鼎立测试信令解释

2000 1x CAI MessageanalysisLecturer: Hong Jeong HoRevision HistoryVersion 1.0 2002.4 Draft version – SK Telecom Samsung System.Version 2.0 2002.5 Add Japan KDDI Motorola system dataVersion 2.1 2002.9 Re-configuration for teaching material.Contents1.CALL ORIGINATION (VOICE, DATA) (3)1.1S YNC C HANNEL M ESSAGE (3)1.2G ENERAL P AGE M ESSAGE (7)1.3N EIGHBOR L IST M ESSAGE (11)1.4CDMA C HANNEL L IST M ESSAGE (13)1.5E XTENDED S YSTEM P ARAMETERS M ESSAGE (13)1.6G ENERAL N EIGHBOR L IST M ESSAGE (19)1.7S YSTEM P ARAMETERS M ESSAGE (21)1.8A CCESS P ARAMETERS M ESSAGE (25)1.9R EGISTRA TION M ESSAGE (29)1.10O RDER M ESSAGE (32)1.11O RIGINA TION M ESSAGE (39)1.12E XTENDED C HANNEL A SSIGNMENT M ESSAGE (44)1.13S ERVICE R EQUEST M ESSAGE (47)1.14S ERVICE C ONNECT M ESSAGE (50)1.15S ERVICE C ONNECT C OMPLETION M ESSAGE (52)1.16P OWER C ONTROL M ESSAGE (52)1.17P OWER C ONTROL P ARAMETERS M ESSAGE (54)1.18P OWER M EASUREMENT R EPORT M ESSAGE (55)1.19E XTENDED S UPPLEMENTAL C HANNEL M ESSAGE (55)1.20RLP S TA TISTICS (59)1.21F AST F ORWARD P OWER C ONTROL I NFORMA TION (65)1.22F ORW ARD F RAME I NFORMA TION (66)1.23R EVERSE F RAME I NFORMA TION (69)1.24R EVERSE P OWER C ONTROL I NFORMA TION (72)1.25P ILOT S TRENGTH M EASUREMENT M ESSAGE (74)1.26U NIVERSAL H ANDOFF D IRECTION M ESSAGE (75)1.27H ANDOFF C OMPLETION M ESSAGE (78)1.28E XTENDED N EIGHBOR L IST U PDATE M ESSAGE (78)1.29I N-TRAFFIC MESSAGE (81)1.30R ELEASE O RDER M ESSAGE (82)1.31SCRM(S UPPLEMENTAL CHANNEL REQUEST MESSAGE) (83)2.CALL TERMINATION (VOICE, DATA) (84)2.1A LERT WITH I NFORMA TION M ESSAGE (84)2.2C ONNECT O RDER M ESSAGE (86)3. PAGING AND STATUS REPORT (VOICE, DATA) (86)3.1Q UICK PAGING (86)3.2A CCESS CHANNEL (P AGING RESPONSE) (87)3.3S EARCHER AND F INGER INFORMA TION (88)3.4M ARKOV STA TISTIC (89)3.5A CCESS P ROBE INFO (89)3.6S ERVICE CONFIGURATION (90)4.SERVICE REDIRECTION MESSAGE (SRM) (91)5.ENHANCED HARD H/O (93)5.1C ANDIDATE F REQUENCY S EARCH R EQUEST M ESSAGE (93)5.2C ANDIDATE F REQUENCY S EARCH R ESPONSE M ESSAGE (95)5.3C ANDIDATE F REQUENCY S EARCH R EPORT M ESSAGE (96)5.4C ANDIDATE F REQUENCY S EARCH C ONTROL (97)1.Call Origination (Voice, Data)1.1 Sync Channel Message2001 Feb 5 07:46:52.493 SYNC CHANNEL -- Sync Channel Msg (vol5. 3.7.2.3.2.25)protocol_rev = 6 (IS2000)chan_type = 0 (Sync)chansc_msggenmsg_type = 1 (Sync) ←①syncp_rev = 6 ← 1:IS95, 2:IS95A, 3:TSB74, 4,5:IS95B, 6:IS95C, protocol revision level.min_p_rev = 1 ← Minimum protocol revision that mobile can access system. It could use to prohibitthe mobile that can‘t support service from system.sid = 2236 (0x8bc) ←②nid = 113 (0x71) ←②pilot_pn = 188 (0xbc)lc_state[HI] = 507lc_state[LO] = 3582174253 ←Present long code statesys_time[HI] = 1sys_time[LO] = 4022462865 ←Difference present time between standard time (Jan 6, 00:00:00, 1980)lp_sec = 13 ←leap second count after system ―on‖ltm_off = 18 ← Local time offset (30minute unit) 18*30minute = 9 Hour★daylt = 1 ←daylight savings time (Allow ‗1‘, prohibit ‘0‘)★prat = 0 ←Paging channel data bps 0 : 9600bps , 1 : 4800bps★cdma_freq = 29 (0x1d) ← CDMA Channel Number including Primary Paging Channelext_cdma_freq = 29 (0x1d) ← Quick paging參考事項①msg_type (See vol4. LAC)Table 3.1.2.3.1.1.2-1. MSG_TYPE Values on f-csch②★SIN, NIDObiective : To help roamingRoaming condition : When SINs,NIDs mobile registered don‘t match NID, SID received.Classification : Home only, NID roamer, SID roamer(Simply ; SID = service provider idenfication number, SKT 011, STI 017, KDDI 090)NID = MSC idenfication number※If NID=65535, Mobile don‘t execute NID roaming. (To protect frequent roaming)1.2 General Page Message2001 Feb 5 07:46:54.201 PAGING CHANNEL -- General Page Msg (vol5. 3.7.2.3.2.17)protocol_rev = 6 (IS2000)chan_type = 1 (Paging)chanpc_msggenprot_disc = 0msg_id = 17gen_pageconfig_msg_seq = 6 ←①acc_msg_seq = 1 ←②class_0_done = 1 ← If GPM have information for class0 IMSI mobile, value is ―1‖.class_1_done = 1 ← If GPM have information for class1 IMSI mobile, value is ―1‖.tmsi_done = 1ordered_tmsis = 0broadcast_done = 1add_length = 0num_pages = 1 (0x1) ← Available paging CH numbergen_page[0]page_class = 0 ← Mobile do registration by class0 IMSI.page_subclass = 3 ←③Including IMSI11_12,MCC.IMSI_S, (See vol4 3.1.2.2.1.1.1.2-1)recformat3msg_seq = 0mcc = 349 (0x15d) ← Mobile Country Code (3 digits fixed) SK Telecom value 450(349+111)imsi_11_12 = 99 ← 99+11→‘00 ‗Mobile Network Code Now, SKT:‘00‘, STI: ‗22‘imsi_s[HI] = 3 ←④imsi_s[LO] = 2219332107special_service = 1 ← Ask service_option.★service_option = 3 (0x3) ←⑤Ask EVRC voice service.Consideration①Whenever system changes the message, the value should increase by the rest of ―CONFIG_SEQ/64‖.②Whenever BTS changes Access_para, BTS shall increases ACC_CONFIG_SEQ by the rest of ―ACC_CONFIG_SEQ/64‖.③If PAGE_SUBCLASS = 0, BTS don‘t send MCC and IMSI_11_12 on General Page Msg. In this case,MCC and IMSI_11_12 use the value in Extended system parameter msg. (When BSC = Wild ON)If value = ‗3‘, MCC and IMSI_11_12 use the value which Mobile have. (When BSC = Wild OFF)④IMSI Structure- MCC : Mobile Country Code (3 digits fixed)- MNC : Mobile Network Code- MSIN : Mobile Station Identification Number- NMSI : National Mobile Station Identity●IMSI type- IMSI_M : IMSI that is low 10 digit of MSIN(Mobile Station Identification Number) including MIN - IMSI_T : IMSI that have not MIN information- IMSI_O : IMSI that ME use practically in CDMA mode.- IMSI_S : IMSI that is low 10 digits of IMSI (in case of MIN based IMSI, low 10 digits is MIN .It would be said IMSI_M_S.)●Class- Class 0 IMSI : NMSI is just 12 digits.- Class 1 IMSI : NMSI is fewer than 12 digits.⑤service_option table descriptionExample) KDDI systemExtended System Parameters [ 14:22:56.841 ] Paging Channel[ 13:57:11.941 ] Paging Channel PROTOCOL_REV : 6PROTOCOL_REV : 0 General PageExtended System ParametersMSG_TYPE: 17MSG_TYPE: 13 CONFIG_MSG_SEQ: 6PILOT_PN: 426 ACC_MSG_SEQ: 6CONFIG_MSG_SEQ: 6 CLASS_0_DONE: 1DELETE_FOR_TMSI: 0 CLASS_1_DONE: 1USE_TMSI: 0 TMSI_DONE: 0PREF_MSID_TYPE: 3 ORDERED_TMSIS: 0MCC: 1023 BROADCAST_DONE: 1IMSI_11_12: 127 -> 38 ADD_LENGTH: 0TMSI_ZONE_LEN: 1 ADD_PFIELD:TMSI_ZONE: 0 PAGE_CLASS: 0BCAST_INDEX: 0 PAGE_SUBCLASS: 0 (See Consideration ②)MSG_SEQ: 022 00 07 10 C0 26 D1 4C 1A 43 82 00 16 0D D5 0C IMSI_S[HI]: 07F FF F1 00 00 60 34 86 10 00 02 AE 80 00 11 F5 IMSI_S[LO]: 14989986468C 72 -> MIN : 019-0466-9997Special_Service: 1Service_Option: 33(0x0021)1C 00 07 10 40 06 A1 28 2D 43 82 00 10 11 18 6C80 00 2C AC 73 BB 40 08 4 0 0A 27 2A★ Telephone Number calculation00 2C AC 73 BB 40 08 4 (= 0001011001 010******* 1001 1101110110 )Number : 019-0466-9997IMSI_T is fewer than 10 digits. Thus, 019-0466-9997 become 190 – 466 – 9 –997.1st : 1*100 + 9*10 + 10 *1 –111 = 89 = 00 0101 1001 2nd : 4*100 + 6*10 + 6 –111 = 355 = 01 0110 0011 3rd : 9 = 1010 (BCD code)4th : 997 = 9*100 + 9*10 + 7 –111 = 886 = 11 0111 0110imsi_s[HI](2bits) imsi_s[LO] (32 bit)1.3 Neighbor List Message2001 Feb 5 07:46:53.022 PAGING CHANNEL -- Neighbor List Msg protocol_rev = 6 (IS2000) (V ol5. 2.6.2.2.3, 3.7.2.3.2.3) chan_type = 1 (Paging) chan pc_msg genprot_disc = 0 msg_id = 3 nghbrpilot_pn = 188 (0xbc) <- Decimal 188 (HEXA bc), config_msg_seq = 6★ pilot_inc = 2 <- Mobile only checks Remain Set by a multiple of pilot_inc. (Range: 1~15 integer) num_nghbrs = 19 (0x13) <- PN 188 Neighbor List 19EA nghbr[0] <- First Neighbor on neighbor listsIMSI_S Digits 1010104nghbr_config = 0 (Config Same) <- ①If value=0, mobile receives Paging in same CDMA channel forneighbor. (range 0~3). See. Table 3.7.2.3.2.3-1nghbr_pn = 356 (0x164)nghbr[1]nghbr_config = 0 (Config Same)nghbr_pn = 454 (0x1c6)nghbr[2]nghbr_config = 0 (Config Same)nghbr_pn = 274 (0x112)nghbr[3]nghbr_config = 0 (Config Same)nghbr_pn = 20 (0x14)nghbr[4]nghbr_config = 0 (Config Same)nghbr_pn = 466 (0x1d2)nghbr[5]nghbr_config = 0 (Config Same)nghbr_pn = 352 (0x160)nghbr[6]nghbr_config = 0 (Config Same)nghbr_pn = 232 (0xe8)nghbr[7]nghbr_config = 0 (Config Same)nghbr_pn = 442 (0x1ba)nghbr[8]nghbr_config = 0 (Config Same)nghbr_pn = 286 (0x11e)nghbr[9]nghbr_config = 0 (Config Same)nghbr_pn = 106 (0x6a)nghbr[10]nghbr_config = 0 (Config Same)nghbr_pn = 58 (0x3a)nghbr[11]nghbr_config = 0 (Config Same)nghbr_pn = 200 (0xc8)nghbr[12]nghbr_config = 0 (Config Same)nghbr_pn = 492 (0x1ec)nghbr[13]nghbr_config = 0 (Config Same)nghbr_pn = 118 (0x76)nghbr[14]nghbr_config = 0 (Config Same)nghbr_pn = 16 (0x10)nghbr[15]nghbr_config = 0 (Config Same)nghbr_pn = 400 (0x190)nghbr[16]nghbr_config = 0 (Config Same)nghbr_pn = 192 (0xc0)nghbr[17]nghbr_config = 0 (Config Same)nghbr_pn = 250 (0xfa)nghbr[18]nghbr_config = 0 (Config Same)nghbr_pn = 386 (0x182)Consideration①nghber_config = 000 : Same paging channel number, Same CDMA Ch (FA)nghber_config = 001 : Primary paging paging channel number, Same CDMA Ch (FA)nghber_config = 010 : Primary paging channel number, First CDMA Ch on serving FAnghber_config = 011 : Transit initial state1.4 CDMA Channel List Message2001 Feb 5 07:46:53.082 PAGING CHANNEL -- CDMA Channel List Msgprotocol_rev = 6 (IS2000)(See V ol5. 2.6.2.2.4 and 3.7.2.3.2.4)chan_type = 1 (Paging)chanpc_msggenprot_disc = 0msg_id = 4chnlistpilot_pn = 188 (0xbc)config_msg_seq = 6 <- Ignore it if Chan_Lst_Msg_Seq value in mobile equal to this value.(See V ol5. 3.6.2.2)num_freq = 1 (0x1) <- Now, serving FA total numbers (Channel List number)★cdma_freq[0] = 29 (0x1d) <- 29 = channel number (Center frequency = (0.03*29)+870 Mhz) 1.5 Extended System Parameters Message2001 Feb 5 07:46:53.181 PAGING CHANNEL -- Extended System Parameters Msg protocol_rev = 6 (IS2000) (See V ol5. 2.6.2.2.5, 3.7.2.3.2.13) chan_type = 1 (Paging)chanpc_msggenprot_disc = 0msg_id = 13ext_sysparmpilot_pn = 188 (0xbc)config_msg_seq = 6 <- Ignore it if Ext_Sys_par_Msg_Seq value in mobile is equal to this value.Update it if Ext_Sys_par_Msg_Seq value in mobile don‘t be equal to this value.delete_for_tmsi = 0 <- Delete foreign TMSI. If TMSI_ZONE assigns other TMSI zone, BTS makesmobile delete the own TMSI.pref_msid_type = 3 <- Preferred Access Channel Mobile Station Identifier TypeValue = 3, mobile use IMSI and ESN in access channel. (See Table 3.7.2.3.2.13-1) mcc = 349 (0x15d) <- ①Mobile Country Code, (See 2.3.1)imsi_11_12 = 99 <- 11th and 12th digits for the IMSI, (See 2.3.1)tmsi_zone_len = 0 ②<- TMSI_ZONE_LENGTH, Range 1~8 octet (Shall include TMSI_ZONE)tmsi_zone[HI] = 0 <- TMSI zone numbertmsi_zone[LO] = 0bcast_index = 0 <- Broadcast slot cycle index, If value = 0, it don‘t execute broadcast paging.Range (1 ~ 7), See. V ol5. 2.6.1.1.3.3is95b_incl = 1imsi_t_supported = 0 <- If system supports 15-digit IMSI_T addressing, set the field= 1.p_rev = 6min_p_rev = 1 <- If Mob_P_Rev that mobile can support is upper than minimum protocol revisionsupported by BTS, record parameter.★soft_slope = 0 <- See V ol5. 2.6.6.2.3, 2.6.6.2.5.2★add_intercept = 0 <- See V ol5. 2.6.6.2.3, 2.6.6.2.5.2★drop_intercept = 0 <- See V ol5. 2.6.6.2.3, 2.6.6.2.5.2packet_zone_id = 0 <- System don‘t concern packet data service zone.max_num_alt_so = 0 <- Maximum number of alternative service optionsreselect_included = 0 <- In case value =0, BTS don‘t include system reselection parameter.pilot_report = 0 <- If value=0, mobile reports additional pilot exceeding T_ADD by Origination Messageand Page Response Message only. If value = 1, mobile uses all Access Channelmessages to report pilot(s) exceeding T_ADD.nghbr_set_entry_info = 0 <- Neighbor Set access entry handoff information included indicator.Set ‗1‘, if message has ―TS Neighbor Set access entry handoff‖.Set ‗0‘. If message has not.nghbr_set_access_info = 0 <- Neighbor Set access handoff included indicator, Set‗1‘,if BTS has informationabout ―Neighbor Set access handoff‖or ―access probe handoff‖. Set‗0‘, BTS don‘t have.is2000_incl = 1broadcast_gps_asst = 0 <- Value = 1, if system support Broadcast GPS Assist capability.★qpch_supported = 0 <- Value=0, if system don‘t support Quick Paging Channel.sdb_supported = 1 <- Value=1, if Mobile allow to send Short Data Burst.rlgain_traffic_pilot = 0 <- In case of RC > 2, if Reverse Traffic Channel adjusts Reverse Pilot Channel gain, set the value = 1. (See V ol2. 2.1.2.3.3)rev_pwr_cntl_delay_incl = 0 <- If this message include Rev_Pwr_Cntl_Delay field, set value=1.is2000_relA_incl = 0enc_supported_incl = 1enc_supported = 0 <- Set ‗1‘, if it includes field related on Encryption.is2000_relA_last2_incl = 1use_sync_id = 0cs_supported = 0Consideration①NMSI MCC Mobile Country CodeMNC Mobile Network CodeMSIN Mobile Station Identif ier NumberNMSI National Mobile Station IdentityIMSI International Mobil Station IdentityFigure 2.3.1-1. IMSI Structure②TMSI (Temporary Mobile Station Identity)This code doesn‘t have any relationship with IMSI, ESN. BTS assigns TMSI for termination call.Full TMSI = INSI_CODE (2,3, or 4 octet) + TMSI_ZONE (1~8 octet).★Extended system parameter in KDDI Motorola system[ 14:22:51.101 ] Paging ChannelPROTOCOL_REV : 6Extended System ParametersMSG_TYPE: 13PILOT_PN: 426CONFIG_MSG_SEQ: 6DELETE_FOR_TMSI: 0USE_TMSI: 0PREF_MSID_TYPE: 3MCC: 1023IMSI_11_12: 127 -> 38TMSI_ZONE_LEN: 1TMSI_ZONE: 0BCAST_INDEX: 0 IMSI_T_SUPPORTED: 0 P_REV: 6 MIN_P_REV: 3 SOFT_SLOPE: 18 ADD_INTERCEPT: 6 DROP_INTERCEPT: 4 PACKET_ZONE_ID: 0 MAX_NUM_ALT_SO: 0 RESELECTED_INCLUDED: 0 PILOT_REPORT: 0NGHBR_SET_ENTRY_INFO: 0 NGHBR_SET_ACCESS_INFO: 0 BROADCAST_GPS_ASST: 0QPCH_SUPPORTED: 1 (1 = Quick channel ―on ‖)NUM_QPCH: 1 (If QPCH_SUPPORTED = 1, UNM_QPCH shall not be ―00‖) QPCH_RA TE: 0 (0 = 4800 bps, 1=9600 bps)★QPCH_POWER_LEVEL_PAGE: 5 (If QPCH_SUPPORTED = 1, message shall contain this message) ---ⓐ QPCH_CCI_SUPPORTED: 1 (If QPCH_SUPPORTED = 1, message shall contain this message. Set ‗1‘,if system support configuration change) QPCH_PWR_LVL_CFG: 5 ---ⓐSDB_SUPPORTED: 0 (Set ‗1‘, if system supports ―short data burst ‖) MAC_CF_SUPPORTED: 0RLGAIN_TRAFFIC_PILOT: 0.00 Reverse Pilot power control RC2 above. (0.123dB unit) See 2.1.2.3.3. REV_PWR_CNTL_DELAY_INCL: 0ⓐ Table 3.7.2.3.2.13-3 Quick Paging Channel Transmit Power LevelTable 2.1.2.3.3.2-1 Reverse link Nominal Attribute Gain Table (Part 1 of 2)Table 2.1.2.3.3.2-1 Reverse link Nominal Attribute Gain Table (Part 1 of 2)1.6 General Neighbor List Message2001 Feb 5 07:46:53.403 PAGING CHANNEL -- General Neighbor List Msg protocol_rev = 6 (IS2000)chan_type = 1 (Paging)chanpc_msggenprot_disc = 0msg_id = 22gen_nghbrpilot_pn = 188 (0xbc)config_msg_seq = 6pilot_inc = 2nghbr_srch_mode = 0nghbr_config_pn_incl = 0freq_fields_incl = 0use_timing = 0num_nghbr = 19nghbr[0]nghbr[1]nghbr[2]nghbr[3]nghbr[4]nghbr[5]nghbr[6]nghbr[7]nghbr[8]nghbr[9]nghbr[10]nghbr[11]nghbr[12]nghbr[13]nghbr[14]nghbr[15]nghbr[16]nghbr[17]nghbr[18]num_analog_nghbr = 0 is2000_incl = 1srch_offset_incl = 0 add_nghbr[0]add_pilot_rec_incl = 0 add_nghbr[1]add_pilot_rec_incl = 0 add_nghbr[2]add_pilot_rec_incl = 0 add_nghbr[3]add_pilot_rec_incl = 0 add_nghbr[4]add_pilot_rec_incl = 0 add_nghbr[5]add_pilot_rec_incl = 0 add_nghbr[6]add_pilot_rec_incl = 0 add_nghbr[7]add_pilot_rec_incl = 0 add_nghbr[8]add_pilot_rec_incl = 0 add_nghbr[9]add_pilot_rec_incl = 0 add_nghbr[10]add_pilot_rec_incl = 0 add_nghbr[11]add_pilot_rec_incl = 0 add_nghbr[12]add_pilot_rec_incl = 0add_nghbr[13]add_pilot_rec_incl = 0add_nghbr[14]add_pilot_rec_incl = 0add_nghbr[15]add_pilot_rec_incl = 0add_nghbr[16]add_pilot_rec_incl = 0add_nghbr[17]add_pilot_rec_incl = 0add_nghbr[18]add_pilot_rec_incl = 01.7 System Parameters Message2001 Feb 5 07:46:53.981 PAGING CHANNEL -- System Parameters Msg(See V ol5. 2.6.2.2.1 and 3.7.2.3.2.1)<- If ―PAGE_CHAN, REG_PRD, BASE_LAT, BASE_LONG, or PWR_REP_THRESH‖ are out range designated (See. 3.7.2.3.2.1), Mobile shall ignore ―system p arameters Message‖ that include their.protocol_rev = 6 (IS2000)chan_type = 1 (Paging)chanpc_msggenprot_disc = 0msg_id = 1sysparmpilot_pn = 188 (0xbc) (12032 PN chips)config_msg_se q = 6 <- When mobile receives ―System Parameters‖thru paging channel, mobile shallcompare ―configuration message sequence number‖, ―CONFIG_MSG_SEQ r,SYS_PAR_MSG_SEQ s‖ with stored value.If values compared are same, mobile may ignore the message. If values comparedaren‘t same, mobile shall process the remain field. (Detail processes arethere ―2.6.2.2.1.1, 2.6.2.2.1.2, 2.6.2.2.1.3, 2.6.2.2.1.4, 2.6.2.2.1.5, and2.6.2.2.1.6)★sid = 2236 (0x8bc) <- System identification, (See V ol5. 2.6.5.2)★nid = 113 (0x71) <- Network identification. It is supplied by ―system sub-identifier‖.(See V ol5. 2.6.5.20)★reg_zone = 1 (0x1) <- Registration zone number, (See V ol5. 2.6.5.1.5)★total_zones = 2 (unknown) <- zone number that mobile have for zone-based registration. . Sets ‗0‘, ifzone-based registration is disable. If we set value high, advantage isthat mobile can save battery consumption, but disadvantage is thatprobability to receiving 1st paging get low in zone boundary. (See V ol5.2.6.5.1.5)★zone_timer = 1 (2 Minutes) <- zone timer registration length, V ol5. Table 3.7.2.3.2.1-1mult_sids = 1 <- Set ‗1‘, if mobile stores SID_NID_List that have different SID. Set ‗0‘,if not.mult_nids = 1 <- Set ‗1‘, if mobile stores SID_NID_List that have different NID, Set ―0‘,if not.base_id = 2 (0x2)base_class = 0 (Public Macrocellular System) <- ①BTS type,(0 means public macrocellular system) page_chan = 1 <- paging channel count.★max_slot_cycle_index = 2 <- See. V ol5. 2.6.2.1.1home_reg = 1 <- See. Page 25for_sid_reg = 1 <- See. Page 25for_nid_reg = 1 <- See. Page 25power_up_reg = 1 <- When mobile power ‗on‘, or try roaming from analog system, do registration. power_down_reg = 1 <- When mobile power ‗off‘parameter_reg = 1 ③reg_prd = 64 (5242.88 Seconds, REG_COUNT_MAX = [2 reg_prd/4]*0.08). In case value=0,reg_prd is off. base_lat = 539805 ②base_long = 1829097 ②reg_dist = 0 (0x0) ②(Distance Based Registration DISABLED)★srch_win_a = 9 (80 PN Chips)★srch_win_n = 10 (100 PN Chips)★srch_win_r = 10 (100 PN Chips)★nghbr_max_age = 1★pwr_rep_thresh = 2 <-(Send PMRM, if mobile receive 2 error frames)★pwr_rep_frames = 7 <-(56 Frames=2(pwr_ref_frames/2)*5)★pwr_thresh_enable = 1 <-(1: threshold basis report on)★pwr_period_enable = 0 <-(0: period report off)★pwr_rep_delay = 5 <-(After sending PMRM, new period starts 21th frame (after delaying 20 frames) rescan = 0★t_add = 28★t_drop = 32★t_comp = 5★t_tdrop = 3ext_sys_parameter = 1 <- Set number #1, if Extended system parameters message exists.ext_nghbr_list = 0 <- Set #1, if extended neighbor list message is sent by paging channel.Set #0, if BTS uses Band Class 0.gen_nghbr_list = 1 <- Set #1, if General Neighbor List Message is sent by paging channel.global_redirect = 0 <- Set #1, if Global Service Redirection Message is sent by paging channel.is2000_incl = 1pri_nghbr_list = 0 <- Set #1, if Private Neighbor List Message is sent by paging channel.user_zone_id = 0 <- Set #1, if User Zone Identification Message is sent by paging channel.ext_global_redirect = 0 <- Set #1, if Extended Global Service Redirection is sent by pagingchannel.ext_chan_list = 0 <- Set #1, if Extended CDMA Channel List Message is sent by Paging Channel.Consideration ①Table 3.7.2.3.2.1-2. Base Station Classes② ⎥⎥⎦⎤⎢⎢⎣⎡∆+∆=16)()(tan 22long lat ce Dis∆ lat = BASE_LAT (present location) – BASE_LAT_REG (previous registration location)∆ long = (BASE_LAT (present location) – BASE_LAT_REG (previous registration location)) ×cos (π/180 × BASE_LAT_REG/14400)③ When these parameter are changed;SLOT_SYCLE_INDEX, SCM, MOB_TERM_HOME (MOB_TERM_FOR_SID, MOB_TERM_FOR_NID). And, when NID, SID value received doesn‘t locate on SID_NID_LIST mobile have.(As usual, when SLOT_CYCLE_INDEX, SID_NID_LIST change, registration procedure is done.)★ Registration Zone Base registrationConditions1.Mobile has 7-zones_maximum. (Total_zone)2.Mobile stores ―reg_zone, SID, NID of each zone ‖.Operation1.Mobile has been comparing Zone_list information registered and system_para message received.2.If mobile receive new zone_list, mobile store it and start registration.If mobile receive stored zone_list, mobile ignore it.3.Stored zone_list has timer, thus All zone_lists will be deleted after designated time.Example) Total zone = 1 case:Mobile have only one zone_list. Whenever mobile move zone A to zone B, zone B to zone A, The mobile starts registration. Thus mobile become a ping-pong state.Disadvantage: reverse noise and system overloadAdvantage: Sure registration.Example) Total zone = 2 case:First, when mobile move zone A to zone B, do registration.Second, when mobile return zone A, don‘t registration until time expired.Third, When time expire, mobile start registration at zone A.Disadvantage: Increase 1st paging fail. (50% at boundary)Advantage: Reduce system overload. (MSC, VLR), reverse noise.Table 3.7.2.3.2.1-1 Value of Zone TimerParameter registrationObjective: At MSC boundary, It help registration, when mobile receive new SID, NID comparing Zone_list stored. MSC/VLR stores location information. HLR updates it and deleteprevious MSC/VLR information.Registration basic setting1.8 Access Parameters Message2001 Feb 5 07:46:54.141 PAGING CHANNEL -- Access Parameters Msgprotocol_rev = 6 (IS2000)(See V ol5. 2.6.2.2.2 and 3.7.2.3.2.2) chan_type = 1 (Paging)chanpc_msggenprot_disc = 0msg_id = 2accparmpilot_pn = 188 (0xbc)acc_msg_seq = 1 <- After comparing exist value with new acc_msg_seq received, update it iftwo values are not same.acc_chan = 0 <- Access channel number related on paging channel.★nom_pwr = 0 <- Nominal transmit power offset. At doing open loop power estimate, correctionfactor is used by mobile. (-8dB ~ +7dB)★init_pwr = 5 <- 5dB, Initial power offset for access. Correction factor used by mobile at beginning of open loop power estimation for initial Access Channel transmission.(-16dB ~ +15dB)★pwr_step = 6 <- 6dB, power interval between probes until mobile access successfully.★num_step = 5 <- During single access probe sequence, access probe number that mobile transmits.★max_cap_sz = 3 ①<- Maximum Access Channel message capsule size, 0 ~ 7★pam_sz = 3 ①<- Access Channel preamble length. Mobile sets lower value than access frame counts that each Access Channel preamble can transmit.psist_0_9 = 0psist_10 = 0 <- test mobile stationpsist_11 = 0 <- emergency mobile stationpsist_12 = 0psist_13 = 0psist_14 = 0psist_15 = 0msg_psist = 0 <- Persistence modifier for Access Channel attempts for message transmissions,(Mobile uses 2-msg_psist unit to improve transmit probability.)reg_psist = 0 <- Persistence modifier for Access Channel attempts for registrations which arenot responses to the Registration Request Order,(Mobile uses 2-reg_psist unit to go up transmit probability.)★probe_pn_ran = 0,②<-Time randomization for Access Channel probes, 0 ~ 9 (RN max = 2probe_pn_ran –1) acc_tmo = 5 ②<- After transmitting each access probe, mobile waits for BTS response during duration (TA=(2+ACC_TMO)*80ms) from end of slot.probe_bkoff = 0 ②<- When Mobile don‘t receive ―access probe ack‖, transmit access probe againwith additional back off delay (RT = 0 ~ probe_bkoff+1 slot).bkoff = 1 ②<- RS that all access probe sequence have 0 ~ 1+BKOFF slot. backoff delay happens pseudorandomly.★max_req_seq = 2 <- When mobile requests thru Access Channel, 2 mean maximum number of access probe sequence★max_rsp_seq = 2 <- When mobile response thru Access Channel. 2 mean maximum number of access probe sequence.auth = 0nom_pwr_ext = 1 <- Extended nominal transmit power, Set 0, if mobile operates Band Class 0.psist_emg_incl = 0 <- Emergency persistence included indicator, Set 0, parameter don‘t includePSIST_EMG.①Access channel slot = (3+max_cap_size) + (1+pam_size) frame unit1 frame preamble = 96 EA zeroCase study)If many subscribers stay near by BTS, small preamble value increases access failure probability.And, big preamble value reduces payload data, BTS shall increase search window size.②Objective : To prohibit the collision because mobile send a message randomly.probe_pn_ran : (range 0~512)*0.8138㎲---- ESN decides the value.★PowerAccess probe Tx= -Rx –73 +Nom_pwr +Init_pwr+ (Access Probe –1)*pwr_step1st Tx on Reverse TCH Tx = -Rx –73 +Nom_pwr+Init_pwr+All access probe corrections1st Power control bit receive Tx= -Rx-73+Nom_pwr+Init_pwr+All probe corrections +All close loop power controlTerminologyAccess probeAccess sequenceIP: Initial open loop powerPD: persistence delayPI: Power incrementRA: Access channel numberRN: PN randomization delayRS: Sequence backoffRT: Probe_backoffTA: Ack response timer (80*(2+ACC_TMO))Num_step: maximum access number of access sequence[ 13:57:11.581 ] Paging Channel (Motorola system logging data)[ 13:57:29.209 ] Access probe info PROTOCOL_REV : 0 PROTOCOL_REV : 0Access ParametersSEQ_NUM: 1MSG_TYPE: 2 PROBE_NUM: 1PILOT_PN: 426 RX_AGC: 224ACC_MSG_SEQ: 6 TX_ADJ: 0ACC_CHAN: 0 RSIST: 1NOM_PWR: 3 CHANNEL: 0INIT_PWR: 29 ⓐ(-3 -> 2‘complement)RANDOM_M: 0PWR_STEP: 5 BACKOFF_RS: 0NUM_STEP: 3 BACKOFF_RT: 0MAX_CAP_SZ: 3PAM_SZ: 0PSIST(0-9): 0PSIST(10-15): 0 0 0 0 0 0MSG_PSIST: 0REG_PSIST: 0PROBE_PN_RAN: 0ACC_TMO: 1PROBE_BKOFF: 0BKOFF: 0MAX_REQ_SEQ: 2MAX_RSP_SEQ: 3AUTH: 0NOM_PWR_EXT: 0PSIST_EMG_INCL: 0ⓐReal value is –3. But, System sending data is 111101 (29). 2‘ complement of 000011 is 111101.Positive value +3 case, mobile shows 000011.1.9 Registration Message2001 Feb 5 07:47:58.830 ACCESS CHANNEL -- Registration Msg (vol5. 2.7.1.3.2.1)protocol_rev = 6 (IS2000)chan_type = 2 (Access)chanac_msggen_acmsg_type = 1 (Registration)hdrack_seq = 7msg_seq = 0ack_req = 1 ← 1: Ask ackvalid_ack = 0ack_type = 0msid_type = 3 ←IMSI and ESNmsidtype3esn = 3925846604imsiimsi_class = 0i_classzeroimsi_class_0_type = 0 ← Include IMSI_Stypezeroimsi_s[HI] = 0imsi_s[LO] = 137485978regauth_mode = 0 ← Not include authorizationpilot_rptfixactive_pilot_strength = 9 ← vol4 2.1.1.4.1.5.1first_is_active = 1 See Definition of Radio Environment Report Fieldsfirst_is_pta = 0num_add_pilots = 0 ← Number of additional (to the pilot in the Active Set)★reg_type = 1 ←①Power-up registration, ,slot_cycle_index = 2 ←②mob_p_rev = 6 ← 95C mobile, Protocol Revision of the mobile,scm = 42 ←③Station class mark, Now always ‗42‘.mob_term = 1 ← Accept mobile terminated callsreturn_cause = 0 ←④Normal accessqpch_supported = 1 ← If Mobile can support Quick Paging Channel, value=1.enhanced_rc = 1 ← Set ‗1‘, if system supports any RC in Radio Configuration Class2.Set ‗1‘, if don‘t support. (See vol2.1.3.7.2-1, vol2. 2.1.3.7.2.3.1) uzid_incl = 0 ← If Message includes User Zone Identifier, set the value 1.。