving FA total numbers (Channel List number) ★cdma_freq[0] = 29 (0x1d) <- 29 = channel number (Center frequency = (0.03*29)+870 Mhz)

1.5 Extended System Parameters Message

2001 Feb 5 07:46:53.181 PAGING CHANNEL -- Extended System Parameters Msg protocol_rev = 6 (IS2000) (See Vol5. 2.6.2.2.5, 3.7.2.3.2.13) chan_type = 1 (Paging) chan pc_msg gen prot_disc = 0 msg_id = 13 ext_sysparm pilot_pn = 188 (0xbc) config_msg_seq = 6 <- Ignore it if Ext_Sys_par_Msg_Seq value in mobile is equal to this value. Update it if Ext_Sys_par_Msg_Seq value in mobile don’t be equal to this value. delete_for_tmsi = 0 <- Delete foreign TMSI. If TMSI_ZONE assigns other TMSI zone, BTS makes mobile delete the own TMSI. pref_msid_type = 3 <- Preferred Access Channel Mobile Station Identifier Type Value = 3, mobile use IMSI and ESN in access channel. (See Table 3.7.2.3.2.13-1) mcc = 349 (0x15d) <- ① Mobile Country Code, (See 2.3.1) imsi_11_12 = 99 <- 11th and 12th digits for the IMSI, (See 2.3.1) tmsi_zone_len = 0 ② <- TMSI_ZONE_LENGTH, Range 1~8 octet (Shall include TMSI_ZONE) tmsi_zone[HI] = 0 <- TMSI zone number tmsi_zone[LO] = 0 bcast_index = 0 <- Broadcast slot cycle index, If value = 0, it don’t execute broadcast paging. Range (1 ~ 7), See. Vol5. 2.6.1.1.3.3 is95b_incl = 1 imsi_t_supported = 0 <- If system supports 15-digit IMSI_T addressing, set the field= 1. p_rev = 6 min_p_rev = 1 <- If Mob_P_Rev that mobile can support is upper than minimum protocol revision supported by BTS, record parameter. ★soft_slope = 0 <- See Vol5. 2.6.6.2.3, 2.6.6.2.5.2 ★add_intercept = 0 <- See Vol5. 2.6.6.2.3, 2.6.6.2.5.2 ★drop_intercept = 0 <- See Vol5. 2.6.6.2.3, 2.6.6.2.5.2 packet_zone_id = 0 <- System don’t concern packet data service zone. max_num_alt_so = 0 <- Maximum number of alternative service options reselect_included = 0 <- In case value =0, BTS don’t include system reselection parameter. pilot_report = 0 <- If value=0, mobile reports additional pilot exceeding T_ADD by Origination Message and Page Response Message only. If value = 1, mobile uses all Access Channel messages to report pilot(s) exceeding T_ADD. nghbr_set_entry_info = 0 <- Neighbor Set access entry handoff information included indicator. Set ‘1’, if message has “TS Neighbor Set access entry handoff”. Set ‘0’. If message has not. nghbr_set_access_info = 0 <- Neighbor Set access handoff included indicator, Set‘1’,if BTS has information

14 about “Neighbor Set access handoff” or “access probe handoff”. Set ‘0’, BTS don’t have. is2000_incl = 1 broadcast_gps_asst = 0 <- Value = 1, if system support Broadcast GPS Assist capability. ★qpch_supported = 0 <- Value=0, if system don’t support Quick Paging Channel. sdb_supported = 1 <- Value=1, if Mobile allow to send Short Data Burst. rlgain_traffic_pilot = 0 <- In case of RC > 2, if Reverse Traffic Channel adjusts Reverse Pilot Channel gain, set the value = 1. (See Vol2. 2.1.2.3.3) rev_pwr_cntl_delay_incl = 0 <- If this message include Rev_Pwr_Cntl_Delay field, set value=1. is2000_relA_incl = 0 enc_supported_incl = 1 enc_supported = 0 <- Set ‘1’, if it includes field related on Encryption. is2000_relA_last2_incl = 1 use_sync_id = 0 cs_supported = 0

Consideration

MCC MNC MSIN

3 digits NMSI IMSI (15 digits) ① MCC Mobile Country Code MNC Mobile Network Code MSIN Mobile Station Identifier Number NMSI National Mobile Station Identity IMSI International Mobil Station Identity

Figure 2.3.1-1. IMSI Structure

② TMSI (Temporary Mobile Station Identity) This code doesn’t have any relationship with IMSI, ESN. BTS assigns TMSI for termination call. Full TMSI = INSI_CODE (2,3, or 4 octet) + TMSI_ZONE (1~8 octet).

15 ★ Extended system parameter in KDDI Motorola system

[ 14:22:51.101 ] Paging Channel PROTOCOL_REV : 6 Extended System Parameters

MSG_TYPE: 13 PILOT_PN: 426 CONFIG_MSG_SEQ: 6 DELETE_FOR_TMSI: 0 USE_TMSI: 0 PREF_MSID_TYPE: 3 MCC: 1023 IMSI_11_12: 127 -> 38 TMSI_ZONE_LEN: 1 TMSI_ZONE: 0

16 BCAST_INDEX: 0 IMSI_T_SUPPORTED: 0 P_REV: 6 MIN_P_REV: 3 SOFT_SLOPE: 18 ADD_INTERCEPT: 6 DROP_INTERCEPT: 4 PACKET_ZONE_ID: 0 MAX_NUM_ALT_SO: 0 RESELECTED_INCLUDED: 0 PILOT_REPORT: 0 NGHBR_SET_ENTRY_INFO: 0 NGHBR_SET_ACCESS_INFO: 0 BROADCAST_GPS_ASST: 0 QPCH_SUPPORTED: 1 (1 = Quick channel “on”) NUM_QPCH: 1 (If QPCH_SUPPORTED = 1, UNM_QPCH shall not be “00”) Quick- QPCH_RATE: 0 (0 = 4800 bps, 1=9600 bps) Paging ★QPCH_POWER_LEVEL_PAGE: 5 (If QPCH_SUPPORTED = 1, message shall contain this message) ---ⓐ QPCH_CCI_SUPPORTED: 1 (If QPCH_SUPPORTED = 1, message shall contain this message. Set ‘1’,if system support configuration change) QPCH_PWR_LVL_CFG: 5 ---ⓐ SDB_SUPPORTED: 0 (Set ‘1’, if system supports “short data burst”) MAC_CF_SUPPORTED: 0 RLGAIN_TRAFFIC_PILOT: 0.00 Reverse Pilot power control RC2 above. (0.123dB unit) See 2.1.2.3.3. RSCH REV_PWR_CNTL_DELAY_INCL: 0

ⓐ Table 3.7.2.3.2.13-3 Quick Paging Channel Transmit Power Level

Quick_POWER_LEVEL_PAGE Transmit Power Level QUICK_POWER_LEVEL_CONFIG (binary) 000 5dB below the Pilot Channel Transmit Power 001 4dB below the Pilot Channel Transmit Power 010 3dB below the Pilot Channel Transmit Power 011 2dB below the Pilot Channel Transmit Power 100 1dB below the Pilot Channel Transmit Power 101 Same as dB the Pilot Channel Transmit Power

17 110 1dB above the Pilot Channel Transmit Power 111 2dB above the Pilot Channel Transmit Power

Table 2.1.2.3.3.2-1 Reverse link Nominal Attribute Gain Table (Part 1 of 2)

Data Rate Frame length Coding Nominal_Arrtibute_Gain Pilot_Reference_level (bps) (ms) 1,500 20 Convolution -47 0 2,700 20 Convolution -22 0 4,800 20 Convolution -2 0 9,600 20 Convolution 30 0 9,600 (RC3,5) 5 Convolution 58 0 1,800 20 Convolution -42 3 3,600 20 Convolution -13 3 7,200 20 Convolution 15 3 14,400 20 Convolution 44 3 9,600 (RC4, 6) 5 Convolution 54 3 19,200 20 Convolution 50 1 38,400 20 Convolution 60 11 76,800 20 Convolution 72 21 153,600 20 Convolution 84 36 307,200 20 Convolution 96 54 614,400 20 Convolution Not Specified Not Specified 28,800 20 Convolution 56 11 57,600 20 Convolution 72 18 115,200 20 Convolution 80 32 230,400 20 Convolution 88 46 460,800 20 Convolution Not Specified Not Specified 1,036,800 20 Convolution Not Specified Not Specified All 40 or 80 Convolution Not Specified Not Specified

18 Table 2.1.2.3.3.2-1 Reverse link Nominal Attribute Gain Table (Part 1 of 2)

Data Rate Frame length Coding Nominal_Arrtibute_Gain Pilot_Reference_level (bps) (ms) 19,200 20 Turbo 44 2 38,400 20 Turbo 56 10 76,800 20 Turbo 68 10 153,600 20 Turbo 76 33 307,200 20 Turbo 88 50 614,400 20 Turbo Not Specified Not Specified 28,800 20 Turbo 52 9 57,600 20 Turbo 64 19 115,200 20 Turbo 76 29 230,400 20 Turbo 88 39 460,800 20 Turbo Not Specified Not Specified 1,036,800 20 Turbo Not Specified Not Specified All 40 or 80 Not Specified Not Specified

1.6 General Neighbor List Message

2001 Feb 5 07:46:53.403 PAGING CHANNEL -- General Neighbor List Msg protocol_rev = 6 (IS2000) chan_type = 1 (Paging) chan pc_msg gen prot_disc = 0 msg_id = 22 gen_nghbr pilot_pn = 188 (0xbc) config_msg_seq = 6 pilot_inc = 2 nghbr_srch_mode = 0 nghbr_config_pn_incl = 0 freq_fields_incl = 0 use_timing = 0 num_nghbr = 19 nghbr[0] nghbr[1] nghbr[2] nghbr[3]

19 nghbr[4] nghbr[5] nghbr[6] nghbr[7] nghbr[8] nghbr[9] nghbr[10] nghbr[11] nghbr[12] nghbr[13] nghbr[14] nghbr[15] nghbr[16] nghbr[17] nghbr[18] num_analog_nghbr = 0 is2000_incl = 1 srch_offset_incl = 0 add_nghbr[0] add_pilot_rec_incl = 0 add_nghbr[1] add_pilot_rec_incl = 0 add_nghbr[2] add_pilot_rec_incl = 0 add_nghbr[3] add_pilot_rec_incl = 0 add_nghbr[4] add_pilot_rec_incl = 0 add_nghbr[5] add_pilot_rec_incl = 0 add_nghbr[6] add_pilot_rec_incl = 0 add_nghbr[7] add_pilot_rec_incl = 0 add_nghbr[8] add_pilot_rec_incl = 0 add_nghbr[9] add_pilot_rec_incl = 0 add_nghbr[10] add_pilot_rec_incl = 0 add_nghbr[11] add_pilot_rec_incl = 0 add_nghbr[12] add_pilot_rec_incl = 0

20 add_nghbr[13] add_pilot_rec_incl = 0 add_nghbr[14] add_pilot_rec_incl = 0 add_nghbr[15] add_pilot_rec_incl = 0 add_nghbr[16] add_pilot_rec_incl = 0 add_nghbr[17] add_pilot_rec_incl = 0 add_nghbr[18] add_pilot_rec_incl = 0

1.7 System Parameters Message

2001 Feb 5 07:46:53.981 PAGING CHANNEL -- System Parameters Msg (See Vol5. 2.6.2.2.1 and 3.7.2.3.2.1) <- If “PAGE_CHAN, REG_PRD, BASE_LAT, BASE_LONG, or PWR_REP_THRESH” are out range designated (See. 3.7.2.3.2.1), Mobile shall ignore “system parameters Message” that include their. protocol_rev = 6 (IS2000) chan_type = 1 (Paging) chan pc_msg gen prot_disc = 0 msg_id = 1 sysparm pilot_pn = 188 (0xbc) (12032 PN chips) config_msg_se q = 6 <- When mobile receives “System Parameters” thru paging channel, mobile shall compare “configuration message sequence number”, “CONFIG_MSG_SEQr, SYS_PAR_MSG_SEQs” with stored value. If values compared are same, mobile may ignore the message. If values compared aren’t same, mobile shall process the remain field. (Detail processes are there “2.6.2.2.1.1, 2.6.2.2.1.2, 2.6.2.2.1.3, 2.6.2.2.1.4, 2.6.2.2.1.5, and 2.6.2.2.1.6) ★sid = 2236 (0x8bc) <- System identification, (See Vol5. 2.6.5.2) ★nid = 113 (0x71) <- Network identification. It is supplied by “system sub-identifier”. (See Vol5. 2.6.5.20) ★reg_zone = 1 (0x1) <- Registration zone number, (See Vol5. 2.6.5.1.5) ★total_zones = 2 (unknown) <- zone number that mobile have for zone-based registration. . Sets ‘0’, if zone-based registration is disable. If we set value high, advantage is that mobile can save battery consumption, but disadvantage is that probability to receiving 1st paging get low in zone boundary. (See Vol5. 2.6.5.1.5) ★zone_timer = 1 (2 Minutes) <- zone timer registration length, Vol5. Table 3.7.2.3.2.1-1

21 mult_sids = 1 <- Set ‘1’, if mobile stores SID_NID_List that have different SID. Set ‘0’,if not. mult_nids = 1 <- Set ‘1’, if mobile stores SID_NID_List that have different NID, Set “0’,if not. base_id = 2 (0x2) base_class = 0 (Public Macrocellular System) <- ① BTS type,(0 means public macrocellular system) page_chan = 1 <- paging channel count. ★max_slot_cycle_index = 2 <- See. Vol5. 2.6.2.1.1 home_reg = 1 <- See. Page 25 for_sid_reg = 1 <- See. Page 25 for_nid_reg = 1 <- See. Page 25 power_up_reg = 1 <- When mobile power ‘on’, or try roaming from analog system, do registration. power_down_reg = 1 <- When mobile power ‘off’ parameter_reg = 1 ③ reg_prd = 64 (5242.88 Seconds, REG_COUNT_MAX = [2 reg_prd/4]*0.08). In case value=0,reg_prd is off. base_lat = 539805 ② base_long = 1829097 ② reg_dist = 0 (0x0) ② (Distance Based Registration DISABLED) ★srch_win_a = 9 (80 PN Chips) ★srch_win_n = 10 (100 PN Chips) ★srch_win_r = 10 (100 PN Chips) ★nghbr_max_age = 1 ★pwr_rep_thresh = 2 <- (Send PMRM, if mobile receive 2 error frames) ★pwr_rep_frames = 7 <- (56 Frames=2(pwr_ref_frames/2)*5) ★pwr_thresh_enable = 1 <- (1: threshold basis report on) ★pwr_period_enable = 0 <- (0: period report off) ★pwr_rep_delay = 5 <-(After sending PMRM, new period starts 21th frame (after delaying 20 frames) rescan = 0 ★t_add = 28 ★t_drop = 32 ★t_comp = 5 ★t_tdrop = 3 ext_sys_parameter = 1 <- Set number #1, if Extended system parameters message exists. ext_nghbr_list = 0 <- Set #1, if extended neighbor list message is sent by paging channel. Set #0, if BTS uses Band Class 0. gen_nghbr_list = 1 <- Set #1, if General Neighbor List Message is sent by paging channel. global_redirect = 0 <- Set #1, if Global Service Redirection Message is sent by paging channel. is2000_incl = 1 pri_nghbr_list = 0 <- Set #1, if Private Neighbor List Message is sent by paging channel. user_zone_id = 0 <- Set #1, if User Zone Identification Message is sent by paging channel.

ext_global_redirect = 0 <- Set #1, if Extended Global Service Redirection is sent by paging channel. ext_chan_list = 0 <- Set #1, if Extended CDMA Channel List Message is sent by Paging Channel.

22 Consideration ①

Table 3.7.2.3.2.1-2. Base Station Classes

Value Class of Service Provided (binary)

0000 Public Macrocellular System

0001 Public PCS System All other values are reserved.

 (lat)2 (long)2  ② Dis tan ce    16    lat = BASE_LAT (present location) – BASE_LAT_REG (previous registration location)  long = (BASE_LAT (present location) – BASE_LAT_REG (previous registration location)) × cos (π/180 × BASE_LAT_REG/14400)

③ When these parameter are changed; SLOT_SYCLE_INDEX, SCM, MOB_TERM_HOME (MOB_TERM_FOR_SID, MOB_TERM_FOR_NID). And, when NID, SID value received doesn’t locate on SID_NID_LIST mobile have. (As usual, when SLOT_CYCLE_INDEX, SID_NID_LIST change, registration procedure is done.)

★ Registration Zone Base registration Conditions 1.Mobile has 7-zones_maximum. (Total_zone) 2.Mobile stores “reg_zone, SID, NID of each zone”.

Operation 1.Mobile has been comparing Zone_list information registered and system_para message received. 2.If mobile receive new zone_list, mobile store it and start registration. If mobile receive stored zone_list, mobile ignore it. 3.Stored zone_list has timer, thus All zone_lists will be deleted after designated time.

Example) Total zone = 1 case:

Do registration Zone Zone A B

23 Mobile have only one zone_list. Whenever mobile move zone A to zone B, zone B to zone A, The mobile starts registration. Thus mobile become a ping-pong state. Disadvantage: reverse noise and system overload Advantage: Sure registration.

Example) Total zone = 2 case:

Registration Registration After timer Expire Zone Zone A B

First, when mobile move zone A to zone B, do registration. Second, when mobile return zone A, don’t registration until time expired. Third, When time expire, mobile start registration at zone A. Disadvantage: Increase 1st paging fail. (50% at boundary) Advantage: Reduce system overload. (MSC, VLR), reverse noise.

No. Mobile Location Mobile stored Zone_list Remark 1 Zone A Zone A 2 Zone B Zone A, B Do Registration 3 Zone A (Return) Zone A, B Don’t Registration 4 Zone A (Return) Zone B Zone_timer expire 5 Zone A (Return) Zone A, B Do Registration

Table 3.7.2.3.2.1-1 Value of Zone Timer

Zone_Timer Timer Length Value (Binary) (Miniute) 000 1 001 2 010 5

24 011 10 100 20 101 30 110 45 111 60

Parameter registration

Objective: At MSC boundary, It help registration, when mobile receive new SID, NID comparing Zone_list stored. MSC/VLR stores location information. HLR updates it and delete previous MSC/VLR information.

No Set Parameter Mobile Operation Multi_sids Muti_nids Total_zone 1 Yes (=1) Yes (=1) 1 Do registration 2 No (=0) No (=0) 1 Do registration 3 No (=0) No (=0) 2 Do registration 4 Yes (=1) Yes (=1) 2 After zone_timer expiring, do resistration.

Registration basic setting

No Parameter Contents Remarks 1 HOME_REG 2 FOR_SID_REG Mobile stores 4-SID/NID pairs. If set value=1, mobile don’t execute registration (Although it receive new SID.). Now, Because SK Telecom has multi SID, value must be “1”. 3 FOR_NID_REG As usual, NID mobile has is 65535 (Home), thus system shall set “1”.

1.8 Access Parameters Message

2001 Feb 5 07:46:54.141 PAGING CHANNEL -- Access Parameters Msg protocol_rev = 6 (IS2000) (See Vol5. 2.6.2.2.2 and 3.7.2.3.2.2) chan_type = 1 (Paging) chan pc_msg gen prot_disc = 0 msg_id = 2 accparm

25 pilot_pn = 188 (0xbc) acc_msg_seq = 1 <- After comparing exist value with new acc_msg_seq received, update it if two values are not same. acc_chan = 0 <- Access channel number related on paging channel. ★nom_pwr = 0 <- Nominal transmit power offset. At doing open loop power estimate, correction factor is used by mobile. (-8dB ~ +7dB) ★init_pwr = 5 <- 5dB, Initial power offset for access. Correction factor used by mobile at beginning of open loop power estimation for initial Access Channel transmission. (-16dB ~ +15dB) ★pwr_step = 6 <- 6dB, power interval between probes until mobile access successfully. ★num_step = 5 <- During single access probe sequence, access probe number that mobile transmits. ★max_cap_sz = 3 ① <- Maximum Access Channel message capsule size, 0 ~ 7 ★pam_sz = 3 ① <- Access Channel preamble length. Mobile sets lower value than access frame counts that each Access Channel preamble can transmit. psist_0_9 = 0 psist_10 = 0 <- test mobile station psist_11 = 0 <- emergency mobile station psist_12 = 0 psist_13 = 0 psist_14 = 0 psist_15 = 0 msg_psist = 0 <- Persistence modifier for Access Channel attempts for message transmissions, (Mobile uses 2-msg_psist unit to improve transmit probability.) reg_psist = 0 <- Persistence modifier for Access Channel attempts for registrations which are not responses to the Registration Request Order, (Mobile uses 2-reg_psist unit to go up transmit probability.) ★probe_pn_ran = 0,②<-Time randomization for Access Channel probes, 0 ~ 9 (RN max = 2probe_pn_ran –1) acc_tmo = 5 ②<- After transmitting each access probe, mobile waits for BTS response during duration (TA=(2+ACC_TMO)*80ms) from end of slot. probe_bkoff = 0 ②<- When Mobile don’t receive “access probe ack”, transmit access probe again with additional back off delay (RT = 0 ~ probe_bkoff+1 slot). bkoff = 1 ②<- RS that all access probe sequence have 0 ~ 1+BKOFF slot. backoff delay happens pseudorandomly. ★max_req_seq = 2 <- When mobile requests thru Access Channel, 2 mean maximum number of access probe sequence

★max_rsp_seq = 2 <- When mobile response thru Access Channel. 2 mean maximum number of access probe sequence. auth = 0 nom_pwr_ext = 1 <- Extended nominal transmit power, Set 0, if mobile operates Band Class 0. psist_emg_incl = 0 <- Emergency persistence included indicator, Set 0, parameter don’t include PSIST_EMG.

① Access channel slot = (3+max_cap_size) + (1+pam_size) frame unit 1 frame preamble = 96 EA zero Case study) If many subscribers stay near by BTS, small preamble value increases access failure probability. And, big preamble value reduces payload data, BTS shall increase search window size.

② Objective : To prohibit the collision because mobile send a message randomly. probe_pn_ran : (range 0~512)*0.8138㎲ ---- ESN decides the value.

★ Power Access probe Tx= -Rx –73 +Nom_pwr +Init_pwr+ (Access Probe –1)*pwr_step 1st Tx on Reverse TCH Tx = -Rx –73 +Nom_pwr+Init_pwr+All access probe corrections 1st Power control bit receive Tx= -Rx-73+Nom_pwr+Init_pwr+All probe corrections +All close loop power control

Terminology Access probe Access sequence IP: Initial open loop power PD: persistence delay PI: Power increment RA: Access channel number RN: PN randomization delay RS: Sequence backoff RT: Probe_backoff TA: Ack response timer (80*(2+ACC_TMO)) Num_step: maximum access number of access sequence AccessAccess AttemptsAttempts 22

Access Attempt Access Probe Seq Sequence 1 Seq 2 Seq 3 Seq 4 MAX_RSP_SEQ RESPONSE (15max) System ATTEMPT Time RS RS RS

Response message ready for transmission Access Attempt Access Probe Seq Sequence 1 Seq 2 Seq 3 MAX_RSP_SEQ REQUEST (15max) ATTEMPT System Time PD RS PD RS PD

Request message ready for transmission ACCESS Probe 1+Num_Step(16max) ACCESS Probe 4 PI ACCESS Probe 3 PI ACCESS ACCESS Probe 2 PROBE PI SEQUENCE ACCESS Probe 1 IP (Initial Power) System 27 Time TA RT TA RT TA RT TA

Select Access See next Channel(RA). initialize figure transmit power AccessAccess AttemptsAttempts 33

See previous Access Channel figure Slot and Frame Boundray

ONE ACCESS CHANNEL SLOT ACCESS CHANNEL ACCESS CHANNEL PREAMBLE MESSAGE CAPSULE (Modulation Symbol 0) ACCESS System PROBE Time Access Channel Frame(20ms) 1+PAM_SZ 3+MAX_CAP_SZ (1-16 frames) (3-10 frames)

4+PAM_SZ+MAX_CAP_SZ (4-26 frames)

Actual Access Probe Transmission

PN Randomization Delay = RN chips = RN×0.8138㎲

28 [ 13:57:29.209 ] Access probe info

[ 13:57:11.581 ] Paging Channel (Motorola system logging data) PROTOCOL_REV : 0 PROTOCOL_REV : 0 Access Parameters SEQ_NUM: 1 MSG_TYPE: 2 PROBE_NUM: 1 PILOT_PN: 426 RX_AGC: 224 ACC_MSG_SEQ: 6 TX_ADJ: 0 ACC_CHAN: 0 RSIST: 1 NOM_PWR: 3 CHANNEL: 0 INIT_PWR: 29 ⓐ (-3 -> 2’complement) RANDOM_M: 0 PWR_STEP: 5 BACKOFF_RS: 0 NUM_STEP: 3 BACKOFF_RT: 0 MAX_CAP_SZ: 3 PAM_SZ: 0 PSIST(0-9): 0 PSIST(10-15): 0 0 0 0 0 0 MSG_PSIST: 0 REG_PSIST: 0 PROBE_PN_RAN: 0 ACC_TMO: 1 PROBE_BKOFF: 0 BKOFF: 0 MAX_REQ_SEQ: 2 MAX_RSP_SEQ: 3 AUTH: 0 NOM_PWR_EXT: 0 PSIST_EMG_INCL: 0

ⓐ Real value is –3. But, System sending data is 111101 (29). 2’ complement of 000011 is 111101. Positive value +3 case, mobile shows 000011.

1.9 Registration Message

2001 Feb 5 07:47:58.830 ACCESS CHANNEL -- Registration Msg (vol5. 2.7.1.3.2.1) protocol_rev = 6 (IS2000)

29 chan_type = 2 (Access) chan ac_msg gen_ac msg_type = 1 (Registration) hdr ack_seq = 7 msg_seq = 0 ack_req = 1  1: Ask ack valid_ack = 0 ack_type = 0 msid_type = 3  IMSI and ESN msid type3 esn = 3925846604 imsi imsi_class = 0 i_class zero imsi_class_0_type = 0  Include IMSI_S type zero imsi_s[HI] = 0 imsi_s[LO] = 137485978 reg auth_mode = 0  Not include authorization pilot_rpt fix active_pilot_strength = 9  vol4 2.1.1.4.1.5.1 first_is_active = 1 See Definition of Radio Environment Report Fields first_is_pta = 0 num_add_pilots = 0  Number of additional (to the pilot in the Active Set) ★reg_type = 1  ① Power-up registration, , slot_cycle_index = 2  ② mob_p_rev = 6  95C mobile, Protocol Revision of the mobile, scm = 42  ③ Station class mark, Now always ‘42’. mob_term = 1  Accept mobile terminated calls return_cause = 0  ④ Normal access qpch_supported = 1  If Mobile can support Quick Paging Channel, value=1. enhanced_rc = 1  Set ‘1’, if system supports any RC in Radio Configuration Class2. Set ‘1’, if don’t support. (See vol2.1.3.7.2-1, vol2. 2.1.3.7.2.3.1) uzid_incl = 0  If Message includes User Zone Identifier, set the value 1.

30 Consideration 1 Registration attempt origin Table 2.7.1.3.2.1-1. Registration Type (REG_TYPE) Codes REG_TYPE Type of Registration (binary)

0000 Timer-based (see 2.6.5.1.3)

0001 Power-up (see 2.6.5.1.1)

0010 Zone-based (see 2.6.5.1.5)

0011 Power-down (see 2.6.5.1.2)

0100 Parameter-change (see 2.6.5.1.6)

0101 Ordered (see 2.6.5.1.7)

0110 Distance-based (see 2.6.5.1.4)

0111 User Zone-based (see 2.6.5.1.10)

All other REG_TYPE values are reserved.

2 Mobile can designate own preferred slot cycle using Registration Message, Origination Message, or Page Response Message’ SLOT_CYCLE_INDEX. See Vol5. 2.6.2.1.1

3 Table 2.3.3-1. See Station Class Mark .Table 2.3.3-1. Station Class Mark Function Bit(s) Setting

Extended SCM Indicator 7 Band Class 0 0XXXXXXX Band Class 1 1XXXXXXX

Dual Mode 6 CDMA Only X0XXXXXX Dual Mode X1XXXXXX

Slotted Class 5 Non-Slotted XX0XXXXX Slotted XX1XXXXX

IS-54 Power Class 4 Always 0 XXX0XXXX

25 MHz Bandwidth 3 Always 1 XXXX1XXX

Transmission 2 Continuous XXXXX0XX Discontinuous XXXXX1XX

Power Class for Band 1 - 0 Class I XXXXXX00 Class 0 Analog Operation Class II XXXXXX01 Class III XXXXXX10 Reserved XXXXXX11

4 Table 2.7.1.3.2.1-2. RETURN_CAUSE Codes , Reason of the MS registration or access. Set the RETURN_CAUSE to match service redirection failure condition

31 Table 2.7.1.3.2.1-2. RETURN_CAUSE Codes RETURN_CAUS Redirect Failure Condition E (binary) 0000 Normal access. 0001 Service redirection failed as a result of system not found. 0010 Service redirection failed as a result of protocol mismatch. 0011 Service redirection failed as a result of registration rejection. 0100 Service redirection failed as a result of wrong SID. 0101 Service redirection failed as a result of wrong NID. All other RETURN_CAUSE values are reserved.

1.10 Order Message

2001 Feb 5 07:47:59.341 PAGING CHANNEL -- Order Msg protocol_rev = 6 (IS2000) (Vol5. 3.7.4 and ① Table 3.7.4-1) chan_type = 1 (Paging) chan pc_msg gen prot_disc = 0 msg_id = 7 pc_ord num_ords = 1 (0x1) ords[0] gen hdr ack_seq = 0 <- Respond msg_seq 0(registration) msg_seq = 1 ack_req = 0 valid_ack = 1 addr_type = 2 addr type2 imsi imsi_class = 0

32 i_class zero imsi_class_0_type = 0 type zero imsi_s[HI] = 0 imsi_s[LO] = 137485978 order = 16 (Base Station Acknowledgement Order)

Consideration ① See the next page

33 Table 3.7.4-1. Order and Order Qualification Codes Used on the f-csch and the f-dsch (Part 1 of 4)

Order Qual- f-csch f-dsch Order ification Code, ACTION_TIME Addi-tional Order Order Code, ORDQ (binary) can be specified Fields other ORDE than ORDQ Name/Function R (binary )

Y N 000001 00000000 N N Abbreviated Alert Order

Y Y 000010 00000000 N Y Base Station Challenge Confirmation Order (see 3.7.4.1)

N Y 000011 000000nn Y N Message Encryption Mode Order (where nn is the mode per Table 3.7.2.3.2.8-2)

Y N 000100 00000000 N N Reorder Order

N Y 000101 0000nnnn N N Parameter Update Order (where ‘nnnn’ is the Request Number)

Y Y 000110 00000000 N N Audit Order

Y N 001001 00000000 N N Intercept Order

N Y 001010 00000000 N N Maintenance Order

Y Y 010000 00000000 N N Base Station Acknowledgment Order (see [4])

N Y 010001 00000000 N N Pilot Measurement Request Order

N Y 010001 nnnnnnnn (in N Y Periodic Pilot Measurement the range of Request Order 00000001 to (see 3.7.4.6) 11111111)

Y Y 010010 0001nnnn N N Lock Until Power-Cycled Order (where nnnn is the lock reason)

Y Y 010010 0010nnnn N N Maintenance Required Order (where nnnn is the maintenance reason)

Y N 010010 11111111 N N Unlock Order

35 Order Qual- f-dsch Order ification ACTION_TIME Addi-tional f-csch Orde Code, Code, can be specified Fields Orde r ORDE ORDQ other than Name/Function r R (binary) ORDQ (binary )

N Y 010011 00000000 Y Y Service Option Request Order (Band Class 0 only) (see 3.7.4.2)

N Y 010100 00000000 Y Y Service Option Response Order (Band Class 0 only; see 3.7.4.3)

Y Y 010101 00000000 N N Release Order (no reason given)

Y Y 010101 00000010 N N Release Order (indicates that requested service option is rejected)

N Y 010110 00000000 N N Outer Loop Report Order

N Y 010111 00000000 Y N Long Code Transition Request Order (request public)

N Y 010111 00000001 Y N Long Code Transition Request Order (request private)

N Y 011001 0000nnnn N N Continuous DTMF Tone Order (where the tone is designated by ‘nnnn’ as defined in Table 2.7.1.3.2.4-4)

N Y 011001 11111111 N N Continuous DTMF Tone Order (stop continuous DTMF tone)

N Y 011010 nnnnnnnn N N Status Request Order (see 3.7.4.4)

Y N 011011 00000000 N N Registration Accepted Order (ROAM_INDI not included; see 3.7.4.5)

Order Qual- f-dsch Order ification Code, ACTION_TIME Additional f-csch Orde Code, ORDQ (binary) can be specified Fields Order r ORDE other than Name/Function R ORDQ (binar y)

Y N 011011 00000001 N N Registration Request Order

Y N 011011 00000010 N N Registration Rejected Order

Y N 011011 00000100 N N Registration Rejected Order (delete TMSI)

Y N 011011 00000101 N Y Registration Accepted Order (ROAM_INDI included; see 3.7.4.5)

Y N 011011 00000110 N Y Registration Accepted Order (ROAM_INDI, EXT_ENC_MSB, SIG_ENCRYPT_MODE, and KEY_SIZE included; see 3.7.4.5)

N Y 011101 nnnnnnnn Y N Service Option Control Order (Band Class 0 only) (the specific control is designated by ‘nnnnnnnn’ as determined by each service option)

Y Y 011110 nnnnnnnn N N Local Control Order (the specific order is designated by ‘nnnnnnnn’ as determined by each system)

Y N 011111 00000000 N N Slotted Mode Order (transition to the slotted mode operation.)

Table 3.7.4-1. Order and Order Qualification Codes Used on the f-csch and the f-dsch (Part 4 of 4)

Order Qual- f-dsch Order ification ACTION_ Additional f-csch Order Order Code, Code, TIME can Fields other ORDER ORDQ be than ORDQ Name/Function (binary) (binary) specified

Y Y 100000 00000000 N Y Retry Order (indicates that the

37 requested operation is rejected and retry delay is included, see 3.7.4.7)

All other codes are reserved.

38 Table 2.7.3-1. Order and Order Qualification Codes Used on the r-dsch and the r-csch (Part 1 of 4)

39 More r-csch r-dsch Order Order Fields Support Order Order Code, Qualification Name/Function Req’d ORDER Code, ORDQ other (binary) (binary) than ORDQ

Y Y 000010 00000000 Y Y BTS Challenge Order (see 2.7.3.1)

Y Y 000011 00000000 N Y SSD Update Confirmation Order

Y Y 000011 00000001 N Y SSD Update Rejection Order

N Y 000101 0000nnnn N Y Parameter Update Confirmation Order (where ‘nnnn’ is the Request Number)

N Y 001011 00000000 N N Request Wide Analog Service Order

N Y 001011 00000001 N N Request Narrow Analog Service Order

N Y 001011 00000010 N N Request Analog Service Order

Y Y 010000 00000000 N Y Mobile Acknowledgment Order (see TIA/EIA/IS-2000-4)

N Y 010011 00000000 Y N Service Option Request Order (Band Class 0 only) (see 2.7.3.2)

N Y 010100 00000000 Y Y Service Option Response Order (Band Class 0 only) (see 2.7.3.3)

Y Y 010101 00000000 N Y Release Order (normal release)

Y Y 010101 00000001 N Y Release Order (with power-down indication)

N Y 010101 00000010 N Y Release Order (with service inactive indication)

N Y 010111 00000000 N N Long Code Transition Request Order (request public)

N Y 010111 00000001 N N Long Code Transition Request Order (request private)

41 r-dsch Order Order More r-csch Fields Support Order Code, Qualification Name/Function Order Req’d ORDER Code, ORDQ other (binary) (binary) than ORDQ

N Y 010111 00000010 N Y Long Code Transition Response Order (use public)

N Y 010111 00000011 N N Long Code Transition Response Order (use private)

N Y 011000 00000000 N Y Connect Order

N Y 011001 0000nnnn N Y Continuous DTMF Tone Order (where ‘nnnn’ is the tone per Table 2.7.1.3.2.4-4).

N Y 011001 11111111 N Y Continuous DTMF Tone Order (Stop continuous DTMF tone)

N Y 011101 nnnnnnnn N Y Service Option Control Order (Band Class 0 only) (the specific control is designated by ‘nnnnnnnn’ as determined by each service option)

Y Y 011110 nnnnnnnn N N Local Control Response Order (specific response as designated by ‘nnnnnnnn’ as determined by each system)

Y Y 011111 00000001 Y Y Mobile Reject Order (unspecified reason; see 2.7.3.4)

Y Y 011111 00000010 Y Y Mobile Reject Order (message not accepted in this state; see 2.7.3.4)

Y Y 011111 00000011 Y Y Mobile Reject Order (message structure not acceptable; see 2.7.3.4)

43 More r-csch r-dsch Order Order Fields Support Order Order Code, Qualification Name/Function other Req’d ORDER Code, ORDQ than (binary) (binary) ORDQ

Y Y 011111 00000100 Y Y Mobile Reject Order (message field not in valid range; see 2.7.3.4)

N Y 011111 00000101 Y Y Mobile Reject Order (message type or order code not understood; see 2.7.3.4)

Y Y 011111 00000110 Y Y Mobile Reject Order (message requires a capability that is not supported by the mobile; see 2.7.3.4)

Y Y 011111 00000111 Y Y Mobile Reject Order (message cannot be handled by the current Mobile configuration; see 2.7.3.4)

Y Y 011111 00001000 Y Y Mobile Reject Order (response message would exceed allowable length; see 2.7.3.4)

Y Y 011111 00001001 Y Y Mobile Reject Order (information record is not supported for the specified band class and operating mode; see 2.7.3.4)

N Y 011111 00001010 Y Y Mobile Reject Order (search set not specified; see 2.6.6.2.5.1)

N Y 011111 00001011 Y Y Mobile Reject Order (invalid search request; see 2.6.6.2.5.1)

More r-csch r-dsch Order Order Fields Support Order Order Code, Qualification Name/Function other Req’d ORDER Code, ORDQ than (binary) (binary) ORDQ

N Y 011111 00001100 Y Y Mobile Reject Order (invalid Frequency Assignment; see 2.6.6.2.5.1)

N Y 011111 00001101 Y Y Mobile Reject Order (search period too short; see 2.6.6.2.5.1)

Y N 011111 00001110 N Y Mobile Reject Order (RC does not match with the value in the field DEFAULT_CONFIG; see 2.6.3.3 and 2.6.3.5)

All other codes are reserved.

1.11 Origination Message

2001 Feb 5 07:55:31.310 ACCESS CHANNEL -- Origination Msg (vol5. 2.7.1.3.2.4) protocol_rev = 6 (IS2000) chan_type = 2 (Access) chan ac_msg gen_ac msg_type = 4 (Origination) hdr ack_seq = 7  Response of msg_seq=7 (f-csch). (Acknowledgement Sequence Number) msg_seq = 2  3bit, 0 ~ 7 increase. (Message Sequence Number) ack_req = 1  Request ack message to BTS (Acknowledgement Request) valid_ack = 0  Set 1, when r-csch(= in this case origination Msg) have ack for f-csch. (Valid Acknowledgement) ack_type = 0 (Acknowledgement Address Type) msid_type = 3  ① It means IMSI and ESN use. msid type3 esn = 3925846604 imsi imsi_class = 0  It means 15digits use. i_class zero imsi_class_0_type = 0  Include IMSI_S. In case of ‘1’, include IMSI_S and IMSI_11_12

45 type zero imsi_s[HI] = 0 imsi_s[LO] = 137485978 orig auth_mode = 0 pilot_rpt fix active_pilot_strength = 16 first_is_active = 1  Set 1, If FIRST_ACTIVE_PILOT and CURRENT_ACTIVE_PILOT are same. first_is_pta = 0  Set 0, If FIRST_ACTIVE_PILOT and PREVIOUS_ACTIVE_PILOT are not same num_add_pilots = 1  var[0] field follows depending on this field value. var[0] ★pilot_pn_phase = 24962 (0x6182) pilot_strength = 27 ★access_ho_en = 0  Support access_ho or not ★access_attempted = 0  Support access_ho attempt or not mob_term = 1 Set receiveing mobile terminated calls slot_cycle_index = 2 mob_p_rev = 6 scm = 42

request_mode = 1  ② cdma only, Requested mode code

special_service = 1  For asking Special service option, mobile shall set this field ‘1’. For asking Default service option (S.O: 1), mobile shall set this field ‘0’.

service_option = 33 (0x21)  CDMA2000 Packet Service Option, High speed data.

pm = 0  For asking Voice privacy, mobile shall set thid field ‘1’. (No ask, set ‘0’)

digit_mode = 0  ③ Digit mode indicator more_fields = 0  This field shows whether dialed digits will be transmitted by “Origination Continuation Message”. If all dialed digits suit this message, set ‘0’. num_fields = 4  dialed digits number chari[0] = 1  ④ SK Telecom automatic receive number 1501. (4 digits = num_fields) chari[1] = 5 chari[2] = 0 chari[3] = 1

nar_an_cap = 0  Narrow analog capability. Set 1, if Mobile can support narrow analog operation. Set 0, if mobile can’t.

46 ★paca_reorig = 0  PACA re-origination. Set 0, if this value is user directed origination. Set 1, if this value is PACA re-origination. ※ When too much mobile try to access the system, system can give priority the mobile. PACA (Priority Access Channel Assignment)

return_cause = 0  Normal access more_records = 0

paca_supported = 0  CDMA PACA support indication. In CDMA mode, it show whether mobile support PACA. ‘0’ = not support num_alt_so = 0  alternative service options count supported. drs = 1  Data Ready to Send. Set ‘1’, if system has data for sending. Set ‘0’, if don’t have. uzid_incl = 0  Set 1, if it includes User Zone Identifier. ch_ind = 1  Ask Fundamental Channel, request physical resources, (vol5 2.7.1.3.2.4-6) sr_id = 1  Orthogonal Transmit Diversity supported indicator. otd_supported = 0  If it supports orthogonal transmit diversity, set the value ‘1’. qpch_supported = 1  If it supports Quick Paging Channel, set the value ‘1’. enhanced_rc = 1  Set 1, if it supports any RC of Radio Configuration Class2. Set 0, if it don’t. (See vol2.1.3.7.2-1, vol2. 2.1.3.7.2.3.1)

★for_rc_pref = 3  Forward Radio Configuration preference, (See RC1-RC9, Vol2. 3.1.3.1-1) ★rev_rc_pref = 3  Reverse FCH Radio Configuration Preference. (See RC1-RC6, Vol2. 2.1.3.1-1) fch_supported = 1  Set 1, if it support FCH. (Fundamental Channel supported indicator) fch_fields

fch_frame_size = 0  Set 1, if mobile supports 5 ms frame size on Fundamental Channel. Set 0, if mobile don’t. for_fch_len = 2 for_fch_rc_map = 62 (0x3e)  000111110,Forward Fundamental Radio Configuration information rev_fch_len = 2 rev_fch_rc_map = 60 ⑤111100,Reverse Fundamental Radio Configuration information dcch_supported = 0  Set ‘1’, if it supports Dedicated Control Channel. rev_fch_gating_req = 1

Consideration ① Table 2.1.1.3.1.1-1. MSID Types Description MSID_TYPE MSID_LEN (binary) (octets) IMSI_S and ESN (Band Class 0 only) 0 9 ESN 1 4 IMSI 10 5 to 7 IMSI and ESN 11 9 to 11

47 TMSI 101 2 to 12 All other MSID_TYPE values are reserved.

② Table 2.7.1.3.2.4-1. REQUEST_MODE Codes Value (binary) Requested Mode 000 Reserved 001 CDMA only 010 Wide analog only 011 Either wide analog or CDMA only 100 Narrow analog only 101 Either narrow analog or CDMA only 110 Either narrow analog or wide analog only 111 Narrow analog or wide analog or CDMA

3 This field show whether dialed digit is 4-bit DTMF codes or 8-bit ASCII codes. To originate the call using binary code (DTMF digits), mobile shall set the field ‘0’. To orginate the call using ASCII character, mobile shall set the field ‘1’.

④ Mobile must include NUM_FIELDS. If DIGIT_MODE set ‘0’, mobile shall generate code value (Table 2.7.1.3.2.4-4) depending on dialed digit. Table 2.7.1.3.2.4-4. Representation of DTMF Digits Digit Code (binary) Digit Code (binary) 1 0001 7 0111 2 0010 8 1000 3 0011 9 1001 4 0100 0 1010 5 0101 * 1011 6 0110 # 1100 All other codes are reserved. On conversation : When send digits, mobile send digit one by one. (DTMF_on_length: 350 ms, DTMF_off_length: 200ms)

Send Burst DTMF Message (RTC) – 09/22/2000 08:01:01.153 [3C] REVERSE TC CAI Send Burst DTMF Message Ack_seq 3, mes_seq 2, ack_req 1, encryption 0 Num_digits: 1 dtmf_on_length 350ms dtmf_off_length 200ms 1 (send digit “1” on conversation state)

Send Burst DTMF Message (RTC) 12/17/2000 01:01:35.030 [2B] REVERSE TC CAI Send Burst DTMF Message Ack_seq 2 Msg_seq 1 Ack_req 1 Encryption 0 Num_digits 11 dtmf_on_length 150ms dtmf_off_length 100ms 0xA 0x1 0x1 In case of sending own telephone number 0x9 0x4 0xA 0xA 0x1 0x1 0x9

Flash with information message (RTC) 09/22/2000 07:46:46.528 [01] REVERSE TC CAI Flash with information Message 3 persons conversation Ack_seq 6, msg_seq 3, ack_seq 1, sencription 0 Keypad Facility Info Record Chars= 4 5 0 9 0 5 8

⑤ This field consist series of 1-bit indicators. Mobile sets indicator ‘1’ if support specific RC. (If Mobile don’t support, set ‘0’. (example, If mobile supports RC1~RC5, set 111110 =62)

Table 2.7.4.27.1-2. Reverse Channel Radio Configurations Supported Subfield Length (bits) Subfield Description RC1 1 Radio Configuration 1 R=1/3 (Convolution) 9600 RC2 1 Radio Configuration 2 R=1/3 (Convolution) 14400 RC3 1 Radio Configuration 3 R=1/4 (Turbo) 163600 RC4 1 Radio Configuration 4

49 R=1/4 (Turbo) 230400 RC5 1 Radio Configuration 5 RC6 1 Radio Configuration 6

★ Acknowledgement Procedure Objective: To ensure signaling it is used at Layer 2. System Mobile Layer 3 Application Layer 3 Layer 2 Ack and others Layer 2 Layer 1 IS-2000 Layer 1 ※ Ack procedure is only for signal, not voice. (Voice has FEC error control not to be delayed)

MSG_SEQ: Same value of previous received message that needs ack. Traffic ACK_SEQ: Mobile and system increase this value. (Previous value + 1; range 0~7) Idle ACK_REQ: Need ack

ACK_TYPE: address type of previous received message that needs ack. VALID_ACK : Have a response

1.12 Extended Channel Assignment Message

2001 Feb 5 07:55:32.141 PAGING CHANNEL -- Extended Channel Assignment Msg protocol_rev = 6 (IS2000) (vol5. 3.7.2.3.2.21참조) chan_type = 1 (Paging) chan pc_msg gen prot_disc = 0 msg_id = 21 ext_chnasn num_chns = 1 (0x1) chns[0] gen hdr ack_seq = 7 msg_seq = 2 ack_req = 0 valid_ack = 0 addr_type = 2  ① It means IMSI use. addr

50 type2 imsi imsi_class = 0  It means 15digits use. i_class zero imsi_class_0_type = 3  ② IMSI_S, IMSI_11_12, and MCC type three mcc = 349 (0x15d)  450(349+111) imsi_11_12 = 99  MNC=00 imsi_s[HI] = 0 imsi_s[LO] = 137485978 assign_mode = 0  ③ Traffic Channel assignment am0 freq_incl = 0  Set 1, if it is included BAND_CLASS field and CDMA_FREQ. default_config = 4  ④ for_fch_rc, rev_fch_rc include message. 20ms frame. bypass_alert_answer = 0 num_pilots = 0  Now, tuning one pilot. The value equal to “Active set pilot count – 1”. granted_mode = 0  Use initial multiflex option and RC whom default_config define. ★frame_offset = 0 encrypt_mode = 0  encryption disable. See Vol5. 3.7.2.3.2.8-2 pilot_rec[0] pilot_pn = 16 (0x10)  Now, tuning PN pwr_comb_ind = 0 ★code_chan = 58  RC1,2,3,5 →the value assigns 1~63. See Vol2. 3.1.3.1.13 is2000_incl = 1 for_fch_rc = 3  for_fch RC that used by MS in ahead of transmitting connect msg.

rev_fch_rc = 3  rev_fch that used by MS in ahead of transmitting service connect mg. ★fpc_fch_init_setpt = 56  7dB, 0.125dB unit. ★fpc_subchan_gain = 0  0.25dB unit. rl_gain_adj = 0  reverse traffic CH power related on access power , 1dB unit. ★fpc_fch_fer = 2  1%, Target Frame Error Rate, See vol5. 3.7.3.3.2.25-2. ★fpc_fch_min_setpt = 16  2dB, 0.125dB unit ★fpc_fch_max_setpt = 96  12dB, 0.125dB unit rev_fch_gating_mode = 0 

Consideration ① Table 3.1.2.2.1.3.1-1. Address Types Description ADDR_TYPE ADDR_LEN (binary) (octets)

51 IMSI_S 0 5 ESN 1 4 IMSI 10 5 to 7 TMSI 11 2 to 12 Reserved 100 – BROADCAST 101 Variable Reserved 110 – Reserved 111 –

② Table 3.1.2.2.1.3.1-2. IMSI Class 0 Types Description IMSI_CLASS_0_TYP Length of IMSIClass 0 E Type-SpecificSubfields (binary) (bits) IMSI_S included 0 37 IMSI_S andIMSI_11_12 1 45 included IMSI_S and MCC included 10 45 IMSI_S, IMSI_11_12, 11 53 and MCC included

③ Table 3.7.2.3.2.21-1. Assignment Mode Value Assignment Mode (binary) 000 Traffic Channel Assignment 001 Paging Channel Assignment 010 Acquire Analog System 011 Analog Voice Channel Assignment 100 Enhanced Traffic Channel Assignment All other values are reserved.

④ Table 3.7.2.3.2.21-2. Default Configuration Value Default Configuration (binary) 000 Multiplex Option 1 and Rate Set 1 for both the Forward Traffic Channel and the Reverse Traffic Channel (RC1 for both Forward Fundamental Channel and Reverse Fundamental Channel) 001 Multiplex Option 2 and Rate Set 2 for both the Forward Traffic Channel and the Reverse Traffic Channel (RC2 for both Forward Fundamental Channel and Reverse Fundamental Channel) 010 Multiplex Option 1 and Rate Set 1 for the Forward Traffic channel;

52 Multiplex Option 2 and Rate Set 2 for the Reverse Traffic channel (RC1 for the Forward Fundamental and RC2 for the Reverse Fundamental Channel) 011 Multiplex Option 2 and Rate Set 2 for the Forward Traffic channel; Multiplex Option 1 and Rate Set 1 for the Reverse Traffic channel (RC2 on the Forward Fundamental Channel and RC1 on the Reverse Fundamental Channel) 100 FOR_FCH_RC or FOR_RC included in this message for the Forward Fundamental Channel or the Forward Dedicated Control Channel and REV_FCH_RC or REV_RC included in this message for the Reverse Fundamental or the Reverse Dedicated Control Channel. Use 20ms frames. All other values are reserved.

1.13 Service Request Message

2001 Feb 5 07:55:32.670 REVERSE TRAFFIC CHANNEL -- Service Request Msg protocol_rev = 6 (IS2000) (See vol5 2.7.2.3.2.12) chan_type = 4 (Reverse Traffic) chan rtc_msg gen msg_type = 12 (Service Request) srv_req hdr ack_seq = 0 msg_seq = 0 ack_req = 1 encryption = 0 serv_req_seq = 0 req_purpose = 2  ① Request service configuration. Cfg  vol5. 2.7.4.18 service configuration for_mux_option = 1 (0x1) rev_mux_option = 1 (0x1) for_rates = 240  ② 11110000 rev_rates = 240  11110000, (vol 5. 2.7.4.17-3). num_con_rec = 1  service option connection record number con[0] con_ref = 0  service option connection reference service_option = 33 (0x21)  High speed radio data for_traffic = 1  ③ At service option connection, use Primary for_traffic CH. rev_traffic = 1  At service option connection, use Primary rev_traffic CH. ui_encrypt_mode = 0  User Information Encryption disabled

53 sr_id = 1 rlp_info_incl = 1  Include rlp_blob. rlp_blob_len = 5 rlp_blob[0] = 46  RLP bit block for connecting service option rlp_blob[1] = 219 rlp_blob[2] = 101 rlp_blob[3] = 50 rlp_blob[4] = 152 fch_cc_incl = 1 ’1’ means that channel Configuration information is included Service Configuration record. fch_frame_size = 0 ’1’ means that 5 ms frame is allowed. (Plus 20 ms frame) for_fch_rc = 3  ④ Propose Forward Fundamental Channel Radio Configuration 3 rev_fch_rc = 3  Propose Reverse Fundamental Channel Radio Configuration 3 dcch_cc_incl = 0  ‘0’ means that Contents related DCCH is not included, DCCH Channel Configuration included indicator. for_sch_cc_incl = 1  Forward SCH Channel Configuration included indicator num_for_sch = 1  Number of Forward Supplemental Channels for_sch[0] for_sch_id = 0 for_sch_mux = 2337 (0x921)  ⑤ Support maximum 153kbps support. sch_chn_cfg  See vol 5. 3.7.5.7.1 sch_rc = 3  Support maximum 153kbps, See vol2 2.1.3.1-1, vol2 3.1.3.1-1 coding = 1  ⑥ Turbo-coding rev_sch_cc_incl = 0  It means that reverse sch isn’t supported.

Consideration ① Table 2.7.2.3.2.12-1. REQ_PURPOSE Codes REQ_PURPOSE Meaning (binary) 0000 Indicates that the purpose of the message is to accept a proposed service configuration. 0001 Indicates that the purpose of the message is to reject a proposed service configuration. 0010 Indicates that the purpose of the message is to propose a service configuration. All other REQ_PURPOSE codes are reserved.

② It shall set sub_field related on transmission rate ‘1’. And, set sub_field remained ‘0’. BTS shall set RESERVED ‘0000’.

54 Table 2.7.4.17-1. Forward Fundamental Traffic Channel Transmission Rates for Rate Set 1

Subfield Length Subfield Description (bits) RS1_9600_FOR 1 Forward Traffic Channel Rate Set 1, 9600 bps RS1_4800_FOR 1 Forward Traffic Channel Rate Set 1, 4800 bps RS1_2400_FOR 1 Forward Traffic Channel Rate Set 1, 2400 bps RS1_1200_FOR 1 Forward Traffic Channel Rate Set 1, 1200 bps RESERVED 4

③ Table 2.7.4.18-1 FOR_TRAFFIC Codes FOR_TRAFFIC Description (Binary) 0000 Service option connection don’t use Forward Traffic CH. 0001 Service option connection use primary traffic on Forward Traffic CH. 0010 Service option connection use secondary traffic on Forward Traffic CH. All other FOR_TRAFFIC codes are reserved

④ If FCH_CC_INCL field set ‘1’ , mobile shall include this field that fellow below description. Otherwise, this field must be omitted. In case of Status Response Message, mobile shall set this field Forward Fundamental Channel Radio Configuration belonged to present service configuration. In case of Service Request Message or Service Response Message, mobile shall set this field Forward Fundamental Channel Radio Configuration belonged to service configuration.

⑤ Multiplex Option CH Maximum Number ofMuxPDUs Multiplex Option Rate in the PhysicalLayer SDU Rate Set 1 Rate Set 2 MuxPDU MuxPDU Type 3 MuxPDU MuxPDU Type 3 MuxPDU MuxPDU Type 3 Type 1,2 single Double Type 1 single Double Type 2 single double 1x 1 0x03 0x04 2x 2 1 0x809 0x905 0x80a 0x906 4x 4 2 0x811 0x909 0x812 0x90a

55 8x 8 4 0x821 0x911 0x822 0x912 16x 8 0x921 0x922

- Multiplex Option Number : 16 bits ; Rate Set , Max. Data Blocks, Data Block Size, Mux PDU Type definition. - Data Block = , Mux SDU : a block of data that belongs to the same service - SCH rate basic(1x), double(2x), etc (classification) ; Example : Rate Set 1 (1x = 9.6kbps, 2x = 19.2kbps, etc) - Mux PDU Type 1 : Rate Set 1 based (9.6kbps) - Mux PDU Type 2 : Rate Set 2 based (14.4kbps) - Mux PDU Type 3 : At using SCH (Rate Set 1and Rate Set2) - Single Data Block = Traffic is 170bits, Double Data Block = Traffic is 346bits

6 If Mobile and BTS want to use convolution coding below 360 bit/frame, turbo coding above 360 bits/frame, set this field ‘1’. If Mobile and BTS would use convolution coding about all block amount, set this field ‘0’.

1.14 Service Connect Message

2001 Feb 5 07:55:32.862 FORWARD TRAFFIC CHANNEL -- Service Connect Msg protocol_rev = 6 (IS2000) (See. vol5 3.7.3.3.2.20) chan_type = 3 (Forward Traffic) chan ftc_msg gen msg_type = 20 (Service Connect) srv_con hdr ack_seq = 0  Response about msg_seq 0. msg_seq = 3 ack_req = 1  Ask response about “msg” . encryption = 0 use_time = 0  action time is not included. action_time = 0 serv_con_seq = 0 cfg for_mux_option = 1 (0x1) rev_mux_option = 1 (0x1) for_rates = 240  Support 1200bps, 2400bps, 4800bps, 9600bps rev_rates = 240  Support 1200bps, 2400bps, 4800bps, 9600bps num_con_rec = 1 con[0] con_ref = 0

56 service_option = 33 (0x21) for_traffic = 1  See. Service Request Msg rev_traffic = 1 ui_encrypt_mode = 0 sr_id = 1 rlp_info_incl = 0 fch_cc_incl = 1 fch_frame_size = 0 for_fch_rc = 3 rev_fch_rc = 3 dcch_cc_incl = 0 for_sch_cc_incl = 1 num_for_sch = 1 for_sch[0] for_sch_id = 0 for_sch_mux = 2337 (0x921)  Support maximum 153kbps sch_chn_cfg sch_rc = 3 coding = 1  Turbo-coding rev_sch_cc_incl = 0 non_neg_cfg fpc_incl = 1  See. power control message fpc_pri_chan = 0 fpc_mode = 1  See. power control message fpc_olpc_fch_incl = 1 ★fpc_fch_fer = 2  1%, Target Frame Error Rate, (See. vol5. 3.7.3.3.2.25-2) ★fpc_fch_min_setpt = 16  2dB, 0.125dB unit ★fpc_fch_max_setpt = 96  12dB, 0.125dB unit fpc_olpc_dcch_incl = 1

★fpc_dcch_min_setpt = 16  2dB, 0.125dB unit ★fpc_dcch_max_setpt = 96  12dB, 0.125dB unit gating_rate_incl = 0 lpm_ind = 0

1.15 Service Connect Completion Message

2001 Feb 5 07:55:32.910 REVERSE TRAFFIC CHANNEL -- Service Connect Complete Msg protocol_rev = 6 (IS2000) (See. vol5 2.7.2.3.2.14) chan_type = 4 (Reverse Traffic) chan rtc_msg gen

57 msg_type = 14 (Service Connect Completion) srv_cmp hdr ack_seq = 2  Response about Service Connect msg msg_seq = 3 ack_req = 1 encryption = 0 serv_con_seq = 0  ①

Consideration 1 Set the SERV_CON_SEQ value as same as Service Connect msg value responded. In above 2001 Feb 5 07:55:32.862 Service Connect msg, SERV_CON_SEQ field is ‘0’.

1.16 Power Control Message

2001 Feb 5 07:55:32.803 FORWARD TRAFFIC CHANNEL -- Power Control Msg protocol_rev = 6 (IS2000) (vol5 3.7.3.3.2.25) chan_type = 3 (Forward Traffic) chan ftc_msg gen msg_type = 25 (Power Control) pwr_ctrl hdr ack_seq = 0 msg_seq = 1 ack_req = 1 encryption = 0 ★pwr_cntl_step = 0  1dB,step size that go up/down mobile power at closed loop power control. use_time = 0  ①action time indicator,'0':action time ON.'1':action time OFF fpc_incl = 1 '1'means inclusion, forward link power control parameter included indicator ★fpc_mode = 1 ② See. vo12 2.1.3.1.10-1 fpc_pri_chan = 0③power control sub_channel indicator fpc_olpc_fch_incl = 1'1'means inclusion, fch outer loop power control para included indicator ★fpc_fch_fer = 2 ④1% ,fch target FER ★fpc_fch_min_setpt = 16 '16':2dB(0.125dB unit) Minimum fch outer loop Eb/Nt set_point ★fpc_fch_max_setpt = 96 Maximum fch outer loop Eb/Nt setpoint.'96':12dB(0.125dB unit) fpc_olpc_dcch_incl = 0 ⑤'0': not include num_sup = 0 SCH Number fpc_thresh_incl = 1  set_point report threshold included indicator fpc_setpt_thresh = 24  ⑥ 3dB,setpoint report threshold fpc_thresh_sch_incl = 1 sch setpoint report threshold included indicator fpc_setpt_thresh_shc = 24  3dB,sch setpoint report threshold

58 rpc_incl = 0  reverse link power control parameter included indicator

Consideration ① action time: Time that message becomes valid. It sets system time by 80ms(modulo64)unit. ②'1':reverse power control sub_ch 0,2,4...,12,14th power control bit is for fch power control. 1,3,5...,13,15th power control bit is for sch power control. (See below table)

vol2 Table 2.1.3.1.10.1-1. Reverse Power Control Subchannel Configurations

Reverse Power Control Subchannel Allocations (Power Control Group Numbers 0-15) FPC_MODEs Primary Reverse Power Secondary Reverse Power Control Subchannel Control Subchannel ‘000’ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, Not supported 10, 11, 12, 13, 14, 15 ‘001’ 0, 2, 4, 6, 8, 10, 12, 14 1, 3, 5, 7, 9, 11, 13, 15 ‘010’ 1, 5, 9, 13 0, 2, 3, 4, 6, 7, 8, 10, 11, 12, 14, 15 ‘011’ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, Not supported 10, 11, 12, 13, 14, 15 All other values Reserved Reserved

③'0':When BTS multiplex power control sub_channel, mobile do primary inner loop estimation about received ffch channel after. '1': When BTS multiplex power control sub_channel, mobile do primary inner loop estimation about received fdcch channel after.

vol5 table 3.7.3.3.2.25-2. Target frame error rate

FER Frame Error Rate (Binary)

00000 0.2%

00001-10100 0.5% -10% (in units of 0.5%)

10101-11001 11% - 15% (in units of 1.0%)

11010-11110 18% - 30% (in units of 3.0%)

11111 Reserved

⑤ fdcch outer loop power control parameter included indicator, Now we don’t use fdcch. ⑥ Mobile transmits “outer loop report message” when set_point go over threshold.

59 1.17 Power Control Parameters Message

2001 Feb 5 07:55:32.822 FORWARD TRAFFIC CHANNEL -- Power Control Parameters Msg protocol_rev = 6 (IS2000) (vol5 3.7.3.3.2.10) chan_type = 3 (Forward Traffic) chan ftc_msg gen msg_type = 10 (Power Control Parameters) pwr_ctl hdr ack_seq = 0 msg_seq = 2 ack_req = 1 encryption = 0 ★pwr_rep_thresh = 2  ①,2frame,Power control reporting threshold number of bad frame ★pwr_rep_frames = 2  ②,10frame,Power control reporting frame count ★pwr_thresh_enable = 0  ③,threshold report mode indicator ★pwr_period_enable = 1  ③,periodic report mode indicator ★pwr_rep_delay = 5  ④,20frame(4frame unit),power report delay

Consideration ①: received bad frame count which can send PMRM ②:(2 pwr_rep_frames/2)*5, frame count which can send periodic PMRM ③:In above case, pwr_thresh_enable is '0', pwr_period_enable is '1', thus bad frame threshold is off. Periodic PMRM report every 10frame. ④:After mobile sent PMRM, it’s the time that mobile counts frames for power control.

1.18 Power Measurement Report Message

2001 Feb 5 07:55:33.031 REVERSE TRAFFIC CHANNEL -- Power Measurement Report Msg protocol_rev = 6 (IS2000) (See. vol5 2.7.2.3.26) chan_type = 4 (Reverse Traffic) chan rtc_msg gen msg_type = 6 (Power Measurement Report) pwr_rpt hdr ack_seq = 4 msg_seq = 3

60 ack_req = 0 encryption = 0 errors_detected = 0  0 frame, Bad frame count that mobile detect on forward fch. pwr_meas_frames = 10 (0xa) ①10frame last_hdm_seq = 0 ② num_pilots = 2 The number of pilot that is reported by PMRM ★pilot_strength[0] = 15  -7.5dB (-0.5*pilot_strength) ★pilot_strength[1] = 18  -9dB (-0.5*pilot_strength) dcch_pwr_meas_incl = 0 ③ forward dcch power measurement include indicator sch_pwr_meas_incl =0 sch power measurement include indicator

Consideration 1 Total frame count that mobile received on forward fch for power measurement period. Above case) Received total 10frame, and no bad frame 2 It is same as UHDM sequence number (hdm_seq) that include pilot in PMRM. ③ Set ‘1’, if both (ffch,fdch) were assigned. Otherwise, set ‘0’. Now SK Telecom don’t use dcch, thus the value is ‘0’.

1.19 Extended Supplemental Channel Message

2001 Feb 5 07:55:33.902FORWARD TRAFFIC CHANNEL -- Extended S Channel Assignment Msg protocol_rev = 6 (IS2000) (vol5 3.7.3.3.2.37) chan_type = 3 (Forward Traffic) chan ftc_msg gen msg_type = 35 (Extended Supplemental Channel Assignment) escam hdr ack_seq = 6 msg_seq = 7 ack_req = 0 encryption = 0 start_time_unit = 0  20ms,start frame unit (Value = 20ms frame counts - 1) rev_sch_dtx_duration = 0  ①,0ms,discontinuous transmission on reverse supplemental channel use_t_add_abort = 0  ②reverse use T_ADD indicator use_scrm_seq_num = 0  scrm sequence indicator add_info_incl = 0  ③ additional information included indicator rev_cfg_included = 0 '0':not inclusion, rsch configuration included indicator num_rev_sch = 0  assigned reverse sch count for_cfg_included = 1 '1':inclusion, fsch configuration included for_sch_fer_rep = 0 num_for_cfg_recs = 0  ④, fsch configuration records counts - 1

61 for_cfgs[0] for_sch_id = 0  fsch identifier sccl_index = 0  ⑤,index of record in sch code list ★for_sch_rate = 4  ⑥153.6kbps,fsch data rate (vol5 table 2.7.4.27.3-2) ★num_sup_sho = 0  fsch count in soft h/o status. (Setting value = fsch active set size - 1) sup_shos[0] pilot_pn = 390 (0x186) add_pilot_rec_incl = 0  additional pilot information included indicator for_sch_cc_index = 3 (0x3) ⑦,0110,fsch code channel index qof_mask_id_sch = 0 num_for_sch = 1  assigned sch count for_schs[0] for_sch_id = 0  fsch identifier ★for_sch_duration = 9  ⑧ 320ms,assigned fsch duration for_sch_start_time_incl = 1 '0':not include,'1':inclusion, start time included indicator for_sch_start_time = 16  ⑨,fsch assignment start time sccl_index = 0 fpc_incl = 1  See. power control message ★fpc_mode_sch = 1  See. power control message fpc_sch_init_setpt_op = 0  ⑩initial sch outer loop Eb/Nt setpoint option num_sup = 1  Total sch count sups[0] sch_id = 0  sch index ★fpc_sch_fer = 10  5%, (See. vol5 table3.7.3.3.2.25-2),(power control message See. ④ ) ★fpc_sch_init_setpt = 56  7dB(0.125dB unit), initial sch outer loop Eb/Nt ★fpc_sch_min_setpt = 0  0dB(0.125dB unit), initial sch outer loop Eb/Nt ★fpc_sch_max_setpt = 112  14dB(0.125dB unit), maximum sch outer loop Eb/Nt fpc_thresh_sch_incl = 1  '1':inclusion sch set_point report threshold included indicator fpc_setpt_thresh_sch = 24  ⑪3dB(0.125dB unit),sch setpoint report threshold rpc_incl = 0  '0':not include, reverse power control parameter included indicator (Now, SK Telecom don’t use reverse sch, thus rpc parameter is useless).

Consideration ① :It is 20ms unit time allowed to stop transmitting to decide for mobile within reverse duration assigned by BTS. Set ‘0000’, if mobile don’t use rsch as soon as stop_transmiting. Set ‘1111’, if BTS make mobile transmit again thru rsch within duration assigned already. ②:In case Mobile use “T_ADD rsch abort feature” for reverse assignment, set ‘1’. Otherwise set ‘0’. When strong signal check in the out of active set, instead of sending PSMM immediately, mobile stops rsch transmission, then send scrm, PSMM. And after completing H/O, mobile is assigned rsch again. ③:If BTS message get FPC_PRI_CHAN, set the value '1'. Otherwise set '0'. ④ :In case of for_cfg_included=1, set fsch cofiguration record s number –1 that is consisted of for_sch_id,sccl_index,for_sch_num_bits_idx fields.

62 ⑤ In case it use 5ms message, while maintaining information like sch data rate,walsh on table, information use same one by sending only index. Sending index only is more simple than sending whole table above. (Now, Samsung system don’t use 5ms message).

vol5 Table 3.7.3.3.2.37-1. SCH Data rate

REV_SCH_RATE BTS assign rate (kbps) FOR_SCH_RATE (Binary) Rate Set 1 Rate Set 2

0000 9.6 14.4 0001 19.2 28.8 0010 38.4 57.6 0011 76.8 115.2 0100 153.6 230.4 0101 307.2 259.2 0110 614.4 460.8 0111 Reserve 518.4 1000 Reserve 1036.8 RESERVED All remained values are reserved.

⑦ See. vol2 table 2.1.3.1.8.1-1

⑧ vol5 Table 3.7.3.3.2.37-3. FOR_SCH_DURATION vs. REV_SCH_DURATION Field FOR_SCH_DURATION Duration in 20 ms REV_SCH_DURITION (Binary) 0001 1 0010 2 0011 3 0100 4 0101 5 0110 6 0111 7 1000 8 1001 16 1010 32 1011 64

63 1100 96 1101 128 1110 256 1110-1111 Reserved

⑨ start time; (t/(start_time_unit+1)- for_sch_start_time )mod32 = 0. t = system time (LSB 5bit at calculating by 20ms unit). Above case, start_time_unit= ‘0’, for_sch_start_time = 16, thus when t=16 or 48 or 80,.., fsch duration will start.

⑩ If the value were ‘0’, initial “fsch Nb/Nt setpoint” set the absolute value. If the value were ‘1’, it means that fsch Eb/Nt setpoint value set relative to the value that mobule use now. (See. 3.7.3.3.2.37) ⑪ When mobile get sch setpoint report threshold, send outer loop report message.

[ 16:18:42.367 ] Forward Traffic Channel PROTOCOL_REV : 0 Extended supplemental channel assignment

MSG_LENGTH: 12 MSG_TYPE: 35 ACK_SEQ: 2 MSG_SEQ: 3 ACK_REQ: 0 ENCRYPTION: 0 START_TIME_UNIT(20msec): 0 REV_SCH_DTX_DURATION: 10 USE_T_ADD_ABORT: 0 USE_SCRM_SEQ_NUM: 0 ADD_INFO_INCL: 1 Set the value ‘1’, if this message include FPC_PRI_CHAN and CH_IHD. FPC_PRI_CHAN: 0 REV_CFG_INCLUDED: 1 NUM_REV_CFG_RECS: 0 REV_SCH_ID: 0 REV_WALSH_ID: 1 SCH_ID = 0 : ++-- SCH_ID = 1 : ++++---- ★REV_SCH_RATE: 3 Rate Set 1 : 76.8Kbps, Rate Set 2 : 115.2Kbps NUM_REV_SCH: 1 REV_SCH_ID: 0 ★REV_SCH_DURATION: 10

64 32*20msec REV_SCH_START_TIME_INCL: 1 REV_SCH_START_TIME: 10 REV_SCH_RATE: 3 Rate Set 1 : 76.8Kbps, Rate Set 2 : 115.2Kbps FOR_CFG_INCL: 0 NUM_FOR_SCH: 0 FPC_INCL: 0 RPC_INCL: 1 RPC_NUM_SUP: 0 SCH_ID: 0 RLGAIN_SCH_PILOT: 2

Consideration

Table 3.7.3.3.2.37-2 REV_WALSH_ID field REV_WALSH_ID (Binary) Walsh Cover SCH_ID=’0’ SCH_ID=’1’ 0 ＋－＋＋－－ 1 ＋＋－－＋＋＋＋－－－－

1.20 RLP Statistics

2001 Feb 5 07:55:32.982 RLP Statistics (See. IS 707, vol3(MAC),) Received Frames Information ------#★Re-transmitted Frames = 0  ① # Idle Frames = 0  ② # Fill Frames = 0  ③ # Blank Frames = 4  ④-1 # Null frames = 1 ④-2 #★New Data Frames = 0  ⑤ # Fundamental Data Frames = 5 # Bytes Rxed. = 0  ⑥ # RLP Erasures Rxed. = 0  ⑦ # Mux Erasures Rxed. = 4  ⑧

Transmitted Frames Information ⑨ ------#★Re-transmitted Frames = 0 # Idle Frames = 0 #★New Data Frames = 0 # Fundamental Data Frames = 5 # Bytes Txed. = 0

Number of NAKs Sent ------★SINGLE NAKS : 0  ⑩

65 ★DOUBLE NAKS : 0  ⑪ ★TRIPLE NAKS : 0  ⑫

------#★ Resets = 0  ⑬ #★Aborts = 0  ⑭ # Nak Frames Received = 0 # Retransmissions Not Found = 0 Largest Block of Consecutive Erasures = 2 Round Trip Time = 0  ⑮ RLP BLOB Used = No BLOB  ⓐ

Consideration ①Re-transmitted frame count (response about MS NAK message) ②When RLP don’t receive any frame from upper layer and don’t have any data to send CEC Buffer, system send idle frame to mobile thru FCH. ③Send system V(n) information to mobile by fill frame. ④-1. System assigns SCH. And, while system sends data frame, no information part occurs in frame. In this case, blank area in the frame is padding by 0. (We call it blank frame) ④-2. At the beginning of Data call (initialization state), null traffic used. Null frame also checks RTD in initialization state. (On conversation, RTD is checked by RLP BLOB_frame. ⑤Data frame being sent for the first time ⑥Total DATA Byte count received from RLP ⑦Total erasure(bad frame) count received from RLP ⑧Total erasure(bad frame) count from MUX ⑨Now, SK Telecom don’t use reverse sch. ⑩single NAK count ⑪double NAK count ⑫triple NAK count ⑬RLP Reset count ⑭NAK Abort count. After sending triple NAK, if receiver part don’t catch any RLP, system aborts the RLP frame and reports upper layer. ⑮Round Trip Time. In RLP initial states, in case system don’t execute “Sync 交換節次”, system get RLP Processing data from RLP BLOB. At that time, system can synchronize with mobile by inserting RTT (RLP delay). (Only when system uses RLP BLOB, above description is available.) ⓐ:It means that system don’t use BLOB. System use BLOB for calculation of RTD. (Round Trip Delay)

*Data Processing Overview

1. V(S),V(n),V(r ) ?

66 V(S)= New Data frame serial number that will be supplied by Multiplex sublayer RLP Sender

……. ………

:Data frame supplied by Multiplxer Sublayer already

: Data frame that will be supplied by Multiplxer Sublayer

RLP Receiver

V(R)=Data frame serial number that can be V(N)=Missed data frame serial number anticipated to be received.

…….. ……..

: Received Data frame

: Data frame that a order (sequence) is not correct.

: Buffer for new Data frame or Missing Data frame

2 NAK Control

 Mobile send NAK message for V(N)Data frame (not received frame).

 If mobile don’t receive Retransmission data frame after sending total 6 NAK message (1st - 1,2nd – 2, 3rd – 3), mobile aborts NAK message. For not-received data frame, and system sends a new data frame.

67  Whenever mobile sends NAK, mobile execute continuous NAK Control by activating timer.

1st NAK RLP, 1time 2nd NAK RLP, 3rd NAK RLP, 3times 2times

1st Retransmission 2nd Retransmission Abort timer timer activation timer activation activation

1st Retransmission 2nd Retransmission Abort timer Expire timer Expire timer Expire

Duration is dependent on RTD. (Null/RLP_BLOB) NAK Control flow

3 Example#1) Samsung System Data Processing

BSC BTS

DC RP GA AMC CE MS N P N C

Data processing System Configuration

68  DCN:Data Core Network  RPP: DCN interface card, Send PPP data frame to AMC thru GAN  GAN: Support path between BSCs for Soft H/O and support data call path  AMC: Make RLP data frame for FCH,SCH and then send to CEC  CEC: Send RLP data frame (received from AMC) to the air . FCH: transmit immediately, SCH: transmit after being assigned SCH (from Scheduler)

1. Received Packet data from DCN, and then make a PPP data in RLP. Send PPP data to AMC(RLP) 2. AMC(RLP) make a RLP data frame and then send CEC. 3. CEC is buffering RLP Data frame and get SCH assignment, send to mobile. 4. After transmitting RLP Data frame thru SCH, CEC give indication AMC(RLP). (#indication means success processing) 5. AMC(RLP) delete data frame sequence successfully transmitted in data sequence list. If AMC(RLP) don’t receive indication within 2 second , AMC believe that RLP data frame transmitted successfully. Thus delete data sequence in data sequence list.

★ The reason that manage the list is Dormant state control. Dormant state ? To save the radio resource, it cut off radio part and stays connecting state in PPP upper layer. Therefore when needing re-connection, system can connect without upper layer initialization and setting time. If AMC(RLP) don’t have PPP frame received from RPP and get judgment no data in CEC buffer, AMC activates Dormant timer. When the timer is expired, dormant state will start.

We get RLP statistic from mobile easily. RLP is good index in radio network optimization because Block is between mobile ~ BSC.

RLP statistic at T1 is R1, RLP statistic at T2 is R2

RLP transmission rate and RLP retransmission rate is defined;

Transmission speed (R2.rxed _ byte  R1.rxed _ byte) 8 전송속도   (kbps) forward T 2 T1 1024 Transmission speed (R2.txed _ byte  R1.txed _ byte) 8 전송속도   (kbps) reverse T 2 T1 1024 Re-Transmission rate retx 재전송율  100 (%) forward retx  idle  blank  null  new _ data Re-Transmission rate retx 재전송율  100 (%) reverse retx  idle  new _ data

★ Voice and Data characteristic Voice Radio Data

69 No storing Storing and forwarding (routing and assembling) FEC (Forward error correction) ARQ (Automatic repeat Request) Connection oriented Connectionless orientation (datagram type) Error rate < 10E-3 error Error rate < 10E-6 error

★ Voice and Data characteristic RLP 1: IS-95-A (14.4Kbps) – Traffic channel RLP 2: IS-95-B (14.4Kbps*8=115.2Kbps) – SCCH RLP 3: IS-2000 Release 0 (153.6Kbps) – SCH RLP 4: IS-2000 Release A (307.2Kbps) – SCH RLP 5: IS-2000 Release B (2Mbps) – SCH

★What is the reason Cellular use RLP protocol? -In IS-95 air link (9.6Kbps), one RLP is 20byte and one TCP is 1.5kbyte. If FER is 1~2%, TCP segment error rate will be 50~100%. Thus, system need effective RLP mechanism.

Motorola system

MM XC Radio RA PCF SDU

Fault manger

Data burst resource Request/response/commit -Time slice assignment (ESCAM) -Transmit RLP frame Resource Allocation (single BTS) Assignment (soft HO SCH) -CE, Walsh code, BTS RF capacity, Backhaul Bandwidth, Time slice manager (=scheduler) Decoder (turbo, -Assign time slice (=time slot) convolution for R-SCH) CM TSM -Conversation with SDU -Control BTS part

Resource configuration RF management Estimate after SCH assignment; -Forward RF cost (Ec/Ior) -Reverse SIR (Noise level)

BBXs CEs

CBSC (=BSC): PCF: Packet control function, SDU: Selection and distribution unit

CM: Cache Manager – Resource assignment and allocation LM: Load Manager –Estimate forward power and reverse SIR before transmitting RLP data. TSM: Time Slice Manager – Control Time slice and LM, CM.

★ More detail part and description : See. “Motorola 1x Supplemental Design Note”

1.21 Fast Forward Power Control Information

2001 Feb 5 07:55:34.106 Fast Forward Power Control Information (vlo2 2.1.3.1.10) Srv Option = 33 Mode = 1 ①, Sub-Chn Ind = 0 ★Sub-Chn Gain = 5.000 dB② Frame Offset (ms) = 0.00 Frame Time Decision History SetPoint by Active Channel ------1 07:55:34.10639 00E0③ ★F-FCH: 6.750 dB④ ★F-SCH0: 7.500 dB ⑤ ★PC SCH Delta: -0.750 dB ⑥ 2 07:55:34.12639 01F0 F-FCH: 6.750 dB F-SCH0: 7.375 dB PC SCH Delta: -0.625 dB 3 07:55:34.14639 F271 F-FCH: 6.750 dB F-SCH0: 7.375 dB PC SCH Delta: -0.625 dB 4 07:55:34.16639 3E2F F-FCH: 6.750 dB F-SCH0: 7.375 dB PC SCH Delta: -0.625 dB 5 07:55:34.18639 1BFF F-FCH: 6.750 dB F-SCH0: 7.875 dB PC SCH Delta: -1.125 dB 6 07:55:34.20639 1650 F-FCH: 6.750 dB F-SCH0: 8.375 dB PC SCH Delta: -1.625 dB 7 07:55:34.22639 3798 F-FCH: 6.750 dB F-SCH0: 8.875 dB PC SCH Delta: -2.125 dB 8 07:55:34.24639 D913 F-FCH: 6.750 dB F-SCH0: 9.375 dB PC SCH Delta: -2.625 dB 9 07:55:34.26639 F3FF F-FCH: 6.750 dB F-SCH0: 9.875 dB PC SCH Delta: -3.125 dB 10 07:55:34.28639 B073 F-FCH: 6.750 dB F-SCH0: 10.375 dB PC SCH Delta: -3.625 dB 11 07:55:34.30639 F903 F-FCH: 6.750 dB F-SCH0: 10.875 dB PC SCH Delta: -4.125 dB

71 12 07:55:34.32639 008F F-FCH: 6.750 dB F-SCH0: 11.375 dB PC SCH Delta: -4.625 dB 13 07:55:34.34639 A278 F-FCH: 6.750 dB F-SCH0: 11.375 dB PC SCH Delta: -4.625 dB

Consideration 1 fpc_mode, (See. power control message ② ) 2 fpc_subch_gain, (See. UHDM④ ) 3 Forward power control decision history. History decides forward power by power control bit (fixed by inner loop power control). It is Inner Loop Power Control that mobile compares Eb/No of received forward frame with FPC_SCH_CURR_SETPT.

After Mobile compares measured Eb/No with FPC_SCH_CURR_SETPT every power contol group (1.25ms); if measured Eb/No > FPC_SCH_CURR_SETPT, mobile transmits power down reverse power control bit (0).if measure Eb/No < FPC_SCH_CURR_SETPT, mobile transmits power up reverse power control bit(1).

In above case; decision history is ‘00E0’. Mobile transmits control bit ‘0000 0000 1110 0000’. And, Since fpc mode is ‘1’, the odd control bit ‘00001100’ is for ffch_power control. The even control bit ‘00001000’ is for fsch_power control.

④,⑤ Mobile ffch,fsch set point. Setpoint decided by forward outer loop power control. At the beginning of data call Forward Outer Loop Power Control set FPC_SCH_CURR_SETPT into init Eb/No setpoint. After that, it adjusts FPC_SCH_CURR_SETPT that can satisfy Target SCH fer.

Mobile increases FPC_SCH_SURR_SETPT by a 0.5dB, if it checks CRC Error in received frame(20ms).

Mobile decreases FPC_SCH_CURR_SETPT if it receives good frame.

In case of Target SCH FER = 1%, FPC_SCH_CURR_SETPT decreases by “1X0.5dB/100-1=0.0051dB”.

In case of Target SCH FER = 5%, FPC_SCH_CURR_SETPT decreases by “5X0.5dB/100-5=0.0263dB”.

Actually mobile adjusts Set_point above units (0.0051dB, 0.0263dB). But, Units are so small that DM shows 0.125dB unit change.

Thus, if mobile receives continuous Good Frame in good air condition area, DM message shows setpoint change after receiving 25 frames (SCH FER 1% case). In case of SCH FER 5%, DM message shows a change after receiving 5 frames.

⑥ PC SCH Delta = F-FCH Set_point - F-SCH0 setpoint6.750 dB - 7.500 dB = -0.75 dB

1.22 Forward Frame Information

2001 Feb 5 07:55:18.662 Forward Frame Information Srv Option = 33 Frame Offset (ms) = 0.00 Radio Configurations: <- Only forward fundamental channel operates RC3. F_FCH : 3 F_DCCH : 0 F_SCH 0 : 0 F_SCH 1 : 0 Frame Time

72 ------1 07:55:18.66239 F-FCH: Type : Payload Only Rate : Eighth Rate <- In RC3, 1200, 2400, 4800, 9600bps. Thus,1/8 = 1200bps

2 07:55:18.68239 F-FCH: Type : Payload Only Rate : Eighth Rate

9 07:55:18.82239 F-FCH: Type : Payload Only

73 Rate : Eighth Rate

10 07:55:18.84239 F-FCH: Type : Blank and Burst Rate : Full Rate <- 9600bps

11 07:55:18.86239 F-FCH: Type : Blank and Burst Rate : Full Rate

13 07:55:18.90239 F-FCH: Type : Blank and Burst Rate : Full Rate

74 1.23 Reverse Frame Information Example #1 --- ①

[ 14:24:02.486 ] Reverse link frame types PROTOCOL_REV : 6

FRAME OFFSET: 1 ---② SERVICE OPTION: 33 REV_FCH_RC : 3REV_SCH0 : 0REV_SCH1 : 0REV_DCCH : 0 RECORD Number : : 1 ----- Frame Statistics : FCH ----- # of FCH Frame : 17 Full : 2 Half : 2 Quarter : 0 Eigh : 13 Eras : 0 FER : 0.00 Payload : 15 DIM : 0 BLANK : 2 ------[14:24:02.146] : 1/8 RATE FRAME --③ [14:24:02.166] : 1/8 RATE FRAME [14:24:02.186] : 1/8 RATE FRAME [14:24:02.206] : 1/8 RATE FRAME [14:24:02.226] : 1/8 RATE FRAME [14:24:02.246] : FULL RATE FRAME ----④ [14:24:02.266] : FULL RATE FRAME [14:24:02.286] : 1/8 RATE FRAME [14:24:02.306] : 1/8 RATE FRAME [14:24:02.326] : 1/2 RATE FRAME [14:24:02.346] : 1/2 RATE FRAME ---⑤ [14:24:02.366] : 1/8 RATE FRAME [14:24:02.386] : 1/8 RATE FRAME [14:24:02.406] : 1/8 RATE FRAME [14:24:02.426] : 1/8 RATE FRAME [14:24:02.446] : 1/8 RATE FRAME [14:24:02.466] : 1/8 RATE FRAME

Example #2 --- ①

2002 Mar 5 05:24:02:487 [17] REVERSE FRAME INFORMATION Srv Option = 33 Frame Offset(ms) = 1.25 ---② Radio Configuration: R_FCH : 3 R_DCCH : 0 R_SCH : 0 R_SCH 1 : 0 Frame Time ------

75 1 05:24:02.48125 R_FCH: Type : Payload Only Rate : Eighth Rate --③ 2 05:24:02.50125 R_FCH: Type : Payload Only Rate : Eighth Rate 3 05:24:02.52125 R_FCH: Type : Payload Only Rate : Eighth Rate 3 05:24:02.54125 R_FCH: Type : Payload Only Rate : Eighth Rate 4 05:24:02.56125 R_FCH: Type : Payload Only Rate : Eighth Rate 5 05:24:02.58125 R_FCH: Type : Payload Only Rate : Eighth Rate

6 05:24:02.60125 R_FCH: Type : Blank and Burst ----④ Full rate shall not be used by Blank and Burst, Dim and Burst. Rate : Full Rate (=Above Full rate means that primary traffic is full rate.) 7 05:24:02.62125 R_FCH: Type : Blank and Burst Rate : Full Rate 8 05:24:02.64125 R_FCH: Type : Payload Only Rate : Eighth Rate

9 05:24:02.66125 R_FCH: Type : Payload Only Rate : Eighth Rate 10 05:24:02.68125 R_FCH:

76 Type : Payload Only Rate : Half Rate ---⑤ 11 05:24:02.70125 R_FCH: Type : Payload Only Rate : Half Rate 12 05:24:02.72125 R_FCH: Type : Payload Only Rate : Eighth Rate 13 05:24:02.74125 R_FCH: Type : Payload Only Rate : Eighth Rate 14 05:24:02.76125 R_FCH: Type : Payload Only Rate : Eighth Rate 15 05:24:02.78125 R_FCH: Type : Payload Only Rate : Eighth Rate 16 05:24:02.80125 R_FCH: Type : Payload Only Rate : Eighth Rate 17 05:24:02.82125 R_FCH: Type : Payload Only Rate : Eighth Rate

Consideration ① Example #1 is Dr CDMA parsing result, Example #2 is Qualcomm parsing result. But, basic dm data is the same one. ② Parsing time is different because Qualcomm DM use GPS time.(America GPS = Korea, Japan + 9 hour) ③, ⑤ 1200 bps (Eighth rate), 2400 (Fourth rate), 4800 (Half rate), 9600 (Full rate) ④ In traffic state, system and mobile needs to send order message. (HCM,HDM,PMRM,IN-traffic msge). (Mobile don’t receive paging message in traffic state) There are two methods sending signaling traffic(HCM,HDM…) and secondary traffic(SMS). -Dim and Burst : Divide the frame(20ms) into Primary traffic and Secondary traffic. -Blank and Burst : Instead of sending primary data, send Secondary or Signaling data. (Above case, Two Blank and Burst frames are for in_traffic_message.) ※ Dim (= reduce), Blank (= clean), Burst (= consecutive) ★ We call it “Multiplex Option

77 1.24 Reverse Power Control Information

2001 Feb 5 07:55:33.611 Reverse Power Control Information (See. vol2 2.1.2.3) Band Class = 0 ① Pilot Gating Rate = 0 Frame Offset (ms) = 0.00 Radio Configurations: R_FCH : 3 ←RC3 R_DCCH : 0 R_SCH 0 : 0 R_SCH 1 : 0 Frame Time Rx. Pwr Total Tx Tx. Adj HISTORY PICH PWR PICH+RX FCH TO FCH PWR ★③ ★④ ★⑤ ② -ADJ ⑥ ⑦PICH ⑧ ⑨ ------1 07:55:33.61105 -86.581 +0.083 -13.500 17C1← -0.915 -73.997 -5.875 -6.790 2 07:55:33.63105 -86.581 +0.083 -13.500 0FF0 -0.915 -73.997 -5.875 -6.790 3 07:55:33.65105 -86.581 +0.083 -13.500 85E3 -5.195 -78.276 3.750 -1.445 4 07:55:33.67105 -86.915 +4.083 -8.500 0F80 +3.085 -75.330 -5.875 -2.790 5 07:55:33.69105 -86.915 -1.583 -14.500 49FF -2.582 -74.997 -5.875 -8.457 6 07:55:33.71105 -87.248 +0.417 -12.500 1D54 -0.582 -75.330 -5.875 -6.457 7 07:55:33.73105 -86.915 +0.417 -12.500 381F -0.582 -74.997 -5.875 -6.457 8 07:55:33.75105 -86.915 +0.083 -13.500 84FC -0.915 -74.330 -5.875 -6.790 9 07:55:33.77105 -86.915 -1.917 -15.500 7857 -2.915 -74.330 -5.875 -8.790 10 07:55:33.79105 -87.248 -3.917 -17.500 75F0 -4.915 -74.663 -5.875 -10.790 11 07:55:33.81105 -86.915 +0.083 -14.500 E0F0 -0.915 -73.330 -5.875 -6.790 12 07:55:33.83105 -86.581 +0.417 -14.500 8F07 -0.582 -72.663 -5.875 -6.457 13 07:55:33.85105 -86.581 -3.917 -16.500 2FC9 -4.915 -74.997 -5.875 -10.790 14 07:55:33.87105 -86.581 -1.917 -15.500 2BE0 -2.915 -73.997 -5.875 -8.790 15 07:55:33.89105 -86.915 +0.083 -13.500 80FA -0.915 -74.330 -5.875 -6.790 16 07:55:33.91105 -86.915 -2.250 -16.500 E3C3 -3.249 -73.663 -5.875 -9.124 17 07:55:33.93105 -86.581 -1.583 -15.500 C4C7 -2.582 -73.663 -5.875 -8.457 18 07:55:33.95105 -86.581 -3.583 -17.500 C7C3 -4.582 -73.663 -5.875 -10.457 19 07:55:33.97105 -86.915 +0.083 -12.500 0711 -0.915 -75.330 -5.875 -6.790 20 07:55:33.99105 -86.915 -1.917 -16.500 C2FC -2.915 -73.330 -5.875 -8.790 21 07:55:34.01105 -87.248 +0.417 -13.500 1E07 -4.861 -78.609 3.750 -1.111 22 07:55:34.03105 -87.248 +2.083 -12.500 E0F8 -3.195 -77.943 3.750 +0.555 23 07:55:34.05105 -86.915 +2.750 -11.500 5F03 -2.528 -77.943 3.750 +1.222

Consideration ① North American Cellular Band : Frequency band, A, B Band, 779 CDMA Channel Number. See. Is-2000 2.1.1.1.1 / Band Class 0 North American Cellular Band(Korean Cellular)

78 Band Class 1 North American PCS Band Band Class 2 TACS Band Band Class 3 JTACS Band Band Class 4 Korean PCS Band Band Class 5 NMT-450 Band Band Class 6 IMT-2000 Band Band Class 7 North American 700MHz Cellular Band

② During Reverse Closed Power Control, when BTS receive Reverse Pilot signal from mobile,

BTS measure Reverse Pilot Eb/No by every Eb/No. After mobile compare measured reverse

Eb/No with stored Eb/No Set_point;

If measured Eb/Nt > stored Eb/Nt Set_point, send Power Down Power Control Bit(1) to mobile.

If measure Eb/Nt < stored Eb/Nt Set_point, send Power Up Power Control Bit(0) to mobile.

While mobile receives Power Control Bit by every 1.25ms from BTS, mobiles adjust the power

by unit depending on PWR_CNTL_STEP. (Power Down Reverse Power Control Bit(1), Power

Up Reverse Power Control Bit(0)).

Table 2.1.2.3.2-1. shows Power Step Size depending on PWR_CNTL_STEP.

Vol 2 Table2.1.2.3.2-1 closed loop power control step size

PWR_CNTL_STEP Power Control Step Size Tolerance

0 1 +- 0.5

1 0.5 + - 0.3

2 0.25 + - 0.2

③ mobile Received signal level

④ Total Mobile Tx power = FCH power (Fundamental or Voice) + Reverse Pilot Power

⑤ Tx coverage and Rx coverage comparision If Adjust > 0, Forward coverage > Reverse coverage If Adjust < 0, Reverse Coverage > Forward coverage

79 ⑥ Reverse Pilot power - adjust

⑦ Reverse Pilot power + Reverse power - adjust

⑧ FCH power – Reverse Pilot power

⑨ Mobile transmit pilot power

1.25 Pilot Strength Measurement Message

2001 Feb 5 07:55:43.631 REVERSE TRAFFIC CHANNEL -- Pilot Strength Measurement Msg protocol_rev = 6 (IS2000) (See. vol5 2.7.2.3.2.5) chan_type = 4 (Reverse Traffic) chan rtc_msg gen msg_type = 5 (Pilot Strength Measurement) pil_str hdr ack_seq = 7 msg_seq = 1 ack_req = 1 encryption = 0 ref_pn = 16 (0x10)  reference PN pilot_strength = 18  -9dB (-0.5*pilot_strength) keep = 1  keep indicator(‘1’:keep, ‘0’:drop) num_msr = 3 (0x3)  3 means pilot PN count measured but reference PN. meas[0] pilot_pn_phase = 24962 (0x6182) (pilot_pn = 390, chips = 2, pilot_inc = 2) ① pilot_strength = 16 keep = 1 meas[1] pilot_pn_phase = 2198 (0x896) (pilot_pn = 34, chips = 22, pilot_inc = 2) pilot_strength = 26 keep = 1 meas[2] pilot_pn_phase = 11776 (0x2e00) (pilot_pn = 184, chips = 0, pilot_inc = 2) pilot_strength = 28 keep = 1

① PILOT_PN_PHASE=(PILOT_ARRIVAL+(64*PILOT_PN))mod 215

80 PILOT_ARRIVAL is measured value by comparing pilot arrived time with mobile time relatively. Time difference unit is PN. At this time, standard pilot is pilot arrived early and capable of modulation. Above case; PILOT_PN_PHASE=(2+(64*390))mod 215 = 24962. (2+(64*390) means distance(time delay) from PN start time to received signal time mod 215 : in case of 512 PN, if PN 512 would delay over 64 chip, PN 512 looks like PN 513. But, PN Number is 0~512, thus mod 215 makes PN 513 change to PN 1. (Modulo, mod value; value means period (215-1 PN bit period)) 1.26 Universal Handoff Direction Message

2001 Feb 5 07:55:43.927 FORWARD TRAFFIC CHANNEL -- Universal Handoff Direction Msg protocol_rev = 6 (IS2000) (vol5 3.7.3.3.2.36 참조) chan_type = 3 (Forward Traffic) chan ftc_msg gen msg_type = 34 (Universal Handoff Direction) uhdm_msg hdr ack_seq = 1 msg_seq = 0 ack_req = 1 encryption = 0 use_time = 0 hdm_seq = 2  ①,UHDM sequence number parms_incl = 0  '0':not include, (p_rev and serv_neg_type include indicator) search_included = 1  pilot search parameter(srch win…) include indicator srch srch_win_a = 9 ②80chip,search window size for active set,(vol5 table 2.6.6.2.1-1) srch_win_n = 10  100chip,search window size for neighbor set, (vol5 table 2.6.6.2.1-1) srch_win_r = 10  100chip, search window size for remaining set, (vol5 table 2.6.6.2.1-1) t_add = 28  -14dB,pilot detection threshold, -0.5*t_add(dB) t_drop = 32  -16dB, pilot drop threshold, -0.5*t_drop(dB) t_comp = 5  2.5dB, candidate set to active set comparison threshold(0.5 dB unit) t_tdrop = 3  ③4 seconds. Drop timer value, (vol5 table 2.6.6.2.3-1) soft_slope = 0 add_intercept = 0 drop_intercept = 0 extra_parms = 0  ②,extra parameter included indicator use_pwr_cntl_step = 0  ⑤1dB, vol5 table 3.7.3.3.2.25-1 clear_retry_delay = 0 sch_incl = 0 ④ sch parameter include indicator, SKT system don’t include due to sch hard h/o. fpc_subchan_gain = 27  ⑥,6.75dB(0.25dB unit) use_pc_time = 0  ⑦,implicit ,power control action time indicator ch_ind = 5  fch, channel indicator, (vol5 table 3.7.3.3.2.36-1)

81 num_pilots = 4  4 means the number of Pilot count in UHDM srch_offset_incl = 0  ⑧, '0':Not include, pilot[0] pilot_pn = 16 (0x10) add_pilot_rec_incl = 0  ⑨, '0':not include, ★pwr_comb_ind = 0 ⑩ code_chan_fch = 48 (0x30)  ⑪,walsh code channel on fch, qof_mask_id_fch = 0

pilot[1] pilot_pn = 184 (0xb8) add_pilot_rec_incl = 0 pwr_comb_ind = 1 code_chan_fch = 48 (0x30) qof_mask_id_fch = 0 pilot[2] pilot_pn = 390 (0x186) add_pilot_rec_incl = 0 pwr_comb_ind = 0 code_chan_fch = 16 (0x10) qof_mask_id_fch = 0 pilot[3] pilot_pn = 34 (0x22) add_pilot_rec_incl = 0 pwr_comb_ind = 0 code_chan_fch = 16 (0x10) qof_mask_id_fch = 0 rev_fch_gating_mode = 0

Consideration 1 Mobile use this value to discriminate the order that sends pilot strength (reported on PMRM). The value is same at last_hdm_seq. Pilot(s) reported is (are) same at pilot(s) in UHDM.

82 ②

vol5 Table 2.6.6.2.1-1. Searcher Window Sizes

SRCH_WIN_A SRCH_WIN_A window_size window_size SRCH_WIN_N SRCH_WIN_N (PN chips) (PN chips) SRCH_WIN_NGHBR SRCH_WIN_NGHBR SRCH_WIN_R SRCH_WIN_R CF_SRCH_WIN_N CF_SRCH_WIN_N

0 4 8 60

1 6 9 80

2 8 10 100

3 10 11 130

4 14 12 160

5 20 13 226

6 28 14 320

7 40 15 452

vol5 Table 2.6.6.2.3-1. Handoff Drop Timer Expiration Values

Timer Timer T_TDROP Expiration T_TDROP Expiration (seconds) (seconds)

0  0.1 8 27 1 1 9 39

2 2 10 55

3 4 11 79

4 6 12 112

5 9 13 159

6 13 14 225

7 19 15 319

④ If it sets ‘1’, parameters (packet_zone_id, frame_offset, private_pcm) are included. ⑤ BTS sets power step size that mobile uses at closed loop power control. ⑥ forward power control sub_channel relative gain. The level difference between 20m frame power level which Forward power control sub_channel is puncturing in and forward link power control

83 sub_channel power. (Recommendation (SKT) 1way case 8(2dB),2way case 20(5dB),more than 3way 27(6.75 dB)) ⑦ The usage of Explicit action time at which new power control sub_channel gain become. ※ explicit action time means when mobile execute the order. . Mobile set action for time system time(80ms unit, modulo 64), At that point, fpc_subchan_gain in message become valid.. ⑧ target pilot channel search window offset included indicator. (vol5 table 2.6.6.2.1-2) ⑨ additional pilot information included indicator. If sets ‘1’, additional pilot information listed in pilot_rec_type, record_len field include. ⑩ Set ‘1’, if forward traffic channel related on the pilot has same closed loop power control sub_channel bit comparing previous pilot’ closed loop power control sub_channel bit. If not, set ‘0’. ※ First coming BTS has a value 0. In case next PN(sub-cell) is softer HO, value become 1. Thus, summation of “0” number is equal to show how many BTS serve for this call. ⑪RC1,2,3,5 case 1~63, RC4,6,8 case 1~127, RC7,9 case 1~255.

1.27 Handoff Completion Message

2001 Feb 5 07:55:43.971 REVERSE TRAFFIC CHANNEL -- Handoff Completion Msg protocol_rev = 6 (IS2000) (See. vol5 2.7.2.3.2.10) chan_type = 4 (Reverse Traffic) chan rtc_msg gen msg_type = 10 (Handoff Completion) comp hdr ack_seq = 0 msg_seq = 3 ack_req = 1 encryption = 0 last_hdm_seq = 2 Now, UHDM sequence number which decides active set. num_pilots = 4 Pilot count in HCM pilot_pn[0] = 16 (0x10) master pilot PN pilot_pn[1] = 184 (0xb8) 2nd pilot PN pilot_pn[2] = 390 (0x186) 3rd pilot PN pilot_pn[3] = 34 (0x22) 4th pilot PN

1.28 Extended Neighbor List Update Message

2001 Feb 5 07:55:44.568 FORWARD TRAFFIC CHANNEL -- Extended Neighbor List Update Msg protocol_rev = 6 (IS2000) (See. Vol5. 3.7.3.3.2.26)

84 chan_type = 3 (Forward Traffic) chan ftc_msg <- forward traffic channel message (Message received on conversation) gen msg_type = 26 (Extended Neighbor List Update) ext_nlu hdr ack_seq = 3 msg_seq = 1 ack_req = 1 encryption = 0 pilot_inc = 2 nghbr_srch_mode = 0 <- Set ‘0’, No search priorities or search windows, Vol5. Table 3.7.2.3.2.22-1 Search Mode Field srch_win_n = 10 use_timing = 0 <- If adjacent BTS don’t include serving BTS’ timing information, set ‘0’. num_nghbr = 20 nghbr[0] nghbr_pn = 54 (0x36) nghbr[1] nghbr_pn = 222 (0xde) nghbr[2] nghbr_pn = 312 (0x138) nghbr[3] nghbr_pn = 144 (0x90) nghbr[4] nghbr_pn = 172 (0xac) nghbr[5] nghbr_pn = 250 (0xfa) nghbr[6] nghbr_pn = 362 (0x16a) nghbr[7] nghbr_pn = 50 (0x32) nghbr[8] nghbr_pn = 194 (0xc2) nghbr[9] nghbr_pn = 26 (0x1a) nghbr[10] nghbr_pn = 288 (0x120) nghbr[11] nghbr_pn = 22 (0x16) nghbr[12] nghbr_pn = 260 (0x104) nghbr[13]

85 nghbr_pn = 218 (0xda) nghbr[14] nghbr_pn = 96 (0x60) nghbr[15] nghbr_pn = 352 (0x160) nghbr[16] nghbr_pn = 82 (0x52) nghbr[17] nghbr_pn = 118 (0x76) nghbr[18] nghbr_pn = 286 (0x11e) nghbr[19] nghbr_pn = 386 (0x182) srch_offset_incl = 1 <- Neighbor pilot channel search window offset included add_nghbr[0] add_pilot_rec_incl = 0 <- Set ‘0’, when additional pilot information exist. add_nghbr[1] add_pilot_rec_incl = 0 add_nghbr[2] add_pilot_rec_incl = 0 add_nghbr[3] add_pilot_rec_incl = 0 add_nghbr[4] add_pilot_rec_incl = 0 add_nghbr[5] add_pilot_rec_incl = 0 add_nghbr[6] add_pilot_rec_incl = 0 add_nghbr[7] add_pilot_rec_incl = 0 add_nghbr[8] add_pilot_rec_incl = 0 add_nghbr[9] add_pilot_rec_incl = 0 add_nghbr[10] add_pilot_rec_incl = 0 add_nghbr[11] add_pilot_rec_incl = 0 add_nghbr[12] add_pilot_rec_incl = 0 add_nghbr[13] add_pilot_rec_incl = 0 add_nghbr[14] add_pilot_rec_incl = 0

86 add_nghbr[15] add_pilot_rec_incl = 0 add_nghbr[16] add_pilot_rec_incl = 0 add_nghbr[17] add_pilot_rec_incl = 0 add_nghbr[18] add_pilot_rec_incl = 0 add_nghbr[19] add_pilot_rec_incl = 0

1.29 In-traffic message

2002 March 13:57:31.787 Forward TRAFFIC CHANNEL -- In_traffic Msg

PROTOCOL_REV : 0

MSG_LENGTH: 18 MSG_TYPE: 7 ACK_SEQ: 4 MSG_SEQ: 3 ACK_REQ: 1 ENCRYPTION: 0 SID: 12336 NID: 14 SRCH_WIN_A: 6 SRCH_WIN_N: 8 SRCH_WIN_R: 9 T_ADD: 28 T_DROP: 32 T_COMP: 8 T_TDROP: 3 NGHBR_MAX_AGE: 0

Consideration

In_traffic_message is very close to system parameter message. Mobile shall update this message, if received message is not the same as it have. ★ In traffic state, BTS don’t send system parameter message, so mobile have origination BTS sys_para. If mobile moves and handoff happen, mobile need to update sys_parameter.

Objective: The massage helps mobile do handoff effectively in region where system environment change severely.

87 (example: in subway, repeater service area…)

※ Details are in system parameter message.

1.30 Release Order Message

2001 Feb 5 07:57:52.970 REVERSE TRAFFIC CHANNEL -- Order Msg protocol_rev = 6 (IS2000) chan_type = 4 (Reverse Traffic) chan rtc_msg gen msg_type = 1 (Order) rtc_ord gen hdr ack_seq = 3 msg_seq = 4 ack_req = 1 encryption = 0 order = 21 (Release Order Normal/Power Down/Service Inactive Ind) ordq ordq_incl = 1<- ordq (Set ‘1’, when order qualification code exist.) ordq = 2 (Release Order - Service Inactive Indication) <- Vol5. Table 3.7.4-1

2001 Feb 5 07:57:53.122 FORWARD TRAFFIC CHANNEL -- Order Msg protocol_rev = 6 (IS2000) chan_type = 3 (Forward Traffic) chan ftc_msg gen msg_type = 1 (Order) ftc_ord gen hdr ack_seq = 4 msg_seq = 3 ack_req = 0 encryption = 0

88 use_time = 0 action_time = 0 order = 16 (Base Station Acknowledgement Order)

2001 Feb 5 07:57:53.142 FORWARD TRAFFIC CHANNEL -- Order Msg protocol_rev = 6 (IS2000) chan_type = 3 (Forward Traffic) chan ftc_msg gen msg_type = 1 (Order) ftc_ord gen hdr ack_seq = 4 msg_seq = 4 ack_req = 0 encryption = 0 use_time = 0 action_time = 0 order = 21 (Release - No Reason/SO rejected Order) ordq ordq_incl = 0

1.31 SCRM (Supplemental channel request message)

[ 16:19:35.386 ] Reverse Traffic Channel PROTOCOL_REV : 0 Supplemental channel request

MSG_Length: 20 MSG_TYPE: 18 ACK_SEQ: 7 MSG_SEQ: 2 ACK_REQ: 0 ENCRYPTION: 0 SIZE_OF_REQ_BLOB: 3 REQ_BLOB: 228 39 255 USE_SCRM_SEQ_NUM: 0

89 REF_PN: 476 PILOT_STRENGTH: -7.50 NUM_ACT_PN: 2 ACT_PN_PHASE : 29440, PN : 460 (+0, Distance : 0.000 m) ACTIVE_PILOT_STRENGTH: -11.00 ACT_PN_PHASE : 11138, PN : 174 (+2, Distance : 487.800 m) ACTIVE_PILOT_STRENGTH: -15.00 NUM_NGHBR_PN: 1 NGHBR_PN_PHASE : 17793, PN : 278 (+1, Distance : 243.900 m) NGHBR_PILOT_STRENGTH: -12.00 REF_PILOT_REC_INCL: 0 PILOT_REC_INCL: 0 PILOT_REC_INCL: 0 PILOT_REC_INCL: 0

Consideration

★When the mobile wants to start up-load (File…), send the SCRM message for recourse assignment. After BTS receives this message, send it to SDU. Then, SDU checks recourses and assignment the ESCAM message.

2.Call Termination (Voice, Data)

2.1 Alert with Information Message

2001 Mar 25 10:01:48.069 FORWARD TRAFFIC CHANNEL -- Alert with Information Msg protocol_rev = 6 (IS2000) (See. vol5 3.7.3.3.2.3, 3.7.5.3) chan_type = 3 (Forward Traffic) chan ftc_msg gen msg_type = 3 (Alert With Information) alert hdr ack_seq = 1 msg_seq = 4 ack_req = 1 encryption = 0 num_recs = 2  information record number (recs[0],[1]) recs[0] hdr record_type = 3  record type, calling party number(Origination subscriber No.), (See. vol5

90 table3.7.5-1) calling fix number_type = 2 number type, national number, (See. vol5 table2.7.1.3.2.4-2) number_plan = 1 numbering plan, ISDN/Telepony numbering plan,(vol5 table2.7.1.3.2.4-2) pi = 0  presentation indicator, Origination number display method (Vol5 table 2.7.4.4-1) si = 2  screening indicator, Origination number security method. (Vol5 table 2.7.4.4-2) num_char = 11 Origination number (01192005128) character counts var[0] = 48 0 var[1] = 49 1 var[2] = 49 1 var[3] = 57 9 var[4] = 50 2 ASCII x3.4 var[5] = 48 0 (MSB is always zero) var[6] = 48 0 var[7] = 53 5 var[8] = 49 1 var[9] = 50 2 var[10] = 56 8 recs[1] hdr record_type = 5  record type, signal, (See. vol5 table3.7.5-1) signal  Information record makes network send information using tone, other alerting signal. signal_type = 2 signal type, (vol5 table3.7.5.5-1) alert_pitch = 0 pitch of alerting signal, (vol5 table 3.7.5.5-2) signal = 1 signal code, (See. vol5 table 3.7.5.5-2)

Table 3.7.5.5-1 Signal type Description SIGNAL TYPE (Binary) Voice signal 00 ISDN Alerting 01 IS-54B Alerting 10 Reserved 11

Table 3.7.5.5-2 Pitch Height Description SIGNAL TYPE (Binary) Medium Pitch 00 High Pitch 01 Low Pitch 10 Reserved 11

91 2.2 Connect Order Message

2001 Mar 25 10:01:53.196 REVERSE TRAFFIC CHANNEL -- Order Msg protocol_rev = 6 (IS2000) chan_type = 4 (Reverse Traffic) chan rtc_msg gen msg_type = 1 (Order) rtc_ord gen hdr ack_seq = 5 msg_seq = 3 ack_req = 1 encryption = 0 order = 24 (Connect Order)

3. Paging and status report (Voice, Data)

3.1 Quick paging

[ 14:26:10.952 ] Quick Paging Channel Statistics PROTOCOL_REV : 6

CHANG : 80 RATE : 0 --- 0—4800bps, 1-9600 bps PILOT_PN : 82 --- idle state dominant PN number PI_LEVEL : 0 THI : 25 THB : 4 NUM_ENTRIES : 2 --- One mobile has two indicator bits. ENTRY[0] STATUS : 3 -> ERASURE, (2 -> INDICATOR BIT DETECTED) TYPE : 0 -> PI INDICATOR BIT #1 POSITION : 58 IND(I, Q) : (-2, -2) PILOT(I, Q) : (16, 0) ENTRY[1] STATUS : 3 -> ERASURE TYPE : 1 -> PI INDICATOR BIT #2 POSITION : 281 IND(I, Q) : (1, -1) PILOT(I, Q) : (2, 0)

92 3.2 Access channel (Paging response)

[ 14:25:45.710 ] Access Channel (Motorola system logging data) PROTOCOL_REV : 6 Page response

PD: 1 MSG_TYPE: 5 LAC_LENGTH: 13 ACK_SEQ: 0 MSG_SEQ: 7 ACK_REQ: 1 VALID_ACK: 1 ACK_TYPE: 2 MSID_TYPE: 3 MSID_LEN: 9 ESN: 4501192(0x0044AEC8) IMSI_CLASS: 0 IMSI_CLASS_0_TYPE: 0 RESERVED: 0 IMSI_S[HI]: 0 IMSI_S[LO]: 1502406516 -> MIN : 019-0674-9995 –Mobile number AUTH_MODE: 0 --- No use authentication. (1  Use authentication) ACTIVE_PILOT_STRENGTH: 10 FIRST_IS_ACTIVE: 1 FIRST_IS_PTA: 0 NUM_ADD_PILOTS: 0 MOB_TERM: 1 SLOT_CYCLE_INDEX: 2 MOV_P_PEV: 6 SCM: 42 REQUEST_MODE: 1 SERVICE_OPTION: 33 ---Service option PM: 0 NAR_AN_CAP: 0 NUM_ALT_SO: 0 ALT_SO: UZID_INCL: 0 CH_IND: 1 CH_IND : Fundamental Channel OTD_SUPPORTED: 0 QPCH_SUPPORTED: 1 –QPCH support

93 ENHANCED_RC: 1 ★FOR_RC_PREF: 4 --- Forward Radio configuration REV_RC_PREF: 3 --- Reverse Radio configuration FCH_SUPPORTED: 1 FCH_FRAME_SIZE: 0 FOR_FCH_LEN: 2 FOR_FCH_RC_MAP: 7 6 REV_FCH_LEN: 2 REV_FCH_RC_MAP: 7 4 DCCH_SUPPORTED: 0 ENC_INFO_INCL: 0 UI_ENCRYPT_REQ: 0 UI_ENCRYPT_SUP: 6 SYNC_ID_INCL: 1 SYNC_ID: 33823

3.3 Searcher and Finger information

[ 14:09:43.025 ] Searcher and finger information PROTOCOL_REV : 0

BAND_CLASS : 3 (832 to 925MHz JTACS Band) --- Searcher Information --- SEARCH_PILOT: 314 --- ① Searcher check PN number SEARCH_PILOT_SET : Neighbor Set --- ② searching PN type (Neighbor or Active) SRCH_STATE : 7 -> Slotted Mode sleep state ★WINDOW_CENTER : 0x2E68 WINDOW_END : 0x2F58 --- ③ Peak Pos(1/2Chp) Ec/Io --- ④ A searcher does correlation every 1/2 chip. ------1 62 -19.207 ⑤ 2 65 -19.207 3 59 -21.067 4 105 -21.512 ** Combined Ec/Io: -14.10 ⑥ ---- Finger Information ---- Finger PN Sector ★POS ★Ec/Io ------1 318 0 0x2E6A -6.747 ⑦ Active PN information. 2 318 0 0x2E78 -17.610 3 This Finger is not locked 4 This Finger is not assigned ** Combined Ec/Io: -6.40

94 Consideration ③ Neighbor set case, (WINDOW_END – WINDOW_CENTER)/8 = Neighbor window size/2 Active set case, (WINDOW_END – WINDOW_CENTER)/8 = Active window size/2 (These values are hexadecimal; so first change them to decimal to calculation) ※Active set case, searcher checks PN Ec/Io by a 1/8 chip unit. (For accuracy) Neighbor set case, searcher checks PN Ec/Io by a 1/2 chip unit. (For speed) Above case, 0x2E68 equals to decimal 11880. 0x2F58 equals to decimal 12120. 12120-11880=240. Unit is 1/8 chip, so 240*1/8 chip=30 chip. From center to end side length is 30 chip. Total window size = 30 chip * 2 = 60 chip (Win_N = 8) If ③ is active set, value is Win_A. (Neighbor set case, Win_N) ⑤ Above case, 62 means 31 chip delay(62/2) away from mobile standard time. –19.207 means Ec/Io value. ⑥ Combined value. 10* Log(10( peek1_ Ec / Io /10) 10( peek 2 _ Ec / Io /10) 10( peek3 _ Ec / Io /10) 10( peek4 _ Ec / Io /10) ) 7 Finger 1,2,3,4 situations. POS = position. How much delay from WINDOW_CENTER? (WINDOW_CENTER – POS)/8 = delay.

3.4 Markov statistic

[ 14:10:09.442 ] Markov statistics PROTOCOL_REV : 0

Total # of Frames: 100 ---① Received frame count (Every 2 second data) 8Kbps non-Markov Full Rate: 23 ---① 9600 bps frame count Half Rate: 0 ---② 4800 bps frame count Quarter Rate: 0 ---③ 2400 bps frame count Eighth Rate: 74 ---④ 1200 bps frame count Erasure: 3 ---⑤ Error bps frame count (Only Full rate frame has CRC bit) FER : : 0.03 ---⑥ Error rate (Erasure/Total frame * 100)%

Consideration -Voice FER = (Erasure count/100 frame)*100 (%) -Full rate and Half rate have CRC bit, however quarter and eighth rate haven’t CRC bit. All erasure frames comes from Full or Half rate.

3.5 Access Probe info

[ 14:25:38.149 ] Access probe info PROTOCOL_REV : 6

SEQ_NUM: 1 ---① Attempt sequence number (See. Access parameter message) PROBE_NUM: 1 ---② Attempt probe number (See, Access parameter message) RX_AGC: 214 --- TX_ADJ: 0 --- RSIST: 1 --- CHANNEL: 0 --- RANDOM_M: 0 --- BACKOFF_RS: 0 ---See. Access parameter BACKOFF_RT: 0 ---See. Access parameter

Consideration After call complete, Access probe info message displays. This information is good index to know a reverse field condition and access channel capacity. We can check Reverse link condition. If SEQ_NUM or PROBE_NUM is more than 1, origination place seems to be bad reverse quality area or too far away from BTS.

3.6 Service configuration

[ 14:27:10.147 ] Service configuration PROTOCOL_REV : 6

SERVICE OPTION: 33 FOR_FCH_RC : 4FOR_SCH0 : 4FOR_SCH1 : 0FOR_DCCH : 0 REV_FCH_RC : 3REV_SCH0 : 3REV_SCH1 : 0REV_DCCH : 0 FCH_FRAME_SIZE: 0 DCCH_FRAME_SIZE: 1 FOR_TRAFFIC: 1 The SO connection uses primary traffic on the FTCH REV_TRAFFIC: 1 The SO connection uses primary traffic on the RTCH FOR_MUX_OPTION: 1 REV_MUX_OPTION: 1 -- Forward Link -- Full Rate Allowed Half Rate Allowed Quarter Rate Allowed Eighth Rate Allowed -- Reverse Link -- Full Rate Allowed Half Rate Allowed

96 Quarter Rate Allowed Eighth Rate Allowed NUM_FOR_SCH: 1 ---SCH 0 only NUM_REV_SCH: 1 ---SCH 0 only Link Type: Forward Link SCH_ID: 0 SCH_MUX_OPTION: 2337 --- Decimal 2337 = Hexa 0x921 SCH_CODING_TYPE: Convolution Coding SCH_MUX_OPTION: 2321 --- Decimal 2321 = Hexa 0x911 SCH_CODING_TYPE: Convolution Coding

Consideration

Multiplex option use RLP frame format Less than rate 1 A B C D Ox1, 0x2 Y Y Y N N 0x3, 0x4 N Y Y N N 0x704 Y N N N N 0x809, 0x80a, 0x811, 0x812, 0x821, 0x822, 0x905, N N N Y Y 0x906, 0x909, 0x90a, 0x911, 0x912, 0x921, 0x922 0xf20 N N N Y Y

Format A: For Primary traffic or secondary traffic. It has length field. (Variable data available) Format B: For Primary traffic or secondary traffic. It hasn’t length field. (Rate set 1 case, 9.6K only) Format C: For SCH. It hasn’t length field. (Transmit full rate only—95B MDR, 2000 1x HSPD) Format D: For SCH. It has length field. (Variable data available—retransmission segmented data) MuxPDU Type 1,2,3 SCH Multiplex Option Maximum Number of Multiplex Option MuxPDUs in the Physical layer Rate set 1 (9600 bps) Rate set 2 (14400 bps) SCH SDU rate MuxPDU MuxPDU Type 3 MuxPDU MuxPDU Type 3 MuxPDU MuxPDU Type 3 Type 1,2 Single Double Type 1 Single Double Type 2 Single Double 1x 1 0x03 0x04 2x 2 1 0x809 0x905 0x80a 0x906 4x 4 2 0x811 0x909 0x812 0x90a 8x 8 4 0x821 0x911 0x9822 0x912 16x 8 0x921 0x922

4.Service Redirection Message (SRM)

2001 Mar 23 12:56:25.391 FORWARD TRAFFIC CHANNEL -- Service Redirection Msg protocol_rev = 6 (IS2000) (vol5 3.7.2.3.2.16 ) chan_type = 3 (Forward Traffic)

97 chan ftc_msg gen msg_type = 23 (Service Redirection) tc_srv_redir hdr ack_seq = 1 msg_seq = 4 ack_req = 1 encryption = 0 return_if_fail = 0  ① Allow tuning again, when mobile fail to do redirection. delete_tmsi = 0  ② ‘0’ means “no use TMSI”. redirect_type = 1  ③ NDSS redirection record_type = 2  ④ Redirection in cdma system redir rec2 band_class = 0 expected_sid = 2236 (0x8bc)  SID for redirection (make a decision to see MIN) expected_nid = 65535 (0xffff)  wildcard, Compare SID regardless NID num_chans = 1 cdma_chan[0] = 29 (0x1d)  CH for redirection

Consideration

① Return If faIl indicator System makes mobile use Redirection Criteria designated. But, when redirection order is failed, value ‘1’ mean that system let mobile return original system.

② TMSI delete indicator When mobile needs to delete TMSI assigned already, BTS set the field ‘1’. Otherwise, set ‘1’.

③ Table 3.7.2.3.2.16-1. Redirection Types Description REDIRECT_TYPE(binary ) Normal redirection 0 NDSS redirection 1

98 Table 3.7.2.3.2.16-2. Redirection Record Types Description RECORD_TYPE (binary) NDSS off indication 0 Redirection to an analog system as defined in [12], [21], [22], [25], [24], and[6] 1 Redirection to a CDMA system as defined in [24] and [2] 10 Redirection to a TACS analog system as defined in Department of Trade and 11 Industry’s TACS Mobile Station-Land Station Compatibility Specification, Issue 4, Amendment 1. Redirection to aJTACS analog system as defined in ARIB’s RCR STD-36. 100 All other RECORD_TYPE values are reserved

5.Enhanced Hard h/o

5.1 Candidate Frequency Search Request Message

2001 Mar 22 19:28:59.874 FORWARD TRAFFIC CHANNEL -- Candidate Frequency Search Request Msg protocol_rev = 6 (IS2000) (vol5 3.7.3.3.2.27) chan_type = 3 (Forward Traffic) chan ftc_msg gen msg_type = 27 (Candidate Frequency Search Request) cfs_req fixed hdr ack_seq = 2 msg_seq = 4 ack_req = 1 encryption = 0 use_time = 0 action_time = 0 cfsrm_seq = 2  candidate frequency search request message number. It increases by modulo4. search_type = 3 search command type,periodic search, (vol5 table3.7.3.3.2.27-1) search_period = 2 2 sec. Contnuous serch time in candidate frequency (vol5 2.6.6.2.8.3.2-1) search_mode = 0 search for CDMA pilots on a candidate frequency,search mode, vol5 table3.7.3.3.2.27-2 mode mod_0 band_class = 0 cdma_freq = 779 (0x30b) sf_total_ec_thresh = 31 ①serving frequency total pilot Ec threshold

99 sf_total_ec_io_thresh = 31 ②serving frequency total pilot Ec/Io threshold diff_rx_pwr_thresh = 0 ③ minimum difference in received power min_total_pilot_ec_io = 0 ④ minimum total pilot Ec/Io cf_t_add = 23 ⑤-11.5dB,pilot detction threshold for the CDMA candidate frequency tf_wait_time = 3 ⑥CDMA Candidate frequency total wait time cf_pilot_inc = 2  After handoff, PN offset increment in CDMA candidate frequency cf_srch_win_n = 10 default search window size for the candidate frequency search neihbor set cf_srch_win_r = 0  default search window size for the candidate frequency search remaining set pilot_update = 1  pilot search parameter update indicator. Set ‘1’, if mobile change pilot search parameter. Otherwise ‘0’ num_pilots = 12 cf_nghbr_srch_mode = 0 ⑦search mode for candidate frequency search set pilot_rec[0] nghbr_pn = 188 (0xbc) search_set = 0 ⑧ Flag indicates whether this pilot is searched or not. pilot_rec[1] nghbr_pn = 152 (0x98) search_set = 0 pilot_rec[2] nghbr_pn = 260 (0x104) search_set = 0 pilot_rec[3] nghbr_pn = 428 (0x1ac) search_set = 0 pilot_rec[4] nghbr_pn = 254 (0xfe) search_set = 0 pilot_rec[5] nghbr_pn = 422 (0x1a6) search_set = 0 pilot_rec[6] nghbr_pn = 66 (0x42) search_set = 0 pilot_rec[7] nghbr_pn = 402 (0x192) search_set = 0 pilot_rec[8] nghbr_pn = 234 (0xea) search_set = 0 pilot_rec[9] nghbr_pn = 338 (0x152) search_set = 0 pilot_rec[10]

100 nghbr_pn = 170 (0xaa) search_set = 0 pilot_rec[11] nghbr_pn = 30 (0x1e) search_set = 1 cf_srch_offset_incl = 0  ‘0’: Not include. neighbor pilot channel search windows offset include. pilot_rec2[0] add_pilot_rec_incl = 0 pilot_rec2[1] add_pilot_rec_incl = 0 pilot_rec2[2] add_pilot_rec_incl = 0

Consideration ① Set ‘11111(=31)”, if mobile don’t measure total Ec in active pilot set at candidate frequency periodic (total_ec_thresh+120) searching. Set (10*log10 /2. If not. If total Ec in active pilot set on serving frequency is bigger than total_ec_thresh, mobile don’t search candidate frequency.

② Set ‘11111(=31)’, at cadidate frequency peridodic seaech process if mobile don’t measure total Ec/Io in (total_ec_io_thresh) active pilot set on serving frequency. Set -20*log10 , if not. If total Ec/Io in active set on serving frequency is bigger than total_ec_io_thresh, mobile don’t search candidate frequency. ③ Set “000000”, if mobile search pilot in CDMA candidate frequency regardless of Rx power. Set (minimum_power_diff+30)/2, if not. minimum_power_diff means the Rx power difference between candidate frequency and serving frequency. (dBm/1.23MHz)

④ Set ‘00000’, if system don’t make mobile demodulate the pilot(forward traffic channel) in active set total_pilot_thresh regareless of pilot strength. Set -20*log10 , if not. If All summation of pilots Ec/Io in active set is less than total_pilot_threshold, mobile don’t demodulate forward traffic channe.

⑤ While mobile search PN on candidate frequency periodically, this value means trigger that can send “candidate frequency search report message”.

⑥BTS sets Maximum time max_wait_time/0.08 . The mobile waits good frame for (N11m*20) on CDMA Target frequency.

⑦no search priorities or search windows specified, (See. vol5 table3.7.3.3.27-3)

⑧Set ‘1’, If mobile adds this pilot in candidate frequency set.. Set ‘0’, If not.

5.2 Candidate Frequency Search Response Message

101 2001 Mar 22 19:29:00.304 REVERSE TRAFFIC CHANNEL -- Candidate Frequency Search Response Msg protocol_rev = 6 (IS2000) (vol5 2.7.2.3.2.19) chan_type = 4 (Reverse Traffic) chan rtc_msg gen msg_type = 19 (Candidate Frequency Search Response) cfs_rsp hdr ack_seq = 3 msg_seq = 3 ack_req = 1 encryption = 0 last_cfsrm_seq = 2  candidate frequency search request message sequence number total_off_time_fwd = 7 ① max_off_time_fwd = 7② total_off_time_rev = 7③ max_off_time_rev = 7④ pcg_off_times = 0  off time (dropping present ch), power control group unit align_timing_used =0 Set ‘1’, while mobile become off on present serving frequency, candidate frequency visit count is same at request count from BTS. Set ‘0’, if not.

Consideration ① For tuning new candidate frequency, It is total count of frame or power control group to drop present foward traffic channel. This is set by mobile estimation value. ② For tuning new candidate frequency, It is maximum count of frame or power control group to drop present foward traffic channel. This is set by mobile estimation value. ③ For tuning new candidate frequency, It is total count of frame or power control group to drop present reverse traffic channel. This is set by mobile estimation value. ④ For tuning new candidate frequency, It is maximum count of frame or power control group to drop present reverse traffic channel. This is set by mobile estimation value.

5.3 Candidate Frequency Search Report Message

2001 Mar 22 19:29:15.343 REVERSE TRAFFIC CHANNEL -- Candidate Frequency Search Report Msg protocol_rev = 6 (IS2000) (See. vol5 2.7.2.3.2.20) chan_type = 4 (Reverse Traffic) chan rtc_msg gen msg_type = 20 (Candidate Frequency Search Report) cfs_rpt

102 fix hdr ack_seq = 3 msg_seq = 2 ack_req = 1 encryption = 0 last_srch_msg = 0 ① last_srch_msg_seq = 2  sequence number in message that start search reported) search_mode = 0 See. candidate frequency search request meessage var mod0 band_class = 0 cdma_freq = 779 (0x30b) sf_total_rx_pwr = 10 ② total rx power on serving frequency cf_total_rx_pwr = 14 ③ total rx power on serving frequency on target frequency or candidate frequency

num_pilots = 1 pilot[0] pilot_pn_phase = 1942 (0x796) PN 30 pilot_strength = 7 -3.5dB

Consideration ①Message type reported at beginging of search. Set ‘0’, if message is sent to report result of single search or periodic search thru candidate frequency search control message or candidate frequency search request meessage에 single search.

②Mobile set the FIELD min(31,(total_received_power+110)/2. At that time, total_received_power is mean input power measured (dBm/1.23MHz) on serving frequency. Above case, sf_total_rx_pwr is ‘10’, thus (total_received_power+110)/2 become 10. And total_received_power become –90dBm.

③ Mobile sets FIELD min(31,(total_received_power+110)/2. At that time, total_received_power is mean input power(dBm/1.23MHz) on target frequency or candidate frequency. Above case, cf_total_rx_pwr is ‘14’, thus (total_received_power+110)/2 becomes ‘14’. And total_received_power become –82dBm.

5.4 Candidate Frequency Search Control

2001 Mar 22 19:29:15.474 FORWARD TRAFFIC CHANNEL -- Candidate Frequency Search Control Msg protocol_rev = 6 (IS2000) (See. vol5 3.7.3.3.2.28) chan_type = 3 (Forward Traffic) chan ftc_msg gen

103 msg_type = 28 (Candidate Frequency Search Control) cfs_ctrl hdr ack_seq = 2 msg_seq = 5 ack_req = 1 encryption = 0 use_time = 0 action_time = 0 cfscm_seq = 2 candidate frequency search control message sequence number search_type = 0 search command type,periodic search, (See. vol5 table3.7.3.3.2.27-1)

Now, BTS sends request, when Mobile catch border cell pn. Now, In case Mobile catch border cell ‘a’ and other border cell ‘b’ simultaneously, mobile receive control message.

Reference

1. 3GPP2-CDMA 2000-1 Introduction, Physical, MAC, LAC, Upper layer 2. STD-T64-C.S 00170-0, 0-1, 0-2